diff -Nru openssl-1.0.2g/debian/changelog openssl-1.0.2g/debian/changelog
--- openssl-1.0.2g/debian/changelog	2016-03-07 13:01:32.000000000 -0600
+++ openssl-1.0.2g/debian/changelog	2016-03-17 12:37:53.000000000 -0500
@@ -1,3 +1,10 @@
+openssl (1.0.2g-1ubuntu3~ppa2) xenial; urgency=medium
+
+  * debian/patches/ubuntu-fips140-2.patch: Add fips 140-2 selftests, 
+    support, and crypto changes for fips mode (LP: #1553309).
+
+ -- Joy Latten <joy.latten@canonical.com>  Tue, 15 Mar 2016 18:36:23 -0500
+
 openssl (1.0.2g-1ubuntu2) xenial; urgency=medium
 
   * debian/patches/arm64-aarch64_asm.patch: Enable aarch64 asm routines
diff -Nru openssl-1.0.2g/debian/patches/series openssl-1.0.2g/debian/patches/series
--- openssl-1.0.2g/debian/patches/series	2016-03-04 14:42:10.000000000 -0600
+++ openssl-1.0.2g/debian/patches/series	2016-03-17 12:37:53.000000000 -0500
@@ -19,3 +19,4 @@
 perlpath-quilt.patch
 no-sslv3.patch
 arm64-aarch64_asm.patch
+ubuntu-fips140-2.patch
diff -Nru openssl-1.0.2g/debian/patches/ubuntu-fips140-2.patch openssl-1.0.2g/debian/patches/ubuntu-fips140-2.patch
--- openssl-1.0.2g/debian/patches/ubuntu-fips140-2.patch	1969-12-31 18:00:00.000000000 -0600
+++ openssl-1.0.2g/debian/patches/ubuntu-fips140-2.patch	2016-03-17 12:37:53.000000000 -0500
@@ -0,0 +1,15678 @@
+commit bc063e757b6f63192c58b3099a94db30f058b8c1
+Author: Joy Latten <joy.latten@canonical.com>
+Date:   Mon Mar 14 20:45:32 2016 -0500
+
+    Add fips selftest and crypto changes
+
+diff --git a/Configure b/Configure
+index 571aefc..1fcc34e 100755
+--- a/Configure
++++ b/Configure
+@@ -1115,11 +1115,6 @@ if (defined($disabled{"md5"}) || defined($disabled{"rsa"}))
+ 	$disabled{"ssl2"} = "forced";
+ 	}
+ 
+-if ($fips && $fipslibdir eq "")
+-	{
+-	$fipslibdir = $fipsdir . "/lib/";
+-	}
+-
+ # RSAX ENGINE sets default non-FIPS RSA method.
+ if ($fips)
+ 	{
+@@ -1608,7 +1603,6 @@ $cflags.=" -DOPENSSL_BN_ASM_GF2m" if ($bn_obj =~ /-gf2m/);
+ if ($fips)
+ 	{
+ 	$openssl_other_defines.="#define OPENSSL_FIPS\n";
+-	$cflags .= " -I\$(FIPSDIR)/include";
+ 	}
+ 
+ $cpuid_obj="mem_clr.o"	unless ($cpuid_obj =~ /\.o$/);
+@@ -1813,9 +1807,12 @@ while (<IN>)
+ 
+ 	s/^FIPSDIR=.*/FIPSDIR=$fipsdir/;
+ 	s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;
+-	s/^FIPSCANLIB=.*/FIPSCANLIB=libcrypto/ if $fips;
+ 	s/^BASEADDR=.*/BASEADDR=$baseaddr/;
+ 
++	if ($fips)
++		{
++		s/^FIPS=.*/FIPS=yes/;
++		}
+ 	s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/;
+ 	s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/;
+ 	s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared);
+diff --git a/Makefile.org b/Makefile.org
+index 0d98f8e..7567fba 100644
+--- a/Makefile.org
++++ b/Makefile.org
+@@ -136,6 +136,9 @@ FIPSCANLIB=
+ 
+ BASEADDR=
+ 
++# Non-empty if FIPS enabled
++FIPS=
++
+ DIRS=   crypto ssl engines apps test tools
+ ENGDIRS= ccgost
+ SHLIBDIRS= crypto ssl
+@@ -148,7 +151,7 @@ SDIRS=  \
+ 	bn ec rsa dsa ecdsa dh ecdh dso engine \
+ 	buffer bio stack lhash rand err \
+ 	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
+-	cms pqueue ts jpake srp store cmac
++	cms pqueue ts jpake srp store cmac fips
+ # keep in mind that the above list is adjusted by ./Configure
+ # according to no-xxx arguments...
+ 
+@@ -239,6 +242,7 @@ BUILDENV=	LC_ALL=C PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)'\
+ 		FIPSLIBDIR='${FIPSLIBDIR}'			\
+ 		FIPSDIR='${FIPSDIR}'				\
+ 		FIPSCANLIB="$${FIPSCANLIB:-$(FIPSCANLIB)}"	\
++		FIPS="$${FIPS:-$(FIPS)}"	\
+ 		THIS=$${THIS:-$@} MAKEFILE=Makefile MAKEOVERRIDES=
+ # MAKEOVERRIDES= effectively "equalizes" GNU-ish and SysV-ish make flavors,
+ # which in turn eliminates ambiguities in variable treatment with -e.
+diff --git a/apps/speed.c b/apps/speed.c
+index 95adcc1..a9c47af 100644
+--- a/apps/speed.c
++++ b/apps/speed.c
+@@ -197,7 +197,6 @@
+ #  ifdef OPENSSL_DOING_MAKEDEPEND
+ #   undef AES_set_encrypt_key
+ #   undef AES_set_decrypt_key
+-#   undef DES_set_key_unchecked
+ #  endif
+ #  define BF_set_key      private_BF_set_key
+ #  define CAST_set_key    private_CAST_set_key
+@@ -205,7 +204,6 @@
+ #  define SEED_set_key    private_SEED_set_key
+ #  define RC2_set_key     private_RC2_set_key
+ #  define RC4_set_key     private_RC4_set_key
+-#  define DES_set_key_unchecked   private_DES_set_key_unchecked
+ #  define AES_set_encrypt_key     private_AES_set_encrypt_key
+ #  define AES_set_decrypt_key     private_AES_set_decrypt_key
+ #  define Camellia_set_key        private_Camellia_set_key
+@@ -974,7 +972,12 @@ int MAIN(int argc, char **argv)
+ # endif
+ # ifndef OPENSSL_NO_RSA
+         if (strcmp(*argv, "rsa") == 0) {
+-            rsa_doit[R_RSA_512] = 1;
++#  ifdef OPENSSL_FIPS
++            if (!FIPS_mode())
++#  endif
++            {
++                rsa_doit[R_RSA_512] = 1;
++            }
+             rsa_doit[R_RSA_1024] = 1;
+             rsa_doit[R_RSA_2048] = 1;
+             rsa_doit[R_RSA_4096] = 1;
+@@ -982,7 +985,12 @@ int MAIN(int argc, char **argv)
+ # endif
+ # ifndef OPENSSL_NO_DSA
+         if (strcmp(*argv, "dsa") == 0) {
+-            dsa_doit[R_DSA_512] = 1;
++#  ifdef OPENSSL_FIPS
++            if (!FIPS_mode())
++#  endif
++            {
++                dsa_doit[R_DSA_512] = 1;
++            }
+             dsa_doit[R_DSA_1024] = 1;
+             dsa_doit[R_DSA_2048] = 1;
+         } else
+@@ -1233,13 +1241,19 @@ int MAIN(int argc, char **argv)
+ 
+     if (j == 0) {
+         for (i = 0; i < ALGOR_NUM; i++) {
+-            if (i != D_EVP)
++            if (i != D_EVP &&
++                (!FIPS_mode() || (i != D_WHIRLPOOL &&
++                                  i != D_MD2 && i != D_MD4 &&
++                                  i != D_MD5 && i != D_MDC2 &&
++                                  i != D_RMD160)))
+                 doit[i] = 1;
+         }
+         for (i = 0; i < RSA_NUM; i++)
+-            rsa_doit[i] = 1;
++            if (!FIPS_mode() || i != R_RSA_512)
++                rsa_doit[i] = 1;
+         for (i = 0; i < DSA_NUM; i++)
+-            dsa_doit[i] = 1;
++            if (!FIPS_mode() || i != R_DSA_512)
++                dsa_doit[i] = 1;
+ # ifndef OPENSSL_NO_ECDSA
+         for (i = 0; i < EC_NUM; i++)
+             ecdsa_doit[i] = 1;
+@@ -1299,30 +1313,46 @@ int MAIN(int argc, char **argv)
+     AES_set_encrypt_key(key32, 256, &aes_ks3);
+ # endif
+ # ifndef OPENSSL_NO_CAMELLIA
+-    Camellia_set_key(key16, 128, &camellia_ks1);
+-    Camellia_set_key(ckey24, 192, &camellia_ks2);
+-    Camellia_set_key(ckey32, 256, &camellia_ks3);
++    if (doit[D_CBC_128_CML] || doit[D_CBC_192_CML] || doit[D_CBC_256_CML]) {
++        Camellia_set_key(key16, 128, &camellia_ks1);
++        Camellia_set_key(ckey24, 192, &camellia_ks2);
++        Camellia_set_key(ckey32, 256, &camellia_ks3);
++    }
+ # endif
+ # ifndef OPENSSL_NO_IDEA
+-    idea_set_encrypt_key(key16, &idea_ks);
++    if (doit[D_CBC_IDEA]) {
++        idea_set_encrypt_key(key16, &idea_ks);
++    }
+ # endif
+ # ifndef OPENSSL_NO_SEED
+-    SEED_set_key(key16, &seed_ks);
++    if (doit[D_CBC_SEED]) {
++        SEED_set_key(key16, &seed_ks);
++    }
+ # endif
+ # ifndef OPENSSL_NO_RC4
+-    RC4_set_key(&rc4_ks, 16, key16);
++    if (doit[D_RC4]) {
++        RC4_set_key(&rc4_ks, 16, key16);
++    }
+ # endif
+ # ifndef OPENSSL_NO_RC2
+-    RC2_set_key(&rc2_ks, 16, key16, 128);
++    if (doit[D_CBC_RC2]) {
++        RC2_set_key(&rc2_ks, 16, key16, 128);
++    }
+ # endif
+ # ifndef OPENSSL_NO_RC5
+-    RC5_32_set_key(&rc5_ks, 16, key16, 12);
++    if (doit[D_CBC_RC5]) {
++        RC5_32_set_key(&rc5_ks, 16, key16, 12);
++    }
+ # endif
+ # ifndef OPENSSL_NO_BF
+-    BF_set_key(&bf_ks, 16, key16);
++    if (doit[D_CBC_BF]) {
++        BF_set_key(&bf_ks, 16, key16);
++    }
+ # endif
+ # ifndef OPENSSL_NO_CAST
+-    CAST_set_key(&cast_ks, 16, key16);
++    if (doit[D_CBC_CAST]) {
++        CAST_set_key(&cast_ks, 16, key16);
++    }
+ # endif
+ # ifndef OPENSSL_NO_RSA
+     memset(rsa_c, 0, sizeof(rsa_c));
+@@ -1605,6 +1635,7 @@ int MAIN(int argc, char **argv)
+         HMAC_CTX hctx;
+ 
+         HMAC_CTX_init(&hctx);
++        HMAC_CTX_set_flags(&hctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+         HMAC_Init_ex(&hctx, (unsigned char *)"This is a key...",
+                      16, EVP_md5(), NULL);
+ 
+diff --git a/crypto/aes/aes_misc.c b/crypto/aes/aes_misc.c
+index fafad4d..4ab7312 100644
+--- a/crypto/aes/aes_misc.c
++++ b/crypto/aes/aes_misc.c
+@@ -70,17 +70,11 @@ const char *AES_options(void)
+ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+                         AES_KEY *key)
+ {
+-#ifdef OPENSSL_FIPS
+-    fips_cipher_abort(AES);
+-#endif
+     return private_AES_set_encrypt_key(userKey, bits, key);
+ }
+ 
+ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+                         AES_KEY *key)
+ {
+-#ifdef OPENSSL_FIPS
+-    fips_cipher_abort(AES);
+-#endif
+     return private_AES_set_decrypt_key(userKey, bits, key);
+ }
+diff --git a/crypto/cmac/cmac.c b/crypto/cmac/cmac.c
+index 2954b6e..d86a011 100644
+--- a/crypto/cmac/cmac.c
++++ b/crypto/cmac/cmac.c
+@@ -105,12 +105,6 @@ CMAC_CTX *CMAC_CTX_new(void)
+ 
+ void CMAC_CTX_cleanup(CMAC_CTX *ctx)
+ {
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->cctx.engine) {
+-        FIPS_cmac_ctx_cleanup(ctx);
+-        return;
+-    }
+-#endif
+     EVP_CIPHER_CTX_cleanup(&ctx->cctx);
+     OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
+     OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
+@@ -160,20 +154,6 @@ int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
+             EVPerr(EVP_F_CMAC_INIT, EVP_R_DISABLED_FOR_FIPS);
+             return 0;
+         }
+-
+-        /* Switch to FIPS cipher implementation if possible */
+-        if (cipher != NULL) {
+-            const EVP_CIPHER *fcipher;
+-            fcipher = FIPS_get_cipherbynid(EVP_CIPHER_nid(cipher));
+-            if (fcipher != NULL)
+-                cipher = fcipher;
+-        }
+-        /*
+-         * Other algorithm blocking will be done in FIPS_cmac_init, via
+-         * FIPS_cipherinit().
+-         */
+-        if (!impl && !ctx->cctx.engine)
+-            return FIPS_cmac_init(ctx, key, keylen, cipher, NULL);
+     }
+ #endif
+     /* All zeros means restart */
+@@ -219,10 +199,7 @@ int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
+ {
+     const unsigned char *data = in;
+     size_t bl;
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->cctx.engine)
+-        return FIPS_cmac_update(ctx, in, dlen);
+-#endif
++
+     if (ctx->nlast_block == -1)
+         return 0;
+     if (dlen == 0)
+@@ -262,10 +239,7 @@ int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
+ int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
+ {
+     int i, bl, lb;
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->cctx.engine)
+-        return FIPS_cmac_final(ctx, out, poutlen);
+-#endif
++
+     if (ctx->nlast_block == -1)
+         return 0;
+     bl = EVP_CIPHER_CTX_block_size(&ctx->cctx);
+diff --git a/crypto/crypto.h b/crypto/crypto.h
+index 6c644ce..01efbc2 100644
+--- a/crypto/crypto.h
++++ b/crypto/crypto.h
+@@ -600,24 +600,29 @@ int FIPS_mode_set(int r);
+ void OPENSSL_init(void);
+ 
+ # define fips_md_init(alg) fips_md_init_ctx(alg, alg)
++# define nonfips_md_init(alg) nonfips_md_init_ctx(alg, alg)
++# define fips_md_init_ctx(alg, cx) \
++        int alg##_Init(cx##_CTX *c)
+ 
+ # ifdef OPENSSL_FIPS
+-#  define fips_md_init_ctx(alg, cx) \
++#  define nonfips_md_init_ctx(alg, cx) \
+         int alg##_Init(cx##_CTX *c) \
+         { \
+         if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
+-                "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
++                "Digest " #alg " forbidden in FIPS mode!"); \
+         return private_##alg##_Init(c); \
+         } \
+         int private_##alg##_Init(cx##_CTX *c)
+ 
+ #  define fips_cipher_abort(alg) \
+         if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
+-                "Low level API call to cipher " #alg " forbidden in FIPS mode!")
++                "Cipher " #alg " forbidden in FIPS mode!")
++
++/* die if FIPS selftest failed */
++void FIPS_selftest_check(void);
+ 
+ # else
+-#  define fips_md_init_ctx(alg, cx) \
+-        int alg##_Init(cx##_CTX *c)
++#  define nonfips_md_init_ctx(alg, cx) fips_md_init_ctx(alg, cx)
+ #  define fips_cipher_abort(alg) while(0)
+ # endif
+ 
+@@ -637,6 +642,9 @@ int CRYPTO_memcmp(const volatile void *a, const volatile void *b, size_t len);
+  */
+ void ERR_load_CRYPTO_strings(void);
+ 
++# define OPENSSL_HAVE_INIT       1
++void OPENSSL_init_library(void);
++
+ /* Error codes for the CRYPTO functions. */
+ 
+ /* Function codes. */
+diff --git a/crypto/des/des.h b/crypto/des/des.h
+index 1b40144..fe02e34 100644
+--- a/crypto/des/des.h
++++ b/crypto/des/des.h
+@@ -231,10 +231,6 @@ int DES_set_key(const_DES_cblock *key, DES_key_schedule *schedule);
+ int DES_key_sched(const_DES_cblock *key, DES_key_schedule *schedule);
+ int DES_set_key_checked(const_DES_cblock *key, DES_key_schedule *schedule);
+ void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule);
+-# ifdef OPENSSL_FIPS
+-void private_DES_set_key_unchecked(const_DES_cblock *key,
+-                                   DES_key_schedule *schedule);
+-# endif
+ void DES_string_to_key(const char *str, DES_cblock *key);
+ void DES_string_to_2keys(const char *str, DES_cblock *key1, DES_cblock *key2);
+ void DES_cfb64_encrypt(const unsigned char *in, unsigned char *out,
+diff --git a/crypto/des/set_key.c b/crypto/des/set_key.c
+index 8fd8fe1..5c63164 100644
+--- a/crypto/des/set_key.c
++++ b/crypto/des/set_key.c
+@@ -359,15 +359,6 @@ int DES_set_key_checked(const_DES_cblock *key, DES_key_schedule *schedule)
+ }
+ 
+ void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
+-#ifdef OPENSSL_FIPS
+-{
+-    fips_cipher_abort(DES);
+-    private_DES_set_key_unchecked(key, schedule);
+-}
+-
+-void private_DES_set_key_unchecked(const_DES_cblock *key,
+-                                   DES_key_schedule *schedule)
+-#endif
+ {
+     static const int shifts2[16] =
+         { 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0 };
+diff --git a/crypto/dh/dh.h b/crypto/dh/dh.h
+index a5bd901..cd08b18 100644
+--- a/crypto/dh/dh.h
++++ b/crypto/dh/dh.h
+@@ -77,6 +77,9 @@
+ #  define OPENSSL_DH_MAX_MODULUS_BITS    10000
+ # endif
+ 
++# define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
++# define OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN 2048
++
+ # define DH_FLAG_CACHE_MONT_P     0x01
+ 
+ /*
+diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c
+index 5bedb66..db9f700 100644
+--- a/crypto/dh/dh_gen.c
++++ b/crypto/dh/dh_gen.c
+@@ -85,10 +85,6 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
+ #endif
+     if (ret->meth->generate_params)
+         return ret->meth->generate_params(ret, prime_len, generator, cb);
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_dh_generate_parameters_ex(ret, prime_len, generator, cb);
+-#endif
+     return dh_builtin_genparams(ret, prime_len, generator, cb);
+ }
+ 
+@@ -126,6 +122,18 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
+     int g, ok = -1;
+     BN_CTX *ctx = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DH_BUILTIN_GENPARAMS, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++
++    if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN)) {
++        DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
++
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+         goto err;
+diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
+index 1d80fb2..1c24715 100644
+--- a/crypto/dh/dh_key.c
++++ b/crypto/dh/dh_key.c
+@@ -61,6 +61,9 @@
+ #include <openssl/bn.h>
+ #include <openssl/rand.h>
+ #include <openssl/dh.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static int generate_key(DH *dh);
+ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
+@@ -97,7 +100,7 @@ int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+ int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+ {
+     int rv, pad;
+-    rv = dh->meth->compute_key(key, pub_key, dh);
++    rv = DH_compute_key(key, pub_key, dh);
+     if (rv <= 0)
+         return rv;
+     pad = BN_num_bytes(dh->p) - rv;
+@@ -115,7 +118,7 @@ static DH_METHOD dh_ossl = {
+     dh_bn_mod_exp,
+     dh_init,
+     dh_finish,
+-    0,
++    DH_FLAG_FIPS_METHOD,
+     NULL,
+     NULL
+ };
+@@ -134,6 +137,14 @@ static int generate_key(DH *dh)
+     BN_MONT_CTX *mont = NULL;
+     BIGNUM *pub_key = NULL, *priv_key = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode()
++        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {
++        DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
++        return 0;
++    }
++#endif
++
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+         goto err;
+@@ -217,6 +228,13 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+         DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE);
+         goto err;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode()
++        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {
++        DHerr(DH_F_COMPUTE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
+ 
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+@@ -277,6 +295,9 @@ static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
+ 
+ static int dh_init(DH *dh)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     dh->flags |= DH_FLAG_CACHE_MONT_P;
+     return (1);
+ }
+diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c
+index bebc160..b38b4be 100644
+--- a/crypto/dh/dh_lib.c
++++ b/crypto/dh/dh_lib.c
+@@ -80,14 +80,7 @@ void DH_set_default_method(const DH_METHOD *meth)
+ const DH_METHOD *DH_get_default_method(void)
+ {
+     if (!default_DH_method) {
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode())
+-            return FIPS_dh_openssl();
+-        else
+-            return DH_OpenSSL();
+-#else
+         default_DH_method = DH_OpenSSL();
+-#endif
+     }
+     return default_DH_method;
+ }
+diff --git a/crypto/dsa/dsa.h b/crypto/dsa/dsa.h
+index 545358f..5c51116 100644
+--- a/crypto/dsa/dsa.h
++++ b/crypto/dsa/dsa.h
+@@ -88,6 +88,9 @@
+ #  define OPENSSL_DSA_MAX_MODULUS_BITS   10000
+ # endif
+ 
++# define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024
++# define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN (getenv("OPENSSL_ENFORCE_MODULUS_BITS")?2048:1024)
++
+ # define DSA_FLAG_CACHE_MONT_P   0x01
+ /*
+  * new with 0.9.7h; the built-in DSA implementation now uses constant time
+@@ -112,6 +115,7 @@
+  */
+ 
+ # define DSA_FLAG_NON_FIPS_ALLOW                 0x0400
++# define DSA_FLAG_FIPS_CHECKED			 0x0800
+ 
+ #ifdef  __cplusplus
+ extern "C" {
+@@ -249,9 +253,9 @@ int DSAparams_print_fp(FILE *fp, const DSA *x);
+ int DSA_print_fp(FILE *bp, const DSA *x, int off);
+ # endif
+ 
+-# define DSS_prime_checks 50
++# define DSS_prime_checks 64
+ /*
+- * Primality test according to FIPS PUB 186[-1], Appendix 2.1: 50 rounds of
++ * Primality test according to FIPS PUB 186-4, Appendix 2.1: 64 rounds of
+  * Rabin-Miller
+  */
+ # define DSA_is_prime(n, callback, cb_arg) \
+@@ -287,6 +291,8 @@ void ERR_load_DSA_strings(void);
+ # define DSA_F_DO_DSA_PRINT                               104
+ # define DSA_F_DSAPARAMS_PRINT                            100
+ # define DSA_F_DSAPARAMS_PRINT_FP                         101
++# define DSA_F_DSA_BUILTIN_KEYGEN                         127
++# define DSA_F_DSA_BUILTIN_PARAMGEN                       128
+ # define DSA_F_DSA_BUILTIN_PARAMGEN2                      126
+ # define DSA_F_DSA_DO_SIGN                                112
+ # define DSA_F_DSA_DO_VERIFY                              113
+@@ -318,6 +324,7 @@ void ERR_load_DSA_strings(void);
+ # define DSA_R_DECODE_ERROR                               104
+ # define DSA_R_INVALID_DIGEST_TYPE                        106
+ # define DSA_R_INVALID_PARAMETERS                         112
++# define DSA_R_KEY_SIZE_TOO_SMALL                         114
+ # define DSA_R_MISSING_PARAMETERS                         101
+ # define DSA_R_MODULUS_TOO_LARGE                          103
+ # define DSA_R_NEED_NEW_SETUP_VALUES                      110
+diff --git a/crypto/dsa/dsa_err.c b/crypto/dsa/dsa_err.c
+index f5ddc66..88c8cf9 100644
+--- a/crypto/dsa/dsa_err.c
++++ b/crypto/dsa/dsa_err.c
+@@ -74,12 +74,13 @@ static ERR_STRING_DATA DSA_str_functs[] = {
+     {ERR_FUNC(DSA_F_DO_DSA_PRINT), "DO_DSA_PRINT"},
+     {ERR_FUNC(DSA_F_DSAPARAMS_PRINT), "DSAparams_print"},
+     {ERR_FUNC(DSA_F_DSAPARAMS_PRINT_FP), "DSAparams_print_fp"},
++    {ERR_FUNC(DSA_F_DSA_BUILTIN_KEYGEN), "dsa_builtin_keygen"},
++    {ERR_FUNC(DSA_F_DSA_BUILTIN_PARAMGEN), "dsa_builtin_paramgen"},
+     {ERR_FUNC(DSA_F_DSA_BUILTIN_PARAMGEN2), "DSA_BUILTIN_PARAMGEN2"},
+     {ERR_FUNC(DSA_F_DSA_DO_SIGN), "DSA_do_sign"},
+     {ERR_FUNC(DSA_F_DSA_DO_VERIFY), "DSA_do_verify"},
+     {ERR_FUNC(DSA_F_DSA_GENERATE_KEY), "DSA_generate_key"},
+-    {ERR_FUNC(DSA_F_DSA_GENERATE_PARAMETERS_EX),
+-     "DSA_generate_parameters_ex"},
++    {ERR_FUNC(DSA_F_DSA_GENERATE_PARAMETERS_EX), "DSA_generate_parameters_ex"},
+     {ERR_FUNC(DSA_F_DSA_NEW_METHOD), "DSA_new_method"},
+     {ERR_FUNC(DSA_F_DSA_PARAM_DECODE), "DSA_PARAM_DECODE"},
+     {ERR_FUNC(DSA_F_DSA_PRINT_FP), "DSA_print_fp"},
+@@ -109,6 +110,7 @@ static ERR_STRING_DATA DSA_str_reasons[] = {
+     {ERR_REASON(DSA_R_DECODE_ERROR), "decode error"},
+     {ERR_REASON(DSA_R_INVALID_DIGEST_TYPE), "invalid digest type"},
+     {ERR_REASON(DSA_R_INVALID_PARAMETERS), "invalid parameters"},
++    {ERR_REASON(DSA_R_KEY_SIZE_TOO_SMALL), "key size too small"},
+     {ERR_REASON(DSA_R_MISSING_PARAMETERS), "missing parameters"},
+     {ERR_REASON(DSA_R_MODULUS_TOO_LARGE), "modulus too large"},
+     {ERR_REASON(DSA_R_NEED_NEW_SETUP_VALUES), "need new setup values"},
+diff --git a/crypto/dsa/dsa_gen.c b/crypto/dsa/dsa_gen.c
+index 15f3bb4..40a73bc 100644
+--- a/crypto/dsa/dsa_gen.c
++++ b/crypto/dsa/dsa_gen.c
+@@ -84,11 +84,9 @@
+ # include <openssl/rand.h>
+ # include <openssl/sha.h>
+ # include "dsa_locl.h"
+-
+-# ifdef OPENSSL_FIPS
+-/* Workaround bug in prototype */
+-#  define fips_dsa_builtin_paramgen2 fips_dsa_paramgen_bad
+-#  include <openssl/fips.h>
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
+ # endif
+ 
+ int DSA_generate_parameters_ex(DSA *ret, int bits,
+@@ -106,13 +104,6 @@ int DSA_generate_parameters_ex(DSA *ret, int bits,
+     if (ret->meth->dsa_paramgen)
+         return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
+                                        counter_ret, h_ret, cb);
+-# ifdef OPENSSL_FIPS
+-    else if (FIPS_mode()) {
+-        return FIPS_dsa_generate_parameters_ex(ret, bits,
+-                                               seed_in, seed_len,
+-                                               counter_ret, h_ret, cb);
+-    }
+-# endif
+     else {
+         const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();
+         size_t qbits = EVP_MD_size(evpmd) * 8;
+@@ -140,7 +131,19 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
+     int r = 0;
+     BN_CTX *ctx = NULL;
+     unsigned int h = 2;
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_BUILTIN_PARAMGEN, FIPS_R_FIPS_SELFTEST_FAILED);
++        goto err;
++    }
+ 
++    if (FIPS_module_mode() && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && ((bits != 1024 || qbits != 160) && (bits != 2048 || qbits != 224)
++        && (bits != 2048 || qbits != 256) && (bits != 3072 || qbits != 256))) {
++        DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN, DSA_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
+     if (qsize != SHA_DIGEST_LENGTH && qsize != SHA224_DIGEST_LENGTH &&
+         qsize != SHA256_DIGEST_LENGTH)
+         /* invalid q size */
+@@ -379,16 +382,76 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
+     return ok;
+ }
+ 
+-# ifdef OPENSSL_FIPS
+-#  undef fips_dsa_builtin_paramgen2
+-extern int fips_dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
+-                                      const EVP_MD *evpmd,
+-                                      const unsigned char *seed_in,
+-                                      size_t seed_len, int idx,
+-                                      unsigned char *seed_out,
+-                                      int *counter_ret, unsigned long *h_ret,
+-                                      BN_GENCB *cb);
+-# endif
++#ifdef OPENSSL_FIPS
++
++/* Security strength of parameter values for (L,N): see FIPS186-3 4.2
++ * and SP800-131A
++ */
++
++static int fips_ffc_strength(size_t L, size_t N)
++{
++	if (L >= 15360 && N >= 512)
++		return 256;
++	if (L >= 7680 && N >= 384)
++		return 192;
++	if (L >= 3072 && N >= 256)
++		return 128;
++	if (L >= 2048 && N >= 224)
++		return 112;
++	if (L >= 1024 && N >= 160)
++		return  80;
++	return 0;
++}
++
++/* Valid DSA2 parameters from FIPS 186-3 */
++
++static int dsa2_valid_parameters(size_t L, size_t N)
++{
++	if (L == 1024 && N == 160)
++		return 80;
++	if (L == 2048 && N == 224)
++		return 112;
++	if (L == 2048 && N == 256)
++		return 112;
++	if (L == 3072 && N == 256)
++		return 128;
++	return 0;
++}
++
++int fips_check_dsa_prng(DSA *dsa, size_t L, size_t N)
++{
++	int strength;
++
++	if (!FIPS_module_mode())
++		return 1;
++
++	if (dsa->flags & (DSA_FLAG_NON_FIPS_ALLOW|DSA_FLAG_FIPS_CHECKED))
++		return 1;
++
++	if (!L || !N) {
++		L = BN_num_bits(dsa->p);
++		N = BN_num_bits(dsa->q);
++	}
++	if (!dsa2_valid_parameters(L, N)) {
++		FIPSerr(FIPS_F_FIPS_CHECK_DSA_PRNG, FIPS_R_INVALID_PARAMETERS);
++		return 0;
++	}
++
++	strength = fips_ffc_strength(L, N);
++
++	if (!strength) {
++		FIPSerr(FIPS_F_FIPS_CHECK_DSA_PRNG,FIPS_R_KEY_TOO_SHORT);
++		return 0;
++	}
++
++	if (FIPS_rand_strength() >= strength)
++		return 1;
++
++	FIPSerr(FIPS_F_FIPS_CHECK_DSA_PRNG,FIPS_R_PRNG_STRENGTH_TOO_LOW);
++	return 0;
++
++}
++#endif /* OPENSSL_FIPS */
+ 
+ /*
+  * This is a parameter generation algorithm for the DSA2 algorithm as
+@@ -417,10 +480,13 @@ int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
+ 
+ # ifdef OPENSSL_FIPS
+ 
+-    if (FIPS_mode())
+-        return fips_dsa_builtin_paramgen2(ret, L, N, evpmd,
+-                                          seed_in, seed_len, idx,
+-                                          seed_out, counter_ret, h_ret, cb);
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_BUILTIN_PARAMGEN2, FIPS_R_FIPS_SELFTEST_FAILED);
++        goto err;
++    }
++
++    if (!fips_check_dsa_prng(ret, L, N))
++        goto err;
+ # endif
+ 
+     EVP_MD_CTX_init(&mctx);
+diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c
+index e8c8d2e..19e629c 100644
+--- a/crypto/dsa/dsa_key.c
++++ b/crypto/dsa/dsa_key.c
+@@ -66,6 +66,32 @@
+ 
+ # ifdef OPENSSL_FIPS
+ #  include <openssl/fips.h>
++#  include <openssl/evp.h>
++
++static int fips_check_dsa(DSA *dsa)
++{
++	EVP_PKEY *pk = NULL;
++	unsigned char tbs[] = "DSA Pairwise Check Data";
++	int ret = 0;
++
++	if ((pk=EVP_PKEY_new()) == NULL)
++		goto err;
++
++	EVP_PKEY_set1_DSA(pk, dsa);
++
++	if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))
++		ret = 1;
++err:
++	if (ret == 0) {
++		FIPSerr(FIPS_F_FIPS_CHECK_DSA, FIPS_R_PAIRWISE_TEST_FAILED);
++		fips_set_selftest_fail();
++	}
++
++	if (pk)
++		EVP_PKEY_free(pk);
++
++	return ret;
++}
+ # endif
+ 
+ static int dsa_builtin_keygen(DSA *dsa);
+@@ -81,10 +107,6 @@ int DSA_generate_key(DSA *dsa)
+ # endif
+     if (dsa->meth->dsa_keygen)
+         return dsa->meth->dsa_keygen(dsa);
+-# ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_dsa_generate_key(dsa);
+-# endif
+     return dsa_builtin_keygen(dsa);
+ }
+ 
+@@ -94,6 +116,14 @@ static int dsa_builtin_keygen(DSA *dsa)
+     BN_CTX *ctx = NULL;
+     BIGNUM *pub_key = NULL, *priv_key = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN)) {
++        DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++# endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+ 
+@@ -131,6 +161,13 @@ static int dsa_builtin_keygen(DSA *dsa)
+ 
+     dsa->priv_key = priv_key;
+     dsa->pub_key = pub_key;
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !fips_check_dsa(dsa)) {
++        dsa->pub_key = NULL;
++        dsa->priv_key = NULL;
++        goto err;
++    }
++# endif
+     ok = 1;
+ 
+  err:
+diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c
+index eb9d21d..13b3491 100644
+--- a/crypto/dsa/dsa_lib.c
++++ b/crypto/dsa/dsa_lib.c
+@@ -86,14 +86,7 @@ void DSA_set_default_method(const DSA_METHOD *meth)
+ const DSA_METHOD *DSA_get_default_method(void)
+ {
+     if (!default_DSA_method) {
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode())
+-            return FIPS_dsa_openssl();
+-        else
+-            return DSA_OpenSSL();
+-#else
+         default_DSA_method = DSA_OpenSSL();
+-#endif
+     }
+     return default_DSA_method;
+ }
+diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
+index efc4f1b..816ec91 100644
+--- a/crypto/dsa/dsa_ossl.c
++++ b/crypto/dsa/dsa_ossl.c
+@@ -65,6 +65,9 @@
+ #include <openssl/dsa.h>
+ #include <openssl/rand.h>
+ #include <openssl/asn1.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+@@ -83,7 +86,7 @@ static DSA_METHOD openssl_dsa_meth = {
+     NULL,                       /* dsa_bn_mod_exp, */
+     dsa_init,
+     dsa_finish,
+-    0,
++    DSA_FLAG_FIPS_METHOD,
+     NULL,
+     NULL,
+     NULL
+@@ -140,6 +143,22 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+     DSA_SIG *ret = NULL;
+     int noredo = 0;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_DO_SIGN, FIPS_R_FIPS_SELFTEST_FAILED);
++        return NULL;
++    }
++
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {
++        DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_KEY_SIZE_TOO_SMALL);
++        return NULL;
++    }
++
++    if (!fips_check_dsa_prng(dsa, 0, 0))
++	goto err;
++#endif
++
+     BN_init(&m);
+     BN_init(&xr);
+ 
+@@ -330,6 +349,18 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len,
+         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_BAD_Q_VALUE);
+         return -1;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_DO_VERIFY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {
++        DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);
++        return -1;
++    }
++#endif
+ 
+     if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
+         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_MODULUS_TOO_LARGE);
+@@ -410,6 +441,9 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len,
+ 
+ static int dsa_init(DSA *dsa)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     dsa->flags |= DSA_FLAG_CACHE_MONT_P;
+     return (1);
+ }
+diff --git a/crypto/ec/ec2_smpl.c b/crypto/ec/ec2_smpl.c
+index 5b27b91..d5cb4a9 100644
+--- a/crypto/ec/ec2_smpl.c
++++ b/crypto/ec/ec2_smpl.c
+@@ -73,10 +73,6 @@
+ 
+ #ifndef OPENSSL_NO_EC2M
+ 
+-# ifdef OPENSSL_FIPS
+-#  include <openssl/fips.h>
+-# endif
+-
+ const EC_METHOD *EC_GF2m_simple_method(void)
+ {
+     static const EC_METHOD ret = {
+@@ -124,11 +120,6 @@ const EC_METHOD *EC_GF2m_simple_method(void)
+         0                       /* field_set_to_one */
+     };
+ 
+-# ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return fips_ec_gf2m_simple_method();
+-# endif
+-
+     return &ret;
+ }
+ 
+diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c
+index 6dbe9d8..81846ec 100644
+--- a/crypto/ec/ec_curve.c
++++ b/crypto/ec/ec_curve.c
+@@ -75,10 +75,6 @@
+ #include <openssl/obj_mac.h>
+ #include <openssl/opensslconf.h>
+ 
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-#endif
+-
+ typedef struct {
+     int field_type,             /* either NID_X9_62_prime_field or
+                                  * NID_X9_62_characteristic_two_field */
+@@ -3162,10 +3158,6 @@ EC_GROUP *EC_GROUP_new_by_curve_name(int nid)
+     size_t i;
+     EC_GROUP *ret = NULL;
+ 
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_ec_group_new_by_curve_name(nid);
+-#endif
+     if (nid <= 0)
+         return NULL;
+ 
+diff --git a/crypto/ec/ec_cvt.c b/crypto/ec/ec_cvt.c
+index 5a832ba..010bd5f 100644
+--- a/crypto/ec/ec_cvt.c
++++ b/crypto/ec/ec_cvt.c
+@@ -82,10 +82,6 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
+     const EC_METHOD *meth;
+     EC_GROUP *ret;
+ 
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_ec_group_new_curve_gfp(p, a, b, ctx);
+-#endif
+ #if defined(OPENSSL_BN_ASM_MONT)
+     /*
+      * This might appear controversial, but the fact is that generic
+@@ -160,10 +156,6 @@ EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a,
+     const EC_METHOD *meth;
+     EC_GROUP *ret;
+ 
+-# ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_ec_group_new_curve_gf2m(p, a, b, ctx);
+-# endif
+     meth = EC_GF2m_simple_method();
+ 
+     ret = EC_GROUP_new(meth);
+diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
+index bc94ab5..d3fd257 100644
+--- a/crypto/ec/ec_key.c
++++ b/crypto/ec/ec_key.c
+@@ -64,9 +64,6 @@
+ #include <string.h>
+ #include "ec_lcl.h"
+ #include <openssl/err.h>
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-#endif
+ 
+ EC_KEY *EC_KEY_new(void)
+ {
+@@ -227,6 +224,38 @@ int EC_KEY_up_ref(EC_KEY *r)
+     return ((i > 1) ? 1 : 0);
+ }
+ 
++#ifdef OPENSSL_FIPS
++
++# include <openssl/evp.h>
++# include <openssl/fips.h>
++# include <openssl/fips_rand.h>
++
++static int fips_check_ec(EC_KEY *key)
++{
++    EVP_PKEY *pk;
++    unsigned char tbs[] = "ECDSA Pairwise Check Data";
++    int ret = 0;
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_EC_KEY(pk, key);
++
++    if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))
++        ret = 1;
++
++ err:
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_CHECK_EC, FIPS_R_PAIRWISE_TEST_FAILED);
++        fips_set_selftest_fail();
++    }
++    if (pk)
++        EVP_PKEY_free(pk);
++    return ret;
++}
++
++#endif
++
+ int EC_KEY_generate_key(EC_KEY *eckey)
+ {
+     int ok = 0;
+@@ -235,8 +264,10 @@ int EC_KEY_generate_key(EC_KEY *eckey)
+     EC_POINT *pub_key = NULL;
+ 
+ #ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_ec_key_generate_key(eckey);
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EC_KEY_GENERATE_KEY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
+ #endif
+ 
+     if (!eckey || !eckey->group) {
+@@ -277,6 +308,14 @@ int EC_KEY_generate_key(EC_KEY *eckey)
+     eckey->priv_key = priv_key;
+     eckey->pub_key = pub_key;
+ 
++#ifdef OPENSSL_FIPS
++    if (!fips_check_ec(eckey)) {
++        eckey->priv_key = NULL;
++        eckey->pub_key = NULL;
++        goto err;
++    }
++#endif
++
+     ok = 1;
+ 
+  err:
+@@ -414,10 +453,12 @@ int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x,
+             goto err;
+     }
+     /*
+-     * Check if retrieved coordinates match originals: if not values are out
+-     * of range.
++     * Check if retrieved coordinates match originals and are less
++     * than field order: if not values are out of range.
+      */
+-    if (BN_cmp(x, tx) || BN_cmp(y, ty)) {
++    if (BN_cmp(x, tx) || BN_cmp(y, ty)
++        || (BN_cmp(x, &key->group->field) >= 0)
++        || (BN_cmp(y, &key->group->field) >= 0)) {
+         ECerr(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES,
+               EC_R_COORDINATES_OUT_OF_RANGE);
+         goto err;
+diff --git a/crypto/ec/ecp_mont.c b/crypto/ec/ecp_mont.c
+index b2de7fa..bc9fd47 100644
+--- a/crypto/ec/ecp_mont.c
++++ b/crypto/ec/ecp_mont.c
+@@ -63,10 +63,6 @@
+ 
+ #include <openssl/err.h>
+ 
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-#endif
+-
+ #include "ec_lcl.h"
+ 
+ const EC_METHOD *EC_GFp_mont_method(void)
+@@ -111,11 +107,6 @@ const EC_METHOD *EC_GFp_mont_method(void)
+         ec_GFp_mont_field_set_to_one
+     };
+ 
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return fips_ec_gfp_mont_method();
+-#endif
+-
+     return &ret;
+ }
+ 
+diff --git a/crypto/ec/ecp_nist.c b/crypto/ec/ecp_nist.c
+index 3944e24..dbd2558 100644
+--- a/crypto/ec/ecp_nist.c
++++ b/crypto/ec/ecp_nist.c
+@@ -67,10 +67,6 @@
+ #include <openssl/obj_mac.h>
+ #include "ec_lcl.h"
+ 
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-#endif
+-
+ const EC_METHOD *EC_GFp_nist_method(void)
+ {
+     static const EC_METHOD ret = {
+@@ -113,11 +109,6 @@ const EC_METHOD *EC_GFp_nist_method(void)
+         0                       /* field_set_to_one */
+     };
+ 
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return fips_ec_gfp_nist_method();
+-#endif
+-
+     return &ret;
+ }
+ 
+diff --git a/crypto/ec/ecp_smpl.c b/crypto/ec/ecp_smpl.c
+index 2b84821..6edb60a 100644
+--- a/crypto/ec/ecp_smpl.c
++++ b/crypto/ec/ecp_smpl.c
+@@ -66,10 +66,6 @@
+ #include <openssl/err.h>
+ #include <openssl/symhacks.h>
+ 
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-#endif
+-
+ #include "ec_lcl.h"
+ 
+ const EC_METHOD *EC_GFp_simple_method(void)
+@@ -114,11 +110,6 @@ const EC_METHOD *EC_GFp_simple_method(void)
+         0                       /* field_set_to_one */
+     };
+ 
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return fips_ec_gfp_simple_method();
+-#endif
+-
+     return &ret;
+ }
+ 
+diff --git a/crypto/ecdh/ech_lib.c b/crypto/ecdh/ech_lib.c
+index cbc21d1..aa7954a 100644
+--- a/crypto/ecdh/ech_lib.c
++++ b/crypto/ecdh/ech_lib.c
+@@ -93,14 +93,7 @@ void ECDH_set_default_method(const ECDH_METHOD *meth)
+ const ECDH_METHOD *ECDH_get_default_method(void)
+ {
+     if (!default_ECDH_method) {
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode())
+-            return FIPS_ecdh_openssl();
+-        else
+-            return ECDH_OpenSSL();
+-#else
+         default_ECDH_method = ECDH_OpenSSL();
+-#endif
+     }
+     return default_ECDH_method;
+ }
+diff --git a/crypto/ecdh/ech_ossl.c b/crypto/ecdh/ech_ossl.c
+index df115cc..3908dfa 100644
+--- a/crypto/ecdh/ech_ossl.c
++++ b/crypto/ecdh/ech_ossl.c
+@@ -78,6 +78,10 @@
+ #include <openssl/obj_mac.h>
+ #include <openssl/bn.h>
+ 
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++
+ static int ecdh_compute_key(void *out, size_t len, const EC_POINT *pub_key,
+                             EC_KEY *ecdh,
+                             void *(*KDF) (const void *in, size_t inlen,
+@@ -90,7 +94,7 @@ static ECDH_METHOD openssl_ecdh_meth = {
+     NULL,                       /* init */
+     NULL,                       /* finish */
+ #endif
+-    0,                          /* flags */
++    ECDH_FLAG_FIPS_METHOD,      /* flags */
+     NULL                        /* app_data */
+ };
+ 
+@@ -119,6 +123,13 @@ static int ecdh_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,
+     size_t buflen, len;
+     unsigned char *buf = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_ECDH_COMPUTE_KEY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++#endif
++
+     if (outlen > INT_MAX) {
+         ECDHerr(ECDH_F_ECDH_COMPUTE_KEY, ERR_R_MALLOC_FAILURE); /* sort of,
+                                                                  * anyway */
+diff --git a/crypto/ecdsa/ecdsatest.c b/crypto/ecdsa/ecdsatest.c
+index 0f301f8..0d12f71 100644
+--- a/crypto/ecdsa/ecdsatest.c
++++ b/crypto/ecdsa/ecdsatest.c
+@@ -138,11 +138,14 @@ int restore_rand(void)
+ }
+ 
+ static int fbytes_counter = 0;
+-static const char *numbers[8] = {
++static const char *numbers[10] = {
++    "651056770906015076056810763456358567190100156695615665659",
+     "651056770906015076056810763456358567190100156695615665659",
+     "6140507067065001063065065565667405560006161556565665656654",
+     "8763001015071075675010661307616710783570106710677817767166"
+         "71676178726717",
++    "8763001015071075675010661307616710783570106710677817767166"
++        "71676178726717",
+     "7000000175690566466555057817571571075705015757757057795755"
+         "55657156756655",
+     "1275552191113212300012030439187146164646146646466749494799",
+@@ -158,7 +161,7 @@ int fbytes(unsigned char *buf, int num)
+     int ret;
+     BIGNUM *tmp = NULL;
+ 
+-    if (fbytes_counter >= 8)
++    if (fbytes_counter >= 10)
+         return 0;
+     tmp = BN_new();
+     if (!tmp)
+@@ -532,8 +535,10 @@ int main(void)
+     RAND_seed(rnd_seed, sizeof(rnd_seed));
+ 
+     /* the tests */
++# if 0
+     if (!x9_62_tests(out))
+         goto err;
++# endif
+     if (!test_builtin(out))
+         goto err;
+ 
+diff --git a/crypto/ecdsa/ecs_lib.c b/crypto/ecdsa/ecs_lib.c
+index 8dc1dda..24ef566 100644
+--- a/crypto/ecdsa/ecs_lib.c
++++ b/crypto/ecdsa/ecs_lib.c
+@@ -80,14 +80,7 @@ void ECDSA_set_default_method(const ECDSA_METHOD *meth)
+ const ECDSA_METHOD *ECDSA_get_default_method(void)
+ {
+     if (!default_ECDSA_method) {
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode())
+-            return FIPS_ecdsa_openssl();
+-        else
+-            return ECDSA_OpenSSL();
+-#else
+         default_ECDSA_method = ECDSA_OpenSSL();
+-#endif
+     }
+     return default_ECDSA_method;
+ }
+diff --git a/crypto/ecdsa/ecs_ossl.c b/crypto/ecdsa/ecs_ossl.c
+index dd76960..d81cf6b 100644
+--- a/crypto/ecdsa/ecs_ossl.c
++++ b/crypto/ecdsa/ecs_ossl.c
+@@ -60,6 +60,9 @@
+ #include <openssl/err.h>
+ #include <openssl/obj_mac.h>
+ #include <openssl/bn.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dlen,
+                                 const BIGNUM *, const BIGNUM *,
+@@ -78,7 +81,7 @@ static ECDSA_METHOD openssl_ecdsa_meth = {
+     NULL,                       /* init */
+     NULL,                       /* finish */
+ #endif
+-    0,                          /* flags */
++    ECDSA_FLAG_FIPS_METHOD,     /* flags */
+     NULL                        /* app_data */
+ };
+ 
+@@ -245,6 +248,13 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
+     ECDSA_DATA *ecdsa;
+     const BIGNUM *priv_key;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_ECDSA_DO_SIGN, FIPS_R_FIPS_SELFTEST_FAILED);
++        return NULL;
++    }
++#endif
++
+     ecdsa = ecdsa_check(eckey);
+     group = EC_KEY_get0_group(eckey);
+     priv_key = EC_KEY_get0_private_key(eckey);
+@@ -358,6 +368,13 @@ static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
+     const EC_GROUP *group;
+     const EC_POINT *pub_key;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_ECDSA_DO_VERIFY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++#endif
++
+     /* check input values */
+     if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||
+         (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {
+diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c
+index 48ad0d2..7dcdd30 100644
+--- a/crypto/engine/eng_all.c
++++ b/crypto/engine/eng_all.c
+@@ -59,11 +59,25 @@
+ 
+ #include "cryptlib.h"
+ #include "eng_int.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ void ENGINE_load_builtin_engines(void)
+ {
+     /* Some ENGINEs need this */
+     OPENSSL_cpuid_setup();
++#ifdef OPENSSL_FIPS
++    OPENSSL_init_library();
++    if (FIPS_mode()) {
++        /* We allow loading dynamic engine as a third party
++           engine might be FIPS validated.
++           User is disallowed to load non-validated engines
++           by security policy. */
++        ENGINE_load_dynamic();
++        return;
++    }
++#endif
+ #if 0
+     /*
+      * There's no longer any need for an "openssl" ENGINE unless, one day, it
+diff --git a/crypto/evp/c_allc.c b/crypto/evp/c_allc.c
+index 280e584..9a903d8 100644
+--- a/crypto/evp/c_allc.c
++++ b/crypto/evp/c_allc.c
+@@ -65,6 +65,10 @@
+ void OpenSSL_add_all_ciphers(void)
+ {
+ 
++#ifdef OPENSSL_FIPS
++    OPENSSL_init_library();
++    if (!FIPS_mode()) {
++#endif
+ #ifndef OPENSSL_NO_DES
+     EVP_add_cipher(EVP_des_cfb());
+     EVP_add_cipher(EVP_des_cfb1());
+@@ -238,4 +242,64 @@ void OpenSSL_add_all_ciphers(void)
+     EVP_add_cipher_alias(SN_camellia_256_cbc, "CAMELLIA256");
+     EVP_add_cipher_alias(SN_camellia_256_cbc, "camellia256");
+ #endif
++#ifdef OPENSSL_FIPS
++    } else {
++# ifndef OPENSSL_NO_DES
++        EVP_add_cipher(EVP_des_ede_cfb());
++        EVP_add_cipher(EVP_des_ede3_cfb());
++
++        EVP_add_cipher(EVP_des_ede_ofb());
++        EVP_add_cipher(EVP_des_ede3_ofb());
++
++        EVP_add_cipher(EVP_des_ede_cbc());
++        EVP_add_cipher(EVP_des_ede3_cbc());
++        EVP_add_cipher_alias(SN_des_ede3_cbc, "DES3");
++        EVP_add_cipher_alias(SN_des_ede3_cbc, "des3");
++
++        EVP_add_cipher(EVP_des_ede());
++        EVP_add_cipher(EVP_des_ede3());
++# endif
++
++# ifndef OPENSSL_NO_AES
++        EVP_add_cipher(EVP_aes_128_ecb());
++        EVP_add_cipher(EVP_aes_128_cbc());
++        EVP_add_cipher(EVP_aes_128_cfb());
++        EVP_add_cipher(EVP_aes_128_cfb1());
++        EVP_add_cipher(EVP_aes_128_cfb8());
++        EVP_add_cipher(EVP_aes_128_ofb());
++        EVP_add_cipher(EVP_aes_128_ctr());
++        EVP_add_cipher(EVP_aes_128_gcm());
++        EVP_add_cipher(EVP_aes_128_xts());
++        EVP_add_cipher(EVP_aes_128_ccm());
++        EVP_add_cipher(EVP_aes_128_wrap());
++        EVP_add_cipher_alias(SN_aes_128_cbc, "AES128");
++        EVP_add_cipher_alias(SN_aes_128_cbc, "aes128");
++        EVP_add_cipher(EVP_aes_192_ecb());
++        EVP_add_cipher(EVP_aes_192_cbc());
++        EVP_add_cipher(EVP_aes_192_cfb());
++        EVP_add_cipher(EVP_aes_192_cfb1());
++        EVP_add_cipher(EVP_aes_192_cfb8());
++        EVP_add_cipher(EVP_aes_192_ofb());
++        EVP_add_cipher(EVP_aes_192_ctr());
++        EVP_add_cipher(EVP_aes_192_gcm());
++        EVP_add_cipher(EVP_aes_192_ccm());
++        EVP_add_cipher(EVP_aes_192_wrap());
++        EVP_add_cipher_alias(SN_aes_192_cbc, "AES192");
++        EVP_add_cipher_alias(SN_aes_192_cbc, "aes192");
++        EVP_add_cipher(EVP_aes_256_ecb());
++        EVP_add_cipher(EVP_aes_256_cbc());
++        EVP_add_cipher(EVP_aes_256_cfb());
++        EVP_add_cipher(EVP_aes_256_cfb1());
++        EVP_add_cipher(EVP_aes_256_cfb8());
++        EVP_add_cipher(EVP_aes_256_ofb());
++        EVP_add_cipher(EVP_aes_256_ctr());
++        EVP_add_cipher(EVP_aes_256_gcm());
++        EVP_add_cipher(EVP_aes_256_xts());
++        EVP_add_cipher(EVP_aes_256_ccm());
++        EVP_add_cipher(EVP_aes_256_wrap());
++        EVP_add_cipher_alias(SN_aes_256_cbc, "AES256");
++        EVP_add_cipher_alias(SN_aes_256_cbc, "aes256");
++# endif
++    }
++#endif
+ }
+diff --git a/crypto/evp/c_alld.c b/crypto/evp/c_alld.c
+index fdbe3ee..61745a5 100644
+--- a/crypto/evp/c_alld.c
++++ b/crypto/evp/c_alld.c
+@@ -64,51 +64,81 @@
+ 
+ void OpenSSL_add_all_digests(void)
+ {
++#ifdef OPENSSL_FIPS
++    OPENSSL_init_library();
++    if (!FIPS_mode()) {
++#endif
+ #ifndef OPENSSL_NO_MD4
+-    EVP_add_digest(EVP_md4());
++        EVP_add_digest(EVP_md4());
+ #endif
+ #ifndef OPENSSL_NO_MD5
+-    EVP_add_digest(EVP_md5());
+-    EVP_add_digest_alias(SN_md5, "ssl2-md5");
+-    EVP_add_digest_alias(SN_md5, "ssl3-md5");
++        EVP_add_digest(EVP_md5());
++        EVP_add_digest_alias(SN_md5, "ssl2-md5");
++        EVP_add_digest_alias(SN_md5, "ssl3-md5");
+ #endif
+ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA0)
+-    EVP_add_digest(EVP_sha());
++        EVP_add_digest(EVP_sha());
+ # ifndef OPENSSL_NO_DSA
+-    EVP_add_digest(EVP_dss());
++        EVP_add_digest(EVP_dss());
+ # endif
+ #endif
+ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+-    EVP_add_digest(EVP_sha1());
+-    EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
+-    EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
++        EVP_add_digest(EVP_sha1());
++        EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
++        EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
+ # ifndef OPENSSL_NO_DSA
+-    EVP_add_digest(EVP_dss1());
+-    EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
+-    EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
+-    EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
++        EVP_add_digest(EVP_dss1());
++        EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
++        EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
++        EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
+ # endif
+ # ifndef OPENSSL_NO_ECDSA
+-    EVP_add_digest(EVP_ecdsa());
++        EVP_add_digest(EVP_ecdsa());
+ # endif
+ #endif
+ #if !defined(OPENSSL_NO_MDC2) && !defined(OPENSSL_NO_DES)
+-    EVP_add_digest(EVP_mdc2());
++        EVP_add_digest(EVP_mdc2());
+ #endif
+ #ifndef OPENSSL_NO_RIPEMD
+-    EVP_add_digest(EVP_ripemd160());
+-    EVP_add_digest_alias(SN_ripemd160, "ripemd");
+-    EVP_add_digest_alias(SN_ripemd160, "rmd160");
++        EVP_add_digest(EVP_ripemd160());
++        EVP_add_digest_alias(SN_ripemd160, "ripemd");
++        EVP_add_digest_alias(SN_ripemd160, "rmd160");
+ #endif
+ #ifndef OPENSSL_NO_SHA256
+-    EVP_add_digest(EVP_sha224());
+-    EVP_add_digest(EVP_sha256());
++        EVP_add_digest(EVP_sha224());
++        EVP_add_digest(EVP_sha256());
+ #endif
+ #ifndef OPENSSL_NO_SHA512
+-    EVP_add_digest(EVP_sha384());
+-    EVP_add_digest(EVP_sha512());
++        EVP_add_digest(EVP_sha384());
++        EVP_add_digest(EVP_sha512());
+ #endif
+ #ifndef OPENSSL_NO_WHIRLPOOL
+-    EVP_add_digest(EVP_whirlpool());
++        EVP_add_digest(EVP_whirlpool());
++#endif
++#ifdef OPENSSL_FIPS
++    } else {
++# if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
++        EVP_add_digest(EVP_sha1());
++        EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
++        EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
++#  ifndef OPENSSL_NO_DSA
++        EVP_add_digest(EVP_dss1());
++        EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
++        EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
++        EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
++#  endif
++#  ifndef OPENSSL_NO_ECDSA
++        EVP_add_digest(EVP_ecdsa());
++#  endif
++# endif
++# ifndef OPENSSL_NO_SHA256
++        EVP_add_digest(EVP_sha224());
++        EVP_add_digest(EVP_sha256());
++# endif
++# ifndef OPENSSL_NO_SHA512
++        EVP_add_digest(EVP_sha384());
++        EVP_add_digest(EVP_sha512());
++# endif
++    }
+ #endif
+ }
+diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
+index f2643f3..0073d73 100644
+--- a/crypto/evp/digest.c
++++ b/crypto/evp/digest.c
+@@ -143,18 +143,55 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
+     return EVP_DigestInit_ex(ctx, type, NULL);
+ }
+ 
++#ifdef OPENSSL_FIPS
++
++/* The purpose of these is to trap programs that attempt to use non FIPS
++ * algorithms in FIPS mode and ignore the errors.
++ */
++
++static int bad_init(EVP_MD_CTX *ctx)
++{
++    FIPS_ERROR_IGNORED("Digest init");
++    return 0;
++}
++
++static int bad_update(EVP_MD_CTX *ctx, const void *data, size_t count)
++{
++    FIPS_ERROR_IGNORED("Digest update");
++    return 0;
++}
++
++static int bad_final(EVP_MD_CTX *ctx, unsigned char *md)
++{
++    FIPS_ERROR_IGNORED("Digest Final");
++    return 0;
++}
++
++static const EVP_MD bad_md = {
++    0,
++    0,
++    0,
++    0,
++    bad_init,
++    bad_update,
++    bad_final,
++    NULL,
++    NULL,
++    NULL,
++    0,
++    {0, 0, 0, 0},
++};
++
++#endif
++
+ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
+ {
+     EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);
+ #ifdef OPENSSL_FIPS
+-    /* If FIPS mode switch to approved implementation if possible */
+-    if (FIPS_mode()) {
+-        const EVP_MD *fipsmd;
+-        if (type) {
+-            fipsmd = evp_get_fips_md(type);
+-            if (fipsmd)
+-                type = fipsmd;
+-        }
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_DIGESTINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);
++        ctx->digest = &bad_md;
++        return 0;
+     }
+ #endif
+ #ifndef OPENSSL_NO_ENGINE
+@@ -212,6 +249,16 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
+     }
+ #endif
+     if (ctx->digest != type) {
++#ifdef OPENSSL_FIPS
++        if (FIPS_mode()) {
++            if (!(type->flags & EVP_MD_FLAG_FIPS)
++                && !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)) {
++                EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_DISABLED_FOR_FIPS);
++                ctx->digest = &bad_md;
++                return 0;
++            }
++        }
++#endif
+         if (ctx->digest && ctx->digest->ctx_size)
+             OPENSSL_free(ctx->md_data);
+         ctx->digest = type;
+@@ -236,25 +283,15 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
+     }
+     if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
+         return 1;
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode()) {
+-        if (FIPS_digestinit(ctx, type))
+-            return 1;
+-        OPENSSL_free(ctx->md_data);
+-        ctx->md_data = NULL;
+-        return 0;
+-    }
+-#endif
+     return ctx->digest->init(ctx);
+ }
+ 
+ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
+ {
+ #ifdef OPENSSL_FIPS
+-    return FIPS_digestupdate(ctx, data, count);
+-#else
+-    return ctx->update(ctx, data, count);
++    FIPS_selftest_check();
+ #endif
++    return ctx->update(ctx, data, count);
+ }
+ 
+ /* The caller can assume that this removes any secret data from the context */
+@@ -269,11 +306,11 @@ int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
+ /* The caller can assume that this removes any secret data from the context */
+ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
+ {
+-#ifdef OPENSSL_FIPS
+-    return FIPS_digestfinal(ctx, md, size);
+-#else
+     int ret;
+ 
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
+     ret = ctx->digest->final(ctx, md);
+     if (size != NULL)
+@@ -284,7 +321,6 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
+     }
+     memset(ctx->md_data, 0, ctx->digest->ctx_size);
+     return ret;
+-#endif
+ }
+ 
+ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
+@@ -373,7 +409,6 @@ void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx)
+ /* This call frees resources associated with the context */
+ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
+ {
+-#ifndef OPENSSL_FIPS
+     /*
+      * Don't assume ctx->md_data was cleaned in EVP_Digest_Final, because
+      * sometimes only copies of the context are ever finalised.
+@@ -386,7 +421,6 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
+         OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size);
+         OPENSSL_free(ctx->md_data);
+     }
+-#endif
+     if (ctx->pctx)
+         EVP_PKEY_CTX_free(ctx->pctx);
+ #ifndef OPENSSL_NO_ENGINE
+@@ -397,9 +431,6 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
+          */
+         ENGINE_finish(ctx->engine);
+ #endif
+-#ifdef OPENSSL_FIPS
+-    FIPS_md_ctx_cleanup(ctx);
+-#endif
+     memset(ctx, '\0', sizeof *ctx);
+ 
+     return 1;
+diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
+index 1734a82..b0ada06 100644
+--- a/crypto/evp/e_aes.c
++++ b/crypto/evp/e_aes.c
+@@ -60,9 +60,6 @@
+ # include "modes_lcl.h"
+ # include <openssl/rand.h>
+ 
+-# undef EVP_CIPH_FLAG_FIPS
+-# define EVP_CIPH_FLAG_FIPS 0
+-
+ typedef struct {
+     union {
+         double align;
+@@ -1159,6 +1156,11 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+     case EVP_CTRL_GCM_SET_IVLEN:
+         if (arg <= 0)
+             return 0;
++# ifdef OPENSSL_FIPS
++        if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
++            && arg < 12)
++            return 0;
++# endif
+         /* Allocate memory for IV if needed */
+         if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) {
+             if (gctx->iv != c->iv)
+@@ -1727,6 +1729,14 @@ static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+         return 0;
+     if (!out || !in || len < AES_BLOCK_SIZE)
+         return 0;
++# ifdef OPENSSL_FIPS
++    /* Requirement of SP800-38E */
++    if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
++        (len > (1UL << 20) * 16)) {
++        EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_TOO_LARGE);
++        return 0;
++    }
++# endif
+     if (xctx->stream)
+         (*xctx->stream) (in, out, len,
+                          xctx->xts.key1, xctx->xts.key2, ctx->iv);
+diff --git a/crypto/evp/e_des3.c b/crypto/evp/e_des3.c
+index 0e910d6..1636fc7 100644
+--- a/crypto/evp/e_des3.c
++++ b/crypto/evp/e_des3.c
+@@ -65,10 +65,6 @@
+ # include <openssl/des.h>
+ # include <openssl/rand.h>
+ 
+-/* Block use of implementations in FIPS mode */
+-# undef EVP_CIPH_FLAG_FIPS
+-# define EVP_CIPH_FLAG_FIPS      0
+-
+ typedef struct {
+     union {
+         double align;
+diff --git a/crypto/evp/e_null.c b/crypto/evp/e_null.c
+index 599fcb8..be9ff3d 100644
+--- a/crypto/evp/e_null.c
++++ b/crypto/evp/e_null.c
+@@ -68,7 +68,7 @@ static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+ static const EVP_CIPHER n_cipher = {
+     NID_undef,
+     1, 0, 0,
+-    0,
++    EVP_CIPH_FLAG_FIPS,
+     null_init_key,
+     null_cipher,
+     NULL,
+diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h
+index 39ab793..2c34f51 100644
+--- a/crypto/evp/evp.h
++++ b/crypto/evp/evp.h
+@@ -122,6 +122,10 @@
+ extern "C" {
+ #endif
+ 
++# ifdef OPENSSL_FIPS
++#  include <openssl/fips.h>
++# endif
++
+ /*
+  * Type needs to be a bit field Sub-type needs to be for variations on the
+  * method, as in, can it do arbitrary encryption....
+@@ -285,11 +289,6 @@ struct env_md_ctx_st {
+                                                 * cleaned */
+ # define EVP_MD_CTX_FLAG_REUSE           0x0004/* Don't free up ctx->md_data
+                                                 * in EVP_MD_CTX_cleanup */
+-/*
+- * FIPS and pad options are ignored in 1.0.0, definitions are here so we
+- * don't accidentally reuse the values for other purposes.
+- */
+-
+ # define EVP_MD_CTX_FLAG_NON_FIPS_ALLOW  0x0008/* Allow use of non FIPS
+                                                 * digest in FIPS mode */
+ 
+@@ -302,6 +301,10 @@ struct env_md_ctx_st {
+ # define EVP_MD_CTX_FLAG_PAD_PKCS1       0x00/* PKCS#1 v1.5 mode */
+ # define EVP_MD_CTX_FLAG_PAD_X931        0x10/* X9.31 mode */
+ # define EVP_MD_CTX_FLAG_PAD_PSS         0x20/* PSS mode */
++# define M_EVP_MD_CTX_FLAG_PSS_SALT(ctx) \
++                ((ctx->flags>>16) &0xFFFF) /* seed length */
++# define EVP_MD_CTX_FLAG_PSS_MDLEN       0xFFFF/* salt len same as digest */
++# define EVP_MD_CTX_FLAG_PSS_MREC        0xFFFE/* salt max or auto recovered */
+ 
+ # define EVP_MD_CTX_FLAG_NO_INIT         0x0100/* Don't initialize md_data */
+ 
+@@ -363,15 +366,15 @@ struct evp_cipher_st {
+ /* cipher handles random key generation */
+ # define         EVP_CIPH_RAND_KEY               0x200
+ /* cipher has its own additional copying logic */
+-# define         EVP_CIPH_CUSTOM_COPY            0x400
++# define         EVP_CIPH_CUSTOM_COPY            0x4000
+ /* Allow use default ASN1 get/set iv */
+ # define         EVP_CIPH_FLAG_DEFAULT_ASN1      0x1000
+ /* Buffer length in bits not bytes: CFB1 mode only */
+ # define         EVP_CIPH_FLAG_LENGTH_BITS       0x2000
+ /* Note if suitable for use in FIPS mode */
+-# define         EVP_CIPH_FLAG_FIPS              0x4000
++# define         EVP_CIPH_FLAG_FIPS              0x400
+ /* Allow non FIPS cipher in FIPS mode */
+-# define         EVP_CIPH_FLAG_NON_FIPS_ALLOW    0x8000
++# define         EVP_CIPH_FLAG_NON_FIPS_ALLOW    0x800
+ /*
+  * Cipher handles any and all padding logic as well as finalisation.
+  */
+diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
+index 65f0e02..cb368a2 100644
+--- a/crypto/evp/evp_enc.c
++++ b/crypto/evp/evp_enc.c
+@@ -69,16 +69,73 @@
+ #endif
+ #include "evp_locl.h"
+ 
+-#ifdef OPENSSL_FIPS
+-# define M_do_cipher(ctx, out, in, inl) FIPS_cipher(ctx, out, in, inl)
+-#else
+-# define M_do_cipher(ctx, out, in, inl) ctx->cipher->do_cipher(ctx, out, in, inl)
+-#endif
++#define M_do_cipher(ctx, out, in, inl) ctx->cipher->do_cipher(ctx, out, in, inl)
+ 
+ const char EVP_version[] = "EVP" OPENSSL_VERSION_PTEXT;
+ 
++#ifdef OPENSSL_FIPS
++
++/* The purpose of these is to trap programs that attempt to use non FIPS
++ * algorithms in FIPS mode and ignore the errors.
++ */
++
++static int bad_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
++                    const unsigned char *iv, int enc)
++{
++    FIPS_ERROR_IGNORED("Cipher init");
++    return 0;
++}
++
++static int bad_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
++                         const unsigned char *in, size_t inl)
++{
++    FIPS_ERROR_IGNORED("Cipher update");
++    return 0;
++}
++
++/* NB: no cleanup because it is allowed after failed init */
++
++static int bad_set_asn1(EVP_CIPHER_CTX *ctx, ASN1_TYPE *typ)
++{
++    FIPS_ERROR_IGNORED("Cipher set_asn1");
++    return 0;
++}
++
++static int bad_get_asn1(EVP_CIPHER_CTX *ctx, ASN1_TYPE *typ)
++{
++    FIPS_ERROR_IGNORED("Cipher get_asn1");
++    return 0;
++}
++
++static int bad_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
++{
++    FIPS_ERROR_IGNORED("Cipher ctrl");
++    return 0;
++}
++
++static const EVP_CIPHER bad_cipher = {
++    0,
++    0,
++    0,
++    0,
++    0,
++    bad_init,
++    bad_do_cipher,
++    NULL,
++    0,
++    bad_set_asn1,
++    bad_get_asn1,
++    bad_ctrl,
++    NULL
++};
++
++#endif
++
+ void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     memset(ctx, 0, sizeof(EVP_CIPHER_CTX));
+     /* ctx->cipher=NULL; */
+ }
+@@ -110,6 +167,13 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+             enc = 1;
+         ctx->encrypt = enc;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_CIPHERINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);
++        ctx->cipher = &bad_cipher;
++        return 0;
++    }
++#endif
+ #ifndef OPENSSL_NO_ENGINE
+     /*
+      * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
+@@ -168,16 +232,6 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+             ctx->engine = NULL;
+ #endif
+ 
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode()) {
+-            const EVP_CIPHER *fcipher;
+-            if (cipher)
+-                fcipher = evp_get_fips_cipher(cipher);
+-            if (fcipher)
+-                cipher = fcipher;
+-            return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+-        }
+-#endif
+         ctx->cipher = cipher;
+         if (ctx->cipher->ctx_size) {
+             ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size);
+@@ -204,10 +258,6 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+ #ifndef OPENSSL_NO_ENGINE
+  skip_to_init:
+ #endif
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+-#endif
+     /* we assume block size is a power of 2 in *cryptUpdate */
+     OPENSSL_assert(ctx->cipher->block_size == 1
+                    || ctx->cipher->block_size == 8
+@@ -253,6 +303,19 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
+             break;
+         }
+     }
++#ifdef OPENSSL_FIPS
++    /* After 'key' is set no further parameters changes are permissible.
++     * So only check for non FIPS enabling at this point.
++     */
++    if (key && FIPS_mode()) {
++        if (!(ctx->cipher->flags & EVP_CIPH_FLAG_FIPS)
++            & !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)) {
++            EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_DISABLED_FOR_FIPS);
++            ctx->cipher = &bad_cipher;
++            return 0;
++        }
++    }
++#endif
+ 
+     if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
+         if (!ctx->cipher->init(ctx, key, iv, enc))
+@@ -554,7 +617,6 @@ void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+ 
+ int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
+ {
+-#ifndef OPENSSL_FIPS
+     if (c->cipher != NULL) {
+         if (c->cipher->cleanup && !c->cipher->cleanup(c))
+             return 0;
+@@ -564,7 +626,6 @@ int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
+     }
+     if (c->cipher_data)
+         OPENSSL_free(c->cipher_data);
+-#endif
+ #ifndef OPENSSL_NO_ENGINE
+     if (c->engine)
+         /*
+@@ -573,9 +634,6 @@ int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
+          */
+         ENGINE_finish(c->engine);
+ #endif
+-#ifdef OPENSSL_FIPS
+-    FIPS_cipher_ctx_cleanup(c);
+-#endif
+     memset(c, 0, sizeof(EVP_CIPHER_CTX));
+     return 1;
+ }
+diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c
+index 7e0bab9..da41dd3 100644
+--- a/crypto/evp/evp_lib.c
++++ b/crypto/evp/evp_lib.c
+@@ -60,10 +60,6 @@
+ #include "cryptlib.h"
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+-#ifdef OPENSSL_FIPS
+-# include <openssl/fips.h>
+-# include "evp_locl.h"
+-#endif
+ 
+ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
+ {
+@@ -224,6 +220,9 @@ int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx)
+ int EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, unsigned int inl)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     return ctx->cipher->do_cipher(ctx, out, in, inl);
+ }
+ 
+@@ -234,22 +233,12 @@ const EVP_CIPHER *EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx)
+ 
+ unsigned long EVP_CIPHER_flags(const EVP_CIPHER *cipher)
+ {
+-#ifdef OPENSSL_FIPS
+-    const EVP_CIPHER *fcipher;
+-    fcipher = evp_get_fips_cipher(cipher);
+-    if (fcipher && fcipher->flags & EVP_CIPH_FLAG_FIPS)
+-        return cipher->flags | EVP_CIPH_FLAG_FIPS;
+-#endif
+     return cipher->flags;
+ }
+ 
+ unsigned long EVP_CIPHER_CTX_flags(const EVP_CIPHER_CTX *ctx)
+ {
+-#ifdef OPENSSL_FIPS
+-    return EVP_CIPHER_flags(ctx->cipher);
+-#else
+     return ctx->cipher->flags;
+-#endif
+ }
+ 
+ void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx)
+@@ -316,40 +305,8 @@ int EVP_MD_size(const EVP_MD *md)
+     return md->md_size;
+ }
+ 
+-#ifdef OPENSSL_FIPS
+-
+-const EVP_MD *evp_get_fips_md(const EVP_MD *md)
+-{
+-    int nid = EVP_MD_type(md);
+-    if (nid == NID_dsa)
+-        return FIPS_evp_dss1();
+-    else if (nid == NID_dsaWithSHA)
+-        return FIPS_evp_dss();
+-    else if (nid == NID_ecdsa_with_SHA1)
+-        return FIPS_evp_ecdsa();
+-    else
+-        return FIPS_get_digestbynid(nid);
+-}
+-
+-const EVP_CIPHER *evp_get_fips_cipher(const EVP_CIPHER *cipher)
+-{
+-    int nid = cipher->nid;
+-    if (nid == NID_undef)
+-        return FIPS_evp_enc_null();
+-    else
+-        return FIPS_get_cipherbynid(nid);
+-}
+-
+-#endif
+-
+ unsigned long EVP_MD_flags(const EVP_MD *md)
+ {
+-#ifdef OPENSSL_FIPS
+-    const EVP_MD *fmd;
+-    fmd = evp_get_fips_md(md);
+-    if (fmd && fmd->flags & EVP_MD_FLAG_FIPS)
+-        return md->flags | EVP_MD_FLAG_FIPS;
+-#endif
+     return md->flags;
+ }
+ 
+diff --git a/crypto/evp/evp_locl.h b/crypto/evp/evp_locl.h
+index 2bb709a..b6fecde 100644
+--- a/crypto/evp/evp_locl.h
++++ b/crypto/evp/evp_locl.h
+@@ -258,10 +258,8 @@ const EVP_CIPHER *EVP_##cname##_ecb(void) { return &cname##_ecb; }
+         BLOCK_CIPHER_func_cfb(cipher##_##keysize,cprefix,cbits,kstruct,ksched) \
+         BLOCK_CIPHER_def_cfb(cipher##_##keysize,kstruct, \
+                              NID_##cipher##_##keysize, keysize/8, iv_len, cbits, \
+-                             0, cipher##_init_key, NULL, \
+-                             EVP_CIPHER_set_asn1_iv, \
+-                             EVP_CIPHER_get_asn1_iv, \
+-                             NULL)
++                             EVP_CIPH_FLAG_DEFAULT_ASN1, \
++                             cipher##_init_key, NULL, NULL, NULL, NULL)
+ 
+ struct evp_pkey_ctx_st {
+     /* Method associated with this operation */
+@@ -355,11 +353,6 @@ const EVP_CIPHER *evp_get_fips_cipher(const EVP_CIPHER *cipher);
+ # define MD2_Init        private_MD2_Init
+ # define MDC2_Init       private_MDC2_Init
+ # define SHA_Init        private_SHA_Init
+-# define SHA1_Init       private_SHA1_Init
+-# define SHA224_Init     private_SHA224_Init
+-# define SHA256_Init     private_SHA256_Init
+-# define SHA384_Init     private_SHA384_Init
+-# define SHA512_Init     private_SHA512_Init
+ 
+ # define BF_set_key      private_BF_set_key
+ # define CAST_set_key    private_CAST_set_key
+@@ -367,7 +360,6 @@ const EVP_CIPHER *evp_get_fips_cipher(const EVP_CIPHER *cipher);
+ # define SEED_set_key    private_SEED_set_key
+ # define RC2_set_key     private_RC2_set_key
+ # define RC4_set_key     private_RC4_set_key
+-# define DES_set_key_unchecked   private_DES_set_key_unchecked
+ # define Camellia_set_key        private_Camellia_set_key
+ 
+ #endif
+diff --git a/crypto/evp/m_dss.c b/crypto/evp/m_dss.c
+index 1478448..c048831 100644
+--- a/crypto/evp/m_dss.c
++++ b/crypto/evp/m_dss.c
+@@ -86,7 +86,7 @@ static const EVP_MD dsa_md = {
+     NID_dsaWithSHA,
+     NID_dsaWithSHA,
+     SHA_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_DIGEST,
++    EVP_MD_FLAG_PKEY_DIGEST | EVP_MD_FLAG_FIPS,
+     init,
+     update,
+     final,
+diff --git a/crypto/evp/m_dss1.c b/crypto/evp/m_dss1.c
+index e36fabf..cfc15f5 100644
+--- a/crypto/evp/m_dss1.c
++++ b/crypto/evp/m_dss1.c
+@@ -87,7 +87,7 @@ static const EVP_MD dss1_md = {
+     NID_dsa,
+     NID_dsaWithSHA1,
+     SHA_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_DIGEST,
++    EVP_MD_FLAG_PKEY_DIGEST | EVP_MD_FLAG_FIPS,
+     init,
+     update,
+     final,
+diff --git a/crypto/evp/m_ecdsa.c b/crypto/evp/m_ecdsa.c
+index 803d314..2830069 100644
+--- a/crypto/evp/m_ecdsa.c
++++ b/crypto/evp/m_ecdsa.c
+@@ -136,7 +136,7 @@ static const EVP_MD ecdsa_md = {
+     NID_ecdsa_with_SHA1,
+     NID_ecdsa_with_SHA1,
+     SHA_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_DIGEST,
++    EVP_MD_FLAG_PKEY_DIGEST | EVP_MD_FLAG_FIPS,
+     init,
+     update,
+     final,
+diff --git a/crypto/evp/m_md2.c b/crypto/evp/m_md2.c
+index 3c4cd7b..379aa2f 100644
+--- a/crypto/evp/m_md2.c
++++ b/crypto/evp/m_md2.c
+@@ -68,6 +68,7 @@
+ # ifndef OPENSSL_NO_RSA
+ #  include <openssl/rsa.h>
+ # endif
++# include "evp_locl.h"
+ 
+ static int init(EVP_MD_CTX *ctx)
+ {
+diff --git a/crypto/evp/m_sha1.c b/crypto/evp/m_sha1.c
+index a74e6b7..f1dd284 100644
+--- a/crypto/evp/m_sha1.c
++++ b/crypto/evp/m_sha1.c
+@@ -87,7 +87,8 @@ static const EVP_MD sha1_md = {
+     NID_sha1,
+     NID_sha1WithRSAEncryption,
+     SHA_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT |
++        EVP_MD_FLAG_FIPS,
+     init,
+     update,
+     final,
+@@ -134,7 +135,8 @@ static const EVP_MD sha224_md = {
+     NID_sha224,
+     NID_sha224WithRSAEncryption,
+     SHA224_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT |
++        EVP_MD_FLAG_FIPS,
+     init224,
+     update256,
+     final256,
+@@ -154,7 +156,8 @@ static const EVP_MD sha256_md = {
+     NID_sha256,
+     NID_sha256WithRSAEncryption,
+     SHA256_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT |
++        EVP_MD_FLAG_FIPS,
+     init256,
+     update256,
+     final256,
+@@ -197,7 +200,8 @@ static const EVP_MD sha384_md = {
+     NID_sha384,
+     NID_sha384WithRSAEncryption,
+     SHA384_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT |
++        EVP_MD_FLAG_FIPS,
+     init384,
+     update512,
+     final512,
+@@ -217,7 +221,8 @@ static const EVP_MD sha512_md = {
+     NID_sha512,
+     NID_sha512WithRSAEncryption,
+     SHA512_DIGEST_LENGTH,
+-    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_PKEY_METHOD_SIGNATURE | EVP_MD_FLAG_DIGALGID_ABSENT |
++        EVP_MD_FLAG_FIPS,
+     init512,
+     update512,
+     final512,
+diff --git a/crypto/evp/p_sign.c b/crypto/evp/p_sign.c
+index 1b9ba06..0a95123 100644
+--- a/crypto/evp/p_sign.c
++++ b/crypto/evp/p_sign.c
+@@ -61,6 +61,7 @@
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/x509.h>
++#include <openssl/rsa.h>
+ 
+ #ifdef undef
+ void EVP_SignInit(EVP_MD_CTX *ctx, EVP_MD *type)
+@@ -101,6 +102,22 @@ int EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret,
+             goto err;
+         if (EVP_PKEY_CTX_set_signature_md(pkctx, ctx->digest) <= 0)
+             goto err;
++        if (ctx->flags & EVP_MD_CTX_FLAG_PAD_X931)
++            if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_X931_PADDING) <= 0)
++                goto err;
++        if (ctx->flags & EVP_MD_CTX_FLAG_PAD_PSS) {
++            int saltlen;
++            if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_PSS_PADDING) <=
++                0)
++                goto err;
++            saltlen = M_EVP_MD_CTX_FLAG_PSS_SALT(ctx);
++            if (saltlen == EVP_MD_CTX_FLAG_PSS_MDLEN)
++                saltlen = -1;
++            else if (saltlen == EVP_MD_CTX_FLAG_PSS_MREC)
++                saltlen = -2;
++            if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkctx, saltlen) <= 0)
++                goto err;
++        }
+         if (EVP_PKEY_sign(pkctx, sigret, &sltmp, m, m_len) <= 0)
+             goto err;
+         *siglen = sltmp;
+diff --git a/crypto/evp/p_verify.c b/crypto/evp/p_verify.c
+index 65e1e21..477b1b0 100644
+--- a/crypto/evp/p_verify.c
++++ b/crypto/evp/p_verify.c
+@@ -61,6 +61,7 @@
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/x509.h>
++#include <openssl/rsa.h>
+ 
+ int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf,
+                     unsigned int siglen, EVP_PKEY *pkey)
+@@ -87,6 +88,22 @@ int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf,
+             goto err;
+         if (EVP_PKEY_CTX_set_signature_md(pkctx, ctx->digest) <= 0)
+             goto err;
++        if (ctx->flags & EVP_MD_CTX_FLAG_PAD_X931)
++            if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_X931_PADDING) <= 0)
++                goto err;
++        if (ctx->flags & EVP_MD_CTX_FLAG_PAD_PSS) {
++            int saltlen;
++            if (EVP_PKEY_CTX_set_rsa_padding(pkctx, RSA_PKCS1_PSS_PADDING) <=
++                0)
++                goto err;
++            saltlen = M_EVP_MD_CTX_FLAG_PSS_SALT(ctx);
++            if (saltlen == EVP_MD_CTX_FLAG_PSS_MDLEN)
++                saltlen = -1;
++            else if (saltlen == EVP_MD_CTX_FLAG_PSS_MREC)
++                saltlen = -2;
++            if (EVP_PKEY_CTX_set_rsa_pss_saltlen(pkctx, saltlen) <= 0)
++                goto err;
++        }
+         i = EVP_PKEY_verify(pkctx, sigbuf, siglen, m, m_len);
+  err:
+         EVP_PKEY_CTX_free(pkctx);
+diff --git a/crypto/fips/Makefile b/crypto/fips/Makefile
+new file mode 100644
+index 0000000..53670a6
+--- /dev/null
++++ b/crypto/fips/Makefile
+@@ -0,0 +1,406 @@
++#
++# OpenSSL/crypto/fips/Makefile
++#
++
++DIR=	fips
++TOP=	../..
++CC=	cc
++INCLUDES=
++CFLAG=-g
++MAKEFILE=	Makefile
++AR=		ar r
++
++CFLAGS= $(INCLUDES) $(CFLAG)
++
++GENERAL=Makefile
++TEST=fips_test_suite.c
++APPS=
++
++#PROGRAM= fips_standalone_hmac
++EXE= $(PROGRAM)$(EXE_EXT)
++
++LIB=$(TOP)/libcrypto.a
++LIBSRC=fips.c fips_aes_selftest.c fips_cmac_selftest.c fips_des_selftest.c \
++	fips_dh_selftest.c fips_drbg_ctr.c fips_drbg_hash.c fips_drbg_hmac.c \
++	fips_drbg_lib.c fips_drbg_rand.c fips_drbg_selftest.c \
++	fips_dsa_selftest.c fips_ecdh_selftest.c fips_ecdsa_selftest.c \
++	fips_enc.c fips_hmac_selftest.c fips_md.c fips_post.c fips_rand.c\
++	fips_rsa_selftest.c fips_sha_selftest.c \
++	fips_rsa_x931g.c fips_rand_lib.c
++
++LIBOBJ=fips.o fips_aes_selftest.o fips_cmac_selftest.o fips_des_selftest.o \
++       fips_dh_selftest.o fips_drbg_ctr.o fips_drbg_hash.o fips_drbg_hmac.o \
++       fips_drbg_lib.o fips_drbg_rand.o fips_drbg_selftest.o \
++       fips_dsa_selftest.o fips_ecdh_selftest.o fips_ecdsa_selftest.o \
++       fips_enc.o fips_hmac_selftest.o fips_md.o fips_post.o fips_rand.o\
++       fips_rsa_selftest.o fips_sha_selftest.o \
++       fips_rsa_x931g.o fips_rand_lib.o
++
++LIBCRYPTO=-L.. -lcrypto
++
++#SRC= $(LIBSRC) fips_standalone_hmac.c
++SRC= $(LIBSRC)
++
++EXHEADER= fips.h fips_rand.h
++HEADER=	$(EXHEADER)
++
++ALL=    $(GENERAL) $(SRC) $(HEADER)
++
++top:
++	(cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
++
++all:	lib exe
++
++lib:	$(LIBOBJ)
++	$(AR) $(LIB) $(LIBOBJ)
++	$(RANLIB) $(LIB) || echo Never mind.
++	@touch lib
++
++exe:	$(EXE)
++
++files:
++	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
++
++links:
++	@$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
++	@$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
++	@$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
++
++install:
++	@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
++	@headerlist="$(EXHEADER)"; for i in $$headerlist ; \
++	do  \
++	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
++	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
++	done;
++
++tags:
++	ctags $(SRC)
++
++tests:
++
++lint:
++	lint -DLINT $(INCLUDES) $(SRC)>fluff
++
++depend:
++	@[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
++	$(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
++
++dclean:
++	$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
++	mv -f Makefile.new $(MAKEFILE)
++
++clean:
++	rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
++
++$(EXE): $(PROGRAM).o
++	FIPS_SHA_ASM=""; for i in $(SHA1_ASM_OBJ) sha256.o; do FIPS_SHA_ASM="$$FIPS_SHA_ASM ../sha/$$i" ; done; \
++	for i in $(CPUID_OBJ); do FIPS_SHA_ASM="$$FIPS_SHA_ASM ../$$i" ; done; \
++	$(CC) -o $@ $(CFLAGS) $(PROGRAM).o $$FIPS_SHA_ASM
++
++# DO NOT DELETE THIS LINE -- make depend depends on it.
++
++fips.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips.o: ../../include/openssl/fips_rand.h ../../include/openssl/hmac.h
++fips.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
++fips.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
++fips.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
++fips.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h
++fips.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
++fips.o: ../../include/openssl/symhacks.h fips.c fips_locl.h
++fips_aes_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_aes_selftest.o: ../../include/openssl/crypto.h
++fips_aes_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_aes_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_aes_selftest.o: ../../include/openssl/lhash.h
++fips_aes_selftest.o: ../../include/openssl/obj_mac.h
++fips_aes_selftest.o: ../../include/openssl/objects.h
++fips_aes_selftest.o: ../../include/openssl/opensslconf.h
++fips_aes_selftest.o: ../../include/openssl/opensslv.h
++fips_aes_selftest.o: ../../include/openssl/ossl_typ.h
++fips_aes_selftest.o: ../../include/openssl/safestack.h
++fips_aes_selftest.o: ../../include/openssl/stack.h
++fips_aes_selftest.o: ../../include/openssl/symhacks.h fips_aes_selftest.c
++fips_cmac_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_cmac_selftest.o: ../../include/openssl/cmac.h
++fips_cmac_selftest.o: ../../include/openssl/crypto.h
++fips_cmac_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_cmac_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_cmac_selftest.o: ../../include/openssl/lhash.h
++fips_cmac_selftest.o: ../../include/openssl/obj_mac.h
++fips_cmac_selftest.o: ../../include/openssl/objects.h
++fips_cmac_selftest.o: ../../include/openssl/opensslconf.h
++fips_cmac_selftest.o: ../../include/openssl/opensslv.h
++fips_cmac_selftest.o: ../../include/openssl/ossl_typ.h
++fips_cmac_selftest.o: ../../include/openssl/safestack.h
++fips_cmac_selftest.o: ../../include/openssl/stack.h
++fips_cmac_selftest.o: ../../include/openssl/symhacks.h fips_cmac_selftest.c
++fips_cmac_selftest.o: fips_locl.h
++fips_des_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_des_selftest.o: ../../include/openssl/crypto.h
++fips_des_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_des_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_des_selftest.o: ../../include/openssl/lhash.h
++fips_des_selftest.o: ../../include/openssl/obj_mac.h
++fips_des_selftest.o: ../../include/openssl/objects.h
++fips_des_selftest.o: ../../include/openssl/opensslconf.h
++fips_des_selftest.o: ../../include/openssl/opensslv.h
++fips_des_selftest.o: ../../include/openssl/ossl_typ.h
++fips_des_selftest.o: ../../include/openssl/safestack.h
++fips_des_selftest.o: ../../include/openssl/stack.h
++fips_des_selftest.o: ../../include/openssl/symhacks.h fips_des_selftest.c
++fips_dh_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_dh_selftest.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
++fips_dh_selftest.o: ../../include/openssl/dh.h ../../include/openssl/e_os2.h
++fips_dh_selftest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_dh_selftest.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
++fips_dh_selftest.o: ../../include/openssl/obj_mac.h
++fips_dh_selftest.o: ../../include/openssl/objects.h
++fips_dh_selftest.o: ../../include/openssl/opensslconf.h
++fips_dh_selftest.o: ../../include/openssl/opensslv.h
++fips_dh_selftest.o: ../../include/openssl/ossl_typ.h
++fips_dh_selftest.o: ../../include/openssl/safestack.h
++fips_dh_selftest.o: ../../include/openssl/stack.h
++fips_dh_selftest.o: ../../include/openssl/symhacks.h fips_dh_selftest.c
++fips_dh_selftest.o: fips_locl.h
++fips_drbg_ctr.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_ctr.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_drbg_ctr.o: ../../include/openssl/e_os2.h ../../include/openssl/evp.h
++fips_drbg_ctr.o: ../../include/openssl/fips.h ../../include/openssl/fips_rand.h
++fips_drbg_ctr.o: ../../include/openssl/hmac.h ../../include/openssl/obj_mac.h
++fips_drbg_ctr.o: ../../include/openssl/objects.h
++fips_drbg_ctr.o: ../../include/openssl/opensslconf.h
++fips_drbg_ctr.o: ../../include/openssl/opensslv.h
++fips_drbg_ctr.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_drbg_ctr.o: ../../include/openssl/safestack.h
++fips_drbg_ctr.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
++fips_drbg_ctr.o: fips_drbg_ctr.c fips_rand_lcl.h
++fips_drbg_hash.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_hash.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_drbg_hash.o: ../../include/openssl/e_os2.h ../../include/openssl/evp.h
++fips_drbg_hash.o: ../../include/openssl/fips.h
++fips_drbg_hash.o: ../../include/openssl/fips_rand.h
++fips_drbg_hash.o: ../../include/openssl/hmac.h ../../include/openssl/obj_mac.h
++fips_drbg_hash.o: ../../include/openssl/objects.h
++fips_drbg_hash.o: ../../include/openssl/opensslconf.h
++fips_drbg_hash.o: ../../include/openssl/opensslv.h
++fips_drbg_hash.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_drbg_hash.o: ../../include/openssl/safestack.h
++fips_drbg_hash.o: ../../include/openssl/stack.h
++fips_drbg_hash.o: ../../include/openssl/symhacks.h fips_drbg_hash.c
++fips_drbg_hash.o: fips_rand_lcl.h
++fips_drbg_hmac.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_hmac.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_drbg_hmac.o: ../../include/openssl/e_os2.h ../../include/openssl/evp.h
++fips_drbg_hmac.o: ../../include/openssl/fips.h
++fips_drbg_hmac.o: ../../include/openssl/fips_rand.h
++fips_drbg_hmac.o: ../../include/openssl/hmac.h ../../include/openssl/obj_mac.h
++fips_drbg_hmac.o: ../../include/openssl/objects.h
++fips_drbg_hmac.o: ../../include/openssl/opensslconf.h
++fips_drbg_hmac.o: ../../include/openssl/opensslv.h
++fips_drbg_hmac.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_drbg_hmac.o: ../../include/openssl/safestack.h
++fips_drbg_hmac.o: ../../include/openssl/stack.h
++fips_drbg_hmac.o: ../../include/openssl/symhacks.h fips_drbg_hmac.c
++fips_drbg_hmac.o: fips_rand_lcl.h
++fips_drbg_lib.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_lib.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_drbg_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_drbg_lib.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_drbg_lib.o: ../../include/openssl/fips_rand.h ../../include/openssl/hmac.h
++fips_drbg_lib.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
++fips_drbg_lib.o: ../../include/openssl/objects.h
++fips_drbg_lib.o: ../../include/openssl/opensslconf.h
++fips_drbg_lib.o: ../../include/openssl/opensslv.h
++fips_drbg_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_drbg_lib.o: ../../include/openssl/safestack.h
++fips_drbg_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
++fips_drbg_lib.o: fips_drbg_lib.c fips_locl.h fips_rand_lcl.h
++fips_drbg_rand.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_rand.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_drbg_rand.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_drbg_rand.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_drbg_rand.o: ../../include/openssl/fips_rand.h
++fips_drbg_rand.o: ../../include/openssl/hmac.h ../../include/openssl/lhash.h
++fips_drbg_rand.o: ../../include/openssl/obj_mac.h
++fips_drbg_rand.o: ../../include/openssl/objects.h
++fips_drbg_rand.o: ../../include/openssl/opensslconf.h
++fips_drbg_rand.o: ../../include/openssl/opensslv.h
++fips_drbg_rand.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_drbg_rand.o: ../../include/openssl/safestack.h
++fips_drbg_rand.o: ../../include/openssl/stack.h
++fips_drbg_rand.o: ../../include/openssl/symhacks.h fips_drbg_rand.c
++fips_drbg_rand.o: fips_rand_lcl.h
++fips_drbg_selftest.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_drbg_selftest.o: ../../include/openssl/bio.h
++fips_drbg_selftest.o: ../../include/openssl/crypto.h
++fips_drbg_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_drbg_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_drbg_selftest.o: ../../include/openssl/fips_rand.h
++fips_drbg_selftest.o: ../../include/openssl/hmac.h
++fips_drbg_selftest.o: ../../include/openssl/lhash.h
++fips_drbg_selftest.o: ../../include/openssl/obj_mac.h
++fips_drbg_selftest.o: ../../include/openssl/objects.h
++fips_drbg_selftest.o: ../../include/openssl/opensslconf.h
++fips_drbg_selftest.o: ../../include/openssl/opensslv.h
++fips_drbg_selftest.o: ../../include/openssl/ossl_typ.h
++fips_drbg_selftest.o: ../../include/openssl/rand.h
++fips_drbg_selftest.o: ../../include/openssl/safestack.h
++fips_drbg_selftest.o: ../../include/openssl/stack.h
++fips_drbg_selftest.o: ../../include/openssl/symhacks.h fips_drbg_selftest.c
++fips_drbg_selftest.o: fips_drbg_selftest.h fips_locl.h fips_rand_lcl.h
++fips_dsa_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_dsa_selftest.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
++fips_dsa_selftest.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
++fips_dsa_selftest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_dsa_selftest.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
++fips_dsa_selftest.o: ../../include/openssl/obj_mac.h
++fips_dsa_selftest.o: ../../include/openssl/objects.h
++fips_dsa_selftest.o: ../../include/openssl/opensslconf.h
++fips_dsa_selftest.o: ../../include/openssl/opensslv.h
++fips_dsa_selftest.o: ../../include/openssl/ossl_typ.h
++fips_dsa_selftest.o: ../../include/openssl/safestack.h
++fips_dsa_selftest.o: ../../include/openssl/stack.h
++fips_dsa_selftest.o: ../../include/openssl/symhacks.h fips_dsa_selftest.c
++fips_dsa_selftest.o: fips_locl.h
++fips_ecdh_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_ecdh_selftest.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
++fips_ecdh_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
++fips_ecdh_selftest.o: ../../include/openssl/ecdh.h ../../include/openssl/err.h
++fips_ecdh_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_ecdh_selftest.o: ../../include/openssl/lhash.h
++fips_ecdh_selftest.o: ../../include/openssl/obj_mac.h
++fips_ecdh_selftest.o: ../../include/openssl/objects.h
++fips_ecdh_selftest.o: ../../include/openssl/opensslconf.h
++fips_ecdh_selftest.o: ../../include/openssl/opensslv.h
++fips_ecdh_selftest.o: ../../include/openssl/ossl_typ.h
++fips_ecdh_selftest.o: ../../include/openssl/safestack.h
++fips_ecdh_selftest.o: ../../include/openssl/stack.h
++fips_ecdh_selftest.o: ../../include/openssl/symhacks.h fips_ecdh_selftest.c
++fips_ecdh_selftest.o: fips_locl.h
++fips_ecdsa_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_ecdsa_selftest.o: ../../include/openssl/bn.h
++fips_ecdsa_selftest.o: ../../include/openssl/crypto.h
++fips_ecdsa_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
++fips_ecdsa_selftest.o: ../../include/openssl/ecdsa.h
++fips_ecdsa_selftest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_ecdsa_selftest.o: ../../include/openssl/fips.h
++fips_ecdsa_selftest.o: ../../include/openssl/lhash.h
++fips_ecdsa_selftest.o: ../../include/openssl/obj_mac.h
++fips_ecdsa_selftest.o: ../../include/openssl/objects.h
++fips_ecdsa_selftest.o: ../../include/openssl/opensslconf.h
++fips_ecdsa_selftest.o: ../../include/openssl/opensslv.h
++fips_ecdsa_selftest.o: ../../include/openssl/ossl_typ.h
++fips_ecdsa_selftest.o: ../../include/openssl/safestack.h
++fips_ecdsa_selftest.o: ../../include/openssl/stack.h
++fips_ecdsa_selftest.o: ../../include/openssl/symhacks.h fips_ecdsa_selftest.c
++fips_enc.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_enc.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
++fips_enc.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_enc.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
++fips_enc.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
++fips_enc.o: ../../include/openssl/opensslconf.h
++fips_enc.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
++fips_enc.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
++fips_enc.o: ../../include/openssl/symhacks.h fips_enc.c
++fips_hmac_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_hmac_selftest.o: ../../include/openssl/crypto.h
++fips_hmac_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_hmac_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_hmac_selftest.o: ../../include/openssl/hmac.h
++fips_hmac_selftest.o: ../../include/openssl/lhash.h
++fips_hmac_selftest.o: ../../include/openssl/obj_mac.h
++fips_hmac_selftest.o: ../../include/openssl/objects.h
++fips_hmac_selftest.o: ../../include/openssl/opensslconf.h
++fips_hmac_selftest.o: ../../include/openssl/opensslv.h
++fips_hmac_selftest.o: ../../include/openssl/ossl_typ.h
++fips_hmac_selftest.o: ../../include/openssl/safestack.h
++fips_hmac_selftest.o: ../../include/openssl/stack.h
++fips_hmac_selftest.o: ../../include/openssl/symhacks.h fips_hmac_selftest.c
++fips_md.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_md.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
++fips_md.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_md.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
++fips_md.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
++fips_md.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
++fips_md.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
++fips_md.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
++fips_md.o: fips_md.c
++fips_post.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
++fips_post.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
++fips_post.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
++fips_post.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_post.o: ../../include/openssl/fips.h ../../include/openssl/fips_rand.h
++fips_post.o: ../../include/openssl/hmac.h ../../include/openssl/lhash.h
++fips_post.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
++fips_post.o: ../../include/openssl/opensslconf.h
++fips_post.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
++fips_post.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h
++fips_post.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
++fips_post.o: ../../include/openssl/symhacks.h fips_locl.h fips_post.c
++fips_rand.o: ../../e_os.h ../../include/openssl/aes.h
++fips_rand.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_rand.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
++fips_rand.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_rand.o: ../../include/openssl/fips.h ../../include/openssl/fips_rand.h
++fips_rand.o: ../../include/openssl/hmac.h ../../include/openssl/lhash.h
++fips_rand.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
++fips_rand.o: ../../include/openssl/opensslconf.h
++fips_rand.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
++fips_rand.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
++fips_rand.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
++fips_rand.o: fips_locl.h fips_rand.c
++fips_rand_lib.o: ../../e_os.h ../../include/openssl/aes.h
++fips_rand_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_rand_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
++fips_rand_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
++fips_rand_lib.o: ../../include/openssl/fips.h ../../include/openssl/fips_rand.h
++fips_rand_lib.o: ../../include/openssl/hmac.h ../../include/openssl/lhash.h
++fips_rand_lib.o: ../../include/openssl/obj_mac.h
++fips_rand_lib.o: ../../include/openssl/objects.h
++fips_rand_lib.o: ../../include/openssl/opensslconf.h
++fips_rand_lib.o: ../../include/openssl/opensslv.h
++fips_rand_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
++fips_rand_lib.o: ../../include/openssl/safestack.h
++fips_rand_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
++fips_rand_lib.o: fips_rand_lib.c
++fips_rsa_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_rsa_selftest.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
++fips_rsa_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_rsa_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_rsa_selftest.o: ../../include/openssl/lhash.h
++fips_rsa_selftest.o: ../../include/openssl/obj_mac.h
++fips_rsa_selftest.o: ../../include/openssl/objects.h
++fips_rsa_selftest.o: ../../include/openssl/opensslconf.h
++fips_rsa_selftest.o: ../../include/openssl/opensslv.h
++fips_rsa_selftest.o: ../../include/openssl/ossl_typ.h
++fips_rsa_selftest.o: ../../include/openssl/rsa.h
++fips_rsa_selftest.o: ../../include/openssl/safestack.h
++fips_rsa_selftest.o: ../../include/openssl/stack.h
++fips_rsa_selftest.o: ../../include/openssl/symhacks.h fips_rsa_selftest.c
++fips_rsa_x931g.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_rsa_x931g.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
++fips_rsa_x931g.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_rsa_x931g.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
++fips_rsa_x931g.o: ../../include/openssl/opensslconf.h
++fips_rsa_x931g.o: ../../include/openssl/opensslv.h
++fips_rsa_x931g.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rsa.h
++fips_rsa_x931g.o: ../../include/openssl/safestack.h
++fips_rsa_x931g.o: ../../include/openssl/stack.h
++fips_rsa_x931g.o: ../../include/openssl/symhacks.h fips_rsa_x931g.c
++fips_sha_selftest.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
++fips_sha_selftest.o: ../../include/openssl/crypto.h
++fips_sha_selftest.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
++fips_sha_selftest.o: ../../include/openssl/evp.h ../../include/openssl/fips.h
++fips_sha_selftest.o: ../../include/openssl/lhash.h
++fips_sha_selftest.o: ../../include/openssl/obj_mac.h
++fips_sha_selftest.o: ../../include/openssl/objects.h
++fips_sha_selftest.o: ../../include/openssl/opensslconf.h
++fips_sha_selftest.o: ../../include/openssl/opensslv.h
++fips_sha_selftest.o: ../../include/openssl/ossl_typ.h
++fips_sha_selftest.o: ../../include/openssl/safestack.h
++fips_sha_selftest.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
++fips_sha_selftest.o: ../../include/openssl/symhacks.h fips_sha_selftest.c
+diff --git a/crypto/fips/fips.c b/crypto/fips/fips.c
+new file mode 100644
+index 0000000..e08dd7d
+--- /dev/null
++++ b/crypto/fips/fips.c
+@@ -0,0 +1,501 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define _GNU_SOURCE
++
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include <openssl/err.h>
++#include <openssl/bio.h>
++#include <openssl/hmac.h>
++#include <openssl/rsa.h>
++#include <string.h>
++#include <limits.h>
++#include <dlfcn.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <errno.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++# include <openssl/fips.h>
++
++# ifndef PATH_MAX
++#  define PATH_MAX 1024
++# endif
++
++static int fips_selftest_fail = 0;
++static int fips_mode = 0;
++static int fips_started = 0;
++
++static int fips_is_owning_thread(void);
++static int fips_set_owning_thread(void);
++static int fips_clear_owning_thread(void);
++
++# define fips_w_lock()   CRYPTO_w_lock(CRYPTO_LOCK_FIPS)
++# define fips_w_unlock() CRYPTO_w_unlock(CRYPTO_LOCK_FIPS)
++# define fips_r_lock()   CRYPTO_r_lock(CRYPTO_LOCK_FIPS)
++# define fips_r_unlock() CRYPTO_r_unlock(CRYPTO_LOCK_FIPS)
++
++static void fips_set_mode(int onoff)
++{
++    int owning_thread = fips_is_owning_thread();
++
++    if (fips_started) {
++        if (!owning_thread)
++            fips_w_lock();
++        fips_mode = onoff;
++        if (!owning_thread)
++            fips_w_unlock();
++    }
++}
++
++int FIPS_module_mode(void)
++{
++    int ret = 0;
++    int owning_thread = fips_is_owning_thread();
++
++    if (fips_started) {
++        if (!owning_thread)
++            fips_r_lock();
++        ret = fips_mode;
++        if (!owning_thread)
++            fips_r_unlock();
++    }
++    return ret;
++}
++
++int FIPS_selftest_failed(void)
++{
++    int ret = 0;
++    if (fips_started) {
++        int owning_thread = fips_is_owning_thread();
++
++        if (!owning_thread)
++            fips_r_lock();
++        ret = fips_selftest_fail;
++        if (!owning_thread)
++            fips_r_unlock();
++    }
++    return ret;
++}
++
++/* Selftest failure fatal exit routine. This will be called
++ * during *any* cryptographic operation. It has the minimum
++ * overhead possible to avoid too big a performance hit.
++ */
++
++void FIPS_selftest_check(void)
++{
++    if (fips_selftest_fail) {
++        OpenSSLDie(__FILE__, __LINE__, "FATAL FIPS SELFTEST FAILURE");
++    }
++}
++
++void fips_set_selftest_fail(void)
++{
++    fips_selftest_fail = 1;
++}
++
++/* we implement what libfipscheck does ourselves */
++
++static int
++get_library_path(const char *libname, const char *symbolname, char *path,
++                 size_t pathlen)
++{
++    Dl_info info;
++    void *dl, *sym;
++    int rv = -1;
++
++    dl = dlopen(libname, RTLD_LAZY);
++    if (dl == NULL) {
++        return -1;
++    }
++
++    sym = dlsym(dl, symbolname);
++
++    if (sym != NULL && dladdr(sym, &info)) {
++        strncpy(path, info.dli_fname, pathlen - 1);
++        path[pathlen - 1] = '\0';
++        rv = 0;
++    }
++
++    dlclose(dl);
++
++    return rv;
++}
++
++static const char conv[] = "0123456789abcdef";
++
++static char *bin2hex(void *buf, size_t len)
++{
++    char *hex, *p;
++    unsigned char *src = buf;
++
++    hex = malloc(len * 2 + 1);
++    if (hex == NULL)
++        return NULL;
++
++    p = hex;
++
++    while (len > 0) {
++        unsigned c;
++
++        c = *src;
++        src++;
++
++        *p = conv[c >> 4];
++        ++p;
++        *p = conv[c & 0x0f];
++        ++p;
++        --len;
++    }
++    *p = '\0';
++    return hex;
++}
++
++# define HMAC_PREFIX "."
++# ifndef HMAC_SUFFIX
++#  define HMAC_SUFFIX ".hmac"
++# endif
++# define READ_BUFFER_LENGTH 16384
++
++static char *make_hmac_path(const char *origpath)
++{
++    char *path, *p;
++    const char *fn;
++
++    path =
++        malloc(sizeof(HMAC_PREFIX) + sizeof(HMAC_SUFFIX) + strlen(origpath));
++    if (path == NULL) {
++        return NULL;
++    }
++
++    fn = strrchr(origpath, '/');
++    if (fn == NULL) {
++        fn = origpath;
++    } else {
++        ++fn;
++    }
++
++    strncpy(path, origpath, fn - origpath);
++    p = path + (fn - origpath);
++    p = stpcpy(p, HMAC_PREFIX);
++    p = stpcpy(p, fn);
++    p = stpcpy(p, HMAC_SUFFIX);
++
++    return path;
++}
++
++static const char hmackey[] = "orboDeJITITejsirpADONivirpUkvarP";
++
++static int compute_file_hmac(const char *path, void **buf, size_t *hmaclen)
++{
++    FILE *f = NULL;
++    int rv = -1;
++    unsigned char rbuf[READ_BUFFER_LENGTH];
++    size_t len;
++    unsigned int hlen;
++    HMAC_CTX c;
++
++    HMAC_CTX_init(&c);
++
++    f = fopen(path, "r");
++
++    if (f == NULL) {
++        goto end;
++    }
++
++    HMAC_Init(&c, hmackey, sizeof(hmackey) - 1, EVP_sha256());
++
++    while ((len = fread(rbuf, 1, sizeof(rbuf), f)) != 0) {
++        HMAC_Update(&c, rbuf, len);
++    }
++
++    len = sizeof(rbuf);
++    /* reuse rbuf for hmac */
++    HMAC_Final(&c, rbuf, &hlen);
++
++    *buf = malloc(hlen);
++    if (*buf == NULL) {
++        goto end;
++    }
++
++    *hmaclen = hlen;
++
++    memcpy(*buf, rbuf, hlen);
++
++    rv = 0;
++ end:
++    HMAC_CTX_cleanup(&c);
++
++    if (f)
++        fclose(f);
++
++    return rv;
++}
++
++static int FIPSCHECK_verify(const char *path)
++{
++    int rv = 0;
++    FILE *hf;
++    char *hmacpath, *p;
++    char *hmac = NULL;
++    size_t n;
++
++    hmacpath = make_hmac_path(path);
++    if (hmacpath == NULL)
++        return 0;
++
++    hf = fopen(hmacpath, "r");
++    if (hf == NULL) {
++        free(hmacpath);
++        return 0;
++    }
++
++    if (getline(&hmac, &n, hf) > 0) {
++        void *buf;
++        size_t hmaclen;
++        char *hex;
++
++        if ((p = strchr(hmac, '\n')) != NULL)
++            *p = '\0';
++
++        if (compute_file_hmac(path, &buf, &hmaclen) < 0) {
++            rv = -4;
++            goto end;
++        }
++
++        if ((hex = bin2hex(buf, hmaclen)) == NULL) {
++            free(buf);
++            rv = -5;
++            goto end;
++        }
++
++        if (strcmp(hex, hmac) != 0) {
++            rv = -1;
++        }
++        free(buf);
++        free(hex);
++    } else {
++        rv = -1;
++    }
++
++ end:
++    free(hmac);
++    free(hmacpath);
++    fclose(hf);
++
++    if (rv < 0)
++        return 0;
++
++    /* check successful */
++    return 1;
++}
++
++static int verify_checksums(void)
++{
++    int rv;
++    char path[PATH_MAX + 1];
++    char *p;
++
++    /* we need to avoid dlopening libssl, assume both libcrypto and libssl
++       are in the same directory */
++
++    rv = get_library_path("libcrypto.so." SHLIB_VERSION_NUMBER,
++                          "FIPS_mode_set", path, sizeof(path));
++    if (rv < 0)
++        return 0;
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++
++    /* replace libcrypto with libssl */
++    while ((p = strstr(path, "libcrypto.so")) != NULL) {
++        p = stpcpy(p, "libssl");
++        memmove(p, p + 3, strlen(p + 2));
++    }
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++    return 1;
++}
++
++int FIPS_module_mode_set(int onoff, const char *auth)
++{
++    int ret = 0;
++
++    fips_w_lock();
++    fips_started = 1;
++    fips_set_owning_thread();
++
++    if (onoff) {
++
++        fips_selftest_fail = 0;
++
++        /* Don't go into FIPS mode twice, just so we can do automagic
++           seeding */
++        if (FIPS_module_mode()) {
++            FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++                    FIPS_R_FIPS_MODE_ALREADY_SET);
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++# ifdef OPENSSL_IA32_SSE2
++        {
++            extern unsigned int OPENSSL_ia32cap_P[2];
++            if ((OPENSSL_ia32cap_P[0] & (1 << 25 | 1 << 26)) !=
++                (1 << 25 | 1 << 26)) {
++                FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++                        FIPS_R_UNSUPPORTED_PLATFORM);
++                fips_selftest_fail = 1;
++                ret = 0;
++                goto end;
++            }
++           OPENSSL_ia32cap_P[0] |= (1<<28);     /* set "shared cache"   */
++           OPENSSL_ia32cap_P[1] &= ~(1<<(60-32));       /* clear AVX    */
++        }
++# endif
++
++	if (!FIPS_selftest()) {
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++
++	if (!verify_checksums()) {
++	    FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++		    FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++
++	fips_set_mode(onoff);
++        ret = 1;
++        goto end;
++    }
++    fips_set_mode(0);
++    fips_selftest_fail = 0;
++    ret = 1;
++ end:
++    fips_clear_owning_thread();
++    fips_w_unlock();
++    return ret;
++}
++
++static CRYPTO_THREADID fips_thread;
++static int fips_thread_set = 0;
++
++static int fips_is_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_r_lock(CRYPTO_LOCK_FIPS2);
++        if (fips_thread_set) {
++            CRYPTO_THREADID cur;
++            CRYPTO_THREADID_current(&cur);
++            if (!CRYPTO_THREADID_cmp(&cur, &fips_thread))
++                ret = 1;
++        }
++        CRYPTO_r_unlock(CRYPTO_LOCK_FIPS2);
++    }
++    return ret;
++}
++
++int fips_set_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
++        if (!fips_thread_set) {
++            CRYPTO_THREADID_current(&fips_thread);
++            ret = 1;
++            fips_thread_set = 1;
++        }
++        CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
++    }
++    return ret;
++}
++
++int fips_clear_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
++        if (fips_thread_set) {
++            CRYPTO_THREADID cur;
++            CRYPTO_THREADID_current(&cur);
++            if (!CRYPTO_THREADID_cmp(&cur, &fips_thread))
++                fips_thread_set = 0;
++        }
++        CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
++    }
++    return ret;
++}
++
++# if 0
++/* The purpose of this is to ensure the error code exists and the function
++ * name is to keep the error checking script quiet
++ */
++void hash_final(void)
++{
++    FIPSerr(FIPS_F_HASH_FINAL, FIPS_R_NON_FIPS_METHOD);
++}
++# endif
++
++#endif
+diff --git a/crypto/fips/fips.h b/crypto/fips/fips.h
+new file mode 100644
+index 0000000..22b21a8
+--- /dev/null
++++ b/crypto/fips/fips.h
+@@ -0,0 +1,254 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <openssl/opensslconf.h>
++#include <openssl/crypto.h>
++#include <stdarg.h>
++
++#ifndef OPENSSL_FIPS
++#error FIPS is disabled.
++#endif
++
++#ifdef OPENSSL_FIPS
++
++# ifdef  __cplusplus
++extern "C" {
++# endif
++
++    struct dsa_st;
++    struct rsa_st;
++    struct evp_pkey_st;
++    struct env_md_st;
++    struct env_md_ctx_st;
++    struct evp_cipher_st;
++    struct evp_cipher_ctx_st;
++    struct dh_method;
++    struct CMAC_CTX_st;
++    struct hmac_ctx_st;
++
++    int FIPS_module_mode_set(int onoff, const char *auth);
++    int FIPS_module_mode(void);
++    int FIPS_module_installed(void);
++    const void *FIPS_rand_check(void);
++    int FIPS_selftest(void);
++    int FIPS_selftest_failed(void);
++    void FIPS_corrupt_sha1(void);
++    int FIPS_selftest_sha1(void);
++    int FIPS_selftest_sha2(void);
++    void FIPS_corrupt_aes(void);
++    int FIPS_selftest_aes_ccm(void);
++    int FIPS_selftest_aes_gcm(void);
++    int FIPS_selftest_aes_xts(void);
++    int FIPS_selftest_aes(void);
++    void FIPS_corrupt_des(void);
++    int FIPS_selftest_des(void);
++    void FIPS_corrupt_rsa(void);
++    void FIPS_corrupt_rsa_keygen(void);
++    int FIPS_selftest_rsa(void);
++    void FIPS_corrupt_dsa(void);
++    int FIPS_selftest_dsa(void);
++    int FIPS_selftest_ecdsa(void);
++    int FIPS_selftest_ecdh(void);
++    int FIPS_selftest_dh(void);
++    void FIPS_corrupt_rng(void);
++    void FIPS_rng_stick(void);
++    void FIPS_x931_stick(int onoff);
++    void FIPS_drbg_stick(int onoff);
++    int FIPS_selftest_rng(void);
++    int FIPS_selftest_x931(void);
++    int FIPS_selftest_hmac(void);
++    int FIPS_selftest_drbg(void);
++    int FIPS_selftest_drbg_all(void);
++    int FIPS_selftest_cmac(void);
++
++    int fips_check_rsa(struct rsa_st *rsa);
++    int fips_check_dsa_prng(struct dsa_st *dsa, size_t L, size_t N);
++
++    void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr);
++
++# define FIPS_ERROR_IGNORED(alg) OpenSSLDie(__FILE__, __LINE__, \
++                alg " previous FIPS forbidden algorithm error ignored");
++
++    int fips_pkey_signature_test(struct evp_pkey_st *pkey,
++                                 const unsigned char *tbs, int tbslen,
++                                 const unsigned char *kat,
++                                 unsigned int katlen,
++                                 const struct env_md_st *digest,
++                                 unsigned int md_flags, const char *fail_str);
++
++    int fips_cipher_test(struct evp_cipher_ctx_st *ctx,
++                         const struct evp_cipher_st *cipher,
++                         const unsigned char *key,
++                         const unsigned char *iv,
++                         const unsigned char *plaintext,
++                         const unsigned char *ciphertext, int len);
++
++    void fips_set_selftest_fail(void);
++
++    const struct env_md_st *FIPS_get_digestbynid(int nid);
++
++    const struct evp_cipher_st *FIPS_get_cipherbynid(int nid);
++
++/* BEGIN ERROR CODES */
++/*
++ * The following lines are auto generated by the script mkerr.pl. Any changes
++ * made after this point may be overwritten when the script is next run.
++ */
++void ERR_load_FIPS_strings(void);
++
++/* Error codes for the FIPS functions. */
++
++/* Function codes. */
++# define FIPS_F_DH_BUILTIN_GENPARAMS                      100
++# define FIPS_F_DRBG_RESEED                               101
++# define FIPS_F_DSA_BUILTIN_PARAMGEN                      102
++# define FIPS_F_DSA_BUILTIN_PARAMGEN2                     103
++# define FIPS_F_DSA_DO_SIGN                               104
++# define FIPS_F_DSA_DO_VERIFY                             105
++# define FIPS_F_ECDH_COMPUTE_KEY                          106
++# define FIPS_F_ECDSA_DO_SIGN                             107
++# define FIPS_F_ECDSA_DO_VERIFY                           108
++# define FIPS_F_EC_KEY_GENERATE_KEY                       109
++# define FIPS_F_EVP_CIPHERINIT_EX                         110
++# define FIPS_F_EVP_DIGESTINIT_EX                         111
++# define FIPS_F_FIPS_CHECK_DSA                            112
++# define FIPS_F_FIPS_CHECK_DSA_PRNG                       113
++# define FIPS_F_FIPS_CHECK_EC                             114
++# define FIPS_F_FIPS_CHECK_RSA                            115
++# define FIPS_F_FIPS_DRBG_BYTES                           116
++# define FIPS_F_FIPS_DRBG_CHECK                           117
++# define FIPS_F_FIPS_DRBG_CPRNG_TEST                      118
++# define FIPS_F_FIPS_DRBG_ERROR_CHECK                     119
++# define FIPS_F_FIPS_DRBG_GENERATE                        120
++# define FIPS_F_FIPS_DRBG_INIT                            121
++# define FIPS_F_FIPS_DRBG_INSTANTIATE                     122
++# define FIPS_F_FIPS_DRBG_NEW                             123
++# define FIPS_F_FIPS_DRBG_SINGLE_KAT                      124
++# define FIPS_F_FIPS_GET_ENTROPY                          125
++# define FIPS_F_FIPS_MODULE_MODE_SET                      126
++# define FIPS_F_FIPS_PKEY_SIGNATURE_TEST                  127
++# define FIPS_F_FIPS_RAND_ADD                             128
++# define FIPS_F_FIPS_RAND_BYTES                           129
++# define FIPS_F_FIPS_RAND_PSEUDO_BYTES                    130
++# define FIPS_F_FIPS_RAND_SEED                            131
++# define FIPS_F_FIPS_RAND_SET_METHOD                      132
++# define FIPS_F_FIPS_RAND_STATUS                          133
++# define FIPS_F_FIPS_RSA_BUILTIN_KEYGEN                   134
++# define FIPS_F_FIPS_SELFTEST_AES                         135
++# define FIPS_F_FIPS_SELFTEST_AES_CCM                     136
++# define FIPS_F_FIPS_SELFTEST_AES_GCM                     137
++# define FIPS_F_FIPS_SELFTEST_AES_XTS                     138
++# define FIPS_F_FIPS_SELFTEST_CMAC                        139
++# define FIPS_F_FIPS_SELFTEST_DES                         140
++# define FIPS_F_FIPS_SELFTEST_HMAC                        141
++# define FIPS_F_FIPS_SELFTEST_SHA1                        142
++# define FIPS_F_FIPS_SELFTEST_SHA2                        143
++# define FIPS_F_FIPS_SELFTEST_X931                        144
++# define FIPS_F_FIPS_SET_PRNG_KEY                         145
++# define FIPS_F_HASH_FINAL                                146
++# define FIPS_F_RSA_BUILTIN_KEYGEN                        147
++# define FIPS_F_RSA_EAY_PRIVATE_DECRYPT                   148
++# define FIPS_F_RSA_EAY_PRIVATE_ENCRYPT                   149
++# define FIPS_F_RSA_EAY_PUBLIC_DECRYPT                    150
++# define FIPS_F_RSA_EAY_PUBLIC_ENCRYPT                    151
++# define FIPS_F_RSA_X931_GENERATE_KEY_EX                  152
++
++/* Reason codes. */
++# define FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED         100
++# define FIPS_R_ADDITIONAL_INPUT_TOO_LONG                 101
++# define FIPS_R_ALREADY_INSTANTIATED                      102
++# define FIPS_R_DRBG_NOT_INITIALISED                      103
++# define FIPS_R_DRBG_STUCK                                104
++# define FIPS_R_ENTROPY_ERROR_UNDETECTED                  105
++# define FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED          106
++# define FIPS_R_ENTROPY_SOURCE_STUCK                      107
++# define FIPS_R_ERROR_INITIALISING_DRBG                   108
++# define FIPS_R_ERROR_INSTANTIATING_DRBG                  109
++# define FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT         110
++# define FIPS_R_ERROR_RETRIEVING_ENTROPY                  111
++# define FIPS_R_ERROR_RETRIEVING_NONCE                    112
++# define FIPS_R_FINGERPRINT_DOES_NOT_MATCH                113
++# define FIPS_R_FIPS_MODE_ALREADY_SET                     114
++# define FIPS_R_FIPS_SELFTEST_FAILED                      115
++# define FIPS_R_FUNCTION_ERROR                            116
++# define FIPS_R_GENERATE_ERROR                            117
++# define FIPS_R_GENERATE_ERROR_UNDETECTED                 118
++# define FIPS_R_INSTANTIATE_ERROR                         119
++# define FIPS_R_INTERNAL_ERROR                            120
++# define FIPS_R_INVALID_KEY_LENGTH                        121
++# define FIPS_R_INVALID_PARAMETERS                        122
++# define FIPS_R_IN_ERROR_STATE                            123
++# define FIPS_R_KEY_TOO_SHORT                             124
++# define FIPS_R_NONCE_ERROR_UNDETECTED                    125
++# define FIPS_R_NON_FIPS_METHOD                           126
++# define FIPS_R_NOPR_TEST1_FAILURE                        127
++# define FIPS_R_NOPR_TEST2_FAILURE                        128
++# define FIPS_R_NOT_INSTANTIATED                          129
++# define FIPS_R_PAIRWISE_TEST_FAILED                      130
++# define FIPS_R_PERSONALISATION_ERROR_UNDETECTED          131
++# define FIPS_R_PERSONALISATION_STRING_TOO_LONG           132
++# define FIPS_R_PRNG_STRENGTH_TOO_LOW                     133
++# define FIPS_R_PR_TEST1_FAILURE                          134
++# define FIPS_R_PR_TEST2_FAILURE                          135
++# define FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED           136
++# define FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG                137
++# define FIPS_R_RESEED_COUNTER_ERROR                      138
++# define FIPS_R_RESEED_ERROR                              139
++# define FIPS_R_SELFTEST_FAILED                           140
++# define FIPS_R_SELFTEST_FAILURE                          141
++# define FIPS_R_TEST_FAILURE                              142
++# define FIPS_R_UNINSTANTIATE_ERROR                       143
++# define FIPS_R_UNINSTANTIATE_ZEROISE_ERROR               144
++# define FIPS_R_UNSUPPORTED_DRBG_TYPE                     145
++# define FIPS_R_UNSUPPORTED_PLATFORM                      146
++
++#ifdef  __cplusplus
++}
++#endif
++#endif
+diff --git a/crypto/fips/fips_aes_selftest.c b/crypto/fips/fips_aes_selftest.c
+new file mode 100644
+index 0000000..ee2a4f1
+--- /dev/null
++++ b/crypto/fips/fips_aes_selftest.c
+@@ -0,0 +1,365 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/evp.h>
++
++#ifdef OPENSSL_FIPS
++static const struct {
++    const unsigned char key[16];
++    const unsigned char plaintext[16];
++    const unsigned char ciphertext[16];
++} tests[] = {
++    {
++        {
++        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++                0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F}, {
++        0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
++                0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}, {
++0x69, 0xC4, 0xE0, 0xD8, 0x6A, 0x7B, 0x04, 0x30,
++                0xD8, 0xCD, 0xB7, 0x80, 0x70, 0xB4, 0xC5, 0x5A},},};
++
++static int corrupt_aes;
++
++void FIPS_corrupt_aes()
++{
++    corrupt_aes = 1;
++}
++
++int FIPS_selftest_aes()
++{
++    int n;
++    int ret = 0;
++    EVP_CIPHER_CTX ctx;
++    EVP_CIPHER_CTX_init(&ctx);
++
++    for (n = 0; n < 1; ++n) {
++        unsigned char key[16];
++
++        memcpy(key, tests[n].key, sizeof(key));
++        if (corrupt_aes)
++            key[0]++;
++        if (fips_cipher_test(&ctx, EVP_aes_128_ecb(),
++                             key, NULL,
++                             tests[n].plaintext,
++                             tests[n].ciphertext, 16) <= 0)
++            goto err;
++    }
++    ret = 1;
++ err:
++    EVP_CIPHER_CTX_cleanup(&ctx);
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES, FIPS_R_SELFTEST_FAILED);
++    return ret;
++}
++
++/* AES-CCM test data from NIST public test vectors */
++
++static const unsigned char ccm_key[] = {
++    0xce, 0xb0, 0x09, 0xae, 0xa4, 0x45, 0x44, 0x51, 0xfe, 0xad, 0xf0, 0xe6,
++    0xb3, 0x6f, 0x45, 0x55, 0x5d, 0xd0, 0x47, 0x23, 0xba, 0xa4, 0x48, 0xe8
++};
++
++static const unsigned char ccm_nonce[] = {
++    0x76, 0x40, 0x43, 0xc4, 0x94, 0x60, 0xb7
++};
++
++static const unsigned char ccm_adata[] = {
++    0x6e, 0x80, 0xdd, 0x7f, 0x1b, 0xad, 0xf3, 0xa1, 0xc9, 0xab, 0x25, 0xc7,
++    0x5f, 0x10, 0xbd, 0xe7, 0x8c, 0x23, 0xfa, 0x0e, 0xb8, 0xf9, 0xaa, 0xa5,
++    0x3a, 0xde, 0xfb, 0xf4, 0xcb, 0xf7, 0x8f, 0xe4
++};
++
++static const unsigned char ccm_pt[] = {
++    0xc8, 0xd2, 0x75, 0xf9, 0x19, 0xe1, 0x7d, 0x7f, 0xe6, 0x9c, 0x2a, 0x1f,
++    0x58, 0x93, 0x9d, 0xfe, 0x4d, 0x40, 0x37, 0x91, 0xb5, 0xdf, 0x13, 0x10
++};
++
++static const unsigned char ccm_ct[] = {
++    0x8a, 0x0f, 0x3d, 0x82, 0x29, 0xe4, 0x8e, 0x74, 0x87, 0xfd, 0x95, 0xa2,
++    0x8a, 0xd3, 0x92, 0xc8, 0x0b, 0x36, 0x81, 0xd4, 0xfb, 0xc7, 0xbb, 0xfd
++};
++
++static const unsigned char ccm_tag[] = {
++    0x2d, 0xd6, 0xef, 0x1c, 0x45, 0xd4, 0xcc, 0xb7, 0x23, 0xdc, 0x07, 0x44,
++    0x14, 0xdb, 0x50, 0x6d
++};
++
++int FIPS_selftest_aes_ccm(void)
++{
++    int ret = 0;
++    unsigned char out[128], tag[16];
++    EVP_CIPHER_CTX ctx;
++    EVP_CIPHER_CTX_init(&ctx);
++    memset(out, 0, sizeof(out));
++    if (!EVP_CipherInit_ex(&ctx, EVP_aes_192_ccm(), NULL, NULL, NULL, 1))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_CCM_SET_IVLEN,
++                             sizeof(ccm_nonce), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_CCM_SET_TAG,
++                             sizeof(ccm_tag), NULL))
++        goto err;
++    if (!EVP_CipherInit_ex(&ctx, NULL, NULL, ccm_key, ccm_nonce, 1))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, NULL, sizeof(ccm_pt)) != sizeof(ccm_pt))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, ccm_adata, sizeof(ccm_adata)) < 0)
++        goto err;
++    if (EVP_Cipher(&ctx, out, ccm_pt, sizeof(ccm_pt)) != sizeof(ccm_ct))
++        goto err;
++
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_CCM_GET_TAG, 16, tag))
++        goto err;
++    if (memcmp(tag, ccm_tag, sizeof(ccm_tag))
++        || memcmp(out, ccm_ct, sizeof(ccm_ct)))
++        goto err;
++
++    memset(out, 0, sizeof(out));
++
++    if (!EVP_CipherInit_ex(&ctx, EVP_aes_192_ccm(), NULL, NULL, NULL, 0))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_CCM_SET_IVLEN,
++                             sizeof(ccm_nonce), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_CCM_SET_TAG, 16, tag))
++        goto err;
++    if (!EVP_CipherInit_ex(&ctx, NULL, NULL, ccm_key, ccm_nonce, 0))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, NULL, sizeof(ccm_ct)) != sizeof(ccm_ct))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, ccm_adata, sizeof(ccm_adata)) < 0)
++        goto err;
++    if (EVP_Cipher(&ctx, out, ccm_ct, sizeof(ccm_ct)) != sizeof(ccm_pt))
++        goto err;
++
++    if (memcmp(out, ccm_pt, sizeof(ccm_pt)))
++        goto err;
++
++    ret = 1;
++
++ err:
++    EVP_CIPHER_CTX_cleanup(&ctx);
++
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_CCM, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    } else
++        return ret;
++
++}
++
++/* AES-GCM test data from NIST public test vectors */
++
++static const unsigned char gcm_key[] = {
++    0xee, 0xbc, 0x1f, 0x57, 0x48, 0x7f, 0x51, 0x92, 0x1c, 0x04, 0x65, 0x66,
++    0x5f, 0x8a, 0xe6, 0xd1, 0x65, 0x8b, 0xb2, 0x6d, 0xe6, 0xf8, 0xa0, 0x69,
++    0xa3, 0x52, 0x02, 0x93, 0xa5, 0x72, 0x07, 0x8f
++};
++
++static const unsigned char gcm_iv[] = {
++    0x99, 0xaa, 0x3e, 0x68, 0xed, 0x81, 0x73, 0xa0, 0xee, 0xd0, 0x66, 0x84
++};
++
++static const unsigned char gcm_pt[] = {
++    0xf5, 0x6e, 0x87, 0x05, 0x5b, 0xc3, 0x2d, 0x0e, 0xeb, 0x31, 0xb2, 0xea,
++    0xcc, 0x2b, 0xf2, 0xa5
++};
++
++static const unsigned char gcm_aad[] = {
++    0x4d, 0x23, 0xc3, 0xce, 0xc3, 0x34, 0xb4, 0x9b, 0xdb, 0x37, 0x0c, 0x43,
++    0x7f, 0xec, 0x78, 0xde
++};
++
++static const unsigned char gcm_ct[] = {
++    0xf7, 0x26, 0x44, 0x13, 0xa8, 0x4c, 0x0e, 0x7c, 0xd5, 0x36, 0x86, 0x7e,
++    0xb9, 0xf2, 0x17, 0x36
++};
++
++static const unsigned char gcm_tag[] = {
++    0x67, 0xba, 0x05, 0x10, 0x26, 0x2a, 0xe4, 0x87, 0xd7, 0x37, 0xee, 0x62,
++    0x98, 0xf7, 0x7e, 0x0c
++};
++
++int FIPS_selftest_aes_gcm(void)
++{
++    int ret = 0;
++    unsigned char out[128], tag[16];
++    EVP_CIPHER_CTX ctx;
++    EVP_CIPHER_CTX_init(&ctx);
++    memset(out, 0, sizeof(out));
++    memset(tag, 0, sizeof(tag));
++    if (!EVP_CipherInit_ex(&ctx, EVP_aes_256_gcm(), NULL, NULL, NULL, 1))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_IVLEN,
++                             sizeof(gcm_iv), NULL))
++        goto err;
++    if (!EVP_CipherInit_ex(&ctx, NULL, NULL, gcm_key, gcm_iv, 1))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, gcm_aad, sizeof(gcm_aad)) < 0)
++        goto err;
++    if (EVP_Cipher(&ctx, out, gcm_pt, sizeof(gcm_pt)) != sizeof(gcm_ct))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, NULL, 0) < 0)
++        goto err;
++
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, 16, tag))
++        goto err;
++
++    if (memcmp(tag, gcm_tag, 16) || memcmp(out, gcm_ct, 16))
++        goto err;
++
++    memset(out, 0, sizeof(out));
++
++    if (!EVP_CipherInit_ex(&ctx, EVP_aes_256_gcm(), NULL, NULL, NULL, 0))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_IVLEN,
++                             sizeof(gcm_iv), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, 16, tag))
++        goto err;
++    if (!EVP_CipherInit_ex(&ctx, NULL, NULL, gcm_key, gcm_iv, 0))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, gcm_aad, sizeof(gcm_aad)) < 0)
++        goto err;
++    if (EVP_Cipher(&ctx, out, gcm_ct, sizeof(gcm_ct)) != sizeof(gcm_pt))
++        goto err;
++    if (EVP_Cipher(&ctx, NULL, NULL, 0) < 0)
++        goto err;
++
++    if (memcmp(out, gcm_pt, 16))
++        goto err;
++
++    ret = 1;
++
++ err:
++    EVP_CIPHER_CTX_cleanup(&ctx);
++
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_GCM, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    } else
++        return ret;
++
++}
++
++static const unsigned char XTS_128_key[] = {
++    0xa1, 0xb9, 0x0c, 0xba, 0x3f, 0x06, 0xac, 0x35, 0x3b, 0x2c, 0x34, 0x38,
++    0x76, 0x08, 0x17, 0x62, 0x09, 0x09, 0x23, 0x02, 0x6e, 0x91, 0x77, 0x18,
++    0x15, 0xf2, 0x9d, 0xab, 0x01, 0x93, 0x2f, 0x2f
++};
++
++static const unsigned char XTS_128_i[] = {
++    0x4f, 0xae, 0xf7, 0x11, 0x7c, 0xda, 0x59, 0xc6, 0x6e, 0x4b, 0x92, 0x01,
++    0x3e, 0x76, 0x8a, 0xd5
++};
++
++static const unsigned char XTS_128_pt[] = {
++    0xeb, 0xab, 0xce, 0x95, 0xb1, 0x4d, 0x3c, 0x8d, 0x6f, 0xb3, 0x50, 0x39,
++    0x07, 0x90, 0x31, 0x1c
++};
++
++static const unsigned char XTS_128_ct[] = {
++    0x77, 0x8a, 0xe8, 0xb4, 0x3c, 0xb9, 0x8d, 0x5a, 0x82, 0x50, 0x81, 0xd5,
++    0xbe, 0x47, 0x1c, 0x63
++};
++
++static const unsigned char XTS_256_key[] = {
++    0x1e, 0xa6, 0x61, 0xc5, 0x8d, 0x94, 0x3a, 0x0e, 0x48, 0x01, 0xe4, 0x2f,
++    0x4b, 0x09, 0x47, 0x14, 0x9e, 0x7f, 0x9f, 0x8e, 0x3e, 0x68, 0xd0, 0xc7,
++    0x50, 0x52, 0x10, 0xbd, 0x31, 0x1a, 0x0e, 0x7c, 0xd6, 0xe1, 0x3f, 0xfd,
++    0xf2, 0x41, 0x8d, 0x8d, 0x19, 0x11, 0xc0, 0x04, 0xcd, 0xa5, 0x8d, 0xa3,
++    0xd6, 0x19, 0xb7, 0xe2, 0xb9, 0x14, 0x1e, 0x58, 0x31, 0x8e, 0xea, 0x39,
++    0x2c, 0xf4, 0x1b, 0x08
++};
++
++static const unsigned char XTS_256_i[] = {
++    0xad, 0xf8, 0xd9, 0x26, 0x27, 0x46, 0x4a, 0xd2, 0xf0, 0x42, 0x8e, 0x84,
++    0xa9, 0xf8, 0x75, 0x64
++};
++
++static const unsigned char XTS_256_pt[] = {
++    0x2e, 0xed, 0xea, 0x52, 0xcd, 0x82, 0x15, 0xe1, 0xac, 0xc6, 0x47, 0xe8,
++    0x10, 0xbb, 0xc3, 0x64, 0x2e, 0x87, 0x28, 0x7f, 0x8d, 0x2e, 0x57, 0xe3,
++    0x6c, 0x0a, 0x24, 0xfb, 0xc1, 0x2a, 0x20, 0x2e
++};
++
++static const unsigned char XTS_256_ct[] = {
++    0xcb, 0xaa, 0xd0, 0xe2, 0xf6, 0xce, 0xa3, 0xf5, 0x0b, 0x37, 0xf9, 0x34,
++    0xd4, 0x6a, 0x9b, 0x13, 0x0b, 0x9d, 0x54, 0xf0, 0x7e, 0x34, 0xf3, 0x6a,
++    0xf7, 0x93, 0xe8, 0x6f, 0x73, 0xc6, 0xd7, 0xdb
++};
++
++int FIPS_selftest_aes_xts()
++{
++    int ret = 1;
++    EVP_CIPHER_CTX ctx;
++    EVP_CIPHER_CTX_init(&ctx);
++
++    if (fips_cipher_test(&ctx, EVP_aes_128_xts(),
++                         XTS_128_key, XTS_128_i, XTS_128_pt, XTS_128_ct,
++                         sizeof(XTS_128_pt)) <= 0)
++        ret = 0;
++
++    if (fips_cipher_test(&ctx, EVP_aes_256_xts(),
++                         XTS_256_key, XTS_256_i, XTS_256_pt, XTS_256_ct,
++                         sizeof(XTS_256_pt)) <= 0)
++        ret = 0;
++
++    EVP_CIPHER_CTX_cleanup(&ctx);
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_XTS, FIPS_R_SELFTEST_FAILED);
++    return ret;
++}
++
++#endif
+diff --git a/crypto/fips/fips_cmac_selftest.c b/crypto/fips/fips_cmac_selftest.c
+new file mode 100644
+index 0000000..9597520
+--- /dev/null
++++ b/crypto/fips/fips_cmac_selftest.c
+@@ -0,0 +1,157 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#include <openssl/cmac.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include "fips_locl.h"
++
++typedef struct {
++    int nid;
++    const unsigned char key[EVP_MAX_KEY_LENGTH];
++    size_t keysize;
++    const unsigned char msg[64];
++    size_t msgsize;
++    const unsigned char mac[32];
++    size_t macsize;
++} CMAC_KAT;
++
++/* from http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf */
++static const CMAC_KAT vector[] = {
++    {NID_aes_128_cbc,           /* Count = 32 from CMACGenAES128.txt */
++     {0x77, 0xa7, 0x7f, 0xaf, 0x29, 0x0c, 0x1f, 0xa3,
++      0x0c, 0x68, 0x3d, 0xf1, 0x6b, 0xa7, 0xa7, 0x7b,}, 128,
++     {0x02, 0x06, 0x83, 0xe1, 0xf0, 0x39, 0x2f, 0x4c,
++      0xac, 0x54, 0x31, 0x8b, 0x60, 0x29, 0x25, 0x9e,
++      0x9c, 0x55, 0x3d, 0xbc, 0x4b, 0x6a, 0xd9, 0x98,
++      0xe6, 0x4d, 0x58, 0xe4, 0xe7, 0xdc, 0x2e, 0x13,}, 256,
++     {0xfb, 0xfe, 0xa4, 0x1b,}, 32},
++    {NID_aes_192_cbc,           /* Count = 23 from CMACGenAES192.txt */
++     {0x7b, 0x32, 0x39, 0x13, 0x69, 0xaa, 0x4c, 0xa9,
++      0x75, 0x58, 0x09, 0x5b, 0xe3, 0xc3, 0xec, 0x86,
++      0x2b, 0xd0, 0x57, 0xce, 0xf1, 0xe3, 0x2d, 0x62,}, 192,
++     {0x0}, 0,
++     {0xe4, 0xd9, 0x34, 0x0b, 0x03, 0xe6, 0x7d, 0xef,
++      0xd4, 0x96, 0x9c, 0xc1, 0xed, 0x37, 0x35, 0xe6,}, 128,
++     },
++    {NID_aes_256_cbc,           /* Count = 33 from CMACGenAES256.txt */
++     {0x0b, 0x12, 0x2a, 0xc8, 0xf3, 0x4e, 0xd1, 0xfe,
++      0x08, 0x2a, 0x36, 0x25, 0xd1, 0x57, 0x56, 0x14,
++      0x54, 0x16, 0x7a, 0xc1, 0x45, 0xa1, 0x0b, 0xbf,
++      0x77, 0xc6, 0xa7, 0x05, 0x96, 0xd5, 0x74, 0xf1,}, 256,
++     {0x49, 0x8b, 0x53, 0xfd, 0xec, 0x87, 0xed, 0xcb,
++      0xf0, 0x70, 0x97, 0xdc, 0xcd, 0xe9, 0x3a, 0x08,
++      0x4b, 0xad, 0x75, 0x01, 0xa2, 0x24, 0xe3, 0x88,
++      0xdf, 0x34, 0x9c, 0xe1, 0x89, 0x59, 0xfe, 0x84,
++      0x85, 0xf8, 0xad, 0x15, 0x37, 0xf0, 0xd8, 0x96,
++      0xea, 0x73, 0xbe, 0xdc, 0x72, 0x14, 0x71, 0x3f,}, 384,
++     {0xf6, 0x2c, 0x46, 0x32, 0x9b,}, 40,
++     },
++    {NID_des_ede3_cbc,          /* Count = 41 from CMACGenTDES3.req */
++     {0x89, 0xbc, 0xd9, 0x52, 0xa8, 0xc8, 0xab, 0x37,
++      0x1a, 0xf4, 0x8a, 0xc7, 0xd0, 0x70, 0x85, 0xd5,
++      0xef, 0xf7, 0x02, 0xe6, 0xd6, 0x2c, 0xdc, 0x23,}, 192,
++     {0xfa, 0x62, 0x0c, 0x1b, 0xbe, 0x97, 0x31, 0x9e,
++      0x9a, 0x0c, 0xf0, 0x49, 0x21, 0x21, 0xf7, 0xa2,
++      0x0e, 0xb0, 0x8a, 0x6a, 0x70, 0x9d, 0xcb, 0xd0,
++      0x0a, 0xaf, 0x38, 0xe4, 0xf9, 0x9e, 0x75, 0x4e,}, 256,
++     {0x8f, 0x49, 0xa1, 0xb7, 0xd6, 0xaa, 0x22, 0x58,}, 64,
++     },
++};
++
++int FIPS_selftest_cmac()
++{
++    size_t n, outlen;
++    unsigned char out[32];
++    const EVP_CIPHER *cipher;
++    CMAC_CTX *ctx = CMAC_CTX_new();
++    const CMAC_KAT *t;
++    int rv = 1;
++
++    for (n = 0, t = vector; n < sizeof(vector) / sizeof(vector[0]); n++, t++) {
++        cipher = FIPS_get_cipherbynid(t->nid);
++        if (!cipher) {
++            rv = -1;
++            goto err;
++        }
++        if (!CMAC_Init(ctx, t->key, t->keysize / 8, cipher, 0)) {
++            rv = -1;
++            goto err;
++        }
++        if (!CMAC_Update(ctx, t->msg, t->msgsize / 8)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!CMAC_Final(ctx, out, &outlen)) {
++            rv = -1;
++            goto err;
++        }
++        CMAC_CTX_cleanup(ctx);
++
++        if (outlen < t->macsize / 8 || memcmp(out, t->mac, t->macsize / 8)) {
++            rv = 0;
++        }
++    }
++
++ err:
++    CMAC_CTX_free(ctx);
++
++    if (rv == -1) {
++        rv = 0;
++    }
++    if (!rv)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_CMAC, FIPS_R_SELFTEST_FAILED);
++
++    return rv;
++}
++#endif
+diff --git a/crypto/fips/fips_des_selftest.c b/crypto/fips/fips_des_selftest.c
+new file mode 100644
+index 0000000..191d5b8
+--- /dev/null
++++ b/crypto/fips/fips_des_selftest.c
+@@ -0,0 +1,138 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/evp.h>
++#include <openssl/opensslconf.h>
++
++#ifdef OPENSSL_FIPS
++
++static const struct {
++    const unsigned char key[16];
++    const unsigned char plaintext[8];
++    const unsigned char ciphertext[8];
++} tests2[] = {
++    {
++        {
++        0x7c, 0x4f, 0x6e, 0xf7, 0xa2, 0x04, 0x16, 0xec,
++                0x0b, 0x6b, 0x7c, 0x9e, 0x5e, 0x19, 0xa7, 0xc4}, {
++        0x06, 0xa7, 0xd8, 0x79, 0xaa, 0xce, 0x69, 0xef}, {
++        0x4c, 0x11, 0x17, 0x55, 0xbf, 0xc4, 0x4e, 0xfd}
++    }, {
++        {
++        0x5d, 0x9e, 0x01, 0xd3, 0x25, 0xc7, 0x3e, 0x34,
++                0x01, 0x16, 0x7c, 0x85, 0x23, 0xdf, 0xe0, 0x68}, {
++        0x9c, 0x50, 0x09, 0x0f, 0x5e, 0x7d, 0x69, 0x7e}, {
++    0xd2, 0x0b, 0x18, 0xdf, 0xd9, 0x0d, 0x9e, 0xff},}
++};
++
++static const struct {
++    const unsigned char key[24];
++    const unsigned char plaintext[8];
++    const unsigned char ciphertext[8];
++} tests3[] = {
++    {
++        {
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++                0xFE, 0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10,
++                0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0}, {
++        0x8f, 0x8f, 0xbf, 0x9b, 0x5d, 0x48, 0xb4, 0x1c}, {
++    0x59, 0x8c, 0xe5, 0xd3, 0x6c, 0xa2, 0xea, 0x1b},}, {
++        {
++        0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10, 0xFE,
++                0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF,
++                0xED, 0x39, 0xD9, 0x50, 0xFA, 0x74, 0xBC, 0xC4}, {
++        0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF}, {
++0x11, 0x25, 0xb0, 0x35, 0xbe, 0xa0, 0x82, 0x86},},};
++
++static int corrupt_des;
++
++void FIPS_corrupt_des()
++{
++    corrupt_des = 1;
++}
++
++int FIPS_selftest_des()
++{
++    int n, ret = 0;
++    EVP_CIPHER_CTX ctx;
++    EVP_CIPHER_CTX_init(&ctx);
++    /* Encrypt/decrypt with 2-key 3DES and compare to known answers */
++    for (n = 0; n < 2; ++n) {
++        unsigned char plaintext[8];
++
++        memcpy(plaintext, tests2[n].plaintext, sizeof(plaintext));
++        if (corrupt_des)
++            plaintext[0]++;
++        if (!fips_cipher_test(&ctx, EVP_des_ede_ecb(),
++                              tests2[n].key, NULL,
++                              plaintext, tests2[n].ciphertext, 8))
++            goto err;
++    }
++
++    /* Encrypt/decrypt with 3DES and compare to known answers */
++    for (n = 0; n < 2; ++n) {
++        if (!fips_cipher_test(&ctx, EVP_des_ede3_ecb(),
++                              tests3[n].key, NULL,
++                              tests3[n].plaintext, tests3[n].ciphertext, 8))
++            goto err;
++    }
++    ret = 1;
++ err:
++    EVP_CIPHER_CTX_cleanup(&ctx);
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_DES, FIPS_R_SELFTEST_FAILED);
++
++    return ret;
++}
++#endif
+diff --git a/crypto/fips/fips_dh_selftest.c b/crypto/fips/fips_dh_selftest.c
+new file mode 100644
+index 0000000..91fe48d
+--- /dev/null
++++ b/crypto/fips/fips_dh_selftest.c
+@@ -0,0 +1,162 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ * Copyright (c) 2013 Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/dh.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include "fips_locl.h"
++
++static const unsigned char dh_test_2048_p[] = {
++    0xAE, 0xEC, 0xEE, 0x22, 0xFA, 0x3A, 0xA5, 0x22, 0xC0, 0xDE, 0x0F, 0x09,
++    0x7E, 0x17, 0xC0, 0x05, 0xF9, 0xF1, 0xE7, 0xC6, 0x87, 0x14, 0x6D, 0x11,
++    0xE7, 0xAE, 0xED, 0x2F, 0x72, 0x59, 0xC5, 0xA9, 0x9B, 0xB8, 0x02, 0xA5,
++    0xF3, 0x69, 0x70, 0xD6, 0xDD, 0x90, 0xF9, 0x19, 0x79, 0xBE, 0x60, 0x8F,
++    0x25, 0x92, 0x30, 0x1C, 0x51, 0x51, 0x38, 0x26, 0x82, 0x25, 0xE6, 0xFC,
++    0xED, 0x65, 0x96, 0x8F, 0x57, 0xE5, 0x53, 0x8B, 0x38, 0x63, 0xC7, 0xCE,
++    0xBC, 0x1B, 0x4D, 0x18, 0x2A, 0x5B, 0x04, 0x3F, 0x6A, 0x3C, 0x94, 0x39,
++    0xAE, 0x36, 0xD6, 0x5E, 0x0F, 0xA2, 0xCC, 0xD0, 0xD4, 0xD5, 0xC6, 0x1E,
++    0xF6, 0xA0, 0xF5, 0x89, 0x4E, 0xB4, 0x0B, 0xA4, 0xB3, 0x2B, 0x3D, 0xE2,
++    0x4E, 0xE1, 0x49, 0x25, 0x99, 0x5F, 0x32, 0x16, 0x33, 0x32, 0x1B, 0x7A,
++    0xA5, 0x5C, 0x6B, 0x34, 0x0D, 0x39, 0x99, 0xDC, 0xF0, 0x76, 0xE5, 0x5A,
++    0xD4, 0x71, 0x00, 0xED, 0x5A, 0x73, 0xFB, 0xC8, 0x01, 0xAD, 0x99, 0xCF,
++    0x99, 0x52, 0x7C, 0x9C, 0x64, 0xC6, 0x76, 0x40, 0x57, 0xAF, 0x59, 0xD7,
++    0x38, 0x0B, 0x40, 0xDE, 0x33, 0x0D, 0xB8, 0x76, 0xEC, 0xA9, 0xD8, 0x73,
++    0xF8, 0xEF, 0x26, 0x66, 0x06, 0x27, 0xDD, 0x7C, 0xA4, 0x10, 0x9C, 0xA6,
++    0xAA, 0xF9, 0x53, 0x62, 0x73, 0x1D, 0xBA, 0x1C, 0xF1, 0x67, 0xF4, 0x35,
++    0xED, 0x6F, 0x37, 0x92, 0xE8, 0x4F, 0x6C, 0xBA, 0x52, 0x6E, 0xA1, 0xED,
++    0xDA, 0x9F, 0x85, 0x11, 0x82, 0x52, 0x62, 0x08, 0x44, 0xF1, 0x30, 0x03,
++    0xC3, 0x38, 0x2C, 0x79, 0xBD, 0xD4, 0x43, 0x45, 0xEE, 0x8E, 0x50, 0xFC,
++    0x29, 0x46, 0x9A, 0xFE, 0x54, 0x1A, 0x19, 0x8F, 0x4B, 0x84, 0x08, 0xDE,
++    0x20, 0x62, 0x73, 0xCC, 0xDD, 0x7E, 0xF0, 0xEF, 0xA2, 0xFD, 0x86, 0x58,
++    0x4B, 0xD8, 0x37, 0xEB
++};
++
++static const unsigned char dh_test_2048_g[] = {
++    0x02
++};
++
++static const unsigned char dh_test_2048_pub_key[] = {
++    0xA0, 0x39, 0x11, 0x77, 0x9A, 0xC1, 0x30, 0x1F, 0xBE, 0x48, 0xA7, 0xAA,
++    0xA0, 0x84, 0x54, 0x64, 0xAD, 0x1B, 0x70, 0xFA, 0x13, 0x55, 0x63, 0xD2,
++    0x1F, 0x62, 0x32, 0x93, 0x8E, 0xC9, 0x3E, 0x09, 0xA7, 0x64, 0xE4, 0x12,
++    0x6E, 0x1B, 0xF2, 0x92, 0x3B, 0xB9, 0xCB, 0x56, 0xEA, 0x07, 0x88, 0xB5,
++    0xA6, 0xBC, 0x16, 0x1F, 0x27, 0xFE, 0xD8, 0xAA, 0x40, 0xB2, 0xB0, 0x2D,
++    0x37, 0x76, 0xA6, 0xA4, 0x82, 0x2C, 0x0E, 0x22, 0x64, 0x9D, 0xCB, 0xD1,
++    0x00, 0xB7, 0x89, 0x14, 0x72, 0x4E, 0xBE, 0x48, 0x41, 0xF8, 0xB2, 0x51,
++    0x11, 0x09, 0x4B, 0x22, 0x01, 0x23, 0x39, 0x96, 0xE0, 0x15, 0xD7, 0x9F,
++    0x60, 0xD1, 0xB7, 0xAE, 0xFE, 0x5F, 0xDB, 0xE7, 0x03, 0x17, 0x97, 0xA6,
++    0x16, 0x74, 0xBD, 0x53, 0x81, 0x19, 0xC5, 0x47, 0x5E, 0xCE, 0x8D, 0xED,
++    0x45, 0x5D, 0x3C, 0x00, 0xA0, 0x0A, 0x68, 0x6A, 0xE0, 0x8E, 0x06, 0x46,
++    0x6F, 0xD7, 0xF9, 0xDF, 0x31, 0x7E, 0x77, 0x44, 0x0D, 0x98, 0xE0, 0xCA,
++    0x98, 0x09, 0x52, 0x04, 0x90, 0xEA, 0x6D, 0xF4, 0x30, 0x69, 0x8F, 0xB1,
++    0x9B, 0xC1, 0x43, 0xDB, 0xD5, 0x8D, 0xC8, 0x8E, 0xB6, 0x0B, 0x05, 0xBE,
++    0x0E, 0xC5, 0x99, 0xC8, 0x6E, 0x4E, 0xF3, 0xCB, 0xC3, 0x5E, 0x9B, 0x53,
++    0xF7, 0x06, 0x1C, 0x4F, 0xC7, 0xB8, 0x6E, 0x30, 0x18, 0xCA, 0x9B, 0xB9,
++    0xBC, 0x5F, 0x17, 0x72, 0x29, 0x5A, 0xE5, 0xD9, 0x96, 0xB7, 0x0B, 0xF3,
++    0x2D, 0x8C, 0xF1, 0xE1, 0x0E, 0x0D, 0x74, 0xD5, 0x9D, 0xF0, 0x06, 0xA9,
++    0xB4, 0x95, 0x63, 0x76, 0x46, 0x55, 0x48, 0x82, 0x39, 0x90, 0xEF, 0x56,
++    0x75, 0x34, 0xB8, 0x34, 0xC3, 0x18, 0x6E, 0x1E, 0xAD, 0xE3, 0x48, 0x7E,
++    0x93, 0x2C, 0x23, 0xE7, 0xF8, 0x90, 0x73, 0xB1, 0x77, 0x80, 0x67, 0xA9,
++    0x36, 0x9E, 0xDA, 0xD2
++};
++
++static const unsigned char dh_test_2048_priv_key[] = {
++    0x0C, 0x4B, 0x30, 0x89, 0xD1, 0xB8, 0x62, 0xCB, 0x3C, 0x43, 0x64, 0x91,
++    0xF0, 0x91, 0x54, 0x70, 0xC5, 0x27, 0x96, 0xE3, 0xAC, 0xBE, 0xE8, 0x00,
++    0xEC, 0x55, 0xF6, 0xCC
++};
++
++int FIPS_selftest_dh()
++{
++    DH *dh = NULL;
++    int ret = 0;
++    void *pub_key = NULL;
++    int len;
++
++    dh = DH_new();
++
++    if (dh == NULL)
++        goto err;
++
++    fips_load_key_component(dh, p, dh_test_2048);
++    fips_load_key_component(dh, g, dh_test_2048);
++    /* note that the private key is much shorter than normally used
++     * but still g ** priv_key > p
++     */
++    fips_load_key_component(dh, priv_key, dh_test_2048);
++
++    if (DH_generate_key(dh) <= 0)
++        goto err;
++
++    len = BN_num_bytes(dh->pub_key);
++    if ((pub_key = OPENSSL_malloc(len)) == NULL)
++        goto err;
++    BN_bn2bin(dh->pub_key, pub_key);
++
++    if (len != sizeof(dh_test_2048_pub_key) ||
++        memcmp(pub_key, dh_test_2048_pub_key, len) != 0)
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (dh)
++        DH_free(dh);
++
++    OPENSSL_free(pub_key);
++    return ret;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_ctr.c b/crypto/fips/fips_drbg_ctr.c
+new file mode 100644
+index 0000000..e9aa949
+--- /dev/null
++++ b/crypto/fips/fips_drbg_ctr.c
+@@ -0,0 +1,418 @@
++/* fips/rand/fips_drbg_ctr.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++static void inc_128(DRBG_CTR_CTX * cctx)
++{
++    int i;
++    unsigned char c;
++    unsigned char *p = cctx->V + 15;
++    for (i = 0; i < 16; i++) {
++        c = *p;
++        c++;
++        *p = c;
++        if (c)
++            return;
++        p--;
++    }
++}
++
++static void ctr_XOR(DRBG_CTR_CTX * cctx, const unsigned char *in,
++                    size_t inlen)
++{
++    size_t i, n;
++    /* Any zero padding will have no effect on the result as we
++     * are XORing. So just process however much input we have.
++     */
++
++    if (!in || !inlen)
++        return;
++
++    if (inlen < cctx->keylen)
++        n = inlen;
++    else
++        n = cctx->keylen;
++
++    for (i = 0; i < n; i++)
++        cctx->K[i] ^= in[i];
++    if (inlen <= cctx->keylen)
++        return;
++
++    n = inlen - cctx->keylen;
++    /* Should never happen */
++    if (n > 16)
++        n = 16;
++    for (i = 0; i < 16; i++)
++        cctx->V[i] ^= in[i + cctx->keylen];
++}
++
++/* Process a complete block using BCC algorithm of SPP 800-90 10.4.3 */
++
++static void ctr_BCC_block(DRBG_CTR_CTX * cctx, unsigned char *out,
++                          const unsigned char *in)
++{
++    int i;
++    for (i = 0; i < 16; i++)
++        out[i] ^= in[i];
++    AES_encrypt(out, out, &cctx->df_ks);
++#if 0
++    fprintf(stderr, "BCC in+out\n");
++    BIO_dump_fp(stderr, in, 16);
++    BIO_dump_fp(stderr, out, 16);
++#endif
++}
++
++/* Handle several BCC operations for as much data as we need for K and X */
++static void ctr_BCC_blocks(DRBG_CTR_CTX * cctx, const unsigned char *in)
++{
++    ctr_BCC_block(cctx, cctx->KX, in);
++    ctr_BCC_block(cctx, cctx->KX + 16, in);
++    if (cctx->keylen != 16)
++        ctr_BCC_block(cctx, cctx->KX + 32, in);
++}
++
++/* Initialise BCC blocks: these have the value 0,1,2 in leftmost positions:
++ * see 10.4.2 stage 7.
++ */
++static void ctr_BCC_init(DRBG_CTR_CTX * cctx)
++{
++    memset(cctx->KX, 0, 48);
++    memset(cctx->bltmp, 0, 16);
++    ctr_BCC_block(cctx, cctx->KX, cctx->bltmp);
++    cctx->bltmp[3] = 1;
++    ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp);
++    if (cctx->keylen != 16) {
++        cctx->bltmp[3] = 2;
++        ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp);
++    }
++}
++
++/* Process several blocks into BCC algorithm, some possibly partial */
++static void ctr_BCC_update(DRBG_CTR_CTX * cctx,
++                           const unsigned char *in, size_t inlen)
++{
++    if (!in || !inlen)
++        return;
++    /* If we have partial block handle it first */
++    if (cctx->bltmp_pos) {
++        size_t left = 16 - cctx->bltmp_pos;
++        /* If we now have a complete block process it */
++        if (inlen >= left) {
++            memcpy(cctx->bltmp + cctx->bltmp_pos, in, left);
++            ctr_BCC_blocks(cctx, cctx->bltmp);
++            cctx->bltmp_pos = 0;
++            inlen -= left;
++            in += left;
++        }
++    }
++    /* Process zero or more complete blocks */
++    while (inlen >= 16) {
++        ctr_BCC_blocks(cctx, in);
++        in += 16;
++        inlen -= 16;
++    }
++    /* Copy any remaining partial block to the temporary buffer */
++    if (inlen > 0) {
++        memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen);
++        cctx->bltmp_pos += inlen;
++    }
++}
++
++static void ctr_BCC_final(DRBG_CTR_CTX * cctx)
++{
++    if (cctx->bltmp_pos) {
++        memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos);
++        ctr_BCC_blocks(cctx, cctx->bltmp);
++    }
++}
++
++static void ctr_df(DRBG_CTR_CTX * cctx,
++                   const unsigned char *in1, size_t in1len,
++                   const unsigned char *in2, size_t in2len,
++                   const unsigned char *in3, size_t in3len)
++{
++    size_t inlen;
++    unsigned char *p = cctx->bltmp;
++    static unsigned char c80 = 0x80;
++
++    ctr_BCC_init(cctx);
++    if (!in1)
++        in1len = 0;
++    if (!in2)
++        in2len = 0;
++    if (!in3)
++        in3len = 0;
++    inlen = in1len + in2len + in3len;
++    /* Initialise L||N in temporary block */
++    *p++ = (inlen >> 24) & 0xff;
++    *p++ = (inlen >> 16) & 0xff;
++    *p++ = (inlen >> 8) & 0xff;
++    *p++ = inlen & 0xff;
++    /* NB keylen is at most 32 bytes */
++    *p++ = 0;
++    *p++ = 0;
++    *p++ = 0;
++    *p = (unsigned char)((cctx->keylen + 16) & 0xff);
++    cctx->bltmp_pos = 8;
++    ctr_BCC_update(cctx, in1, in1len);
++    ctr_BCC_update(cctx, in2, in2len);
++    ctr_BCC_update(cctx, in3, in3len);
++    ctr_BCC_update(cctx, &c80, 1);
++    ctr_BCC_final(cctx);
++    /* Set up key K */
++    AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks);
++    /* X follows key K */
++    AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks);
++    AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks);
++    if (cctx->keylen != 16)
++        AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks);
++#if 0
++    fprintf(stderr, "Output of ctr_df:\n");
++    BIO_dump_fp(stderr, cctx->KX, cctx->keylen + 16);
++#endif
++}
++
++/* NB the no-df  Update in SP800-90 specifies a constant input length
++ * of seedlen, however other uses of this algorithm pad the input with
++ * zeroes if necessary and have up to two parameters XORed together,
++ * handle both cases in this function instead.
++ */
++
++static void ctr_Update(DRBG_CTX *dctx,
++                       const unsigned char *in1, size_t in1len,
++                       const unsigned char *in2, size_t in2len,
++                       const unsigned char *nonce, size_t noncelen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    /* ks is already setup for correct key */
++    inc_128(cctx);
++    AES_encrypt(cctx->V, cctx->K, &cctx->ks);
++    /* If keylen longer than 128 bits need extra encrypt */
++    if (cctx->keylen != 16) {
++        inc_128(cctx);
++        AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks);
++    }
++    inc_128(cctx);
++    AES_encrypt(cctx->V, cctx->V, &cctx->ks);
++    /* If 192 bit key part of V is on end of K */
++    if (cctx->keylen == 24) {
++        memcpy(cctx->V + 8, cctx->V, 8);
++        memcpy(cctx->V, cctx->K + 24, 8);
++    }
++
++    if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++        /* If no input reuse existing derived value */
++        if (in1 || nonce || in2)
++            ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len);
++        /* If this a reuse input in1len != 0 */
++        if (in1len)
++            ctr_XOR(cctx, cctx->KX, dctx->seedlen);
++    } else {
++        ctr_XOR(cctx, in1, in1len);
++        ctr_XOR(cctx, in2, in2len);
++    }
++
++    AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
++#if 0
++    fprintf(stderr, "K+V after update is:\n");
++    BIO_dump_fp(stderr, cctx->K, cctx->keylen);
++    BIO_dump_fp(stderr, cctx->V, 16);
++#endif
++}
++
++static int drbg_ctr_instantiate(DRBG_CTX *dctx,
++                                const unsigned char *ent, size_t entlen,
++                                const unsigned char *nonce, size_t noncelen,
++                                const unsigned char *pers, size_t perslen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    memset(cctx->K, 0, sizeof(cctx->K));
++    memset(cctx->V, 0, sizeof(cctx->V));
++    AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
++    ctr_Update(dctx, ent, entlen, pers, perslen, nonce, noncelen);
++    return 1;
++}
++
++static int drbg_ctr_reseed(DRBG_CTX *dctx,
++                           const unsigned char *ent, size_t entlen,
++                           const unsigned char *adin, size_t adinlen)
++{
++    ctr_Update(dctx, ent, entlen, adin, adinlen, NULL, 0);
++    return 1;
++}
++
++static int drbg_ctr_generate(DRBG_CTX *dctx,
++                             unsigned char *out, size_t outlen,
++                             const unsigned char *adin, size_t adinlen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    if (adin && adinlen) {
++        ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
++        /* This means we reuse derived value */
++        if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++            adin = NULL;
++            adinlen = 1;
++        }
++    } else
++        adinlen = 0;
++
++    for (;;) {
++        inc_128(cctx);
++        if (!(dctx->xflags & DRBG_FLAG_TEST) && !dctx->lb_valid) {
++            AES_encrypt(cctx->V, dctx->lb, &cctx->ks);
++            dctx->lb_valid = 1;
++            continue;
++        }
++        if (outlen < 16) {
++            /* Use K as temp space as it will be updated */
++            AES_encrypt(cctx->V, cctx->K, &cctx->ks);
++            if (!fips_drbg_cprng_test(dctx, cctx->K))
++                return 0;
++            memcpy(out, cctx->K, outlen);
++            break;
++        }
++        AES_encrypt(cctx->V, out, &cctx->ks);
++        if (!fips_drbg_cprng_test(dctx, out))
++            return 0;
++        out += 16;
++        outlen -= 16;
++        if (outlen == 0)
++            break;
++    }
++
++    ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
++
++    return 1;
++
++}
++
++static int drbg_ctr_uninstantiate(DRBG_CTX *dctx)
++{
++    memset(&dctx->d.ctr, 0, sizeof(DRBG_CTR_CTX));
++    return 1;
++}
++
++int fips_drbg_ctr_init(DRBG_CTX *dctx)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++
++    size_t keylen;
++
++    switch (dctx->type) {
++    case NID_aes_128_ctr:
++        keylen = 16;
++        break;
++
++    case NID_aes_192_ctr:
++        keylen = 24;
++        break;
++
++    case NID_aes_256_ctr:
++        keylen = 32;
++        break;
++
++    default:
++        return -2;
++    }
++
++    dctx->instantiate = drbg_ctr_instantiate;
++    dctx->reseed = drbg_ctr_reseed;
++    dctx->generate = drbg_ctr_generate;
++    dctx->uninstantiate = drbg_ctr_uninstantiate;
++
++    cctx->keylen = keylen;
++    dctx->strength = keylen * 8;
++    dctx->blocklength = 16;
++    dctx->seedlen = keylen + 16;
++
++    if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++        /* df initialisation */
++        static unsigned char df_key[32] = {
++            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++            0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++            0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
++        };
++        /* Set key schedule for df_key */
++        AES_set_encrypt_key(df_key, dctx->strength, &cctx->df_ks);
++
++        dctx->min_entropy = cctx->keylen;
++        dctx->max_entropy = DRBG_MAX_LENGTH;
++        dctx->min_nonce = dctx->min_entropy / 2;
++        dctx->max_nonce = DRBG_MAX_LENGTH;
++        dctx->max_pers = DRBG_MAX_LENGTH;
++        dctx->max_adin = DRBG_MAX_LENGTH;
++    } else {
++        dctx->min_entropy = dctx->seedlen;
++        dctx->max_entropy = dctx->seedlen;
++        /* Nonce not used */
++        dctx->min_nonce = 0;
++        dctx->max_nonce = 0;
++        dctx->max_pers = dctx->seedlen;
++        dctx->max_adin = dctx->seedlen;
++    }
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_hash.c b/crypto/fips/fips_drbg_hash.c
+new file mode 100644
+index 0000000..93c1f3d
+--- /dev/null
++++ b/crypto/fips/fips_drbg_hash.c
+@@ -0,0 +1,361 @@
++/* fips/rand/fips_drbg_hash.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++/* This is Hash_df from SP 800-90 10.4.1 */
++
++static int hash_df(DRBG_CTX *dctx, unsigned char *out,
++                   const unsigned char *in1, size_t in1len,
++                   const unsigned char *in2, size_t in2len,
++                   const unsigned char *in3, size_t in3len,
++                   const unsigned char *in4, size_t in4len)
++{
++    EVP_MD_CTX *mctx = &dctx->d.hash.mctx;
++    unsigned char *vtmp = dctx->d.hash.vtmp;
++    unsigned char tmp[6];
++    /* Standard only ever needs seedlen bytes which is always less than
++     * maximum permitted so no need to check length.
++     */
++    size_t outlen = dctx->seedlen;
++    tmp[0] = 1;
++    tmp[1] = ((outlen * 8) >> 24) & 0xff;
++    tmp[2] = ((outlen * 8) >> 16) & 0xff;
++    tmp[3] = ((outlen * 8) >> 8) & 0xff;
++    tmp[4] = (outlen * 8) & 0xff;
++    if (!in1) {
++        tmp[5] = (unsigned char)in1len;
++        in1 = tmp + 5;
++        in1len = 1;
++    }
++    for (;;) {
++        if (!FIPS_digestinit(mctx, dctx->d.hash.md))
++            return 0;
++        if (!FIPS_digestupdate(mctx, tmp, 5))
++            return 0;
++        if (in1 && !FIPS_digestupdate(mctx, in1, in1len))
++            return 0;
++        if (in2 && !FIPS_digestupdate(mctx, in2, in2len))
++            return 0;
++        if (in3 && !FIPS_digestupdate(mctx, in3, in3len))
++            return 0;
++        if (in4 && !FIPS_digestupdate(mctx, in4, in4len))
++            return 0;
++        if (outlen < dctx->blocklength) {
++            if (!FIPS_digestfinal(mctx, vtmp, NULL))
++                return 0;
++            memcpy(out, vtmp, outlen);
++            OPENSSL_cleanse(vtmp, dctx->blocklength);
++            return 1;
++        } else if (!FIPS_digestfinal(mctx, out, NULL))
++            return 0;
++
++        outlen -= dctx->blocklength;
++        if (outlen == 0)
++            return 1;
++        tmp[0]++;
++        out += dctx->blocklength;
++    }
++}
++
++/* Add an unsigned buffer to the buf value, storing the result in buf. For
++ * this algorithm the length of input never exceeds the seed length.
++ */
++
++static void ctx_add_buf(DRBG_CTX *dctx, unsigned char *buf,
++                        unsigned char *in, size_t inlen)
++{
++    size_t i = inlen;
++    const unsigned char *q;
++    unsigned char c, *p;
++    p = buf + dctx->seedlen;
++    q = in + inlen;
++
++    OPENSSL_assert(i <= dctx->seedlen);
++
++    /* Special case: zero length, just increment buffer */
++    if (i)
++        c = 0;
++    else
++        c = 1;
++
++    while (i) {
++        int r;
++        p--;
++        q--;
++        r = *p + *q + c;
++        /* Carry */
++        if (r > 0xff)
++            c = 1;
++        else
++            c = 0;
++        *p = r & 0xff;
++        i--;
++    }
++
++    i = dctx->seedlen - inlen;
++
++    /* If not adding whole buffer handle final carries */
++    if (c && i) {
++        do {
++            p--;
++            c = *p;
++            c++;
++            *p = c;
++            if (c)
++                return;
++        } while (i--);
++    }
++}
++
++/* Finalise and add hash to V */
++
++static int ctx_add_md(DRBG_CTX *dctx)
++{
++    if (!FIPS_digestfinal(&dctx->d.hash.mctx, dctx->d.hash.vtmp, NULL))
++        return 0;
++    ctx_add_buf(dctx, dctx->d.hash.V, dctx->d.hash.vtmp, dctx->blocklength);
++    return 1;
++}
++
++static int hash_gen(DRBG_CTX *dctx, unsigned char *out, size_t outlen)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    if (outlen == 0)
++        return 1;
++    memcpy(hctx->vtmp, hctx->V, dctx->seedlen);
++    for (;;) {
++        FIPS_digestinit(&hctx->mctx, hctx->md);
++        FIPS_digestupdate(&hctx->mctx, hctx->vtmp, dctx->seedlen);
++        if (!(dctx->xflags & DRBG_FLAG_TEST) && !dctx->lb_valid) {
++            FIPS_digestfinal(&hctx->mctx, dctx->lb, NULL);
++            dctx->lb_valid = 1;
++        } else if (outlen < dctx->blocklength) {
++            FIPS_digestfinal(&hctx->mctx, hctx->vtmp, NULL);
++            if (!fips_drbg_cprng_test(dctx, hctx->vtmp))
++                return 0;
++            memcpy(out, hctx->vtmp, outlen);
++            return 1;
++        } else {
++            FIPS_digestfinal(&hctx->mctx, out, NULL);
++            if (!fips_drbg_cprng_test(dctx, out))
++                return 0;
++            outlen -= dctx->blocklength;
++            if (outlen == 0)
++                return 1;
++            out += dctx->blocklength;
++        }
++        ctx_add_buf(dctx, hctx->vtmp, NULL, 0);
++    }
++}
++
++static int drbg_hash_instantiate(DRBG_CTX *dctx,
++                                 const unsigned char *ent, size_t ent_len,
++                                 const unsigned char *nonce, size_t nonce_len,
++                                 const unsigned char *pstr, size_t pstr_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    if (!hash_df(dctx, hctx->V,
++                 ent, ent_len, nonce, nonce_len, pstr, pstr_len, NULL, 0))
++        return 0;
++    if (!hash_df(dctx, hctx->C,
++                 NULL, 0, hctx->V, dctx->seedlen, NULL, 0, NULL, 0))
++        return 0;
++
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after instantiate:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_reseed(DRBG_CTX *dctx,
++                            const unsigned char *ent, size_t ent_len,
++                            const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    /* V about to be updated so use C as output instead */
++    if (!hash_df(dctx, hctx->C,
++                 NULL, 1, hctx->V, dctx->seedlen,
++                 ent, ent_len, adin, adin_len))
++        return 0;
++    memcpy(hctx->V, hctx->C, dctx->seedlen);
++    if (!hash_df(dctx, hctx->C, NULL, 0,
++                 hctx->V, dctx->seedlen, NULL, 0, NULL, 0))
++        return 0;
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after reseed:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_generate(DRBG_CTX *dctx,
++                              unsigned char *out, size_t outlen,
++                              const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    EVP_MD_CTX *mctx = &hctx->mctx;
++    unsigned char tmp[4];
++    if (adin && adin_len) {
++        tmp[0] = 2;
++        if (!FIPS_digestinit(mctx, hctx->md))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, tmp, 1))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, hctx->V, dctx->seedlen))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, adin, adin_len))
++            return 0;
++        if (!ctx_add_md(dctx))
++            return 0;
++    }
++    if (!hash_gen(dctx, out, outlen))
++        return 0;
++
++    tmp[0] = 3;
++    if (!FIPS_digestinit(mctx, hctx->md))
++        return 0;
++    if (!EVP_DigestUpdate(mctx, tmp, 1))
++        return 0;
++    if (!EVP_DigestUpdate(mctx, hctx->V, dctx->seedlen))
++        return 0;
++
++    if (!ctx_add_md(dctx))
++        return 0;
++
++    ctx_add_buf(dctx, hctx->V, hctx->C, dctx->seedlen);
++
++    tmp[0] = (dctx->reseed_counter >> 24) & 0xff;
++    tmp[1] = (dctx->reseed_counter >> 16) & 0xff;
++    tmp[2] = (dctx->reseed_counter >> 8) & 0xff;
++    tmp[3] = dctx->reseed_counter & 0xff;
++    ctx_add_buf(dctx, hctx->V, tmp, 4);
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after generate:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_uninstantiate(DRBG_CTX *dctx)
++{
++    EVP_MD_CTX_cleanup(&dctx->d.hash.mctx);
++    OPENSSL_cleanse(&dctx->d.hash, sizeof(DRBG_HASH_CTX));
++    return 1;
++}
++
++int fips_drbg_hash_init(DRBG_CTX *dctx)
++{
++    const EVP_MD *md;
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    md = FIPS_get_digestbynid(dctx->type);
++    if (!md)
++        return -2;
++    switch (dctx->type) {
++    case NID_sha1:
++        dctx->strength = 128;
++        break;
++
++    case NID_sha224:
++        dctx->strength = 192;
++        break;
++
++    default:
++        dctx->strength = 256;
++        break;
++    }
++
++    dctx->instantiate = drbg_hash_instantiate;
++    dctx->reseed = drbg_hash_reseed;
++    dctx->generate = drbg_hash_generate;
++    dctx->uninstantiate = drbg_hash_uninstantiate;
++
++    dctx->d.hash.md = md;
++    EVP_MD_CTX_init(&hctx->mctx);
++
++    /* These are taken from SP 800-90 10.1 table 2 */
++
++    dctx->blocklength = M_EVP_MD_size(md);
++    if (dctx->blocklength > 32)
++        dctx->seedlen = 111;
++    else
++        dctx->seedlen = 55;
++
++    dctx->min_entropy = dctx->strength / 8;
++    dctx->max_entropy = DRBG_MAX_LENGTH;
++
++    dctx->min_nonce = dctx->min_entropy / 2;
++    dctx->max_nonce = DRBG_MAX_LENGTH;
++
++    dctx->max_pers = DRBG_MAX_LENGTH;
++    dctx->max_adin = DRBG_MAX_LENGTH;
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_hmac.c b/crypto/fips/fips_drbg_hmac.c
+new file mode 100644
+index 0000000..f9eba4c
+--- /dev/null
++++ b/crypto/fips/fips_drbg_hmac.c
+@@ -0,0 +1,273 @@
++/* fips/rand/fips_drbg_hmac.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/evp.h>
++#include <openssl/hmac.h>
++#include <openssl/aes.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++static int drbg_hmac_update(DRBG_CTX *dctx,
++                            const unsigned char *in1, size_t in1len,
++                            const unsigned char *in2, size_t in2len,
++                            const unsigned char *in3, size_t in3len)
++{
++    static unsigned char c0 = 0, c1 = 1;
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    HMAC_CTX *hctx = &hmac->hctx;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++    if (!HMAC_Update(hctx, &c0, 1))
++        return 0;
++    if (in1len && !HMAC_Update(hctx, in1, in1len))
++        return 0;
++    if (in2len && !HMAC_Update(hctx, in2, in2len))
++        return 0;
++    if (in3len && !HMAC_Update(hctx, in3, in3len))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->K, NULL))
++        return 0;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->V, NULL))
++        return 0;
++
++    if (!in1len && !in2len && !in3len)
++        return 1;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++    if (!HMAC_Update(hctx, &c1, 1))
++        return 0;
++    if (in1len && !HMAC_Update(hctx, in1, in1len))
++        return 0;
++    if (in2len && !HMAC_Update(hctx, in2, in2len))
++        return 0;
++    if (in3len && !HMAC_Update(hctx, in3, in3len))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->K, NULL))
++        return 0;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->V, NULL))
++        return 0;
++
++    return 1;
++
++}
++
++static int drbg_hmac_instantiate(DRBG_CTX *dctx,
++                                 const unsigned char *ent, size_t ent_len,
++                                 const unsigned char *nonce, size_t nonce_len,
++                                 const unsigned char *pstr, size_t pstr_len)
++{
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    memset(hmac->K, 0, dctx->blocklength);
++    memset(hmac->V, 1, dctx->blocklength);
++    if (!drbg_hmac_update(dctx,
++                          ent, ent_len, nonce, nonce_len, pstr, pstr_len))
++        return 0;
++
++#ifdef HMAC_DRBG_TRACE
++    fprintf(stderr, "K+V after instantiate:\n");
++    hexprint(stderr, hmac->K, hmac->blocklength);
++    hexprint(stderr, hmac->V, hmac->blocklength);
++#endif
++    return 1;
++}
++
++static int drbg_hmac_reseed(DRBG_CTX *dctx,
++                            const unsigned char *ent, size_t ent_len,
++                            const unsigned char *adin, size_t adin_len)
++{
++    if (!drbg_hmac_update(dctx, ent, ent_len, adin, adin_len, NULL, 0))
++        return 0;
++
++#ifdef HMAC_DRBG_TRACE
++    {
++        DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++        fprintf(stderr, "K+V after reseed:\n");
++        hexprint(stderr, hmac->K, hmac->blocklength);
++        hexprint(stderr, hmac->V, hmac->blocklength);
++    }
++#endif
++    return 1;
++}
++
++static int drbg_hmac_generate(DRBG_CTX *dctx,
++                              unsigned char *out, size_t outlen,
++                              const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    HMAC_CTX *hctx = &hmac->hctx;
++    const unsigned char *Vtmp = hmac->V;
++    if (adin_len && !drbg_hmac_update(dctx, adin, adin_len, NULL, 0, NULL, 0))
++        return 0;
++    for (;;) {
++        if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++            return 0;
++        if (!HMAC_Update(hctx, Vtmp, dctx->blocklength))
++            return 0;
++        if (!(dctx->xflags & DRBG_FLAG_TEST) && !dctx->lb_valid) {
++            if (!HMAC_Final(hctx, dctx->lb, NULL))
++                return 0;
++            dctx->lb_valid = 1;
++            Vtmp = dctx->lb;
++            continue;
++        } else if (outlen > dctx->blocklength) {
++            if (!HMAC_Final(hctx, out, NULL))
++                return 0;
++            if (!fips_drbg_cprng_test(dctx, out))
++                return 0;
++            Vtmp = out;
++        } else {
++            if (!HMAC_Final(hctx, hmac->V, NULL))
++                return 0;
++            if (!fips_drbg_cprng_test(dctx, hmac->V))
++                return 0;
++            memcpy(out, hmac->V, outlen);
++            break;
++        }
++        out += dctx->blocklength;
++        outlen -= dctx->blocklength;
++    }
++    if (!drbg_hmac_update(dctx, adin, adin_len, NULL, 0, NULL, 0))
++        return 0;
++
++    return 1;
++}
++
++static int drbg_hmac_uninstantiate(DRBG_CTX *dctx)
++{
++    HMAC_CTX_cleanup(&dctx->d.hmac.hctx);
++    OPENSSL_cleanse(&dctx->d.hmac, sizeof(DRBG_HMAC_CTX));
++    return 1;
++}
++
++int fips_drbg_hmac_init(DRBG_CTX *dctx)
++{
++    const EVP_MD *md = NULL;
++    DRBG_HMAC_CTX *hctx = &dctx->d.hmac;
++    dctx->strength = 256;
++    switch (dctx->type) {
++    case NID_hmacWithSHA1:
++        md = EVP_sha1();
++        dctx->strength = 128;
++        break;
++
++    case NID_hmacWithSHA224:
++        md = EVP_sha224();
++        dctx->strength = 192;
++        break;
++
++    case NID_hmacWithSHA256:
++        md = EVP_sha256();
++        break;
++
++    case NID_hmacWithSHA384:
++        md = EVP_sha384();
++        break;
++
++    case NID_hmacWithSHA512:
++        md = EVP_sha512();
++        break;
++
++    default:
++        dctx->strength = 0;
++        return -2;
++    }
++    dctx->instantiate = drbg_hmac_instantiate;
++    dctx->reseed = drbg_hmac_reseed;
++    dctx->generate = drbg_hmac_generate;
++    dctx->uninstantiate = drbg_hmac_uninstantiate;
++    HMAC_CTX_init(&hctx->hctx);
++    hctx->md = md;
++    dctx->blocklength = M_EVP_MD_size(md);
++    dctx->seedlen = M_EVP_MD_size(md);
++
++    dctx->min_entropy = dctx->strength / 8;
++    dctx->max_entropy = DRBG_MAX_LENGTH;
++
++    dctx->min_nonce = dctx->min_entropy / 2;
++    dctx->max_nonce = DRBG_MAX_LENGTH;
++
++    dctx->max_pers = DRBG_MAX_LENGTH;
++    dctx->max_adin = DRBG_MAX_LENGTH;
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_lib.c b/crypto/fips/fips_drbg_lib.c
+new file mode 100644
+index 0000000..cc0c7f8
+--- /dev/null
++++ b/crypto/fips/fips_drbg_lib.c
+@@ -0,0 +1,555 @@
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/err.h>
++#include <openssl/fips_rand.h>
++#include "fips_locl.h"
++#ifdef OPENSSL_FIPS
++#include "fips_rand_lcl.h"
++
++/* Support framework for SP800-90 DRBGs */
++
++int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
++{
++    int rv;
++    memset(dctx, 0, sizeof(DRBG_CTX));
++    dctx->status = DRBG_STATUS_UNINITIALISED;
++    dctx->xflags = flags;
++    dctx->type = type;
++
++    dctx->iflags = 0;
++    dctx->entropy_blocklen = 0;
++    dctx->health_check_cnt = 0;
++    dctx->health_check_interval = DRBG_HEALTH_INTERVAL;
++
++    rv = fips_drbg_hash_init(dctx);
++
++    if (rv == -2)
++        rv = fips_drbg_ctr_init(dctx);
++    if (rv == -2)
++        rv = fips_drbg_hmac_init(dctx);
++
++    if (rv <= 0) {
++        if (rv == -2)
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_UNSUPPORTED_DRBG_TYPE);
++        else
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
++    }
++
++    /* If not in test mode run selftests on DRBG of the same type */
++
++    if (!(dctx->xflags & DRBG_FLAG_TEST)) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);
++            return 0;
++        }
++    }
++
++    return rv;
++}
++
++DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags)
++{
++    DRBG_CTX *dctx;
++    dctx = OPENSSL_malloc(sizeof(DRBG_CTX));
++    if (!dctx) {
++        FIPSerr(FIPS_F_FIPS_DRBG_NEW, ERR_R_MALLOC_FAILURE);
++        return NULL;
++    }
++
++    if (type == 0) {
++        memset(dctx, 0, sizeof(DRBG_CTX));
++        dctx->type = 0;
++        dctx->status = DRBG_STATUS_UNINITIALISED;
++        return dctx;
++    }
++
++    if (FIPS_drbg_init(dctx, type, flags) <= 0) {
++        OPENSSL_free(dctx);
++        return NULL;
++    }
++
++    return dctx;
++}
++
++void FIPS_drbg_free(DRBG_CTX *dctx)
++{
++    if (dctx->uninstantiate)
++        dctx->uninstantiate(dctx);
++    /* Don't free up default DRBG */
++    if (dctx == FIPS_get_default_drbg()) {
++        memset(dctx, 0, sizeof(DRBG_CTX));
++        dctx->type = 0;
++        dctx->status = DRBG_STATUS_UNINITIALISED;
++    } else {
++        OPENSSL_cleanse(&dctx->d, sizeof(dctx->d));
++        OPENSSL_free(dctx);
++    }
++}
++
++static size_t fips_get_entropy(DRBG_CTX *dctx, unsigned char **pout,
++                               int entropy, size_t min_len, size_t max_len)
++{
++    unsigned char *tout, *p;
++    size_t bl = dctx->entropy_blocklen, rv;
++    if (!dctx->get_entropy)
++        return 0;
++    if (dctx->xflags & DRBG_FLAG_TEST || !bl)
++        return dctx->get_entropy(dctx, pout, entropy, min_len, max_len);
++    rv = dctx->get_entropy(dctx, &tout, entropy + bl,
++                           min_len + bl, max_len + bl);
++    if (tout == NULL)
++        return 0;
++    *pout = tout + bl;
++    if (rv < (min_len + bl) || (rv % bl))
++        return 0;
++    /* Compare consecutive blocks for continuous PRNG test */
++    for (p = tout; p < tout + rv - bl; p += bl) {
++        if (!memcmp(p, p + bl, bl)) {
++            FIPSerr(FIPS_F_FIPS_GET_ENTROPY, FIPS_R_ENTROPY_SOURCE_STUCK);
++            return 0;
++        }
++    }
++    rv -= bl;
++    if (rv > max_len)
++        return max_len;
++    return rv;
++}
++
++static void fips_cleanup_entropy(DRBG_CTX *dctx,
++                                 unsigned char *out, size_t olen)
++{
++    size_t bl;
++    if (dctx->xflags & DRBG_FLAG_TEST)
++        bl = 0;
++    else
++        bl = dctx->entropy_blocklen;
++    /* Call cleanup with original arguments */
++    dctx->cleanup_entropy(dctx, out - bl, olen + bl);
++}
++
++int FIPS_drbg_instantiate(DRBG_CTX *dctx,
++                          const unsigned char *pers, size_t perslen)
++{
++    size_t entlen = 0, noncelen = 0;
++    unsigned char *nonce = NULL, *entropy = NULL;
++
++#if 0
++    /* Put here so error script picks them up */
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE,
++            FIPS_R_PERSONALISATION_STRING_TOO_LONG);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_IN_ERROR_STATE);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ALREADY_INSTANTIATED);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_ENTROPY);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_NONCE);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_INSTANTIATE_ERROR);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_DRBG_NOT_INITIALISED);
++#endif
++
++    int r = 0;
++
++    if (perslen > dctx->max_pers) {
++        r = FIPS_R_PERSONALISATION_STRING_TOO_LONG;
++        goto end;
++    }
++
++    if (!dctx->instantiate) {
++        r = FIPS_R_DRBG_NOT_INITIALISED;
++        goto end;
++    }
++
++    if (dctx->status != DRBG_STATUS_UNINITIALISED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else
++            r = FIPS_R_ALREADY_INSTANTIATED;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_ERROR;
++
++    entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
++                              dctx->min_entropy, dctx->max_entropy);
++
++    if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) {
++        r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
++        goto end;
++    }
++
++    if (dctx->max_nonce > 0 && dctx->get_nonce) {
++        noncelen = dctx->get_nonce(dctx, &nonce,
++                                   dctx->strength / 2,
++                                   dctx->min_nonce, dctx->max_nonce);
++
++        if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce) {
++            r = FIPS_R_ERROR_RETRIEVING_NONCE;
++            goto end;
++        }
++
++    }
++
++    if (!dctx->instantiate(dctx,
++                           entropy, entlen, nonce, noncelen, pers, perslen)) {
++        r = FIPS_R_ERROR_INSTANTIATING_DRBG;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_READY;
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
++        dctx->reseed_counter = 1;
++
++ end:
++
++    if (entropy && dctx->cleanup_entropy)
++        fips_cleanup_entropy(dctx, entropy, entlen);
++
++    if (nonce && dctx->cleanup_nonce)
++        dctx->cleanup_nonce(dctx, nonce, noncelen);
++
++    if (dctx->status == DRBG_STATUS_READY)
++        return 1;
++
++    if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, r);
++
++    return 0;
++
++}
++
++static int drbg_reseed(DRBG_CTX *dctx,
++                       const unsigned char *adin, size_t adinlen, int hcheck)
++{
++    unsigned char *entropy = NULL;
++    size_t entlen = 0;
++    int r = 0;
++
++#if 0
++    FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_NOT_INSTANTIATED);
++    FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_ADDITIONAL_INPUT_TOO_LONG);
++#endif
++    if (dctx->status != DRBG_STATUS_READY
++        && dctx->status != DRBG_STATUS_RESEED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else if (dctx->status == DRBG_STATUS_UNINITIALISED)
++            r = FIPS_R_NOT_INSTANTIATED;
++        goto end;
++    }
++
++    if (!adin)
++        adinlen = 0;
++    else if (adinlen > dctx->max_adin) {
++        r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_ERROR;
++    /* Peform health check on all reseed operations if not a prediction
++     * resistance request and not in test mode.
++     */
++    if (hcheck && !(dctx->xflags & DRBG_FLAG_TEST)) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            r = FIPS_R_SELFTEST_FAILURE;
++            goto end;
++        }
++    }
++
++    entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
++                              dctx->min_entropy, dctx->max_entropy);
++
++    if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) {
++        r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
++        goto end;
++    }
++
++    if (!dctx->reseed(dctx, entropy, entlen, adin, adinlen))
++        goto end;
++
++    dctx->status = DRBG_STATUS_READY;
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
++        dctx->reseed_counter = 1;
++ end:
++
++    if (entropy && dctx->cleanup_entropy)
++        fips_cleanup_entropy(dctx, entropy, entlen);
++
++    if (dctx->status == DRBG_STATUS_READY)
++        return 1;
++
++    if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_DRBG_RESEED, r);
++
++    return 0;
++}
++
++int FIPS_drbg_reseed(DRBG_CTX *dctx,
++                     const unsigned char *adin, size_t adinlen)
++{
++    return drbg_reseed(dctx, adin, adinlen, 1);
++}
++
++static int fips_drbg_check(DRBG_CTX *dctx)
++{
++    if (dctx->xflags & DRBG_FLAG_TEST)
++        return 1;
++    dctx->health_check_cnt++;
++    if (dctx->health_check_cnt >= dctx->health_check_interval) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE);
++            return 0;
++        }
++    }
++    return 1;
++}
++
++int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
++                       int prediction_resistance,
++                       const unsigned char *adin, size_t adinlen)
++{
++    int r = 0;
++
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    if (!fips_drbg_check(dctx))
++        return 0;
++
++    if (dctx->status != DRBG_STATUS_READY
++        && dctx->status != DRBG_STATUS_RESEED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else if (dctx->status == DRBG_STATUS_UNINITIALISED)
++            r = FIPS_R_NOT_INSTANTIATED;
++        goto end;
++    }
++
++    if (outlen > dctx->max_request) {
++        r = FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG;
++        return 0;
++    }
++
++    if (adinlen > dctx->max_adin) {
++        r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
++        goto end;
++    }
++
++    if (dctx->iflags & DRBG_CUSTOM_RESEED)
++        dctx->generate(dctx, NULL, outlen, NULL, 0);
++    else if (dctx->reseed_counter >= dctx->reseed_interval)
++        dctx->status = DRBG_STATUS_RESEED;
++
++    if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance) {
++        /* If prediction resistance request don't do health check */
++        int hcheck = prediction_resistance ? 0 : 1;
++
++        if (!drbg_reseed(dctx, adin, adinlen, hcheck)) {
++            r = FIPS_R_RESEED_ERROR;
++            goto end;
++        }
++        adin = NULL;
++        adinlen = 0;
++    }
++
++    if (!dctx->generate(dctx, out, outlen, adin, adinlen)) {
++        r = FIPS_R_GENERATE_ERROR;
++        dctx->status = DRBG_STATUS_ERROR;
++        goto end;
++    }
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED)) {
++        if (dctx->reseed_counter >= dctx->reseed_interval)
++            dctx->status = DRBG_STATUS_RESEED;
++        else
++            dctx->reseed_counter++;
++    }
++
++ end:
++    if (r) {
++        if (!(dctx->iflags & DRBG_FLAG_NOERR))
++            FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, r);
++        return 0;
++    }
++
++    return 1;
++}
++
++int FIPS_drbg_uninstantiate(DRBG_CTX *dctx)
++{
++    int rv;
++    if (!dctx->uninstantiate)
++        rv = 1;
++    else
++        rv = dctx->uninstantiate(dctx);
++    /* Although we'd like to cleanse here we can't because we have to
++     * test the uninstantiate really zeroes the data.
++     */
++    memset(&dctx->d, 0, sizeof(dctx->d));
++    dctx->status = DRBG_STATUS_UNINITIALISED;
++    /* If method has problems uninstantiating, return error */
++    return rv;
++}
++
++int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
++                            size_t (*get_entropy) (DRBG_CTX *ctx,
++                                                   unsigned char **pout,
++                                                   int entropy,
++                                                   size_t min_len,
++                                                   size_t max_len),
++                            void (*cleanup_entropy) (DRBG_CTX *ctx,
++                                                     unsigned char *out,
++                                                     size_t olen),
++                            size_t entropy_blocklen,
++                            size_t (*get_nonce) (DRBG_CTX *ctx,
++                                                 unsigned char **pout,
++                                                 int entropy, size_t min_len,
++                                                 size_t max_len),
++                            void (*cleanup_nonce) (DRBG_CTX *ctx,
++                                                   unsigned char *out,
++                                                   size_t olen))
++{
++    if (dctx->status != DRBG_STATUS_UNINITIALISED)
++        return 0;
++    dctx->entropy_blocklen = entropy_blocklen;
++    dctx->get_entropy = get_entropy;
++    dctx->cleanup_entropy = cleanup_entropy;
++    dctx->get_nonce = get_nonce;
++    dctx->cleanup_nonce = cleanup_nonce;
++    return 1;
++}
++
++int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
++                                 size_t (*get_adin) (DRBG_CTX *ctx,
++                                                     unsigned char **pout),
++                                 void (*cleanup_adin) (DRBG_CTX *ctx,
++                                                       unsigned char *out,
++                                                       size_t olen),
++                                 int (*rand_seed_cb) (DRBG_CTX *ctx,
++                                                      const void *buf,
++                                                      int num),
++                                 int (*rand_add_cb) (DRBG_CTX *ctx,
++                                                     const void *buf, int num,
++                                                     double entropy))
++{
++    if (dctx->status != DRBG_STATUS_UNINITIALISED)
++        return 0;
++    dctx->get_adin = get_adin;
++    dctx->cleanup_adin = cleanup_adin;
++    dctx->rand_seed_cb = rand_seed_cb;
++    dctx->rand_add_cb = rand_add_cb;
++    return 1;
++}
++
++void *FIPS_drbg_get_app_data(DRBG_CTX *dctx)
++{
++    return dctx->app_data;
++}
++
++void FIPS_drbg_set_app_data(DRBG_CTX *dctx, void *app_data)
++{
++    dctx->app_data = app_data;
++}
++
++size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx)
++{
++    return dctx->blocklength;
++}
++
++int FIPS_drbg_get_strength(DRBG_CTX *dctx)
++{
++    return dctx->strength;
++}
++
++void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval)
++{
++    dctx->health_check_interval = interval;
++}
++
++void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval)
++{
++    dctx->reseed_interval = interval;
++}
++
++static int drbg_stick = 0;
++
++void FIPS_drbg_stick(int onoff)
++{
++    drbg_stick = onoff;
++}
++
++/* Continuous DRBG utility function */
++int fips_drbg_cprng_test(DRBG_CTX *dctx, const unsigned char *out)
++{
++    /* No CPRNG in test mode */
++    if (dctx->xflags & DRBG_FLAG_TEST)
++        return 1;
++    /* Check block is valid: should never happen */
++    if (dctx->lb_valid == 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_INTERNAL_ERROR);
++        fips_set_selftest_fail();
++        return 0;
++    }
++    if (drbg_stick)
++        memcpy(dctx->lb, out, dctx->blocklength);
++    /* Check against last block: fail if match */
++    if (!memcmp(dctx->lb, out, dctx->blocklength)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_CPRNG_TEST, FIPS_R_DRBG_STUCK);
++        fips_set_selftest_fail();
++        return 0;
++    }
++    /* Save last block for next comparison */
++    memcpy(dctx->lb, out, dctx->blocklength);
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_rand.c b/crypto/fips/fips_drbg_rand.c
+new file mode 100644
+index 0000000..46db8ce
+--- /dev/null
++++ b/crypto/fips/fips_drbg_rand.c
+@@ -0,0 +1,168 @@
++/* fips/rand/fips_drbg_rand.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/err.h>
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#ifdef OPENSSL_FIPS
++#include "fips_rand_lcl.h"
++
++/* Mapping of SP800-90 DRBGs to OpenSSL RAND_METHOD */
++
++/* Since we only have one global PRNG used at any time in OpenSSL use a global
++ * variable to store context.
++ */
++
++static DRBG_CTX ossl_dctx;
++
++DRBG_CTX *FIPS_get_default_drbg(void)
++{
++    return &ossl_dctx;
++}
++
++static int fips_drbg_bytes(unsigned char *out, int count)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int rv = 0;
++    unsigned char *adin = NULL;
++    size_t adinlen = 0;
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    do {
++        size_t rcnt;
++        if (count > (int)dctx->max_request)
++            rcnt = dctx->max_request;
++        else
++            rcnt = count;
++        if (dctx->get_adin) {
++            adinlen = dctx->get_adin(dctx, &adin);
++            if (adinlen && !adin) {
++                FIPSerr(FIPS_F_FIPS_DRBG_BYTES,
++                        FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT);
++                goto err;
++            }
++        }
++        rv = FIPS_drbg_generate(dctx, out, rcnt, 0, adin, adinlen);
++        if (adin) {
++            if (dctx->cleanup_adin)
++                dctx->cleanup_adin(dctx, adin, adinlen);
++            adin = NULL;
++        }
++        if (!rv)
++            goto err;
++        out += rcnt;
++        count -= rcnt;
++    }
++    while (count);
++    rv = 1;
++ err:
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++    return rv;
++}
++
++static int fips_drbg_pseudo(unsigned char *out, int count)
++{
++    if (fips_drbg_bytes(out, count) <= 0)
++        return -1;
++    return 1;
++}
++
++static int fips_drbg_status(void)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int rv;
++    CRYPTO_r_lock(CRYPTO_LOCK_RAND);
++    rv = dctx->status == DRBG_STATUS_READY ? 1 : 0;
++    CRYPTO_r_unlock(CRYPTO_LOCK_RAND);
++    return rv;
++}
++
++static void fips_drbg_cleanup(void)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    FIPS_drbg_uninstantiate(dctx);
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++}
++
++static int fips_drbg_seed(const void *seed, int seedlen)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    if (dctx->rand_seed_cb)
++        return dctx->rand_seed_cb(dctx, seed, seedlen);
++    return 1;
++}
++
++static int fips_drbg_add(const void *seed, int seedlen, double add_entropy)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    if (dctx->rand_add_cb)
++        return dctx->rand_add_cb(dctx, seed, seedlen, add_entropy);
++    return 1;
++}
++
++static const RAND_METHOD rand_drbg_meth = {
++    fips_drbg_seed,
++    fips_drbg_bytes,
++    fips_drbg_cleanup,
++    fips_drbg_add,
++    fips_drbg_pseudo,
++    fips_drbg_status
++};
++
++const RAND_METHOD *FIPS_drbg_method(void)
++{
++    return &rand_drbg_meth;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_selftest.c b/crypto/fips/fips_drbg_selftest.c
+new file mode 100644
+index 0000000..c4d4337
+--- /dev/null
++++ b/crypto/fips/fips_drbg_selftest.c
+@@ -0,0 +1,829 @@
++/* fips/rand/fips_drbg_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/err.h>
++#include <openssl/fips_rand.h>
++#ifdef OPENSSL_FIPS
++#include "fips_rand_lcl.h"
++#include "fips_locl.h"
++
++#include "fips_drbg_selftest.h"
++
++typedef struct {
++    int post;
++    int nid;
++    unsigned int flags;
++
++    /* KAT data for no PR */
++    const unsigned char *ent;
++    size_t entlen;
++    const unsigned char *nonce;
++    size_t noncelen;
++    const unsigned char *pers;
++    size_t perslen;
++    const unsigned char *adin;
++    size_t adinlen;
++    const unsigned char *entreseed;
++    size_t entreseedlen;
++    const unsigned char *adinreseed;
++    size_t adinreseedlen;
++    const unsigned char *adin2;
++    size_t adin2len;
++    const unsigned char *kat;
++    size_t katlen;
++    const unsigned char *kat2;
++    size_t kat2len;
++
++    /* KAT data for PR */
++    const unsigned char *ent_pr;
++    size_t entlen_pr;
++    const unsigned char *nonce_pr;
++    size_t noncelen_pr;
++    const unsigned char *pers_pr;
++    size_t perslen_pr;
++    const unsigned char *adin_pr;
++    size_t adinlen_pr;
++    const unsigned char *entpr_pr;
++    size_t entprlen_pr;
++    const unsigned char *ading_pr;
++    size_t adinglen_pr;
++    const unsigned char *entg_pr;
++    size_t entglen_pr;
++    const unsigned char *kat_pr;
++    size_t katlen_pr;
++    const unsigned char *kat2_pr;
++    size_t kat2len_pr;
++
++} DRBG_SELFTEST_DATA;
++
++#define make_drbg_test_data(nid, flag, pr, p) {p, nid, flag | DRBG_FLAG_TEST, \
++        pr##_entropyinput, sizeof(pr##_entropyinput), \
++        pr##_nonce, sizeof(pr##_nonce), \
++        pr##_personalizationstring, sizeof(pr##_personalizationstring), \
++        pr##_additionalinput, sizeof(pr##_additionalinput), \
++        pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
++        pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
++        pr##_additionalinput2, sizeof(pr##_additionalinput2), \
++        pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
++        pr##_returnedbits, sizeof(pr##_returnedbits), \
++        pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
++        pr##_pr_nonce, sizeof(pr##_pr_nonce), \
++        pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
++        pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
++        pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
++        pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
++        pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
++        pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
++        pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits), \
++        }
++
++#define make_drbg_test_data_df(nid, pr, p) \
++        make_drbg_test_data(nid, DRBG_FLAG_CTR_USE_DF, pr, p)
++
++#define make_drbg_test_data_ec(curve, md, pr, p) \
++        make_drbg_test_data((curve << 16) | md , 0, pr, p)
++
++static DRBG_SELFTEST_DATA drbg_test[] = {
++    make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0),
++    make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0),
++    make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1),
++    make_drbg_test_data(NID_aes_128_ctr, 0, aes_128_no_df, 0),
++    make_drbg_test_data(NID_aes_192_ctr, 0, aes_192_no_df, 0),
++    make_drbg_test_data(NID_aes_256_ctr, 0, aes_256_no_df, 1),
++    make_drbg_test_data(NID_sha1, 0, sha1, 0),
++    make_drbg_test_data(NID_sha224, 0, sha224, 0),
++    make_drbg_test_data(NID_sha256, 0, sha256, 1),
++    make_drbg_test_data(NID_sha384, 0, sha384, 0),
++    make_drbg_test_data(NID_sha512, 0, sha512, 0),
++    make_drbg_test_data(NID_hmacWithSHA1, 0, hmac_sha1, 0),
++    make_drbg_test_data(NID_hmacWithSHA224, 0, hmac_sha224, 0),
++    make_drbg_test_data(NID_hmacWithSHA256, 0, hmac_sha256, 1),
++    make_drbg_test_data(NID_hmacWithSHA384, 0, hmac_sha384, 0),
++    make_drbg_test_data(NID_hmacWithSHA512, 0, hmac_sha512, 0),
++    {0, 0, 0}
++};
++
++typedef struct {
++    const unsigned char *ent;
++    size_t entlen;
++    int entcnt;
++    const unsigned char *nonce;
++    size_t noncelen;
++    int noncecnt;
++} TEST_ENT;
++
++static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,
++                           int entropy, size_t min_len, size_t max_len)
++{
++    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
++    *pout = (unsigned char *)t->ent;
++    t->entcnt++;
++    return t->entlen;
++}
++
++static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,
++                         int entropy, size_t min_len, size_t max_len)
++{
++    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
++    *pout = (unsigned char *)t->nonce;
++    t->noncecnt++;
++    return t->noncelen;
++}
++
++static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,
++                                int quick)
++{
++    TEST_ENT t;
++    int rv = 0;
++    size_t adinlen;
++    unsigned char randout[1024];
++
++    /* Initial test without PR */
++
++    /* Instantiate DRBG with test entropy, nonce and personalisation
++     * string.
++     */
++
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, &t);
++
++    t.ent = td->ent;
++    t.entlen = td->entlen;
++    t.nonce = td->nonce;
++    t.noncelen = td->noncelen;
++    t.entcnt = 0;
++    t.noncecnt = 0;
++
++    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
++        goto err;
++
++    /* Note for CTR without DF some additional input values
++     * ignore bytes after the keylength: so reduce adinlen
++     * to half to ensure invalid data is fed in.
++     */
++    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))
++        adinlen = td->adinlen / 2;
++    else
++        adinlen = td->adinlen;
++
++    /* Generate with no PR and verify output matches expected data */
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, adinlen))
++        goto err;
++
++    if (memcmp(randout, td->kat, td->katlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);
++        goto err2;
++    }
++    /* If abbreviated POST end of test */
++    if (quick) {
++        rv = 1;
++        goto err;
++    }
++    /* Reseed DRBG with test entropy and additional input */
++    t.ent = td->entreseed;
++    t.entlen = td->entreseedlen;
++
++    if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))
++        goto err;
++
++    /* Generate with no PR and verify output matches expected data */
++    if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0,
++                            td->adin2, td->adin2len))
++        goto err;
++
++    if (memcmp(randout, td->kat2, td->kat2len)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST2_FAILURE);
++        goto err2;
++    }
++
++    FIPS_drbg_uninstantiate(dctx);
++
++    /* Now test with PR */
++
++    /* Instantiate DRBG with test entropy, nonce and personalisation
++     * string.
++     */
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, &t);
++
++    t.ent = td->ent_pr;
++    t.entlen = td->entlen_pr;
++    t.nonce = td->nonce_pr;
++    t.noncelen = td->noncelen_pr;
++    t.entcnt = 0;
++    t.noncecnt = 0;
++
++    if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))
++        goto err;
++
++    /* Now generate with PR: we need to supply entropy as this will
++     * perform a reseed operation. Check output matches expected value.
++     */
++
++    t.ent = td->entpr_pr;
++    t.entlen = td->entprlen_pr;
++
++    /* Note for CTR without DF some additional input values
++     * ignore bytes after the keylength: so reduce adinlen
++     * to half to ensure invalid data is fed in.
++     */
++    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))
++        adinlen = td->adinlen_pr / 2;
++    else
++        adinlen = td->adinlen_pr;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 1,
++                            td->adin_pr, adinlen))
++        goto err;
++
++    if (memcmp(randout, td->kat_pr, td->katlen_pr)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST1_FAILURE);
++        goto err2;
++    }
++
++    /* Now generate again with PR: supply new entropy again.
++     * Check output matches expected value.
++     */
++
++    t.ent = td->entg_pr;
++    t.entlen = td->entglen_pr;
++
++    if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 1,
++                            td->ading_pr, td->adinglen_pr))
++        goto err;
++
++    if (memcmp(randout, td->kat2_pr, td->kat2len_pr)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);
++        goto err2;
++    }
++    /* All OK, test complete */
++    rv = 1;
++
++ err:
++    if (rv == 0)
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_SELFTEST_FAILED);
++ err2:
++    FIPS_drbg_uninstantiate(dctx);
++
++    return rv;
++
++}
++
++/* Initialise a DRBG based on selftest data */
++
++static int do_drbg_init(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td, TEST_ENT * t)
++{
++
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, t);
++
++    t->ent = td->ent;
++    t->entlen = td->entlen;
++    t->nonce = td->nonce;
++    t->noncelen = td->noncelen;
++    t->entcnt = 0;
++    t->noncecnt = 0;
++    return 1;
++}
++
++/* Initialise and instantiate DRBG based on selftest data */
++static int do_drbg_instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,
++                               TEST_ENT * t)
++{
++    if (!do_drbg_init(dctx, td, t))
++        return 0;
++    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
++        return 0;
++
++    return 1;
++}
++
++/* This function performs extensive error checking as required by SP800-90.
++ * Induce several failure modes and check an error condition is set.
++ * This function along with fips_drbg_single_kat peforms the health checking
++ * operation.
++ */
++
++static int fips_drbg_error_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td)
++{
++    unsigned char randout[1024];
++    TEST_ENT t;
++    size_t i;
++    unsigned int reseed_counter_tmp;
++    unsigned char *p = (unsigned char *)dctx;
++
++    /* Initialise DRBG */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    /* Don't report induced errors */
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Personalisation string tests */
++
++    /* Test detection of too large personlisation string */
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_PERSONALISATION_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Entropy source tests */
++
++    /* Test entropy source failure detecion: i.e. returns no data */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Try to generate output from uninstantiated DRBG */
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_GENERATE_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Test insufficient entropy */
++
++    t.entlen = dctx->min_entropy - 1;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test too much entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->max_entropy + 1;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Nonce tests */
++
++    /* Test too small nonce */
++
++    if (dctx->min_nonce) {
++
++        if (!do_drbg_init(dctx, td, &t))
++            goto err;
++
++        dctx->iflags |= DRBG_FLAG_NOERR;
++
++        t.noncelen = dctx->min_nonce - 1;
++
++        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_NONCE_ERROR_UNDETECTED);
++            goto err;
++        }
++
++        dctx->iflags &= ~DRBG_FLAG_NOERR;
++        if (!FIPS_drbg_uninstantiate(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++            goto err;
++        }
++
++    }
++
++    /* Test too large nonce */
++
++    if (dctx->max_nonce) {
++
++        if (!do_drbg_init(dctx, td, &t))
++            goto err;
++
++        dctx->iflags |= DRBG_FLAG_NOERR;
++
++        t.noncelen = dctx->max_nonce + 1;
++
++        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_NONCE_ERROR_UNDETECTED);
++            goto err;
++        }
++
++        dctx->iflags &= ~DRBG_FLAG_NOERR;
++        if (!FIPS_drbg_uninstantiate(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++            goto err;
++        }
++
++    }
++
++    /* Instantiate with valid data. */
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++
++    /* Check generation is now OK */
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Request too much data for one request */
++    if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Try too large additional input */
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                           td->adin, dctx->max_adin + 1)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Check prediction resistance request fails if entropy source
++     * failure.
++     */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Instantiate again with valid data */
++
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++    /* Test reseed counter works */
++    /* Save initial reseed counter */
++    reseed_counter_tmp = dctx->reseed_counter;
++    /* Set reseed counter to beyond interval */
++    dctx->reseed_counter = dctx->reseed_interval;
++
++    /* Generate output and check entropy has been requested for reseed */
++    t.entcnt = 0;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++    if (t.entcnt != 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
++        goto err;
++    }
++    /* Check reseed counter has been reset */
++    if (dctx->reseed_counter != reseed_counter_tmp + 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Check prediction resistance request fails if entropy source
++     * failure.
++     */
++
++    t.entlen = 0;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++    /* Test reseed counter works */
++    /* Save initial reseed counter */
++    reseed_counter_tmp = dctx->reseed_counter;
++    /* Set reseed counter to beyond interval */
++    dctx->reseed_counter = dctx->reseed_interval;
++
++    /* Generate output and check entropy has been requested for reseed */
++    t.entcnt = 0;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++    if (t.entcnt != 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
++        goto err;
++    }
++    /* Check reseed counter has been reset */
++    if (dctx->reseed_counter != reseed_counter_tmp + 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Explicit reseed tests */
++
++    /* Test explicit reseed with too large additional input */
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, dctx->max_adin + 1) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Test explicit reseed with entropy source failure */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test explicit reseed with too much entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->max_entropy + 1;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test explicit reseed with too little entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->min_entropy - 1;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    p = (unsigned char *)&dctx->d;
++    /* Standard says we have to check uninstantiate really zeroes
++     * the data...
++     */
++    for (i = 0; i < sizeof(dctx->d); i++) {
++        if (*p != 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_UNINSTANTIATE_ZEROISE_ERROR);
++            goto err;
++        }
++        p++;
++    }
++
++    return 1;
++
++ err:
++    /* A real error as opposed to an induced one: underlying function will
++     * indicate the error.
++     */
++    if (!(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_FUNCTION_ERROR);
++    FIPS_drbg_uninstantiate(dctx);
++    return 0;
++
++}
++
++int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)
++{
++    DRBG_SELFTEST_DATA *td;
++    flags |= DRBG_FLAG_TEST;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (td->nid == nid && td->flags == flags) {
++            if (!fips_drbg_single_kat(dctx, td, 0))
++                return 0;
++            return fips_drbg_error_check(dctx, td);
++        }
++    }
++    return 0;
++}
++
++int FIPS_drbg_health_check(DRBG_CTX *dctx)
++{
++    int rv;
++    DRBG_CTX *tctx = NULL;
++    tctx = FIPS_drbg_new(0, 0);
++    fips_post_started(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    if (!tctx)
++        return 0;
++    rv = fips_drbg_kat(tctx, dctx->type, dctx->xflags);
++    if (tctx)
++        FIPS_drbg_free(tctx);
++    if (rv)
++        fips_post_success(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    else
++        fips_post_failed(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    if (!rv)
++        dctx->status = DRBG_STATUS_ERROR;
++    else
++        dctx->health_check_cnt = 0;
++    return rv;
++}
++
++int FIPS_selftest_drbg(void)
++{
++    DRBG_CTX *dctx;
++    DRBG_SELFTEST_DATA *td;
++    int rv = 1;
++    dctx = FIPS_drbg_new(0, 0);
++    if (!dctx)
++        return 0;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (td->post != 1)
++            continue;
++        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 1;
++        if (!fips_drbg_single_kat(dctx, td, 1)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 0;
++    }
++    FIPS_drbg_free(dctx);
++    return rv;
++}
++
++int FIPS_selftest_drbg_all(void)
++{
++    DRBG_CTX *dctx;
++    DRBG_SELFTEST_DATA *td;
++    int rv = 1;
++    dctx = FIPS_drbg_new(0, 0);
++    if (!dctx)
++        return 0;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 1;
++        if (!fips_drbg_single_kat(dctx, td, 0)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_drbg_error_check(dctx, td)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 0;
++    }
++    FIPS_drbg_free(dctx);
++    return rv;
++}
++#endif
+diff --git a/crypto/fips/fips_drbg_selftest.h b/crypto/fips/fips_drbg_selftest.h
+new file mode 100644
+index 0000000..bb28152
+--- /dev/null
++++ b/crypto/fips/fips_drbg_selftest.h
+@@ -0,0 +1,1791 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++/* Selftest and health check data for the SP800-90 DRBG */
++
++#define __fips_constseg
++
++/* AES-128 use df PR  */
++__fips_constseg static const unsigned char aes_128_use_df_pr_entropyinput[] = {
++    0x61, 0x52, 0x7c, 0xe3, 0x23, 0x7d, 0x0a, 0x07, 0x10, 0x0c, 0x50, 0x33,
++    0xc8, 0xdb, 0xff, 0x12
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_pr_nonce[] = {
++    0x51, 0x0d, 0x85, 0x77, 0xed, 0x22, 0x97, 0x28
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_personalizationstring[] = {
++    0x59, 0x9f, 0xbb, 0xcd, 0xd5, 0x25, 0x69, 0xb5, 0xcb, 0xb5, 0x03, 0xfe,
++    0xd7, 0xd7, 0x01, 0x67
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_additionalinput[] = {
++    0xef, 0x88, 0x76, 0x01, 0xaf, 0x3c, 0xfe, 0x8b, 0xaf, 0x26, 0x06, 0x9e,
++    0x9a, 0x47, 0x08, 0x76
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_entropyinputpr[] = {
++    0xe2, 0x76, 0xf9, 0xf6, 0x3a, 0xba, 0x10, 0x9f, 0xbf, 0x47, 0x0e, 0x51,
++    0x09, 0xfb, 0xa3, 0xb6
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_int_returnedbits[] = {
++    0xd4, 0x98, 0x8a, 0x46, 0x80, 0x4c, 0xdb, 0xa3, 0x59, 0x02, 0x57, 0x52,
++    0x66, 0x1c, 0xea, 0x5b
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_additionalinput2[] = {
++    0x88, 0x8c, 0x91, 0xd6, 0xbe, 0x56, 0x6e, 0x08, 0x9a, 0x62, 0x2b, 0x11,
++    0x3f, 0x5e, 0x31, 0x06
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_entropyinputpr2[] = {
++    0xc0, 0x5c, 0x6b, 0x98, 0x01, 0x0d, 0x58, 0x18, 0x51, 0x18, 0x96, 0xae,
++    0xa7, 0xe3, 0xa8, 0x67
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_pr_returnedbits[] = {
++    0xcf, 0x01, 0xac, 0x22, 0x31, 0x06, 0x8e, 0xfc, 0xce, 0x56, 0xea, 0x24,
++    0x0f, 0x38, 0x43, 0xc6
++};
++
++/* AES-128 use df No PR  */
++__fips_constseg static const unsigned char aes_128_use_df_entropyinput[] = {
++    0x1f, 0x8e, 0x34, 0x82, 0x0c, 0xb7, 0xbe, 0xc5, 0x01, 0x3e, 0xd0, 0xa3,
++    0x9d, 0x7d, 0x1c, 0x9b
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_nonce[] = {
++    0xd5, 0x4d, 0xbd, 0x4a, 0x93, 0x7f, 0xb8, 0x96
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_personalizationstring[] = {
++    0xab, 0xd6, 0x3f, 0x04, 0xfe, 0x27, 0x6b, 0x2d, 0xd7, 0xc3, 0x1c, 0xf3,
++    0x38, 0x66, 0xba, 0x1b
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_additionalinput[] = {
++    0xfe, 0xf4, 0x09, 0xa8, 0xb7, 0x73, 0x27, 0x9c, 0x5f, 0xa7, 0xea, 0x46,
++    0xb5, 0xe2, 0xb2, 0x41
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_int_returnedbits[] = {
++    0x42, 0xe4, 0x4e, 0x7b, 0x27, 0xdd, 0xcb, 0xbc, 0x0a, 0xcf, 0xa6, 0x67,
++    0xe7, 0x57, 0x11, 0xb4
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_entropyinputreseed[] = {
++    0x14, 0x26, 0x69, 0xd9, 0xf3, 0x65, 0x03, 0xd6, 0x6b, 0xb9, 0x44, 0x0b,
++    0xc7, 0xc4, 0x9e, 0x39
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_additionalinputreseed[] = {
++    0x55, 0x2e, 0x60, 0x9a, 0x05, 0x72, 0x8a, 0xa8, 0xef, 0x22, 0x81, 0x5a,
++    0xc8, 0x93, 0xfa, 0x84
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_additionalinput2[] = {
++    0x3c, 0x40, 0xc8, 0xc4, 0x16, 0x0c, 0x21, 0xa4, 0x37, 0x2c, 0x8f, 0xa5,
++    0x06, 0x0c, 0x15, 0x2c
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_returnedbits[] = {
++    0xe1, 0x3e, 0x99, 0x98, 0x86, 0x67, 0x0b, 0x63, 0x7b, 0xbe, 0x3f, 0x88,
++    0x46, 0x81, 0xc7, 0x19
++};
++
++/* AES-192 use df PR  */
++__fips_constseg static const unsigned char aes_192_use_df_pr_entropyinput[] = {
++    0x2b, 0x4e, 0x8b, 0xe1, 0xf1, 0x34, 0x80, 0x56, 0x81, 0xf9, 0x74, 0xec,
++    0x17, 0x44, 0x2a, 0xf1, 0x14, 0xb0, 0xbf, 0x97, 0x39, 0xb7, 0x04, 0x7d
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_pr_nonce[] = {
++    0xd6, 0x9d, 0xeb, 0x14, 0x4e, 0x6c, 0x30, 0x1e, 0x39, 0x55, 0x73, 0xd0,
++    0xd1, 0x80, 0x78, 0xfa
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_personalizationstring[] = {
++    0xfc, 0x43, 0x4a, 0xf8, 0x9a, 0x55, 0xb3, 0x53, 0x83, 0xe2, 0x18, 0x16,
++    0x0c, 0xdc, 0xcd, 0x5e, 0x4f, 0xa0, 0x03, 0x01, 0x2b, 0x9f, 0xe4, 0xd5,
++    0x7d, 0x49, 0xf0, 0x41, 0x9e, 0x3d, 0x99, 0x04
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_additionalinput[] = {
++    0x5e, 0x9f, 0x49, 0x6f, 0x21, 0x8b, 0x1d, 0x32, 0xd5, 0x84, 0x5c, 0xac,
++    0xaf, 0xdf, 0xe4, 0x79, 0x9e, 0xaf, 0xa9, 0x82, 0xd0, 0xf8, 0x4f, 0xcb,
++    0x69, 0x10, 0x0a, 0x7e, 0x81, 0x57, 0xb5, 0x36
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_entropyinputpr[] = {
++    0xd4, 0x81, 0x0c, 0xd7, 0x66, 0x39, 0xec, 0x42, 0x53, 0x87, 0x41, 0xa5,
++    0x1e, 0x7d, 0x80, 0x91, 0x8e, 0xbb, 0xed, 0xac, 0x14, 0x02, 0x1a, 0xd5
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_int_returnedbits[] = {
++    0xdf, 0x1d, 0x39, 0x45, 0x7c, 0x9b, 0xc6, 0x2b, 0x7d, 0x8c, 0x93, 0xe9,
++    0x19, 0x30, 0x6b, 0x67
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_additionalinput2[] = {
++    0x00, 0x71, 0x27, 0x4e, 0xd3, 0x14, 0xf1, 0x20, 0x7f, 0x4a, 0x41, 0x32,
++    0x2a, 0x97, 0x11, 0x43, 0x8f, 0x4a, 0x15, 0x7b, 0x9b, 0x51, 0x79, 0xda,
++    0x49, 0x3d, 0xde, 0xe8, 0xbc, 0x93, 0x91, 0x99
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_entropyinputpr2[] = {
++    0x90, 0xee, 0x76, 0xa1, 0x45, 0x8d, 0xb7, 0x40, 0xb0, 0x11, 0xbf, 0xd0,
++    0x65, 0xd7, 0x3c, 0x7c, 0x4f, 0x20, 0x3f, 0x4e, 0x11, 0x9d, 0xb3, 0x5e
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_pr_returnedbits[] = {
++    0x24, 0x3b, 0x20, 0xa4, 0x37, 0x66, 0xba, 0x72, 0x39, 0x3f, 0xcf, 0x3c,
++    0x7e, 0x1a, 0x2b, 0x83
++};
++
++/* AES-192 use df No PR  */
++__fips_constseg static const unsigned char aes_192_use_df_entropyinput[] = {
++    0x8d, 0x74, 0xa4, 0x50, 0x1a, 0x02, 0x68, 0x0c, 0x2a, 0x69, 0xc4, 0x82,
++    0x3b, 0xbb, 0xda, 0x0e, 0x7f, 0x77, 0xa3, 0x17, 0x78, 0x57, 0xb2, 0x7b
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_nonce[] = {
++    0x75, 0xd5, 0x1f, 0xac, 0xa4, 0x8d, 0x42, 0x78, 0xd7, 0x69, 0x86, 0x9d,
++    0x77, 0xd7, 0x41, 0x0e
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_personalizationstring[] = {
++    0x4e, 0x33, 0x41, 0x3c, 0x9c, 0xc2, 0xd2, 0x53, 0xaf, 0x90, 0xea, 0xcf,
++    0x19, 0x50, 0x1e, 0xe6, 0x6f, 0x63, 0xc8, 0x32, 0x22, 0xdc, 0x07, 0x65,
++    0x9c, 0xd3, 0xf8, 0x30, 0x9e, 0xed, 0x35, 0x70
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_additionalinput[] = {
++    0x5d, 0x8b, 0x8c, 0xc1, 0xdf, 0x0e, 0x02, 0x78, 0xfb, 0x19, 0xb8, 0x69,
++    0x78, 0x4e, 0x9c, 0x52, 0xbc, 0xc7, 0x20, 0xc9, 0xe6, 0x5e, 0x77, 0x22,
++    0x28, 0x3d, 0x0c, 0x9e, 0x68, 0xa8, 0x45, 0xd7
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_int_returnedbits[] = {
++    0xd5, 0xe7, 0x08, 0xc5, 0x19, 0x99, 0xd5, 0x31, 0x03, 0x0a, 0x74, 0xb6,
++    0xb7, 0xed, 0xe9, 0xea
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_entropyinputreseed[] = {
++    0x9c, 0x26, 0xda, 0xf1, 0xac, 0xd9, 0x5a, 0xd6, 0xa8, 0x65, 0xf5, 0x02,
++    0x8f, 0xdc, 0xa2, 0x09, 0x54, 0xa6, 0xe2, 0xa4, 0xde, 0x32, 0xe0, 0x01
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_additionalinputreseed[] = {
++    0x9b, 0x90, 0xb0, 0x3a, 0x0e, 0x3a, 0x80, 0x07, 0x4a, 0xf4, 0xda, 0x76,
++    0x28, 0x30, 0x3c, 0xee, 0x54, 0x1b, 0x94, 0x59, 0x51, 0x43, 0x56, 0x77,
++    0xaf, 0x88, 0xdd, 0x63, 0x89, 0x47, 0x06, 0x65
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_additionalinput2[] = {
++    0x3c, 0x11, 0x64, 0x7a, 0x96, 0xf5, 0xd8, 0xb8, 0xae, 0xd6, 0x70, 0x4e,
++    0x16, 0x96, 0xde, 0xe9, 0x62, 0xbc, 0xee, 0x28, 0x2f, 0x26, 0xa6, 0xf0,
++    0x56, 0xef, 0xa3, 0xf1, 0x6b, 0xa1, 0xb1, 0x77
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_returnedbits[] = {
++    0x0b, 0xe2, 0x56, 0x03, 0x1e, 0xdb, 0x2c, 0x6d, 0x7f, 0x1b, 0x15, 0x58,
++    0x1a, 0xf9, 0x13, 0x28
++};
++
++/* AES-256 use df PR  */
++__fips_constseg static const unsigned char aes_256_use_df_pr_entropyinput[] = {
++    0x61, 0x68, 0xfc, 0x1a, 0xf0, 0xb5, 0x95, 0x6b, 0x85, 0x09, 0x9b, 0x74,
++    0x3f, 0x13, 0x78, 0x49, 0x3b, 0x85, 0xec, 0x93, 0x13, 0x3b, 0xa9, 0x4f,
++    0x96, 0xab, 0x2c, 0xe4, 0xc8, 0x8f, 0xdd, 0x6a
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_pr_nonce[] = {
++    0xad, 0xd2, 0xbb, 0xba, 0xb7, 0x65, 0x89, 0xc3, 0x21, 0x6c, 0x55, 0x33,
++    0x2b, 0x36, 0xff, 0xa4
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_personalizationstring[] = {
++    0x6e, 0xca, 0xe7, 0x20, 0x72, 0xd3, 0x84, 0x5a, 0x32, 0xd3, 0x4b, 0x24,
++    0x72, 0xc4, 0x63, 0x2b, 0x9d, 0x12, 0x24, 0x0c, 0x23, 0x26, 0x8e, 0x83,
++    0x16, 0x37, 0x0b, 0xd1, 0x06, 0x4f, 0x68, 0x6d
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_additionalinput[] = {
++    0x7e, 0x08, 0x4a, 0xbb, 0xe3, 0x21, 0x7c, 0xc9, 0x23, 0xd2, 0xf8, 0xb0,
++    0x73, 0x98, 0xba, 0x84, 0x74, 0x23, 0xab, 0x06, 0x8a, 0xe2, 0x22, 0xd3,
++    0x7b, 0xce, 0x9b, 0xd2, 0x4a, 0x76, 0xb8, 0xde
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_entropyinputpr[] = {
++    0x0b, 0x23, 0xaf, 0xdf, 0xf1, 0x62, 0xd7, 0xd3, 0x43, 0x97, 0xf8, 0x77,
++    0x04, 0xa8, 0x42, 0x20, 0xbd, 0xf6, 0x0f, 0xc1, 0x17, 0x2f, 0x9f, 0x54,
++    0xbb, 0x56, 0x17, 0x86, 0x68, 0x0e, 0xba, 0xa9
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_int_returnedbits[] = {
++    0x31, 0x8e, 0xad, 0xaf, 0x40, 0xeb, 0x6b, 0x74, 0x31, 0x46, 0x80, 0xc7,
++    0x17, 0xab, 0x3c, 0x7a
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_additionalinput2[] = {
++    0x94, 0x6b, 0xc9, 0x9f, 0xab, 0x8d, 0xc5, 0xec, 0x71, 0x88, 0x1d, 0x00,
++    0x8c, 0x89, 0x68, 0xe4, 0xc8, 0x07, 0x77, 0x36, 0x17, 0x6d, 0x79, 0x78,
++    0xc7, 0x06, 0x4e, 0x99, 0x04, 0x28, 0x29, 0xc3
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_entropyinputpr2[] = {
++    0xbf, 0x6c, 0x59, 0x2a, 0x0d, 0x44, 0x0f, 0xae, 0x9a, 0x5e, 0x03, 0x73,
++    0xd8, 0xa6, 0xe1, 0xcf, 0x25, 0x61, 0x38, 0x24, 0x86, 0x9e, 0x53, 0xe8,
++    0xa4, 0xdf, 0x56, 0xf4, 0x06, 0x07, 0x9c, 0x0f
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_pr_returnedbits[] = {
++    0x22, 0x4a, 0xb4, 0xb8, 0xb6, 0xee, 0x7d, 0xb1, 0x9e, 0xc9, 0xf9, 0xa0,
++    0xd9, 0xe2, 0x97, 0x00
++};
++
++/* AES-256 use df No PR  */
++__fips_constseg static const unsigned char aes_256_use_df_entropyinput[] = {
++    0xa5, 0x3e, 0x37, 0x10, 0x17, 0x43, 0x91, 0x93, 0x59, 0x1e, 0x47, 0x50,
++    0x87, 0xaa, 0xdd, 0xd5, 0xc1, 0xc3, 0x86, 0xcd, 0xca, 0x0d, 0xdb, 0x68,
++    0xe0, 0x02, 0xd8, 0x0f, 0xdc, 0x40, 0x1a, 0x47
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_nonce[] = {
++    0xa9, 0x4d, 0xa5, 0x5a, 0xfd, 0xc5, 0x0c, 0xe5, 0x1c, 0x9a, 0x3b, 0x8a,
++    0x4c, 0x44, 0x84, 0x40
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_personalizationstring[] = {
++    0x8b, 0x52, 0xa2, 0x4a, 0x93, 0xc3, 0x4e, 0xa7, 0x1e, 0x1c, 0xa7, 0x05,
++    0xeb, 0x82, 0x9b, 0xa6, 0x5d, 0xe4, 0xd4, 0xe0, 0x7f, 0xa3, 0xd8, 0x6b,
++    0x37, 0x84, 0x5f, 0xf1, 0xc7, 0xd5, 0xf6, 0xd2
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_additionalinput[] = {
++    0x20, 0xf4, 0x22, 0xed, 0xf8, 0x5c, 0xa1, 0x6a, 0x01, 0xcf, 0xbe, 0x5f,
++    0x8d, 0x6c, 0x94, 0x7f, 0xae, 0x12, 0xa8, 0x57, 0xdb, 0x2a, 0xa9, 0xbf,
++    0xc7, 0xb3, 0x65, 0x81, 0x80, 0x8d, 0x0d, 0x46
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_int_returnedbits[] = {
++    0x4e, 0x44, 0xfd, 0xf3, 0x9e, 0x29, 0xa2, 0xb8, 0x0f, 0x5d, 0x6c, 0xe1,
++    0x28, 0x0c, 0x3b, 0xc1
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_entropyinputreseed[] = {
++    0xdd, 0x40, 0xe5, 0x98, 0x7b, 0x27, 0x16, 0x73, 0x15, 0x68, 0xd2, 0x76,
++    0xbf, 0x0c, 0x67, 0x15, 0x75, 0x79, 0x03, 0xd3, 0xde, 0xde, 0x91, 0x46,
++    0x42, 0xdd, 0xd4, 0x67, 0xc8, 0x79, 0xc8, 0x1e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_additionalinputreseed[] = {
++    0x7f, 0xd8, 0x1f, 0xbd, 0x2a, 0xb5, 0x1c, 0x11, 0x5d, 0x83, 0x4e, 0x99,
++    0xf6, 0x5c, 0xa5, 0x40, 0x20, 0xed, 0x38, 0x8e, 0xd5, 0x9e, 0xe0, 0x75,
++    0x93, 0xfe, 0x12, 0x5e, 0x5d, 0x73, 0xfb, 0x75
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_additionalinput2[] = {
++    0xcd, 0x2c, 0xff, 0x14, 0x69, 0x3e, 0x4c, 0x9e, 0xfd, 0xfe, 0x26, 0x0d,
++    0xe9, 0x86, 0x00, 0x49, 0x30, 0xba, 0xb1, 0xc6, 0x50, 0x57, 0x77, 0x2a,
++    0x62, 0x39, 0x2c, 0x3b, 0x74, 0xeb, 0xc9, 0x0d
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_returnedbits[] = {
++    0x4f, 0x78, 0xbe, 0xb9, 0x4d, 0x97, 0x8c, 0xe9, 0xd0, 0x97, 0xfe, 0xad,
++    0xfa, 0xfd, 0x35, 0x5e
++};
++
++/* AES-128 no df PR  */
++__fips_constseg static const unsigned char aes_128_no_df_pr_entropyinput[] = {
++    0x9a, 0x25, 0x65, 0x10, 0x67, 0xd5, 0xb6, 0x6b, 0x70, 0xa1, 0xb3, 0xa4,
++    0x43, 0x95, 0x80, 0xc0, 0x84, 0x0a, 0x79, 0xb0, 0x88, 0x74, 0xf2, 0xbf,
++    0x31, 0x6c, 0x33, 0x38, 0x0b, 0x00, 0xb2, 0x5a
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_nonce[] = {
++    0x78, 0x47, 0x6b, 0xf7, 0x90, 0x8e, 0x87, 0xf1
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_personalizationstring[] = {
++    0xf7, 0x22, 0x1d, 0x3a, 0xbe, 0x1d, 0xca, 0x32, 0x1b, 0xbd, 0x87, 0x0c,
++    0x51, 0x24, 0x19, 0xee, 0xa3, 0x23, 0x09, 0x63, 0x33, 0x3d, 0xa8, 0x0c,
++    0x1c, 0xfa, 0x42, 0x89, 0xcc, 0x6f, 0xa0, 0xa8
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_additionalinput[] = {
++    0xc9, 0xe0, 0x80, 0xbf, 0x8c, 0x45, 0x58, 0x39, 0xff, 0x00, 0xab, 0x02,
++    0x4c, 0x3e, 0x3a, 0x95, 0x9b, 0x80, 0xa8, 0x21, 0x2a, 0xee, 0xba, 0x73,
++    0xb1, 0xd9, 0xcf, 0x28, 0xf6, 0x8f, 0x9b, 0x12
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_entropyinputpr[] = {
++    0x4c, 0xa8, 0xc5, 0xf0, 0x59, 0x9e, 0xa6, 0x8d, 0x26, 0x53, 0xd7, 0x8a,
++    0xa9, 0xd8, 0xf7, 0xed, 0xb2, 0xf9, 0x12, 0x42, 0xe1, 0xe5, 0xbd, 0xe7,
++    0xe7, 0x1d, 0x74, 0x99, 0x00, 0x9d, 0x31, 0x3e
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_int_returnedbits[] = {
++    0xe2, 0xac, 0x20, 0xf0, 0x80, 0xe7, 0xbc, 0x7e, 0x9c, 0x7b, 0x65, 0x71,
++    0xaf, 0x19, 0x32, 0x16
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_additionalinput2[] = {
++    0x32, 0x7f, 0x38, 0x8b, 0x73, 0x0a, 0x78, 0x83, 0xdc, 0x30, 0xbe, 0x9f,
++    0x10, 0x1f, 0xf5, 0x1f, 0xca, 0x00, 0xb5, 0x0d, 0xd6, 0x9d, 0x60, 0x83,
++    0x51, 0x54, 0x7d, 0x38, 0x23, 0x3a, 0x52, 0x50
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_entropyinputpr2[] = {
++    0x18, 0x61, 0x53, 0x56, 0xed, 0xed, 0xd7, 0x20, 0xfb, 0x71, 0x04, 0x7a,
++    0xb2, 0xac, 0xc1, 0x28, 0xcd, 0xf2, 0xc2, 0xfc, 0xaa, 0xb1, 0x06, 0x07,
++    0xe9, 0x46, 0x95, 0x02, 0x48, 0x01, 0x78, 0xf9
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_returnedbits[] = {
++    0x29, 0xc8, 0x1b, 0x15, 0xb1, 0xd1, 0xc2, 0xf6, 0x71, 0x86, 0x68, 0x33,
++    0x57, 0x82, 0x33, 0xaf
++};
++
++/* AES-128 no df No PR  */
++__fips_constseg static const unsigned char aes_128_no_df_entropyinput[] = {
++    0xc9, 0xc5, 0x79, 0xbc, 0xe8, 0xc5, 0x19, 0xd8, 0xbc, 0x66, 0x73, 0x67,
++    0xf6, 0xd3, 0x72, 0xaa, 0xa6, 0x16, 0xb8, 0x50, 0xb7, 0x47, 0x3a, 0x42,
++    0xab, 0xf4, 0x16, 0xb2, 0x96, 0xd2, 0xb6, 0x60
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_nonce[] = {
++    0x5f, 0xbf, 0x97, 0x0c, 0x4b, 0xa4, 0x87, 0x13
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_personalizationstring[] = {
++    0xce, 0xfb, 0x7b, 0x3f, 0xd4, 0x6b, 0x29, 0x0d, 0x69, 0x06, 0xff, 0xbb,
++    0xf2, 0xe5, 0xc6, 0x6c, 0x0a, 0x10, 0xa0, 0xcf, 0x1a, 0x48, 0xc7, 0x8b,
++    0x3c, 0x16, 0x88, 0xed, 0x50, 0x13, 0x81, 0xce
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_additionalinput[] = {
++    0x4b, 0x22, 0x46, 0x18, 0x02, 0x7b, 0xd2, 0x1b, 0x22, 0x42, 0x7c, 0x37,
++    0xd9, 0xf6, 0xe8, 0x9b, 0x12, 0x30, 0x5f, 0xe9, 0x90, 0xe8, 0x08, 0x24,
++    0x4f, 0x06, 0x66, 0xdb, 0x19, 0x2b, 0x13, 0x95
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_int_returnedbits[] = {
++    0x2e, 0x96, 0x70, 0x64, 0xfa, 0xdf, 0xdf, 0x57, 0xb5, 0x82, 0xee, 0xd6,
++    0xed, 0x3e, 0x65, 0xc2
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_entropyinputreseed[] = {
++    0x26, 0xc0, 0x72, 0x16, 0x3a, 0x4b, 0xb7, 0x99, 0xd4, 0x07, 0xaf, 0x66,
++    0x62, 0x36, 0x96, 0xa4, 0x51, 0x17, 0xfa, 0x07, 0x8b, 0x17, 0x5e, 0xa1,
++    0x2f, 0x3c, 0x10, 0xe7, 0x90, 0xd0, 0x46, 0x00
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_additionalinputreseed[] = {
++    0x83, 0x39, 0x37, 0x7b, 0x02, 0x06, 0xd2, 0x12, 0x13, 0x8d, 0x8b, 0xf2,
++    0xf0, 0xf6, 0x26, 0xeb, 0xa4, 0x22, 0x7b, 0xc2, 0xe7, 0xba, 0x79, 0xe4,
++    0x3b, 0x77, 0x5d, 0x4d, 0x47, 0xb2, 0x2d, 0xb4
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_additionalinput2[] = {
++    0x0b, 0xb9, 0x67, 0x37, 0xdb, 0x83, 0xdf, 0xca, 0x81, 0x8b, 0xf9, 0x3f,
++    0xf1, 0x11, 0x1b, 0x2f, 0xf0, 0x61, 0xa6, 0xdf, 0xba, 0xa3, 0xb1, 0xac,
++    0xd3, 0xe6, 0x09, 0xb8, 0x2c, 0x6a, 0x67, 0xd6
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_returnedbits[] = {
++    0x1e, 0xa7, 0xa4, 0xe4, 0xe1, 0xa6, 0x7c, 0x69, 0x9a, 0x44, 0x6c, 0x36,
++    0x81, 0x37, 0x19, 0xd4
++};
++
++/* AES-192 no df PR  */
++__fips_constseg static const unsigned char aes_192_no_df_pr_entropyinput[] = {
++    0x9d, 0x2c, 0xd2, 0x55, 0x66, 0xea, 0xe0, 0xbe, 0x18, 0xb7, 0x76, 0xe7,
++    0x73, 0x35, 0xd8, 0x1f, 0xad, 0x3a, 0xe3, 0x81, 0x0e, 0x92, 0xd0, 0x61,
++    0xc9, 0x12, 0x26, 0xf6, 0x1c, 0xdf, 0xfe, 0x47, 0xaa, 0xfe, 0x7d, 0x5a,
++    0x17, 0x1f, 0x8d, 0x9a
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_nonce[] = {
++    0x44, 0x82, 0xed, 0xe8, 0x4c, 0x28, 0x5a, 0x14, 0xff, 0x88, 0x8d, 0x19,
++    0x61, 0x5c, 0xee, 0x0f
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_personalizationstring[] = {
++    0x47, 0xd7, 0x9b, 0x99, 0xaa, 0xcb, 0xe7, 0xd2, 0x57, 0x66, 0x2c, 0xe1,
++    0x78, 0xd6, 0x2c, 0xea, 0xa3, 0x23, 0x5f, 0x2a, 0xc1, 0x3a, 0xf0, 0xa4,
++    0x20, 0x3b, 0xfa, 0x07, 0xd5, 0x05, 0x02, 0xe4, 0x57, 0x01, 0xb6, 0x10,
++    0x57, 0x2e, 0xe7, 0x55
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_additionalinput[] = {
++    0x4b, 0x74, 0x0b, 0x40, 0xce, 0x6b, 0xc2, 0x6a, 0x24, 0xb4, 0xf3, 0xad,
++    0x7a, 0xa5, 0x7a, 0xa2, 0x15, 0xe2, 0xc8, 0x61, 0x15, 0xc6, 0xb7, 0x85,
++    0x69, 0x11, 0xad, 0x7b, 0x14, 0xd2, 0xf6, 0x12, 0xa1, 0x95, 0x5d, 0x3f,
++    0xe2, 0xd0, 0x0c, 0x2f
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_entropyinputpr[] = {
++    0x0c, 0x9c, 0xad, 0x05, 0xee, 0xae, 0x48, 0x23, 0x89, 0x59, 0xa1, 0x94,
++    0xd7, 0xd8, 0x75, 0xd5, 0x54, 0x93, 0xc7, 0x4a, 0xd9, 0x26, 0xde, 0xeb,
++    0xba, 0xb0, 0x7e, 0x30, 0x1d, 0x5f, 0x69, 0x40, 0x9c, 0x3b, 0x17, 0x58,
++    0x1d, 0x30, 0xb3, 0x78
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_int_returnedbits[] = {
++    0xf7, 0x93, 0xb0, 0x6d, 0x77, 0x83, 0xd5, 0x38, 0x01, 0xe1, 0x52, 0x40,
++    0x7e, 0x3e, 0x0c, 0x26
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_additionalinput2[] = {
++    0xbc, 0x4b, 0x37, 0x44, 0x1c, 0xc5, 0x45, 0x5f, 0x8f, 0x51, 0x62, 0x8a,
++    0x85, 0x30, 0x1d, 0x7c, 0xe4, 0xcf, 0xf7, 0x44, 0xce, 0x32, 0x3e, 0x57,
++    0x95, 0xa4, 0x2a, 0xdf, 0xfd, 0x9e, 0x38, 0x41, 0xb3, 0xf6, 0xc5, 0xee,
++    0x0c, 0x4b, 0xee, 0x6e
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_entropyinputpr2[] = {
++    0xec, 0xaf, 0xf6, 0x4f, 0xb1, 0xa0, 0x54, 0xb5, 0x5b, 0xe3, 0x46, 0xb0,
++    0x76, 0x5a, 0x7c, 0x3f, 0x7b, 0x94, 0x69, 0x21, 0x51, 0x02, 0xe5, 0x9f,
++    0x04, 0x59, 0x02, 0x98, 0xc6, 0x43, 0x2c, 0xcc, 0x26, 0x4c, 0x87, 0x6b,
++    0x8e, 0x0a, 0x83, 0xdf
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_returnedbits[] = {
++    0x74, 0x45, 0xfb, 0x53, 0x84, 0x96, 0xbe, 0xff, 0x15, 0xcc, 0x41, 0x91,
++    0xb9, 0xa1, 0x21, 0x68
++};
++
++/* AES-192 no df No PR  */
++__fips_constseg static const unsigned char aes_192_no_df_entropyinput[] = {
++    0x3c, 0x7d, 0xb5, 0xe0, 0x54, 0xd9, 0x6e, 0x8c, 0xa9, 0x86, 0xce, 0x4e,
++    0x6b, 0xaf, 0xeb, 0x2f, 0xe7, 0x75, 0xe0, 0x8b, 0xa4, 0x3b, 0x07, 0xfe,
++    0xbe, 0x33, 0x75, 0x93, 0x80, 0x27, 0xb5, 0x29, 0x47, 0x8b, 0xc7, 0x28,
++    0x94, 0xc3, 0x59, 0x63
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_nonce[] = {
++    0x43, 0xf1, 0x7d, 0xb8, 0xc3, 0xfe, 0xd0, 0x23, 0x6b, 0xb4, 0x92, 0xdb,
++    0x29, 0xfd, 0x45, 0x71
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_personalizationstring[] = {
++    0x9f, 0x24, 0x29, 0x99, 0x9e, 0x01, 0xab, 0xe9, 0x19, 0xd8, 0x23, 0x08,
++    0xb7, 0xd6, 0x7e, 0x8c, 0xc0, 0x9e, 0x7f, 0x6e, 0x5b, 0x33, 0x20, 0x96,
++    0x0b, 0x23, 0x2c, 0xa5, 0x6a, 0xf8, 0x1b, 0x04, 0x26, 0xdb, 0x2e, 0x2b,
++    0x3b, 0x88, 0xce, 0x35
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_additionalinput[] = {
++    0x94, 0xe9, 0x7c, 0x3d, 0xa7, 0xdb, 0x60, 0x83, 0x1f, 0x98, 0x3f, 0x0b,
++    0x88, 0x59, 0x57, 0x51, 0x88, 0x9f, 0x76, 0x49, 0x9f, 0xa6, 0xda, 0x71,
++    0x1d, 0x0d, 0x47, 0x16, 0x63, 0xc5, 0x68, 0xe4, 0x5d, 0x39, 0x69, 0xb3,
++    0x3e, 0xbe, 0xd4, 0x8e
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_int_returnedbits[] = {
++    0xf9, 0xd7, 0xad, 0x69, 0xab, 0x8f, 0x23, 0x56, 0x70, 0x17, 0x4f, 0x2a,
++    0x45, 0xe7, 0x4a, 0xc5
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_entropyinputreseed[] = {
++    0xa6, 0x71, 0x6a, 0x3d, 0xba, 0xd1, 0xe8, 0x66, 0xa6, 0xef, 0xb2, 0x0e,
++    0xa8, 0x9c, 0xaa, 0x4e, 0xaf, 0x17, 0x89, 0x50, 0x00, 0xda, 0xa1, 0xb1,
++    0x0b, 0xa4, 0xd9, 0x35, 0x89, 0xc8, 0xe5, 0xb0, 0xd9, 0xb7, 0xc4, 0x33,
++    0x9b, 0xcb, 0x7e, 0x75
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_additionalinputreseed[] = {
++    0x27, 0x21, 0xfc, 0xc2, 0xbd, 0xf3, 0x3c, 0xce, 0xc3, 0xca, 0xc1, 0x01,
++    0xe0, 0xff, 0x93, 0x12, 0x7d, 0x54, 0x42, 0xe3, 0x9f, 0x03, 0xdf, 0x27,
++    0x04, 0x07, 0x3c, 0x53, 0x7f, 0xa8, 0x66, 0xc8, 0x97, 0x4b, 0x61, 0x40,
++    0x5d, 0x7a, 0x25, 0x79
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_additionalinput2[] = {
++    0x2d, 0x8e, 0x16, 0x5d, 0x0b, 0x9f, 0xeb, 0xaa, 0xd6, 0xec, 0x28, 0x71,
++    0x7c, 0x0b, 0xc1, 0x1d, 0xd4, 0x44, 0x19, 0x47, 0xfd, 0x1d, 0x7c, 0xe5,
++    0xf3, 0x27, 0xe1, 0xb6, 0x72, 0x0a, 0xe0, 0xec, 0x0e, 0xcd, 0xef, 0x1a,
++    0x91, 0x6a, 0xe3, 0x5f
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_returnedbits[] = {
++    0xe5, 0xda, 0xb8, 0xe0, 0x63, 0x59, 0x5a, 0xcc, 0x3d, 0xdc, 0x9f, 0xe8,
++    0x66, 0x67, 0x2c, 0x92
++};
++
++/* AES-256 no df PR  */
++__fips_constseg static const unsigned char aes_256_no_df_pr_entropyinput[] = {
++    0x15, 0xc7, 0x5d, 0xcb, 0x41, 0x4b, 0x16, 0x01, 0x3a, 0xd1, 0x44, 0xe8,
++    0x22, 0x32, 0xc6, 0x9c, 0x3f, 0xe7, 0x43, 0xf5, 0x9a, 0xd3, 0xea, 0xf2,
++    0xd7, 0x4e, 0x6e, 0x6a, 0x55, 0x73, 0x40, 0xef, 0x89, 0xad, 0x0d, 0x03,
++    0x96, 0x7e, 0x78, 0x81, 0x2f, 0x91, 0x1b, 0x44, 0xb0, 0x02, 0xba, 0x1c
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_nonce[] = {
++    0xdc, 0xe4, 0xd4, 0x27, 0x7a, 0x90, 0xd7, 0x99, 0x43, 0xa1, 0x3c, 0x30,
++    0xcc, 0x4b, 0xee, 0x2e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_personalizationstring[] = {
++    0xe3, 0xe6, 0xb9, 0x11, 0xe4, 0x7a, 0xa4, 0x40, 0x6b, 0xf8, 0x73, 0xf7,
++    0x7e, 0xec, 0xc7, 0xb9, 0x97, 0xbf, 0xf8, 0x25, 0x7b, 0xbe, 0x11, 0x9b,
++    0x5b, 0x6a, 0x0c, 0x2e, 0x2b, 0x01, 0x51, 0xcd, 0x41, 0x4b, 0x6b, 0xac,
++    0x31, 0xa8, 0x0b, 0xf7, 0xe6, 0x59, 0x42, 0xb8, 0x03, 0x0c, 0xf8, 0x06
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_additionalinput[] = {
++    0x6a, 0x9f, 0x00, 0x91, 0xae, 0xfe, 0xcf, 0x84, 0x99, 0xce, 0xb1, 0x40,
++    0x6d, 0x5d, 0x33, 0x28, 0x84, 0xf4, 0x8c, 0x63, 0x4c, 0x7e, 0xbd, 0x2c,
++    0x80, 0x76, 0xee, 0x5a, 0xaa, 0x15, 0x07, 0x31, 0xd8, 0xbb, 0x8c, 0x69,
++    0x9d, 0x9d, 0xbc, 0x7e, 0x49, 0xae, 0xec, 0x39, 0x6b, 0xd1, 0x1f, 0x7e
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_entropyinputpr[] = {
++    0xf3, 0xb9, 0x75, 0x9c, 0xbd, 0x88, 0xea, 0xa2, 0x50, 0xad, 0xd6, 0x16,
++    0x1a, 0x12, 0x3c, 0x86, 0x68, 0xaf, 0x6f, 0xbe, 0x19, 0xf2, 0xee, 0xcc,
++    0xa5, 0x70, 0x84, 0x53, 0x50, 0xcb, 0x9f, 0x14, 0xa9, 0xe5, 0xee, 0xb9,
++    0x48, 0x45, 0x40, 0xe2, 0xc7, 0xc9, 0x9a, 0x74, 0xff, 0x8c, 0x99, 0x1f
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_int_returnedbits[] = {
++    0x2e, 0xf2, 0x45, 0x4c, 0x62, 0x2e, 0x0a, 0xb9, 0x6b, 0xa2, 0xfd, 0x56,
++    0x79, 0x60, 0x93, 0xcf
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_additionalinput2[] = {
++    0xaf, 0x69, 0x20, 0xe9, 0x3b, 0x37, 0x9d, 0x3f, 0xb4, 0x80, 0x02, 0x7a,
++    0x25, 0x7d, 0xb8, 0xde, 0x71, 0xc5, 0x06, 0x0c, 0xb4, 0xe2, 0x8f, 0x35,
++    0xd8, 0x14, 0x0d, 0x7f, 0x76, 0x63, 0x4e, 0xb5, 0xee, 0xe9, 0x6f, 0x34,
++    0xc7, 0x5f, 0x56, 0x14, 0x4a, 0xe8, 0x73, 0x95, 0x5b, 0x1c, 0xb9, 0xcb
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_entropyinputpr2[] = {
++    0xe5, 0xb0, 0x2e, 0x7e, 0x52, 0x30, 0xe3, 0x63, 0x82, 0xb6, 0x44, 0xd3,
++    0x25, 0x19, 0x05, 0x24, 0x9a, 0x9f, 0x5f, 0x27, 0x6a, 0x29, 0xab, 0xfa,
++    0x07, 0xa2, 0x42, 0x0f, 0xc5, 0xa8, 0x94, 0x7c, 0x17, 0x7b, 0x85, 0x83,
++    0x0c, 0x25, 0x0e, 0x63, 0x0b, 0xe9, 0x12, 0x60, 0xcd, 0xef, 0x80, 0x0f
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_returnedbits[] = {
++    0x5e, 0xf2, 0x26, 0xef, 0x9f, 0x58, 0x5d, 0xd5, 0x4a, 0x10, 0xfe, 0xa7,
++    0x2d, 0x5f, 0x4a, 0x46
++};
++
++/* AES-256 no df No PR  */
++__fips_constseg static const unsigned char aes_256_no_df_entropyinput[] = {
++    0xfb, 0xcf, 0x1b, 0x61, 0x16, 0x89, 0x78, 0x23, 0xf5, 0xd8, 0x96, 0xe3,
++    0x4e, 0x64, 0x0b, 0x29, 0x9a, 0x3f, 0xf8, 0xa5, 0xed, 0xf2, 0xfe, 0xdb,
++    0x16, 0xca, 0x7f, 0x10, 0xfa, 0x5e, 0x18, 0x76, 0x2c, 0x63, 0x5e, 0x96,
++    0xcf, 0xb3, 0xd6, 0xfc, 0xaf, 0x99, 0x39, 0x28, 0x9c, 0x61, 0xe8, 0xb3
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_nonce[] = {
++    0x12, 0x96, 0xf0, 0x52, 0xf3, 0x8d, 0x81, 0xcf, 0xde, 0x86, 0xf2, 0x99,
++    0x43, 0x96, 0xb9, 0xf0
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_personalizationstring[] = {
++    0x63, 0x0d, 0x78, 0xf5, 0x90, 0x8e, 0x32, 0x47, 0xb0, 0x4d, 0x37, 0x60,
++    0x09, 0x96, 0xbc, 0xbf, 0x97, 0x7a, 0x62, 0x14, 0x45, 0xbd, 0x8d, 0xcc,
++    0x69, 0xfb, 0x03, 0xe1, 0x80, 0x1c, 0xc7, 0xe2, 0x2a, 0xf9, 0x37, 0x3f,
++    0x66, 0x4d, 0x62, 0xd9, 0x10, 0xe0, 0xad, 0xc8, 0x9a, 0xf0, 0xa8, 0x6d
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_additionalinput[] = {
++    0x36, 0xc6, 0x13, 0x60, 0xbb, 0x14, 0xad, 0x22, 0xb0, 0x38, 0xac, 0xa6,
++    0x18, 0x16, 0x93, 0x25, 0x86, 0xb7, 0xdc, 0xdc, 0x36, 0x98, 0x2b, 0xf9,
++    0x68, 0x33, 0xd3, 0xc6, 0xff, 0xce, 0x8d, 0x15, 0x59, 0x82, 0x76, 0xed,
++    0x6f, 0x8d, 0x49, 0x74, 0x2f, 0xda, 0xdc, 0x1f, 0x17, 0xd0, 0xde, 0x17
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_int_returnedbits[] = {
++    0x16, 0x2f, 0x8e, 0x3f, 0x21, 0x7a, 0x1c, 0x20, 0x56, 0xd1, 0x92, 0xf6,
++    0xd2, 0x25, 0x75, 0x0e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_entropyinputreseed[] = {
++    0x91, 0x79, 0x76, 0xee, 0xe0, 0xcf, 0x9e, 0xc2, 0xd5, 0xd4, 0x23, 0x9b,
++    0x12, 0x8c, 0x7e, 0x0a, 0xb7, 0xd2, 0x8b, 0xd6, 0x7c, 0xa3, 0xc6, 0xe5,
++    0x0e, 0xaa, 0xc7, 0x6b, 0xae, 0x0d, 0xfa, 0x53, 0x06, 0x79, 0xa1, 0xed,
++    0x4d, 0x6a, 0x0e, 0xd8, 0x9d, 0xbe, 0x1b, 0x31, 0x93, 0x7b, 0xec, 0xfb
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_additionalinputreseed[] = {
++    0xd2, 0x46, 0x50, 0x22, 0x10, 0x14, 0x63, 0xf7, 0xea, 0x0f, 0xb9, 0x7e,
++    0x0d, 0xe1, 0x94, 0x07, 0xaf, 0x09, 0x44, 0x31, 0xea, 0x64, 0xa4, 0x18,
++    0x5b, 0xf9, 0xd8, 0xc2, 0xfa, 0x03, 0x47, 0xc5, 0x39, 0x43, 0xd5, 0x3b,
++    0x62, 0x86, 0x64, 0xea, 0x2c, 0x73, 0x8c, 0xae, 0x9d, 0x98, 0x98, 0x29
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_additionalinput2[] = {
++    0x8c, 0xab, 0x18, 0xf8, 0xc3, 0xec, 0x18, 0x5c, 0xb3, 0x1e, 0x9d, 0xbe,
++    0x3f, 0x03, 0xb4, 0x00, 0x98, 0x9d, 0xae, 0xeb, 0xf4, 0x94, 0xf8, 0x42,
++    0x8f, 0xe3, 0x39, 0x07, 0xe1, 0xc9, 0xad, 0x0b, 0x1f, 0xed, 0xc0, 0xba,
++    0xf6, 0xd1, 0xec, 0x27, 0x86, 0x7b, 0xd6, 0x55, 0x9b, 0x60, 0xa5, 0xc6
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_returnedbits[] = {
++    0xef, 0xd2, 0xd8, 0x5c, 0xdc, 0x62, 0x25, 0x9f, 0xaa, 0x1e, 0x2c, 0x67,
++    0xf6, 0x02, 0x32, 0xe2
++};
++
++/* SHA-1 PR  */
++__fips_constseg static const unsigned char sha1_pr_entropyinput[] = {
++    0xd2, 0x36, 0xa5, 0x27, 0x31, 0x73, 0xdd, 0x11, 0x4f, 0x93, 0xbd, 0xe2,
++    0x31, 0xa5, 0x91, 0x13
++};
++
++__fips_constseg static const unsigned char sha1_pr_nonce[] = {
++    0xb5, 0xb3, 0x60, 0xef, 0xf7, 0x63, 0x31, 0xf3
++};
++
++__fips_constseg static const unsigned char sha1_pr_personalizationstring[] = {
++    0xd4, 0xbb, 0x02, 0x10, 0xb2, 0x71, 0xdb, 0x81, 0xd6, 0xf0, 0x42, 0x60,
++    0xda, 0xea, 0x77, 0x52
++};
++
++__fips_constseg static const unsigned char sha1_pr_additionalinput[] = {
++    0x4d, 0xd2, 0x6c, 0x87, 0xfb, 0x2c, 0x4f, 0xa6, 0x8d, 0x16, 0x63, 0x22,
++    0x6a, 0x51, 0xe3, 0xf8
++};
++
++__fips_constseg static const unsigned char sha1_pr_entropyinputpr[] = {
++    0xc9, 0x83, 0x9e, 0x16, 0xf6, 0x1c, 0x0f, 0xb2, 0xec, 0x60, 0x31, 0xa9,
++    0xcb, 0xa9, 0x36, 0x7a
++};
++
++__fips_constseg static const unsigned char sha1_pr_int_returnedbits[] = {
++    0xa8, 0x13, 0x4f, 0xf4, 0x31, 0x02, 0x44, 0xe3, 0xd3, 0x3d, 0x61, 0x9e,
++    0xe5, 0xc6, 0x3e, 0x89, 0xb5, 0x9b, 0x0f, 0x35
++};
++
++__fips_constseg static const unsigned char sha1_pr_additionalinput2[] = {
++    0xf9, 0xe8, 0xd2, 0x72, 0x13, 0x34, 0x95, 0x6f, 0x15, 0x49, 0x47, 0x99,
++    0x16, 0x03, 0x19, 0x47
++};
++
++__fips_constseg static const unsigned char sha1_pr_entropyinputpr2[] = {
++    0x4e, 0x8c, 0x49, 0x9b, 0x4a, 0x5c, 0x9b, 0x9c, 0x3a, 0xee, 0xfb, 0xd2,
++    0xae, 0xcd, 0x8c, 0xc4
++};
++
++__fips_constseg static const unsigned char sha1_pr_returnedbits[] = {
++    0x50, 0xb4, 0xb4, 0xcd, 0x68, 0x57, 0xfc, 0x2e, 0xc1, 0x52, 0xcc, 0xf6,
++    0x68, 0xa4, 0x81, 0xed, 0x7e, 0xe4, 0x1d, 0x87
++};
++
++/* SHA-1 No PR  */
++__fips_constseg static const unsigned char sha1_entropyinput[] = {
++    0xa9, 0x47, 0x1b, 0x29, 0x2d, 0x1c, 0x05, 0xdf, 0x76, 0xd0, 0x62, 0xf9,
++    0xe2, 0x7f, 0x4c, 0x7b
++};
++
++__fips_constseg static const unsigned char sha1_nonce[] = {
++    0x53, 0x23, 0x24, 0xe3, 0xec, 0x0c, 0x54, 0x14
++};
++
++__fips_constseg static const unsigned char sha1_personalizationstring[] = {
++    0x7a, 0x87, 0xa1, 0xac, 0x1c, 0xfd, 0xab, 0xae, 0xf7, 0xd6, 0xfb, 0x76,
++    0x28, 0xec, 0x6d, 0xca
++};
++
++__fips_constseg static const unsigned char sha1_additionalinput[] = {
++    0xfc, 0x92, 0x35, 0xd6, 0x7e, 0xb7, 0x24, 0x65, 0xfd, 0x12, 0x27, 0x35,
++    0xc0, 0x72, 0xca, 0x28
++};
++
++__fips_constseg static const unsigned char sha1_int_returnedbits[] = {
++    0x57, 0x88, 0x82, 0xe5, 0x25, 0xa5, 0x2c, 0x4a, 0x06, 0x20, 0x6c, 0x72,
++    0x55, 0x61, 0xdd, 0x90, 0x71, 0x9f, 0x95, 0xea
++};
++
++__fips_constseg static const unsigned char sha1_entropyinputreseed[] = {
++    0x69, 0xa5, 0x40, 0x62, 0x98, 0x47, 0x56, 0x73, 0x4a, 0x8f, 0x60, 0x96,
++    0xd6, 0x99, 0x27, 0xed
++};
++
++__fips_constseg static const unsigned char sha1_additionalinputreseed[] = {
++    0xe5, 0x40, 0x4e, 0xbd, 0x50, 0x00, 0xf5, 0x15, 0xa6, 0xee, 0x45, 0xda,
++    0x84, 0x3d, 0xd4, 0xc0
++};
++
++__fips_constseg static const unsigned char sha1_additionalinput2[] = {
++    0x11, 0x51, 0x14, 0xf0, 0x09, 0x1b, 0x4e, 0x56, 0x0d, 0xe9, 0xf6, 0x1e,
++    0x52, 0x65, 0xcd, 0x96
++};
++
++__fips_constseg static const unsigned char sha1_returnedbits[] = {
++    0xa1, 0x9c, 0x94, 0x6e, 0x29, 0xe1, 0x33, 0x0d, 0x32, 0xd6, 0xaa, 0xce,
++    0x71, 0x3f, 0x52, 0x72, 0x8b, 0x42, 0xa8, 0xd7
++};
++
++/* SHA-224 PR  */
++__fips_constseg static const unsigned char sha224_pr_entropyinput[] = {
++    0x12, 0x69, 0x32, 0x4f, 0x83, 0xa6, 0xf5, 0x14, 0xe3, 0x49, 0x3e, 0x75,
++    0x3e, 0xde, 0xad, 0xa1, 0x29, 0xc3, 0xf3, 0x19, 0x20, 0xb5, 0x4c, 0xd9
++};
++
++__fips_constseg static const unsigned char sha224_pr_nonce[] = {
++    0x6a, 0x78, 0xd0, 0xeb, 0xbb, 0x5a, 0xf0, 0xee, 0xe8, 0xc3, 0xba, 0x71
++};
++
++__fips_constseg static const unsigned char sha224_pr_personalizationstring[] = {
++    0xd5, 0xb8, 0xb6, 0xbc, 0xc1, 0x5b, 0x60, 0x31, 0x3c, 0xf5, 0xe5, 0xc0,
++    0x8e, 0x52, 0x7a, 0xbd, 0xea, 0x47, 0xa9, 0x5f, 0x8f, 0xf9, 0x8b, 0xae
++};
++
++__fips_constseg static const unsigned char sha224_pr_additionalinput[] = {
++    0x1f, 0x55, 0xec, 0xae, 0x16, 0x12, 0x84, 0xba, 0x84, 0x16, 0x19, 0x88,
++    0x8e, 0xb8, 0x33, 0x25, 0x54, 0xff, 0xca, 0x79, 0xaf, 0x07, 0x25, 0x50
++};
++
++__fips_constseg static const unsigned char sha224_pr_entropyinputpr[] = {
++    0x92, 0xa3, 0x32, 0xa8, 0x9a, 0x0a, 0x58, 0x7c, 0x1d, 0x5a, 0x7e, 0xe1,
++    0xb2, 0x73, 0xab, 0x0e, 0x16, 0x79, 0x23, 0xd3, 0x29, 0x89, 0x81, 0xe1
++};
++
++__fips_constseg static const unsigned char sha224_pr_int_returnedbits[] = {
++    0xf3, 0x38, 0x91, 0x40, 0x37, 0x7a, 0x51, 0x72, 0x42, 0x74, 0x78, 0x0a,
++    0x69, 0xfd, 0xa6, 0x44, 0x43, 0x45, 0x6c, 0x0c, 0x5a, 0x19, 0xff, 0xf1,
++    0x54, 0x60, 0xee, 0x6a
++};
++
++__fips_constseg static const unsigned char sha224_pr_additionalinput2[] = {
++    0x75, 0xf3, 0x04, 0x25, 0xdd, 0x36, 0xa8, 0x37, 0x46, 0xae, 0x0c, 0x52,
++    0x05, 0x79, 0x4c, 0x26, 0xdb, 0xe9, 0x71, 0x16, 0x4c, 0x0a, 0xf2, 0x60
++};
++
++__fips_constseg static const unsigned char sha224_pr_entropyinputpr2[] = {
++    0xea, 0xc5, 0x03, 0x0a, 0x4f, 0xb0, 0x38, 0x8d, 0x23, 0xd4, 0xc8, 0x77,
++    0xe2, 0x6d, 0x9c, 0x0b, 0x44, 0xf7, 0x2d, 0x5b, 0xbf, 0x5d, 0x2a, 0x11
++};
++
++__fips_constseg static const unsigned char sha224_pr_returnedbits[] = {
++    0x60, 0x50, 0x2b, 0xe7, 0x86, 0xd8, 0x26, 0x73, 0xe3, 0x1d, 0x95, 0x20,
++    0xb3, 0x2c, 0x32, 0x1c, 0xf5, 0xce, 0x57, 0xa6, 0x67, 0x2b, 0xdc, 0x4e,
++    0xdd, 0x11, 0x4c, 0xc4
++};
++
++/* SHA-224 No PR  */
++__fips_constseg static const unsigned char sha224_entropyinput[] = {
++    0xb2, 0x1c, 0x77, 0x4d, 0xf6, 0xd3, 0xb6, 0x40, 0xb7, 0x30, 0x3e, 0x29,
++    0xb0, 0x85, 0x1c, 0xbe, 0x4a, 0xea, 0x6b, 0x5a, 0xb5, 0x8a, 0x97, 0xeb
++};
++
++__fips_constseg static const unsigned char sha224_nonce[] = {
++    0x42, 0x02, 0x0a, 0x1c, 0x98, 0x9a, 0x77, 0x9e, 0x9f, 0x80, 0xba, 0xe0
++};
++
++__fips_constseg static const unsigned char sha224_personalizationstring[] = {
++    0x98, 0xb8, 0x04, 0x41, 0xfc, 0xc1, 0x5d, 0xc5, 0xe9, 0xb9, 0x08, 0xda,
++    0xf9, 0xfa, 0x0d, 0x90, 0xce, 0xdf, 0x1d, 0x10, 0xa9, 0x8d, 0x50, 0x0c
++};
++
++__fips_constseg static const unsigned char sha224_additionalinput[] = {
++    0x9a, 0x8d, 0x39, 0x49, 0x42, 0xd5, 0x0b, 0xae, 0xe1, 0xaf, 0xb7, 0x00,
++    0x02, 0xfa, 0x96, 0xb1, 0xa5, 0x1d, 0x2d, 0x25, 0x78, 0xee, 0x83, 0x3f
++};
++
++__fips_constseg static const unsigned char sha224_int_returnedbits[] = {
++    0xe4, 0xf5, 0x53, 0x79, 0x5a, 0x97, 0x58, 0x06, 0x08, 0xba, 0x7b, 0xfa,
++    0xf0, 0x83, 0x05, 0x8c, 0x22, 0xc0, 0xc9, 0xdb, 0x15, 0xe7, 0xde, 0x20,
++    0x55, 0x22, 0x9a, 0xad
++};
++
++__fips_constseg static const unsigned char sha224_entropyinputreseed[] = {
++    0x67, 0x09, 0x48, 0xaa, 0x07, 0x16, 0x99, 0x89, 0x7f, 0x6d, 0xa0, 0xe5,
++    0x8f, 0xdf, 0xbc, 0xdb, 0xfe, 0xe5, 0x6c, 0x7a, 0x95, 0x4a, 0x66, 0x17
++};
++
++__fips_constseg static const unsigned char sha224_additionalinputreseed[] = {
++    0x0f, 0x4b, 0x1c, 0x6f, 0xb7, 0xe3, 0x47, 0xe5, 0x5d, 0x7d, 0x38, 0xd6,
++    0x28, 0x9b, 0xeb, 0x55, 0x63, 0x09, 0x3e, 0x7c, 0x56, 0xea, 0xf8, 0x19
++};
++
++__fips_constseg static const unsigned char sha224_additionalinput2[] = {
++    0x2d, 0x26, 0x7c, 0x37, 0xe4, 0x7a, 0x28, 0x5e, 0x5a, 0x3c, 0xaf, 0x3d,
++    0x5a, 0x8e, 0x55, 0xa2, 0x1a, 0x6e, 0xc0, 0xe5, 0xf6, 0x21, 0xd3, 0xf6
++};
++
++__fips_constseg static const unsigned char sha224_returnedbits[] = {
++    0x4d, 0x83, 0x35, 0xdf, 0x67, 0xa9, 0xfc, 0x17, 0xda, 0x70, 0xcc, 0x8b,
++    0x7f, 0x77, 0xae, 0xa2, 0x5f, 0xb9, 0x7e, 0x74, 0x4c, 0x26, 0xc1, 0x7a,
++    0x3b, 0xa7, 0x5c, 0x93
++};
++
++/* SHA-256 PR  */
++__fips_constseg static const unsigned char sha256_pr_entropyinput[] = {
++    0xce, 0x49, 0x00, 0x7a, 0x56, 0xe3, 0x67, 0x8f, 0xe1, 0xb6, 0xa7, 0xd4,
++    0x4f, 0x08, 0x7a, 0x1b, 0x01, 0xf4, 0xfa, 0x6b, 0xef, 0xb7, 0xe5, 0xeb,
++    0x07, 0x3d, 0x11, 0x0d, 0xc8, 0xea, 0x2b, 0xfe
++};
++
++__fips_constseg static const unsigned char sha256_pr_nonce[] = {
++    0x73, 0x41, 0xc8, 0x92, 0x94, 0xe2, 0xc5, 0x5f, 0x93, 0xfd, 0x39, 0x5d,
++    0x2b, 0x91, 0x4d, 0x38
++};
++
++__fips_constseg static const unsigned char sha256_pr_personalizationstring[] = {
++    0x50, 0x6d, 0x01, 0x01, 0x07, 0x5a, 0x80, 0x35, 0x7a, 0x56, 0x1a, 0x56,
++    0x2f, 0x9a, 0x0b, 0x35, 0xb2, 0xb1, 0xc9, 0xe5, 0xca, 0x69, 0x61, 0x48,
++    0xff, 0xfb, 0x0f, 0xd9, 0x4b, 0x79, 0x1d, 0xba
++};
++
++__fips_constseg static const unsigned char sha256_pr_additionalinput[] = {
++    0x20, 0xb8, 0xdf, 0x44, 0x77, 0x5a, 0xb8, 0xd3, 0xbf, 0xf6, 0xcf, 0xac,
++    0x5e, 0xa6, 0x96, 0x62, 0x73, 0x44, 0x40, 0x4a, 0x30, 0xfb, 0x38, 0xa5,
++    0x7b, 0x0d, 0xe4, 0x0d, 0xc6, 0xe4, 0x9a, 0x1f
++};
++
++__fips_constseg static const unsigned char sha256_pr_entropyinputpr[] = {
++    0x04, 0xc4, 0x65, 0xf4, 0xd3, 0xbf, 0x83, 0x4b, 0xab, 0xc8, 0x41, 0xa8,
++    0xc2, 0xe0, 0x44, 0x63, 0x77, 0x4c, 0x6f, 0x6c, 0x49, 0x46, 0xff, 0x94,
++    0x17, 0xea, 0xe6, 0x1a, 0x9d, 0x5e, 0x66, 0x78
++};
++
++__fips_constseg static const unsigned char sha256_pr_int_returnedbits[] = {
++    0x07, 0x4d, 0xac, 0x9b, 0x86, 0xca, 0x4a, 0xaa, 0x6e, 0x7a, 0x03, 0xa2,
++    0x5d, 0x10, 0xea, 0x0b, 0xf9, 0x83, 0xcc, 0xd1, 0xfc, 0xe2, 0x07, 0xc7,
++    0x06, 0x34, 0x60, 0x6f, 0x83, 0x94, 0x99, 0x76
++};
++
++__fips_constseg static const unsigned char sha256_pr_additionalinput2[] = {
++    0x89, 0x4e, 0x45, 0x8c, 0x11, 0xf9, 0xbc, 0x5b, 0xac, 0x74, 0x8b, 0x4b,
++    0x5f, 0xf7, 0x19, 0xf3, 0xf5, 0x24, 0x54, 0x14, 0xd1, 0x15, 0xb1, 0x43,
++    0x12, 0xa4, 0x5f, 0xd4, 0xec, 0xfc, 0xcd, 0x09
++};
++
++__fips_constseg static const unsigned char sha256_pr_entropyinputpr2[] = {
++    0x0e, 0xeb, 0x1f, 0xd7, 0xfc, 0xd1, 0x9d, 0xd4, 0x05, 0x36, 0x8b, 0xb2,
++    0xfb, 0xe4, 0xf4, 0x51, 0x0c, 0x87, 0x9b, 0x02, 0x44, 0xd5, 0x92, 0x4d,
++    0x44, 0xfe, 0x1a, 0x03, 0x43, 0x56, 0xbd, 0x86
++};
++
++__fips_constseg static const unsigned char sha256_pr_returnedbits[] = {
++    0x02, 0xaa, 0xb6, 0x1d, 0x7e, 0x2a, 0x40, 0x03, 0x69, 0x2d, 0x49, 0xa3,
++    0x41, 0xe7, 0x44, 0x0b, 0xaf, 0x7b, 0x85, 0xe4, 0x5f, 0x53, 0x3b, 0x64,
++    0xbc, 0x89, 0xc8, 0x82, 0xd4, 0x78, 0x37, 0xa2
++};
++
++/* SHA-256 No PR  */
++__fips_constseg static const unsigned char sha256_entropyinput[] = {
++    0x5b, 0x1b, 0xec, 0x4d, 0xa9, 0x38, 0x74, 0x5a, 0x34, 0x0b, 0x7b, 0xc5,
++    0xe5, 0xd7, 0x66, 0x7c, 0xbc, 0x82, 0xb9, 0x0e, 0x2d, 0x1f, 0x92, 0xd7,
++    0xc1, 0xbc, 0x67, 0x69, 0xec, 0x6b, 0x03, 0x3c
++};
++
++__fips_constseg static const unsigned char sha256_nonce[] = {
++    0xa4, 0x0c, 0xd8, 0x9c, 0x61, 0xd8, 0xc3, 0x54, 0xfe, 0x53, 0xc9, 0xe5,
++    0x5d, 0x6f, 0x6d, 0x35
++};
++
++__fips_constseg static const unsigned char sha256_personalizationstring[] = {
++    0x22, 0x5e, 0x62, 0x93, 0x42, 0x83, 0x78, 0x24, 0xd8, 0x40, 0x8c, 0xde,
++    0x6f, 0xf9, 0xa4, 0x7a, 0xc5, 0xa7, 0x3b, 0x88, 0xa3, 0xee, 0x42, 0x20,
++    0xfd, 0x61, 0x56, 0xc6, 0x4c, 0x13, 0x41, 0x9c
++};
++
++__fips_constseg static const unsigned char sha256_additionalinput[] = {
++    0xbf, 0x74, 0x5b, 0xf6, 0xc5, 0x64, 0x5e, 0x99, 0x34, 0x8f, 0xbc, 0xa4,
++    0xe2, 0xbd, 0xd8, 0x85, 0x26, 0x37, 0xea, 0xba, 0x4f, 0xf2, 0x9a, 0x9a,
++    0x66, 0xfc, 0xdf, 0x63, 0x26, 0x26, 0x19, 0x87
++};
++
++__fips_constseg static const unsigned char sha256_int_returnedbits[] = {
++    0xb3, 0xc6, 0x07, 0x07, 0xd6, 0x75, 0xf6, 0x2b, 0xd6, 0x21, 0x96, 0xf1,
++    0xae, 0xdb, 0x2b, 0xac, 0x25, 0x2a, 0xae, 0xae, 0x41, 0x72, 0x03, 0x5e,
++    0xbf, 0xd3, 0x64, 0xbc, 0x59, 0xf9, 0xc0, 0x76
++};
++
++__fips_constseg static const unsigned char sha256_entropyinputreseed[] = {
++    0xbf, 0x20, 0x33, 0x56, 0x29, 0xa8, 0x37, 0x04, 0x1f, 0x78, 0x34, 0x3d,
++    0x81, 0x2a, 0xc9, 0x86, 0xc6, 0x7a, 0x2f, 0x88, 0x5e, 0xd5, 0xbe, 0x34,
++    0x46, 0x20, 0xa4, 0x35, 0xeb, 0xc7, 0xe2, 0x9d
++};
++
++__fips_constseg static const unsigned char sha256_additionalinputreseed[] = {
++    0x9b, 0xae, 0x2d, 0x2d, 0x61, 0xa4, 0x89, 0xeb, 0x43, 0x46, 0xa7, 0xda,
++    0xef, 0x40, 0xca, 0x4a, 0x99, 0x11, 0x41, 0xdc, 0x5c, 0x94, 0xe9, 0xac,
++    0xd4, 0xd0, 0xe6, 0xbd, 0xfb, 0x03, 0x9c, 0xa8
++};
++
++__fips_constseg static const unsigned char sha256_additionalinput2[] = {
++    0x23, 0xaa, 0x0c, 0xbd, 0x28, 0x33, 0xe2, 0x51, 0xfc, 0x71, 0xd2, 0x15,
++    0x1f, 0x76, 0xfd, 0x0d, 0xe0, 0xb7, 0xb5, 0x84, 0x75, 0x5b, 0xbe, 0xf3,
++    0x5c, 0xca, 0xc5, 0x30, 0xf2, 0x75, 0x1f, 0xda
++};
++
++__fips_constseg static const unsigned char sha256_returnedbits[] = {
++    0x90, 0x3c, 0xc1, 0x10, 0x8c, 0x12, 0x01, 0xc6, 0xa6, 0x3a, 0x0f, 0x4d,
++    0xb6, 0x3a, 0x4f, 0x41, 0x9c, 0x61, 0x75, 0x84, 0xe9, 0x74, 0x75, 0xfd,
++    0xfe, 0xf2, 0x1f, 0x43, 0xd8, 0x5e, 0x24, 0xa3
++};
++
++/* SHA-384 PR  */
++__fips_constseg static const unsigned char sha384_pr_entropyinput[] = {
++    0x71, 0x9d, 0xb2, 0x5a, 0x71, 0x6d, 0x04, 0xe9, 0x1e, 0xc7, 0x92, 0x24,
++    0x6e, 0x12, 0x33, 0xa9, 0x52, 0x64, 0x31, 0xef, 0x71, 0xeb, 0x22, 0x55,
++    0x28, 0x97, 0x06, 0x6a, 0xc0, 0x0c, 0xa0, 0x7e
++};
++
++__fips_constseg static const unsigned char sha384_pr_nonce[] = {
++    0xf5, 0x0d, 0xfa, 0xb0, 0xec, 0x6a, 0x7c, 0xd6, 0xbd, 0x9b, 0x05, 0xfd,
++    0x38, 0x3e, 0x2e, 0x56
++};
++
++__fips_constseg static const unsigned char sha384_pr_personalizationstring[] = {
++    0x74, 0xac, 0x7e, 0x6d, 0xb1, 0xa4, 0xe7, 0x21, 0xd1, 0x1e, 0x6e, 0x96,
++    0x6d, 0x4d, 0x53, 0x46, 0x82, 0x96, 0x6e, 0xcf, 0xaa, 0x81, 0x8d, 0x7d,
++    0x9e, 0xe1, 0x0f, 0x15, 0xea, 0x41, 0xbf, 0xe3
++};
++
++__fips_constseg static const unsigned char sha384_pr_additionalinput[] = {
++    0xda, 0x95, 0xd4, 0xd0, 0xb8, 0x11, 0xd3, 0x49, 0x27, 0x5d, 0xa9, 0x39,
++    0x68, 0xf3, 0xa8, 0xe9, 0x5d, 0x19, 0x8a, 0x2b, 0x66, 0xe8, 0x69, 0x06,
++    0x7c, 0x9e, 0x03, 0xa1, 0x8b, 0x26, 0x2d, 0x6e
++};
++
++__fips_constseg static const unsigned char sha384_pr_entropyinputpr[] = {
++    0x49, 0xdf, 0x44, 0x00, 0xe4, 0x1c, 0x75, 0x0b, 0x26, 0x5a, 0x59, 0x64,
++    0x1f, 0x4e, 0xb1, 0xb2, 0x13, 0xf1, 0x22, 0x4e, 0xb4, 0x6d, 0x9a, 0xcc,
++    0xa0, 0x48, 0xe6, 0xcf, 0x1d, 0xd1, 0x92, 0x0d
++};
++
++__fips_constseg static const unsigned char sha384_pr_int_returnedbits[] = {
++    0xc8, 0x52, 0xae, 0xbf, 0x04, 0x3c, 0x27, 0xb7, 0x78, 0x18, 0xaa, 0x8f,
++    0xff, 0xcf, 0xa4, 0xf1, 0xcc, 0xe7, 0x68, 0xfa, 0x22, 0xa2, 0x13, 0x45,
++    0xe8, 0xdd, 0x87, 0xe6, 0xf2, 0x6e, 0xdd, 0xc7, 0x52, 0x90, 0x9f, 0x7b,
++    0xfa, 0x61, 0x2d, 0x9d, 0x9e, 0xcf, 0x98, 0xac, 0x52, 0x40, 0xce, 0xaf
++};
++
++__fips_constseg static const unsigned char sha384_pr_additionalinput2[] = {
++    0x61, 0x7c, 0x03, 0x9a, 0x3e, 0x50, 0x57, 0x60, 0xc5, 0x83, 0xc9, 0xb2,
++    0xd1, 0x87, 0x85, 0x66, 0x92, 0x5d, 0x84, 0x0e, 0x53, 0xfb, 0x70, 0x03,
++    0x72, 0xfd, 0xba, 0xae, 0x9c, 0x8f, 0xf8, 0x18
++};
++
++__fips_constseg static const unsigned char sha384_pr_entropyinputpr2[] = {
++    0xf8, 0xeb, 0x89, 0xb1, 0x8d, 0x78, 0xbe, 0x21, 0xe0, 0xbb, 0x9d, 0xb7,
++    0x95, 0x0e, 0xd9, 0x46, 0x0c, 0x8c, 0xe2, 0x63, 0xb7, 0x9d, 0x67, 0x90,
++    0xbd, 0xc7, 0x0b, 0xa5, 0xce, 0xb2, 0x65, 0x81
++};
++
++__fips_constseg static const unsigned char sha384_pr_returnedbits[] = {
++    0xe6, 0x9f, 0xfe, 0x68, 0xd6, 0xb5, 0x79, 0xf1, 0x06, 0x5f, 0xa3, 0xbb,
++    0x23, 0x85, 0xd8, 0xf0, 0x29, 0x5a, 0x68, 0x9e, 0xf5, 0xf4, 0xa6, 0x12,
++    0xe0, 0x9a, 0xe2, 0xac, 0x00, 0x1d, 0x98, 0x26, 0xfc, 0x53, 0x95, 0x53,
++    0xe4, 0x3e, 0x17, 0xd5, 0x08, 0x0b, 0x70, 0x3d, 0x67, 0x99, 0xac, 0x66
++};
++
++/* SHA-384 No PR  */
++__fips_constseg static const unsigned char sha384_entropyinput[] = {
++    0x07, 0x15, 0x27, 0x2a, 0xaf, 0x74, 0x24, 0x37, 0xbc, 0xd5, 0x14, 0x69,
++    0xce, 0x11, 0xff, 0xa2, 0x6b, 0xb8, 0x05, 0x67, 0x34, 0xf8, 0xbd, 0x6d,
++    0x6a, 0xcc, 0xcd, 0x60, 0xa3, 0x68, 0xca, 0xf4
++};
++
++__fips_constseg static const unsigned char sha384_nonce[] = {
++    0x70, 0x17, 0xc2, 0x5b, 0x5d, 0x22, 0x0b, 0x06, 0x15, 0x54, 0x78, 0x77,
++    0x44, 0xaf, 0x2f, 0x09
++};
++
++__fips_constseg static const unsigned char sha384_personalizationstring[] = {
++    0x89, 0x39, 0x28, 0xb0, 0x60, 0xeb, 0x3d, 0xdc, 0x55, 0x75, 0x86, 0xeb,
++    0xae, 0xa2, 0x8f, 0xbc, 0x1b, 0x75, 0xd4, 0xe1, 0x0f, 0xaa, 0x38, 0xca,
++    0x62, 0x8b, 0xcb, 0x2c, 0x26, 0xf6, 0xbc, 0xb1
++};
++
++__fips_constseg static const unsigned char sha384_additionalinput[] = {
++    0x30, 0x2b, 0x42, 0x35, 0xef, 0xda, 0x40, 0x55, 0x28, 0xc6, 0x95, 0xfb,
++    0x54, 0x01, 0x62, 0xd7, 0x87, 0x14, 0x48, 0x6d, 0x90, 0x4c, 0xa9, 0x02,
++    0x54, 0x40, 0x22, 0xc8, 0x66, 0xa5, 0x48, 0x48
++};
++
++__fips_constseg static const unsigned char sha384_int_returnedbits[] = {
++    0x82, 0xc4, 0xa1, 0x9c, 0x21, 0xd2, 0xe7, 0xa5, 0xa6, 0xf6, 0x5f, 0x04,
++    0x5c, 0xc7, 0x31, 0x9d, 0x8d, 0x59, 0x74, 0x50, 0x19, 0x89, 0x2f, 0x63,
++    0xd5, 0xb7, 0x7e, 0xeb, 0x15, 0xe3, 0x70, 0x83, 0xa1, 0x24, 0x59, 0xfa,
++    0x2c, 0x56, 0xf6, 0x88, 0x3a, 0x92, 0x93, 0xa1, 0xfb, 0x79, 0xc1, 0x7a
++};
++
++__fips_constseg static const unsigned char sha384_entropyinputreseed[] = {
++    0x39, 0xa6, 0xe8, 0x5c, 0x82, 0x17, 0x71, 0x26, 0x57, 0x4f, 0x9f, 0xc2,
++    0x55, 0xff, 0x5c, 0x9b, 0x53, 0x1a, 0xd1, 0x5f, 0xbc, 0x62, 0xe4, 0x27,
++    0x2d, 0x32, 0xf0, 0xe4, 0x52, 0x8c, 0xc5, 0x0c
++};
++
++__fips_constseg static const unsigned char sha384_additionalinputreseed[] = {
++    0x8d, 0xcb, 0x8d, 0xce, 0x08, 0xea, 0x80, 0xe8, 0x9b, 0x61, 0xa8, 0x0f,
++    0xaf, 0x49, 0x20, 0x9e, 0x74, 0xcb, 0x57, 0x80, 0x42, 0xb0, 0x84, 0x5e,
++    0x30, 0x2a, 0x67, 0x08, 0xf4, 0xe3, 0x40, 0x22
++};
++
++__fips_constseg static const unsigned char sha384_additionalinput2[] = {
++    0x7c, 0x8f, 0xc2, 0xae, 0x22, 0x4a, 0xd6, 0xf6, 0x05, 0xa4, 0x7a, 0xea,
++    0xbb, 0x25, 0xd0, 0xb7, 0x5a, 0xd6, 0xcf, 0x9d, 0xf3, 0x6c, 0xe2, 0xb2,
++    0x4e, 0xb4, 0xbd, 0xf4, 0xe5, 0x40, 0x80, 0x94
++};
++
++__fips_constseg static const unsigned char sha384_returnedbits[] = {
++    0x9e, 0x7e, 0xfb, 0x59, 0xbb, 0xaa, 0x3c, 0xf7, 0xe1, 0xf8, 0x76, 0xdd,
++    0x63, 0x5f, 0xaf, 0x23, 0xd6, 0x64, 0x61, 0xc0, 0x9a, 0x09, 0x47, 0xc9,
++    0x33, 0xdf, 0x6d, 0x55, 0x91, 0x34, 0x79, 0x70, 0xc4, 0x99, 0x6e, 0x54,
++    0x09, 0x64, 0x21, 0x1a, 0xbd, 0x1e, 0x80, 0x40, 0x34, 0xad, 0xfa, 0xd7
++};
++
++/* SHA-512 PR  */
++__fips_constseg static const unsigned char sha512_pr_entropyinput[] = {
++    0x13, 0xf7, 0x61, 0x75, 0x65, 0x28, 0xa2, 0x59, 0x13, 0x5a, 0x4a, 0x4f,
++    0x56, 0x60, 0x8c, 0x53, 0x7d, 0xb0, 0xbd, 0x06, 0x4f, 0xed, 0xcc, 0xd2,
++    0xa2, 0xb5, 0xfd, 0x5b, 0x3a, 0xab, 0xec, 0x28
++};
++
++__fips_constseg static const unsigned char sha512_pr_nonce[] = {
++    0xbe, 0xa3, 0x91, 0x93, 0x1d, 0xc3, 0x31, 0x3a, 0x23, 0x33, 0x50, 0x67,
++    0x88, 0xc7, 0xa2, 0xc4
++};
++
++__fips_constseg static const unsigned char sha512_pr_personalizationstring[] = {
++    0x1f, 0x59, 0x4d, 0x7b, 0xe6, 0x46, 0x91, 0x48, 0xc1, 0x25, 0xfa, 0xff,
++    0x89, 0x12, 0x77, 0x35, 0xdf, 0x3e, 0xf4, 0x80, 0x5f, 0xd9, 0xb0, 0x07,
++    0x22, 0x41, 0xdd, 0x48, 0x78, 0x6b, 0x77, 0x2b
++};
++
++__fips_constseg static const unsigned char sha512_pr_additionalinput[] = {
++    0x30, 0xff, 0x63, 0x6f, 0xac, 0xd9, 0x84, 0x39, 0x6f, 0xe4, 0x99, 0xce,
++    0x91, 0x7d, 0x7e, 0xc8, 0x58, 0xf2, 0x12, 0xc3, 0xb6, 0xad, 0xda, 0x22,
++    0x04, 0xa0, 0xd2, 0x21, 0xfe, 0xf2, 0x95, 0x1d
++};
++
++__fips_constseg static const unsigned char sha512_pr_entropyinputpr[] = {
++    0x64, 0x54, 0x13, 0xec, 0x4f, 0x77, 0xda, 0xb2, 0x92, 0x2e, 0x52, 0x80,
++    0x11, 0x10, 0xc2, 0xf8, 0xe6, 0xa7, 0xcd, 0x4b, 0xfc, 0x32, 0x2e, 0x9e,
++    0xeb, 0xbb, 0xb1, 0xbf, 0x15, 0x5c, 0x73, 0x08
++};
++
++__fips_constseg static const unsigned char sha512_pr_int_returnedbits[] = {
++    0xef, 0x1e, 0xdc, 0x0a, 0xa4, 0x36, 0x91, 0x9c, 0x3d, 0x27, 0x97, 0x50,
++    0x8d, 0x36, 0x29, 0x8d, 0xce, 0x6a, 0x0c, 0xf7, 0x21, 0xc0, 0x91, 0xae,
++    0x0c, 0x96, 0x72, 0xbd, 0x52, 0x81, 0x58, 0xfc, 0x6d, 0xe5, 0xf7, 0xa5,
++    0xfd, 0x5d, 0xa7, 0x58, 0x68, 0xc8, 0x99, 0x58, 0x8e, 0xc8, 0xce, 0x95,
++    0x01, 0x7d, 0xff, 0xa4, 0xc8, 0xf7, 0x63, 0xfe, 0x5f, 0x69, 0x83, 0x53,
++    0xe2, 0xc6, 0x8b, 0xc3
++};
++
++__fips_constseg static const unsigned char sha512_pr_additionalinput2[] = {
++    0xe6, 0x9b, 0xc4, 0x88, 0x34, 0xca, 0xea, 0x29, 0x2f, 0x98, 0x05, 0xa4,
++    0xd3, 0xc0, 0x7b, 0x11, 0xe8, 0xbb, 0x75, 0xf2, 0xbd, 0x29, 0xb7, 0x40,
++    0x25, 0x7f, 0xc1, 0xb7, 0xb1, 0xf1, 0x25, 0x61
++};
++
++__fips_constseg static const unsigned char sha512_pr_entropyinputpr2[] = {
++    0x23, 0x6d, 0xff, 0xde, 0xfb, 0xd1, 0xba, 0x33, 0x18, 0xe6, 0xbe, 0xb5,
++    0x48, 0x77, 0x6d, 0x7f, 0xa7, 0xe1, 0x4d, 0x48, 0x1e, 0x3c, 0xa7, 0x34,
++    0x1a, 0xc8, 0x60, 0xdb, 0x8f, 0x99, 0x15, 0x99
++};
++
++__fips_constseg static const unsigned char sha512_pr_returnedbits[] = {
++    0x70, 0x27, 0x31, 0xdb, 0x92, 0x70, 0x21, 0xfe, 0x16, 0xb6, 0xc8, 0x51,
++    0x34, 0x87, 0x65, 0xd0, 0x4e, 0xfd, 0xfe, 0x68, 0xec, 0xac, 0xdc, 0x93,
++    0x41, 0x38, 0x92, 0x90, 0xb4, 0x94, 0xf9, 0x0d, 0xa4, 0xf7, 0x4e, 0x80,
++    0x92, 0x67, 0x48, 0x40, 0xa7, 0x08, 0xc7, 0xbc, 0x66, 0x00, 0xfd, 0xf7,
++    0x4c, 0x8b, 0x17, 0x6e, 0xd1, 0x8f, 0x9b, 0xf3, 0x6f, 0xf6, 0x34, 0xdd,
++    0x67, 0xf7, 0x68, 0xdd
++};
++
++/* SHA-512 No PR  */
++__fips_constseg static const unsigned char sha512_entropyinput[] = {
++    0xb6, 0x0b, 0xb7, 0xbc, 0x84, 0x56, 0xf6, 0x12, 0xaf, 0x45, 0x67, 0x17,
++    0x7c, 0xd1, 0xb2, 0x78, 0x2b, 0xa0, 0xf2, 0xbe, 0xb6, 0x6d, 0x8b, 0x56,
++    0xc6, 0xbc, 0x4d, 0xe1, 0xf7, 0xbe, 0xce, 0xbd
++};
++
++__fips_constseg static const unsigned char sha512_nonce[] = {
++    0x9d, 0xed, 0xc0, 0xe5, 0x5a, 0x98, 0x6a, 0xcb, 0x51, 0x7d, 0x76, 0x31,
++    0x5a, 0x64, 0xf0, 0xf7
++};
++
++__fips_constseg static const unsigned char sha512_personalizationstring[] = {
++    0xc2, 0x6d, 0xa3, 0xc3, 0x06, 0x74, 0xe5, 0x01, 0x5c, 0x10, 0x17, 0xc7,
++    0xaf, 0x83, 0x9d, 0x59, 0x8d, 0x2d, 0x29, 0x38, 0xc5, 0x59, 0x70, 0x8b,
++    0x46, 0x48, 0x2d, 0xcf, 0x36, 0x7d, 0x59, 0xc0
++};
++
++__fips_constseg static const unsigned char sha512_additionalinput[] = {
++    0xec, 0x8c, 0xd4, 0xf7, 0x61, 0x6e, 0x0d, 0x95, 0x79, 0xb7, 0x28, 0xad,
++    0x5f, 0x69, 0x74, 0x5f, 0x2d, 0x36, 0x06, 0x8a, 0x6b, 0xac, 0x54, 0x97,
++    0xc4, 0xa1, 0x12, 0x85, 0x0a, 0xdf, 0x4b, 0x34
++};
++
++__fips_constseg static const unsigned char sha512_int_returnedbits[] = {
++    0x84, 0x2f, 0x1f, 0x68, 0x6a, 0xa3, 0xad, 0x1e, 0xfb, 0xf4, 0x15, 0xbd,
++    0xde, 0x38, 0xd4, 0x30, 0x80, 0x51, 0xe9, 0xd3, 0xc7, 0x20, 0x88, 0xe9,
++    0xf5, 0xcc, 0xdf, 0x57, 0x5c, 0x47, 0x2f, 0x57, 0x3c, 0x5f, 0x13, 0x56,
++    0xcc, 0xc5, 0x4f, 0x84, 0xf8, 0x10, 0x41, 0xd5, 0x7e, 0x58, 0x6e, 0x19,
++    0x19, 0x9e, 0xaf, 0xc2, 0x22, 0x58, 0x41, 0x50, 0x79, 0xc2, 0xd8, 0x04,
++    0x28, 0xd4, 0x39, 0x9a
++};
++
++__fips_constseg static const unsigned char sha512_entropyinputreseed[] = {
++    0xfa, 0x7f, 0x46, 0x51, 0x83, 0x62, 0x98, 0x16, 0x9a, 0x19, 0xa2, 0x49,
++    0xa9, 0xe6, 0x4a, 0xd8, 0x85, 0xe7, 0xd4, 0x3b, 0x2c, 0x82, 0xc5, 0x82,
++    0xbf, 0x11, 0xf9, 0x9e, 0xbc, 0xd0, 0x01, 0xee
++};
++
++__fips_constseg static const unsigned char sha512_additionalinputreseed[] = {
++    0xb9, 0x12, 0xe0, 0x4f, 0xf7, 0xa7, 0xc4, 0xd8, 0xd0, 0x8e, 0x99, 0x29,
++    0x7c, 0x9a, 0xe9, 0xcf, 0xc4, 0x6c, 0xf8, 0xc3, 0xa7, 0x41, 0x83, 0xd6,
++    0x2e, 0xfa, 0xb8, 0x5e, 0x8e, 0x6b, 0x78, 0x20
++};
++
++__fips_constseg static const unsigned char sha512_additionalinput2[] = {
++    0xd7, 0x07, 0x52, 0xb9, 0x83, 0x2c, 0x03, 0x71, 0xee, 0xc9, 0xc0, 0x85,
++    0xe1, 0x57, 0xb2, 0xcd, 0x3a, 0xf0, 0xc9, 0x34, 0x24, 0x41, 0x1c, 0x42,
++    0x99, 0xb2, 0x84, 0xe9, 0x17, 0xd2, 0x76, 0x92
++};
++
++__fips_constseg static const unsigned char sha512_returnedbits[] = {
++    0x36, 0x17, 0x5d, 0x98, 0x2b, 0x65, 0x25, 0x8e, 0xc8, 0x29, 0xdf, 0x27,
++    0x05, 0x36, 0x26, 0x12, 0x8a, 0x68, 0x74, 0x27, 0x37, 0xd4, 0x7f, 0x32,
++    0xb1, 0x12, 0xd6, 0x85, 0x83, 0xeb, 0x2e, 0xa0, 0xed, 0x4b, 0xb5, 0x7b,
++    0x6f, 0x39, 0x3c, 0x71, 0x77, 0x02, 0x12, 0xcc, 0x2c, 0x3a, 0x8e, 0x63,
++    0xdf, 0x4a, 0xbd, 0x6f, 0x6e, 0x2e, 0xed, 0x0a, 0x85, 0xa5, 0x2f, 0xa2,
++    0x68, 0xde, 0x42, 0xb5
++};
++
++/* HMAC SHA-1 PR  */
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinput[] = {
++    0x26, 0x5f, 0x36, 0x14, 0xff, 0x3d, 0x83, 0xfa, 0x73, 0x5e, 0x75, 0xdc,
++    0x2c, 0x18, 0x17, 0x1b
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_nonce[] = {
++    0xc8, 0xe3, 0x57, 0xa5, 0x7b, 0x74, 0x86, 0x6e
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha1_pr_personalizationstring[] = {
++    0x6e, 0xdb, 0x0d, 0xfe, 0x7d, 0xac, 0x79, 0xd0, 0xa5, 0x3a, 0x48, 0x85,
++    0x80, 0xe2, 0x7f, 0x2a
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_additionalinput[] = {
++    0x31, 0xcd, 0x5e, 0x43, 0xdc, 0xfb, 0x7a, 0x79, 0xca, 0x88, 0xde, 0x1f,
++    0xd7, 0xbb, 0x42, 0x09
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinputpr[] = {
++    0x7c, 0x23, 0x95, 0x38, 0x00, 0x95, 0xc1, 0x78, 0x1f, 0x8f, 0xd7, 0x63,
++    0x23, 0x87, 0x2a, 0xed
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_int_returnedbits[] = {
++    0xbb, 0x34, 0xe7, 0x93, 0xa3, 0x02, 0x2c, 0x4a, 0xd0, 0x89, 0xda, 0x7f,
++    0xed, 0xf4, 0x4c, 0xde, 0x17, 0xec, 0xe5, 0x6c
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_additionalinput2[] = {
++    0x49, 0xbc, 0x2d, 0x2c, 0xb7, 0x32, 0xcb, 0x20, 0xdf, 0xf5, 0x77, 0x58,
++    0xa0, 0x4b, 0x93, 0x6e
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinputpr2[] = {
++    0x3c, 0xaa, 0xb0, 0x21, 0x42, 0xb0, 0xdd, 0x34, 0xf0, 0x16, 0x7f, 0x0c,
++    0x0f, 0xff, 0x2e, 0xaf
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_returnedbits[] = {
++    0x8e, 0xcb, 0xa3, 0x64, 0xb2, 0xb8, 0x33, 0x6c, 0x64, 0x3b, 0x78, 0x16,
++    0x99, 0x35, 0xc8, 0x30, 0xcb, 0x3e, 0xa0, 0xd8
++};
++
++/* HMAC SHA-1 No PR  */
++__fips_constseg static const unsigned char hmac_sha1_entropyinput[] = {
++    0x32, 0x9a, 0x2a, 0x87, 0x7b, 0x89, 0x7c, 0xf6, 0xcb, 0x95, 0xd5, 0x40,
++    0x17, 0xfe, 0x47, 0x70
++};
++
++__fips_constseg static const unsigned char hmac_sha1_nonce[] = {
++    0x16, 0xd8, 0xe0, 0xc7, 0x52, 0xcf, 0x4a, 0x25
++};
++
++__fips_constseg static const unsigned char hmac_sha1_personalizationstring[] = {
++    0x35, 0x35, 0xa9, 0xa5, 0x40, 0xbe, 0x9b, 0xd1, 0x56, 0xdd, 0x44, 0x00,
++    0x72, 0xf7, 0xd3, 0x5e
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinput[] = {
++    0x1b, 0x2c, 0x84, 0x2d, 0x4a, 0x89, 0x8f, 0x69, 0x19, 0xf1, 0xf3, 0xdb,
++    0xbb, 0xe3, 0xaa, 0xea
++};
++
++__fips_constseg static const unsigned char hmac_sha1_int_returnedbits[] = {
++    0xcf, 0xfa, 0x7d, 0x72, 0x0f, 0xe6, 0xc7, 0x96, 0xa0, 0x69, 0x31, 0x11,
++    0x9b, 0x0b, 0x1a, 0x20, 0x1f, 0x3f, 0xaa, 0xd1
++};
++
++__fips_constseg static const unsigned char hmac_sha1_entropyinputreseed[] = {
++    0x90, 0x75, 0x15, 0x04, 0x95, 0xf1, 0xba, 0x81, 0x0c, 0x37, 0x94, 0x6f,
++    0x86, 0x52, 0x6d, 0x9c
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinputreseed[] = {
++    0x5b, 0x40, 0xba, 0x5f, 0x17, 0x70, 0xf0, 0x4b, 0xdf, 0xc9, 0x97, 0x92,
++    0x79, 0xc5, 0x82, 0x28
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinput2[] = {
++    0x97, 0xc8, 0x80, 0x90, 0xb3, 0xaa, 0x6e, 0x60, 0xea, 0x83, 0x7a, 0xe3,
++    0x8a, 0xca, 0xa4, 0x7f
++};
++
++__fips_constseg static const unsigned char hmac_sha1_returnedbits[] = {
++    0x90, 0xbd, 0x05, 0x56, 0x6d, 0xb5, 0x22, 0xd5, 0xb9, 0x5a, 0x29, 0x2d,
++    0xe9, 0x0b, 0xe1, 0xac, 0xde, 0x27, 0x0b, 0xb0
++};
++
++/* HMAC SHA-224 PR  */
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinput[] = {
++    0x17, 0x32, 0x2b, 0x2e, 0x6f, 0x1b, 0x9c, 0x6d, 0x31, 0xe0, 0x34, 0x07,
++    0xcf, 0xed, 0xf6, 0xb6, 0x5a, 0x76, 0x4c, 0xbc, 0x62, 0x85, 0x01, 0x90
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_nonce[] = {
++    0x38, 0xbf, 0x5f, 0x20, 0xb3, 0x68, 0x2f, 0x43, 0x61, 0x05, 0x8f, 0x23
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_pr_personalizationstring[] = {
++    0xc0, 0xc9, 0x45, 0xac, 0x8d, 0x27, 0x77, 0x08, 0x0b, 0x17, 0x6d, 0xed,
++    0xc1, 0x7d, 0xd5, 0x07, 0x9d, 0x6e, 0xf8, 0x23, 0x2a, 0x22, 0x13, 0xbd
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_additionalinput[] = {
++    0xa4, 0x3c, 0xe7, 0x3b, 0xea, 0x19, 0x45, 0x32, 0xc2, 0x83, 0x6d, 0x21,
++    0x8a, 0xc0, 0xee, 0x67, 0x45, 0xde, 0x13, 0x7d, 0x9d, 0x61, 0x00, 0x3b
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinputpr[] = {
++    0x15, 0x05, 0x74, 0x4a, 0x7f, 0x8d, 0x5c, 0x60, 0x16, 0xe5, 0x7b, 0xad,
++    0xf5, 0x41, 0x8f, 0x55, 0x60, 0xc4, 0x09, 0xee, 0x1e, 0x11, 0x81, 0xab
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_int_returnedbits[] = {
++    0x6f, 0xf5, 0x9a, 0xe2, 0x54, 0x53, 0x30, 0x3d, 0x5a, 0x27, 0x29, 0x38,
++    0x27, 0xf2, 0x0d, 0x05, 0xe9, 0x26, 0xcb, 0x16, 0xc3, 0x51, 0x5f, 0x13,
++    0x41, 0xfe, 0x99, 0xf2
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_additionalinput2[] = {
++    0x73, 0x81, 0x88, 0x84, 0x8f, 0xed, 0x6f, 0x10, 0x9f, 0x93, 0xbf, 0x17,
++    0x35, 0x7c, 0xef, 0xd5, 0x8d, 0x26, 0xa6, 0x7a, 0xe8, 0x09, 0x36, 0x4f
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinputpr2[] = {
++    0xe6, 0xcf, 0xcf, 0x7e, 0x12, 0xe5, 0x43, 0xd2, 0x38, 0xd8, 0x24, 0x6f,
++    0x5a, 0x37, 0x68, 0xbf, 0x4f, 0xa0, 0xff, 0xd5, 0x61, 0x8a, 0x93, 0xe0
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_returnedbits[] = {
++    0xaf, 0xf9, 0xd8, 0x19, 0x91, 0x30, 0x82, 0x6f, 0xa9, 0x1e, 0x9d, 0xd7,
++    0xf3, 0x50, 0xe0, 0xc7, 0xd5, 0x64, 0x96, 0x7d, 0x4c, 0x4d, 0x78, 0x03,
++    0x6d, 0xd8, 0x9e, 0x72
++};
++
++/* HMAC SHA-224 No PR  */
++__fips_constseg static const unsigned char hmac_sha224_entropyinput[] = {
++    0x11, 0x82, 0xfd, 0xd9, 0x42, 0xf4, 0xfa, 0xc8, 0xf2, 0x41, 0xe6, 0x54,
++    0x01, 0xae, 0x22, 0x6e, 0xc6, 0xaf, 0xaf, 0xd0, 0xa6, 0xb2, 0xe2, 0x6d
++};
++
++__fips_constseg static const unsigned char hmac_sha224_nonce[] = {
++    0xa9, 0x48, 0xd7, 0x92, 0x39, 0x7e, 0x2a, 0xdc, 0x30, 0x1f, 0x0e, 0x2b
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_personalizationstring[] = {
++    0x11, 0xd5, 0xf4, 0xbd, 0x67, 0x8c, 0x31, 0xcf, 0xa3, 0x3f, 0x1e, 0x6b,
++    0xa8, 0x07, 0x02, 0x0b, 0xc8, 0x2e, 0x6c, 0x64, 0x41, 0x5b, 0xc8, 0x37
++};
++
++__fips_constseg static const unsigned char hmac_sha224_additionalinput[] = {
++    0x68, 0x18, 0xc2, 0x06, 0xeb, 0x3e, 0x04, 0x95, 0x44, 0x5e, 0xfb, 0xe6,
++    0x41, 0xc1, 0x5c, 0xcc, 0x40, 0x2f, 0xb7, 0xd2, 0x0f, 0xf3, 0x6b, 0xe7
++};
++
++__fips_constseg static const unsigned char hmac_sha224_int_returnedbits[] = {
++    0x7f, 0x45, 0xc7, 0x5d, 0x32, 0xe6, 0x17, 0x60, 0xba, 0xdc, 0xb8, 0x42,
++    0x1b, 0x9c, 0xf1, 0xfa, 0x3b, 0x4d, 0x29, 0x54, 0xc6, 0x90, 0xff, 0x5c,
++    0xcd, 0xd6, 0xa9, 0xcc
++};
++
++__fips_constseg static const unsigned char hmac_sha224_entropyinputreseed[] = {
++    0xc4, 0x8e, 0x37, 0x95, 0x69, 0x53, 0x28, 0xd7, 0x37, 0xbb, 0x70, 0x95,
++    0x1c, 0x07, 0x1d, 0xd9, 0xb7, 0xe6, 0x1b, 0xbb, 0xfe, 0x41, 0xeb, 0xc9
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_additionalinputreseed[] = {
++    0x53, 0x17, 0xa1, 0x6a, 0xfa, 0x77, 0x47, 0xb0, 0x95, 0x56, 0x9a, 0x20,
++    0x57, 0xde, 0x5c, 0x89, 0x9f, 0x7f, 0xe2, 0xde, 0x17, 0x3a, 0x50, 0x23
++};
++
++__fips_constseg static const unsigned char hmac_sha224_additionalinput2[] = {
++    0x3a, 0x32, 0xf9, 0x85, 0x0c, 0xc1, 0xed, 0x76, 0x2d, 0xdf, 0x40, 0xc3,
++    0x06, 0x22, 0x66, 0xd4, 0x9a, 0x9a, 0xff, 0x5a, 0x7e, 0x7a, 0xf3, 0x96
++};
++
++__fips_constseg static const unsigned char hmac_sha224_returnedbits[] = {
++    0x43, 0xb4, 0x57, 0x5c, 0x38, 0x25, 0x9d, 0xae, 0xec, 0x96, 0xd1, 0x85,
++    0x3a, 0x84, 0x8d, 0xfe, 0x68, 0xd5, 0x0e, 0x5c, 0x8f, 0x65, 0xa5, 0x4e,
++    0x45, 0x84, 0xa8, 0x94
++};
++
++/* HMAC SHA-256 PR  */
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinput[] = {
++    0x4d, 0xb0, 0x43, 0xd8, 0x34, 0x4b, 0x10, 0x70, 0xb1, 0x8b, 0xed, 0xea,
++    0x07, 0x92, 0x9f, 0x6c, 0x79, 0x31, 0xaf, 0x81, 0x29, 0xeb, 0x6e, 0xca,
++    0x32, 0x48, 0x28, 0xe7, 0x02, 0x5d, 0xa6, 0xa6
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_nonce[] = {
++    0x3a, 0xae, 0x15, 0xa9, 0x99, 0xdc, 0xe4, 0x67, 0x34, 0x3b, 0x70, 0x15,
++    0xaa, 0xd3, 0x30, 0x9a
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_pr_personalizationstring[] = {
++    0x13, 0x1d, 0x24, 0x04, 0xb0, 0x18, 0x81, 0x15, 0x21, 0x51, 0x2a, 0x24,
++    0x52, 0x61, 0xbe, 0x64, 0x82, 0x6b, 0x55, 0x2f, 0xe2, 0xf1, 0x40, 0x7d,
++    0x71, 0xd8, 0x01, 0x86, 0x15, 0xb7, 0x8b, 0xb5
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_additionalinput[] = {
++    0x8f, 0xa6, 0x54, 0x5f, 0xb1, 0xd0, 0xd8, 0xc3, 0xe7, 0x0c, 0x15, 0xa9,
++    0x23, 0x6e, 0xfe, 0xfb, 0x93, 0xf7, 0x3a, 0xbd, 0x59, 0x01, 0xfa, 0x18,
++    0x8e, 0xe9, 0x1a, 0xa9, 0x78, 0xfc, 0x79, 0x0b
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinputpr[] = {
++    0xcf, 0x24, 0xb9, 0xeb, 0xb3, 0xd4, 0xcd, 0x17, 0x37, 0x38, 0x75, 0x79,
++    0x15, 0xcb, 0x2d, 0x75, 0x51, 0xf1, 0xcc, 0xaa, 0x32, 0xa4, 0xa7, 0x36,
++    0x7c, 0x5c, 0xe4, 0x47, 0xf1, 0x3e, 0x1d, 0xe5
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_int_returnedbits[] = {
++    0x52, 0x42, 0xfa, 0xeb, 0x85, 0xe0, 0x30, 0x22, 0x79, 0x00, 0x16, 0xb2,
++    0x88, 0x2f, 0x14, 0x6a, 0xb7, 0xfc, 0xb7, 0x53, 0xdc, 0x4a, 0x12, 0xef,
++    0x54, 0xd6, 0x33, 0xe9, 0x20, 0xd6, 0xfd, 0x56
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_additionalinput2[] = {
++    0xf4, 0xf6, 0x49, 0xa1, 0x2d, 0x64, 0x2b, 0x30, 0x58, 0xf8, 0xbd, 0xb8,
++    0x75, 0xeb, 0xbb, 0x5e, 0x1c, 0x9b, 0x81, 0x6a, 0xda, 0x14, 0x86, 0x6e,
++    0xd0, 0xda, 0x18, 0xb7, 0x88, 0xfb, 0x59, 0xf3
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinputpr2[] = {
++    0x21, 0xcd, 0x6e, 0x46, 0xad, 0x99, 0x07, 0x17, 0xb4, 0x3d, 0x76, 0x0a,
++    0xff, 0x5b, 0x52, 0x50, 0x78, 0xdf, 0x1f, 0x24, 0x06, 0x0d, 0x3f, 0x74,
++    0xa9, 0xc9, 0x37, 0xcf, 0xd8, 0x26, 0x25, 0x91
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_returnedbits[] = {
++    0xa7, 0xaf, 0x2f, 0x29, 0xe0, 0x3a, 0x72, 0x95, 0x96, 0x1c, 0xa9, 0xf0,
++    0x4a, 0x17, 0x4d, 0x66, 0x06, 0x10, 0xbf, 0x39, 0x89, 0x88, 0xb8, 0x91,
++    0x37, 0x18, 0x99, 0xcf, 0x8c, 0x53, 0x3b, 0x7e
++};
++
++/* HMAC SHA-256 No PR  */
++__fips_constseg static const unsigned char hmac_sha256_entropyinput[] = {
++    0x96, 0xb7, 0x53, 0x22, 0x1e, 0x52, 0x2a, 0x96, 0xb1, 0x15, 0x3c, 0x35,
++    0x5a, 0x8b, 0xd3, 0x4a, 0xa6, 0x6c, 0x83, 0x0a, 0x7d, 0xa3, 0x23, 0x3d,
++    0x43, 0xa1, 0x07, 0x2c, 0x2d, 0xe3, 0x81, 0xcc
++};
++
++__fips_constseg static const unsigned char hmac_sha256_nonce[] = {
++    0xf1, 0xac, 0x97, 0xcb, 0x5e, 0x06, 0x48, 0xd2, 0x94, 0xbe, 0x15, 0x2e,
++    0xc7, 0xfc, 0xc2, 0x01
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_personalizationstring[] = {
++    0x98, 0xc5, 0x1e, 0x35, 0x5e, 0x89, 0x0d, 0xce, 0x64, 0x6d, 0x18, 0xa7,
++    0x5a, 0xc6, 0xf3, 0xe7, 0xd6, 0x9e, 0xc0, 0xea, 0xb7, 0x3a, 0x8d, 0x65,
++    0xb8, 0xeb, 0x10, 0xd7, 0x57, 0x18, 0xa0, 0x32
++};
++
++__fips_constseg static const unsigned char hmac_sha256_additionalinput[] = {
++    0x1b, 0x10, 0xaf, 0xac, 0xd0, 0x65, 0x95, 0xad, 0x04, 0xad, 0x03, 0x1c,
++    0xe0, 0x40, 0xd6, 0x3e, 0x1c, 0x46, 0x53, 0x39, 0x7c, 0xe2, 0xbc, 0xda,
++    0x8c, 0xa2, 0x33, 0xa7, 0x9a, 0x26, 0xd3, 0x27
++};
++
++__fips_constseg static const unsigned char hmac_sha256_int_returnedbits[] = {
++    0xba, 0x61, 0x0e, 0x55, 0xfe, 0x11, 0x8a, 0x9e, 0x0f, 0x80, 0xdf, 0x1d,
++    0x03, 0x0a, 0xfe, 0x15, 0x94, 0x28, 0x4b, 0xba, 0xf4, 0x9f, 0x51, 0x25,
++    0x88, 0xe5, 0x4e, 0xfb, 0xaf, 0xce, 0x69, 0x90
++};
++
++__fips_constseg static const unsigned char hmac_sha256_entropyinputreseed[] = {
++    0x62, 0x7f, 0x1e, 0x6b, 0xe8, 0x8e, 0xe1, 0x35, 0x7d, 0x9b, 0x4f, 0xc7,
++    0xec, 0xc8, 0xac, 0xef, 0x6b, 0x13, 0x9e, 0x05, 0x56, 0xc1, 0x08, 0xf9,
++    0x2f, 0x0f, 0x27, 0x9c, 0xd4, 0x15, 0xed, 0x2d
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_additionalinputreseed[] = {
++    0xc7, 0x76, 0x6e, 0xa9, 0xd2, 0xb2, 0x76, 0x40, 0x82, 0x25, 0x2c, 0xb3,
++    0x6f, 0xac, 0xe9, 0x74, 0xef, 0x8f, 0x3c, 0x8e, 0xcd, 0xf1, 0xbf, 0xb3,
++    0x49, 0x77, 0x34, 0x88, 0x52, 0x36, 0xe6, 0x2e
++};
++
++__fips_constseg static const unsigned char hmac_sha256_additionalinput2[] = {
++    0x8d, 0xb8, 0x0c, 0xd1, 0xbf, 0x70, 0xf6, 0x19, 0xc3, 0x41, 0x80, 0x9f,
++    0xe1, 0xa5, 0xa4, 0x1f, 0x2c, 0x26, 0xb1, 0xe5, 0xd8, 0xeb, 0xbe, 0xf8,
++    0xdf, 0x88, 0x6a, 0x89, 0xd6, 0x05, 0xd8, 0x9d
++};
++
++__fips_constseg static const unsigned char hmac_sha256_returnedbits[] = {
++    0x43, 0x12, 0x2a, 0x2c, 0x40, 0x53, 0x2e, 0x7c, 0x66, 0x34, 0xac, 0xc3,
++    0x43, 0xe3, 0xe0, 0x6a, 0xfc, 0xfa, 0xea, 0x87, 0x21, 0x1f, 0xe2, 0x26,
++    0xc4, 0xf9, 0x09, 0x9a, 0x0d, 0x6e, 0x7f, 0xe0
++};
++
++/* HMAC SHA-384 PR  */
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinput[] = {
++    0x69, 0x81, 0x98, 0x88, 0x44, 0xf5, 0xd6, 0x2e, 0x00, 0x08, 0x3b, 0xc5,
++    0xfb, 0xd7, 0x8e, 0x6f, 0x23, 0xf8, 0x6d, 0x09, 0xd6, 0x85, 0x49, 0xd1,
++    0xf8, 0x6d, 0xa4, 0x58, 0x54, 0xfd, 0x88, 0xa9
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_nonce[] = {
++    0x6e, 0x38, 0x81, 0xca, 0xb7, 0xe8, 0x6e, 0x66, 0x49, 0x8a, 0xb2, 0x59,
++    0xee, 0x16, 0xc9, 0xde
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_pr_personalizationstring[] = {
++    0xfe, 0x4c, 0xd9, 0xf4, 0x78, 0x3b, 0x08, 0x41, 0x8d, 0x8f, 0x55, 0xc4,
++    0x43, 0x56, 0xb6, 0x12, 0x36, 0x6b, 0x30, 0xb7, 0x5e, 0xe1, 0xb9, 0x47,
++    0x04, 0xb1, 0x4e, 0xa9, 0x00, 0xa1, 0x52, 0xa1
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_additionalinput[] = {
++    0x89, 0xe9, 0xcc, 0x8f, 0x27, 0x3c, 0x26, 0xd1, 0x95, 0xc8, 0x7d, 0x0f,
++    0x5b, 0x1a, 0xf0, 0x78, 0x39, 0x56, 0x6f, 0xa4, 0x23, 0xe7, 0xd1, 0xda,
++    0x7c, 0x66, 0x33, 0xa0, 0x90, 0xc9, 0x92, 0x88
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinputpr[] = {
++    0xbe, 0x3d, 0x7c, 0x0d, 0xca, 0xda, 0x7c, 0x49, 0xb8, 0x12, 0x36, 0xc0,
++    0xdb, 0xad, 0x35, 0xa8, 0xc7, 0x0b, 0x2a, 0x2c, 0x69, 0x6d, 0x25, 0x56,
++    0x63, 0x82, 0x11, 0x3e, 0xa7, 0x33, 0x70, 0x72
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_int_returnedbits[] = {
++    0x82, 0x3d, 0xe6, 0x54, 0x80, 0x42, 0xf8, 0xba, 0x90, 0x4f, 0x06, 0xa6,
++    0xd2, 0x7f, 0xbf, 0x79, 0x7c, 0x12, 0x7d, 0xa6, 0xa2, 0x66, 0xe8, 0xa6,
++    0xc0, 0xd6, 0x4a, 0x55, 0xbf, 0xd8, 0x0a, 0xc5, 0xf8, 0x03, 0x88, 0xdd,
++    0x8e, 0x87, 0xd1, 0x5a, 0x48, 0x26, 0x72, 0x2a, 0x8e, 0xcf, 0xee, 0xba
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_additionalinput2[] = {
++    0x8f, 0xff, 0xd9, 0x84, 0xbb, 0x85, 0x3a, 0x66, 0xa1, 0x21, 0xce, 0xb2,
++    0x3a, 0x3a, 0x17, 0x22, 0x19, 0xae, 0xc7, 0xb6, 0x63, 0x81, 0xd5, 0xff,
++    0x0d, 0xc8, 0xe1, 0xaf, 0x57, 0xd2, 0xcb, 0x60
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinputpr2[] = {
++    0xd7, 0xfb, 0xc9, 0xe8, 0xe2, 0xf2, 0xaa, 0x4c, 0xb8, 0x51, 0x2f, 0xe1,
++    0x22, 0xba, 0xf3, 0xda, 0x0a, 0x19, 0x76, 0x71, 0x57, 0xb2, 0x1d, 0x94,
++    0x09, 0x69, 0x6c, 0xd3, 0x97, 0x51, 0x81, 0x87
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_returnedbits[] = {
++    0xe6, 0x19, 0x28, 0xa8, 0x21, 0xce, 0x5e, 0xdb, 0x24, 0x79, 0x8c, 0x76,
++    0x5d, 0x73, 0xb2, 0xdf, 0xac, 0xef, 0x85, 0xa7, 0x3b, 0x19, 0x09, 0x8b,
++    0x7f, 0x98, 0x28, 0xa9, 0x93, 0xd8, 0x7a, 0xad, 0x55, 0x8b, 0x24, 0x9d,
++    0xe6, 0x98, 0xfe, 0x47, 0xd5, 0x48, 0xc1, 0x23, 0xd8, 0x1d, 0x62, 0x75
++};
++
++/* HMAC SHA-384 No PR  */
++__fips_constseg static const unsigned char hmac_sha384_entropyinput[] = {
++    0xc3, 0x56, 0x2b, 0x1d, 0xc2, 0xbb, 0xa8, 0xf0, 0xae, 0x1b, 0x0d, 0xd3,
++    0x5a, 0x6c, 0xda, 0x57, 0x8e, 0xa5, 0x8a, 0x0d, 0x6c, 0x4b, 0x18, 0xb1,
++    0x04, 0x3e, 0xb4, 0x99, 0x35, 0xc4, 0xc0, 0x5f
++};
++
++__fips_constseg static const unsigned char hmac_sha384_nonce[] = {
++    0xc5, 0x49, 0x1e, 0x66, 0x27, 0x92, 0xbe, 0xec, 0xb5, 0x1e, 0x4b, 0xb1,
++    0x38, 0xe3, 0xeb, 0x62
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_personalizationstring[] = {
++    0xbe, 0xe7, 0x6b, 0x57, 0xde, 0x88, 0x11, 0x96, 0x9b, 0x6e, 0xea, 0xe5,
++    0x63, 0x83, 0x4c, 0xb6, 0x8d, 0x66, 0xaa, 0x1f, 0x8b, 0x54, 0xe7, 0x62,
++    0x6d, 0x5a, 0xfc, 0xbf, 0x97, 0xba, 0xcd, 0x77
++};
++
++__fips_constseg static const unsigned char hmac_sha384_additionalinput[] = {
++    0xe5, 0x28, 0x5f, 0x43, 0xf5, 0x83, 0x6e, 0x0a, 0x83, 0x5c, 0xe3, 0x81,
++    0x03, 0xf2, 0xf8, 0x78, 0x00, 0x7c, 0x95, 0x87, 0x16, 0xd6, 0x6c, 0x58,
++    0x33, 0x6c, 0x53, 0x35, 0x0d, 0x66, 0xe3, 0xce
++};
++
++__fips_constseg static const unsigned char hmac_sha384_int_returnedbits[] = {
++    0xe2, 0x1f, 0xf3, 0xda, 0x0d, 0x19, 0x99, 0x87, 0xc4, 0x90, 0xa2, 0x31,
++    0xca, 0x2a, 0x89, 0x58, 0x43, 0x44, 0xb8, 0xde, 0xcf, 0xa4, 0xbe, 0x3b,
++    0x53, 0x26, 0x22, 0x31, 0x76, 0x41, 0x22, 0xb5, 0xa8, 0x70, 0x2f, 0x4b,
++    0x64, 0x95, 0x4d, 0x48, 0x96, 0x35, 0xe6, 0xbd, 0x3c, 0x34, 0xdb, 0x1b
++};
++
++__fips_constseg static const unsigned char hmac_sha384_entropyinputreseed[] = {
++    0x77, 0x61, 0xba, 0xbc, 0xf2, 0xc1, 0xf3, 0x4b, 0x86, 0x65, 0xfd, 0x48,
++    0x0e, 0x3c, 0x02, 0x5e, 0xa2, 0x7a, 0x6b, 0x7c, 0xed, 0x21, 0x5e, 0xf9,
++    0xcd, 0xcd, 0x77, 0x07, 0x2b, 0xbe, 0xc5, 0x5c
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_additionalinputreseed[] = {
++    0x18, 0x24, 0x5f, 0xc6, 0x84, 0xd1, 0x67, 0xc3, 0x9a, 0x11, 0xa5, 0x8c,
++    0x07, 0x39, 0x21, 0x83, 0x4d, 0x04, 0xc4, 0x6a, 0x28, 0x19, 0xcf, 0x92,
++    0x21, 0xd9, 0x9e, 0x41, 0x72, 0x6c, 0x9e, 0x63
++};
++
++__fips_constseg static const unsigned char hmac_sha384_additionalinput2[] = {
++    0x96, 0x67, 0x41, 0x28, 0x9b, 0xb7, 0x92, 0x8d, 0x64, 0x3b, 0xe4, 0xcf,
++    0x7e, 0xaa, 0x1e, 0xb1, 0x4b, 0x1d, 0x09, 0x56, 0x67, 0x9c, 0xc6, 0x6d,
++    0x3b, 0xe8, 0x91, 0x9d, 0xe1, 0x8a, 0xb7, 0x32
++};
++
++__fips_constseg static const unsigned char hmac_sha384_returnedbits[] = {
++    0xe3, 0x59, 0x61, 0x38, 0x92, 0xec, 0xe2, 0x3c, 0xff, 0xb7, 0xdb, 0x19,
++    0x0f, 0x5b, 0x93, 0x68, 0x0d, 0xa4, 0x94, 0x40, 0x72, 0x0b, 0xe0, 0xed,
++    0x4d, 0xcd, 0x68, 0xa0, 0x1e, 0xfe, 0x67, 0xb2, 0xfa, 0x21, 0x56, 0x74,
++    0xa4, 0xad, 0xcf, 0xb7, 0x60, 0x66, 0x2e, 0x40, 0xde, 0x82, 0xca, 0xfb
++};
++
++/* HMAC SHA-512 PR  */
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinput[] = {
++    0xaa, 0x9e, 0x45, 0x67, 0x0e, 0x00, 0x2a, 0x67, 0x98, 0xd6, 0xda, 0x0b,
++    0x0f, 0x17, 0x7e, 0xac, 0xfd, 0x27, 0xc4, 0xca, 0x84, 0xdf, 0xde, 0xba,
++    0x85, 0xd9, 0xbe, 0x8f, 0xf3, 0xff, 0x91, 0x4d
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_nonce[] = {
++    0x8c, 0x49, 0x2f, 0x58, 0x1e, 0x7a, 0xda, 0x4b, 0x7e, 0x8a, 0x30, 0x7b,
++    0x86, 0xea, 0xaf, 0xa2
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_pr_personalizationstring[] = {
++    0x71, 0xe1, 0xbb, 0xad, 0xa7, 0x4b, 0x2e, 0x31, 0x3b, 0x0b, 0xec, 0x24,
++    0x99, 0x38, 0xbc, 0xaa, 0x05, 0x4c, 0x46, 0x44, 0xfa, 0xad, 0x8e, 0x02,
++    0xc1, 0x7e, 0xad, 0xec, 0x54, 0xa6, 0xd0, 0xad
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_additionalinput[] = {
++    0x3d, 0x6e, 0xa6, 0xa8, 0x29, 0x2a, 0xb2, 0xf5, 0x98, 0x42, 0xe4, 0x92,
++    0x78, 0x22, 0x67, 0xfd, 0x1b, 0x15, 0x1e, 0x29, 0xaa, 0x71, 0x3c, 0x3c,
++    0xe7, 0x05, 0x20, 0xa9, 0x29, 0xc6, 0x75, 0x71
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinputpr[] = {
++    0xab, 0xb9, 0x16, 0xd8, 0x55, 0x35, 0x54, 0xb7, 0x97, 0x3f, 0x94, 0xbc,
++    0x2f, 0x7c, 0x70, 0xc7, 0xd0, 0xed, 0xb7, 0x4b, 0xf7, 0xf6, 0x6c, 0x03,
++    0x0c, 0xb0, 0x03, 0xd8, 0xbb, 0x71, 0xd9, 0x10
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_int_returnedbits[] = {
++    0x8e, 0xd3, 0xfd, 0x52, 0x9e, 0x83, 0x08, 0x49, 0x18, 0x6e, 0x23, 0x56,
++    0x5c, 0x45, 0x93, 0x34, 0x05, 0xe2, 0x98, 0x8f, 0x0c, 0xd4, 0x32, 0x0c,
++    0xfd, 0xda, 0x5f, 0x92, 0x3a, 0x8c, 0x81, 0xbd, 0xf6, 0x6c, 0x55, 0xfd,
++    0xb8, 0x20, 0xce, 0x8d, 0x97, 0x27, 0xe8, 0xe8, 0xe0, 0xb3, 0x85, 0x50,
++    0xa2, 0xc2, 0xb2, 0x95, 0x1d, 0x48, 0xd3, 0x7b, 0x4b, 0x78, 0x13, 0x35,
++    0x05, 0x17, 0xbe, 0x0d
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_additionalinput2[] = {
++    0xc3, 0xfc, 0x95, 0xaa, 0x69, 0x06, 0xae, 0x59, 0x41, 0xce, 0x26, 0x08,
++    0x29, 0x6d, 0x45, 0xda, 0xe8, 0xb3, 0x6c, 0x95, 0x60, 0x0f, 0x70, 0x2c,
++    0x10, 0xba, 0x38, 0x8c, 0xcf, 0x29, 0x99, 0xaa
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinputpr2[] = {
++    0x3b, 0x9a, 0x25, 0xce, 0xd7, 0xf9, 0x5c, 0xd1, 0x3a, 0x3e, 0xaa, 0x71,
++    0x14, 0x3e, 0x19, 0xe8, 0xce, 0xe6, 0xfe, 0x51, 0x84, 0xe9, 0x1b, 0xfe,
++    0x3f, 0xa7, 0xf2, 0xfd, 0x76, 0x5f, 0x6a, 0xe7
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_returnedbits[] = {
++    0xb7, 0x82, 0xa9, 0x57, 0x81, 0x67, 0x53, 0xb5, 0xa1, 0xe9, 0x3d, 0x35,
++    0xf9, 0xe4, 0x97, 0xbe, 0xa6, 0xca, 0xf1, 0x01, 0x13, 0x09, 0xe7, 0x21,
++    0xc0, 0xed, 0x93, 0x5d, 0x4b, 0xf4, 0xeb, 0x8d, 0x53, 0x25, 0x8a, 0xc4,
++    0xb1, 0x6f, 0x6e, 0x37, 0xcd, 0x2e, 0xac, 0x39, 0xb2, 0xb6, 0x99, 0xa3,
++    0x82, 0x00, 0xb0, 0x21, 0xf0, 0xc7, 0x2f, 0x4c, 0x73, 0x92, 0xfd, 0x00,
++    0xb6, 0xaf, 0xbc, 0xd3
++};
++
++/* HMAC SHA-512 No PR  */
++__fips_constseg static const unsigned char hmac_sha512_entropyinput[] = {
++    0x6e, 0x85, 0xe6, 0x25, 0x96, 0x29, 0xa7, 0x52, 0x5b, 0x60, 0xba, 0xaa,
++    0xde, 0xdb, 0x36, 0x0a, 0x51, 0x9a, 0x15, 0xae, 0x6e, 0x18, 0xd3, 0xfe,
++    0x39, 0xb9, 0x4a, 0x96, 0xf8, 0x77, 0xcb, 0x95
++};
++
++__fips_constseg static const unsigned char hmac_sha512_nonce[] = {
++    0xe0, 0xa6, 0x5d, 0x08, 0xc3, 0x7c, 0xae, 0x25, 0x2e, 0x80, 0xd1, 0x3e,
++    0xd9, 0xaf, 0x43, 0x3c
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_personalizationstring[] = {
++    0x53, 0x99, 0x52, 0x5f, 0x11, 0xa9, 0x64, 0x66, 0x20, 0x5e, 0x1b, 0x5f,
++    0x42, 0xb3, 0xf4, 0xda, 0xed, 0xbb, 0x63, 0xc1, 0x23, 0xaf, 0xd0, 0x01,
++    0x90, 0x3b, 0xd0, 0x78, 0xe4, 0x0b, 0xa7, 0x20
++};
++
++__fips_constseg static const unsigned char hmac_sha512_additionalinput[] = {
++    0x85, 0x90, 0x80, 0xd3, 0x98, 0xf1, 0x53, 0x6d, 0x68, 0x15, 0x8f, 0xe5,
++    0x60, 0x3f, 0x17, 0x29, 0x55, 0x8d, 0x33, 0xb1, 0x45, 0x64, 0x64, 0x8d,
++    0x50, 0x21, 0x89, 0xae, 0xf6, 0xfd, 0x32, 0x73
++};
++
++__fips_constseg static const unsigned char hmac_sha512_int_returnedbits[] = {
++    0x28, 0x56, 0x30, 0x6f, 0xf4, 0xa1, 0x48, 0xe0, 0xc9, 0xf5, 0x75, 0x90,
++    0xcc, 0xfb, 0xdf, 0xdf, 0x71, 0x3d, 0x0a, 0x9a, 0x03, 0x65, 0x3b, 0x18,
++    0x61, 0xe3, 0xd1, 0xda, 0xcc, 0x4a, 0xfe, 0x55, 0x38, 0xf8, 0x21, 0x6b,
++    0xfa, 0x18, 0x01, 0x42, 0x39, 0x2f, 0x99, 0x53, 0x38, 0x15, 0x82, 0x34,
++    0xc5, 0x93, 0x92, 0xbc, 0x4d, 0x75, 0x1a, 0x5f, 0x21, 0x27, 0xcc, 0xa1,
++    0xb1, 0x57, 0x69, 0xe8
++};
++
++__fips_constseg static const unsigned char hmac_sha512_entropyinputreseed[] = {
++    0x8c, 0x52, 0x7e, 0x77, 0x72, 0x3f, 0xa3, 0x04, 0x97, 0x10, 0x9b, 0x41,
++    0xbd, 0xe8, 0xff, 0x89, 0xed, 0x80, 0xe3, 0xbd, 0xaa, 0x12, 0x2d, 0xca,
++    0x75, 0x82, 0x36, 0x77, 0x88, 0xcd, 0xa6, 0x73
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_additionalinputreseed[] = {
++    0x7e, 0x32, 0xe3, 0x69, 0x69, 0x07, 0x34, 0xa2, 0x16, 0xa2, 0x5d, 0x1a,
++    0x10, 0x91, 0xd3, 0xe2, 0x21, 0xa2, 0xa3, 0xdd, 0xcd, 0x0c, 0x09, 0x86,
++    0x11, 0xe1, 0x50, 0xff, 0x5c, 0xb7, 0xeb, 0x5c
++};
++
++__fips_constseg static const unsigned char hmac_sha512_additionalinput2[] = {
++    0x7f, 0x78, 0x66, 0xd8, 0xfb, 0x67, 0xcf, 0x8d, 0x8c, 0x08, 0x30, 0xa5,
++    0xf8, 0x7d, 0xcf, 0x44, 0x59, 0xce, 0xf8, 0xdf, 0x58, 0xd3, 0x60, 0xcb,
++    0xa8, 0x60, 0xb9, 0x07, 0xc4, 0xb1, 0x95, 0x48
++};
++
++__fips_constseg static const unsigned char hmac_sha512_returnedbits[] = {
++    0xdf, 0xa7, 0x36, 0xd4, 0xdc, 0x5d, 0x4d, 0x31, 0xad, 0x69, 0x46, 0x9f,
++    0xf1, 0x7c, 0xd7, 0x3b, 0x4f, 0x55, 0xf2, 0xd7, 0xb9, 0x9d, 0xad, 0x7a,
++    0x79, 0x08, 0x59, 0xa5, 0xdc, 0x74, 0xf5, 0x9b, 0x73, 0xd2, 0x13, 0x25,
++    0x0b, 0x81, 0x08, 0x08, 0x25, 0xfb, 0x39, 0xf2, 0xf0, 0xa3, 0xa4, 0x8d,
++    0xef, 0x05, 0x9e, 0xb8, 0xc7, 0x52, 0xe4, 0x0e, 0x42, 0xaa, 0x7c, 0x79,
++    0xc2, 0xd6, 0xfd, 0xa5
++};
+diff --git a/crypto/fips/fips_dsa_selftest.c b/crypto/fips/fips_dsa_selftest.c
+new file mode 100644
+index 0000000..819efcd
+--- /dev/null
++++ b/crypto/fips/fips_dsa_selftest.c
+@@ -0,0 +1,192 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/dsa.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include "fips_locl.h"
++
++static const unsigned char dsa_test_2048_p[] = {
++    0xa8, 0x53, 0x78, 0xd8, 0xfd, 0x3f, 0x8d, 0x72, 0xec, 0x74, 0x18, 0x08,
++    0x0d, 0xa2, 0x13, 0x17, 0xe4, 0x3e, 0xc4, 0xb6, 0x2b, 0xa8, 0xc8, 0x62,
++    0x3b, 0x7e, 0x4d, 0x04, 0x44, 0x1d, 0xd1, 0xa0, 0x65, 0x86, 0x62, 0x59,
++    0x64, 0x93, 0xca, 0x8e, 0x9e, 0x8f, 0xbb, 0x7e, 0x34, 0xaa, 0xdd, 0xb6,
++    0x2e, 0x5d, 0x67, 0xb6, 0xd0, 0x9a, 0x6e, 0x61, 0xb7, 0x69, 0xe7, 0xc3,
++    0x52, 0xaa, 0x2b, 0x10, 0xe2, 0x0c, 0xa0, 0x63, 0x69, 0x63, 0xb5, 0x52,
++    0x3e, 0x86, 0x47, 0x0d, 0xec, 0xbb, 0xed, 0xa0, 0x27, 0xe7, 0x97, 0xe7,
++    0xb6, 0x76, 0x35, 0xd4, 0xd4, 0x9c, 0x30, 0x70, 0x0e, 0x74, 0xaf, 0x8a,
++    0x0f, 0xf1, 0x56, 0xa8, 0x01, 0xaf, 0x57, 0xa2, 0x6e, 0x70, 0x78, 0xf1,
++    0xd8, 0x2f, 0x74, 0x90, 0x8e, 0xcb, 0x6d, 0x07, 0xe7, 0x0b, 0x35, 0x03,
++    0xee, 0xd9, 0x4f, 0xa3, 0x2c, 0xf1, 0x7a, 0x7f, 0xc3, 0xd6, 0xcf, 0x40,
++    0xdc, 0x7b, 0x00, 0x83, 0x0e, 0x6a, 0x25, 0x66, 0xdc, 0x07, 0x3e, 0x34,
++    0x33, 0x12, 0x51, 0x7c, 0x6a, 0xa5, 0x15, 0x2b, 0x4b, 0xfe, 0xcd, 0x2e,
++    0x55, 0x1f, 0xee, 0x34, 0x63, 0x18, 0xa1, 0x53, 0x42, 0x3c, 0x99, 0x6b,
++    0x0d, 0x5d, 0xcb, 0x91, 0x02, 0xae, 0xdd, 0x38, 0x79, 0x86, 0x16, 0xf1,
++    0xf1, 0xe0, 0xd6, 0xc4, 0x03, 0x52, 0x5b, 0x1f, 0x9b, 0x3d, 0x4d, 0xc7,
++    0x66, 0xde, 0x2d, 0xfc, 0x4a, 0x56, 0xd7, 0xb8, 0xba, 0x59, 0x63, 0xd6,
++    0x0f, 0x3e, 0x16, 0x31, 0x88, 0x70, 0xad, 0x43, 0x69, 0x52, 0xe5, 0x57,
++    0x65, 0x37, 0x4e, 0xab, 0x85, 0xe8, 0xec, 0x17, 0xd6, 0xb9, 0xa4, 0x54,
++    0x7b, 0x9b, 0x5f, 0x27, 0x52, 0xf3, 0x10, 0x5b, 0xe8, 0x09, 0xb2, 0x3a,
++    0x2c, 0x8d, 0x74, 0x69, 0xdb, 0x02, 0xe2, 0x4d, 0x59, 0x23, 0x94, 0xa7,
++    0xdb, 0xa0, 0x69, 0xe9
++};
++
++static const unsigned char dsa_test_2048_q[] = {
++    0xd2, 0x77, 0x04, 0x4e, 0x50, 0xf5, 0xa4, 0xe3, 0xf5, 0x10, 0xa5, 0x0a,
++    0x0b, 0x84, 0xfd, 0xff, 0xbc, 0xa0, 0x47, 0xed, 0x27, 0x60, 0x20, 0x56,
++    0x74, 0x41, 0xa0, 0xa5
++};
++
++static const unsigned char dsa_test_2048_g[] = {
++    0x13, 0xd7, 0x54, 0xe2, 0x1f, 0xd2, 0x41, 0x65, 0x5d, 0xa8, 0x91, 0xc5,
++    0x22, 0xa6, 0x5a, 0x72, 0xa8, 0x9b, 0xdc, 0x64, 0xec, 0x9b, 0x54, 0xa8,
++    0x21, 0xed, 0x4a, 0x89, 0x8b, 0x49, 0x0e, 0x0c, 0x4f, 0xcb, 0x72, 0x19,
++    0x2a, 0x4a, 0x20, 0xf5, 0x41, 0xf3, 0xf2, 0x92, 0x53, 0x99, 0xf0, 0xba,
++    0xec, 0xf9, 0x29, 0xaa, 0xfb, 0xf7, 0x9d, 0xfe, 0x43, 0x32, 0x39, 0x3b,
++    0x32, 0xcd, 0x2e, 0x2f, 0xcf, 0x27, 0x2f, 0x32, 0xa6, 0x27, 0x43, 0x4a,
++    0x0d, 0xf2, 0x42, 0xb7, 0x5b, 0x41, 0x4d, 0xf3, 0x72, 0x12, 0x1e, 0x53,
++    0xa5, 0x53, 0xf2, 0x22, 0xf8, 0x36, 0xb0, 0x00, 0xf0, 0x16, 0x48, 0x5b,
++    0x6b, 0xd0, 0x89, 0x84, 0x51, 0x80, 0x1d, 0xcd, 0x8d, 0xe6, 0x4c, 0xd5,
++    0x36, 0x56, 0x96, 0xff, 0xc5, 0x32, 0xd5, 0x28, 0xc5, 0x06, 0x62, 0x0a,
++    0x94, 0x2a, 0x03, 0x05, 0x04, 0x6d, 0x8f, 0x18, 0x76, 0x34, 0x1f, 0x1e,
++    0x57, 0x0b, 0xc3, 0x97, 0x4b, 0xa6, 0xb9, 0xa4, 0x38, 0xe9, 0x70, 0x23,
++    0x02, 0xa2, 0xe6, 0xe6, 0x7b, 0xfd, 0x06, 0xd3, 0x2b, 0xc6, 0x79, 0x96,
++    0x22, 0x71, 0xd7, 0xb4, 0x0c, 0xd7, 0x2f, 0x38, 0x6e, 0x64, 0xe0, 0xd7,
++    0xef, 0x86, 0xca, 0x8c, 0xa5, 0xd1, 0x42, 0x28, 0xdc, 0x2a, 0x4f, 0x16,
++    0xe3, 0x18, 0x98, 0x86, 0xb5, 0x99, 0x06, 0x74, 0xf4, 0x20, 0x0f, 0x3a,
++    0x4c, 0xf6, 0x5a, 0x3f, 0x0d, 0xdb, 0xa1, 0xfa, 0x67, 0x2d, 0xff, 0x2f,
++    0x5e, 0x14, 0x3d, 0x10, 0xe4, 0xe9, 0x7a, 0xe8, 0x4f, 0x6d, 0xa0, 0x95,
++    0x35, 0xd5, 0xb9, 0xdf, 0x25, 0x91, 0x81, 0xa7, 0x9b, 0x63, 0xb0, 0x69,
++    0xe9, 0x49, 0x97, 0x2b, 0x02, 0xba, 0x36, 0xb3, 0x58, 0x6a, 0xab, 0x7e,
++    0x45, 0xf3, 0x22, 0xf8, 0x2e, 0x4e, 0x85, 0xca, 0x3a, 0xb8, 0x55, 0x91,
++    0xb3, 0xc2, 0xa9, 0x66
++};
++
++static const unsigned char dsa_test_2048_pub_key[] = {
++    0x24, 0x52, 0xf3, 0xcc, 0xbe, 0x9e, 0xd5, 0xca, 0x7d, 0xc7, 0x4c, 0x60,
++    0x2b, 0x99, 0x22, 0x6e, 0x8f, 0x2f, 0xab, 0x38, 0xe7, 0xd7, 0xdd, 0xfb,
++    0x75, 0x53, 0x9b, 0x17, 0x15, 0x5e, 0x9f, 0xcf, 0xd1, 0xab, 0xa5, 0x64,
++    0xeb, 0x85, 0x35, 0xd8, 0x12, 0xc9, 0xc2, 0xdc, 0xf9, 0x72, 0x84, 0x44,
++    0x1b, 0xc4, 0x82, 0x24, 0x36, 0x24, 0xc7, 0xf4, 0x57, 0x58, 0x0c, 0x1c,
++    0x38, 0xa5, 0x7c, 0x46, 0xc4, 0x57, 0x39, 0x24, 0x70, 0xed, 0xb5, 0x2c,
++    0xb5, 0xa6, 0xe0, 0x3f, 0xe6, 0x28, 0x7b, 0xb6, 0xf4, 0x9a, 0x42, 0xa2,
++    0x06, 0x5a, 0x05, 0x4f, 0x03, 0x08, 0x39, 0xdf, 0x1f, 0xd3, 0x14, 0x9c,
++    0x4c, 0xa0, 0x53, 0x1d, 0xd8, 0xca, 0x8a, 0xaa, 0x9c, 0xc7, 0x33, 0x71,
++    0x93, 0x38, 0x73, 0x48, 0x33, 0x61, 0x18, 0x22, 0x45, 0x45, 0xe8, 0x8c,
++    0x80, 0xff, 0xd8, 0x76, 0x5d, 0x74, 0x36, 0x03, 0x33, 0xcc, 0xab, 0x99,
++    0x72, 0x77, 0x9b, 0x65, 0x25, 0xa6, 0x5b, 0xdd, 0x0d, 0x10, 0xc6, 0x75,
++    0xc1, 0x09, 0xbb, 0xd3, 0xe5, 0xbe, 0x4d, 0x72, 0xef, 0x6e, 0xba, 0x6e,
++    0x43, 0x8d, 0x52, 0x26, 0x23, 0x7d, 0xb8, 0x88, 0x37, 0x9c, 0x5f, 0xcc,
++    0x47, 0xa3, 0x84, 0x7f, 0xf6, 0x37, 0x11, 0xba, 0xed, 0x6d, 0x03, 0xaf,
++    0xe8, 0x1e, 0x69, 0x4a, 0x41, 0x3b, 0x68, 0x0b, 0xd3, 0x8a, 0xb4, 0x90,
++    0x3f, 0x83, 0x70, 0xa7, 0x07, 0xef, 0x55, 0x1d, 0x49, 0x41, 0x02, 0x6d,
++    0x95, 0x79, 0xd6, 0x91, 0xde, 0x8e, 0xda, 0xa1, 0x61, 0x05, 0xeb, 0x9d,
++    0xba, 0x3c, 0x2f, 0x4c, 0x1b, 0xec, 0x50, 0x82, 0x75, 0xaa, 0x02, 0x07,
++    0xe2, 0x51, 0xb5, 0xec, 0xcb, 0x28, 0x6a, 0x4b, 0x01, 0xd4, 0x49, 0xd3,
++    0x0a, 0xcb, 0x67, 0x37, 0x17, 0xa0, 0xd2, 0xfb, 0x3b, 0x50, 0xc8, 0x93,
++    0xf7, 0xda, 0xb1, 0x4f
++};
++
++static const unsigned char dsa_test_2048_priv_key[] = {
++    0x0c, 0x4b, 0x30, 0x89, 0xd1, 0xb8, 0x62, 0xcb, 0x3c, 0x43, 0x64, 0x91,
++    0xf0, 0x91, 0x54, 0x70, 0xc5, 0x27, 0x96, 0xe3, 0xac, 0xbe, 0xe8, 0x00,
++    0xec, 0x55, 0xf6, 0xcc
++};
++
++static int corrupt_dsa;
++
++void FIPS_corrupt_dsa()
++{
++    corrupt_dsa = 1;
++}
++
++int FIPS_selftest_dsa()
++{
++    DSA *dsa = NULL;
++    EVP_PKEY *pk = NULL;
++    int ret = 0;
++
++    dsa = DSA_new();
++
++    if (dsa == NULL)
++        goto err;
++
++    fips_load_key_component(dsa, p, dsa_test_2048);
++    fips_load_key_component(dsa, q, dsa_test_2048);
++    fips_load_key_component(dsa, g, dsa_test_2048);
++    fips_load_key_component(dsa, pub_key, dsa_test_2048);
++    fips_load_key_component(dsa, priv_key, dsa_test_2048);
++
++    if (corrupt_dsa)
++        BN_set_bit(dsa->pub_key, 2047);
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_assign_DSA(pk, dsa);
++
++    if (!fips_pkey_signature_test(pk, NULL, 0,
++                                  NULL, 0, EVP_sha256(), 0, "DSA SHA256"))
++        goto err;
++    ret = 1;
++
++ err:
++    if (pk)
++        EVP_PKEY_free(pk);
++    else if (dsa)
++        DSA_free(dsa);
++    return ret;
++}
++#endif
+diff --git a/crypto/fips/fips_ecdh_selftest.c b/crypto/fips/fips_ecdh_selftest.c
+new file mode 100644
+index 0000000..1b29dc5
+--- /dev/null
++++ b/crypto/fips/fips_ecdh_selftest.c
+@@ -0,0 +1,241 @@
++/* fips/ecdh/fips_ecdh_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project 2011.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/ec.h>
++#include <openssl/ecdh.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++# include "fips_locl.h"
++
++static const unsigned char p256_qcavsx[] = {
++    0x52, 0xc6, 0xa5, 0x75, 0xf3, 0x04, 0x98, 0xb3, 0x29, 0x66, 0x0c, 0x62,
++    0x18, 0x60, 0x55, 0x41, 0x59, 0xd4, 0x60, 0x85, 0x99, 0xc1, 0x51, 0x13,
++    0x6f, 0x97, 0x85, 0x93, 0x33, 0x34, 0x07, 0x50
++};
++
++static const unsigned char p256_qcavsy[] = {
++    0x6f, 0x69, 0x24, 0xeb, 0xe9, 0x3b, 0xa7, 0xcc, 0x47, 0x17, 0xaa, 0x3f,
++    0x70, 0xfc, 0x10, 0x73, 0x0a, 0xcd, 0x21, 0xee, 0x29, 0x19, 0x1f, 0xaf,
++    0xb4, 0x1c, 0x1e, 0xc2, 0x8e, 0x97, 0x81, 0x6e
++};
++
++static const unsigned char p256_qiutx[] = {
++    0x71, 0x46, 0x88, 0x08, 0x92, 0x21, 0x1b, 0x10, 0x21, 0x74, 0xff, 0x0c,
++    0x94, 0xde, 0x34, 0x7c, 0x86, 0x74, 0xbe, 0x67, 0x41, 0x68, 0xd4, 0xc1,
++    0xe5, 0x75, 0x63, 0x9c, 0xa7, 0x46, 0x93, 0x6f
++};
++
++static const unsigned char p256_qiuty[] = {
++    0x33, 0x40, 0xa9, 0x6a, 0xf5, 0x20, 0xb5, 0x9e, 0xfc, 0x60, 0x1a, 0xae,
++    0x3d, 0xf8, 0x21, 0xd2, 0xa7, 0xca, 0x52, 0x34, 0xb9, 0x5f, 0x27, 0x75,
++    0x6c, 0x81, 0xbe, 0x32, 0x4d, 0xba, 0xbb, 0xf8
++};
++
++static const unsigned char p256_qiutd[] = {
++    0x1a, 0x48, 0x55, 0x6b, 0x11, 0xbe, 0x92, 0xd4, 0x1c, 0xd7, 0x45, 0xc3,
++    0x82, 0x81, 0x51, 0xf1, 0x23, 0x40, 0xb7, 0x83, 0xfd, 0x01, 0x6d, 0xbc,
++    0xa1, 0x66, 0xaf, 0x0a, 0x03, 0x23, 0xcd, 0xc8
++};
++
++static const unsigned char p256_ziut[] = {
++    0x77, 0x2a, 0x1e, 0x37, 0xee, 0xe6, 0x51, 0x02, 0x71, 0x40, 0xf8, 0x6a,
++    0x36, 0xf8, 0x65, 0x61, 0x2b, 0x18, 0x71, 0x82, 0x23, 0xe6, 0xf2, 0x77,
++    0xce, 0xec, 0xb8, 0x49, 0xc7, 0xbf, 0x36, 0x4f
++};
++
++typedef struct {
++    int curve;
++    const unsigned char *x1;
++    size_t x1len;
++    const unsigned char *y1;
++    size_t y1len;
++    const unsigned char *d1;
++    size_t d1len;
++    const unsigned char *x2;
++    size_t x2len;
++    const unsigned char *y2;
++    size_t y2len;
++    const unsigned char *z;
++    size_t zlen;
++} ECDH_SELFTEST_DATA;
++
++# define make_ecdh_test(nid, pr) { nid, \
++                                pr##_qiutx, sizeof(pr##_qiutx), \
++                                pr##_qiuty, sizeof(pr##_qiuty), \
++                                pr##_qiutd, sizeof(pr##_qiutd), \
++                                pr##_qcavsx, sizeof(pr##_qcavsx), \
++                                pr##_qcavsy, sizeof(pr##_qcavsy), \
++                                pr##_ziut, sizeof(pr##_ziut) }
++
++static ECDH_SELFTEST_DATA test_ecdh_data[] = {
++    make_ecdh_test(NID_X9_62_prime256v1, p256),
++};
++
++int FIPS_selftest_ecdh(void)
++{
++    EC_KEY *ec1 = NULL, *ec2 = NULL;
++    const EC_POINT *ecp = NULL;
++    BIGNUM *x = NULL, *y = NULL, *d = NULL;
++    unsigned char *ztmp = NULL;
++    int rv = 1;
++    size_t i;
++
++    for (i = 0; i < sizeof(test_ecdh_data) / sizeof(ECDH_SELFTEST_DATA); i++) {
++        ECDH_SELFTEST_DATA *ecd = test_ecdh_data + i;
++        if (!fips_post_started(FIPS_TEST_ECDH, ecd->curve, 0))
++            continue;
++        ztmp = OPENSSL_malloc(ecd->zlen);
++
++        x = BN_bin2bn(ecd->x1, ecd->x1len, x);
++        y = BN_bin2bn(ecd->y1, ecd->y1len, y);
++        d = BN_bin2bn(ecd->d1, ecd->d1len, d);
++
++        if (!x || !y || !d || !ztmp) {
++            rv = -1;
++            goto err;
++        }
++
++        ec1 = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec1) {
++            rv = -1;
++            goto err;
++        }
++        EC_KEY_set_flags(ec1, EC_FLAG_COFACTOR_ECDH);
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec1, x, y)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!EC_KEY_set_private_key(ec1, d)) {
++            rv = -1;
++            goto err;
++        }
++
++        x = BN_bin2bn(ecd->x2, ecd->x2len, x);
++        y = BN_bin2bn(ecd->y2, ecd->y2len, y);
++
++        if (!x || !y) {
++            rv = -1;
++            goto err;
++        }
++
++        ec2 = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec2) {
++            rv = -1;
++            goto err;
++        }
++        EC_KEY_set_flags(ec1, EC_FLAG_COFACTOR_ECDH);
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec2, x, y)) {
++            rv = -1;
++            goto err;
++        }
++
++        ecp = EC_KEY_get0_public_key(ec2);
++        if (!ecp) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!ECDH_compute_key(ztmp, ecd->zlen, ecp, ec1, 0)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!fips_post_corrupt(FIPS_TEST_ECDH, ecd->curve, NULL))
++            ztmp[0] ^= 0x1;
++
++        if (memcmp(ztmp, ecd->z, ecd->zlen)) {
++            fips_post_failed(FIPS_TEST_ECDH, ecd->curve, 0);
++            rv = 0;
++        } else if (!fips_post_success(FIPS_TEST_ECDH, ecd->curve, 0))
++            goto err;
++
++        EC_KEY_free(ec1);
++        ec1 = NULL;
++        EC_KEY_free(ec2);
++        ec2 = NULL;
++        OPENSSL_free(ztmp);
++        ztmp = NULL;
++    }
++
++ err:
++
++    if (x)
++        BN_clear_free(x);
++    if (y)
++        BN_clear_free(y);
++    if (d)
++        BN_clear_free(d);
++    if (ec1)
++        EC_KEY_free(ec1);
++    if (ec2)
++        EC_KEY_free(ec2);
++    if (ztmp)
++        OPENSSL_free(ztmp);
++
++    return rv;
++
++}
++
++#endif
+diff --git a/crypto/fips/fips_ecdsa_selftest.c b/crypto/fips/fips_ecdsa_selftest.c
+new file mode 100644
+index 0000000..3fd35ae
+--- /dev/null
++++ b/crypto/fips/fips_ecdsa_selftest.c
+@@ -0,0 +1,165 @@
++/* fips/ecdsa/fips_ecdsa_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project 2011.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/ec.h>
++#include <openssl/ecdsa.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++
++static const char P_256_name[] = "ECDSA P-256";
++
++static const unsigned char P_256_d[] = {
++    0x51, 0xbd, 0x06, 0xa1, 0x1c, 0xda, 0xe2, 0x12, 0x99, 0xc9, 0x52, 0x3f,
++    0xea, 0xa4, 0xd2, 0xd1, 0xf4, 0x7f, 0xd4, 0x3e, 0xbd, 0xf8, 0xfc, 0x87,
++    0xdc, 0x82, 0x53, 0x21, 0xee, 0xa0, 0xdc, 0x64
++};
++
++static const unsigned char P_256_qx[] = {
++    0x23, 0x89, 0xe0, 0xf4, 0x69, 0xe0, 0x49, 0xe5, 0xc7, 0xe5, 0x40, 0x6e,
++    0x8f, 0x25, 0xdd, 0xad, 0x11, 0x16, 0x14, 0x9b, 0xab, 0x44, 0x06, 0x31,
++    0xbf, 0x5e, 0xa6, 0x44, 0xac, 0x86, 0x00, 0x07
++};
++
++static const unsigned char P_256_qy[] = {
++    0xb3, 0x05, 0x0d, 0xd0, 0xdc, 0xf7, 0x40, 0xe6, 0xf9, 0xd8, 0x6d, 0x7b,
++    0x63, 0xca, 0x97, 0xe6, 0x12, 0xf9, 0xd4, 0x18, 0x59, 0xbe, 0xb2, 0x5e,
++    0x4a, 0x6a, 0x77, 0x23, 0xf4, 0x11, 0x9d, 0xeb
++};
++
++typedef struct {
++    int curve;
++    const char *name;
++    const unsigned char *x;
++    size_t xlen;
++    const unsigned char *y;
++    size_t ylen;
++    const unsigned char *d;
++    size_t dlen;
++} EC_SELFTEST_DATA;
++
++# define make_ecdsa_test(nid, pr) { nid, pr##_name, \
++                                pr##_qx, sizeof(pr##_qx), \
++                                pr##_qy, sizeof(pr##_qy), \
++                                pr##_d, sizeof(pr##_d)}
++
++static EC_SELFTEST_DATA test_ec_data[] = {
++    make_ecdsa_test(NID_X9_62_prime256v1, P_256),
++};
++
++int FIPS_selftest_ecdsa()
++{
++    EC_KEY *ec = NULL;
++    BIGNUM *x = NULL, *y = NULL, *d = NULL;
++    EVP_PKEY *pk = NULL;
++    int rv = 0;
++    size_t i;
++
++    for (i = 0; i < sizeof(test_ec_data) / sizeof(EC_SELFTEST_DATA); i++) {
++        EC_SELFTEST_DATA *ecd = test_ec_data + i;
++
++        x = BN_bin2bn(ecd->x, ecd->xlen, x);
++        y = BN_bin2bn(ecd->y, ecd->ylen, y);
++        d = BN_bin2bn(ecd->d, ecd->dlen, d);
++
++        if (!x || !y || !d)
++            goto err;
++
++        ec = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec)
++            goto err;
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec, x, y))
++            goto err;
++
++        if (!EC_KEY_set_private_key(ec, d))
++            goto err;
++
++        if ((pk = EVP_PKEY_new()) == NULL)
++            goto err;
++
++        EVP_PKEY_assign_EC_KEY(pk, ec);
++
++        if (!fips_pkey_signature_test(pk, NULL, 0,
++                                      NULL, 0, EVP_sha256(), 0, ecd->name))
++            goto err;
++    }
++
++    rv = 1;
++
++ err:
++
++    if (x)
++        BN_clear_free(x);
++    if (y)
++        BN_clear_free(y);
++    if (d)
++        BN_clear_free(d);
++    if (pk)
++        EVP_PKEY_free(pk);
++    else if (ec)
++        EC_KEY_free(ec);
++
++    return rv;
++
++}
++
++#endif
+diff --git a/crypto/fips/fips_enc.c b/crypto/fips/fips_enc.c
+new file mode 100644
+index 0000000..0bccf1b
+--- /dev/null
++++ b/crypto/fips/fips_enc.c
+@@ -0,0 +1,191 @@
++/* fipe/evp/fips_enc.c */
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ *
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ *
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <openssl/evp.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++
++const EVP_CIPHER *FIPS_get_cipherbynid(int nid)
++{
++    switch (nid) {
++    case NID_aes_128_cbc:
++        return EVP_aes_128_cbc();
++
++    case NID_aes_128_ccm:
++        return EVP_aes_128_ccm();
++
++    case NID_aes_128_cfb1:
++        return EVP_aes_128_cfb1();
++
++    case NID_aes_128_cfb128:
++        return EVP_aes_128_cfb128();
++
++    case NID_aes_128_cfb8:
++        return EVP_aes_128_cfb8();
++
++    case NID_aes_128_ctr:
++        return EVP_aes_128_ctr();
++
++    case NID_aes_128_ecb:
++        return EVP_aes_128_ecb();
++
++    case NID_aes_128_gcm:
++        return EVP_aes_128_gcm();
++
++    case NID_aes_128_ofb128:
++        return EVP_aes_128_ofb();
++
++    case NID_aes_128_xts:
++        return EVP_aes_128_xts();
++
++    case NID_aes_192_cbc:
++        return EVP_aes_192_cbc();
++
++    case NID_aes_192_ccm:
++        return EVP_aes_192_ccm();
++
++    case NID_aes_192_cfb1:
++        return EVP_aes_192_cfb1();
++
++    case NID_aes_192_cfb128:
++        return EVP_aes_192_cfb128();
++
++    case NID_aes_192_cfb8:
++        return EVP_aes_192_cfb8();
++
++    case NID_aes_192_ctr:
++        return EVP_aes_192_ctr();
++
++    case NID_aes_192_ecb:
++        return EVP_aes_192_ecb();
++
++    case NID_aes_192_gcm:
++        return EVP_aes_192_gcm();
++
++    case NID_aes_192_ofb128:
++        return EVP_aes_192_ofb();
++
++    case NID_aes_256_cbc:
++        return EVP_aes_256_cbc();
++
++    case NID_aes_256_ccm:
++        return EVP_aes_256_ccm();
++
++    case NID_aes_256_cfb1:
++        return EVP_aes_256_cfb1();
++
++    case NID_aes_256_cfb128:
++        return EVP_aes_256_cfb128();
++
++    case NID_aes_256_cfb8:
++        return EVP_aes_256_cfb8();
++
++    case NID_aes_256_ctr:
++        return EVP_aes_256_ctr();
++
++    case NID_aes_256_ecb:
++        return EVP_aes_256_ecb();
++
++    case NID_aes_256_gcm:
++        return EVP_aes_256_gcm();
++
++    case NID_aes_256_ofb128:
++        return EVP_aes_256_ofb();
++
++    case NID_aes_256_xts:
++        return EVP_aes_256_xts();
++
++    case NID_des_ede_ecb:
++        return EVP_des_ede();
++
++    case NID_des_ede3_ecb:
++        return EVP_des_ede3();
++
++    case NID_des_ede3_cbc:
++        return EVP_des_ede3_cbc();
++
++    case NID_des_ede3_cfb1:
++        return EVP_des_ede3_cfb1();
++
++    case NID_des_ede3_cfb64:
++        return EVP_des_ede3_cfb64();
++
++    case NID_des_ede3_cfb8:
++        return EVP_des_ede3_cfb8();
++
++    case NID_des_ede3_ofb64:
++        return EVP_des_ede3_ofb();
++
++    case NID_des_ede_cbc:
++        return EVP_des_ede_cbc();
++
++    case NID_des_ede_cfb64:
++        return EVP_des_ede_cfb64();
++
++    case NID_des_ede_ofb64:
++        return EVP_des_ede_ofb();
++
++    default:
++        return NULL;
++
++    }
++}
++#endif
+diff --git a/crypto/fips/fips_hmac_selftest.c b/crypto/fips/fips_hmac_selftest.c
+new file mode 100644
+index 0000000..3089843
+--- /dev/null
++++ b/crypto/fips/fips_hmac_selftest.c
+@@ -0,0 +1,134 @@
++/* ====================================================================
++ * Copyright (c) 2005 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/hmac.h>
++
++#ifdef OPENSSL_FIPS
++typedef struct {
++    const EVP_MD *(*alg) (void);
++    const char *key, *iv;
++    unsigned char kaval[EVP_MAX_MD_SIZE];
++} HMAC_KAT;
++
++static const HMAC_KAT vector[] = {
++    {EVP_sha1,
++     /* from http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf */
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x09, 0x22, 0xd3, 0x40, 0x5f, 0xaa, 0x3d, 0x19,
++      0x4f, 0x82, 0xa4, 0x58, 0x30, 0x73, 0x7d, 0x5c,
++      0xc6, 0xc7, 0x5d, 0x24}
++     },
++    {EVP_sha224,
++     /* just keep extending the above... */
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0xdd, 0xef, 0x0a, 0x40, 0xcb, 0x7d, 0x50, 0xfb,
++      0x6e, 0xe6, 0xce, 0xa1, 0x20, 0xba, 0x26, 0xaa,
++      0x08, 0xf3, 0x07, 0x75, 0x87, 0xb8, 0xad, 0x1b,
++      0x8c, 0x8d, 0x12, 0xc7}
++     },
++    {EVP_sha256,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0xb8, 0xf2, 0x0d, 0xb5, 0x41, 0xea, 0x43, 0x09,
++      0xca, 0x4e, 0xa9, 0x38, 0x0c, 0xd0, 0xe8, 0x34,
++      0xf7, 0x1f, 0xbe, 0x91, 0x74, 0xa2, 0x61, 0x38,
++      0x0d, 0xc1, 0x7e, 0xae, 0x6a, 0x34, 0x51, 0xd9}
++     },
++    {EVP_sha384,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x08, 0xbc, 0xb0, 0xda, 0x49, 0x1e, 0x87, 0xad,
++      0x9a, 0x1d, 0x6a, 0xce, 0x23, 0xc5, 0x0b, 0xf6,
++      0xb7, 0x18, 0x06, 0xa5, 0x77, 0xcd, 0x49, 0x04,
++      0x89, 0xf1, 0xe6, 0x23, 0x44, 0x51, 0x51, 0x9f,
++      0x85, 0x56, 0x80, 0x79, 0x0c, 0xbd, 0x4d, 0x50,
++      0xa4, 0x5f, 0x29, 0xe3, 0x93, 0xf0, 0xe8, 0x7f}
++     },
++    {EVP_sha512,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x80, 0x9d, 0x44, 0x05, 0x7c, 0x5b, 0x95, 0x41,
++      0x05, 0xbd, 0x04, 0x13, 0x16, 0xdb, 0x0f, 0xac,
++      0x44, 0xd5, 0xa4, 0xd5, 0xd0, 0x89, 0x2b, 0xd0,
++      0x4e, 0x86, 0x64, 0x12, 0xc0, 0x90, 0x77, 0x68,
++      0xf1, 0x87, 0xb7, 0x7c, 0x4f, 0xae, 0x2c, 0x2f,
++      0x21, 0xa5, 0xb5, 0x65, 0x9a, 0x4f, 0x4b, 0xa7,
++      0x47, 0x02, 0xa3, 0xde, 0x9b, 0x51, 0xf1, 0x45,
++      0xbd, 0x4f, 0x25, 0x27, 0x42, 0x98, 0x99, 0x05}
++     },
++};
++
++int FIPS_selftest_hmac()
++{
++    int n;
++    unsigned int outlen;
++    unsigned char out[EVP_MAX_MD_SIZE];
++    const EVP_MD *md;
++    const HMAC_KAT *t;
++
++    for (n = 0, t = vector; n < sizeof(vector) / sizeof(vector[0]); n++, t++) {
++        md = (*t->alg) ();
++        HMAC(md, t->key, strlen(t->key),
++             (const unsigned char *)t->iv, strlen(t->iv), out, &outlen);
++
++        if (memcmp(out, t->kaval, outlen)) {
++            FIPSerr(FIPS_F_FIPS_SELFTEST_HMAC, FIPS_R_SELFTEST_FAILED);
++            return 0;
++        }
++    }
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_locl.h b/crypto/fips/fips_locl.h
+new file mode 100644
+index 0000000..3c3d1bb
+--- /dev/null
++++ b/crypto/fips/fips_locl.h
+@@ -0,0 +1,71 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#ifdef OPENSSL_FIPS
++
++# ifdef  __cplusplus
++extern "C" {
++# endif
++
++# define FIPS_MAX_CIPHER_TEST_SIZE       32
++# define fips_load_key_component(key, comp, pre) \
++        key->comp = BN_bin2bn(pre##_##comp, sizeof(pre##_##comp), key->comp); \
++        if (!key->comp) \
++                goto err
++
++# define fips_post_started(id, subid, ex) 1
++# define fips_post_success(id, subid, ex) 1
++# define fips_post_failed(id, subid, ex) 1
++# define fips_post_corrupt(id, subid, ex) 1
++# define fips_post_status() 1
++
++# ifdef  __cplusplus
++}
++# endif
++#endif
+diff --git a/crypto/fips/fips_md.c b/crypto/fips/fips_md.c
+new file mode 100644
+index 0000000..465eb98
+--- /dev/null
++++ b/crypto/fips/fips_md.c
+@@ -0,0 +1,146 @@
++/* fips/evp/fips_md.c */
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ *
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ *
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++/* ====================================================================
++ * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ * This product includes cryptographic software written by Eric Young
++ * (eay@cryptsoft.com).  This product includes software written by Tim
++ * Hudson (tjh@cryptsoft.com).
++ *
++ */
++
++/* Minimal standalone FIPS versions of Digest operations */
++
++#define OPENSSL_FIPSAPI
++
++#include <stdio.h>
++#include <string.h>
++#include <openssl/objects.h>
++#include <openssl/evp.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++
++const EVP_MD *FIPS_get_digestbynid(int nid)
++{
++    switch (nid) {
++    case NID_sha1:
++        return EVP_sha1();
++
++    case NID_sha224:
++        return EVP_sha224();
++
++    case NID_sha256:
++        return EVP_sha256();
++
++    case NID_sha384:
++        return EVP_sha384();
++
++    case NID_sha512:
++        return EVP_sha512();
++
++    default:
++        return NULL;
++    }
++}
++#endif
+diff --git a/crypto/fips/fips_post.c b/crypto/fips/fips_post.c
+new file mode 100644
+index 0000000..b6a169c
+--- /dev/null
++++ b/crypto/fips/fips_post.c
+@@ -0,0 +1,205 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <openssl/crypto.h>
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include <openssl/err.h>
++#include <openssl/bio.h>
++#include <openssl/hmac.h>
++#include <openssl/rsa.h>
++#include <openssl/dsa.h>
++#include <string.h>
++#include <limits.h>
++
++#ifdef OPENSSL_FIPS
++
++/* Power on self test (POST) support functions */
++
++# include <openssl/fips.h>
++# include "fips_locl.h"
++
++/* Run all selftests */
++int FIPS_selftest(void)
++{
++    int rv = 1;
++    if (!FIPS_selftest_drbg())
++        rv = 0;
++    if (!FIPS_selftest_sha1())
++        rv = 0;
++    if (!FIPS_selftest_sha2())
++        rv = 0;
++    if (!FIPS_selftest_hmac())
++        rv = 0;
++    if (!FIPS_selftest_cmac())
++        rv = 0;
++    if (!FIPS_selftest_aes())
++        rv = 0;
++    if (!FIPS_selftest_aes_ccm())
++        rv = 0;
++    if (!FIPS_selftest_aes_gcm())
++        rv = 0;
++    if (!FIPS_selftest_aes_xts())
++        rv = 0;
++    if (!FIPS_selftest_des())
++        rv = 0;
++    if (!FIPS_selftest_rsa())
++        rv = 0;
++    if (!FIPS_selftest_ecdsa())
++        rv = 0;
++    if (!FIPS_selftest_dsa())
++        rv = 0;
++    if (!FIPS_selftest_dh())
++	rv = 0;
++    if (!FIPS_selftest_ecdh())
++        rv = 0;
++    return rv;
++}
++
++/* Generalized public key test routine. Signs and verifies the data
++ * supplied in tbs using mesage digest md and setting option digest
++ * flags md_flags. If the 'kat' parameter is not NULL it will
++ * additionally check the signature matches it: a known answer test
++ * The string "fail_str" is used for identification purposes in case
++ * of failure. If "pkey" is NULL just perform a message digest check.
++ */
++
++int fips_pkey_signature_test(EVP_PKEY *pkey,
++                             const unsigned char *tbs, int tbslen,
++                             const unsigned char *kat, unsigned int katlen,
++                             const EVP_MD *digest, unsigned int md_flags,
++                             const char *fail_str)
++{
++    int ret = 0;
++    unsigned char sigtmp[256], *sig = sigtmp;
++    unsigned int siglen;
++    EVP_MD_CTX mctx;
++    EVP_MD_CTX_init(&mctx);
++
++    if (digest == NULL)
++        digest = EVP_sha256();
++
++    if ((pkey->type == EVP_PKEY_RSA)
++        && (RSA_size(pkey->pkey.rsa) > sizeof(sigtmp))) {
++        sig = OPENSSL_malloc(RSA_size(pkey->pkey.rsa));
++        if (!sig) {
++            FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, ERR_R_MALLOC_FAILURE);
++            return 0;
++        }
++    }
++
++    if (tbslen == -1)
++        tbslen = strlen((char *)tbs);
++
++    if (md_flags)
++        EVP_MD_CTX_set_flags(&mctx, md_flags);
++
++    if (!EVP_SignInit_ex(&mctx, digest, NULL))
++        goto error;
++    if (!EVP_SignUpdate(&mctx, tbs, tbslen))
++        goto error;
++    if (!EVP_SignFinal(&mctx, sig, &siglen, pkey))
++        goto error;
++
++    if (kat && ((siglen != katlen) || memcmp(kat, sig, katlen)))
++        goto error;
++
++    if (!EVP_VerifyInit_ex(&mctx, digest, NULL))
++        goto error;
++    if (!EVP_VerifyUpdate(&mctx, tbs, tbslen))
++        goto error;
++    ret = EVP_VerifyFinal(&mctx, sig, siglen, pkey);
++
++ error:
++    if (sig != sigtmp)
++        OPENSSL_free(sig);
++    EVP_MD_CTX_cleanup(&mctx);
++    if (ret != 1) {
++        FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, FIPS_R_TEST_FAILURE);
++        if (fail_str)
++            ERR_add_error_data(2, "Type=", fail_str);
++        return 0;
++    }
++    return 1;
++}
++
++/* Generalized symmetric cipher test routine. Encrypt data, verify result
++ * against known answer, decrypt and compare with original plaintext.
++ */
++
++int fips_cipher_test(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
++                     const unsigned char *key,
++                     const unsigned char *iv,
++                     const unsigned char *plaintext,
++                     const unsigned char *ciphertext, int len)
++{
++    unsigned char pltmp[FIPS_MAX_CIPHER_TEST_SIZE];
++    unsigned char citmp[FIPS_MAX_CIPHER_TEST_SIZE];
++
++    OPENSSL_assert(len <= FIPS_MAX_CIPHER_TEST_SIZE);
++    memset(pltmp, 0, FIPS_MAX_CIPHER_TEST_SIZE);
++    memset(citmp, 0, FIPS_MAX_CIPHER_TEST_SIZE);
++
++    if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1) <= 0)
++        return 0;
++    if (EVP_Cipher(ctx, citmp, plaintext, len) <= 0)
++        return 0;
++    if (memcmp(citmp, ciphertext, len))
++        return 0;
++    if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0) <= 0)
++        return 0;
++    if (EVP_Cipher(ctx, pltmp, citmp, len) <= 0)
++        return 0;
++    if (memcmp(pltmp, plaintext, len))
++        return 0;
++    return 1;
++}
++#endif
+diff --git a/crypto/fips/fips_rand.c b/crypto/fips/fips_rand.c
+new file mode 100644
+index 0000000..1b3861f
+--- /dev/null
++++ b/crypto/fips/fips_rand.c
+@@ -0,0 +1,429 @@
++/* ====================================================================
++ * Copyright (c) 2007 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++/*
++ * This is a FIPS approved AES PRNG based on ANSI X9.31 A.2.4.
++ */
++#include <openssl/crypto.h>
++#include "e_os.h"
++
++/* If we don't define _XOPEN_SOURCE_EXTENDED, struct timeval won't
++   be defined and gettimeofday() won't be declared with strict compilers
++   like DEC C in ANSI C mode.  */
++#ifndef _XOPEN_SOURCE_EXTENDED
++# define _XOPEN_SOURCE_EXTENDED 1
++#endif
++
++#include <openssl/rand.h>
++#include <openssl/aes.h>
++#include <openssl/err.h>
++#if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS))
++# include <sys/time.h>
++#endif
++#if defined(OPENSSL_SYS_VXWORKS)
++# include <time.h>
++#endif
++#include <assert.h>
++#ifndef OPENSSL_SYS_WIN32
++# ifdef OPENSSL_UNISTD
++#  include OPENSSL_UNISTD
++# else
++#  include <unistd.h>
++# endif
++#endif
++#include <string.h>
++
++#ifdef OPENSSL_FIPS
++
++#include <openssl/fips_rand.h>
++#include <openssl/fips.h>
++#include "fips_locl.h"
++
++void *OPENSSL_stderr(void);
++
++# define AES_BLOCK_LENGTH        16
++
++/* AES FIPS PRNG implementation */
++
++typedef struct {
++    int seeded;
++    int keyed;
++    int test_mode;
++    int second;
++    int error;
++    unsigned long counter;
++    AES_KEY ks;
++    int vpos;
++    /* Temporary storage for key if it equals seed length */
++    unsigned char tmp_key[AES_BLOCK_LENGTH];
++    unsigned char V[AES_BLOCK_LENGTH];
++    unsigned char DT[AES_BLOCK_LENGTH];
++    unsigned char last[AES_BLOCK_LENGTH];
++} FIPS_PRNG_CTX;
++
++static FIPS_PRNG_CTX sctx;
++
++static int fips_prng_fail = 0;
++
++void FIPS_x931_stick(int onoff)
++{
++    fips_prng_fail = onoff;
++}
++
++void FIPS_rng_stick(void)
++{
++    FIPS_x931_stick(1);
++}
++
++static void fips_rand_prng_reset(FIPS_PRNG_CTX * ctx)
++{
++    ctx->seeded = 0;
++    ctx->keyed = 0;
++    ctx->test_mode = 0;
++    ctx->counter = 0;
++    ctx->second = 0;
++    ctx->error = 0;
++    ctx->vpos = 0;
++    OPENSSL_cleanse(ctx->V, AES_BLOCK_LENGTH);
++    OPENSSL_cleanse(&ctx->ks, sizeof(AES_KEY));
++}
++
++static int fips_set_prng_key(FIPS_PRNG_CTX * ctx,
++                             const unsigned char *key, unsigned int keylen)
++{
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_FIPS_SET_PRNG_KEY, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++    if (keylen != 16 && keylen != 24 && keylen != 32) {
++        /* error: invalid key size */
++        return 0;
++    }
++    AES_set_encrypt_key(key, keylen << 3, &ctx->ks);
++    if (keylen == 16) {
++        memcpy(ctx->tmp_key, key, 16);
++        ctx->keyed = 2;
++    } else
++        ctx->keyed = 1;
++    ctx->seeded = 0;
++    ctx->second = 0;
++    return 1;
++}
++
++static int fips_set_prng_seed(FIPS_PRNG_CTX * ctx,
++                              const unsigned char *seed, unsigned int seedlen)
++{
++    unsigned int i;
++    if (!ctx->keyed)
++        return 0;
++    /* In test mode seed is just supplied data */
++    if (ctx->test_mode) {
++        if (seedlen != AES_BLOCK_LENGTH)
++            return 0;
++        memcpy(ctx->V, seed, AES_BLOCK_LENGTH);
++        ctx->seeded = 1;
++        return 1;
++    }
++    /* Outside test mode XOR supplied data with existing seed */
++    for (i = 0; i < seedlen; i++) {
++        ctx->V[ctx->vpos++] ^= seed[i];
++        if (ctx->vpos == AES_BLOCK_LENGTH) {
++            ctx->vpos = 0;
++            /* Special case if first seed and key length equals
++             * block size check key and seed do not match.
++             */
++            if (ctx->keyed == 2) {
++                if (!memcmp(ctx->tmp_key, ctx->V, 16)) {
++                    RANDerr(RAND_F_FIPS_SET_PRNG_SEED,
++                            RAND_R_PRNG_SEED_MUST_NOT_MATCH_KEY);
++                    return 0;
++                }
++                OPENSSL_cleanse(ctx->tmp_key, 16);
++                ctx->keyed = 1;
++            }
++            ctx->seeded = 1;
++        }
++    }
++    return 1;
++}
++
++static int fips_set_test_mode(FIPS_PRNG_CTX * ctx)
++{
++    if (ctx->keyed) {
++        RANDerr(RAND_F_FIPS_SET_TEST_MODE, RAND_R_PRNG_KEYED);
++        return 0;
++    }
++    ctx->test_mode = 1;
++    return 1;
++}
++
++int FIPS_x931_test_mode(void)
++{
++    return fips_set_test_mode(&sctx);
++}
++
++int FIPS_rand_test_mode(void)
++{
++    return fips_set_test_mode(&sctx);
++}
++
++int FIPS_x931_set_dt(unsigned char *dt)
++{
++    if (!sctx.test_mode) {
++        RANDerr(RAND_F_FIPS_X931_SET_DT, RAND_R_NOT_IN_TEST_MODE);
++        return 0;
++    }
++    memcpy(sctx.DT, dt, AES_BLOCK_LENGTH);
++    return 1;
++}
++
++int FIPS_rand_set_dt(unsigned char *dt)
++{
++    if (!sctx.test_mode) {
++        RANDerr(RAND_F_FIPS_RAND_SET_DT, RAND_R_NOT_IN_TEST_MODE);
++        return 0;
++    }
++    memcpy(sctx.DT, dt, AES_BLOCK_LENGTH);
++    return 1;
++}
++
++void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr)
++{
++# ifdef OPENSSL_SYS_WIN32
++    FILETIME ft;
++# elif defined(OPENSSL_SYS_VXWORKS)
++    struct timespec ts;
++# else
++    struct timeval tv;
++# endif
++
++# ifndef GETPID_IS_MEANINGLESS
++    unsigned long pid;
++# endif
++
++# ifdef OPENSSL_SYS_WIN32
++    GetSystemTimeAsFileTime(&ft);
++    buf[0] = (unsigned char)(ft.dwHighDateTime & 0xff);
++    buf[1] = (unsigned char)((ft.dwHighDateTime >> 8) & 0xff);
++    buf[2] = (unsigned char)((ft.dwHighDateTime >> 16) & 0xff);
++    buf[3] = (unsigned char)((ft.dwHighDateTime >> 24) & 0xff);
++    buf[4] = (unsigned char)(ft.dwLowDateTime & 0xff);
++    buf[5] = (unsigned char)((ft.dwLowDateTime >> 8) & 0xff);
++    buf[6] = (unsigned char)((ft.dwLowDateTime >> 16) & 0xff);
++    buf[7] = (unsigned char)((ft.dwLowDateTime >> 24) & 0xff);
++# elif defined(OPENSSL_SYS_VXWORKS)
++    clock_gettime(CLOCK_REALTIME, &ts);
++    buf[0] = (unsigned char)(ts.tv_sec & 0xff);
++    buf[1] = (unsigned char)((ts.tv_sec >> 8) & 0xff);
++    buf[2] = (unsigned char)((ts.tv_sec >> 16) & 0xff);
++    buf[3] = (unsigned char)((ts.tv_sec >> 24) & 0xff);
++    buf[4] = (unsigned char)(ts.tv_nsec & 0xff);
++    buf[5] = (unsigned char)((ts.tv_nsec >> 8) & 0xff);
++    buf[6] = (unsigned char)((ts.tv_nsec >> 16) & 0xff);
++    buf[7] = (unsigned char)((ts.tv_nsec >> 24) & 0xff);
++# else
++    gettimeofday(&tv, NULL);
++    buf[0] = (unsigned char)(tv.tv_sec & 0xff);
++    buf[1] = (unsigned char)((tv.tv_sec >> 8) & 0xff);
++    buf[2] = (unsigned char)((tv.tv_sec >> 16) & 0xff);
++    buf[3] = (unsigned char)((tv.tv_sec >> 24) & 0xff);
++    buf[4] = (unsigned char)(tv.tv_usec & 0xff);
++    buf[5] = (unsigned char)((tv.tv_usec >> 8) & 0xff);
++    buf[6] = (unsigned char)((tv.tv_usec >> 16) & 0xff);
++    buf[7] = (unsigned char)((tv.tv_usec >> 24) & 0xff);
++# endif
++    buf[8] = (unsigned char)(*pctr & 0xff);
++    buf[9] = (unsigned char)((*pctr >> 8) & 0xff);
++    buf[10] = (unsigned char)((*pctr >> 16) & 0xff);
++    buf[11] = (unsigned char)((*pctr >> 24) & 0xff);
++
++    (*pctr)++;
++
++# ifndef GETPID_IS_MEANINGLESS
++    pid = (unsigned long)getpid();
++    buf[12] = (unsigned char)(pid & 0xff);
++    buf[13] = (unsigned char)((pid >> 8) & 0xff);
++    buf[14] = (unsigned char)((pid >> 16) & 0xff);
++    buf[15] = (unsigned char)((pid >> 24) & 0xff);
++# endif
++}
++
++static int fips_rand(FIPS_PRNG_CTX * ctx,
++                     unsigned char *out, unsigned int outlen)
++{
++    unsigned char R[AES_BLOCK_LENGTH], I[AES_BLOCK_LENGTH];
++    unsigned char tmp[AES_BLOCK_LENGTH];
++    int i;
++    if (ctx->error) {
++        RANDerr(RAND_F_FIPS_RAND, RAND_R_PRNG_ERROR);
++        return 0;
++    }
++    if (!ctx->keyed) {
++        RANDerr(RAND_F_FIPS_RAND, RAND_R_NO_KEY_SET);
++        return 0;
++    }
++    if (!ctx->seeded) {
++        RANDerr(RAND_F_FIPS_RAND, RAND_R_PRNG_NOT_SEEDED);
++        return 0;
++    }
++    for (;;) {
++        if (!ctx->test_mode)
++            FIPS_get_timevec(ctx->DT, &ctx->counter);
++        AES_encrypt(ctx->DT, I, &ctx->ks);
++        for (i = 0; i < AES_BLOCK_LENGTH; i++)
++            tmp[i] = I[i] ^ ctx->V[i];
++        AES_encrypt(tmp, R, &ctx->ks);
++        for (i = 0; i < AES_BLOCK_LENGTH; i++)
++            tmp[i] = R[i] ^ I[i];
++        AES_encrypt(tmp, ctx->V, &ctx->ks);
++        /* Continuous PRNG test */
++        if (ctx->second) {
++            if (fips_prng_fail)
++                memcpy(ctx->last, R, AES_BLOCK_LENGTH);
++            if (!memcmp(R, ctx->last, AES_BLOCK_LENGTH)) {
++                RANDerr(RAND_F_FIPS_RAND, RAND_R_PRNG_STUCK);
++                ctx->error = 1;
++                fips_set_selftest_fail();
++                return 0;
++            }
++        }
++        memcpy(ctx->last, R, AES_BLOCK_LENGTH);
++        if (!ctx->second) {
++            ctx->second = 1;
++            if (!ctx->test_mode)
++                continue;
++        }
++
++        if (outlen <= AES_BLOCK_LENGTH) {
++            memcpy(out, R, outlen);
++            break;
++        }
++
++        memcpy(out, R, AES_BLOCK_LENGTH);
++        out += AES_BLOCK_LENGTH;
++        outlen -= AES_BLOCK_LENGTH;
++    }
++    return 1;
++}
++
++int FIPS_x931_set_key(const unsigned char *key, int keylen)
++{
++    int ret;
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    ret = fips_set_prng_key(&sctx, key, keylen);
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++    return ret;
++}
++
++int FIPS_rand_set_key(const unsigned char *key, FIPS_RAND_SIZE_T keylen)
++{
++    return FIPS_x931_set_key(key, keylen);
++}
++
++int FIPS_x931_seed(const void *seed, int seedlen)
++{
++    int ret;
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    ret = fips_set_prng_seed(&sctx, seed, seedlen);
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++    return ret;
++}
++
++int FIPS_x931_bytes(unsigned char *out, int count)
++{
++    int ret;
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    ret = fips_rand(&sctx, out, count);
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++    return ret;
++}
++
++int FIPS_x931_status(void)
++{
++    int ret;
++    CRYPTO_r_lock(CRYPTO_LOCK_RAND);
++    ret = sctx.seeded;
++    CRYPTO_r_unlock(CRYPTO_LOCK_RAND);
++    return ret;
++}
++
++void FIPS_x931_reset(void)
++{
++    CRYPTO_w_lock(CRYPTO_LOCK_RAND);
++    fips_rand_prng_reset(&sctx);
++    CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
++}
++
++static int fips_do_rand_seed(const void *seed, int seedlen)
++{
++    FIPS_x931_seed(seed, seedlen);
++    return 1;
++}
++
++static int fips_do_rand_add(const void *seed, int seedlen, double add_entropy)
++{
++    FIPS_x931_seed(seed, seedlen);
++    return 1;
++}
++
++static const RAND_METHOD rand_x931_meth = {
++    fips_do_rand_seed,
++    FIPS_x931_bytes,
++    FIPS_x931_reset,
++    fips_do_rand_add,
++    FIPS_x931_bytes,
++    FIPS_x931_status
++};
++
++const RAND_METHOD *FIPS_x931_method(void)
++{
++    return &rand_x931_meth;
++}
++
++#endif
+diff --git a/crypto/fips/fips_rand.h b/crypto/fips/fips_rand.h
+new file mode 100644
+index 0000000..1887dda
+--- /dev/null
++++ b/crypto/fips/fips_rand.h
+@@ -0,0 +1,163 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#ifndef HEADER_FIPS_RAND_H
++# define HEADER_FIPS_RAND_H
++
++# include <openssl/aes.h>
++# include <openssl/evp.h>
++# include <openssl/hmac.h>
++# include <openssl/rand.h>
++
++# ifdef OPENSSL_FIPS
++
++#  ifdef  __cplusplus
++extern "C" {
++#  endif
++
++    int FIPS_x931_set_key(const unsigned char *key, int keylen);
++    int FIPS_x931_seed(const void *buf, int num);
++    int FIPS_x931_bytes(unsigned char *out, int outlen);
++
++    int FIPS_x931_test_mode(void);
++    void FIPS_x931_reset(void);
++    int FIPS_x931_set_dt(unsigned char *dt);
++
++    int FIPS_x931_status(void);
++
++    const RAND_METHOD *FIPS_x931_method(void);
++
++typedef struct drbg_ctx_st DRBG_CTX;
++/* DRBG external flags */
++/* Flag for CTR mode only: use derivation function ctr_df */
++#  define DRBG_FLAG_CTR_USE_DF            0x1
++/* PRNG is in test state */
++#  define DRBG_FLAG_TEST                  0x2
++
++    DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags);
++    int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags);
++    int FIPS_drbg_instantiate(DRBG_CTX *dctx,
++                              const unsigned char *pers, size_t perslen);
++    int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin,
++                         size_t adinlen);
++    int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
++                           int prediction_resistance,
++                           const unsigned char *adin, size_t adinlen);
++
++    int FIPS_drbg_uninstantiate(DRBG_CTX *dctx);
++    void FIPS_drbg_free(DRBG_CTX *dctx);
++
++    int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
++                                size_t (*get_entropy) (DRBG_CTX *ctx,
++                                                       unsigned char **pout,
++                                                       int entropy,
++                                                       size_t min_len,
++                                                       size_t max_len),
++                                void (*cleanup_entropy) (DRBG_CTX *ctx,
++                                                         unsigned char *out,
++                                                         size_t olen),
++                                size_t entropy_blocklen,
++                                size_t (*get_nonce) (DRBG_CTX *ctx,
++                                                     unsigned char **pout,
++                                                     int entropy,
++                                                     size_t min_len,
++                                                     size_t max_len),
++                                void (*cleanup_nonce) (DRBG_CTX *ctx,
++                                                       unsigned char *out,
++                                                       size_t olen));
++
++    int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
++                                     size_t (*get_adin) (DRBG_CTX *ctx,
++                                                         unsigned char
++                                                         **pout),
++                                     void (*cleanup_adin) (DRBG_CTX *ctx,
++                                                           unsigned char *out,
++                                                           size_t olen),
++                                     int (*rand_seed_cb) (DRBG_CTX *ctx,
++                                                          const void *buf,
++                                                          int num),
++                                     int (*rand_add_cb) (DRBG_CTX *ctx,
++                                                         const void *buf,
++                                                         int num,
++                                                         double entropy));
++
++    void *FIPS_drbg_get_app_data(DRBG_CTX *ctx);
++    void FIPS_drbg_set_app_data(DRBG_CTX *ctx, void *app_data);
++    size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx);
++    int FIPS_drbg_get_strength(DRBG_CTX *dctx);
++    void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval);
++    void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval);
++
++    int FIPS_drbg_health_check(DRBG_CTX *dctx);
++
++    DRBG_CTX *FIPS_get_default_drbg(void);
++    const RAND_METHOD *FIPS_drbg_method(void);
++
++    int FIPS_rand_set_method(const RAND_METHOD *meth);
++    const RAND_METHOD *FIPS_rand_get_method(void);
++
++    void FIPS_rand_set_bits(int nbits);
++
++    int FIPS_rand_strength(void);
++
++/* 1.0.0 compat functions */
++    int FIPS_rand_set_key(const unsigned char *key, FIPS_RAND_SIZE_T keylen);
++    int FIPS_rand_seed(const void *buf, FIPS_RAND_SIZE_T num);
++    int FIPS_rand_bytes(unsigned char *out, FIPS_RAND_SIZE_T outlen);
++    int FIPS_rand_test_mode(void);
++    void FIPS_rand_reset(void);
++    int FIPS_rand_set_dt(unsigned char *dt);
++    int FIPS_rand_status(void);
++    const RAND_METHOD *FIPS_rand_method(void);
++
++#  ifdef  __cplusplus
++}
++#  endif
++# endif
++#endif
+diff --git a/crypto/fips/fips_rand_lcl.h b/crypto/fips/fips_rand_lcl.h
+new file mode 100644
+index 0000000..d5b016c
+--- /dev/null
++++ b/crypto/fips/fips_rand_lcl.h
+@@ -0,0 +1,211 @@
++/* fips/rand/fips_rand_lcl.h */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++typedef struct drbg_hash_ctx_st DRBG_HASH_CTX;
++typedef struct drbg_hmac_ctx_st DRBG_HMAC_CTX;
++typedef struct drbg_ctr_ctx_st DRBG_CTR_CTX;
++
++/* 888 bits from 10.1 table 2 */
++#define HASH_PRNG_MAX_SEEDLEN   111
++
++struct drbg_hash_ctx_st {
++    const EVP_MD *md;
++    EVP_MD_CTX mctx;
++    unsigned char V[HASH_PRNG_MAX_SEEDLEN];
++    unsigned char C[HASH_PRNG_MAX_SEEDLEN];
++    /* Temporary value storage: should always exceed max digest length */
++    unsigned char vtmp[HASH_PRNG_MAX_SEEDLEN];
++};
++
++struct drbg_hmac_ctx_st {
++    const EVP_MD *md;
++    HMAC_CTX hctx;
++    unsigned char K[EVP_MAX_MD_SIZE];
++    unsigned char V[EVP_MAX_MD_SIZE];
++};
++
++struct drbg_ctr_ctx_st {
++    AES_KEY ks;
++    size_t keylen;
++    unsigned char K[32];
++    unsigned char V[16];
++    /* Temp variables used by derivation function */
++    AES_KEY df_ks;
++    AES_KEY df_kxks;
++    /* Temporary block storage used by ctr_df */
++    unsigned char bltmp[16];
++    size_t bltmp_pos;
++    unsigned char KX[48];
++};
++
++/* DRBG internal flags */
++
++/* Functions shouldn't call err library */
++#define DRBG_FLAG_NOERR                 0x1
++/* Custom reseed checking */
++#define DRBG_CUSTOM_RESEED              0x2
++
++/* DRBG status values */
++/* not initialised */
++#define DRBG_STATUS_UNINITIALISED       0
++/* ok and ready to generate random bits */
++#define DRBG_STATUS_READY               1
++/* reseed required */
++#define DRBG_STATUS_RESEED              2
++/* fatal error condition */
++#define DRBG_STATUS_ERROR               3
++
++/* A default maximum length: larger than any reasonable value used in pratice */
++
++#define DRBG_MAX_LENGTH                 0x7ffffff0
++/* Maximum DRBG block length: all md sizes are bigger than cipher blocks sizes
++ * so use max digest length.
++ */
++#define DRBG_MAX_BLOCK                  EVP_MAX_MD_SIZE
++
++#define DRBG_HEALTH_INTERVAL            (1 << 24)
++
++/* DRBG context structure */
++
++struct drbg_ctx_st {
++    /* First types common to all implementations */
++    /* DRBG type: a NID for the underlying algorithm */
++    int type;
++    /* Various external flags */
++    unsigned int xflags;
++    /* Various internal use only flags */
++    unsigned int iflags;
++    /* Used for periodic health checks */
++    int health_check_cnt, health_check_interval;
++
++    /* The following parameters are setup by mechanism drbg_init() call */
++    int strength;
++    size_t blocklength;
++    size_t max_request;
++
++    size_t min_entropy, max_entropy;
++    size_t min_nonce, max_nonce;
++    size_t max_pers, max_adin;
++    unsigned int reseed_counter;
++    unsigned int reseed_interval;
++    size_t seedlen;
++    int status;
++    /* Application data: typically used by test get_entropy */
++    void *app_data;
++    /* Implementation specific structures */
++    union {
++        DRBG_HASH_CTX hash;
++        DRBG_HMAC_CTX hmac;
++        DRBG_CTR_CTX ctr;
++    } d;
++    /* Initialiase PRNG and setup callbacks below */
++    int (*init) (DRBG_CTX *ctx, int nid, int security, unsigned int flags);
++    /* Intantiate PRNG */
++    int (*instantiate) (DRBG_CTX *ctx,
++                        const unsigned char *ent, size_t entlen,
++                        const unsigned char *nonce, size_t noncelen,
++                        const unsigned char *pers, size_t perslen);
++    /* reseed */
++    int (*reseed) (DRBG_CTX *ctx,
++                   const unsigned char *ent, size_t entlen,
++                   const unsigned char *adin, size_t adinlen);
++    /* generat output */
++    int (*generate) (DRBG_CTX *ctx,
++                     unsigned char *out, size_t outlen,
++                     const unsigned char *adin, size_t adinlen);
++    /* uninstantiate */
++    int (*uninstantiate) (DRBG_CTX *ctx);
++
++    /* Entropy source block length */
++    size_t entropy_blocklen;
++
++    /* entropy gathering function */
++    size_t (*get_entropy) (DRBG_CTX *ctx, unsigned char **pout,
++                           int entropy, size_t min_len, size_t max_len);
++    /* Indicates we have finished with entropy buffer */
++    void (*cleanup_entropy) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++
++    /* nonce gathering function */
++    size_t (*get_nonce) (DRBG_CTX *ctx, unsigned char **pout,
++                         int entropy, size_t min_len, size_t max_len);
++    /* Indicates we have finished with nonce buffer */
++    void (*cleanup_nonce) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++
++    /* Continuous random number test temporary area */
++    /* Last block */
++    unsigned char lb[EVP_MAX_MD_SIZE];
++    /* set if lb is valid */
++    int lb_valid;
++
++    /* Callbacks used when called through RAND interface */
++    /* Get any additional input for generate */
++    size_t (*get_adin) (DRBG_CTX *ctx, unsigned char **pout);
++    void (*cleanup_adin) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++    /* Callback for RAND_seed(), RAND_add() */
++    int (*rand_seed_cb) (DRBG_CTX *ctx, const void *buf, int num);
++    int (*rand_add_cb) (DRBG_CTX *ctx,
++                        const void *buf, int num, double entropy);
++};
++
++int fips_drbg_ctr_init(DRBG_CTX *dctx);
++int fips_drbg_hash_init(DRBG_CTX *dctx);
++int fips_drbg_hmac_init(DRBG_CTX *dctx);
++int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags);
++int fips_drbg_cprng_test(DRBG_CTX *dctx, const unsigned char *out);
++
++const struct env_md_st *FIPS_get_digestbynid(int nid);
++
++#define FIPS_digestinit EVP_DigestInit
++#define FIPS_digestupdate EVP_DigestUpdate
++#define FIPS_digestfinal EVP_DigestFinal
++#define M_EVP_MD_size EVP_MD_size
+diff --git a/crypto/fips/fips_rand_lib.c b/crypto/fips/fips_rand_lib.c
+new file mode 100644
+index 0000000..fc129ee
+--- /dev/null
++++ b/crypto/fips/fips_rand_lib.c
+@@ -0,0 +1,182 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <openssl/crypto.h>
++#include <openssl/rand.h>
++#include <openssl/err.h>
++#include "e_os.h"
++
++#ifdef OPENSSL_FIPS
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++
++/* FIPS API for PRNG use. Similar to RAND functionality but without
++ * ENGINE and additional checking for non-FIPS rand methods.
++ */
++
++static const RAND_METHOD *fips_rand_meth = NULL;
++static int fips_approved_rand_meth = 0;
++static int fips_rand_bits = 0;
++
++/* Allows application to override number of bits and uses non-FIPS methods */
++void FIPS_rand_set_bits(int nbits)
++{
++    fips_rand_bits = nbits;
++}
++
++int FIPS_rand_set_method(const RAND_METHOD *meth)
++{
++    if (!fips_rand_bits) {
++        if (meth == FIPS_drbg_method())
++            fips_approved_rand_meth = 1;
++        else {
++            fips_approved_rand_meth = 0;
++            if (FIPS_module_mode()) {
++                FIPSerr(FIPS_F_FIPS_RAND_SET_METHOD, FIPS_R_NON_FIPS_METHOD);
++                return 0;
++            }
++        }
++    }
++    fips_rand_meth = meth;
++    return 1;
++}
++
++const RAND_METHOD *FIPS_rand_get_method(void)
++{
++    return fips_rand_meth;
++}
++
++const RAND_METHOD *FIPS_rand_method(void)
++{
++    return FIPS_rand_get_method();
++}
++
++void FIPS_rand_reset(void)
++{
++    if (fips_rand_meth && fips_rand_meth->cleanup)
++        fips_rand_meth->cleanup();
++}
++
++int FIPS_rand_seed(const void *buf, FIPS_RAND_SIZE_T num)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_SEED, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->seed)
++        fips_rand_meth->seed(buf, num);
++    return 1;
++}
++
++void FIPS_rand_add(const void *buf, int num, double entropy)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_ADD, FIPS_R_NON_FIPS_METHOD);
++        return;
++    }
++    if (fips_rand_meth && fips_rand_meth->add)
++        fips_rand_meth->add(buf, num, entropy);
++}
++
++int FIPS_rand_bytes(unsigned char *buf, FIPS_RAND_SIZE_T num)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_BYTES, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->bytes)
++        return fips_rand_meth->bytes(buf, num);
++    return 0;
++}
++
++int FIPS_rand_pseudo_bytes(unsigned char *buf, int num)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_PSEUDO_BYTES, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->pseudorand)
++        return fips_rand_meth->pseudorand(buf, num);
++    return -1;
++}
++
++int FIPS_rand_status(void)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_STATUS, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->status)
++        return fips_rand_meth->status();
++    return 0;
++}
++
++/* Return instantiated strength of PRNG. For DRBG this is an internal
++ * parameter. For X9.31 PRNG it is 80 bits (from SP800-131). Any other
++ * type of PRNG is not approved and returns 0 in FIPS mode and maximum
++ * 256 outside FIPS mode.
++ */
++
++int FIPS_rand_strength(void)
++{
++    if (fips_rand_bits)
++        return fips_rand_bits;
++    if (fips_approved_rand_meth == 1)
++        return FIPS_drbg_get_strength(FIPS_get_default_drbg());
++    else if (fips_approved_rand_meth == 2)
++        return 80;
++    else if (fips_approved_rand_meth == 0) {
++        if (FIPS_module_mode())
++            return 0;
++        else
++            return 256;
++    }
++    return 0;
++}
++#endif
+diff --git a/crypto/fips/fips_rand_selftest.c b/crypto/fips/fips_rand_selftest.c
+new file mode 100644
+index 0000000..6eb69ce
+--- /dev/null
++++ b/crypto/fips/fips_rand_selftest.c
+@@ -0,0 +1,176 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++typedef struct {
++    unsigned char DT[16];
++    unsigned char V[16];
++    unsigned char R[16];
++} AES_PRNG_TV;
++
++/* The following test vectors are taken directly from the RGNVS spec */
++
++static unsigned char aes_128_key[16] =
++    { 0xf3, 0xb1, 0x66, 0x6d, 0x13, 0x60, 0x72, 0x42,
++    0xed, 0x06, 0x1c, 0xab, 0xb8, 0xd4, 0x62, 0x02
++};
++
++static AES_PRNG_TV aes_128_tv = {
++    /* DT */
++    {0xe6, 0xb3, 0xbe, 0x78, 0x2a, 0x23, 0xfa, 0x62,
++     0xd7, 0x1d, 0x4a, 0xfb, 0xb0, 0xe9, 0x22, 0xf9},
++    /* V */
++    {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
++    /* R */
++    {0x59, 0x53, 0x1e, 0xd1, 0x3b, 0xb0, 0xc0, 0x55,
++     0x84, 0x79, 0x66, 0x85, 0xc1, 0x2f, 0x76, 0x41}
++};
++
++static unsigned char aes_192_key[24] =
++    { 0x15, 0xd8, 0x78, 0x0d, 0x62, 0xd3, 0x25, 0x6e,
++    0x44, 0x64, 0x10, 0x13, 0x60, 0x2b, 0xa9, 0xbc,
++    0x4a, 0xfb, 0xca, 0xeb, 0x4c, 0x8b, 0x99, 0x3b
++};
++
++static AES_PRNG_TV aes_192_tv = {
++    /* DT */
++    {0x3f, 0xd8, 0xff, 0xe8, 0x80, 0x69, 0x8b, 0xc1,
++     0xbf, 0x99, 0x7d, 0xa4, 0x24, 0x78, 0xf3, 0x4b},
++    /* V */
++    {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
++    /* R */
++    {0x17, 0x07, 0xd5, 0x28, 0x19, 0x79, 0x1e, 0xef,
++     0xa5, 0x0c, 0xbf, 0x25, 0xe5, 0x56, 0xb4, 0x93}
++};
++
++static unsigned char aes_256_key[32] =
++    { 0x6d, 0x14, 0x06, 0x6c, 0xb6, 0xd8, 0x21, 0x2d,
++    0x82, 0x8d, 0xfa, 0xf2, 0x7a, 0x03, 0xb7, 0x9f,
++    0x0c, 0xc7, 0x3e, 0xcd, 0x76, 0xeb, 0xee, 0xb5,
++    0x21, 0x05, 0x8c, 0x4f, 0x31, 0x7a, 0x80, 0xbb
++};
++
++static AES_PRNG_TV aes_256_tv = {
++    /* DT */
++    {0xda, 0x3a, 0x41, 0xec, 0x1d, 0xa3, 0xb0, 0xd5,
++     0xf2, 0xa9, 0x4e, 0x34, 0x74, 0x8e, 0x9e, 0x88},
++    /* V */
++    {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
++    /* R */
++    {0x35, 0xc7, 0xef, 0xa7, 0x78, 0x4d, 0x29, 0xbc,
++     0x82, 0x79, 0x99, 0xfb, 0xd0, 0xb3, 0x3b, 0x72}
++};
++
++void FIPS_corrupt_rng()
++{
++    aes_192_tv.V[0]++;
++}
++
++# define fips_x931_test(key, tv) \
++        do_x931_test(key, sizeof key, &tv)
++
++static int do_x931_test(unsigned char *key, int keylen, AES_PRNG_TV * tv)
++{
++    unsigned char R[16], V[16];
++    int rv = 1;
++    memcpy(V, tv->V, sizeof(V));
++    if (!FIPS_x931_set_key(key, keylen))
++        return 0;
++    if (!fips_post_started(FIPS_TEST_X931, keylen, NULL))
++        return 1;
++    if (!fips_post_corrupt(FIPS_TEST_X931, keylen, NULL))
++        V[0]++;
++    FIPS_x931_seed(V, 16);
++    FIPS_x931_set_dt(tv->DT);
++    FIPS_x931_bytes(R, 16);
++    if (memcmp(R, tv->R, 16)) {
++        fips_post_failed(FIPS_TEST_X931, keylen, NULL);
++        rv = 0;
++    } else if (!fips_post_success(FIPS_TEST_X931, keylen, NULL))
++        return 0;
++    return rv;
++}
++
++int FIPS_selftest_x931()
++{
++    int rv = 1;
++    FIPS_x931_reset();
++    if (!FIPS_x931_test_mode()) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_X931, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++    if (!fips_x931_test(aes_128_key, aes_128_tv))
++        rv = 0;
++    if (!fips_x931_test(aes_192_key, aes_192_tv))
++        rv = 0;
++    if (!fips_x931_test(aes_256_key, aes_256_tv))
++        rv = 0;
++    FIPS_x931_reset();
++    if (!rv)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_X931, FIPS_R_SELFTEST_FAILED);
++    return rv;
++}
++
++int FIPS_selftest_rng(void)
++{
++    return FIPS_selftest_x931();
++}
++
++#endif
+diff --git a/crypto/fips/fips_randtest.c b/crypto/fips/fips_randtest.c
+new file mode 100644
+index 0000000..4e71c17
+--- /dev/null
++++ b/crypto/fips/fips_randtest.c
+@@ -0,0 +1,247 @@
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ *
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ *
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <ctype.h>
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include <openssl/err.h>
++#include <openssl/bn.h>
++
++#include "e_os.h"
++
++#ifndef OPENSSL_FIPS
++int main(int argc, char *argv[])
++{
++    printf("No FIPS RAND support\n");
++    return (0);
++}
++
++#else
++
++# include "fips_utl.h"
++# include <openssl/fips.h>
++
++typedef struct {
++    unsigned char DT[16];
++    unsigned char V[16];
++    unsigned char R[16];
++} AES_PRNG_MCT;
++
++static const unsigned char aes_128_mct_key[16] =
++    { 0x9f, 0x5b, 0x51, 0x20, 0x0b, 0xf3, 0x34, 0xb5,
++    0xd8, 0x2b, 0xe8, 0xc3, 0x72, 0x55, 0xc8, 0x48
++};
++
++static const AES_PRNG_MCT aes_128_mct_tv = {
++    /* DT */
++    {0x63, 0x76, 0xbb, 0xe5, 0x29, 0x02, 0xba, 0x3b,
++     0x67, 0xc9, 0x25, 0xfa, 0x70, 0x1f, 0x11, 0xac},
++    /* V */
++    {0x57, 0x2c, 0x8e, 0x76, 0x87, 0x26, 0x47, 0x97,
++     0x7e, 0x74, 0xfb, 0xdd, 0xc4, 0x95, 0x01, 0xd1},
++    /* R */
++    {0x48, 0xe9, 0xbd, 0x0d, 0x06, 0xee, 0x18, 0xfb,
++     0xe4, 0x57, 0x90, 0xd5, 0xc3, 0xfc, 0x9b, 0x73}
++};
++
++static const unsigned char aes_192_mct_key[24] =
++    { 0xb7, 0x6c, 0x34, 0xd1, 0x09, 0x67, 0xab, 0x73,
++    0x4d, 0x5a, 0xd5, 0x34, 0x98, 0x16, 0x0b, 0x91,
++    0xbc, 0x35, 0x51, 0x16, 0x6b, 0xae, 0x93, 0x8a
++};
++
++static const AES_PRNG_MCT aes_192_mct_tv = {
++    /* DT */
++    {0x84, 0xce, 0x22, 0x7d, 0x91, 0x5a, 0xa3, 0xc9,
++     0x84, 0x3c, 0x0a, 0xb3, 0xa9, 0x63, 0x15, 0x52},
++    /* V */
++    {0xb6, 0xaf, 0xe6, 0x8f, 0x99, 0x9e, 0x90, 0x64,
++     0xdd, 0xc7, 0x7a, 0xc1, 0xbb, 0x90, 0x3a, 0x6d},
++    /* R */
++    {0xfc, 0x85, 0x60, 0x9a, 0x29, 0x6f, 0xef, 0x21,
++     0xdd, 0x86, 0x20, 0x32, 0x8a, 0x29, 0x6f, 0x47}
++};
++
++static const unsigned char aes_256_mct_key[32] =
++    { 0x9b, 0x05, 0xc8, 0x68, 0xff, 0x47, 0xf8, 0x3a,
++    0xa6, 0x3a, 0xa8, 0xcb, 0x4e, 0x71, 0xb2, 0xe0,
++    0xb8, 0x7e, 0xf1, 0x37, 0xb6, 0xb4, 0xf6, 0x6d,
++    0x86, 0x32, 0xfc, 0x1f, 0x5e, 0x1d, 0x1e, 0x50
++};
++
++static const AES_PRNG_MCT aes_256_mct_tv = {
++    /* DT */
++    {0x31, 0x6e, 0x35, 0x9a, 0xb1, 0x44, 0xf0, 0xee,
++     0x62, 0x6d, 0x04, 0x46, 0xe0, 0xa3, 0x92, 0x4c},
++    /* V */
++    {0x4f, 0xcd, 0xc1, 0x87, 0x82, 0x1f, 0x4d, 0xa1,
++     0x3e, 0x0e, 0x56, 0x44, 0x59, 0xe8, 0x83, 0xca},
++    /* R */
++    {0xc8, 0x87, 0xc2, 0x61, 0x5b, 0xd0, 0xb9, 0xe1,
++     0xe7, 0xf3, 0x8b, 0xd7, 0x5b, 0xd5, 0xf1, 0x8d}
++};
++
++static void dump(const unsigned char *b, int n)
++{
++    while (n-- > 0) {
++        printf(" %02x", *b++);
++    }
++}
++
++static void compare(const unsigned char *result,
++                    const unsigned char *expected, int n)
++{
++    int i;
++
++    for (i = 0; i < n; ++i)
++        if (result[i] != expected[i]) {
++            puts("Random test failed, got:");
++            dump(result, n);
++            puts("\n               expected:");
++            dump(expected, n);
++            putchar('\n');
++            EXIT(1);
++        }
++}
++
++static void run_test(const unsigned char *key, int keylen,
++                     const AES_PRNG_MCT * tv)
++{
++    unsigned char buf[16], dt[16];
++    int i, j;
++    FIPS_x931_reset();
++    FIPS_x931_test_mode();
++    FIPS_x931_set_key(key, keylen);
++    FIPS_x931_seed(tv->V, 16);
++    memcpy(dt, tv->DT, 16);
++    for (i = 0; i < 10000; i++) {
++        FIPS_x931_set_dt(dt);
++        FIPS_x931_bytes(buf, 16);
++        /* Increment DT */
++        for (j = 15; j >= 0; j--) {
++            dt[j]++;
++            if (dt[j])
++                break;
++        }
++    }
++
++    compare(buf, tv->R, 16);
++}
++
++int main()
++{
++    run_test(aes_128_mct_key, 16, &aes_128_mct_tv);
++    printf("FIPS PRNG test 1 done\n");
++    run_test(aes_192_mct_key, 24, &aes_192_mct_tv);
++    printf("FIPS PRNG test 2 done\n");
++    run_test(aes_256_mct_key, 32, &aes_256_mct_tv);
++    printf("FIPS PRNG test 3 done\n");
++    return 0;
++}
++
++#endif
+diff --git a/crypto/fips/fips_rsa_selftest.c b/crypto/fips/fips_rsa_selftest.c
+new file mode 100644
+index 0000000..d625c05
+--- /dev/null
++++ b/crypto/fips/fips_rsa_selftest.c
+@@ -0,0 +1,553 @@
++/* ====================================================================
++ * Copyright (c) 2003-2007 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/rsa.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++#include <openssl/opensslconf.h>
++
++#ifdef OPENSSL_FIPS
++
++static const unsigned char n[] =
++    "\x00\xc9\xd5\x6d\x9d\x90\xdb\x43\xd6\x02\xed\x96\x88\x13\x8a"
++    "\xb2\xbf\x6e\xa1\x06\x10\xb2\x78\x37\xa7\x14\xa8\xff\xdd\x00"
++    "\xdd\xb4\x93\xa0\x45\xcc\x96\x90\xed\xad\xa9\xdd\xc4\xd6\xca"
++    "\x0c\xf0\xed\x4f\x72\x5e\x21\x49\x9a\x18\x12\x15\x8f\x90\x5a"
++    "\xdb\xb6\x33\x99\xa3\xe6\xb4\xf0\xc4\x97\x21\x26\xbb\xe3\xba"
++    "\xf2\xff\xa0\x72\xda\x89\x63\x8e\x8b\x3e\x08\x9d\x92\x2a\xbe"
++    "\x16\xe1\x43\x15\xfc\x57\xc7\x1f\x09\x11\x67\x1c\xa9\x96\xd1"
++    "\x8b\x3e\x80\x93\xc1\x59\xd0\x6d\x39\xf2\xac\x95\xcc\x10\x75"
++    "\xe9\x31\x24\xd1\x43\xaf\x68\x52\x4b\xe7\x16\xd7\x49\x65\x6f"
++    "\x26\xc0\x86\xad\xc0\x07\x0a\xc1\xe1\x2f\x87\x85\x86\x3b\xdc"
++    "\x5a\x99\xbe\xe9\xf9\xb9\xe9\x82\x27\x51\x04\x15\xab\x06\x0e"
++    "\x76\x5a\x28\x8d\x92\xbd\xc5\xb5\x7b\xa8\xdf\x4e\x47\xa2\xc1"
++    "\xe7\x52\xbf\x47\xf7\x62\xe0\x3a\x6f\x4d\x6a\x4d\x4e\xd4\xb9"
++    "\x59\x69\xfa\xb2\x14\xc1\xee\xe6\x2f\x95\xcd\x94\x72\xae\xe4"
++    "\xdb\x18\x9a\xc4\xcd\x70\xbd\xee\x31\x16\xb7\x49\x65\xac\x40"
++    "\x19\x0e\xb5\x6d\x83\xf1\x36\xbb\x08\x2f\x2e\x4e\x92\x62\xa4"
++    "\xff\x50\xdb\x20\x45\xa2\xeb\x16\x7a\xf2\xd5\x28\xc1\xfd\x4e" "\x03\x71";
++
++static int corrupt_rsa;
++
++static int setrsakey(RSA *key)
++{
++    static const unsigned char e[] = "\x01\x00\x01";
++
++    static const unsigned char d[] =
++        "\x36\x27\x3d\xb1\xf9\x1b\xdb\xa7\xa0\x41\x7f\x12\x23\xac\x23"
++        "\x29\x99\xd5\x3a\x7b\x60\x67\x41\x07\x63\x53\xb4\xd2\xe7\x58"
++        "\x95\x0a\xc7\x05\xf3\x4e\xb2\xb4\x12\xd4\x70\xdc\x4f\x85\x06"
++        "\xd3\xdd\xd8\x63\x27\x3e\x67\x31\x21\x24\x39\x04\xbc\x06\xa4"
++        "\xcc\xce\x2b\x7a\xfe\x7b\xad\xde\x11\x6e\xa3\xa5\xe6\x04\x53"
++        "\x0e\xa3\x4e\x2d\xb4\x8f\x31\xbf\xca\x75\x25\x52\x02\x85\xde"
++        "\x3d\xb2\x72\x43\xb2\x89\x8a\x9a\x34\x41\x26\x3f\x9a\x67\xbe"
++        "\xa4\x96\x7b\x0e\x75\xba\xa6\x93\xd5\xb8\xd8\xb8\x57\xf2\x4b"
++        "\x0f\x14\x81\xd1\x57\x4e\xf6\x45\x4c\xa6\x3b\xd0\x70\xca\xd3"
++        "\x9d\x55\xde\x22\x05\xe7\x8e\x28\x4d\xee\x11\xcf\xb6\x67\x76"
++        "\x09\xd3\xe3\x3c\x13\xf9\x99\x34\x10\x7b\xec\x81\x38\xf0\xb6"
++        "\x34\x9c\x9b\x50\x6f\x0b\x91\x81\x4d\x89\x94\x04\x7b\xf0\x3c"
++        "\xf4\xb1\xb2\x00\x48\x8d\x5a\x8f\x88\x9e\xc5\xab\x3a\x9e\x44"
++        "\x3f\x54\xe7\xd9\x6e\x47\xaa\xa1\xbd\x40\x46\x31\xf9\xf0\x34"
++        "\xb6\x04\xe1\x2b\x5b\x73\x86\xdd\x3a\x92\x1b\x71\xc7\x3f\x32"
++        "\xe5\xc3\xc2\xab\xa1\x7e\xbf\xa4\x52\xa0\xb0\x68\x90\xd1\x20"
++        "\x12\x79\xe9\xd7\xc9\x40\xba\xf2\x19\xc7\xa5\x00\x92\x86\x0d" "\x01";
++
++    static const unsigned char p[] =
++        "\x00\xfc\x5c\x6e\x16\xce\x1f\x03\x7b\xcd\xf7\xb3\x72\xb2\x8f"
++        "\x16\x72\xb8\x56\xae\xf7\xcd\x67\xd8\x4e\x7d\x07\xaf\xd5\x43"
++        "\x26\xc3\x35\xbe\x43\x8f\x4e\x2f\x1c\x43\x4e\x6b\xd2\xb2\xec"
++        "\x52\x6d\x97\x52\x2b\xcc\x5c\x3a\x6b\xf4\x14\xc6\x74\xda\x66"
++        "\x38\x1c\x7a\x3f\x84\x2f\xe3\xf9\x5a\xb8\x65\x69\x46\x06\xa3"
++        "\x37\x79\xb2\xa1\x5b\x58\xed\x5e\xa7\x5f\x8c\x65\x66\xbb\xd1"
++        "\x24\x36\xe6\x37\xa7\x3d\x49\x77\x8a\x8c\x34\xd8\x69\x29\xf3"
++        "\x4d\x58\x22\xb0\x51\x24\xb6\x40\xa8\x86\x59\x0a\xb7\xba\x5c"
++        "\x97\xda\x57\xe8\x36\xda\x7a\x9c\xad";
++
++    static const unsigned char q[] =
++        "\x00\xcc\xbe\x7b\x09\x69\x06\xee\x45\xbf\x88\x47\x38\xa8\xf8"
++        "\x17\xe5\xb6\xba\x67\x55\xe3\xe8\x05\x8b\xb8\xe2\x53\xd6\x8e"
++        "\xef\x2c\xe7\x4f\x4a\xf7\x4e\x26\x8d\x85\x0b\x3f\xec\xc3\x1c"
++        "\xd4\xeb\xec\x6a\xc8\x72\x2a\x25\x7d\xfd\xa6\x77\x96\xf0\x1e"
++        "\xcd\x28\x57\xf8\x37\x30\x75\x6b\xbd\xd4\x7b\x0c\x87\xc5\x6c"
++        "\x87\x40\xa5\xbb\x27\x2c\x78\xc9\x74\x5a\x54\x5b\x0b\x30\x6f"
++        "\x44\x4a\xfa\x71\xe4\x21\x61\x66\xf9\xee\x65\xde\x7c\x04\xd7"
++        "\xfd\xa9\x15\x5b\x7f\xe2\x7a\xba\x69\x86\x72\xa6\x06\x8d\x9b"
++        "\x90\x55\x60\x9e\x4c\x5d\xa9\xb6\x55";
++
++    static const unsigned char dmp1[] =
++        "\x7a\xd6\x12\xd0\x0e\xec\x91\xa9\x85\x8b\xf8\x50\xf0\x11\x2e"
++        "\x00\x11\x32\x40\x60\x66\x1f\x11\xee\xc2\x75\x27\x65\x4b\x16"
++        "\x67\x16\x95\xd2\x14\xc3\x1d\xb3\x48\x1f\xb7\xe4\x0b\x2b\x74"
++        "\xc3\xdb\x50\x27\xf9\x85\x3a\xfa\xa9\x08\x23\xc1\x65\x3d\x34"
++        "\x3a\xc8\x56\x7a\x65\x45\x36\x6e\xae\x2a\xce\x9f\x43\x43\xd7"
++        "\x10\xe9\x9e\x18\xf4\xa4\x35\xda\x8a\x6b\xb0\x3f\xdd\x53\xe3"
++        "\xa8\xc5\x4e\x79\x9d\x1f\x51\x8c\xa2\xca\x66\x3c\x6a\x2a\xff"
++        "\x8e\xd2\xf3\xb7\xcb\x82\xda\xde\x2c\xe6\xd2\x8c\xb3\xad\xb6"
++        "\x4c\x95\x55\x76\xbd\xc9\xc8\xd1";
++
++    static const unsigned char dmq1[] =
++        "\x00\x83\x23\x1d\xbb\x11\x42\x17\x2b\x25\x5a\x2c\x03\xe6\x75"
++        "\xc1\x18\xa8\xc9\x0b\x96\xbf\xba\xc4\x92\x91\x80\xa5\x22\x2f"
++        "\xba\x91\x90\x36\x01\x56\x15\x00\x2c\x74\xa2\x97\xf7\x15\xa1"
++        "\x49\xdf\x32\x35\xd2\xdd\x0c\x91\xa6\xf8\xe7\xbe\x81\x36\x9b"
++        "\x03\xdc\x6b\x3b\xd8\x5d\x79\x57\xe0\xe6\x4f\x49\xdf\x4c\x5c"
++        "\x0e\xe5\x21\x41\x95\xfd\xad\xff\x9a\x3e\xa0\xf9\x0f\x59\x9e"
++        "\x6a\xa7\x7b\x71\xa7\x24\x9a\x36\x52\xae\x97\x20\xc1\x5e\x78"
++        "\xd9\x47\x8b\x1e\x67\xf2\xaf\x98\xe6\x2d\xef\x10\xd7\xf1\xab"
++        "\x49\xee\xe5\x4b\x7e\xae\x1f\x1d\x61";
++
++    static const unsigned char iqmp[] =
++        "\x23\x96\xc1\x91\x17\x5e\x0a\x83\xd2\xdc\x7b\x69\xb2\x59\x1d"
++        "\x33\x58\x52\x3f\x18\xc7\x09\x50\x1c\xb9\xa1\xbb\x4c\xa2\x38"
++        "\x40\x4c\x9a\x8e\xfe\x9c\x90\x92\xd0\x71\x9f\x89\x99\x50\x91"
++        "\x1f\x34\x8b\x74\x53\x11\x11\x4a\x70\xe2\xf7\x30\xd8\x8c\x80"
++        "\xe1\xcc\x9f\xf1\x63\x17\x1a\x7d\x67\x29\x4c\xcb\x4e\x74\x7b"
++        "\xe0\x3e\x9e\x2f\xf4\x67\x8f\xec\xb9\x5c\x00\x1e\x7e\xa2\x7b"
++        "\x92\xc9\x6f\x4c\xe4\x0e\xf9\x48\x63\xcd\x50\x22\x5d\xbf\xb6"
++        "\x9d\x01\x33\x6a\xf4\x50\xbe\x86\x98\x4f\xca\x3f\x3a\xfa\xcf"
++        "\x07\x40\xc4\xaa\xad\xae\xbe\xbf";
++
++    key->n = BN_bin2bn(n, sizeof(n) - 1, key->n);
++    if (corrupt_rsa)
++        BN_set_bit(key->n, 2048);
++    key->e = BN_bin2bn(e, sizeof(e) - 1, key->e);
++    key->d = BN_bin2bn(d, sizeof(d) - 1, key->d);
++    key->p = BN_bin2bn(p, sizeof(p) - 1, key->p);
++    key->q = BN_bin2bn(q, sizeof(q) - 1, key->q);
++    key->dmp1 = BN_bin2bn(dmp1, sizeof(dmp1) - 1, key->dmp1);
++    key->dmq1 = BN_bin2bn(dmq1, sizeof(dmq1) - 1, key->dmq1);
++    key->iqmp = BN_bin2bn(iqmp, sizeof(iqmp) - 1, key->iqmp);
++    return 1;
++}
++
++void FIPS_corrupt_rsa()
++{
++    corrupt_rsa = 1;
++}
++
++/* Known Answer Test (KAT) data for the above RSA private key signing
++ * kat_tbs.
++ */
++
++static const unsigned char kat_tbs[] =
++    "OpenSSL FIPS 140-2 Public Key RSA KAT";
++
++static const unsigned char kat_RSA_PSS_SHA1[] = {
++    0xC2, 0x80, 0x82, 0x56, 0xD8, 0xA7, 0xB2, 0x9C, 0xF5, 0xD6, 0x3C, 0xE3,
++    0xBF, 0xE9, 0x3A, 0x53, 0x40, 0xAE, 0xF2, 0xA9, 0x6A, 0x39, 0x49, 0x5B,
++    0x05, 0x7F, 0x67, 0x38, 0x2E, 0x1D, 0xE1, 0x93, 0x22, 0x65, 0x79, 0x84,
++    0x68, 0xFA, 0xD8, 0xAF, 0xA1, 0x98, 0x61, 0x6F, 0x44, 0x27, 0xA6, 0x8B,
++    0xCF, 0x0E, 0x13, 0xA9, 0xCE, 0xD7, 0x6C, 0xD2, 0x38, 0xB5, 0x16, 0xB9,
++    0x66, 0x94, 0x48, 0xDE, 0x9E, 0x19, 0x3D, 0x6F, 0xB3, 0xA1, 0x9A, 0x19,
++    0xDF, 0xFB, 0xAB, 0xA5, 0x9F, 0x38, 0xDA, 0xC9, 0x21, 0x8F, 0xCE, 0x98,
++    0x01, 0x3A, 0xC8, 0xE0, 0xDF, 0xDA, 0xFC, 0xF0, 0xA6, 0x86, 0x29, 0xB5,
++    0x7F, 0x61, 0xFB, 0xBA, 0xC5, 0x49, 0xB2, 0x7C, 0x6A, 0x26, 0x82, 0xC4,
++    0x8F, 0xAA, 0x5B, 0x10, 0xD5, 0xEE, 0xA0, 0x55, 0x42, 0xEF, 0x32, 0x5A,
++    0x3F, 0x55, 0xB3, 0x2C, 0x22, 0xE9, 0x65, 0xDA, 0x8D, 0x0A, 0xB9, 0x70,
++    0x43, 0xCC, 0x3F, 0x64, 0x9C, 0xB5, 0x65, 0x49, 0xBD, 0x7F, 0x35, 0xC1,
++    0x20, 0x85, 0x24, 0xFE, 0xAA, 0x6B, 0x37, 0x04, 0xA1, 0x0E, 0x9D, 0x5C,
++    0xBA, 0x7F, 0x14, 0x69, 0xC5, 0x93, 0xB2, 0x33, 0xC2, 0xC0, 0xC7, 0xDF,
++    0x7E, 0x9E, 0xA4, 0xB0, 0xA0, 0x64, 0xD2, 0xAC, 0xFC, 0xFD, 0xFD, 0x99,
++    0x8F, 0x6A, 0x40, 0x26, 0xC1, 0x2E, 0x4E, 0x8B, 0x33, 0xBE, 0xF1, 0x45,
++    0x59, 0x8F, 0x33, 0x40, 0x1D, 0x2A, 0xD2, 0xF7, 0x50, 0x83, 0x89, 0xCF,
++    0x94, 0xC6, 0xF8, 0x36, 0xF0, 0x84, 0x0B, 0x85, 0xA5, 0x02, 0xA9, 0x0F,
++    0x41, 0x7A, 0x77, 0xA3, 0x2F, 0x47, 0x1E, 0x1D, 0xEC, 0xE6, 0xD3, 0x01,
++    0x1E, 0x6F, 0x7A, 0x96, 0x50, 0x37, 0x37, 0x4B, 0x27, 0x52, 0x0B, 0xDC,
++    0xDB, 0xC7, 0xA9, 0x31, 0xB2, 0x40, 0xEE, 0x60, 0x41, 0x26, 0x6A, 0x05,
++    0xCE, 0x08, 0x1D, 0x89
++};
++
++static const unsigned char kat_RSA_PSS_SHA224[] = {
++    0xB4, 0x01, 0x93, 0x16, 0x05, 0xF6, 0xEB, 0xE2, 0xA4, 0xEB, 0x48, 0xAA,
++    0x00, 0xF4, 0xA1, 0x99, 0x0A, 0xB4, 0xB6, 0x63, 0xE9, 0x68, 0xCA, 0xB3,
++    0x13, 0xD7, 0x66, 0x6A, 0xCD, 0xCB, 0x33, 0x9F, 0xE5, 0x84, 0xE2, 0xC3,
++    0x0B, 0x53, 0xE5, 0x8B, 0x96, 0x4B, 0xDB, 0x2D, 0x80, 0xA4, 0x1D, 0xE3,
++    0x81, 0xDC, 0x52, 0x99, 0xBA, 0x9B, 0x6A, 0x9D, 0x48, 0x1F, 0x73, 0xF7,
++    0xAC, 0x09, 0x13, 0xA1, 0x16, 0x2C, 0x60, 0xFB, 0xBC, 0x25, 0xF7, 0x53,
++    0xD1, 0x04, 0x5A, 0x3F, 0x95, 0x09, 0x5E, 0xE5, 0xA2, 0x7D, 0xFC, 0x2A,
++    0x51, 0x1D, 0x21, 0xCE, 0x2B, 0x4E, 0x1B, 0xB8, 0xCB, 0xDD, 0x24, 0xEE,
++    0x99, 0x1D, 0x37, 0xDC, 0xED, 0x5F, 0x2F, 0x48, 0x5E, 0x33, 0x94, 0x06,
++    0x19, 0xCD, 0x5A, 0x26, 0x85, 0x77, 0x9D, 0xAF, 0x86, 0x97, 0xC9, 0x08,
++    0xD5, 0x81, 0x0E, 0xB8, 0x9F, 0xB6, 0xAF, 0x20, 0x72, 0xDC, 0x13, 0x4D,
++    0x7A, 0xE4, 0x5C, 0x81, 0xDE, 0xC0, 0x3D, 0x19, 0x9C, 0x33, 0x11, 0x07,
++    0xD5, 0xA9, 0x51, 0x67, 0xCD, 0xFD, 0x37, 0x61, 0x14, 0x9F, 0xE7, 0x70,
++    0x18, 0x32, 0xC3, 0x34, 0x54, 0x0D, 0x4F, 0xB4, 0xAE, 0x9F, 0xEC, 0x64,
++    0xD8, 0xB2, 0x16, 0xA4, 0xB2, 0x99, 0x92, 0xCB, 0x7F, 0x1F, 0x06, 0x17,
++    0x5F, 0xA1, 0x07, 0x68, 0xAE, 0xA7, 0x2D, 0x03, 0x91, 0x2A, 0x9D, 0x69,
++    0xC2, 0x9D, 0x90, 0xF7, 0xF9, 0x66, 0x5D, 0x13, 0xB7, 0x7F, 0xD3, 0x97,
++    0x45, 0x97, 0x43, 0xD8, 0xCE, 0x3C, 0xF2, 0x98, 0x98, 0xDD, 0xE2, 0x2D,
++    0xCF, 0xA1, 0xC4, 0x25, 0x46, 0x2E, 0xD2, 0xE5, 0x5F, 0xC6, 0x01, 0xC5,
++    0x4F, 0x42, 0x2B, 0xDE, 0x0F, 0xEA, 0x4A, 0x4F, 0xC3, 0x5B, 0xDF, 0x9B,
++    0x5D, 0x30, 0x18, 0x93, 0xD0, 0xDE, 0xC5, 0x09, 0xAA, 0x57, 0x57, 0xBD,
++    0x2D, 0x84, 0x03, 0xB7
++};
++
++static const unsigned char kat_RSA_PSS_SHA256[] = {
++    0x38, 0xDA, 0x99, 0x51, 0x26, 0x38, 0xC6, 0x7F, 0xC4, 0x81, 0x57, 0x19,
++    0x35, 0xC6, 0xF6, 0x1E, 0x90, 0x47, 0x20, 0x55, 0x47, 0x56, 0x26, 0xE9,
++    0xF2, 0xA8, 0x39, 0x6C, 0xD5, 0xCD, 0xCB, 0x55, 0xFC, 0x0C, 0xC5, 0xCB,
++    0xF7, 0x40, 0x17, 0x3B, 0xCF, 0xE4, 0x05, 0x03, 0x3B, 0xA0, 0xB2, 0xC9,
++    0x0D, 0x5E, 0x48, 0x3A, 0xE9, 0xAD, 0x28, 0x71, 0x7D, 0x8F, 0x89, 0x16,
++    0x59, 0x93, 0x35, 0xDC, 0x4D, 0x7B, 0xDF, 0x84, 0xE4, 0x68, 0xAA, 0x33,
++    0xAA, 0xDC, 0x66, 0x50, 0xC8, 0xA9, 0x32, 0x12, 0xDC, 0xC6, 0x90, 0x49,
++    0x0B, 0x75, 0xFF, 0x9B, 0x95, 0x00, 0x9A, 0x90, 0xE0, 0xD4, 0x0E, 0x67,
++    0xAB, 0x3C, 0x47, 0x36, 0xC5, 0x2E, 0x1C, 0x46, 0xF0, 0x2D, 0xD3, 0x8B,
++    0x42, 0x08, 0xDE, 0x0D, 0xB6, 0x2C, 0x86, 0xB0, 0x35, 0x71, 0x18, 0x6B,
++    0x89, 0x67, 0xC0, 0x05, 0xAD, 0xF4, 0x1D, 0x62, 0x4E, 0x75, 0xEC, 0xD6,
++    0xC2, 0xDB, 0x07, 0xB0, 0xB6, 0x8D, 0x15, 0xAD, 0xCD, 0xBF, 0xF5, 0x60,
++    0x76, 0xAE, 0x48, 0xB8, 0x77, 0x7F, 0xC5, 0x01, 0xD9, 0x29, 0xBB, 0xD6,
++    0x17, 0xA2, 0x20, 0x5A, 0xC0, 0x4A, 0x3B, 0x34, 0xC8, 0xB9, 0x39, 0xCF,
++    0x06, 0x89, 0x95, 0x6F, 0xC7, 0xCA, 0xC4, 0xE4, 0x43, 0xDF, 0x5A, 0x23,
++    0xE2, 0x89, 0xA3, 0x38, 0x78, 0x31, 0x38, 0xC6, 0xA4, 0x6F, 0x5F, 0x73,
++    0x5A, 0xE5, 0x9E, 0x09, 0xE7, 0x6F, 0xD4, 0xF8, 0x3E, 0xB7, 0xB0, 0x56,
++    0x9A, 0xF3, 0x65, 0xF0, 0xC2, 0xA6, 0x8A, 0x08, 0xBA, 0x44, 0xAC, 0x97,
++    0xDE, 0xB4, 0x16, 0x83, 0xDF, 0xE3, 0xEE, 0x71, 0xFA, 0xF9, 0x51, 0x50,
++    0x14, 0xDC, 0xFD, 0x6A, 0x82, 0x20, 0x68, 0x64, 0x7D, 0x4E, 0x82, 0x68,
++    0xD7, 0x45, 0xFA, 0x6A, 0xE4, 0xE5, 0x29, 0x3A, 0x70, 0xFB, 0xE4, 0x62,
++    0x2B, 0x31, 0xB9, 0x7D
++};
++
++static const unsigned char kat_RSA_PSS_SHA384[] = {
++    0x99, 0x02, 0xC9, 0x1E, 0x31, 0x82, 0xB4, 0xE6, 0x1B, 0x32, 0xCE, 0x5D,
++    0x41, 0x1D, 0x00, 0x2F, 0x04, 0x8B, 0xBD, 0x37, 0x79, 0xCF, 0x77, 0x03,
++    0x05, 0x6A, 0x21, 0xC7, 0x8D, 0x24, 0x60, 0x49, 0x39, 0x58, 0xC5, 0x27,
++    0x8F, 0xC5, 0x97, 0x4A, 0xB2, 0xE1, 0xD4, 0x36, 0x57, 0xBD, 0x43, 0xCC,
++    0x7B, 0xCE, 0xF2, 0xA5, 0x30, 0xF8, 0x72, 0x14, 0xBB, 0xD0, 0x9F, 0xC1,
++    0x49, 0xC8, 0x1C, 0xAF, 0xCD, 0x95, 0x78, 0x72, 0x25, 0xF9, 0x45, 0xC6,
++    0x5B, 0x62, 0x5E, 0x01, 0xD7, 0x40, 0x5E, 0xC8, 0xCA, 0x0A, 0xF3, 0xBA,
++    0x08, 0x07, 0x88, 0xCA, 0x49, 0x36, 0x84, 0x7D, 0xF6, 0xFC, 0x5A, 0xDB,
++    0xFC, 0x50, 0xD3, 0xEB, 0x3D, 0x83, 0xB0, 0xF5, 0x94, 0x5E, 0x88, 0xC3,
++    0x82, 0xCD, 0x53, 0x40, 0x96, 0x18, 0x6B, 0x4A, 0x6C, 0x9C, 0xFE, 0xE5,
++    0x3B, 0x75, 0xF9, 0xEB, 0xA5, 0x77, 0x11, 0xEF, 0x88, 0x1C, 0x25, 0x70,
++    0x7D, 0x88, 0x5D, 0xC3, 0xCA, 0xE1, 0x49, 0x14, 0x90, 0xAD, 0xF2, 0x5E,
++    0x49, 0xD7, 0x99, 0xA5, 0x7B, 0x77, 0x3B, 0x8E, 0xB8, 0xDB, 0xF1, 0x4C,
++    0xD6, 0x9A, 0xDC, 0xE5, 0x7A, 0x1C, 0xE1, 0xCE, 0x9D, 0xF1, 0xF3, 0xA0,
++    0x0A, 0x35, 0x52, 0x9D, 0xB9, 0x46, 0x94, 0x82, 0x0F, 0xF7, 0xB2, 0x62,
++    0x51, 0x70, 0x75, 0xD2, 0x37, 0x96, 0x67, 0x2F, 0xD0, 0x22, 0xD8, 0x07,
++    0x8D, 0x69, 0x9E, 0x6D, 0x0B, 0x40, 0x4F, 0x70, 0xEC, 0x0B, 0xCA, 0x88,
++    0x80, 0x8D, 0x9A, 0xF4, 0xF9, 0x18, 0x50, 0x27, 0x08, 0xFA, 0xCC, 0xC7,
++    0x3F, 0xE4, 0x84, 0x83, 0xA1, 0xB6, 0x1D, 0x23, 0x34, 0xFE, 0x48, 0xE5,
++    0xE3, 0xAE, 0x4D, 0x98, 0xBC, 0xA6, 0x8A, 0x9F, 0xFD, 0x4D, 0xDB, 0x9D,
++    0xF7, 0xEB, 0x4E, 0xB6, 0x6F, 0x25, 0xEA, 0x7A, 0xE9, 0x85, 0xB2, 0xEF,
++    0x90, 0xD2, 0xA6, 0x2B
++};
++
++static const unsigned char kat_RSA_PSS_SHA512[] = {
++    0x3F, 0x83, 0x43, 0x78, 0x25, 0xBE, 0x81, 0xB2, 0x6E, 0x78, 0x11, 0x32,
++    0xD0, 0x88, 0x05, 0x53, 0x95, 0xED, 0x81, 0x12, 0xCE, 0x50, 0xD9, 0x06,
++    0x42, 0x89, 0xA0, 0x55, 0x7A, 0x05, 0x13, 0x94, 0x35, 0x9B, 0xCA, 0x5D,
++    0xCB, 0xB2, 0x32, 0xE1, 0x04, 0x99, 0xEC, 0xE7, 0xA6, 0x69, 0x4D, 0x2B,
++    0xC1, 0x57, 0x13, 0x48, 0x0D, 0x6B, 0x4D, 0x83, 0x28, 0x06, 0x79, 0x9D,
++    0xB4, 0x70, 0xCE, 0xC0, 0xFC, 0x3B, 0x69, 0xB3, 0x91, 0x54, 0xA9, 0x44,
++    0x2E, 0xDA, 0x4A, 0xC5, 0xC2, 0x99, 0xF0, 0xDE, 0xCA, 0x77, 0x99, 0x6B,
++    0x0C, 0x79, 0xE5, 0x29, 0x74, 0x83, 0x69, 0xEA, 0xB8, 0x72, 0x30, 0x3D,
++    0x7A, 0x30, 0xE1, 0x03, 0x7B, 0x09, 0xE6, 0x11, 0xC0, 0xDC, 0xFF, 0xFD,
++    0xBD, 0xEC, 0x9C, 0xCC, 0x46, 0x7B, 0x4C, 0x4C, 0x59, 0xBE, 0x82, 0x7C,
++    0xF5, 0x60, 0x5A, 0xC3, 0xE8, 0xA8, 0x8A, 0x38, 0x9E, 0x01, 0x57, 0xF1,
++    0x79, 0x3A, 0x7C, 0xA3, 0x9F, 0x12, 0x1A, 0x4F, 0x2E, 0xA2, 0xE5, 0x0A,
++    0xAB, 0xC0, 0xF4, 0xA5, 0xE3, 0x5F, 0x89, 0x1C, 0x8F, 0xA4, 0x5E, 0xCE,
++    0x0D, 0x91, 0x05, 0x1B, 0x17, 0x62, 0x48, 0xFE, 0xA5, 0x4C, 0xEF, 0x2D,
++    0x28, 0xF1, 0x5E, 0xE6, 0xD1, 0x30, 0x89, 0x0A, 0xAD, 0x18, 0xAF, 0x6F,
++    0x04, 0x09, 0x36, 0x9A, 0xFF, 0xCA, 0xA1, 0xA7, 0x05, 0x7F, 0xD4, 0xBF,
++    0x3A, 0xB5, 0x42, 0x6D, 0xE9, 0x07, 0x29, 0x65, 0x8B, 0xAD, 0x4D, 0x0F,
++    0x22, 0xE1, 0x59, 0x43, 0x68, 0x87, 0xA8, 0x8B, 0xBC, 0x69, 0xA1, 0x94,
++    0x22, 0x3E, 0x8A, 0x49, 0xE8, 0xA3, 0x6F, 0xC2, 0x93, 0x58, 0xE7, 0xAE,
++    0xC9, 0x1F, 0xCF, 0x61, 0x93, 0xFC, 0xC1, 0xF6, 0xF3, 0x27, 0x7F, 0x0A,
++    0x90, 0xE0, 0x65, 0x32, 0x57, 0x47, 0xE2, 0xED, 0x08, 0x59, 0xA6, 0xF0,
++    0x17, 0x2C, 0x13, 0xE0
++};
++
++static const unsigned char kat_RSA_SHA1[] = {
++    0x3B, 0x60, 0x4B, 0xFC, 0x54, 0x28, 0x23, 0xE6, 0x2F, 0x05, 0x04, 0xBA,
++    0x9D, 0xE4, 0x3C, 0xB8, 0x5B, 0x60, 0x5C, 0xCD, 0x9D, 0xEA, 0xC3, 0x4C,
++    0xC2, 0x33, 0xE6, 0xC6, 0x21, 0x48, 0x76, 0xEC, 0xB2, 0xF5, 0x11, 0xDE,
++    0x44, 0xB4, 0xAF, 0x16, 0x11, 0xC3, 0x18, 0x16, 0xB3, 0x69, 0xBB, 0x94,
++    0xED, 0xE8, 0xB3, 0x9E, 0xB1, 0x43, 0x8E, 0xCE, 0xB4, 0x34, 0x9B, 0x08,
++    0x22, 0xAF, 0x31, 0x73, 0xB5, 0xFA, 0x11, 0x7E, 0x8F, 0x13, 0x52, 0xEC,
++    0xC9, 0x03, 0xEE, 0x0D, 0x2B, 0x91, 0x32, 0xF2, 0x8E, 0xDF, 0x02, 0xE0,
++    0x0A, 0x47, 0xD2, 0x0A, 0x51, 0x00, 0x1A, 0x30, 0x6F, 0x0C, 0xB3, 0x54,
++    0x64, 0x20, 0x90, 0x0C, 0x01, 0xBE, 0xC0, 0x42, 0x8C, 0x5D, 0x18, 0x6F,
++    0x32, 0x75, 0x45, 0x7B, 0x1C, 0x04, 0xA2, 0x9F, 0x84, 0xD7, 0xF5, 0x3A,
++    0x95, 0xD4, 0xE8, 0x8D, 0xEC, 0x99, 0xEF, 0x18, 0x5E, 0x64, 0xD3, 0xAF,
++    0xF8, 0xD4, 0xFF, 0x3C, 0x87, 0xA0, 0x3F, 0xC7, 0x22, 0x05, 0xFD, 0xFD,
++    0x29, 0x8A, 0x28, 0xDA, 0xA9, 0x8A, 0x8B, 0x23, 0x62, 0x9D, 0x42, 0xB8,
++    0x4A, 0x76, 0x0D, 0x9F, 0x9A, 0xE0, 0xE6, 0xDD, 0xAD, 0x5E, 0x5F, 0xD5,
++    0x32, 0xE9, 0x4B, 0x97, 0x7D, 0x62, 0x0A, 0xB3, 0xBE, 0xF2, 0x8C, 0x1F,
++    0x2B, 0x22, 0x06, 0x15, 0x33, 0x71, 0xED, 0x9B, 0xA0, 0x82, 0xCE, 0xBF,
++    0x3B, 0x08, 0x5F, 0xA7, 0x20, 0x94, 0x09, 0xEB, 0x82, 0xA5, 0x41, 0x60,
++    0xF1, 0x08, 0xEB, 0x8D, 0xCC, 0x8D, 0xC9, 0x52, 0x0A, 0xAF, 0xF4, 0xF9,
++    0x9F, 0x82, 0xD8, 0x0B, 0x75, 0x5E, 0xE4, 0xAF, 0x65, 0x96, 0xAF, 0xFC,
++    0x33, 0xBF, 0x9F, 0x3E, 0xA4, 0x7B, 0x86, 0xC7, 0xF7, 0x47, 0xAB, 0x37,
++    0x05, 0xD6, 0x0D, 0x31, 0x72, 0x8C, 0x80, 0x1E, 0xA9, 0x54, 0xFC, 0xDF,
++    0x27, 0x90, 0xE2, 0x01
++};
++
++static const unsigned char kat_RSA_SHA224[] = {
++    0xA2, 0xD8, 0x42, 0x53, 0xDD, 0xBF, 0x1F, 0x6B, 0x07, 0xE0, 0x60, 0x86,
++    0x5A, 0x60, 0x06, 0x8F, 0x44, 0xD9, 0xB0, 0x4A, 0xAA, 0x90, 0x71, 0xB8,
++    0xB2, 0xBC, 0x30, 0x41, 0x50, 0xBB, 0xFD, 0x46, 0x98, 0x4D, 0xC0, 0x89,
++    0x57, 0x85, 0x8A, 0x97, 0x49, 0x25, 0xA8, 0x0C, 0x69, 0x70, 0x19, 0x39,
++    0x66, 0x24, 0xB4, 0x69, 0x47, 0xD2, 0x7C, 0xDE, 0x2D, 0x37, 0x59, 0xB3,
++    0xE3, 0xC7, 0x6B, 0xDD, 0xBE, 0xE1, 0xE6, 0x28, 0x9A, 0x8D, 0x42, 0x3E,
++    0x28, 0x01, 0xD7, 0x03, 0xC9, 0x73, 0xC3, 0x6B, 0x03, 0xEC, 0x1E, 0xF8,
++    0x53, 0x8B, 0x52, 0x42, 0x89, 0x55, 0xB7, 0x87, 0xA9, 0x94, 0xC2, 0xB4,
++    0x4B, 0x76, 0xF5, 0x61, 0x47, 0xE1, 0x44, 0x7B, 0xEC, 0xB4, 0x25, 0x66,
++    0xC0, 0xFF, 0xEB, 0x86, 0x24, 0xAA, 0xA8, 0x72, 0xC7, 0xFB, 0xFB, 0xF6,
++    0x84, 0xA7, 0x5B, 0xD4, 0x87, 0xE5, 0x84, 0x56, 0x1E, 0x4C, 0xE5, 0xBC,
++    0x87, 0x94, 0xAC, 0x9C, 0x1B, 0x3D, 0xF7, 0xD4, 0x36, 0x85, 0x9F, 0xC9,
++    0xF6, 0x43, 0x3F, 0xB6, 0x25, 0x33, 0x48, 0x0F, 0xE5, 0x7C, 0xCD, 0x53,
++    0x48, 0xEB, 0x02, 0x11, 0xB9, 0x9E, 0xC3, 0xB4, 0xE1, 0x54, 0xD6, 0xAA,
++    0x1A, 0x9E, 0x10, 0xE1, 0x27, 0x25, 0xF2, 0xE1, 0xAB, 0xAB, 0x6C, 0x45,
++    0x61, 0xD5, 0xA3, 0x6C, 0xB6, 0x33, 0x52, 0xAE, 0x3D, 0xFD, 0x22, 0xFC,
++    0x3A, 0xAB, 0x63, 0x94, 0xB5, 0x3A, 0x69, 0x11, 0xAC, 0x99, 0x4F, 0x33,
++    0x67, 0x0A, 0x1A, 0x70, 0x1E, 0xB9, 0xE2, 0x26, 0x27, 0x68, 0xEA, 0xF5,
++    0x97, 0x55, 0xAC, 0x83, 0x6A, 0x40, 0x3B, 0x56, 0xAE, 0x13, 0x88, 0xE8,
++    0x98, 0x72, 0x52, 0x91, 0x7F, 0x78, 0x0A, 0x18, 0xD4, 0x44, 0x78, 0x83,
++    0x0D, 0x44, 0x77, 0xA6, 0xF3, 0x04, 0xF1, 0x8C, 0xBC, 0x2F, 0xF9, 0x5B,
++    0xDB, 0x70, 0x00, 0xF6
++};
++
++static const unsigned char kat_RSA_SHA256[] = {
++    0xC2, 0xB1, 0x97, 0x00, 0x9A, 0xE5, 0x80, 0x6A, 0xE2, 0x51, 0x68, 0xB9,
++    0x7A, 0x0C, 0xF2, 0xB4, 0x77, 0xED, 0x15, 0x0C, 0x4E, 0xE1, 0xDC, 0xFF,
++    0x8E, 0xBC, 0xDE, 0xC7, 0x9A, 0x96, 0xF1, 0x47, 0x45, 0x24, 0x9D, 0x6F,
++    0xA6, 0xF3, 0x1D, 0x0D, 0x35, 0x4C, 0x1A, 0xF3, 0x58, 0x2C, 0x6C, 0x06,
++    0xD6, 0x22, 0x37, 0x77, 0x8C, 0x33, 0xE5, 0x07, 0x53, 0x93, 0x28, 0xCF,
++    0x67, 0xFA, 0xC4, 0x1F, 0x1B, 0x24, 0xDB, 0x4C, 0xC5, 0x2A, 0x51, 0xA2,
++    0x60, 0x15, 0x8C, 0x54, 0xB4, 0x30, 0xE2, 0x24, 0x47, 0x86, 0xF2, 0xF8,
++    0x6C, 0xD6, 0x12, 0x59, 0x2C, 0x74, 0x9A, 0x37, 0xF3, 0xC4, 0xA2, 0xD5,
++    0x4E, 0x1F, 0x77, 0xF0, 0x27, 0xCE, 0x77, 0xF8, 0x4A, 0x79, 0x03, 0xBE,
++    0xC8, 0x06, 0x2D, 0xA7, 0xA6, 0x46, 0xF5, 0x55, 0x79, 0xD7, 0x5C, 0xC6,
++    0x5B, 0xB1, 0x00, 0x4E, 0x7C, 0xD9, 0x11, 0x85, 0xE0, 0xB1, 0x4D, 0x2D,
++    0x13, 0xD7, 0xAC, 0xEA, 0x64, 0xD1, 0xAC, 0x8F, 0x8D, 0x8F, 0xEA, 0x42,
++    0x7F, 0xF9, 0xB7, 0x7D, 0x2C, 0x68, 0x49, 0x07, 0x7A, 0x74, 0xEF, 0xB4,
++    0xC9, 0x97, 0x16, 0x5C, 0x6C, 0x6E, 0x5C, 0x09, 0x2E, 0x8E, 0x13, 0x2E,
++    0x1A, 0x8D, 0xA6, 0x0C, 0x6E, 0x0C, 0x1C, 0x0F, 0xCC, 0xB2, 0x78, 0x8A,
++    0x07, 0xFC, 0x5C, 0xC2, 0xF5, 0x65, 0xEC, 0xAB, 0x8B, 0x3C, 0xCA, 0x91,
++    0x6F, 0x84, 0x7C, 0x21, 0x0E, 0xB8, 0xDA, 0x7B, 0x6C, 0xF7, 0xDF, 0xAB,
++    0x7E, 0x15, 0xFD, 0x85, 0x0B, 0x33, 0x9B, 0x6A, 0x3A, 0xC3, 0xEF, 0x65,
++    0x04, 0x6E, 0xB2, 0xAC, 0x98, 0xFD, 0xEB, 0x02, 0xF5, 0xC0, 0x0B, 0x5E,
++    0xCB, 0xD4, 0x83, 0x82, 0x18, 0x1B, 0xDA, 0xB4, 0xCD, 0xE8, 0x71, 0x6B,
++    0x1D, 0xB5, 0x4F, 0xE9, 0xD6, 0x43, 0xA0, 0x0A, 0x14, 0xA0, 0xE7, 0x5D,
++    0x47, 0x9D, 0x18, 0xD7
++};
++
++static const unsigned char kat_RSA_SHA384[] = {
++    0x11, 0x5E, 0x63, 0xFE, 0x47, 0xAA, 0x6A, 0x84, 0xEB, 0x44, 0x9A, 0x00,
++    0x96, 0x4A, 0xED, 0xD2, 0xA7, 0x67, 0x3A, 0x64, 0x82, 0x30, 0x61, 0x2D,
++    0xE3, 0xF5, 0x49, 0x68, 0x5E, 0x60, 0xD2, 0x4D, 0xEF, 0xF2, 0xA4, 0xB2,
++    0x9A, 0x81, 0x1D, 0x41, 0xA5, 0x73, 0x59, 0xEB, 0xBB, 0xC4, 0x9E, 0x2B,
++    0xEB, 0xC3, 0xDE, 0x3A, 0xEA, 0xF5, 0xAD, 0xDA, 0x87, 0x08, 0x68, 0xCF,
++    0x12, 0x9B, 0xC1, 0xE4, 0xA7, 0x71, 0xF8, 0xBD, 0x6B, 0x6F, 0x50, 0xF1,
++    0xD1, 0xFF, 0xCE, 0x6C, 0xD9, 0xBE, 0xDA, 0x76, 0xF3, 0xEB, 0xAB, 0x9C,
++    0x41, 0x6E, 0x4F, 0x35, 0x7A, 0x61, 0x27, 0xBC, 0x03, 0x3E, 0xAE, 0x3E,
++    0x1B, 0xDD, 0xAC, 0xD9, 0x1A, 0xFF, 0xD3, 0xF5, 0x66, 0x43, 0x07, 0x76,
++    0x8A, 0x69, 0x2D, 0x14, 0xB1, 0xBE, 0x55, 0x49, 0x90, 0x89, 0x4B, 0xC4,
++    0x11, 0x67, 0xD5, 0x9D, 0xB0, 0xB2, 0xEE, 0x8D, 0x0A, 0x47, 0x4A, 0xD9,
++    0x0E, 0xD1, 0x24, 0xF0, 0x30, 0x2B, 0xF2, 0x79, 0x47, 0xDB, 0x70, 0xB4,
++    0x46, 0xF2, 0xF8, 0xB7, 0xB4, 0xF6, 0x34, 0x79, 0xA8, 0x2D, 0x3D, 0x56,
++    0xD5, 0x9A, 0x60, 0x7A, 0x04, 0xC7, 0x66, 0x1D, 0xCD, 0x3C, 0xD5, 0x39,
++    0x37, 0x12, 0x51, 0x5E, 0x9F, 0xF8, 0x1A, 0xAF, 0x13, 0xC1, 0x13, 0x00,
++    0x35, 0xD5, 0x8D, 0x17, 0xE3, 0x02, 0x28, 0xD9, 0xEC, 0xDE, 0xD1, 0x2F,
++    0x93, 0x49, 0x03, 0x11, 0x3E, 0x56, 0x9D, 0xC2, 0x31, 0xF8, 0xAF, 0x2D,
++    0xD9, 0x99, 0xB7, 0x8A, 0xAC, 0x5A, 0x86, 0x20, 0x3A, 0x83, 0x29, 0x26,
++    0x9D, 0x03, 0x52, 0x2B, 0x34, 0x56, 0x40, 0x16, 0x53, 0x50, 0x82, 0xC9,
++    0xC7, 0xD5, 0x51, 0x4C, 0xED, 0xB3, 0xE2, 0xE1, 0xCF, 0xA8, 0xCE, 0xBD,
++    0xB1, 0x48, 0xA6, 0x8A, 0x79, 0x17, 0x55, 0x11, 0xEF, 0xE8, 0x14, 0xF4,
++    0x7E, 0x37, 0x1D, 0x96
++};
++
++static const unsigned char kat_RSA_SHA512[] = {
++    0x35, 0x6D, 0xF1, 0x9E, 0xCF, 0xB1, 0xF6, 0x0C, 0x04, 0x21, 0x17, 0xB3,
++    0xC4, 0x9D, 0xFE, 0x62, 0x1C, 0x1A, 0x45, 0x00, 0x2E, 0x6B, 0xB6, 0x9F,
++    0x5C, 0xB1, 0xCB, 0xCF, 0xF9, 0x67, 0xEA, 0x62, 0x8A, 0xEB, 0x77, 0x02,
++    0x42, 0x30, 0x88, 0xB1, 0x48, 0xDF, 0x12, 0x60, 0x6E, 0x92, 0xBB, 0x4B,
++    0x09, 0x68, 0xD1, 0x70, 0x2B, 0x59, 0xEE, 0x57, 0x96, 0xF9, 0xEA, 0xA3,
++    0x4C, 0xE9, 0xC9, 0xBD, 0x25, 0x34, 0x66, 0x15, 0x6C, 0xC9, 0x81, 0xD1,
++    0x48, 0x0F, 0x33, 0x5F, 0x05, 0x4F, 0xC2, 0xC4, 0xDD, 0x09, 0x54, 0x79,
++    0xA1, 0x57, 0x07, 0x70, 0xA0, 0x33, 0x02, 0x4D, 0x5D, 0xE9, 0x24, 0xD1,
++    0xEF, 0xF0, 0x61, 0xD0, 0x1D, 0x41, 0xE2, 0x9B, 0x2B, 0x7C, 0xD0, 0x4E,
++    0x55, 0xD9, 0x6D, 0xA1, 0x16, 0x9F, 0xDA, 0xC3, 0x3B, 0xF1, 0x74, 0xD1,
++    0x99, 0xF1, 0x63, 0x57, 0xAD, 0xC7, 0x55, 0xF4, 0x97, 0x43, 0x1C, 0xED,
++    0x1B, 0x7A, 0x32, 0xCB, 0x24, 0xA6, 0x3D, 0x93, 0x37, 0x90, 0x74, 0xEE,
++    0xD2, 0x8D, 0x4B, 0xBC, 0x72, 0xDA, 0x25, 0x2B, 0x64, 0xE9, 0xCA, 0x69,
++    0x36, 0xB6, 0xEC, 0x6E, 0x8F, 0x33, 0x0E, 0x74, 0x40, 0x48, 0x51, 0xE2,
++    0x54, 0x6F, 0xAF, 0x6E, 0x36, 0x54, 0x3A, 0xEC, 0x78, 0x37, 0xE6, 0x1F,
++    0x76, 0xA5, 0x4D, 0xA6, 0xD9, 0xB3, 0x6B, 0x17, 0x6D, 0x61, 0xFC, 0xA3,
++    0x85, 0x4A, 0xCC, 0xDA, 0x52, 0xAC, 0x5B, 0xDA, 0x51, 0xE5, 0x7F, 0x5B,
++    0x52, 0x8B, 0x74, 0x75, 0x99, 0x5C, 0x01, 0xFD, 0x25, 0x3E, 0xCD, 0x86,
++    0x6F, 0x7A, 0xC0, 0xD8, 0x17, 0x6F, 0xD1, 0xD2, 0x6B, 0xAB, 0x14, 0x1F,
++    0x3B, 0xB8, 0x15, 0x05, 0x86, 0x40, 0x36, 0xCF, 0xDA, 0x59, 0x2B, 0x9A,
++    0xE9, 0x1E, 0x6E, 0xD3, 0x6B, 0xA1, 0x19, 0xC5, 0xE6, 0x3F, 0xE9, 0x2E,
++    0x43, 0xA8, 0x34, 0x0A
++};
++
++static int fips_rsa_encrypt_test(RSA *rsa, const unsigned char *plaintext,
++                                 int ptlen)
++{
++    unsigned char *ctbuf = NULL, *ptbuf = NULL;
++    int ret = 0;
++    int len;
++
++    ctbuf = OPENSSL_malloc(RSA_size(rsa));
++    if (!ctbuf)
++        goto err;
++
++    len = RSA_public_encrypt(ptlen, plaintext, ctbuf, rsa, RSA_PKCS1_PADDING);
++    if (len <= 0)
++        goto err;
++    /* Check ciphertext doesn't match plaintext */
++    if (len >= ptlen && !memcmp(plaintext, ctbuf, ptlen))
++        goto err;
++
++    ptbuf = OPENSSL_malloc(RSA_size(rsa));
++    if (!ptbuf)
++        goto err;
++
++    len = RSA_private_decrypt(len, ctbuf, ptbuf, rsa, RSA_PKCS1_PADDING);
++    if (len != ptlen)
++        goto err;
++    if (memcmp(ptbuf, plaintext, len))
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (ctbuf)
++        OPENSSL_free(ctbuf);
++    if (ptbuf)
++        OPENSSL_free(ptbuf);
++    return ret;
++}
++
++int FIPS_selftest_rsa()
++{
++    int ret = 0;
++    RSA *key;
++    EVP_PKEY *pk = NULL;
++
++    if ((key = RSA_new()) == NULL)
++        goto err;
++    setrsakey(key);
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_RSA(pk, key);
++
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA1, sizeof(kat_RSA_SHA1),
++                                  EVP_sha1(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA1 PKCS#1"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA224, sizeof(kat_RSA_SHA224),
++                                  EVP_sha224(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA224 PKCS#1"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA256, sizeof(kat_RSA_SHA256),
++                                  EVP_sha256(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA256 PKCS#1"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA384, sizeof(kat_RSA_SHA384),
++                                  EVP_sha384(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA384 PKCS#1"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA512, sizeof(kat_RSA_SHA512),
++                                  EVP_sha512(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA512 PKCS#1"))
++        goto err;
++
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA1, sizeof(kat_RSA_PSS_SHA1),
++                                  EVP_sha1(), EVP_MD_CTX_FLAG_PAD_PSS,
++                                  "RSA SHA1 PSS"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA224,
++                                  sizeof(kat_RSA_PSS_SHA224), EVP_sha224(),
++                                  EVP_MD_CTX_FLAG_PAD_PSS, "RSA SHA224 PSS"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA256,
++                                  sizeof(kat_RSA_PSS_SHA256), EVP_sha256(),
++                                  EVP_MD_CTX_FLAG_PAD_PSS, "RSA SHA256 PSS"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA384,
++                                  sizeof(kat_RSA_PSS_SHA384), EVP_sha384(),
++                                  EVP_MD_CTX_FLAG_PAD_PSS, "RSA SHA384 PSS"))
++        goto err;
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA512,
++                                  sizeof(kat_RSA_PSS_SHA512), EVP_sha512(),
++                                  EVP_MD_CTX_FLAG_PAD_PSS, "RSA SHA512 PSS"))
++        goto err;
++
++    if (!fips_rsa_encrypt_test(key, kat_tbs, sizeof(kat_tbs) - 1))
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (pk)
++        EVP_PKEY_free(pk);
++    if (key)
++        RSA_free(key);
++    return ret;
++}
++
++#endif                          /* def OPENSSL_FIPS */
+diff --git a/crypto/fips/fips_rsa_x931g.c b/crypto/fips/fips_rsa_x931g.c
+new file mode 100644
+index 0000000..2891dae
+--- /dev/null
++++ b/crypto/fips/fips_rsa_x931g.c
+@@ -0,0 +1,273 @@
++/* crypto/rsa/rsa_gen.c */
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ *
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ *
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ *
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <time.h>
++#include <openssl/err.h>
++#include <openssl/bn.h>
++#include <openssl/rsa.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++
++extern int fips_check_rsa(RSA *rsa);
++#endif
++
++/* X9.31 RSA key derivation and generation */
++
++int RSA_X931_derive_ex(RSA *rsa, BIGNUM *p1, BIGNUM *p2, BIGNUM *q1,
++                       BIGNUM *q2, const BIGNUM *Xp1, const BIGNUM *Xp2,
++                       const BIGNUM *Xp, const BIGNUM *Xq1, const BIGNUM *Xq2,
++                       const BIGNUM *Xq, const BIGNUM *e, BN_GENCB *cb)
++{
++    BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *r3 = NULL;
++    BN_CTX *ctx = NULL, *ctx2 = NULL;
++
++    if (!rsa)
++        goto err;
++
++    ctx = BN_CTX_new();
++    if (!ctx)
++        goto err;
++    BN_CTX_start(ctx);
++
++    r0 = BN_CTX_get(ctx);
++    r1 = BN_CTX_get(ctx);
++    r2 = BN_CTX_get(ctx);
++    r3 = BN_CTX_get(ctx);
++
++    if (r3 == NULL)
++        goto err;
++    if (!rsa->e) {
++        rsa->e = BN_dup(e);
++        if (!rsa->e)
++            goto err;
++    } else
++        e = rsa->e;
++
++    /* If not all parameters present only calculate what we can.
++     * This allows test programs to output selective parameters.
++     */
++
++    if (Xp && !rsa->p) {
++        rsa->p = BN_new();
++        if (!rsa->p)
++            goto err;
++
++        if (!BN_X931_derive_prime_ex(rsa->p, p1, p2,
++                                     Xp, Xp1, Xp2, e, ctx, cb))
++            goto err;
++    }
++
++    if (Xq && !rsa->q) {
++        rsa->q = BN_new();
++        if (!rsa->q)
++            goto err;
++        if (!BN_X931_derive_prime_ex(rsa->q, q1, q2,
++                                     Xq, Xq1, Xq2, e, ctx, cb))
++            goto err;
++    }
++
++    if (!rsa->p || !rsa->q) {
++        BN_CTX_end(ctx);
++        BN_CTX_free(ctx);
++        return 2;
++    }
++
++    /* Since both primes are set we can now calculate all remaining
++     * components.
++     */
++
++    /* calculate n */
++    rsa->n = BN_new();
++    if (rsa->n == NULL)
++        goto err;
++    if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx))
++        goto err;
++
++    /* calculate d */
++    if (!BN_sub(r1, rsa->p, BN_value_one()))
++        goto err;               /* p-1 */
++    if (!BN_sub(r2, rsa->q, BN_value_one()))
++        goto err;               /* q-1 */
++    if (!BN_mul(r0, r1, r2, ctx))
++        goto err;               /* (p-1)(q-1) */
++
++    if (!BN_gcd(r3, r1, r2, ctx))
++        goto err;
++
++    if (!BN_div(r0, NULL, r0, r3, ctx))
++        goto err;               /* LCM((p-1)(q-1)) */
++
++    ctx2 = BN_CTX_new();
++    if (!ctx2)
++        goto err;
++
++    rsa->d = BN_mod_inverse(NULL, rsa->e, r0, ctx2); /* d */
++    if (rsa->d == NULL)
++        goto err;
++
++    /* calculate d mod (p-1) */
++    rsa->dmp1 = BN_new();
++    if (rsa->dmp1 == NULL)
++        goto err;
++    if (!BN_mod(rsa->dmp1, rsa->d, r1, ctx))
++        goto err;
++
++    /* calculate d mod (q-1) */
++    rsa->dmq1 = BN_new();
++    if (rsa->dmq1 == NULL)
++        goto err;
++    if (!BN_mod(rsa->dmq1, rsa->d, r2, ctx))
++        goto err;
++
++    /* calculate inverse of q mod p */
++    rsa->iqmp = BN_mod_inverse(NULL, rsa->q, rsa->p, ctx2);
++
++ err:
++    if (ctx) {
++        BN_CTX_end(ctx);
++        BN_CTX_free(ctx);
++    }
++    if (ctx2)
++        BN_CTX_free(ctx2);
++    /* If this is set all calls successful */
++    if (rsa && rsa->iqmp != NULL)
++        return 1;
++
++    return 0;
++
++}
++
++int RSA_X931_generate_key_ex(RSA *rsa, int bits, const BIGNUM *e,
++                             BN_GENCB *cb)
++{
++    int ok = 0;
++    BIGNUM *Xp = NULL, *Xq = NULL;
++    BN_CTX *ctx = NULL;
++
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) &&
++        (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++        FIPSerr(FIPS_F_RSA_X931_GENERATE_KEY_EX, FIPS_R_KEY_TOO_SHORT);
++        return 0;
++    }
++
++    if (bits & 0xff) {
++        FIPSerr(FIPS_F_RSA_X931_GENERATE_KEY_EX, FIPS_R_INVALID_KEY_LENGTH);
++        return 0;
++    }
++
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_RSA_X931_GENERATE_KEY_EX, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++#endif
++
++    ctx = BN_CTX_new();
++    if (!ctx)
++        goto error;
++
++    BN_CTX_start(ctx);
++    Xp = BN_CTX_get(ctx);
++    Xq = BN_CTX_get(ctx);
++    if (!BN_X931_generate_Xpq(Xp, Xq, bits, ctx))
++        goto error;
++
++    rsa->p = BN_new();
++    rsa->q = BN_new();
++    if (!rsa->p || !rsa->q)
++        goto error;
++
++    /* Generate two primes from Xp, Xq */
++
++    if (!BN_X931_generate_prime_ex(rsa->p, NULL, NULL, NULL, NULL, Xp,
++                                   e, ctx, cb))
++        goto error;
++
++    if (!BN_X931_generate_prime_ex(rsa->q, NULL, NULL, NULL, NULL, Xq,
++                                   e, ctx, cb))
++        goto error;
++
++    /* Since rsa->p and rsa->q are valid this call will just derive
++     * remaining RSA components.
++     */
++
++    if (!RSA_X931_derive_ex(rsa, NULL, NULL, NULL, NULL,
++                            NULL, NULL, NULL, NULL, NULL, NULL, e, cb))
++        goto error;
++
++#ifdef OPENSSL_FIPS
++    if (!fips_check_rsa(rsa))
++        goto error;
++#endif
++
++    ok = 1;
++
++ error:
++    if (ctx) {
++        BN_CTX_end(ctx);
++        BN_CTX_free(ctx);
++    }
++
++    if (ok)
++        return 1;
++
++    return 0;
++
++}
+diff --git a/crypto/fips/fips_sha_selftest.c b/crypto/fips/fips_sha_selftest.c
+new file mode 100644
+index 0000000..b567b8e
+--- /dev/null
++++ b/crypto/fips/fips_sha_selftest.c
+@@ -0,0 +1,145 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/evp.h>
++#include <openssl/sha.h>
++
++#ifdef OPENSSL_FIPS
++static const char test[][60] = {
++    "",
++    "abc",
++    "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
++};
++
++static const unsigned char ret[][SHA_DIGEST_LENGTH] = {
++    {0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55,
++     0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09},
++    {0xa9, 0x99, 0x3e, 0x36, 0x47, 0x06, 0x81, 0x6a, 0xba, 0x3e,
++     0x25, 0x71, 0x78, 0x50, 0xc2, 0x6c, 0x9c, 0xd0, 0xd8, 0x9d},
++    {0x84, 0x98, 0x3e, 0x44, 0x1c, 0x3b, 0xd2, 0x6e, 0xba, 0xae,
++     0x4a, 0xa1, 0xf9, 0x51, 0x29, 0xe5, 0xe5, 0x46, 0x70, 0xf1},
++};
++
++static int corrupt_sha;
++
++void FIPS_corrupt_sha1()
++{
++    corrupt_sha = 1;
++}
++
++int FIPS_selftest_sha1()
++{
++    int n;
++
++    for (n = 0; n < sizeof(test) / sizeof(test[0]); ++n) {
++        unsigned char md[SHA_DIGEST_LENGTH];
++
++        EVP_Digest(test[n], strlen(test[n]) + corrupt_sha, md, NULL,
++                   EVP_sha1(), NULL);
++        if (memcmp(md, ret[n], sizeof md)) {
++            FIPSerr(FIPS_F_FIPS_SELFTEST_SHA1, FIPS_R_SELFTEST_FAILED);
++            return 0;
++        }
++    }
++    return 1;
++}
++
++static const unsigned char msg_sha256[] =
++    { 0xfa, 0x48, 0x59, 0x2a, 0xe1, 0xae, 0x1f, 0x30,
++    0xfc
++};
++
++static const unsigned char dig_sha256[] =
++    { 0xf7, 0x26, 0xd8, 0x98, 0x47, 0x91, 0x68, 0x5b,
++    0x9e, 0x39, 0xb2, 0x58, 0xbb, 0x75, 0xbf, 0x01,
++    0x17, 0x0c, 0x84, 0x00, 0x01, 0x7a, 0x94, 0x83,
++    0xf3, 0x0b, 0x15, 0x84, 0x4b, 0x69, 0x88, 0x8a
++};
++
++static const unsigned char msg_sha512[] =
++    { 0x37, 0xd1, 0x35, 0x9d, 0x18, 0x41, 0xe9, 0xb7,
++    0x6d, 0x9a, 0x13, 0xda, 0x5f, 0xf3, 0xbd
++};
++
++static const unsigned char dig_sha512[] =
++    { 0x11, 0x13, 0xc4, 0x19, 0xed, 0x2b, 0x1d, 0x16,
++    0x11, 0xeb, 0x9b, 0xbe, 0xf0, 0x7f, 0xcf, 0x44,
++    0x8b, 0xd7, 0x57, 0xbd, 0x8d, 0xa9, 0x25, 0xb0,
++    0x47, 0x25, 0xd6, 0x6c, 0x9a, 0x54, 0x7f, 0x8f,
++    0x0b, 0x53, 0x1a, 0x10, 0x68, 0x32, 0x03, 0x38,
++    0x82, 0xc4, 0x87, 0xc4, 0xea, 0x0e, 0xd1, 0x04,
++    0xa9, 0x98, 0xc1, 0x05, 0xa3, 0xf3, 0xf8, 0xb1,
++    0xaf, 0xbc, 0xd9, 0x78, 0x7e, 0xee, 0x3d, 0x43
++};
++
++int FIPS_selftest_sha2(void)
++{
++    unsigned char md[SHA512_DIGEST_LENGTH];
++
++    EVP_Digest(msg_sha256, sizeof(msg_sha256), md, NULL, EVP_sha256(), NULL);
++    if (memcmp(dig_sha256, md, sizeof(dig_sha256))) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_SHA2, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    EVP_Digest(msg_sha512, sizeof(msg_sha512), md, NULL, EVP_sha512(), NULL);
++    if (memcmp(dig_sha512, md, sizeof(dig_sha512))) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_SHA2, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    return 1;
++}
++
++#endif
+diff --git a/crypto/fips/fips_standalone_hmac.c b/crypto/fips/fips_standalone_hmac.c
+new file mode 100644
+index 0000000..0864c48
+--- /dev/null
++++ b/crypto/fips/fips_standalone_hmac.c
+@@ -0,0 +1,268 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/opensslconf.h>
++#include <openssl/sha.h>
++#include <openssl/hmac.h>
++
++#ifndef FIPSCANISTER_O
++int FIPS_selftest_failed()
++{
++    return 0;
++}
++
++void FIPS_selftest_check()
++{
++}
++#endif
++
++#ifdef OPENSSL_FIPS
++int bn_mul_mont_fpu64(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
++                      const BN_ULONG *np, const BN_ULONG *n0, int num)
++{
++    return 0;
++};
++
++int bn_mul_mont_int(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
++                    const BN_ULONG *np, const BN_ULONG *n0, int num)
++{
++    return 0;
++};
++
++# if     defined(__i386)   || defined(__i386__)   || defined(_M_IX86) || \
++        defined(__INTEL__) || \
++        defined(__x86_64) || defined(__x86_64__) || \
++        defined(_M_AMD64) || defined(_M_X64)
++
++unsigned int OPENSSL_ia32cap_P[4];
++unsigned long *OPENSSL_ia32cap_loc(void)
++{
++    if (sizeof(long) == 4)
++        /*
++         * If 32-bit application pulls address of OPENSSL_ia32cap_P[0]
++         * clear second element to maintain the illusion that vector
++         * is 32-bit.
++         */
++        OPENSSL_ia32cap_P[1] = 0;
++
++    OPENSSL_ia32cap_P[2] = 0;
++
++    return (unsigned long *)OPENSSL_ia32cap_P;
++}
++
++#  if defined(OPENSSL_CPUID_OBJ) && !defined(OPENSSL_NO_ASM) && !defined(I386_ONLY)
++#   define OPENSSL_CPUID_SETUP
++#   if defined(_WIN32)
++typedef unsigned __int64 IA32CAP;
++#   else
++typedef unsigned long long IA32CAP;
++#   endif
++void OPENSSL_cpuid_setup(void)
++{
++    static int trigger = 0;
++    IA32CAP OPENSSL_ia32_cpuid(unsigned int *);
++    IA32CAP vec;
++    char *env;
++
++    if (trigger)
++        return;
++
++    trigger = 1;
++    if ((env = getenv("OPENSSL_ia32cap"))) {
++        int off = (env[0] == '~') ? 1 : 0;
++#   if defined(_WIN32)
++        if (!sscanf(env + off, "%I64i", &vec))
++            vec = strtoul(env + off, NULL, 0);
++#   else
++        if (!sscanf(env + off, "%lli", (long long *)&vec))
++            vec = strtoul(env + off, NULL, 0);
++#   endif
++        if (off)
++            vec = OPENSSL_ia32_cpuid(OPENSSL_ia32cap_P) & ~vec;
++        else if (env[0] == ':')
++            vec = OPENSSL_ia32_cpuid(OPENSSL_ia32cap_P);
++
++        OPENSSL_ia32cap_P[2] = 0;
++        if ((env = strchr(env, ':'))) {
++            unsigned int vecx;
++            env++;
++            off = (env[0] == '~') ? 1 : 0;
++            vecx = strtoul(env + off, NULL, 0);
++            if (off)
++                OPENSSL_ia32cap_P[2] &= ~vecx;
++            else
++                OPENSSL_ia32cap_P[2] = vecx;
++        }
++    } else
++        vec = OPENSSL_ia32_cpuid(OPENSSL_ia32cap_P);
++
++    /*
++     * |(1<<10) sets a reserved bit to signal that variable
++     * was initialized already... This is to avoid interference
++     * with cpuid snippets in ELF .init segment.
++     */
++    OPENSSL_ia32cap_P[0] = (unsigned int)vec | (1 << 10);
++    OPENSSL_ia32cap_P[1] = (unsigned int)(vec >> 32);
++}
++#  else
++unsigned int OPENSSL_ia32cap_P[4];
++#  endif
++
++# else
++unsigned long *OPENSSL_ia32cap_loc(void)
++{
++    return NULL;
++}
++# endif
++int OPENSSL_NONPIC_relocated = 0;
++# if !defined(OPENSSL_CPUID_SETUP) && !defined(OPENSSL_CPUID_OBJ)
++void OPENSSL_cpuid_setup(void)
++{
++}
++# endif
++
++static void hmac_init(SHA256_CTX *md_ctx, SHA256_CTX *o_ctx, const char *key)
++{
++    size_t len = strlen(key);
++    int i;
++    unsigned char keymd[HMAC_MAX_MD_CBLOCK];
++    unsigned char pad[HMAC_MAX_MD_CBLOCK];
++
++    if (len > SHA_CBLOCK) {
++        SHA256_Init(md_ctx);
++        SHA256_Update(md_ctx, key, len);
++        SHA256_Final(keymd, md_ctx);
++        len = SHA256_DIGEST_LENGTH;
++    } else
++        memcpy(keymd, key, len);
++    memset(&keymd[len], '\0', HMAC_MAX_MD_CBLOCK - len);
++
++    for (i = 0; i < HMAC_MAX_MD_CBLOCK; i++)
++        pad[i] = 0x36 ^ keymd[i];
++    SHA256_Init(md_ctx);
++    SHA256_Update(md_ctx, pad, SHA256_CBLOCK);
++
++    for (i = 0; i < HMAC_MAX_MD_CBLOCK; i++)
++        pad[i] = 0x5c ^ keymd[i];
++    SHA256_Init(o_ctx);
++    SHA256_Update(o_ctx, pad, SHA256_CBLOCK);
++}
++
++static void hmac_final(unsigned char *md, SHA256_CTX *md_ctx,
++                       SHA256_CTX *o_ctx)
++{
++    unsigned char buf[SHA256_DIGEST_LENGTH];
++
++    SHA256_Final(buf, md_ctx);
++    SHA256_Update(o_ctx, buf, sizeof buf);
++    SHA256_Final(md, o_ctx);
++}
++
++#endif
++
++int main(int argc, char **argv)
++{
++#ifdef OPENSSL_FIPS
++    static char key[] = "orboDeJITITejsirpADONivirpUkvarP";
++    int n, binary = 0;
++
++    if (argc < 2) {
++        fprintf(stderr, "%s [<file>]+\n", argv[0]);
++        exit(1);
++    }
++
++    n = 1;
++    if (!strcmp(argv[n], "-binary")) {
++        n++;
++        binary = 1;             /* emit binary fingerprint... */
++    }
++
++    for (; n < argc; ++n) {
++        FILE *f = fopen(argv[n], "rb");
++        SHA256_CTX md_ctx, o_ctx;
++        unsigned char md[SHA256_DIGEST_LENGTH];
++        int i;
++
++        if (!f) {
++            perror(argv[n]);
++            exit(2);
++        }
++
++        hmac_init(&md_ctx, &o_ctx, key);
++        for (;;) {
++            char buf[1024];
++            size_t l = fread(buf, 1, sizeof buf, f);
++
++            if (l == 0) {
++                if (ferror(f)) {
++                    perror(argv[n]);
++                    exit(3);
++                } else
++                    break;
++            }
++            SHA256_Update(&md_ctx, buf, l);
++        }
++        hmac_final(md, &md_ctx, &o_ctx);
++
++        if (binary) {
++            fwrite(md, SHA256_DIGEST_LENGTH, 1, stdout);
++            break;              /* ... for single(!) file */
++        }
++
++/*      printf("HMAC-SHA1(%s)= ",argv[n]); */
++        for (i = 0; i < SHA256_DIGEST_LENGTH; ++i)
++            printf("%02x", md[i]);
++        printf("\n");
++    }
++#endif
++    return 0;
++}
+diff --git a/crypto/fips/fips_test_suite.c b/crypto/fips/fips_test_suite.c
+new file mode 100644
+index 0000000..1bba28d
+--- /dev/null
++++ b/crypto/fips/fips_test_suite.c
+@@ -0,0 +1,964 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ *
++ * This command is intended as a test driver for the FIPS-140 testing
++ * lab performing FIPS-140 validation.  It demonstrates the use of the
++ * OpenSSL library ito perform a variety of common cryptographic
++ * functions.  A power-up self test is demonstrated by deliberately
++ * pointing to an invalid executable hash
++ *
++ * Contributed by Steve Marquess.
++ *
++ */
++#include <stdio.h>
++#include <assert.h>
++#include <ctype.h>
++#include <string.h>
++#include <stdlib.h>
++#include <openssl/aes.h>
++#include <openssl/des.h>
++#include <openssl/rsa.h>
++#include <openssl/dsa.h>
++#include <openssl/dh.h>
++#include <openssl/hmac.h>
++#include <openssl/err.h>
++
++#include <openssl/bn.h>
++#include <openssl/rand.h>
++#include <openssl/sha.h>
++#include <openssl/cmac.h>
++#include <openssl/fips_rand.h>
++
++#ifndef OPENSSL_FIPS
++int main(int argc, char *argv[])
++{
++	printf("No FIPS support\n");
++	return (0);
++}
++#else
++
++# include <openssl/fips.h>
++# include "fips_utl.h"
++
++/* AES: encrypt and decrypt known plaintext, verify result matches
++ * original plaintext
++ */
++static int FIPS_aes_test(void)
++{
++	int ret = 0;
++	unsigned char pltmp[16];
++	unsigned char citmp[16];
++	unsigned char key[16] = { 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 };
++	unsigned char plaintext[16] = "etaonrishdlcu";
++	EVP_CIPHER_CTX ctx;
++
++	EVP_CIPHER_CTX_init(&ctx);
++	if (EVP_CipherInit_ex(&ctx, EVP_aes_128_ecb(), NULL, key, NULL, 1) <= 0)
++		goto err;
++	EVP_Cipher(&ctx, citmp, plaintext, 16);
++	if (EVP_CipherInit_ex(&ctx, EVP_aes_128_ecb(), NULL, key, NULL, 0) <= 0)
++		goto err;
++	EVP_Cipher(&ctx, pltmp, citmp, 16);
++	if (memcmp(pltmp, plaintext, 16))
++		goto err;
++	ret = 1;
++err:
++	EVP_CIPHER_CTX_cleanup(&ctx);
++	return ret;
++}
++
++static int FIPS_aes_gcm_test(void)
++{
++	int ret = 0;
++	unsigned char pltmp[16];
++	unsigned char citmp[16];
++	unsigned char tagtmp[16];
++	unsigned char key[16] = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16};
++	unsigned char iv[16] = {21,22,23,24,25,26,27,28,29,30,31,32};
++	unsigned char aad[] = "Some text AAD";
++	unsigned char plaintext[16] = "etaonrishdlcu";
++	EVP_CIPHER_CTX ctx;
++
++	EVP_CIPHER_CTX_init(&ctx);
++	if (EVP_CipherInit_ex(&ctx, EVP_aes_128_gcm(), NULL, key, iv, 1) <= 0)
++		goto err;
++	EVP_Cipher(&ctx, NULL, aad, sizeof(aad));
++	EVP_Cipher(&ctx, citmp, plaintext, 16);
++	EVP_Cipher(&ctx, NULL, NULL, 0);
++	if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, 16, tagtmp))
++		goto err;
++
++	if (EVP_CipherInit_ex(&ctx, EVP_aes_128_gcm(), NULL, key, iv, 0) <= 0)
++		goto err;
++	if (!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, 16, tagtmp))
++		goto err;
++
++	EVP_Cipher(&ctx, NULL, aad, sizeof(aad));
++
++	EVP_Cipher(&ctx, pltmp, citmp, 16);
++
++	if (EVP_Cipher(&ctx, NULL, NULL, 0) < 0)
++		goto err;
++
++	if (memcmp(pltmp, plaintext, 16))
++		goto err;
++
++	ret = 1;
++err:
++	EVP_CIPHER_CTX_cleanup(&ctx);
++	return ret;
++}
++
++static int FIPS_des3_test(void)
++{
++	int ret = 0;
++	unsigned char pltmp[8];
++	unsigned char citmp[8];
++	unsigned char key[] = { 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,
++				19,20,21,22,23,24 };
++	unsigned char plaintext[] = { 'e', 't', 'a', 'o', 'n', 'r', 'i', 's' };
++	EVP_CIPHER_CTX ctx;
++
++	EVP_CIPHER_CTX_init(&ctx);
++	if (EVP_CipherInit_ex(&ctx, EVP_des_ede3_ecb(), NULL, key, NULL, 1) <= 0)
++		goto err;
++	EVP_Cipher(&ctx, citmp, plaintext, 8);
++	if (EVP_CipherInit_ex(&ctx, EVP_des_ede3_ecb(), NULL, key, NULL, 0) <= 0)
++		goto err;
++	EVP_Cipher(&ctx, pltmp, citmp, 8);
++	if (memcmp(pltmp, plaintext, 8))
++		goto err;
++	ret = 1;
++err:
++	EVP_CIPHER_CTX_cleanup(&ctx);
++	return ret;
++}
++
++/*
++ * DSA: generate keys and sign, verify input plaintext.
++ */
++static int FIPS_dsa_test(int bad)
++{
++	DSA *dsa = NULL;
++	EVP_PKEY *pk = NULL;
++	unsigned char dgst[] = "etaonrishdlc";
++	unsigned char buf[60];
++	unsigned int slen;
++	int r = 0;
++	EVP_MD_CTX mctx;
++
++	ERR_clear_error();
++	EVP_MD_CTX_init(&mctx);
++	dsa = DSA_new();
++	if (!dsa)
++		goto end;
++	if (!DSA_generate_parameters_ex(dsa, 1024, NULL, 0, NULL, NULL, NULL))
++		goto end;
++	if (!DSA_generate_key(dsa))
++		goto end;
++	if (bad)
++		BN_add_word(dsa->pub_key, 1);
++
++	if ((pk=EVP_PKEY_new()) == NULL)
++		goto end;
++	EVP_PKEY_assign_DSA(pk, dsa);
++
++	if (!EVP_SignInit_ex(&mctx, EVP_dss1(), NULL))
++		goto end;
++	if (!EVP_SignUpdate(&mctx, dgst, sizeof(dgst) - 1))
++		goto end;
++	if (!EVP_SignFinal(&mctx, buf, &slen, pk))
++		goto end;
++
++	if (!EVP_VerifyInit_ex(&mctx, EVP_dss1(), NULL))
++		goto end;
++	if (!EVP_VerifyUpdate(&mctx, dgst, sizeof(dgst) - 1))
++		goto end;
++	r = EVP_VerifyFinal(&mctx, buf, slen, pk);
++end:
++	EVP_MD_CTX_cleanup(&mctx);
++	if (pk)
++		EVP_PKEY_free(pk);
++	else if (dsa)
++		DSA_free(dsa);
++	if (r != 1)
++		return 0;
++	return 1;
++}
++
++/*
++ * RSA: generate keys and sign, verify input plaintext.
++ */
++static int FIPS_rsa_test(int bad)
++{
++	RSA *key;
++	unsigned char input_ptext[] = "etaonrishdlc";
++	unsigned char buf[256];
++	unsigned int slen;
++	BIGNUM *bn;
++	EVP_MD_CTX mctx;
++	EVP_PKEY *pk = NULL;
++	int r = 0;
++
++	ERR_clear_error();
++	EVP_MD_CTX_init(&mctx);
++	key = RSA_new();
++	bn = BN_new();
++	if (!key || !bn)
++		return 0;
++	BN_set_word(bn, 65537);
++	if (!RSA_generate_key_ex(key, 1024, bn, NULL))
++		return 0;
++	BN_free(bn);
++	if (bad)
++		BN_add_word(key->n, 1);
++
++	if ((pk = EVP_PKEY_new()) == NULL)
++		goto end;
++	EVP_PKEY_set1_RSA(pk, key);
++
++	if (!EVP_SignInit_ex(&mctx, EVP_sha1(), NULL))
++		goto end;
++	if (!EVP_SignUpdate(&mctx, input_ptext, sizeof(input_ptext) - 1))
++		goto end;
++	if (!EVP_SignFinal(&mctx, buf, &slen, pk))
++		goto end;
++
++	if (!EVP_VerifyInit_ex(&mctx, EVP_sha1(), NULL))
++		goto end;
++	if (!EVP_VerifyUpdate(&mctx, input_ptext, sizeof(input_ptext) - 1))
++		goto end;
++	r = EVP_VerifyFinal(&mctx, buf, slen, pk);
++end:
++	EVP_MD_CTX_cleanup(&mctx);
++	if (pk)
++		EVP_PKEY_free(pk);
++	if (key)
++		RSA_free(key);
++	if (r != 1)
++		return 0;
++	return 1;
++}
++
++/* SHA1: generate hash of known digest value and compare to known
++ * precomputed correct hash
++ */
++static int FIPS_sha1_test()
++{
++	unsigned char digest[SHA_DIGEST_LENGTH] = { 0x11,0xf1,0x9a,0x3a,0xec,
++						    0x1a,0x1e,0x8e,0x65,0xd4,
++						    0x9a,0x38,0x0c,0x8b,0x1e,
++						    0x2c,0xe8,0xb3,0xc5,0x18 };
++	unsigned char str[] = "etaonrishd";
++	unsigned char md[SHA_DIGEST_LENGTH];
++
++	ERR_clear_error();
++	if (!EVP_Digest(str, sizeof(str) - 1, md, NULL, EVP_sha1(), NULL))
++		return 0;
++	if (memcmp(md, digest, sizeof(md)))
++		return 0;
++	return 1;
++}
++
++/* SHA256: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_sha256_test()
++{
++	unsigned char digest[SHA256_DIGEST_LENGTH] =
++			{ 0xf5,0x53,0xcd,0xb8,0xcf,0x1,0xee,0x17,0x9b,0x93,
++			  0xc9,0x68,0xc0,0xea,0x40,0x91,0x6,0xec,0x8e,0x11,
++			  0x96,0xc8,0x5d,0x1c,0xaf,0x64,0x22,0xe6,0x50,0x4f,
++			  0x47,0x57 };
++	unsigned char str[] = "etaonrishd";
++	unsigned char md[SHA256_DIGEST_LENGTH];
++
++	ERR_clear_error();
++	if (!EVP_Digest(str, sizeof(str) - 1, md, NULL, EVP_sha256(), NULL))
++		return 0;
++	if (memcmp(md, digest, sizeof(md)))
++		return 0;
++	return 1;
++}
++
++/* SHA512: generate hash of known digest value and compare to known
++   precomputed correct hash
++*/
++static int FIPS_sha512_test()
++{
++	unsigned char digest[SHA512_DIGEST_LENGTH] =
++			{ 0x99,0xc9,0xe9,0x5b,0x88,0xd4,0x78,0x88,0xdf,0x88,
++			  0x5f,0x94,0x71,0x64,0x28,0xca,0x16,0x1f,0x3d,0xf4,
++			  0x1f,0xf3,0x0f,0xc5,0x03,0x99,0xb2,0xd0,0xe7,0x0b,
++			  0x94,0x4a,0x45,0xd2,0x6c,0x4f,0x20,0x06,0xef,0x71,
++			  0xa9,0x25,0x7f,0x24,0xb1,0xd9,0x40,0x22,0x49,0x54,
++			  0x10,0xc2,0x22,0x9d,0x27,0xfe,0xbd,0xd6,0xd6,0xeb,
++			  0x2d,0x42,0x1d,0xa3 };
++	unsigned char str[] = "etaonrishd";
++	unsigned char md[SHA512_DIGEST_LENGTH];
++
++	ERR_clear_error();
++	if (!EVP_Digest(str, sizeof(str) - 1, md, NULL, EVP_sha512(), NULL))
++		return 0;
++	if (memcmp(md, digest, sizeof(md)))
++		return 0;
++	return 1;
++}
++
++/* HMAC-SHA1: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_hmac_sha1_test()
++{
++	unsigned char key[] = "etaonrishd";
++	unsigned char iv[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] = { 0x73,0xf7,0xa0,0x48,0xf8,0x94,
++						 0xed,0xdd,0x0a,0xea,0xea,0x56,
++						 0x1b,0x61,0x2e,0x70,0xb2,0xfb,
++						 0xec,0xc6 };
++	unsigned char out[EVP_MAX_MD_SIZE];
++	unsigned int outlen;
++
++	ERR_clear_error();
++	if (!HMAC(EVP_sha1(), key, sizeof(key) - 1, iv, sizeof(iv) - 1, out, &outlen))
++		return 0;
++	if (memcmp(out, kaval, outlen))
++		return 0;
++	return 1;
++}
++
++/* HMAC-SHA224: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_hmac_sha224_test()
++{
++	unsigned char key[] = "etaonrishd";
++	unsigned char iv[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] = { 0x75,0x58,0xd5,0xbd,0x55,0x6d,
++						 0x87,0x0f,0x75,0xff,0xbe,0x1c,
++						 0xb2,0xf0,0x20,0x35,0xe5,0x62,
++						 0x49,0xb6,0x94,0xb9,0xfc,0x65,
++						 0x34,0x33,0x3a,0x19 };
++	unsigned char out[EVP_MAX_MD_SIZE];
++	unsigned int outlen;
++
++	ERR_clear_error();
++	if (!HMAC(EVP_sha224(), key, sizeof(key) - 1, iv, sizeof(iv) - 1, out, &outlen))
++		return 0;
++	if (memcmp(out, kaval, outlen))
++		return 0;
++	return 1;
++}
++
++/* HMAC-SHA256: generate hash of known digest value and compare to known
++ * precomputed correct hash
++ */
++static int FIPS_hmac_sha256_test()
++{
++	unsigned char key[] = "etaonrishd";
++	unsigned char iv[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] = { 0xe9,0x17,0xc1,0x7b,0x4c,0x6b,
++						 0x77,0xda,0xd2,0x30,0x36,0x02,
++						 0xf5,0x72,0x33,0x87,0x9f,0xc6,
++						 0x6e,0x7b,0x7e,0xa8,0xea,0xaa,
++						 0x9f,0xba,0xee,0x51,0xff,0xda,
++						 0x24,0xf4 };
++	unsigned char out[EVP_MAX_MD_SIZE];
++	unsigned int outlen;
++
++	ERR_clear_error();
++	if (!HMAC(EVP_sha256(), key, sizeof(key) - 1, iv, sizeof(iv) - 1, out, &outlen))
++		return 0;
++	if (memcmp(out, kaval, outlen))
++		return 0;
++	return 1;
++}
++
++/* HMAC-SHA384: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_hmac_sha384_test()
++{
++	unsigned char key[] = "etaonrishd";
++	unsigned char iv[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] =
++				{ 0xb2,0x9d,0x40,0x58,0x32,0xc4,0xe3,0x31,
++				  0xb6,0x63,0x08,0x26,0x99,0xef,0x3b,0x10,
++				  0xe2,0xdf,0xf8,0xff,0xc6,0xe1,0x03,0x29,
++				  0x81,0x2a,0x1b,0xac,0xb0,0x07,0x39,0x08,
++				  0xf3,0x91,0x35,0x11,0x76,0xd6,0x4c,0x20,
++				  0xfb,0x4d,0xc3,0xf3,0xb8,0x9b,0x88,0x1c };
++
++	unsigned char out[EVP_MAX_MD_SIZE];
++	unsigned int outlen;
++
++	ERR_clear_error();
++	if (!HMAC(EVP_sha384(), key, sizeof(key) - 1, iv, sizeof(iv) - 1, out, &outlen))
++		return 0;
++	if (memcmp(out, kaval, outlen))
++		return 0;
++	return 1;
++}
++
++/* HMAC-SHA512: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_hmac_sha512_test()
++{
++	unsigned char key[] = "etaonrishd";
++	unsigned char iv[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] =
++				{ 0xcd,0x3e,0xb9,0x51,0xb8,0xbc,0x7f,0x9a,
++				  0x23,0xaf,0xf3,0x77,0x59,0x85,0xa9,0xe6,
++				  0xf7,0xd1,0x51,0x96,0x17,0xe0,0x92,0xd8,
++				  0xa6,0x3b,0xc1,0xad,0x7e,0x24,0xca,0xb1,
++				  0xd7,0x79,0x0a,0xa5,0xea,0x2c,0x02,0x58,
++				  0x0b,0xa6,0x52,0x6b,0x61,0x7f,0xeb,0x9c,
++				  0x47,0x86,0x5d,0x74,0x2b,0x88,0xdf,0xee,
++				  0x46,0x69,0x96,0x3d,0xa6,0xd9,0x2a,0x53 };
++	unsigned char out[EVP_MAX_MD_SIZE];
++	unsigned int outlen;
++
++	ERR_clear_error();
++	if (!HMAC(EVP_sha512(), key, sizeof(key) - 1, iv, sizeof(iv) - 1, out, &outlen))
++		return 0;
++	if (memcmp(out, kaval, outlen))
++		return 0;
++	return 1;
++}
++
++/* CMAC-AES128: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_cmac_aes128_test()
++{
++	unsigned char key[16] = { 0x2b,0x7e,0x15,0x16, 0x28,0xae,0xd2,0xa6,
++				  0xab,0xf7,0x15,0x88, 0x09,0xcf,0x4f,0x3c };
++	unsigned char data[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] =
++				{ 0x16,0x83,0xfe,0xac, 0x52,0x9b,0xae,0x23,
++				  0xd7,0xd5,0x66,0xf5, 0xd2,0x8d,0xbd,0x2a };
++	unsigned char *out = NULL;
++	size_t outlen;
++	CMAC_CTX *ctx = CMAC_CTX_new();
++	int r = 0;
++
++	ERR_clear_error();
++	if (!ctx)
++		goto end;
++	if (!CMAC_Init(ctx,key,sizeof(key),EVP_aes_128_cbc(),NULL))
++		goto end;
++	if (!CMAC_Update(ctx,data,sizeof(data)-1))
++		goto end;
++	/* This should return 1.  If not, there's a programming error... */
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++	out = OPENSSL_malloc(outlen);
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++#if 0
++	{
++	char *hexout = OPENSSL_malloc(outlen * 2 + 1);
++	bin2hex(out, outlen, hexout);
++	printf("CMAC-AES128: res = %s\n", hexout);
++	OPENSSL_free(hexout);
++	}
++	r = 1;
++#else
++	if (!memcmp(out,kaval,outlen))
++		r = 1;
++#endif
++
++end:
++	CMAC_CTX_free(ctx);
++	if (out)
++		OPENSSL_free(out);
++	return r;
++}
++
++/* CMAC-AES192: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_cmac_aes192_test()
++{
++	unsigned char key[] = { 0x8e,0x73,0xb0,0xf7, 0xda,0x0e,0x64,0x52,
++				0xc8,0x10,0xf3,0x2b, 0x80,0x90,0x79,0xe5,
++				0x62,0xf8,0xea,0xd2, 0x52,0x2c,0x6b,0x7b, };
++	unsigned char data[] = "Sample text";
++	unsigned char kaval[] = { 0xd6,0x99,0x19,0x25, 0xe5,0x1d,0x95,0x48,
++				  0xb1,0x4a,0x0b,0xf2, 0xc6,0x3c,0x47,0x1f, };
++	unsigned char *out = NULL;
++	size_t outlen;
++	CMAC_CTX *ctx = CMAC_CTX_new();
++	int r = 0;
++
++	ERR_clear_error();
++	if (!ctx)
++		goto end;
++	if (!CMAC_Init(ctx,key,sizeof(key),EVP_aes_192_cbc(),NULL))
++		goto end;
++	if (!CMAC_Update(ctx,data,sizeof(data)-1))
++		goto end;
++	/* This should return 1.  If not, there's a programming error... */
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++	out = OPENSSL_malloc(outlen);
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++#if 0
++	{
++	char *hexout = OPENSSL_malloc(outlen * 2 + 1);
++	bin2hex(out, outlen, hexout);
++	printf("CMAC-AES192: res = %s\n", hexout);
++	OPENSSL_free(hexout);
++	}
++	r = 1;
++#else
++	if (!memcmp(out,kaval,outlen))
++		r = 1;
++#endif
++
++end:
++	CMAC_CTX_free(ctx);
++	if (out)
++		OPENSSL_free(out);
++	return r;
++}
++
++/* CMAC-AES256: generate hash of known digest value and compare to known
++ *  precomputed correct hash
++ */
++static int FIPS_cmac_aes256_test()
++{
++	unsigned char key[] = { 0x60,0x3d,0xeb,0x10, 0x15,0xca,0x71,0xbe,
++				0x2b,0x73,0xae,0xf0, 0x85,0x7d,0x77,0x81,
++				0x1f,0x35,0x2c,0x07, 0x3b,0x61,0x08,0xd7,
++				0x2d,0x98,0x10,0xa3, 0x09,0x14,0xdf,0xf4, };
++	unsigned char data[] = "Sample text";
++	unsigned char kaval[] = { 0xec,0xc2,0xcf,0x63,0xc7,0xce,0xfc,0xa4,
++				  0xb0,0x86,0x37,0x5f,0x15,0x60,0xba,0x1f };
++	unsigned char *out = NULL;
++	size_t outlen;
++	CMAC_CTX *ctx = CMAC_CTX_new();
++	int r = 0;
++
++	ERR_clear_error();
++
++	if (!ctx)
++		goto end;
++	if (!CMAC_Init(ctx,key,sizeof(key),EVP_aes_256_cbc(),NULL))
++		goto end;
++	if (!CMAC_Update(ctx,data,sizeof(data)-1))
++		goto end;
++	/* This should return 1.  If not, there's a programming error... */
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++	out = OPENSSL_malloc(outlen);
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++#if 0
++	{
++	char *hexout = OPENSSL_malloc(outlen * 2 + 1);
++	bin2hex(out, outlen, hexout);
++	printf("CMAC-AES256: res = %s\n", hexout);
++	OPENSSL_free(hexout);
++	}
++	r = 1;
++#else
++	if (!memcmp(out,kaval,outlen))
++		r = 1;
++#endif
++
++end:
++	CMAC_CTX_free(ctx);
++	if (out)
++		OPENSSL_free(out);
++	return r;
++}
++
++/* CMAC-TDEA3: generate hash of known digest value and compare to known
++ * precomputed correct hash
++ */
++static int FIPS_cmac_tdea3_test()
++{
++	unsigned char key[] = { 0x8a,0xa8,0x3b,0xf8, 0xcb,0xda,0x10,0x62,
++				0x0b,0xc1,0xbf,0x19, 0xfb,0xb6,0xcd,0x58,
++				0xbc,0x31,0x3d,0x4a, 0x37,0x1c,0xa8,0xb5, };
++	unsigned char data[] = "Sample text";
++	unsigned char kaval[EVP_MAX_MD_SIZE] =
++				{ 0xb4,0x06,0x4e,0xbf,0x59,0x89,0xba,0x68, };
++	unsigned char *out = NULL;
++	size_t outlen;
++	CMAC_CTX *ctx = CMAC_CTX_new();
++	int r = 0;
++
++	ERR_clear_error();
++	if (!ctx)
++		goto end;
++	if (!CMAC_Init(ctx,key,sizeof(key),EVP_des_ede3_cbc(),NULL))
++		goto end;
++	if (!CMAC_Update(ctx,data,sizeof(data)-1))
++		goto end;
++	/* This should return 1.  If not, there's a programming error... */
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++	out = OPENSSL_malloc(outlen);
++	if (!CMAC_Final(ctx, out, &outlen))
++		goto end;
++#if 0
++	{
++	char *hexout = OPENSSL_malloc(outlen * 2 + 1);
++	bin2hex(out, outlen, hexout);
++	printf("CMAC-TDEA3: res = %s\n", hexout);
++	OPENSSL_free(hexout);
++	}
++	r = 1;
++#else
++	if (!memcmp(out,kaval,outlen))
++		r = 1;
++#endif
++
++end:
++	CMAC_CTX_free(ctx);
++	if (out)
++		OPENSSL_free(out);
++	return r;
++}
++
++
++/* DH: generate shared parameters
++ */
++static int dh_test()
++{
++	DH *dh;
++
++	ERR_clear_error();
++	dh = DH_new();
++	if (!dh)
++		return 0;
++	if (!DH_generate_parameters_ex(dh, 2048, 2, NULL))
++		return 0;
++	DH_free(dh);
++	return 1;
++}
++
++/* Zeroize
++ */
++static int Zeroize()
++{
++	RSA *key;
++	BIGNUM *bn;
++	unsigned char userkey[16] = { 0x48,0x50,0xf0,0xa3,0x3a,0xed,0xd3,0xaf,
++				      0x6e,0x47,0x7f,0x83,0x02,0xb1,0x09,0x68 };
++	int i, n;
++
++	key = RSA_new();
++	bn = BN_new();
++	if (!key || !bn)
++		return 0;
++	BN_set_word(bn, 65537);
++	if (!RSA_generate_key_ex(key, 1024, bn, NULL))
++		return 0;
++	BN_free(bn);
++
++	n = BN_num_bytes(key->d);
++	printf(" Generated %d byte RSA private key\n", n);
++	printf("\tBN key before overwriting:\n");
++	do_bn_print(stdout, key->d);
++	BN_rand(key->d, n * 8, -1, 0);
++	printf("\tBN key after overwriting:\n");
++	do_bn_print(stdout, key->d);
++
++	printf("\tchar buffer key before overwriting: \n\t\t");
++	for (i = 0; i < sizeof(userkey); i++)
++		printf("%02x", userkey[i]);
++	printf("\n");
++	RAND_bytes(userkey, sizeof userkey);
++	printf("\tchar buffer key after overwriting: \n\t\t");
++	for (i = 0; i < sizeof(userkey); i++)
++		printf("%02x", userkey[i]);
++	printf("\n");
++
++	return 1;
++}
++
++/* Dummy Entropy for DRBG tests. WARNING: THIS IS TOTALLY BOGUS
++ * HAS ZERO SECURITY AND MUST NOT BE USED IN REAL APPLICATIONS.
++ */
++static unsigned char dummy_drbg_entropy[1024];
++static size_t drbg_test_cb(DRBG_CTX *ctx, unsigned char **pout,
++			   int entropy, size_t min_len, size_t max_len)
++{
++	*pout = dummy_drbg_entropy;
++	/* Round up to multiple of block size */
++	return (min_len + 0xf) & ~0xf;
++}
++
++/* DRBG test: just generate lots of data and trigger health checks */
++static int do_drbg_test(int type, int flags)
++{
++	DRBG_CTX *dctx;
++	int rv = 0;
++	size_t i;
++	unsigned char randout[1024];
++
++	dctx = FIPS_drbg_new(type, flags);
++	if (!dctx)
++		return 0;
++	FIPS_drbg_set_callbacks(dctx, drbg_test_cb, 0, 0x10, drbg_test_cb, 0);
++	for (i = 0; i < sizeof(dummy_drbg_entropy); i++) {
++		dummy_drbg_entropy[i] = i & 0xff;
++	}
++	if (!FIPS_drbg_instantiate(dctx, dummy_drbg_entropy, 10))
++		goto err;
++	FIPS_drbg_set_check_interval(dctx, 10);
++	for (i = 0; i < 32; i++) {
++		if (!FIPS_drbg_generate(dctx, randout, sizeof(randout),
++					0, NULL, 0))
++			goto err;
++		if (!FIPS_drbg_generate(dctx, randout, sizeof(randout),
++					0, dummy_drbg_entropy, 1))
++			goto err;
++	}
++	rv = 1;
++err:
++	FIPS_drbg_free(dctx);
++	return rv;
++}
++
++typedef struct
++{
++	int type, flags;
++} DRBG_LIST;
++
++static int do_drbg_all(void)
++{
++	static DRBG_LIST drbg_types[] = {
++		{NID_sha1, 0},
++		{NID_sha224, 0},
++		{NID_sha256, 0},
++		{NID_sha384, 0},
++		{NID_sha512, 0},
++		{NID_hmacWithSHA1, 0},
++		{NID_hmacWithSHA224, 0},
++		{NID_hmacWithSHA256, 0},
++		{NID_hmacWithSHA384, 0},
++		{NID_hmacWithSHA512, 0},
++		{NID_aes_128_ctr, 0},
++		{NID_aes_192_ctr, 0},
++		{NID_aes_256_ctr, 0},
++		{NID_aes_128_ctr, DRBG_FLAG_CTR_USE_DF},
++		{NID_aes_192_ctr, DRBG_FLAG_CTR_USE_DF},
++		{NID_aes_256_ctr, DRBG_FLAG_CTR_USE_DF},
++		{0, 0}
++	};
++	DRBG_LIST *lst;
++	int rv = 1;
++	for (lst = drbg_types;; lst++) {
++		if (lst->type == 0)
++			break;
++		if (!do_drbg_test(lst->type, lst->flags))
++			rv = 0;
++	}
++	return rv;
++}
++
++static int Error;
++const char *Fail(const char *msg)
++{
++	do_print_errors();
++	Error++;
++	return msg;
++}
++
++static void test_msg(const char *msg, int result)
++{
++        printf("%s...%s\n", msg, result ? "successful" : Fail("Failed!"));
++}
++
++int main(int argc, char **argv)
++{
++
++	int do_corrupt_rsa_keygen = 0;
++	int bad_rsa = 0, bad_dsa = 0;
++	int no_exit = 0;
++	int do_drbg = 0;
++	int do_drbg_stick = 0;
++
++	printf("\tFIPS-mode test application\n\n");
++
++	/* Load entropy from external file, if any */
++	RAND_load_file(".rnd", 1024);
++
++	if (argv[1]) {
++		/* Corrupted KAT tests */
++		if (!strcmp(argv[1], "aes")) {
++			FIPS_corrupt_aes();
++			printf("AES encryption/decryption with corrupted KAT...\n");
++		} else if (!strcmp(argv[1], "des")) {
++			FIPS_corrupt_des();
++			printf("DES3-ECB encryption/decryption with corrupted KAT...\n");
++		} else if (!strcmp(argv[1], "dsa")) {
++			FIPS_corrupt_dsa();
++			printf("DSA key generation and signature validation with corrupted KAT...\n");
++		} else if (!strcmp(argv[1], "rsa")) {
++			FIPS_corrupt_rsa();
++			printf("RSA key generation and signature validation with corrupted KAT...\n");
++		} else if (!strcmp(argv[1], "rsakey")) {
++			printf("RSA key generation and signature validation with corrupted key...\n");
++			bad_rsa = 1;
++			no_exit = 1;
++		} else if (!strcmp(argv[1], "rsakeygen")) {
++			do_corrupt_rsa_keygen = 1;
++			no_exit = 1;
++			printf("RSA key generation and signature validation with corrupted keygen...\n");
++		} else if (!strcmp(argv[1], "dsakey")) {
++			printf("DSA key generation and signature validation with corrupted key...\n");
++			bad_dsa = 1;
++			no_exit = 1;
++		} else if (!strcmp(argv[1], "sha1")) {
++			FIPS_corrupt_sha1();
++			printf("SHA-1 hash with corrupted KAT...\n");
++		} else if (!strcmp(argv[1], "drbg")) {
++			do_drbg = 1;
++			no_exit = 1;
++		} else if (!strcmp(argv[1], "drbgstick")) {
++			do_drbg_stick = 1;
++			no_exit = 1;
++			printf("DRBG test with stuck continuous test...\n");
++		} else {
++			printf("Bad argument \"%s\"\n", argv[1]);
++			exit(1);
++		}
++
++		if (!no_exit) {
++			if (!FIPS_mode_set(1)) {
++				do_print_errors();
++				printf("Power-up self test failed\n");
++				exit(1);
++			}
++			printf("Power-up self test successful\n");
++			exit(0);
++		}
++	}
++
++	/* Non-Approved cryptographic operation
++	 */
++	printf("1. Non-Approved cryptographic operation test...\n");
++	test_msg("\ta. Included algorithm (D-H)...", dh_test());
++
++	/* Power-up self test
++	 */
++	ERR_clear_error();
++	printf("2. Automatic power-up self test...");
++	if (!FIPS_mode_set(1)) {
++		do_print_errors();
++		printf("%s\n", Fail("FAILED!"));
++		exit(1);
++	}
++	printf("successful\n");
++	if (do_corrupt_rsa_keygen)
++		FIPS_corrupt_rsa_keygen();
++	if (do_drbg_stick)
++		FIPS_drbg_stick(1);
++
++	/* AES encryption/decryption
++	 */
++	test_msg("3. AES encryption/decryption", FIPS_aes_test());
++
++	/* AES GCM encryption/decryption
++	 */
++	test_msg("3b. AES-GCM encryption/decryption", FIPS_aes_gcm_test());
++
++	/* RSA key generation and encryption/decryption
++	 */
++	test_msg("4. RSA key generation and encryption/decryption",
++	FIPS_rsa_test(bad_rsa));
++
++	/* DES-CBC encryption/decryption
++	 */
++	test_msg("5. DES-ECB encryption/decryption", FIPS_des3_test());
++
++	/* DSA key generation and signature validation
++	 */
++	test_msg("6. DSA key generation and signature validation",
++	FIPS_dsa_test(bad_dsa));
++
++	/* SHA-1 hash
++	 */
++	test_msg("7a. SHA-1 hash", FIPS_sha1_test());
++
++	/* SHA-256 hash
++	 */
++	test_msg("7b. SHA-256 hash", FIPS_sha256_test());
++
++	/* SHA-512 hash
++	 */
++	test_msg("7c. SHA-512 hash", FIPS_sha512_test());
++
++	/* HMAC-SHA-1 hash
++	 */
++	test_msg("7d. HMAC-SHA-1 hash", FIPS_hmac_sha1_test());
++
++	/* HMAC-SHA-224 hash
++	 */
++	test_msg("7e. HMAC-SHA-224 hash", FIPS_hmac_sha224_test());
++
++	/* HMAC-SHA-256 hash
++	 */
++	test_msg("7f. HMAC-SHA-256 hash", FIPS_hmac_sha256_test());
++
++	/* HMAC-SHA-384 hash
++	 */
++	test_msg("7g. HMAC-SHA-384 hash", FIPS_hmac_sha384_test());
++
++	/* HMAC-SHA-512 hash
++	 */
++	test_msg("7h. HMAC-SHA-512 hash", FIPS_hmac_sha512_test());
++
++	/* CMAC-AES-128 hash
++	 */
++	test_msg("8a. CMAC-AES-128 hash", FIPS_cmac_aes128_test());
++
++	/* CMAC-AES-192 hash
++	 */
++	test_msg("8b. CMAC-AES-192 hash", FIPS_cmac_aes192_test());
++
++	/* CMAC-AES-256 hash
++	 */
++	test_msg("8c. CMAC-AES-256 hash", FIPS_cmac_aes256_test());
++
++	/* CMAC-TDEA-3 hash
++	 */
++	test_msg("8d. CMAC-TDEA-3 hash", FIPS_cmac_tdea3_test());
++
++	/* Non-Approved cryptographic operation
++	 */
++	printf("9. Non-Approved cryptographic operation test...\n");
++	printf("\ta. Included algorithm (D-H)...%s\n",
++		dh_test() ? "successful as expected\n"
++		: Fail("failed INCORRECTLY!\n"));
++
++	/* Zeroization
++	 */
++	printf("10. Zero-ization...\n\t%s\n",
++	       Zeroize() ? "\tsuccessful as expected"
++	       : Fail("failed INCORRECTLY!"));
++
++	printf("11. Complete DRBG health check...\n");
++	printf("\t%s\n", FIPS_selftest_drbg_all() ? "successful as expected"
++					         : Fail("failed INCORRECTLY!"));
++
++	printf("12. DRBG generation check...\n");
++	if (!do_drbg)
++		printf("\tskipped\n");
++	else
++		printf("\t%s\n", do_drbg_all() ? "successful as expected"
++                                        : Fail("failed INCORRECTLY!") );
++
++	printf("\nAll tests completed with %d errors\n", Error);
++	return Error ? 1 : 0;
++}
++
++#endif
+diff --git a/crypto/fips/fips_utl.h b/crypto/fips/fips_utl.h
+new file mode 100644
+index 0000000..0b289bf
+--- /dev/null
++++ b/crypto/fips/fips_utl.h
+@@ -0,0 +1,342 @@
++/* ====================================================================
++ * Copyright (c) 2007 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++void do_print_errors(void)
++	{
++	const char *file, *data;
++	int line, flags;
++	unsigned long l;
++	while ((l = ERR_get_error_line_data(&file, &line, &data, &flags)))
++		{
++		fprintf(stderr, "ERROR:%lx:lib=%d,func=%d,reason=%d"
++				":file=%s:line=%d:%s\n",
++			l, ERR_GET_LIB(l), ERR_GET_FUNC(l), ERR_GET_REASON(l),
++			file, line, flags & ERR_TXT_STRING ? data : "");
++		}
++	}
++
++int hex2bin(const char *in, unsigned char *out)
++    {
++    int n1, n2;
++    unsigned char ch;
++
++    for (n1=0,n2=0 ; in[n1] && in[n1] != '\n' ; )
++	{ /* first byte */
++	if ((in[n1] >= '0') && (in[n1] <= '9'))
++	    ch = in[n1++] - '0';
++	else if ((in[n1] >= 'A') && (in[n1] <= 'F'))
++	    ch = in[n1++] - 'A' + 10;
++	else if ((in[n1] >= 'a') && (in[n1] <= 'f'))
++	    ch = in[n1++] - 'a' + 10;
++	else
++	    return -1;
++	if(!in[n1])
++	    {
++	    out[n2++]=ch;
++	    break;
++	    }
++	out[n2] = ch << 4;
++	/* second byte */
++	if ((in[n1] >= '0') && (in[n1] <= '9'))
++	    ch = in[n1++] - '0';
++	else if ((in[n1] >= 'A') && (in[n1] <= 'F'))
++	    ch = in[n1++] - 'A' + 10;
++	else if ((in[n1] >= 'a') && (in[n1] <= 'f'))
++	    ch = in[n1++] - 'a' + 10;
++	else
++	    return -1;
++	out[n2++] |= ch;
++	}
++    return n2;
++    }
++
++unsigned char *hex2bin_m(const char *in, long *plen)
++	{
++	unsigned char *p;
++	p = OPENSSL_malloc((strlen(in) + 1)/2);
++	*plen = hex2bin(in, p);
++	return p;
++	}
++
++int do_hex2bn(BIGNUM **pr, const char *in)
++	{
++	unsigned char *p;
++	long plen;
++	int r = 0;
++	p = hex2bin_m(in, &plen);
++	if (!p)
++		return 0;
++	if (!*pr)
++		*pr = BN_new();
++	if (!*pr)
++		return 0;
++	if (BN_bin2bn(p, plen, *pr))
++		r = 1;
++	OPENSSL_free(p);
++	return r;
++	}
++
++int do_bn_print(FILE *out, BIGNUM *bn)
++	{
++	int len, i;
++	unsigned char *tmp;
++	len = BN_num_bytes(bn);
++	if (len == 0)
++		{
++		fputs("00", out);
++		return 1;
++		}
++
++	tmp = OPENSSL_malloc(len);
++	if (!tmp)
++		{
++		fprintf(stderr, "Memory allocation error\n");
++		return 0;
++		}
++	BN_bn2bin(bn, tmp);
++	for (i = 0; i < len; i++)
++		fprintf(out, "%02x", tmp[i]);
++	OPENSSL_free(tmp);
++	return 1;
++	}
++
++int do_bn_print_name(FILE *out, const char *name, BIGNUM *bn)
++	{
++	int r;
++	fprintf(out, "%s = ", name);
++	r = do_bn_print(out, bn);
++	if (!r)
++		return 0;
++	fputs("\n", out);
++	return 1;
++	}
++
++int parse_line(char **pkw, char **pval, char *linebuf, char *olinebuf)
++	{
++	char *keyword, *value, *p, *q;
++	strcpy(linebuf, olinebuf);
++	keyword = linebuf;
++	/* Skip leading space */
++	while (isspace((unsigned char)*keyword))
++		keyword++;
++
++	/* Look for = sign */
++	p = strchr(linebuf, '=');
++
++	/* If no '=' exit */
++	if (!p)
++		return 0;
++
++	q = p - 1;
++
++	/* Remove trailing space */
++	while (isspace((unsigned char)*q))
++		*q-- = 0;
++
++	*p = 0;
++	value = p + 1;
++
++	/* Remove leading space from value */
++	while (isspace((unsigned char)*value))
++		value++;
++
++	/* Remove trailing space from value */
++	p = value + strlen(value) - 1;
++
++	while (*p == '\n' || isspace((unsigned char)*p))
++		*p-- = 0;
++
++	*pkw = keyword;
++	*pval = value;
++	return 1;
++	}
++
++BIGNUM *hex2bn(const char *in)
++    {
++    BIGNUM *p=NULL;
++
++    if (!do_hex2bn(&p, in))
++	return NULL;
++
++    return p;
++    }
++
++int bin2hex(const unsigned char *in,int len,char *out)
++    {
++    int n1, n2;
++    unsigned char ch;
++
++    for (n1=0,n2=0 ; n1 < len ; ++n1)
++	{
++	ch=in[n1] >> 4;
++	if (ch <= 0x09)
++	    out[n2++]=ch+'0';
++	else
++	    out[n2++]=ch-10+'a';
++	ch=in[n1] & 0x0f;
++	if(ch <= 0x09)
++	    out[n2++]=ch+'0';
++	else
++	    out[n2++]=ch-10+'a';
++	}
++    out[n2]='\0';
++    return n2;
++    }
++
++void pv(const char *tag,const unsigned char *val,int len)
++    {
++    char obuf[2048];
++
++    bin2hex(val,len,obuf);
++    printf("%s = %s\n",tag,obuf);
++    }
++
++/* To avoid extensive changes to test program at this stage just convert
++ * the input line into an acceptable form. Keyword lines converted to form
++ * "keyword = value\n" no matter what white space present, all other lines
++ * just have leading and trailing space removed.
++ */
++
++int tidy_line(char *linebuf, char *olinebuf)
++	{
++	char *keyword, *value, *p, *q;
++	strcpy(linebuf, olinebuf);
++	keyword = linebuf;
++	/* Skip leading space */
++	while (isspace((unsigned char)*keyword))
++		keyword++;
++	/* Look for = sign */
++	p = strchr(linebuf, '=');
++
++	/* If no '=' just chop leading, trailing ws */
++	if (!p)
++		{
++		p = keyword + strlen(keyword) - 1;
++		while (*p == '\n' || isspace((unsigned char)*p))
++			*p-- = 0;
++		strcpy(olinebuf, keyword);
++		strcat(olinebuf, "\n");
++		return 1;
++		}
++
++	q = p - 1;
++
++	/* Remove trailing space */
++	while (isspace((unsigned char)*q))
++		*q-- = 0;
++
++	*p = 0;
++	value = p + 1;
++
++	/* Remove leading space from value */
++	while (isspace((unsigned char)*value))
++		value++;
++
++	/* Remove trailing space from value */
++	p = value + strlen(value) - 1;
++
++	while (*p == '\n' || isspace((unsigned char)*p))
++		*p-- = 0;
++
++	strcpy(olinebuf, keyword);
++	strcat(olinebuf, " = ");
++	strcat(olinebuf, value);
++	strcat(olinebuf, "\n");
++
++	return 1;
++	}
++
++/* NB: this return the number of _bits_ read */
++int bint2bin(const char *in, int len, unsigned char *out)
++    {
++    int n;
++
++    memset(out,0,len);
++    for(n=0 ; n < len ; ++n)
++	if(in[n] == '1')
++	    out[n/8]|=(0x80 >> (n%8));
++    return len;
++    }
++
++int bin2bint(const unsigned char *in,int len,char *out)
++    {
++    int n;
++
++    for(n=0 ; n < len ; ++n)
++	out[n]=(in[n/8]&(0x80 >> (n%8))) ? '1' : '0';
++    return n;
++    }
++
++/*-----------------------------------------------*/
++
++void PrintValue(char *tag, unsigned char *val, int len)
++{
++#if VERBOSE
++  char obuf[2048];
++  int olen;
++  olen = bin2hex(val, len, obuf);
++  printf("%s = %.*s\n", tag, olen, obuf);
++#endif
++}
++
++void OutputValue(char *tag, unsigned char *val, int len, FILE *rfp,int bitmode)
++    {
++    char obuf[2048];
++    int olen;
++
++    if(bitmode)
++	olen=bin2bint(val,len,obuf);
++    else
++	olen=bin2hex(val,len,obuf);
++
++    fprintf(rfp, "%s = %.*s\n", tag, olen, obuf);
++#if VERBOSE
++    printf("%s = %.*s\n", tag, olen, obuf);
++#endif
++    }
+diff --git a/crypto/fips_err.h b/crypto/fips_err.h
+index 0308b63..3da2188 100644
+--- a/crypto/fips_err.h
++++ b/crypto/fips_err.h
+@@ -71,26 +71,21 @@
+ 
+ static ERR_STRING_DATA FIPS_str_functs[] = {
+     {ERR_FUNC(FIPS_F_DH_BUILTIN_GENPARAMS), "DH_BUILTIN_GENPARAMS"},
+-    {ERR_FUNC(FIPS_F_DH_INIT), "DH_INIT"},
+     {ERR_FUNC(FIPS_F_DRBG_RESEED), "DRBG_RESEED"},
+-    {ERR_FUNC(FIPS_F_DSA_BUILTIN_PARAMGEN), "DSA_BUILTIN_PARAMGEN"},
++    {ERR_FUNC(FIPS_F_DSA_BUILTIN_PARAMGEN), "dsa_builtin_paramgen"},
+     {ERR_FUNC(FIPS_F_DSA_BUILTIN_PARAMGEN2), "DSA_BUILTIN_PARAMGEN2"},
+     {ERR_FUNC(FIPS_F_DSA_DO_SIGN), "DSA_do_sign"},
+     {ERR_FUNC(FIPS_F_DSA_DO_VERIFY), "DSA_do_verify"},
++    {ERR_FUNC(FIPS_F_ECDH_COMPUTE_KEY), "ECDH_compute_key"},
++    {ERR_FUNC(FIPS_F_ECDSA_DO_SIGN), "ECDSA_do_sign"},
++    {ERR_FUNC(FIPS_F_ECDSA_DO_VERIFY), "ECDSA_do_verify"},
++    {ERR_FUNC(FIPS_F_EC_KEY_GENERATE_KEY), "EC_KEY_generate_key"},
++    {ERR_FUNC(FIPS_F_EVP_CIPHERINIT_EX), "EVP_CipherInit_ex"},
++    {ERR_FUNC(FIPS_F_EVP_DIGESTINIT_EX), "EVP_DigestInit_ex"},
+     {ERR_FUNC(FIPS_F_FIPS_CHECK_DSA), "FIPS_CHECK_DSA"},
+     {ERR_FUNC(FIPS_F_FIPS_CHECK_DSA_PRNG), "fips_check_dsa_prng"},
+     {ERR_FUNC(FIPS_F_FIPS_CHECK_EC), "FIPS_CHECK_EC"},
+-    {ERR_FUNC(FIPS_F_FIPS_CHECK_EC_PRNG), "fips_check_ec_prng"},
+-    {ERR_FUNC(FIPS_F_FIPS_CHECK_INCORE_FINGERPRINT),
+-     "FIPS_check_incore_fingerprint"},
+     {ERR_FUNC(FIPS_F_FIPS_CHECK_RSA), "fips_check_rsa"},
+-    {ERR_FUNC(FIPS_F_FIPS_CHECK_RSA_PRNG), "fips_check_rsa_prng"},
+-    {ERR_FUNC(FIPS_F_FIPS_CIPHER), "FIPS_cipher"},
+-    {ERR_FUNC(FIPS_F_FIPS_CIPHERINIT), "FIPS_cipherinit"},
+-    {ERR_FUNC(FIPS_F_FIPS_CIPHER_CTX_CTRL), "FIPS_CIPHER_CTX_CTRL"},
+-    {ERR_FUNC(FIPS_F_FIPS_DIGESTFINAL), "FIPS_digestfinal"},
+-    {ERR_FUNC(FIPS_F_FIPS_DIGESTINIT), "FIPS_digestinit"},
+-    {ERR_FUNC(FIPS_F_FIPS_DIGESTUPDATE), "FIPS_digestupdate"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_BYTES), "FIPS_DRBG_BYTES"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_CHECK), "FIPS_DRBG_CHECK"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_CPRNG_TEST), "FIPS_DRBG_CPRNG_TEST"},
+@@ -99,10 +94,7 @@ static ERR_STRING_DATA FIPS_str_functs[] = {
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_INIT), "FIPS_drbg_init"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_INSTANTIATE), "FIPS_drbg_instantiate"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_NEW), "FIPS_drbg_new"},
+-    {ERR_FUNC(FIPS_F_FIPS_DRBG_RESEED), "FIPS_drbg_reseed"},
+     {ERR_FUNC(FIPS_F_FIPS_DRBG_SINGLE_KAT), "FIPS_DRBG_SINGLE_KAT"},
+-    {ERR_FUNC(FIPS_F_FIPS_DSA_SIGN_DIGEST), "FIPS_dsa_sign_digest"},
+-    {ERR_FUNC(FIPS_F_FIPS_DSA_VERIFY_DIGEST), "FIPS_dsa_verify_digest"},
+     {ERR_FUNC(FIPS_F_FIPS_GET_ENTROPY), "FIPS_GET_ENTROPY"},
+     {ERR_FUNC(FIPS_F_FIPS_MODULE_MODE_SET), "FIPS_module_mode_set"},
+     {ERR_FUNC(FIPS_F_FIPS_PKEY_SIGNATURE_TEST), "fips_pkey_signature_test"},
+@@ -112,23 +104,20 @@ static ERR_STRING_DATA FIPS_str_functs[] = {
+     {ERR_FUNC(FIPS_F_FIPS_RAND_SEED), "FIPS_rand_seed"},
+     {ERR_FUNC(FIPS_F_FIPS_RAND_SET_METHOD), "FIPS_rand_set_method"},
+     {ERR_FUNC(FIPS_F_FIPS_RAND_STATUS), "FIPS_rand_status"},
+-    {ERR_FUNC(FIPS_F_FIPS_RSA_SIGN_DIGEST), "FIPS_rsa_sign_digest"},
+-    {ERR_FUNC(FIPS_F_FIPS_RSA_VERIFY_DIGEST), "FIPS_rsa_verify_digest"},
++    {ERR_FUNC(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN), "FIPS_RSA_BUILTIN_KEYGEN"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES), "FIPS_selftest_aes"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_CCM), "FIPS_selftest_aes_ccm"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_GCM), "FIPS_selftest_aes_gcm"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_XTS), "FIPS_selftest_aes_xts"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_CMAC), "FIPS_selftest_cmac"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_DES), "FIPS_selftest_des"},
+-    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_DSA), "FIPS_selftest_dsa"},
+-    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_ECDSA), "FIPS_selftest_ecdsa"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_HMAC), "FIPS_selftest_hmac"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_SHA1), "FIPS_selftest_sha1"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_SHA2), "FIPS_selftest_sha2"},
+     {ERR_FUNC(FIPS_F_FIPS_SELFTEST_X931), "FIPS_selftest_x931"},
+     {ERR_FUNC(FIPS_F_FIPS_SET_PRNG_KEY), "FIPS_SET_PRNG_KEY"},
+     {ERR_FUNC(FIPS_F_HASH_FINAL), "HASH_FINAL"},
+     {ERR_FUNC(FIPS_F_RSA_BUILTIN_KEYGEN), "RSA_BUILTIN_KEYGEN"},
+-    {ERR_FUNC(FIPS_F_RSA_EAY_INIT), "RSA_EAY_INIT"},
+     {ERR_FUNC(FIPS_F_RSA_EAY_PRIVATE_DECRYPT), "RSA_EAY_PRIVATE_DECRYPT"},
+     {ERR_FUNC(FIPS_F_RSA_EAY_PRIVATE_ENCRYPT), "RSA_EAY_PRIVATE_ENCRYPT"},
+     {ERR_FUNC(FIPS_F_RSA_EAY_PUBLIC_DECRYPT), "RSA_EAY_PUBLIC_DECRYPT"},
+@@ -143,8 +132,6 @@ static ERR_STRING_DATA FIPS_str_reasons[] = {
+     {ERR_REASON(FIPS_R_ADDITIONAL_INPUT_TOO_LONG),
+      "additional input too long"},
+     {ERR_REASON(FIPS_R_ALREADY_INSTANTIATED), "already instantiated"},
+-    {ERR_REASON(FIPS_R_AUTHENTICATION_FAILURE), "authentication failure"},
+-    {ERR_REASON(FIPS_R_CONTRADICTING_EVIDENCE), "contradicting evidence"},
+     {ERR_REASON(FIPS_R_DRBG_NOT_INITIALISED), "drbg not initialised"},
+     {ERR_REASON(FIPS_R_DRBG_STUCK), "drbg stuck"},
+     {ERR_REASON(FIPS_R_ENTROPY_ERROR_UNDETECTED), "entropy error undetected"},
+@@ -159,10 +146,6 @@ static ERR_STRING_DATA FIPS_str_reasons[] = {
+     {ERR_REASON(FIPS_R_ERROR_RETRIEVING_NONCE), "error retrieving nonce"},
+     {ERR_REASON(FIPS_R_FINGERPRINT_DOES_NOT_MATCH),
+      "fingerprint does not match"},
+-    {ERR_REASON(FIPS_R_FINGERPRINT_DOES_NOT_MATCH_NONPIC_RELOCATED),
+-     "fingerprint does not match nonpic relocated"},
+-    {ERR_REASON(FIPS_R_FINGERPRINT_DOES_NOT_MATCH_SEGMENT_ALIASING),
+-     "fingerprint does not match segment aliasing"},
+     {ERR_REASON(FIPS_R_FIPS_MODE_ALREADY_SET), "fips mode already set"},
+     {ERR_REASON(FIPS_R_FIPS_SELFTEST_FAILED), "fips selftest failed"},
+     {ERR_REASON(FIPS_R_FUNCTION_ERROR), "function error"},
+@@ -170,8 +153,6 @@ static ERR_STRING_DATA FIPS_str_reasons[] = {
+     {ERR_REASON(FIPS_R_GENERATE_ERROR_UNDETECTED),
+      "generate error undetected"},
+     {ERR_REASON(FIPS_R_INSTANTIATE_ERROR), "instantiate error"},
+-    {ERR_REASON(FIPS_R_INSUFFICIENT_SECURITY_STRENGTH),
+-     "insufficient security strength"},
+     {ERR_REASON(FIPS_R_INTERNAL_ERROR), "internal error"},
+     {ERR_REASON(FIPS_R_INVALID_KEY_LENGTH), "invalid key length"},
+     {ERR_REASON(FIPS_R_INVALID_PARAMETERS), "invalid parameters"},
+@@ -198,8 +179,6 @@ static ERR_STRING_DATA FIPS_str_reasons[] = {
+     {ERR_REASON(FIPS_R_RESEED_ERROR), "reseed error"},
+     {ERR_REASON(FIPS_R_SELFTEST_FAILED), "selftest failed"},
+     {ERR_REASON(FIPS_R_SELFTEST_FAILURE), "selftest failure"},
+-    {ERR_REASON(FIPS_R_STRENGTH_ERROR_UNDETECTED),
+-     "strength error undetected"},
+     {ERR_REASON(FIPS_R_TEST_FAILURE), "test failure"},
+     {ERR_REASON(FIPS_R_UNINSTANTIATE_ERROR), "uninstantiate error"},
+     {ERR_REASON(FIPS_R_UNINSTANTIATE_ZEROISE_ERROR),
+diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
+index 51a0a3e..cca5d78 100644
+--- a/crypto/hmac/hmac.c
++++ b/crypto/hmac/hmac.c
+@@ -89,12 +89,6 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
+             EVPerr(EVP_F_HMAC_INIT_EX, EVP_R_DISABLED_FOR_FIPS);
+             return 0;
+         }
+-        /*
+-         * Other algorithm blocking will be done in FIPS_cmac_init, via
+-         * FIPS_hmac_init_ex().
+-         */
+-        if (!impl && !ctx->i_ctx.engine)
+-            return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
+     }
+ #endif
+     /* If we are changing MD then we must have a key */
+@@ -111,6 +105,13 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
+     }
+ 
+     if (key != NULL) {
++#ifdef OPENSSL_FIPS
++        if (FIPS_mode() && !(md->flags & EVP_MD_FLAG_FIPS)
++            && (!(ctx->md_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
++                || !(ctx->i_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
++                || !(ctx->o_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)))
++            goto err;
++#endif
+         reset = 1;
+         j = EVP_MD_block_size(md);
+         OPENSSL_assert(j <= (int)sizeof(ctx->key));
+@@ -164,10 +165,6 @@ int HMAC_Init(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md)
+ 
+ int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
+ {
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->i_ctx.engine)
+-        return FIPS_hmac_update(ctx, data, len);
+-#endif
+     if (!ctx->md)
+         return 0;
+ 
+@@ -178,10 +175,6 @@ int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
+ {
+     unsigned int i;
+     unsigned char buf[EVP_MAX_MD_SIZE];
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->i_ctx.engine)
+-        return FIPS_hmac_final(ctx, md, len);
+-#endif
+ 
+     if (!ctx->md)
+         goto err;
+@@ -225,12 +218,6 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
+ 
+ void HMAC_CTX_cleanup(HMAC_CTX *ctx)
+ {
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !ctx->i_ctx.engine) {
+-        FIPS_hmac_ctx_cleanup(ctx);
+-        return;
+-    }
+-#endif
+     EVP_MD_CTX_cleanup(&ctx->i_ctx);
+     EVP_MD_CTX_cleanup(&ctx->o_ctx);
+     EVP_MD_CTX_cleanup(&ctx->md_ctx);
+diff --git a/crypto/md2/md2_dgst.c b/crypto/md2/md2_dgst.c
+index 9cd79f8..7a49951 100644
+--- a/crypto/md2/md2_dgst.c
++++ b/crypto/md2/md2_dgst.c
+@@ -62,6 +62,11 @@
+ #include <openssl/md2.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/crypto.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++
++#include <openssl/err.h>
+ 
+ const char MD2_version[] = "MD2" OPENSSL_VERSION_PTEXT;
+ 
+@@ -119,7 +124,7 @@ const char *MD2_options(void)
+         return ("md2(int)");
+ }
+ 
+-fips_md_init(MD2)
++nonfips_md_init(MD2)
+ {
+     c->num = 0;
+     memset(c->state, 0, sizeof c->state);
+diff --git a/crypto/md4/md4_dgst.c b/crypto/md4/md4_dgst.c
+index 614fca0..d14f01f 100644
+--- a/crypto/md4/md4_dgst.c
++++ b/crypto/md4/md4_dgst.c
+@@ -72,7 +72,7 @@ const char MD4_version[] = "MD4" OPENSSL_VERSION_PTEXT;
+ #define INIT_DATA_C (unsigned long)0x98badcfeL
+ #define INIT_DATA_D (unsigned long)0x10325476L
+ 
+-fips_md_init(MD4)
++nonfips_md_init(MD4)
+ {
+     memset(c, 0, sizeof(*c));
+     c->A = INIT_DATA_A;
+diff --git a/crypto/md5/md5_dgst.c b/crypto/md5/md5_dgst.c
+index 2b51946..0c86a49 100644
+--- a/crypto/md5/md5_dgst.c
++++ b/crypto/md5/md5_dgst.c
+@@ -72,7 +72,16 @@ const char MD5_version[] = "MD5" OPENSSL_VERSION_PTEXT;
+ #define INIT_DATA_C (unsigned long)0x98badcfeL
+ #define INIT_DATA_D (unsigned long)0x10325476L
+ 
+-fips_md_init(MD5)
++int MD5_Init(MD5_CTX *c)
++#ifdef OPENSSL_FIPS
++{
++    if (FIPS_mode() && getenv("OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW") == NULL)
++        OpenSSLDie(__FILE__, __LINE__, "Digest MD5 forbidden in FIPS mode!");
++    return private_MD5_Init(c);
++}
++
++int private_MD5_Init(MD5_CTX *c)
++#endif
+ {
+     memset(c, 0, sizeof(*c));
+     c->A = INIT_DATA_A;
+diff --git a/crypto/o_fips.c b/crypto/o_fips.c
+index f56d5bb..0abd233 100644
+--- a/crypto/o_fips.c
++++ b/crypto/o_fips.c
+@@ -80,6 +80,8 @@ int FIPS_mode_set(int r)
+ # ifndef FIPS_AUTH_USER_PASS
+ #  define FIPS_AUTH_USER_PASS     "Default FIPS Crypto User Password"
+ # endif
++    if (r && FIPS_module_mode()) /* can be implicitly initialized by OPENSSL_init() */
++        return 1;
+     if (!FIPS_module_mode_set(r, FIPS_AUTH_USER_PASS))
+         return 0;
+     if (r)
+diff --git a/crypto/o_init.c b/crypto/o_init.c
+index 2088388..11b124c 100644
+--- a/crypto/o_init.c
++++ b/crypto/o_init.c
+@@ -56,8 +56,47 @@
+ #include <e_os.h>
+ #include <openssl/err.h>
+ #ifdef OPENSSL_FIPS
++# include <sys/types.h>
++# include <sys/stat.h>
++# include <fcntl.h>
++# include <unistd.h>
++# include <errno.h>
++# include <stdlib.h>
+ # include <openssl/fips.h>
+ # include <openssl/rand.h>
++
++# define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
++
++static void init_fips_mode(void)
++{
++    char buf[2] = "0";
++    int fd;
++
++    /* Ensure the selftests always run */
++    FIPS_mode_set(1);
++
++/* Dont use env variable to set fips mode
++    if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
++        buf[0] = '1';
++    } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
++*/
++    if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
++        while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
++        close(fd);
++    }
++    /* Failure reading the fips mode switch file means just not
++     * switching into FIPS mode. We would break too many things
++     * otherwise..
++     */
++
++    if (buf[0] != '1') {
++	/* drop down to non-FIPS mode if it is not requested */
++        FIPS_mode_set(0);
++    } else {
++	/* abort if selftest failed */
++	FIPS_selftest_check();
++    }
++}
+ #endif
+ 
+ /*
+@@ -65,19 +104,32 @@
+  * sets FIPS callbacks
+  */
+ 
+-void OPENSSL_init(void)
++void __attribute__ ((constructor)) OPENSSL_init_library(void)
+ {
+     static int done = 0;
+     if (done)
+         return;
+     done = 1;
+ #ifdef OPENSSL_FIPS
+-    FIPS_set_locking_callbacks(CRYPTO_lock, CRYPTO_add_lock);
+-    FIPS_set_error_callbacks(ERR_put_error, ERR_add_error_vdata);
+-    FIPS_set_malloc_callbacks(CRYPTO_malloc, CRYPTO_free);
++        /* Don't use /etc/system-fips to enable fips  */
++      /* if (!FIPS_module_installed())
++               {
++               return;
++               }
++        */
+     RAND_init_fips();
++    init_fips_mode();
++    if (!FIPS_mode()) {
++        /* Clean up prematurely set default rand method */
++        RAND_set_rand_method(NULL);
++    }
+ #endif
+ #if 0
+     fprintf(stderr, "Called OPENSSL_init\n");
+ #endif
+ }
++
++void OPENSSL_init(void)
++{
++    OPENSSL_init_library();
++}
+diff --git a/crypto/opensslconf.h.in b/crypto/opensslconf.h.in
+index 7a1c85d..e86ec45 100644
+--- a/crypto/opensslconf.h.in
++++ b/crypto/opensslconf.h.in
+@@ -1,5 +1,20 @@
+ /* crypto/opensslconf.h.in */
+ 
++#ifdef OPENSSL_DOING_MAKEDEPEND
++
++/* Include any symbols here that have to be explicitly set to enable a feature
++ * that should be visible to makedepend.
++ *
++ * [Our "make depend" doesn't actually look at this, we use actual build settings
++ * instead; we want to make it easy to remove subdirectories with disabled algorithms.]
++ */
++
++#ifndef OPENSSL_FIPS
++#define OPENSSL_FIPS
++#endif
++
++#endif
++
+ /* Generate 80386 code? */
+ #undef I386_ONLY
+ 
+diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c
+index 9e0064e..a93f2f4 100644
+--- a/crypto/rand/md_rand.c
++++ b/crypto/rand/md_rand.c
+@@ -391,7 +391,14 @@ int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo, int lock)
+     CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
+     crypto_lock_rand = 1;
+ 
+-    if (!initialized) {
++    /* always poll for external entropy in FIPS mode, drbg provides the
++     * expansion
++     */
++#ifdef OPENSSL_FIPS
++    if (!initialized || FIPS_module_mode()) {
++#else
++	if (!initialized) {
++#endif
+         RAND_poll();
+         initialized = 1;
+     }
+diff --git a/crypto/rand/rand.h b/crypto/rand/rand.h
+index 2553afd..cecdaeb 100644
+--- a/crypto/rand/rand.h
++++ b/crypto/rand/rand.h
+@@ -133,6 +133,11 @@ void ERR_load_RAND_strings(void);
+ /* Error codes for the RAND functions. */
+ 
+ /* Function codes. */
++# define RAND_F_FIPS_RAND                                 103
++# define RAND_F_FIPS_RAND_SET_DT                          104
++# define RAND_F_FIPS_SET_PRNG_SEED                        105
++# define RAND_F_FIPS_SET_TEST_MODE                        106
++# define RAND_F_FIPS_X931_SET_DT                          107
+ # define RAND_F_RAND_GET_RAND_METHOD                      101
+ # define RAND_F_RAND_INIT_FIPS                            102
+ # define RAND_F_SSLEAY_RAND_BYTES                         100
+@@ -141,8 +146,14 @@ void ERR_load_RAND_strings(void);
+ # define RAND_R_DUAL_EC_DRBG_DISABLED                     104
+ # define RAND_R_ERROR_INITIALISING_DRBG                   102
+ # define RAND_R_ERROR_INSTANTIATING_DRBG                  103
++# define RAND_R_NOT_IN_TEST_MODE                          105
+ # define RAND_R_NO_FIPS_RANDOM_METHOD_SET                 101
++# define RAND_R_NO_KEY_SET                                106
++# define RAND_R_PRNG_ERROR                                107
++# define RAND_R_PRNG_KEYED                                108
+ # define RAND_R_PRNG_NOT_SEEDED                           100
++# define RAND_R_PRNG_SEED_MUST_NOT_MATCH_KEY              109
++# define RAND_R_PRNG_STUCK                                110
+ 
+ #ifdef  __cplusplus
+ }
+diff --git a/crypto/ripemd/rmd_dgst.c b/crypto/ripemd/rmd_dgst.c
+index 4ddd939..2d21dd7 100644
+--- a/crypto/ripemd/rmd_dgst.c
++++ b/crypto/ripemd/rmd_dgst.c
+@@ -70,7 +70,7 @@ void ripemd160_block_x86(RIPEMD160_CTX *c, unsigned long *p, size_t num);
+ void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p, size_t num);
+ #endif
+ 
+-fips_md_init(RIPEMD160)
++nonfips_md_init(RIPEMD160)
+ {
+     memset(c, 0, sizeof(*c));
+     c->A = RIPEMD160_A;
+diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h
+index d2ee374..fa635a4 100644
+--- a/crypto/rsa/rsa.h
++++ b/crypto/rsa/rsa.h
+@@ -168,6 +168,8 @@ struct rsa_st {
+ #  define OPENSSL_RSA_MAX_MODULUS_BITS   16384
+ # endif
+ 
++# define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS 1024
++
+ # ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+ #  define OPENSSL_RSA_SMALL_MODULUS_BITS 3072
+ # endif
+@@ -329,7 +331,13 @@ RSA *RSA_generate_key(int bits, unsigned long e, void
+ 
+ /* New version */
+ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb);
+-
++int RSA_X931_derive_ex(RSA *rsa, BIGNUM *p1, BIGNUM *p2, BIGNUM *q1,
++                       BIGNUM *q2, const BIGNUM *Xp1, const BIGNUM *Xp2,
++                       const BIGNUM *Xp, const BIGNUM *Xq1,
++                       const BIGNUM *Xq2, const BIGNUM *Xq,
++                       const BIGNUM *e, BN_GENCB *cb);
++int RSA_X931_generate_key_ex(RSA *rsa, int bits, const BIGNUM *e,
++                             BN_GENCB *cb);
+ int RSA_check_key(const RSA *);
+         /* next 4 return -1 on error */
+ int RSA_public_encrypt(int flen, const unsigned char *from,
+@@ -527,6 +535,7 @@ void ERR_load_RSA_strings(void);
+ /* Function codes. */
+ # define RSA_F_CHECK_PADDING_MD                           140
+ # define RSA_F_DO_RSA_PRINT                               146
++# define RSA_F_FIPS_RSA_BUILTIN_KEYGEN                    163
+ # define RSA_F_INT_RSA_VERIFY                             145
+ # define RSA_F_MEMORY_LOCK                                100
+ # define RSA_F_OLD_RSA_PRIV_DECODE                        147
+@@ -582,6 +591,8 @@ void ERR_load_RSA_strings(void);
+ # define RSA_F_RSA_PUBLIC_ENCRYPT                         153
+ # define RSA_F_RSA_PUB_DECODE                             139
+ # define RSA_F_RSA_SETUP_BLINDING                         136
++# define RSA_F_RSA_SET_DEFAULT_METHOD                     164
++# define RSA_F_RSA_SET_METHOD                             165
+ # define RSA_F_RSA_SIGN                                   117
+ # define RSA_F_RSA_SIGN_ASN1_OCTET_STRING                 118
+ # define RSA_F_RSA_VERIFY                                 119
+@@ -629,6 +640,7 @@ void ERR_load_RSA_strings(void);
+ # define RSA_R_KEY_SIZE_TOO_SMALL                         120
+ # define RSA_R_LAST_OCTET_INVALID                         134
+ # define RSA_R_MODULUS_TOO_LARGE                          105
++# define RSA_R_NON_FIPS_METHOD                            167
+ # define RSA_R_NON_FIPS_RSA_METHOD                        157
+ # define RSA_R_NO_PUBLIC_EXPONENT                         140
+ # define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
+diff --git a/crypto/rsa/rsa_crpt.c b/crypto/rsa/rsa_crpt.c
+index 5c416b5..81e00d9 100644
+--- a/crypto/rsa/rsa_crpt.c
++++ b/crypto/rsa/rsa_crpt.c
+@@ -89,9 +89,9 @@ int RSA_private_encrypt(int flen, const unsigned char *from,
+                         unsigned char *to, RSA *rsa, int padding)
+ {
+ #ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+-        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
+-        RSAerr(RSA_F_RSA_PRIVATE_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
++    if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PRIVATE_ENCRYPT,
++               RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
+         return -1;
+     }
+ #endif
+@@ -115,9 +115,9 @@ int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
+                        RSA *rsa, int padding)
+ {
+ #ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+-        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
+-        RSAerr(RSA_F_RSA_PUBLIC_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
++    if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PUBLIC_DECRYPT,
++               RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
+         return -1;
+     }
+ #endif
+diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c
+index b147fff..2de7afc 100644
+--- a/crypto/rsa/rsa_eay.c
++++ b/crypto/rsa/rsa_eay.c
+@@ -114,6 +114,10 @@
+ #include <openssl/bn.h>
+ #include <openssl/rsa.h>
+ #include <openssl/rand.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ #ifndef RSA_NULL
+ 
+@@ -140,7 +144,7 @@ static RSA_METHOD rsa_pkcs1_eay_meth = {
+                                  * if e == 3 */
+     RSA_eay_init,
+     RSA_eay_finish,
+-    0,                          /* flags */
++    RSA_FLAG_FIPS_METHOD,       /* flags */
+     NULL,
+     0,                          /* rsa_sign */
+     0,                          /* rsa_verify */
+@@ -160,6 +164,22 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
+     unsigned char *buf = NULL;
+     BN_CTX *ctx = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_EAY_PUBLIC_ENCRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            goto err;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
+         RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+         return -1;
+@@ -361,6 +381,22 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
+     BIGNUM *unblind = NULL;
+     BN_BLINDING *blinding = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_EAY_PRIVATE_ENCRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            return -1;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+     BN_CTX_start(ctx);
+@@ -497,6 +533,22 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
+     BIGNUM *unblind = NULL;
+     BN_BLINDING *blinding = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_EAY_PRIVATE_DECRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            return -1;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+     BN_CTX_start(ctx);
+@@ -623,6 +675,22 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
+     unsigned char *buf = NULL;
+     BN_CTX *ctx = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_EAY_PUBLIC_DECRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            goto err;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
+         RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+         return -1;
+@@ -886,6 +954,9 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+ 
+ static int RSA_eay_init(RSA *rsa)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     rsa->flags |= RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE;
+     return (1);
+ }
+diff --git a/crypto/rsa/rsa_err.c b/crypto/rsa/rsa_err.c
+index 0bab05e..561bab4 100644
+--- a/crypto/rsa/rsa_err.c
++++ b/crypto/rsa/rsa_err.c
+@@ -1,6 +1,6 @@
+ /* crypto/rsa/rsa_err.c */
+ /* ====================================================================
+- * Copyright (c) 1999-2014 The OpenSSL Project.  All rights reserved.
++ * Copyright (c) 1999-2016 The OpenSSL Project.  All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -72,6 +72,7 @@
+ static ERR_STRING_DATA RSA_str_functs[] = {
+     {ERR_FUNC(RSA_F_CHECK_PADDING_MD), "CHECK_PADDING_MD"},
+     {ERR_FUNC(RSA_F_DO_RSA_PRINT), "DO_RSA_PRINT"},
++    {ERR_FUNC(RSA_F_FIPS_RSA_BUILTIN_KEYGEN), "FIPS_RSA_BUILTIN_KEYGEN"},
+     {ERR_FUNC(RSA_F_INT_RSA_VERIFY), "INT_RSA_VERIFY"},
+     {ERR_FUNC(RSA_F_MEMORY_LOCK), "MEMORY_LOCK"},
+     {ERR_FUNC(RSA_F_OLD_RSA_PRIV_DECODE), "OLD_RSA_PRIV_DECODE"},
+@@ -101,8 +102,7 @@ static ERR_STRING_DATA RSA_str_functs[] = {
+     {ERR_FUNC(RSA_F_RSA_NULL_PUBLIC_DECRYPT), "RSA_NULL_PUBLIC_DECRYPT"},
+     {ERR_FUNC(RSA_F_RSA_NULL_PUBLIC_ENCRYPT), "RSA_NULL_PUBLIC_ENCRYPT"},
+     {ERR_FUNC(RSA_F_RSA_PADDING_ADD_NONE), "RSA_padding_add_none"},
+-    {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP),
+-     "RSA_padding_add_PKCS1_OAEP"},
++    {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP), "RSA_padding_add_PKCS1_OAEP"},
+     {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP_MGF1),
+      "RSA_padding_add_PKCS1_OAEP_mgf1"},
+     {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_PSS), "RSA_padding_add_PKCS1_PSS"},
+@@ -136,9 +136,10 @@ static ERR_STRING_DATA RSA_str_functs[] = {
+     {ERR_FUNC(RSA_F_RSA_PUBLIC_ENCRYPT), "RSA_public_encrypt"},
+     {ERR_FUNC(RSA_F_RSA_PUB_DECODE), "RSA_PUB_DECODE"},
+     {ERR_FUNC(RSA_F_RSA_SETUP_BLINDING), "RSA_setup_blinding"},
++    {ERR_FUNC(RSA_F_RSA_SET_DEFAULT_METHOD), "RSA_set_default_method"},
++    {ERR_FUNC(RSA_F_RSA_SET_METHOD), "RSA_set_method"},
+     {ERR_FUNC(RSA_F_RSA_SIGN), "RSA_sign"},
+-    {ERR_FUNC(RSA_F_RSA_SIGN_ASN1_OCTET_STRING),
+-     "RSA_sign_ASN1_OCTET_STRING"},
++    {ERR_FUNC(RSA_F_RSA_SIGN_ASN1_OCTET_STRING), "RSA_sign_ASN1_OCTET_STRING"},
+     {ERR_FUNC(RSA_F_RSA_VERIFY), "RSA_verify"},
+     {ERR_FUNC(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING),
+      "RSA_verify_ASN1_OCTET_STRING"},
+@@ -155,8 +156,7 @@ static ERR_STRING_DATA RSA_str_reasons[] = {
+     {ERR_REASON(RSA_R_BAD_SIGNATURE), "bad signature"},
+     {ERR_REASON(RSA_R_BLOCK_TYPE_IS_NOT_01), "block type is not 01"},
+     {ERR_REASON(RSA_R_BLOCK_TYPE_IS_NOT_02), "block type is not 02"},
+-    {ERR_REASON(RSA_R_DATA_GREATER_THAN_MOD_LEN),
+-     "data greater than mod len"},
++    {ERR_REASON(RSA_R_DATA_GREATER_THAN_MOD_LEN), "data greater than mod len"},
+     {ERR_REASON(RSA_R_DATA_TOO_LARGE), "data too large"},
+     {ERR_REASON(RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE),
+      "data too large for key size"},
+@@ -193,10 +193,10 @@ static ERR_STRING_DATA RSA_str_reasons[] = {
+     {ERR_REASON(RSA_R_KEY_SIZE_TOO_SMALL), "key size too small"},
+     {ERR_REASON(RSA_R_LAST_OCTET_INVALID), "last octet invalid"},
+     {ERR_REASON(RSA_R_MODULUS_TOO_LARGE), "modulus too large"},
++    {ERR_REASON(RSA_R_NON_FIPS_METHOD), "non fips method"},
+     {ERR_REASON(RSA_R_NON_FIPS_RSA_METHOD), "non fips rsa method"},
+     {ERR_REASON(RSA_R_NO_PUBLIC_EXPONENT), "no public exponent"},
+-    {ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING),
+-     "null before block missing"},
++    {ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING), "null before block missing"},
+     {ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q), "n does not equal p q"},
+     {ERR_REASON(RSA_R_OAEP_DECODING_ERROR), "oaep decoding error"},
+     {ERR_REASON(RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),
+diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
+index 7f7dca3..d54c300 100644
+--- a/crypto/rsa/rsa_gen.c
++++ b/crypto/rsa/rsa_gen.c
+@@ -69,8 +69,78 @@
+ #include <openssl/rsa.h>
+ #ifdef OPENSSL_FIPS
+ # include <openssl/fips.h>
+-extern int FIPS_rsa_x931_generate_key_ex(RSA *rsa, int bits, BIGNUM *e,
+-                                         BN_GENCB *cb);
++# include <openssl/err.h>
++# include <openssl/evp.h>
++
++static int fips_rsa_pairwise_fail = 0;
++
++void FIPS_corrupt_rsa_keygen(void)
++{
++    fips_rsa_pairwise_fail = 1;
++}
++
++int fips_check_rsa(RSA *rsa)
++{
++	const unsigned char tbs[] = "RSA Pairwise Check Data";
++	unsigned char *ctbuf = NULL, *ptbuf = NULL;
++	int len, ret = 0;
++	EVP_PKEY *pk;
++
++	if ((pk = EVP_PKEY_new()) == NULL)
++		goto err;
++
++	EVP_PKEY_set1_RSA(pk, rsa);
++
++	/* Perform pairwise consistency signature test */
++	if (!fips_pkey_signature_test(pk, tbs, -1, NULL, 0, EVP_sha1(),
++				      EVP_MD_CTX_FLAG_PAD_PKCS1, NULL)
++		|| !fips_pkey_signature_test(pk, tbs, -1, NULL, 0, EVP_sha1(),
++					     EVP_MD_CTX_FLAG_PAD_X931, NULL)
++		|| !fips_pkey_signature_test(pk, tbs, -1, NULL, 0, EVP_sha1(),
++					     EVP_MD_CTX_FLAG_PAD_PSS, NULL))
++		goto err;
++	/* Now perform pairwise consistency encrypt/decrypt test */
++	ctbuf = OPENSSL_malloc(RSA_size(rsa));
++	if (!ctbuf)
++		goto err;
++
++	len = RSA_public_encrypt(sizeof(tbs) - 1, tbs, ctbuf, rsa,
++				 RSA_PKCS1_PADDING);
++	if (len <= 0)
++		goto err;
++	/* Check ciphertext doesn't match plaintext */
++	if ((len == (sizeof(tbs) - 1)) && !memcmp(tbs, ctbuf, len))
++		goto err;
++	ptbuf = OPENSSL_malloc(RSA_size(rsa));
++
++	if (!ptbuf)
++		goto err;
++	len = RSA_private_decrypt(len, ctbuf, ptbuf, rsa, RSA_PKCS1_PADDING);
++	if (len != (sizeof(tbs) - 1))
++		goto err;
++	if (memcmp(ptbuf, tbs, len))
++		goto err;
++
++	ret = 1;
++
++	if (!ptbuf)
++		goto err;
++
++err:
++	if (ret == 0) {
++		fips_set_selftest_fail();
++		FIPSerr(FIPS_F_FIPS_CHECK_RSA, FIPS_R_PAIRWISE_TEST_FAILED);
++	}
++
++	if (ctbuf)
++		OPENSSL_free(ctbuf);
++	if (ptbuf)
++		OPENSSL_free(ptbuf);
++	if (pk)
++		EVP_PKEY_free(pk);
++
++	return ret;
++}
+ #endif
+ 
+ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
+@@ -86,7 +156,7 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
+ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
+ {
+ #ifdef OPENSSL_FIPS
+-    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++    if (FIPS_module_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+         && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
+         RSAerr(RSA_F_RSA_GENERATE_KEY_EX, RSA_R_NON_FIPS_RSA_METHOD);
+         return 0;
+@@ -94,13 +164,267 @@ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
+ #endif
+     if (rsa->meth->rsa_keygen)
+         return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
+-#ifdef OPENSSL_FIPS
+-    if (FIPS_mode())
+-        return FIPS_rsa_x931_generate_key_ex(rsa, bits, e_value, cb);
+-#endif
+     return rsa_builtin_keygen(rsa, bits, e_value, cb);
+ }
+ 
++#ifdef OPENSSL_FIPS
++static int FIPS_rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
++                                   BN_GENCB *cb)
++{
++	BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *r3 = NULL, *tmp;
++	BIGNUM local_r0, local_d, local_p;
++	BIGNUM *pr0, *d, *p;
++	BN_CTX *ctx = NULL;
++	int ok = -1;
++	int i;
++	int n = 0;
++	int test = 0;
++	int pbits = bits / 2;
++
++	if (FIPS_selftest_failed()) {
++		FIPSerr(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN,
++			FIPS_R_FIPS_SELFTEST_FAILED);
++		return 0;
++	}
++
++	if ((pbits & 0xFF)
++	     || (getenv("OPENSSL_ENFORCE_MODULUS_BITS") && bits != 2048
++	     && bits != 3072)) {
++		FIPSerr(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN,
++			FIPS_R_INVALID_KEY_LENGTH);
++		return 0;
++	}
++
++	ctx = BN_CTX_new();
++	if (ctx == NULL)
++		goto err;
++	BN_CTX_start(ctx);
++	r0 = BN_CTX_get(ctx);
++	r1 = BN_CTX_get(ctx);
++	r2 = BN_CTX_get(ctx);
++	r3 = BN_CTX_get(ctx);
++
++	if (r3 == NULL)
++		goto err;
++
++	/* We need the RSA components non-NULL */
++	if (!rsa->n && ((rsa->n = BN_new()) == NULL))
++		goto err;
++	if (!rsa->d && ((rsa->d = BN_new()) == NULL))
++		goto err;
++	if (!rsa->e && ((rsa->e = BN_new()) == NULL))
++		goto err;
++	if (!rsa->p && ((rsa->p = BN_new()) == NULL))
++		goto err;
++	if (!rsa->q && ((rsa->q = BN_new()) == NULL))
++		goto err;
++	if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL))
++		goto err;
++	if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL))
++		goto err;
++	if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL))
++		goto err;
++
++	if (!BN_set_word(r0, RSA_F4))
++		goto err;
++	if (BN_cmp(e_value, r0) < 0 || BN_num_bits(e_value) > 256) {
++		ok = 0;                 /* we set our own err */
++		RSAerr(RSA_F_FIPS_RSA_BUILTIN_KEYGEN, RSA_R_BAD_E_VALUE);
++		goto err;
++	}
++
++	/* prepare approximate minimum p and q */
++	if (!BN_set_word(r0, 0xB504F334))
++		goto err;
++	if (!BN_lshift(r0, r0, pbits - 32))
++		goto err;
++
++	/* prepare minimum p and q difference */
++	if (!BN_one(r3))
++		goto err;
++	if (!BN_lshift(r3, r3, pbits - 100))
++		goto err;
++
++	BN_copy(rsa->e, e_value);
++
++	if (!BN_is_zero(rsa->p) && !BN_is_zero(rsa->q))
++		test = 1;
++
++retry:
++	/* generate p and q */
++	for (i = 0; i < 5 * pbits; i++) {
++ploop:
++		if (!test)
++		if (!BN_rand(rsa->p, pbits, 0, 1))
++			goto err;
++		if (BN_cmp(rsa->p, r0) < 0) {
++			if (test)
++				goto err;
++			goto ploop;
++		}
++
++		if (!BN_sub(r2, rsa->p, BN_value_one()))
++			goto err;
++		if (!BN_gcd(r1, r2, rsa->e, ctx))
++			goto err;
++		if (BN_is_one(r1)) {
++			int r;
++
++			r = BN_is_prime_fasttest_ex(rsa->p,
++					            pbits > 1024 ? 4 : 5,
++						    ctx, 0, cb);
++			if (r == -1 || (test && r <= 0))
++				goto err;
++			if (r > 0)
++				break;
++		}
++
++		if (!BN_GENCB_call(cb, 2, n++))
++			goto err;
++	}
++
++	if (!BN_GENCB_call(cb, 3, 0))
++		goto err;
++
++	if (i >= 5 * pbits)
++		/* prime not found */
++		goto err;
++
++	for (i = 0; i < 5 * pbits; i++) {
++qloop:
++		if (!test)
++			if (!BN_rand(rsa->q, pbits, 0, 1))
++				goto err;
++		if (BN_cmp(rsa->q, r0) < 0) {
++			if (test)
++				goto err;
++			goto qloop;
++		}
++		if (!BN_sub(r2, rsa->q, rsa->p))
++			goto err;
++		if (BN_ucmp(r2, r3) <= 0) {
++			if (test)
++				goto err;
++			goto qloop;
++		}
++
++		if (!BN_sub(r2, rsa->q, BN_value_one()))
++			goto err;
++		if (!BN_gcd(r1, r2, rsa->e, ctx))
++			goto err;
++		if (BN_is_one(r1)) {
++			int r;
++
++			r = BN_is_prime_fasttest_ex(rsa->q,
++						    pbits > 1024 ? 4 : 5,
++						    ctx, 0, cb);
++			if (r == -1 || (test && r <= 0))
++				goto err;
++			if (r > 0)
++				break;
++		}
++
++		if (!BN_GENCB_call(cb, 2, n++))
++			goto err;
++	}
++
++	if (!BN_GENCB_call(cb, 3, 1))
++		goto err;
++
++	if (i >= 5 * pbits)
++		/* prime not found */
++		goto err;
++
++	if (test) {
++		/* do not try to calculate the remaining key values */
++		BN_clear(rsa->n);
++		ok = 1;
++		goto err;
++	}
++
++	if (BN_cmp(rsa->p, rsa->q) < 0) {
++		tmp = rsa->p;
++		rsa->p = rsa->q;
++		rsa->q = tmp;
++	}
++
++	/* calculate n */
++	if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx))
++		goto err;
++
++	/* calculate d */
++	if (!BN_sub(r1, rsa->p, BN_value_one()))
++		goto err;               /* p-1 */
++	if (!BN_sub(r2, rsa->q, BN_value_one()))
++		goto err;               /* q-1 */
++
++	if (!BN_gcd(r0, r1, r2, ctx))
++		goto err;
++	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
++		pr0 = &local_r0;
++		BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);
++	} else
++		pr0 = r0;
++	if (!BN_div(r0, NULL, r1, pr0, ctx))
++		goto err;
++	if (!BN_mul(r0, r0, r2, ctx))
++		goto err;               /* lcm(p-1, q-1) */
++
++	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
++		pr0 = &local_r0;
++		BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);
++	} else
++		pr0 = r0;
++	if (!BN_mod_inverse(rsa->d, rsa->e, pr0, ctx))
++		goto err;               /* d */
++
++	if (BN_num_bits(rsa->d) < pbits)
++		goto retry;             /* d is too small */
++
++	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
++		d = &local_d;
++		BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
++	} else
++		d = rsa->d;
++
++	/* calculate d mod (p-1) */
++	if (!BN_mod(rsa->dmp1, d, r1, ctx))
++		goto err;
++
++	/* calculate d mod (q-1) */
++	if (!BN_mod(rsa->dmq1, d, r2, ctx))
++		goto err;
++
++	/* calculate inverse of q mod p */
++	if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
++		p = &local_p;
++		BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
++	} else
++		p = rsa->p;
++	if (!BN_mod_inverse(rsa->iqmp, rsa->q, p, ctx))
++		goto err;
++
++	if (fips_rsa_pairwise_fail)
++		BN_add_word(rsa->n, 1);
++
++	if (!fips_check_rsa(rsa))
++		goto err;
++
++	ok = 1;
++err:
++	if (ok == -1) {
++		RSAerr(RSA_F_FIPS_RSA_BUILTIN_KEYGEN, ERR_LIB_BN);
++		ok = 0;
++	}
++	if (ctx != NULL) {
++		BN_CTX_end(ctx);
++		BN_CTX_free(ctx);
++	}
++
++	return ok;
++}
++#endif
++
+ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
+                               BN_GENCB *cb)
+ {
+@@ -110,6 +434,16 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
+     int bitsp, bitsq, ok = -1, n = 0;
+     BN_CTX *ctx = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_module_mode()) {
++        if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS) {
++            FIPSerr(FIPS_F_RSA_BUILTIN_KEYGEN, FIPS_R_KEY_TOO_SHORT);
++            return 0;
++        }
++	return FIPS_rsa_builtin_keygen(rsa, bits, e_value, cb);
++    }
++#endif
++
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+         goto err;
+diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c
+index a6805de..fe7b520 100644
+--- a/crypto/rsa/rsa_lib.c
++++ b/crypto/rsa/rsa_lib.c
+@@ -84,23 +84,22 @@ RSA *RSA_new(void)
+ 
+ void RSA_set_default_method(const RSA_METHOD *meth)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_SET_DEFAULT_METHOD, RSA_R_NON_FIPS_METHOD);
++        return;
++    }
++#endif
+     default_RSA_meth = meth;
+ }
+ 
+ const RSA_METHOD *RSA_get_default_method(void)
+ {
+     if (default_RSA_meth == NULL) {
+-#ifdef OPENSSL_FIPS
+-        if (FIPS_mode())
+-            return FIPS_rsa_pkcs1_ssleay();
+-        else
+-            return RSA_PKCS1_SSLeay();
+-#else
+-# ifdef RSA_NULL
++#ifdef RSA_NULL
+         default_RSA_meth = RSA_null_method();
+-# else
++#else
+         default_RSA_meth = RSA_PKCS1_SSLeay();
+-# endif
+ #endif
+     }
+ 
+@@ -119,6 +118,12 @@ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth)
+      * to deal with which ENGINE it comes from.
+      */
+     const RSA_METHOD *mtmp;
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_SET_METHOD, RSA_R_NON_FIPS_METHOD);
++        return 0;
++    }
++#endif
+     mtmp = rsa->meth;
+     if (mtmp->finish)
+         mtmp->finish(rsa);
+@@ -165,6 +170,17 @@ RSA *RSA_new_method(ENGINE *engine)
+         }
+     }
+ #endif
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(ret->meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_NEW_METHOD, RSA_R_NON_FIPS_METHOD);
++# ifndef OPENSSL_NO_ENGINE
++        if (ret->engine)
++            ENGINE_finish(ret->engine);
++# endif
++        OPENSSL_free(ret);
++        return NULL;
++    }
++#endif
+ 
+     ret->pad = 0;
+     ret->version = 0;
+@@ -183,7 +199,7 @@ RSA *RSA_new_method(ENGINE *engine)
+     ret->blinding = NULL;
+     ret->mt_blinding = NULL;
+     ret->bignum_data = NULL;
+-    ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
++    ret->flags = ret->meth->flags;
+     if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data)) {
+ #ifndef OPENSSL_NO_ENGINE
+         if (ret->engine)
+diff --git a/crypto/rsa/rsa_pmeth.c b/crypto/rsa/rsa_pmeth.c
+index 2036355..3deba38 100644
+--- a/crypto/rsa/rsa_pmeth.c
++++ b/crypto/rsa/rsa_pmeth.c
+@@ -228,20 +228,6 @@ static int pkey_rsa_sign(EVP_PKEY_CTX *ctx, unsigned char *sig,
+             RSAerr(RSA_F_PKEY_RSA_SIGN, RSA_R_INVALID_DIGEST_LENGTH);
+             return -1;
+         }
+-#ifdef OPENSSL_FIPS
+-        if (ret > 0) {
+-            unsigned int slen;
+-            ret = FIPS_rsa_sign_digest(rsa, tbs, tbslen, rctx->md,
+-                                       rctx->pad_mode,
+-                                       rctx->saltlen,
+-                                       rctx->mgf1md, sig, &slen);
+-            if (ret > 0)
+-                *siglen = slen;
+-            else
+-                *siglen = 0;
+-            return ret;
+-        }
+-#endif
+ 
+         if (EVP_MD_type(rctx->md) == NID_mdc2) {
+             unsigned int sltmp;
+@@ -359,17 +345,6 @@ static int pkey_rsa_verify(EVP_PKEY_CTX *ctx,
+     }
+ #endif
+     if (rctx->md) {
+-#ifdef OPENSSL_FIPS
+-        if (rv > 0) {
+-            return FIPS_rsa_verify_digest(rsa,
+-                                          tbs, tbslen,
+-                                          rctx->md,
+-                                          rctx->pad_mode,
+-                                          rctx->saltlen,
+-                                          rctx->mgf1md, sig, siglen);
+-
+-        }
+-#endif
+         if (rctx->pad_mode == RSA_PKCS1_PADDING)
+             return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen,
+                               sig, siglen, rsa);
+diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c
+index 82ca832..71d6248 100644
+--- a/crypto/rsa/rsa_sign.c
++++ b/crypto/rsa/rsa_sign.c
+@@ -132,7 +132,9 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
+         i2d_X509_SIG(&sig, &p);
+         s = tmps;
+     }
+-    i = RSA_private_encrypt(i, s, sigret, rsa, RSA_PKCS1_PADDING);
++    /* NB: call underlying method directly to avoid FIPS blocking */
++    i = rsa->meth->rsa_priv_enc ? rsa->meth->rsa_priv_enc(i, s, sigret, rsa,
++                                                        RSA_PKCS1_PADDING) : 0;
+     if (i <= 0)
+         ret = 0;
+     else
+@@ -188,8 +190,9 @@ int int_rsa_verify(int dtype, const unsigned char *m,
+     }
+ 
+     if ((dtype == NID_md5_sha1) && rm) {
+-        i = RSA_public_decrypt((int)siglen,
+-                               sigbuf, rm, rsa, RSA_PKCS1_PADDING);
++        i = rsa->meth->rsa_pub_dec ? rsa->meth->rsa_pub_dec((int)siglen,
++                                                         sigbuf, rm, rsa,
++                                                         RSA_PKCS1_PADDING) : 0;
+         if (i <= 0)
+             return 0;
+         *prm_len = i;
+@@ -205,7 +208,10 @@ int int_rsa_verify(int dtype, const unsigned char *m,
+         RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
+         goto err;
+     }
+-    i = RSA_public_decrypt((int)siglen, sigbuf, s, rsa, RSA_PKCS1_PADDING);
++    /* NB: call underlying method directly to avoid FIPS blocking */
++    i = rsa->meth->rsa_pub_dec ? rsa->meth->rsa_pub_dec((int)siglen, sigbuf,
++                                                        s, rsa,
++                                                        RSA_PKCS1_PADDING) : 0;
+ 
+     if (i <= 0)
+         goto err;
+diff --git a/crypto/sha/sha.h b/crypto/sha/sha.h
+index e5169e4..08bc317 100644
+--- a/crypto/sha/sha.h
++++ b/crypto/sha/sha.h
+@@ -115,9 +115,6 @@ unsigned char *SHA(const unsigned char *d, size_t n, unsigned char *md);
+ void SHA_Transform(SHA_CTX *c, const unsigned char *data);
+ # endif
+ # ifndef OPENSSL_NO_SHA1
+-#  ifdef OPENSSL_FIPS
+-int private_SHA1_Init(SHA_CTX *c);
+-#  endif
+ int SHA1_Init(SHA_CTX *c);
+ int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
+ int SHA1_Final(unsigned char *md, SHA_CTX *c);
+@@ -139,10 +136,6 @@ typedef struct SHA256state_st {
+ } SHA256_CTX;
+ 
+ # ifndef OPENSSL_NO_SHA256
+-#  ifdef OPENSSL_FIPS
+-int private_SHA224_Init(SHA256_CTX *c);
+-int private_SHA256_Init(SHA256_CTX *c);
+-#  endif
+ int SHA224_Init(SHA256_CTX *c);
+ int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
+ int SHA224_Final(unsigned char *md, SHA256_CTX *c);
+@@ -192,10 +185,6 @@ typedef struct SHA512state_st {
+ # endif
+ 
+ # ifndef OPENSSL_NO_SHA512
+-#  ifdef OPENSSL_FIPS
+-int private_SHA384_Init(SHA512_CTX *c);
+-int private_SHA512_Init(SHA512_CTX *c);
+-#  endif
+ int SHA384_Init(SHA512_CTX *c);
+ int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);
+ int SHA384_Final(unsigned char *md, SHA512_CTX *c);
+diff --git a/crypto/sha/sha256.c b/crypto/sha/sha256.c
+index 72a1159..a6cf450 100644
+--- a/crypto/sha/sha256.c
++++ b/crypto/sha/sha256.c
+@@ -12,12 +12,19 @@
+ 
+ # include <openssl/crypto.h>
+ # include <openssl/sha.h>
++# ifdef OPENSSL_FIPS
++#  include <openssl/fips.h>
++# endif
++
+ # include <openssl/opensslv.h>
+ 
+ const char SHA256_version[] = "SHA-256" OPENSSL_VERSION_PTEXT;
+ 
+ fips_md_init_ctx(SHA224, SHA256)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     memset(c, 0, sizeof(*c));
+     c->h[0] = 0xc1059ed8UL;
+     c->h[1] = 0x367cd507UL;
+@@ -33,6 +40,9 @@ fips_md_init_ctx(SHA224, SHA256)
+ 
+ fips_md_init(SHA256)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     memset(c, 0, sizeof(*c));
+     c->h[0] = 0x6a09e667UL;
+     c->h[1] = 0xbb67ae85UL;
+diff --git a/crypto/sha/sha512.c b/crypto/sha/sha512.c
+index 3bf66ae..9c5f265 100644
+--- a/crypto/sha/sha512.c
++++ b/crypto/sha/sha512.c
+@@ -5,6 +5,11 @@
+  * ====================================================================
+  */
+ #include <openssl/opensslconf.h>
++#ifdef OPENSSL_FIPS
++# include <stdlib.h>
++# include <openssl/fips.h>
++#endif
++
+ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512)
+ /*-
+  * IMPLEMENTATION NOTES.
+@@ -62,6 +67,9 @@ const char SHA512_version[] = "SHA-512" OPENSSL_VERSION_PTEXT;
+ 
+ fips_md_init_ctx(SHA384, SHA512)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     c->h[0] = U64(0xcbbb9d5dc1059ed8);
+     c->h[1] = U64(0x629a292a367cd507);
+     c->h[2] = U64(0x9159015a3070dd17);
+@@ -80,6 +88,9 @@ fips_md_init_ctx(SHA384, SHA512)
+ 
+ fips_md_init(SHA512)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     c->h[0] = U64(0x6a09e667f3bcc908);
+     c->h[1] = U64(0xbb67ae8584caa73b);
+     c->h[2] = U64(0x3c6ef372fe94f82b);
+diff --git a/crypto/sha/sha_locl.h b/crypto/sha/sha_locl.h
+index 03bd411..84ce5ca 100644
+--- a/crypto/sha/sha_locl.h
++++ b/crypto/sha/sha_locl.h
+@@ -123,11 +123,14 @@ void sha1_block_data_order(SHA_CTX *c, const void *p, size_t num);
+ #define INIT_DATA_h4 0xc3d2e1f0UL
+ 
+ #ifdef SHA_0
+-fips_md_init(SHA)
++nonfips_md_init(SHA)
+ #else
+ fips_md_init_ctx(SHA1, SHA)
+ #endif
+ {
++#if defined(SHA_1) && defined(OPENSSL_FIPS)
++    FIPS_selftest_check();
++#endif
+     memset(c, 0, sizeof(*c));
+     c->h0 = INIT_DATA_h0;
+     c->h1 = INIT_DATA_h1;
+diff --git a/crypto/whrlpool/wp_dgst.c b/crypto/whrlpool/wp_dgst.c
+index e33bb4f..050b281 100644
+--- a/crypto/whrlpool/wp_dgst.c
++++ b/crypto/whrlpool/wp_dgst.c
+@@ -55,7 +55,7 @@
+ #include <openssl/crypto.h>
+ #include <string.h>
+ 
+-fips_md_init(WHIRLPOOL)
++nonfips_md_init(WHIRLPOOL)
+ {
+     memset(c, 0, sizeof(*c));
+     return (1);
+diff --git a/openssl.ld b/openssl.ld
+index 8d40f31..dcbfdac 100644
+--- a/openssl.ld
++++ b/openssl.ld
+@@ -4617,5 +4617,15 @@ OPENSSL_1.0.2g {
+        global:
+                SRP_VBASE_get1_by_user;
+                SRP_user_pwd_free;
++               OPENSSL_init_library;
++               private_BF_set_key;
++               private_CAST_set_key;
++               private_idea_set_encrypt_key;
++               private_SEED_set_key;
++               private_RC2_set_key;
++               private_RC4_set_key;
++               private_AES_set_encrypt_key;
++               private_AES_set_decrypt_key;
++               private_Camellia_set_key;
+ } OPENSSL_1.0.2;
+ 
+diff --git a/ssl/ssl_algs.c b/ssl/ssl_algs.c
+index e6f515f..34c0ab9 100644
+--- a/ssl/ssl_algs.c
++++ b/ssl/ssl_algs.c
+@@ -64,6 +64,11 @@
+ int SSL_library_init(void)
+ {
+ 
++#ifdef OPENSSL_FIPS
++    OPENSSL_init_library();
++    if (!FIPS_mode()) {
++#endif
++
+ #ifndef OPENSSL_NO_DES
+     EVP_add_cipher(EVP_des_cbc());
+     EVP_add_cipher(EVP_des_ede3_cbc());
+@@ -142,6 +147,48 @@ int SSL_library_init(void)
+     EVP_add_digest(EVP_sha());
+     EVP_add_digest(EVP_dss());
+ #endif
++#ifdef OPENSSL_FIPS
++    } else {
++# ifndef OPENSSL_NO_DES
++        EVP_add_cipher(EVP_des_ede3_cbc());
++# endif
++# ifndef OPENSSL_NO_AES
++        EVP_add_cipher(EVP_aes_128_cbc());
++        EVP_add_cipher(EVP_aes_192_cbc());
++        EVP_add_cipher(EVP_aes_256_cbc());
++        EVP_add_cipher(EVP_aes_128_gcm());
++        EVP_add_cipher(EVP_aes_256_gcm());
++# endif
++# ifndef OPENSSL_NO_MD5
++        /* needed even in the FIPS mode for TLS MAC */
++        EVP_add_digest(EVP_md5());
++        EVP_add_digest_alias(SN_md5, "ssl2-md5");
++        EVP_add_digest_alias(SN_md5, "ssl3-md5");
++# endif
++# ifndef OPENSSL_NO_SHA
++        EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
++        EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
++        EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
++# endif
++# ifndef OPENSSL_NO_SHA256
++        EVP_add_digest(EVP_sha224());
++        EVP_add_digest(EVP_sha256());
++# endif
++# ifndef OPENSSL_NO_SHA512
++        EVP_add_digest(EVP_sha384());
++        EVP_add_digest(EVP_sha512());
++# endif
++# if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA)
++        EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
++        EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
++        EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
++        EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
++# endif
++# ifndef OPENSSL_NO_ECDSA
++        EVP_add_digest(EVP_ecdsa());
++# endif
++    }
++#endif
+ #ifndef OPENSSL_NO_COMP
+     /*
+      * This will initialise the built-in compression algorithms. The value
diff -Nru openssl-1.0.2g/debian/rules openssl-1.0.2g/debian/rules
--- openssl-1.0.2g/debian/rules	2016-02-02 12:37:35.000000000 -0600
+++ openssl-1.0.2g/debian/rules	2016-03-17 12:37:53.000000000 -0500
@@ -41,7 +41,7 @@
 ifeq ($(DEB_HOST_ARCH),amd64)
  ARCH_CONFARGS := enable-ec_nistp_64_gcc_128
 endif
-CONFARGS  = --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/$(DEB_HOST_MULTIARCH) no-idea no-mdc2 no-rc5 no-zlib  enable-tlsext no-ssl2 no-ssl3 enable-unit-test $(ARCH_CONFARGS)
+CONFARGS  = --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/$(DEB_HOST_MULTIARCH) no-idea no-mdc2 no-rc5 no-zlib  enable-tlsext no-ssl2 no-ssl3 enable-unit-test fips $(ARCH_CONFARGS)
 OPT_alpha = ev4 ev5
 ARCHOPTS  = OPT_$(DEB_HOST_ARCH)
 OPTS      = $($(ARCHOPTS))