From e4b8d132297cf17f11a26c1791fca4ae60e0b33d Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: May 07 2019 12:44:02 +0000
Subject: import openssl-1.1.1-8.el8


---

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fcedc49
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+SOURCES/openssl-1.1.1-hobbled.tar.xz
diff --git a/.openssl.metadata b/.openssl.metadata
new file mode 100644
index 0000000..a8edd97
--- /dev/null
+++ b/.openssl.metadata
@@ -0,0 +1 @@
+cf3e6f9d1ce137b4c5b86d6ae60abae9c8907d2d SOURCES/openssl-1.1.1-hobbled.tar.xz
diff --git a/SOURCES/Makefile.certificate b/SOURCES/Makefile.certificate
new file mode 100644
index 0000000..cc88c52
--- /dev/null
+++ b/SOURCES/Makefile.certificate
@@ -0,0 +1,82 @@
+UTF8 := $(shell locale -c LC_CTYPE -k | grep -q charmap.*UTF-8 && echo -utf8)
+DAYS=365
+KEYLEN=2048
+TYPE=rsa:$(KEYLEN)
+EXTRA_FLAGS=
+ifdef SERIAL
+	EXTRA_FLAGS+=-set_serial $(SERIAL)
+endif
+
+.PHONY: usage
+.SUFFIXES: .key .csr .crt .pem
+.PRECIOUS: %.key %.csr %.crt %.pem
+
+usage:
+	@echo "This makefile allows you to create:"
+	@echo "  o public/private key pairs"
+	@echo "  o SSL certificate signing requests (CSRs)"
+	@echo "  o self-signed SSL test certificates"
+	@echo
+	@echo "To create a key pair, run \"make SOMETHING.key\"."
+	@echo "To create a CSR, run \"make SOMETHING.csr\"."
+	@echo "To create a test certificate, run \"make SOMETHING.crt\"."
+	@echo "To create a key and a test certificate in one file, run \"make SOMETHING.pem\"."
+	@echo
+	@echo "To create a key for use with Apache, run \"make genkey\"."
+	@echo "To create a CSR for use with Apache, run \"make certreq\"."
+	@echo "To create a test certificate for use with Apache, run \"make testcert\"."
+	@echo
+	@echo "To create a test certificate with serial number other than random, add SERIAL=num"
+	@echo "You can also specify key length with KEYLEN=n and expiration in days with DAYS=n"
+	@echo "Any additional options can be passed to openssl req via EXTRA_FLAGS"
+	@echo
+	@echo Examples:
+	@echo "  make server.key"
+	@echo "  make server.csr"
+	@echo "  make server.crt"
+	@echo "  make stunnel.pem"
+	@echo "  make genkey"
+	@echo "  make certreq"
+	@echo "  make testcert"
+	@echo "  make server.crt SERIAL=1"
+	@echo "  make stunnel.pem EXTRA_FLAGS=-sha384"
+	@echo "  make testcert DAYS=600"
+
+%.pem:
+	umask 77 ; \
+	PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
+	PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
+	/usr/bin/openssl req $(UTF8) -newkey $(TYPE) -keyout $$PEM1 -nodes -x509 -days $(DAYS) -out $$PEM2 $(EXTRA_FLAGS) ; \
+	cat $$PEM1 >  $@ ; \
+	echo ""    >> $@ ; \
+	cat $$PEM2 >> $@ ; \
+	$(RM) $$PEM1 $$PEM2
+
+%.key:
+	umask 77 ; \
+	/usr/bin/openssl genrsa -aes128 $(KEYLEN) > $@
+
+%.csr: %.key
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $^ -out $@
+
+%.crt: %.key
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $^ -x509 -days $(DAYS) -out $@ $(EXTRA_FLAGS)
+
+TLSROOT=/etc/pki/tls
+KEY=$(TLSROOT)/private/localhost.key
+CSR=$(TLSROOT)/certs/localhost.csr
+CRT=$(TLSROOT)/certs/localhost.crt
+
+genkey: $(KEY)
+certreq: $(CSR)
+testcert: $(CRT)
+
+$(CSR): $(KEY)
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $(KEY) -out $(CSR)
+
+$(CRT): $(KEY)
+	umask 77 ; \
+	/usr/bin/openssl req $(UTF8) -new -key $(KEY) -x509 -days $(DAYS) -out $(CRT) $(EXTRA_FLAGS)
diff --git a/SOURCES/README.FIPS b/SOURCES/README.FIPS
new file mode 100644
index 0000000..a36c547
--- /dev/null
+++ b/SOURCES/README.FIPS
@@ -0,0 +1,72 @@
+User guide for the FIPS Red Hat Enterprise Linux - OpenSSL Module
+=================================================================
+
+This package contains libraries which comprise the FIPS 140-2
+Red Hat Enterprise Linux - OPENSSL Module.
+
+The module files
+================
+/usr/lib[64]/libcrypto.so.1.1.0
+/usr/lib[64]/libssl.so.1.1.0
+/usr/lib[64]/.libcrypto.so.1.1.0.hmac
+/usr/lib[64]/.libssl.so.1.1.0.hmac
+
+Dependencies
+============
+
+The approved mode of operation requires kernel with /dev/urandom RNG running
+with properties as defined in the security policy of the module. This is
+provided by kernel packages with validated Red Hat Enterprise Linux Kernel
+Crytographic Module.
+
+Installation
+============
+
+The RPM package of the module can be installed by standard tools recommended
+for installation of RPM packages on the Red Hat Enterprise Linux system (yum,
+rpm, RHN remote management tool).
+
+The RPM package dracut-fips must be installed for the approved mode of
+operation.
+
+Usage and API
+=============
+
+The module respects kernel command line FIPS setting. If the kernel command
+line contains option fips=1 the module will initialize in the FIPS approved
+mode of operation automatically. To allow for the automatic initialization the
+application using the module has to call one of the following API calls:
+
+- void OPENSSL_init_library(void) - this will do only a basic initialization
+of the library and does initialization of the FIPS approved mode without setting
+up EVP API with supported algorithms.
+
+- void OPENSSL_add_all_algorithms(void) - this API function calls
+OPENSSL_init() implicitly and also adds all approved algorithms to the EVP API
+in the approved mode 
+
+- void SSL_library_init(void) - it calls OPENSSL_init() implicitly and also
+adds algorithms which are necessary for TLS protocol support and initializes
+the SSL library.
+
+To explicitely put the library to the approved mode the application can call
+the following function:
+
+- int FIPS_mode_set(int on) - if called with 1 as a parameter it will switch
+the library from the non-approved to the approved mode. If any of the selftests
+and integrity verification tests fail, the library is put into the error state
+and 0 is returned. If they succeed the return value is 1.
+
+To query the module whether it is in the approved mode or not:
+
+- int FIPS_mode(void) - returns 1 if the module is in the approved mode,
+0 otherwise.
+
+To query whether the module is in the error state:
+
+- int FIPS_selftest_failed(void) - returns 1 if the module is in the error
+state, 0 otherwise.
+
+To zeroize the FIPS RNG key and internal state the application calls:
+
+- void RAND_cleanup(void)
diff --git a/SOURCES/ec_curve.c b/SOURCES/ec_curve.c
new file mode 100644
index 0000000..58f8f3f
--- /dev/null
+++ b/SOURCES/ec_curve.c
@@ -0,0 +1,470 @@
+/*
+ * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <string.h>
+#include "ec_lcl.h"
+#include <openssl/err.h>
+#include <openssl/obj_mac.h>
+#include <openssl/opensslconf.h>
+#include "internal/nelem.h"
+
+typedef struct {
+    int field_type,             /* either NID_X9_62_prime_field or
+                                 * NID_X9_62_characteristic_two_field */
+     seed_len, param_len;
+    unsigned int cofactor;      /* promoted to BN_ULONG */
+} EC_CURVE_DATA;
+
+/* the nist prime curves */
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 28 * 6];
+} _EC_NIST_PRIME_224 = {
+    {
+        NID_X9_62_prime_field, 20, 28, 1
+    },
+    {
+        /* seed */
+        0xBD, 0x71, 0x34, 0x47, 0x99, 0xD5, 0xC7, 0xFC, 0xDC, 0x45, 0xB5, 0x9F,
+        0xA3, 0xB9, 0xAB, 0x8F, 0x6A, 0x94, 0x8B, 0xC5,
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x01,
+        /* a */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFE,
+        /* b */
+        0xB4, 0x05, 0x0A, 0x85, 0x0C, 0x04, 0xB3, 0xAB, 0xF5, 0x41, 0x32, 0x56,
+        0x50, 0x44, 0xB0, 0xB7, 0xD7, 0xBF, 0xD8, 0xBA, 0x27, 0x0B, 0x39, 0x43,
+        0x23, 0x55, 0xFF, 0xB4,
+        /* x */
+        0xB7, 0x0E, 0x0C, 0xBD, 0x6B, 0xB4, 0xBF, 0x7F, 0x32, 0x13, 0x90, 0xB9,
+        0x4A, 0x03, 0xC1, 0xD3, 0x56, 0xC2, 0x11, 0x22, 0x34, 0x32, 0x80, 0xD6,
+        0x11, 0x5C, 0x1D, 0x21,
+        /* y */
+        0xbd, 0x37, 0x63, 0x88, 0xb5, 0xf7, 0x23, 0xfb, 0x4c, 0x22, 0xdf, 0xe6,
+        0xcd, 0x43, 0x75, 0xa0, 0x5a, 0x07, 0x47, 0x64, 0x44, 0xd5, 0x81, 0x99,
+        0x85, 0x00, 0x7e, 0x34,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0x16, 0xA2, 0xE0, 0xB8, 0xF0, 0x3E, 0x13, 0xDD, 0x29, 0x45,
+        0x5C, 0x5C, 0x2A, 0x3D
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 48 * 6];
+} _EC_NIST_PRIME_384 = {
+    {
+        NID_X9_62_prime_field, 20, 48, 1
+    },
+    {
+        /* seed */
+        0xA3, 0x35, 0x92, 0x6A, 0xA3, 0x19, 0xA2, 0x7A, 0x1D, 0x00, 0x89, 0x6A,
+        0x67, 0x73, 0xA4, 0x82, 0x7A, 0xCD, 0xAC, 0x73,
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0xB3, 0x31, 0x2F, 0xA7, 0xE2, 0x3E, 0xE7, 0xE4, 0x98, 0x8E, 0x05, 0x6B,
+        0xE3, 0xF8, 0x2D, 0x19, 0x18, 0x1D, 0x9C, 0x6E, 0xFE, 0x81, 0x41, 0x12,
+        0x03, 0x14, 0x08, 0x8F, 0x50, 0x13, 0x87, 0x5A, 0xC6, 0x56, 0x39, 0x8D,
+        0x8A, 0x2E, 0xD1, 0x9D, 0x2A, 0x85, 0xC8, 0xED, 0xD3, 0xEC, 0x2A, 0xEF,
+        /* x */
+        0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05, 0x37, 0x8E, 0xB1, 0xC7, 0x1E,
+        0xF3, 0x20, 0xAD, 0x74, 0x6E, 0x1D, 0x3B, 0x62, 0x8B, 0xA7, 0x9B, 0x98,
+        0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54, 0x2A, 0x38, 0x55, 0x02, 0xF2, 0x5D,
+        0xBF, 0x55, 0x29, 0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A, 0xB7,
+        /* y */
+        0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f, 0x5d, 0x9e, 0x98, 0xbf,
+        0x92, 0x92, 0xdc, 0x29, 0xf8, 0xf4, 0x1d, 0xbd, 0x28, 0x9a, 0x14, 0x7c,
+        0xe9, 0xda, 0x31, 0x13, 0xb5, 0xf0, 0xb8, 0xc0, 0x0a, 0x60, 0xb1, 0xce,
+        0x1d, 0x7e, 0x81, 0x9d, 0x7a, 0x43, 0x1d, 0x7c, 0x90, 0xea, 0x0e, 0x5f,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37, 0x2D, 0xDF, 0x58, 0x1A, 0x0D, 0xB2,
+        0x48, 0xB0, 0xA7, 0x7A, 0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 66 * 6];
+} _EC_NIST_PRIME_521 = {
+    {
+        NID_X9_62_prime_field, 20, 66, 1
+    },
+    {
+        /* seed */
+        0xD0, 0x9E, 0x88, 0x00, 0x29, 0x1C, 0xB8, 0x53, 0x96, 0xCC, 0x67, 0x17,
+        0x39, 0x32, 0x84, 0xAA, 0xA0, 0xDA, 0x64, 0xBA,
+        /* p */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0x00, 0x51, 0x95, 0x3E, 0xB9, 0x61, 0x8E, 0x1C, 0x9A, 0x1F, 0x92, 0x9A,
+        0x21, 0xA0, 0xB6, 0x85, 0x40, 0xEE, 0xA2, 0xDA, 0x72, 0x5B, 0x99, 0xB3,
+        0x15, 0xF3, 0xB8, 0xB4, 0x89, 0x91, 0x8E, 0xF1, 0x09, 0xE1, 0x56, 0x19,
+        0x39, 0x51, 0xEC, 0x7E, 0x93, 0x7B, 0x16, 0x52, 0xC0, 0xBD, 0x3B, 0xB1,
+        0xBF, 0x07, 0x35, 0x73, 0xDF, 0x88, 0x3D, 0x2C, 0x34, 0xF1, 0xEF, 0x45,
+        0x1F, 0xD4, 0x6B, 0x50, 0x3F, 0x00,
+        /* x */
+        0x00, 0xC6, 0x85, 0x8E, 0x06, 0xB7, 0x04, 0x04, 0xE9, 0xCD, 0x9E, 0x3E,
+        0xCB, 0x66, 0x23, 0x95, 0xB4, 0x42, 0x9C, 0x64, 0x81, 0x39, 0x05, 0x3F,
+        0xB5, 0x21, 0xF8, 0x28, 0xAF, 0x60, 0x6B, 0x4D, 0x3D, 0xBA, 0xA1, 0x4B,
+        0x5E, 0x77, 0xEF, 0xE7, 0x59, 0x28, 0xFE, 0x1D, 0xC1, 0x27, 0xA2, 0xFF,
+        0xA8, 0xDE, 0x33, 0x48, 0xB3, 0xC1, 0x85, 0x6A, 0x42, 0x9B, 0xF9, 0x7E,
+        0x7E, 0x31, 0xC2, 0xE5, 0xBD, 0x66,
+        /* y */
+        0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b, 0xc0, 0x04, 0x5c, 0x8a,
+        0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9, 0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b,
+        0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17, 0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee,
+        0x72, 0x99, 0x5e, 0xf4, 0x26, 0x40, 0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad,
+        0x07, 0x61, 0x35, 0x3c, 0x70, 0x86, 0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe,
+        0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
+        /* order */
+        0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFA, 0x51, 0x86,
+        0x87, 0x83, 0xBF, 0x2F, 0x96, 0x6B, 0x7F, 0xCC, 0x01, 0x48, 0xF7, 0x09,
+        0xA5, 0xD0, 0x3B, 0xB5, 0xC9, 0xB8, 0x89, 0x9C, 0x47, 0xAE, 0xBB, 0x6F,
+        0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[20 + 32 * 6];
+} _EC_X9_62_PRIME_256V1 = {
+    {
+        NID_X9_62_prime_field, 20, 32, 1
+    },
+    {
+        /* seed */
+        0xC4, 0x9D, 0x36, 0x08, 0x86, 0xE7, 0x04, 0x93, 0x6A, 0x66, 0x78, 0xE1,
+        0x13, 0x9D, 0x26, 0xB7, 0x81, 0x9F, 0x7E, 0x90,
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        /* a */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
+        /* b */
+        0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3, 0xEB, 0xBD, 0x55,
+        0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06, 0xB0, 0xCC, 0x53, 0xB0, 0xF6,
+        0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2, 0x60, 0x4B,
+        /* x */
+        0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC, 0xE6, 0xE5,
+        0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB, 0x33, 0xA0,
+        0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96,
+        /* y */
+        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a,
+        0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce,
+        0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84,
+        0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51
+    }
+};
+
+static const struct {
+    EC_CURVE_DATA h;
+    unsigned char data[0 + 32 * 6];
+} _EC_SECG_PRIME_256K1 = {
+    {
+        NID_X9_62_prime_field, 0, 32, 1
+    },
+    {
+        /* no seed */
+        /* p */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
+        /* a */
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        /* b */
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07,
+        /* x */
+        0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62, 0x95,
+        0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9,
+        0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98,
+        /* y */
+        0x48, 0x3a, 0xda, 0x77, 0x26, 0xa3, 0xc4, 0x65, 0x5d, 0xa4, 0xfb, 0xfc,
+        0x0e, 0x11, 0x08, 0xa8, 0xfd, 0x17, 0xb4, 0x48, 0xa6, 0x85, 0x54, 0x19,
+        0x9c, 0x47, 0xd0, 0x8f, 0xfb, 0x10, 0xd4, 0xb8,
+        /* order */
+        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
+        0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
+    }
+};
+
+typedef struct _ec_list_element_st {
+    int nid;
+    const EC_CURVE_DATA *data;
+    const EC_METHOD *(*meth) (void);
+    const char *comment;
+} ec_list_element;
+
+static const ec_list_element curve_list[] = {
+    /* prime field curves */
+    /* secg curves */
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+    {NID_secp224r1, &_EC_NIST_PRIME_224.h, EC_GFp_nistp224_method,
+     "NIST/SECG curve over a 224 bit prime field"},
+#else
+    {NID_secp224r1, &_EC_NIST_PRIME_224.h, 0,
+     "NIST/SECG curve over a 224 bit prime field"},
+#endif
+    {NID_secp256k1, &_EC_SECG_PRIME_256K1.h, 0,
+     "SECG curve over a 256 bit prime field"},
+    /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */
+    {NID_secp384r1, &_EC_NIST_PRIME_384.h, 0,
+     "NIST/SECG curve over a 384 bit prime field"},
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+    {NID_secp521r1, &_EC_NIST_PRIME_521.h, EC_GFp_nistp521_method,
+     "NIST/SECG curve over a 521 bit prime field"},
+#else
+    {NID_secp521r1, &_EC_NIST_PRIME_521.h, 0,
+     "NIST/SECG curve over a 521 bit prime field"},
+#endif
+    /* X9.62 curves */
+    {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h,
+#if defined(ECP_NISTZ256_ASM)
+     EC_GFp_nistz256_method,
+#elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128)
+     EC_GFp_nistp256_method,
+#else
+     0,
+#endif
+     "X9.62/SECG curve over a 256 bit prime field"},
+};
+
+#define curve_list_length OSSL_NELEM(curve_list)
+
+static EC_GROUP *ec_group_new_from_data(const ec_list_element curve)
+{
+    EC_GROUP *group = NULL;
+    EC_POINT *P = NULL;
+    BN_CTX *ctx = NULL;
+    BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL, *order =
+        NULL;
+    int ok = 0;
+    int seed_len, param_len;
+    const EC_METHOD *meth;
+    const EC_CURVE_DATA *data;
+    const unsigned char *params;
+
+    /* If no curve data curve method must handle everything */
+    if (curve.data == NULL)
+        return EC_GROUP_new(curve.meth != NULL ? curve.meth() : NULL);
+
+    if ((ctx = BN_CTX_new()) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    data = curve.data;
+    seed_len = data->seed_len;
+    param_len = data->param_len;
+    params = (const unsigned char *)(data + 1); /* skip header */
+    params += seed_len;         /* skip seed */
+
+    if ((p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) == NULL
+        || (a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) == NULL
+        || (b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+
+    if (curve.meth != 0) {
+        meth = curve.meth();
+        if (((group = EC_GROUP_new(meth)) == NULL) ||
+            (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    } else if (data->field_type == NID_X9_62_prime_field) {
+        if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+#ifndef OPENSSL_NO_EC2M
+    else {                      /* field_type ==
+                                 * NID_X9_62_characteristic_two_field */
+
+        if ((group = EC_GROUP_new_curve_GF2m(p, a, b, ctx)) == NULL) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+#endif
+
+    EC_GROUP_set_curve_name(group, curve.nid);
+
+    if ((P = EC_POINT_new(group)) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+
+    if ((x = BN_bin2bn(params + 3 * param_len, param_len, NULL)) == NULL
+        || (y = BN_bin2bn(params + 4 * param_len, param_len, NULL)) == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+    if (!EC_POINT_set_affine_coordinates(group, P, x, y, ctx)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+    if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL
+        || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+        goto err;
+    }
+    if (!EC_GROUP_set_generator(group, P, order, x)) {
+        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+        goto err;
+    }
+    if (seed_len) {
+        if (!EC_GROUP_set_seed(group, params - seed_len, seed_len)) {
+            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+            goto err;
+        }
+    }
+    ok = 1;
+ err:
+    if (!ok) {
+        EC_GROUP_free(group);
+        group = NULL;
+    }
+    EC_POINT_free(P);
+    BN_CTX_free(ctx);
+    BN_free(p);
+    BN_free(a);
+    BN_free(b);
+    BN_free(order);
+    BN_free(x);
+    BN_free(y);
+    return group;
+}
+
+EC_GROUP *EC_GROUP_new_by_curve_name(int nid)
+{
+    size_t i;
+    EC_GROUP *ret = NULL;
+
+    if (nid <= 0)
+        return NULL;
+
+    for (i = 0; i < curve_list_length; i++)
+        if (curve_list[i].nid == nid) {
+            ret = ec_group_new_from_data(curve_list[i]);
+            break;
+        }
+
+    if (ret == NULL) {
+        ECerr(EC_F_EC_GROUP_NEW_BY_CURVE_NAME, EC_R_UNKNOWN_GROUP);
+        return NULL;
+    }
+
+    return ret;
+}
+
+size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems)
+{
+    size_t i, min;
+
+    if (r == NULL || nitems == 0)
+        return curve_list_length;
+
+    min = nitems < curve_list_length ? nitems : curve_list_length;
+
+    for (i = 0; i < min; i++) {
+        r[i].nid = curve_list[i].nid;
+        r[i].comment = curve_list[i].comment;
+    }
+
+    return curve_list_length;
+}
+
+/* Functions to translate between common NIST curve names and NIDs */
+
+typedef struct {
+    const char *name;           /* NIST Name of curve */
+    int nid;                    /* Curve NID */
+} EC_NIST_NAME;
+
+static EC_NIST_NAME nist_curves[] = {
+    {"B-163", NID_sect163r2},
+    {"B-233", NID_sect233r1},
+    {"B-283", NID_sect283r1},
+    {"B-409", NID_sect409r1},
+    {"B-571", NID_sect571r1},
+    {"K-163", NID_sect163k1},
+    {"K-233", NID_sect233k1},
+    {"K-283", NID_sect283k1},
+    {"K-409", NID_sect409k1},
+    {"K-571", NID_sect571k1},
+    {"P-192", NID_X9_62_prime192v1},
+    {"P-224", NID_secp224r1},
+    {"P-256", NID_X9_62_prime256v1},
+    {"P-384", NID_secp384r1},
+    {"P-521", NID_secp521r1}
+};
+
+const char *EC_curve_nid2nist(int nid)
+{
+    size_t i;
+    for (i = 0; i < OSSL_NELEM(nist_curves); i++) {
+        if (nist_curves[i].nid == nid)
+            return nist_curves[i].name;
+    }
+    return NULL;
+}
+
+int EC_curve_nist2nid(const char *name)
+{
+    size_t i;
+    for (i = 0; i < OSSL_NELEM(nist_curves); i++) {
+        if (strcmp(nist_curves[i].name, name) == 0)
+            return nist_curves[i].nid;
+    }
+    return NID_undef;
+}
diff --git a/SOURCES/ectest.c b/SOURCES/ectest.c
new file mode 100644
index 0000000..5c20ac3
--- /dev/null
+++ b/SOURCES/ectest.c
@@ -0,0 +1,850 @@
+/*
+ * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "internal/nelem.h"
+#include "testutil.h"
+
+#ifndef OPENSSL_NO_EC
+# include <openssl/ec.h>
+# ifndef OPENSSL_NO_ENGINE
+#  include <openssl/engine.h>
+# endif
+# include <openssl/err.h>
+# include <openssl/obj_mac.h>
+# include <openssl/objects.h>
+# include <openssl/rand.h>
+# include <openssl/bn.h>
+# include <openssl/opensslconf.h>
+
+static size_t crv_len = 0;
+static EC_builtin_curve *curves = NULL;
+
+/* test multiplication with group order, long and negative scalars */
+static int group_order_tests(EC_GROUP *group)
+{
+    BIGNUM *n1 = NULL, *n2 = NULL, *order = NULL;
+    EC_POINT *P = NULL, *Q = NULL, *R = NULL, *S = NULL;
+    const EC_POINT *G = NULL;
+    BN_CTX *ctx = NULL;
+    int i = 0, r = 0;
+
+    if (!TEST_ptr(n1 = BN_new())
+        || !TEST_ptr(n2 = BN_new())
+        || !TEST_ptr(order = BN_new())
+        || !TEST_ptr(ctx = BN_CTX_new())
+        || !TEST_ptr(G = EC_GROUP_get0_generator(group))
+        || !TEST_ptr(P = EC_POINT_new(group))
+        || !TEST_ptr(Q = EC_POINT_new(group))
+        || !TEST_ptr(R = EC_POINT_new(group))
+        || !TEST_ptr(S = EC_POINT_new(group)))
+        goto err;
+
+    if (!TEST_true(EC_GROUP_get_order(group, order, ctx))
+        || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
+        || !TEST_true(EC_POINT_is_at_infinity(group, Q))
+        || !TEST_true(EC_GROUP_precompute_mult(group, ctx))
+        || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
+        || !TEST_true(EC_POINT_is_at_infinity(group, Q))
+        || !TEST_true(EC_POINT_copy(P, G))
+        || !TEST_true(BN_one(n1))
+        || !TEST_true(EC_POINT_mul(group, Q, n1, NULL, NULL, ctx))
+        || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
+        || !TEST_true(BN_sub(n1, order, n1))
+        || !TEST_true(EC_POINT_mul(group, Q, n1, NULL, NULL, ctx))
+        || !TEST_true(EC_POINT_invert(group, Q, ctx))
+        || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
+        goto err;
+
+    for (i = 1; i <= 2; i++) {
+        const BIGNUM *scalars[6];
+        const EC_POINT *points[6];
+
+        if (!TEST_true(BN_set_word(n1, i))
+            /*
+             * If i == 1, P will be the predefined generator for which
+             * EC_GROUP_precompute_mult has set up precomputation.
+             */
+            || !TEST_true(EC_POINT_mul(group, P, n1, NULL, NULL, ctx))
+            || (i == 1 && !TEST_int_eq(0, EC_POINT_cmp(group, P, G, ctx)))
+            || !TEST_true(BN_one(n1))
+            /* n1 = 1 - order */
+            || !TEST_true(BN_sub(n1, n1, order))
+            || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n1, ctx))
+            || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
+
+            /* n2 = 1 + order */
+            || !TEST_true(BN_add(n2, order, BN_value_one()))
+            || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
+
+            /* n2 = (1 - order) * (1 + order) = 1 - order^2 */
+            || !TEST_true(BN_mul(n2, n1, n2, ctx))
+            || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
+            goto err;
+
+        /* n2 = order^2 - 1 */
+        BN_set_negative(n2, 0);
+        if (!TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
+            /* Add P to verify the result. */
+            || !TEST_true(EC_POINT_add(group, Q, Q, P, ctx))
+            || !TEST_true(EC_POINT_is_at_infinity(group, Q))
+
+            /* Exercise EC_POINTs_mul, including corner cases. */
+            || !TEST_false(EC_POINT_is_at_infinity(group, P)))
+            goto err;
+
+        scalars[0] = scalars[1] = BN_value_one();
+        points[0]  = points[1]  = P;
+
+        if (!TEST_true(EC_POINTs_mul(group, R, NULL, 2, points, scalars, ctx))
+            || !TEST_true(EC_POINT_dbl(group, S, points[0], ctx))
+            || !TEST_int_eq(0, EC_POINT_cmp(group, R, S, ctx)))
+            goto err;
+
+        scalars[0] = n1;
+        points[0] = Q;          /* => infinity */
+        scalars[1] = n2;
+        points[1] = P;          /* => -P */
+        scalars[2] = n1;
+        points[2] = Q;          /* => infinity */
+        scalars[3] = n2;
+        points[3] = Q;          /* => infinity */
+        scalars[4] = n1;
+        points[4] = P;          /* => P */
+        scalars[5] = n2;
+        points[5] = Q;          /* => infinity */
+        if (!TEST_true(EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx))
+            || !TEST_true(EC_POINT_is_at_infinity(group, P)))
+            goto err;
+    }
+
+    r = 1;
+err:
+    if (r == 0 && i != 0)
+        TEST_info(i == 1 ? "allowing precomputation" :
+                           "without precomputation");
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    EC_POINT_free(R);
+    EC_POINT_free(S);
+    BN_free(n1);
+    BN_free(n2);
+    BN_free(order);
+    BN_CTX_free(ctx);
+    return r;
+}
+
+static int prime_field_tests(void)
+{
+    BN_CTX *ctx = NULL;
+    BIGNUM *p = NULL, *a = NULL, *b = NULL, *scalar3 = NULL;
+    EC_GROUP *group = NULL, *tmp = NULL;
+    EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL,
+             *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;
+    EC_POINT *P = NULL, *Q = NULL, *R = NULL;
+    BIGNUM *x = NULL, *y = NULL, *z = NULL, *yplusone = NULL;
+    const EC_POINT *points[4];
+    const BIGNUM *scalars[4];
+    unsigned char buf[100];
+    size_t len, r = 0;
+    int k;
+
+    if (!TEST_ptr(ctx = BN_CTX_new())
+        || !TEST_ptr(p = BN_new())
+        || !TEST_ptr(a = BN_new())
+        || !TEST_ptr(b = BN_new())
+        /*
+         * applications should use EC_GROUP_new_curve_GFp so
+         * that the library gets to choose the EC_METHOD
+         */
+        || !TEST_ptr(group = EC_GROUP_new(EC_GFp_mont_method()))
+        || !TEST_ptr(tmp = EC_GROUP_new(EC_GROUP_method_of(group)))
+        || !TEST_true(EC_GROUP_copy(tmp, group)))
+        goto err;
+    EC_GROUP_free(group);
+    group = tmp;
+    tmp = NULL;
+
+    buf[0] = 0;
+    if (!TEST_ptr(P = EC_POINT_new(group))
+        || !TEST_ptr(Q = EC_POINT_new(group))
+        || !TEST_ptr(R = EC_POINT_new(group))
+        || !TEST_ptr(x = BN_new())
+        || !TEST_ptr(y = BN_new())
+        || !TEST_ptr(z = BN_new())
+        || !TEST_ptr(yplusone = BN_new()))
+        goto err;
+
+    /* Curve P-224 (FIPS PUB 186-2, App. 6) */
+
+    if (!TEST_true(BN_hex2bn(&p,         "FFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFF000000000000000000000001"))
+        || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        || !TEST_true(BN_hex2bn(&a,         "FFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE"))
+        || !TEST_true(BN_hex2bn(&b,         "B4050A850C04B3ABF5413256"
+                                    "5044B0B7D7BFD8BA270B39432355FFB4"))
+        || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
+        || !TEST_true(BN_hex2bn(&x,         "B70E0CBD6BB4BF7F321390B9"
+                                    "4A03C1D356C21122343280D6115C1D21"))
+        || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
+        || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+        || !TEST_true(BN_hex2bn(&z,         "FFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFF16A2E0B8F03E13DD29455C5C2A3D"))
+        || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
+        goto err;
+
+    TEST_info("NIST curve P-224 -- Generator");
+    test_output_bignum("x", x);
+    test_output_bignum("y", y);
+    /* G_y value taken from the standard: */
+    if (!TEST_true(BN_hex2bn(&z,         "BD376388B5F723FB4C22DFE6"
+                                 "CD4375A05A07476444D5819985007E34"))
+        || !TEST_BN_eq(y, z)
+        || !TEST_true(BN_add(yplusone, y, BN_value_one()))
+    /*
+     * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
+     * and therefore setting the coordinates should fail.
+     */
+        || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
+                                                       ctx))
+        || !TEST_int_eq(EC_GROUP_get_degree(group), 224)
+        || !group_order_tests(group)
+        || !TEST_ptr(P_224 = EC_GROUP_new(EC_GROUP_method_of(group)))
+        || !TEST_true(EC_GROUP_copy(P_224, group))
+
+    /* Curve P-256 (FIPS PUB 186-2, App. 6) */
+
+        || !TEST_true(BN_hex2bn(&p, "FFFFFFFF000000010000000000000000"
+                                    "00000000FFFFFFFFFFFFFFFFFFFFFFFF"))
+        || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        || !TEST_true(BN_hex2bn(&a, "FFFFFFFF000000010000000000000000"
+                                    "00000000FFFFFFFFFFFFFFFFFFFFFFFC"))
+        || !TEST_true(BN_hex2bn(&b, "5AC635D8AA3A93E7B3EBBD55769886BC"
+                                    "651D06B0CC53B0F63BCE3C3E27D2604B"))
+        || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
+
+        || !TEST_true(BN_hex2bn(&x, "6B17D1F2E12C4247F8BCE6E563A440F2"
+                                    "77037D812DEB33A0F4A13945D898C296"))
+        || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
+        || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+        || !TEST_true(BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
+                                    "BCE6FAADA7179E84F3B9CAC2FC632551"))
+        || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
+        goto err;
+
+    TEST_info("NIST curve P-256 -- Generator");
+    test_output_bignum("x", x);
+    test_output_bignum("y", y);
+    /* G_y value taken from the standard: */
+    if (!TEST_true(BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
+                                 "2BCE33576B315ECECBB6406837BF51F5"))
+        || !TEST_BN_eq(y, z)
+        || !TEST_true(BN_add(yplusone, y, BN_value_one()))
+    /*
+     * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
+     * and therefore setting the coordinates should fail.
+     */
+        || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
+                                                       ctx))
+        || !TEST_int_eq(EC_GROUP_get_degree(group), 256)
+        || !group_order_tests(group)
+        || !TEST_ptr(P_256 = EC_GROUP_new(EC_GROUP_method_of(group)))
+        || !TEST_true(EC_GROUP_copy(P_256, group))
+
+    /* Curve P-384 (FIPS PUB 186-2, App. 6) */
+
+        || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
+                                    "FFFFFFFF0000000000000000FFFFFFFF"))
+        || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
+                                    "FFFFFFFF0000000000000000FFFFFFFC"))
+        || !TEST_true(BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19"
+                                    "181D9C6EFE8141120314088F5013875A"
+                                    "C656398D8A2ED19D2A85C8EDD3EC2AEF"))
+        || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
+
+        || !TEST_true(BN_hex2bn(&x, "AA87CA22BE8B05378EB1C71EF320AD74"
+                                    "6E1D3B628BA79B9859F741E082542A38"
+                                    "5502F25DBF55296C3A545E3872760AB7"))
+        || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
+        || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+        || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
+                                    "581A0DB248B0A77AECEC196ACCC52973"))
+        || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
+        goto err;
+
+    TEST_info("NIST curve P-384 -- Generator");
+    test_output_bignum("x", x);
+    test_output_bignum("y", y);
+    /* G_y value taken from the standard: */
+    if (!TEST_true(BN_hex2bn(&z, "3617DE4A96262C6F5D9E98BF9292DC29"
+                                 "F8F41DBD289A147CE9DA3113B5F0B8C0"
+                                 "0A60B1CE1D7E819D7A431D7C90EA0E5F"))
+        || !TEST_BN_eq(y, z)
+        || !TEST_true(BN_add(yplusone, y, BN_value_one()))
+    /*
+     * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
+     * and therefore setting the coordinates should fail.
+     */
+        || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
+                                                       ctx))
+        || !TEST_int_eq(EC_GROUP_get_degree(group), 384)
+        || !group_order_tests(group)
+        || !TEST_ptr(P_384 = EC_GROUP_new(EC_GROUP_method_of(group)))
+        || !TEST_true(EC_GROUP_copy(P_384, group))
+
+    /* Curve P-521 (FIPS PUB 186-2, App. 6) */
+        || !TEST_true(BN_hex2bn(&p,                              "1FF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))
+        || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        || !TEST_true(BN_hex2bn(&a,                              "1FF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC"))
+        || !TEST_true(BN_hex2bn(&b,                              "051"
+                                    "953EB9618E1C9A1F929A21A0B68540EE"
+                                    "A2DA725B99B315F3B8B489918EF109E1"
+                                    "56193951EC7E937B1652C0BD3BB1BF07"
+                                    "3573DF883D2C34F1EF451FD46B503F00"))
+        || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
+        || !TEST_true(BN_hex2bn(&x,                               "C6"
+                                    "858E06B70404E9CD9E3ECB662395B442"
+                                    "9C648139053FB521F828AF606B4D3DBA"
+                                    "A14B5E77EFE75928FE1DC127A2FFA8DE"
+                                    "3348B3C1856A429BF97E7E31C2E5BD66"))
+        || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
+        || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+        || !TEST_true(BN_hex2bn(&z,                              "1FF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                                    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA"
+                                    "51868783BF2F966B7FCC0148F709A5D0"
+                                    "3BB5C9B8899C47AEBB6FB71E91386409"))
+        || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
+        || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
+        goto err;
+
+    TEST_info("NIST curve P-521 -- Generator");
+    test_output_bignum("x", x);
+    test_output_bignum("y", y);
+    /* G_y value taken from the standard: */
+    if (!TEST_true(BN_hex2bn(&z,                              "118"
+                                 "39296A789A3BC0045C8A5FB42C7D1BD9"
+                                 "98F54449579B446817AFBD17273E662C"
+                                 "97EE72995EF42640C550B9013FAD0761"
+                                 "353C7086A272C24088BE94769FD16650"))
+        || !TEST_BN_eq(y, z)
+        || !TEST_true(BN_add(yplusone, y, BN_value_one()))
+    /*
+     * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
+     * and therefore setting the coordinates should fail.
+     */
+        || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
+                                                       ctx))
+        || !TEST_int_eq(EC_GROUP_get_degree(group), 521)
+        || !group_order_tests(group)
+        || !TEST_ptr(P_521 = EC_GROUP_new(EC_GROUP_method_of(group)))
+        || !TEST_true(EC_GROUP_copy(P_521, group))
+
+    /* more tests using the last curve */
+
+    /* Restore the point that got mangled in the (x, y + 1) test. */
+        || !TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
+        || !TEST_true(EC_POINT_copy(Q, P))
+        || !TEST_false(EC_POINT_is_at_infinity(group, Q))
+        || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
+        || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
+        || !TEST_true(EC_POINT_invert(group, Q, ctx))       /* P = -2Q */
+        || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
+        || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
+        || !TEST_true(EC_POINT_is_at_infinity(group, R))    /* R = P + 2Q */
+        || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
+        goto err;
+    points[0] = Q;
+    points[1] = Q;
+    points[2] = Q;
+    points[3] = Q;
+
+    if (!TEST_true(EC_GROUP_get_order(group, z, ctx))
+        || !TEST_true(BN_add(y, z, BN_value_one()))
+        || !TEST_BN_even(y)
+        || !TEST_true(BN_rshift1(y, y)))
+        goto err;
+    scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
+    scalars[1] = y;
+
+    TEST_note("combined multiplication ...");
+
+    /* z is still the group order */
+    if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
+        || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
+        || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
+        || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx))
+        || !TEST_true(BN_rand(y, BN_num_bits(y), 0, 0))
+        || !TEST_true(BN_add(z, z, y)))
+        goto err;
+    BN_set_negative(z, 1);
+    scalars[0] = y;
+    scalars[1] = z;         /* z = -(order + y) */
+
+    if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
+        || !TEST_true(EC_POINT_is_at_infinity(group, P))
+        || !TEST_true(BN_rand(x, BN_num_bits(y) - 1, 0, 0))
+        || !TEST_true(BN_add(z, x, y)))
+        goto err;
+    BN_set_negative(z, 1);
+    scalars[0] = x;
+    scalars[1] = y;
+    scalars[2] = z;         /* z = -(x+y) */
+
+    if (!TEST_ptr(scalar3 = BN_new()))
+        goto err;
+    BN_zero(scalar3);
+    scalars[3] = scalar3;
+
+    if (!TEST_true(EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx))
+        || !TEST_true(EC_POINT_is_at_infinity(group, P)))
+        goto err;
+
+    TEST_note(" ok\n");
+
+
+    r = 1;
+err:
+    BN_CTX_free(ctx);
+    BN_free(p);
+    BN_free(a);
+    BN_free(b);
+    EC_GROUP_free(group);
+    EC_GROUP_free(tmp);
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    EC_POINT_free(R);
+    BN_free(x);
+    BN_free(y);
+    BN_free(z);
+    BN_free(yplusone);
+    BN_free(scalar3);
+
+    EC_GROUP_free(P_224);
+    EC_GROUP_free(P_256);
+    EC_GROUP_free(P_384);
+    EC_GROUP_free(P_521);
+    return r;
+}
+
+static int internal_curve_test(int n)
+{
+    EC_GROUP *group = NULL;
+    int nid = curves[n].nid;
+
+    if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
+        TEST_info("EC_GROUP_new_curve_name() failed with curve %s\n",
+                  OBJ_nid2sn(nid));
+        return 0;
+    }
+    if (!TEST_true(EC_GROUP_check(group, NULL))) {
+        TEST_info("EC_GROUP_check() failed with curve %s\n", OBJ_nid2sn(nid));
+        EC_GROUP_free(group);
+        return 0;
+    }
+    EC_GROUP_free(group);
+    return 1;
+}
+
+static int internal_curve_test_method(int n)
+{
+    int r, nid = curves[n].nid;
+    EC_GROUP *group;
+
+    if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
+        TEST_info("Curve %s failed\n", OBJ_nid2sn(nid));
+        return 0;
+    }
+    r = group_order_tests(group);
+    EC_GROUP_free(group);
+    return r;
+}
+
+# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+/*
+ * nistp_test_params contains magic numbers for testing our optimized
+ * implementations of several NIST curves with characteristic > 3.
+ */
+struct nistp_test_params {
+    const EC_METHOD *(*meth) (void);
+    int degree;
+    /*
+     * Qx, Qy and D are taken from
+     * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
+     * Otherwise, values are standard curve parameters from FIPS 180-3
+     */
+    const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
+};
+
+static const struct nistp_test_params nistp_tests_params[] = {
+    {
+     /* P-224 */
+     EC_GFp_nistp224_method,
+     224,
+     /* p */
+     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
+     /* a */
+     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
+     /* b */
+     "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
+     /* Qx */
+     "E84FB0B8E7000CB657D7973CF6B42ED78B301674276DF744AF130B3E",
+     /* Qy */
+     "4376675C6FC5612C21A0FF2D2A89D2987DF7A2BC52183B5982298555",
+     /* Gx */
+     "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
+     /* Gy */
+     "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
+     /* order */
+     "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
+     /* d */
+     "3F0C488E987C80BE0FEE521F8D90BE6034EC69AE11CA72AA777481E8",
+     },
+    {
+     /* P-256 */
+     EC_GFp_nistp256_method,
+     256,
+     /* p */
+     "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
+     /* a */
+     "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
+     /* b */
+     "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
+     /* Qx */
+     "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19",
+     /* Qy */
+     "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09",
+     /* Gx */
+     "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
+     /* Gy */
+     "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
+     /* order */
+     "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
+     /* d */
+     "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96",
+     },
+    {
+     /* P-521 */
+     EC_GFp_nistp521_method,
+     521,
+     /* p */
+                                                                  "1ff"
+     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+     /* a */
+                                                                  "1ff"
+     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+     "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
+     /* b */
+                                                                  "051"
+     "953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e1"
+     "56193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
+     /* Qx */
+                                                                 "0098"
+     "e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e"
+     "59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4",
+     /* Qy */
+                                                                 "0164"
+     "350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8"
+     "554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e",
+     /* Gx */
+                                                                   "c6"
+     "858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dba"
+     "a14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
+     /* Gy */
+                                                                  "118"
+     "39296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c"
+     "97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
+     /* order */
+                                                                  "1ff"
+     "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa"
+     "51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
+     /* d */
+                                                                 "0100"
+     "085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eee"
+     "df09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722",
+     },
+};
+
+static int nistp_single_test(int idx)
+{
+    const struct nistp_test_params *test = nistp_tests_params + idx;
+    BN_CTX *ctx = NULL;
+    BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL;
+    BIGNUM *n = NULL, *m = NULL, *order = NULL, *yplusone = NULL;
+    EC_GROUP *NISTP = NULL;
+    EC_POINT *G = NULL, *P = NULL, *Q = NULL, *Q_CHECK = NULL;
+    int r = 0;
+
+    TEST_note("NIST curve P-%d (optimised implementation):",
+              test->degree);
+    if (!TEST_ptr(ctx = BN_CTX_new())
+        || !TEST_ptr(p = BN_new())
+        || !TEST_ptr(a = BN_new())
+        || !TEST_ptr(b = BN_new())
+        || !TEST_ptr(x = BN_new())
+        || !TEST_ptr(y = BN_new())
+        || !TEST_ptr(m = BN_new())
+        || !TEST_ptr(n = BN_new())
+        || !TEST_ptr(order = BN_new())
+        || !TEST_ptr(yplusone = BN_new())
+
+        || !TEST_ptr(NISTP = EC_GROUP_new(test->meth()))
+        || !TEST_true(BN_hex2bn(&p, test->p))
+        || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
+        || !TEST_true(BN_hex2bn(&a, test->a))
+        || !TEST_true(BN_hex2bn(&b, test->b))
+        || !TEST_true(EC_GROUP_set_curve(NISTP, p, a, b, ctx))
+        || !TEST_ptr(G = EC_POINT_new(NISTP))
+        || !TEST_ptr(P = EC_POINT_new(NISTP))
+        || !TEST_ptr(Q = EC_POINT_new(NISTP))
+        || !TEST_ptr(Q_CHECK = EC_POINT_new(NISTP))
+        || !TEST_true(BN_hex2bn(&x, test->Qx))
+        || !TEST_true(BN_hex2bn(&y, test->Qy))
+        || !TEST_true(BN_add(yplusone, y, BN_value_one()))
+    /*
+     * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
+     * and therefore setting the coordinates should fail.
+     */
+        || !TEST_false(EC_POINT_set_affine_coordinates(NISTP, Q_CHECK, x,
+                                                       yplusone, ctx))
+        || !TEST_true(EC_POINT_set_affine_coordinates(NISTP, Q_CHECK, x, y,
+                                                      ctx))
+        || !TEST_true(BN_hex2bn(&x, test->Gx))
+        || !TEST_true(BN_hex2bn(&y, test->Gy))
+        || !TEST_true(EC_POINT_set_affine_coordinates(NISTP, G, x, y, ctx))
+        || !TEST_true(BN_hex2bn(&order, test->order))
+        || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
+        || !TEST_int_eq(EC_GROUP_get_degree(NISTP), test->degree))
+        goto err;
+
+    TEST_note("NIST test vectors ... ");
+    if (!TEST_true(BN_hex2bn(&n, test->d)))
+        goto err;
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
+        goto err;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+
+        /* set generator to P = 2*G, where G is the standard generator */
+        || !TEST_true(EC_POINT_dbl(NISTP, P, G, ctx))
+        || !TEST_true(EC_GROUP_set_generator(NISTP, P, order, BN_value_one()))
+        /* set the scalar to m=n/2, where n is the NIST test scalar */
+        || !TEST_true(BN_rshift(m, n, 1)))
+        goto err;
+
+    /* test the non-standard generator */
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
+        goto err;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+
+    /*
+     * We have not performed precomputation so have_precompute mult should be
+     * false
+     */
+        || !TEST_false(EC_GROUP_have_precompute_mult(NISTP))
+
+    /* now repeat all tests with precomputation */
+        || !TEST_true(EC_GROUP_precompute_mult(NISTP, ctx))
+        || !TEST_true(EC_GROUP_have_precompute_mult(NISTP)))
+        goto err;
+
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
+        goto err;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
+
+    /* reset generator */
+        || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one())))
+        goto err;
+    /* fixed point multiplication */
+    EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
+        goto err;
+    /* random point multiplication */
+    EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+    if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
+        goto err;
+
+    /* regression test for felem_neg bug */
+    if (!TEST_true(BN_set_word(m, 32))
+        || !TEST_true(BN_set_word(n, 31))
+        || !TEST_true(EC_POINT_copy(P, G))
+        || !TEST_true(EC_POINT_invert(NISTP, P, ctx))
+        || !TEST_true(EC_POINT_mul(NISTP, Q, m, P, n, ctx))
+        || !TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, G, ctx)))
+      goto err;
+
+    r = group_order_tests(NISTP);
+err:
+    EC_GROUP_free(NISTP);
+    EC_POINT_free(G);
+    EC_POINT_free(P);
+    EC_POINT_free(Q);
+    EC_POINT_free(Q_CHECK);
+    BN_free(n);
+    BN_free(m);
+    BN_free(p);
+    BN_free(a);
+    BN_free(b);
+    BN_free(x);
+    BN_free(y);
+    BN_free(order);
+    BN_free(yplusone);
+    BN_CTX_free(ctx);
+    return r;
+}
+# endif
+
+static const unsigned char p521_named[] = {
+    0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x23,
+};
+
+static const unsigned char p521_explicit[] = {
+    0x30, 0x82, 0x01, 0xc3, 0x02, 0x01, 0x01, 0x30, 0x4d, 0x06, 0x07, 0x2a,
+    0x86, 0x48, 0xce, 0x3d, 0x01, 0x01, 0x02, 0x42, 0x01, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0x30, 0x81, 0x9f, 0x04, 0x42, 0x01, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xfc, 0x04, 0x42, 0x00, 0x51, 0x95, 0x3e, 0xb9, 0x61, 0x8e, 0x1c, 0x9a,
+    0x1f, 0x92, 0x9a, 0x21, 0xa0, 0xb6, 0x85, 0x40, 0xee, 0xa2, 0xda, 0x72,
+    0x5b, 0x99, 0xb3, 0x15, 0xf3, 0xb8, 0xb4, 0x89, 0x91, 0x8e, 0xf1, 0x09,
+    0xe1, 0x56, 0x19, 0x39, 0x51, 0xec, 0x7e, 0x93, 0x7b, 0x16, 0x52, 0xc0,
+    0xbd, 0x3b, 0xb1, 0xbf, 0x07, 0x35, 0x73, 0xdf, 0x88, 0x3d, 0x2c, 0x34,
+    0xf1, 0xef, 0x45, 0x1f, 0xd4, 0x6b, 0x50, 0x3f, 0x00, 0x03, 0x15, 0x00,
+    0xd0, 0x9e, 0x88, 0x00, 0x29, 0x1c, 0xb8, 0x53, 0x96, 0xcc, 0x67, 0x17,
+    0x39, 0x32, 0x84, 0xaa, 0xa0, 0xda, 0x64, 0xba, 0x04, 0x81, 0x85, 0x04,
+    0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04, 0x04, 0xe9, 0xcd, 0x9e, 0x3e,
+    0xcb, 0x66, 0x23, 0x95, 0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05, 0x3f,
+    0xb5, 0x21, 0xf8, 0x28, 0xaf, 0x60, 0x6b, 0x4d, 0x3d, 0xba, 0xa1, 0x4b,
+    0x5e, 0x77, 0xef, 0xe7, 0x59, 0x28, 0xfe, 0x1d, 0xc1, 0x27, 0xa2, 0xff,
+    0xa8, 0xde, 0x33, 0x48, 0xb3, 0xc1, 0x85, 0x6a, 0x42, 0x9b, 0xf9, 0x7e,
+    0x7e, 0x31, 0xc2, 0xe5, 0xbd, 0x66, 0x01, 0x18, 0x39, 0x29, 0x6a, 0x78,
+    0x9a, 0x3b, 0xc0, 0x04, 0x5c, 0x8a, 0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9,
+    0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b, 0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17,
+    0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee, 0x72, 0x99, 0x5e, 0xf4, 0x26, 0x40,
+    0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad, 0x07, 0x61, 0x35, 0x3c, 0x70, 0x86,
+    0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe, 0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
+    0x02, 0x42, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfa,
+    0x51, 0x86, 0x87, 0x83, 0xbf, 0x2f, 0x96, 0x6b, 0x7f, 0xcc, 0x01, 0x48,
+    0xf7, 0x09, 0xa5, 0xd0, 0x3b, 0xb5, 0xc9, 0xb8, 0x89, 0x9c, 0x47, 0xae,
+    0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38, 0x64, 0x09, 0x02, 0x01, 0x01,
+};
+
+static int parameter_test(void)
+{
+    EC_GROUP *group = NULL, *group2 = NULL;
+    ECPARAMETERS *ecparameters = NULL;
+    unsigned char *buf = NULL;
+    int r = 0, len;
+
+    if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp384r1))
+        || !TEST_ptr(ecparameters = EC_GROUP_get_ecparameters(group, NULL))
+        || !TEST_ptr(group2 = EC_GROUP_new_from_ecparameters(ecparameters))
+        || !TEST_int_eq(EC_GROUP_cmp(group, group2, NULL), 0))
+        goto err;
+
+    EC_GROUP_free(group);
+    group = NULL;
+
+    /* Test the named curve encoding, which should be default. */
+    if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp521r1))
+        || !TEST_true((len = i2d_ECPKParameters(group, &buf)) >= 0)
+        || !TEST_mem_eq(buf, len, p521_named, sizeof(p521_named)))
+        goto err;
+
+    OPENSSL_free(buf);
+    buf = NULL;
+
+    /*
+     * Test the explicit encoding. P-521 requires correctly zero-padding the
+     * curve coefficients.
+     */
+    EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE);
+    if (!TEST_true((len = i2d_ECPKParameters(group, &buf)) >= 0)
+        || !TEST_mem_eq(buf, len, p521_explicit, sizeof(p521_explicit)))
+        goto err;
+
+    r = 1;
+err:
+    EC_GROUP_free(group);
+    EC_GROUP_free(group2);
+    ECPARAMETERS_free(ecparameters);
+    OPENSSL_free(buf);
+    return r;
+}
+#endif
+
+int setup_tests(void)
+{
+#ifndef OPENSSL_NO_EC
+    crv_len = EC_get_builtin_curves(NULL, 0);
+    if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
+        || !TEST_true(EC_get_builtin_curves(curves, crv_len)))
+        return 0;
+
+    ADD_TEST(parameter_test);
+    ADD_TEST(prime_field_tests);
+# ifndef OPENSSL_NO_EC2M
+    ADD_TEST(char2_field_tests);
+    ADD_ALL_TESTS(char2_curve_test, OSSL_NELEM(char2_curve_tests));
+# endif
+# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+    ADD_ALL_TESTS(nistp_single_test, OSSL_NELEM(nistp_tests_params));
+# endif
+    ADD_ALL_TESTS(internal_curve_test, crv_len);
+    ADD_ALL_TESTS(internal_curve_test_method, crv_len);
+#endif
+    return 1;
+}
+
+void cleanup_tests(void)
+{
+#ifndef OPENSSL_NO_EC
+    OPENSSL_free(curves);
+#endif
+}
diff --git a/SOURCES/hobble-openssl b/SOURCES/hobble-openssl
new file mode 100755
index 0000000..9a23ca6
--- /dev/null
+++ b/SOURCES/hobble-openssl
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# Quit out if anything fails.
+set -e
+
+# Clean out patent-or-otherwise-encumbered code.
+# MDC-2: 4,908,861 13/03/2007 - expired, we do not remove it but do not enable it anyway
+# IDEA:  5,214,703 07/01/2012 - expired, we do not remove it anymore
+# RC5:   5,724,428 01/11/2015 - expired, we do not remove it anymore
+# EC:    ????????? ??/??/2020
+# SRP:   ????????? ??/??/2017 - expired, we do not remove it anymore
+
+# Remove assembler portions of IDEA, MDC2, and RC5.
+# (find crypto/rc5/asm -type f | xargs -r rm -fv)
+
+for c in `find crypto/bn -name "*gf2m.c"`; do
+	echo Destroying $c
+	> $c
+done
+
+for c in `find crypto/ec -name "ec2*.c" -o -name "ec_curve.c"`; do
+	echo Destroying $c
+	> $c
+done
+
+for c in `find test -name "ectest.c"`; do
+	echo Destroying $c
+	> $c
+done
+
+for h in `find crypto ssl apps test -name "*.h"` ; do
+	echo Removing EC2M references from $h
+	cat $h | \
+	awk    'BEGIN {ech=1;} \
+		/^#[ \t]*ifndef.*NO_EC2M/ {ech--; next;} \
+                /^#[ \t]*if/ {if(ech < 1) ech--;} \
+		{if(ech>0) {;print $0};} \
+		/^#[ \t]*endif/ {if(ech < 1) ech++;}' > $h.hobbled && \
+	mv $h.hobbled $h
+done
diff --git a/SOURCES/make-dummy-cert b/SOURCES/make-dummy-cert
new file mode 100755
index 0000000..f5f0453
--- /dev/null
+++ b/SOURCES/make-dummy-cert
@@ -0,0 +1,28 @@
+#!/bin/sh
+umask 077
+
+answers() {
+	echo --
+	echo SomeState
+	echo SomeCity
+	echo SomeOrganization
+	echo SomeOrganizationalUnit
+	echo localhost.localdomain
+	echo root@localhost.localdomain
+}
+
+if [ $# -eq 0 ] ; then
+	echo $"Usage: `basename $0` filename [...]"
+	exit 0
+fi
+
+for target in $@ ; do
+	PEM1=`/bin/mktemp /tmp/openssl.XXXXXX`
+	PEM2=`/bin/mktemp /tmp/openssl.XXXXXX`
+	trap "rm -f $PEM1 $PEM2" SIGINT
+	answers | /usr/bin/openssl req -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 2> /dev/null
+	cat $PEM1 >  ${target}
+	echo ""   >> ${target}
+	cat $PEM2 >> ${target}
+	rm -f $PEM1 $PEM2
+done
diff --git a/SOURCES/openssl-1.1.0-apps-dgst.patch b/SOURCES/openssl-1.1.0-apps-dgst.patch
new file mode 100644
index 0000000..af10684
--- /dev/null
+++ b/SOURCES/openssl-1.1.0-apps-dgst.patch
@@ -0,0 +1,12 @@
+diff -up openssl-1.1.0-pre5/apps/ca.c.dgst openssl-1.1.0-pre5/apps/ca.c
+--- openssl-1.1.0-pre5/apps/ca.c.dgst	2016-04-19 16:57:52.000000000 +0200
++++ openssl-1.1.0-pre5/apps/ca.c	2016-07-18 15:58:18.516742682 +0200
+@@ -216,7 +216,7 @@ OPTIONS ca_options[] = {
+     {"enddate", OPT_ENDDATE, 's',
+      "YYMMDDHHMMSSZ cert notAfter (overrides -days)"},
+     {"days", OPT_DAYS, 'p', "Number of days to certify the cert for"},
+-    {"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
++    {"md", OPT_MD, 's', "md to use; see openssl dgst -h for list"},
+     {"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
+     {"keyfile", OPT_KEYFILE, 's', "Private key"},
+     {"keyform", OPT_KEYFORM, 'f', "Private key file format (PEM or ENGINE)"},
diff --git a/SOURCES/openssl-1.1.0-defaults.patch b/SOURCES/openssl-1.1.0-defaults.patch
new file mode 100644
index 0000000..347749a
--- /dev/null
+++ b/SOURCES/openssl-1.1.0-defaults.patch
@@ -0,0 +1,60 @@
+diff -up openssl-1.1.0-pre5/apps/openssl.cnf.defaults openssl-1.1.0-pre5/apps/openssl.cnf
+--- openssl-1.1.0-pre5/apps/openssl.cnf.defaults	2016-04-19 16:57:52.000000000 +0200
++++ openssl-1.1.0-pre5/apps/openssl.cnf	2016-07-18 14:22:08.252691017 +0200
+@@ -10,7 +10,7 @@
+ # This definition stops the following lines choking if HOME isn't
+ # defined.
+ HOME			= .
+-RANDFILE		= $ENV::HOME/.rnd
++#RANDFILE		= $ENV::HOME/.rnd
+ 
+ # Extra OBJECT IDENTIFIER info:
+ #oid_file		= $ENV::HOME/.oid
+@@ -72,7 +72,7 @@ cert_opt 	= ca_default		# Certificate fi
+ 
+ default_days	= 365			# how long to certify for
+ default_crl_days= 30			# how long before next CRL
+-default_md	= default		# use public key default MD
++default_md	= sha256		# use SHA-256 by default
+ preserve	= no			# keep passed DN ordering
+ 
+ # A few difference way of specifying how similar the request should look
+@@ -104,6 +104,7 @@ emailAddress		= optional
+ ####################################################################
+ [ req ]
+ default_bits		= 2048
++default_md		= sha256
+ default_keyfile 	= privkey.pem
+ distinguished_name	= req_distinguished_name
+ attributes		= req_attributes
+@@ -126,17 +127,18 @@ string_mask = utf8only
+ 
+ [ req_distinguished_name ]
+ countryName			= Country Name (2 letter code)
+-countryName_default		= AU
++countryName_default		= XX
+ countryName_min			= 2
+ countryName_max			= 2
+ 
+ stateOrProvinceName		= State or Province Name (full name)
+-stateOrProvinceName_default	= Some-State
++#stateOrProvinceName_default	= Default Province
+ 
+ localityName			= Locality Name (eg, city)
++localityName_default		= Default City
+ 
+ 0.organizationName		= Organization Name (eg, company)
+-0.organizationName_default	= Internet Widgits Pty Ltd
++0.organizationName_default	= Default Company Ltd
+ 
+ # we can do this but it is not needed normally :-)
+ #1.organizationName		= Second Organization Name (eg, company)
+@@ -145,7 +147,7 @@ localityName			= Locality Name (eg, city
+ organizationalUnitName		= Organizational Unit Name (eg, section)
+ #organizationalUnitName_default	=
+ 
+-commonName			= Common Name (e.g. server FQDN or YOUR name)
++commonName			= Common Name (eg, your name or your server\'s hostname)
+ commonName_max			= 64
+ 
+ emailAddress			= Email Address
diff --git a/SOURCES/openssl-1.1.0-issuer-hash.patch b/SOURCES/openssl-1.1.0-issuer-hash.patch
new file mode 100644
index 0000000..1b824e0
--- /dev/null
+++ b/SOURCES/openssl-1.1.0-issuer-hash.patch
@@ -0,0 +1,11 @@
+diff -up openssl-1.1.0-pre5/crypto/x509/x509_cmp.c.issuer-hash openssl-1.1.0-pre5/crypto/x509/x509_cmp.c
+--- openssl-1.1.0-pre5/crypto/x509/x509_cmp.c.issuer-hash	2016-07-18 15:16:32.788881100 +0200
++++ openssl-1.1.0-pre5/crypto/x509/x509_cmp.c	2016-07-18 15:17:16.671871840 +0200
+@@ -87,6 +87,7 @@ unsigned long X509_issuer_and_serial_has
+ 
+     if (ctx == NULL)
+         goto err;
++    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+     f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);
+     if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL))
+         goto err;
diff --git a/SOURCES/openssl-1.1.0-no-html.patch b/SOURCES/openssl-1.1.0-no-html.patch
new file mode 100644
index 0000000..f6a941e
--- /dev/null
+++ b/SOURCES/openssl-1.1.0-no-html.patch
@@ -0,0 +1,12 @@
+diff -up openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl.nohtml openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl
+--- openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl.no-html	2016-04-19 16:57:52.000000000 +0200
++++ openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl	2016-07-18 13:58:55.060106243 +0200
+@@ -288,7 +288,7 @@ install_sw: all install_dev install_engi
+ 
+ uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
+ 
+-install_docs: install_man_docs install_html_docs
++install_docs: install_man_docs
+ 
+ uninstall_docs: uninstall_man_docs uninstall_html_docs
+ 	$(RM) -r -v $(DESTDIR)$(DOCDIR)
diff --git a/SOURCES/openssl-1.1.0-no-weak-verify.patch b/SOURCES/openssl-1.1.0-no-weak-verify.patch
new file mode 100644
index 0000000..59439af
--- /dev/null
+++ b/SOURCES/openssl-1.1.0-no-weak-verify.patch
@@ -0,0 +1,26 @@
+diff -up openssl-1.1.0g/crypto/asn1/a_verify.c.no-md5-verify openssl-1.1.0g/crypto/asn1/a_verify.c
+--- openssl-1.1.0g/crypto/asn1/a_verify.c.no-md5-verify	2017-11-02 15:29:02.000000000 +0100
++++ openssl-1.1.0g/crypto/asn1/a_verify.c	2017-11-03 16:15:46.125801341 +0100
+@@ -7,6 +7,9 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
++
+ #include <stdio.h>
+ #include <time.h>
+ #include <sys/types.h>
+@@ -126,6 +129,12 @@ int ASN1_item_verify(const ASN1_ITEM *it
+         if (ret != 2)
+             goto err;
+         ret = -1;
++    } else if ((mdnid == NID_md5
++               && secure_getenv("OPENSSL_ENABLE_MD5_VERIFY") == NULL) ||
++               mdnid == NID_md4 || mdnid == NID_md2 || mdnid == NID_sha) {
++        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
++                ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
++        goto err;
+     } else {
+         const EVP_MD *type;
+         type = EVP_get_digestbynid(mdnid);
diff --git a/SOURCES/openssl-1.1.1-build.patch b/SOURCES/openssl-1.1.1-build.patch
new file mode 100644
index 0000000..cfe20f6
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-build.patch
@@ -0,0 +1,40 @@
+diff -up openssl-1.1.1-pre8/Configurations/unix-Makefile.tmpl.build openssl-1.1.1-pre8/Configurations/unix-Makefile.tmpl
+--- openssl-1.1.1-pre8/Configurations/unix-Makefile.tmpl.build	2018-06-20 16:48:09.000000000 +0200
++++ openssl-1.1.1-pre8/Configurations/unix-Makefile.tmpl	2018-07-16 17:15:38.108831031 +0200
+@@ -680,7 +680,7 @@ uninstall_runtime:
+ install_man_docs:
+ 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+ 	@$(ECHO) "*** Installing manpages"
+-	$(PERL) $(SRCDIR)/util/process_docs.pl \
++	TZ=UTC $(PERL) $(SRCDIR)/util/process_docs.pl \
+ 		--destdir=$(DESTDIR)$(MANDIR) --type=man --suffix=$(MANSUFFIX)
+ 
+ uninstall_man_docs:
+@@ -692,7 +692,7 @@ uninstall_man_docs:
+ install_html_docs:
+ 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+ 	@$(ECHO) "*** Installing HTML manpages"
+-	$(PERL) $(SRCDIR)/util/process_docs.pl \
++	TZ=UTC $(PERL) $(SRCDIR)/util/process_docs.pl \
+ 		--destdir=$(DESTDIR)$(HTMLDIR) --type=html
+ 
+ uninstall_html_docs:
+diff -up openssl-1.1.1-pre8/Configurations/10-main.conf.build openssl-1.1.1-pre8/Configurations/10-main.conf
+--- openssl-1.1.1-pre8/Configurations/10-main.conf.build	2018-06-20 16:48:09.000000000 +0200
++++ openssl-1.1.1-pre8/Configurations/10-main.conf	2018-07-16 17:17:10.312045203 +0200
+@@ -693,6 +693,7 @@ my %targets = (
+         cxxflags         => add("-m64"),
+         lib_cppflags     => add("-DL_ENDIAN"),
+         perlasm_scheme   => "linux64le",
++        multilib         => "64",
+     },
+ 
+     "linux-armv4" => {
+@@ -733,6 +734,7 @@ my %targets = (
+     "linux-aarch64" => {
+         inherit_from     => [ "linux-generic64", asm("aarch64_asm") ],
+         perlasm_scheme   => "linux64",
++        multilib         => "64",
+     },
+     "linux-arm64ilp32" => {  # https://wiki.linaro.org/Platform/arm64-ilp32
+         inherit_from     => [ "linux-generic32", asm("aarch64_asm") ],
diff --git a/SOURCES/openssl-1.1.1-conf-paths.patch b/SOURCES/openssl-1.1.1-conf-paths.patch
new file mode 100644
index 0000000..1b02c2f
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-conf-paths.patch
@@ -0,0 +1,56 @@
+diff -up openssl-1.1.1-pre8/apps/CA.pl.in.conf-paths openssl-1.1.1-pre8/apps/CA.pl.in
+--- openssl-1.1.1-pre8/apps/CA.pl.in.conf-paths	2018-06-20 16:48:09.000000000 +0200
++++ openssl-1.1.1-pre8/apps/CA.pl.in	2018-07-25 17:26:58.388624296 +0200
+@@ -33,7 +33,7 @@ my $X509 = "$openssl x509";
+ my $PKCS12 = "$openssl pkcs12";
+ 
+ # default openssl.cnf file has setup as per the following
+-my $CATOP = "./demoCA";
++my $CATOP = "/etc/pki/CA";
+ my $CAKEY = "cakey.pem";
+ my $CAREQ = "careq.pem";
+ my $CACERT = "cacert.pem";
+diff -up openssl-1.1.1-pre8/apps/openssl.cnf.conf-paths openssl-1.1.1-pre8/apps/openssl.cnf
+--- openssl-1.1.1-pre8/apps/openssl.cnf.conf-paths	2018-07-25 17:26:58.378624057 +0200
++++ openssl-1.1.1-pre8/apps/openssl.cnf	2018-07-27 13:20:08.198513471 +0200
+@@ -23,6 +23,22 @@ oid_section		= new_oids
+ # (Alternatively, use a configuration file that has only
+ # X.509v3 extensions in its main [= default] section.)
+ 
++# Load default TLS policy configuration
++
++openssl_conf = default_modules
++
++[ default_modules ]
++
++ssl_conf = ssl_module
++
++[ ssl_module ]
++
++system_default = crypto_policy
++
++[ crypto_policy ]
++
++.include /etc/crypto-policies/back-ends/opensslcnf.config
++
+ [ new_oids ]
+ 
+ # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+@@ -43,7 +59,7 @@ default_ca	= CA_default		# The default c
+ ####################################################################
+ [ CA_default ]
+ 
+-dir		= ./demoCA		# Where everything is kept
++dir		= /etc/pki/CA		# Where everything is kept
+ certs		= $dir/certs		# Where the issued certs are kept
+ crl_dir		= $dir/crl		# Where the issued crl are kept
+ database	= $dir/index.txt	# database index file.
+@@ -329,7 +345,7 @@ default_tsa = tsa_config1	# the default
+ [ tsa_config1 ]
+ 
+ # These are used by the TSA reply generation only.
+-dir		= ./demoCA		# TSA root directory
++dir		= /etc/pki/CA		# TSA root directory
+ serial		= $dir/tsaserial	# The current serial number (mandatory)
+ crypto_device	= builtin		# OpenSSL engine to use for signing
+ signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
diff --git a/SOURCES/openssl-1.1.1-coverity.patch b/SOURCES/openssl-1.1.1-coverity.patch
new file mode 100644
index 0000000..ae78b9d
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-coverity.patch
@@ -0,0 +1,12 @@
+diff -up openssl-1.1.1/apps/speed.c.coverity openssl-1.1.1/apps/speed.c
+--- openssl-1.1.1/apps/speed.c.coverity	2018-10-09 16:32:44.912051009 +0200
++++ openssl-1.1.1/apps/speed.c	2018-10-09 16:29:55.518851544 +0200
+@@ -2852,7 +2852,7 @@ int speed_main(int argc, char **argv)
+ 
+             if (rsa_count <= 1) {
+                 /* if longer than 10s, don't do any more */
+-                for (testnum++; testnum < EC_NUM; testnum++)
++                for (testnum++; testnum < ECDSA_NUM; testnum++)
+                     ecdsa_doit[testnum] = 0;
+             }
+         }
diff --git a/SOURCES/openssl-1.1.1-ec-curves.patch b/SOURCES/openssl-1.1.1-ec-curves.patch
new file mode 100644
index 0000000..2d8dcc2
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-ec-curves.patch
@@ -0,0 +1,206 @@
+diff -up openssl-1.1.1/apps/speed.c.curves openssl-1.1.1/apps/speed.c
+--- openssl-1.1.1/apps/speed.c.curves	2018-09-11 14:48:20.000000000 +0200
++++ openssl-1.1.1/apps/speed.c	2018-09-13 09:24:24.840081023 +0200
+@@ -489,82 +489,28 @@ static const OPT_PAIR rsa_choices[] = {
+ static double rsa_results[RSA_NUM][2];  /* 2 ops: sign then verify */
+ #endif /* OPENSSL_NO_RSA */
+ 
+-#define R_EC_P160    0
+-#define R_EC_P192    1
+-#define R_EC_P224    2
+-#define R_EC_P256    3
+-#define R_EC_P384    4
+-#define R_EC_P521    5
+-#define R_EC_K163    6
+-#define R_EC_K233    7
+-#define R_EC_K283    8
+-#define R_EC_K409    9
+-#define R_EC_K571    10
+-#define R_EC_B163    11
+-#define R_EC_B233    12
+-#define R_EC_B283    13
+-#define R_EC_B409    14
+-#define R_EC_B571    15
+-#define R_EC_BRP256R1  16
+-#define R_EC_BRP256T1  17
+-#define R_EC_BRP384R1  18
+-#define R_EC_BRP384T1  19
+-#define R_EC_BRP512R1  20
+-#define R_EC_BRP512T1  21
+-#define R_EC_X25519  22
+-#define R_EC_X448    23
++#define R_EC_P224    0
++#define R_EC_P256    1
++#define R_EC_P384    2
++#define R_EC_P521    3
++#define R_EC_X25519  4
++#define R_EC_X448    5
+ #ifndef OPENSSL_NO_EC
+ static OPT_PAIR ecdsa_choices[] = {
+-    {"ecdsap160", R_EC_P160},
+-    {"ecdsap192", R_EC_P192},
+     {"ecdsap224", R_EC_P224},
+     {"ecdsap256", R_EC_P256},
+     {"ecdsap384", R_EC_P384},
+     {"ecdsap521", R_EC_P521},
+-    {"ecdsak163", R_EC_K163},
+-    {"ecdsak233", R_EC_K233},
+-    {"ecdsak283", R_EC_K283},
+-    {"ecdsak409", R_EC_K409},
+-    {"ecdsak571", R_EC_K571},
+-    {"ecdsab163", R_EC_B163},
+-    {"ecdsab233", R_EC_B233},
+-    {"ecdsab283", R_EC_B283},
+-    {"ecdsab409", R_EC_B409},
+-    {"ecdsab571", R_EC_B571},
+-    {"ecdsabrp256r1", R_EC_BRP256R1},
+-    {"ecdsabrp256t1", R_EC_BRP256T1},
+-    {"ecdsabrp384r1", R_EC_BRP384R1},
+-    {"ecdsabrp384t1", R_EC_BRP384T1},
+-    {"ecdsabrp512r1", R_EC_BRP512R1},
+-    {"ecdsabrp512t1", R_EC_BRP512T1}
+ };
+ # define ECDSA_NUM       OSSL_NELEM(ecdsa_choices)
+ 
+ static double ecdsa_results[ECDSA_NUM][2];    /* 2 ops: sign then verify */
+ 
+ static const OPT_PAIR ecdh_choices[] = {
+-    {"ecdhp160", R_EC_P160},
+-    {"ecdhp192", R_EC_P192},
+     {"ecdhp224", R_EC_P224},
+     {"ecdhp256", R_EC_P256},
+     {"ecdhp384", R_EC_P384},
+     {"ecdhp521", R_EC_P521},
+-    {"ecdhk163", R_EC_K163},
+-    {"ecdhk233", R_EC_K233},
+-    {"ecdhk283", R_EC_K283},
+-    {"ecdhk409", R_EC_K409},
+-    {"ecdhk571", R_EC_K571},
+-    {"ecdhb163", R_EC_B163},
+-    {"ecdhb233", R_EC_B233},
+-    {"ecdhb283", R_EC_B283},
+-    {"ecdhb409", R_EC_B409},
+-    {"ecdhb571", R_EC_B571},
+-    {"ecdhbrp256r1", R_EC_BRP256R1},
+-    {"ecdhbrp256t1", R_EC_BRP256T1},
+-    {"ecdhbrp384r1", R_EC_BRP384R1},
+-    {"ecdhbrp384t1", R_EC_BRP384T1},
+-    {"ecdhbrp512r1", R_EC_BRP512R1},
+-    {"ecdhbrp512t1", R_EC_BRP512T1},
+     {"ecdhx25519", R_EC_X25519},
+     {"ecdhx448", R_EC_X448}
+ };
+@@ -1495,29 +1441,10 @@ int speed_main(int argc, char **argv)
+         unsigned int bits;
+     } test_curves[] = {
+         /* Prime Curves */
+-        {"secp160r1", NID_secp160r1, 160},
+-        {"nistp192", NID_X9_62_prime192v1, 192},
+         {"nistp224", NID_secp224r1, 224},
+         {"nistp256", NID_X9_62_prime256v1, 256},
+         {"nistp384", NID_secp384r1, 384}, 
+         {"nistp521", NID_secp521r1, 521},
+-        /* Binary Curves */
+-        {"nistk163", NID_sect163k1, 163},
+-        {"nistk233", NID_sect233k1, 233}, 
+-        {"nistk283", NID_sect283k1, 283},
+-        {"nistk409", NID_sect409k1, 409},
+-        {"nistk571", NID_sect571k1, 571},
+-        {"nistb163", NID_sect163r2, 163},
+-        {"nistb233", NID_sect233r1, 233},
+-        {"nistb283", NID_sect283r1, 283},
+-        {"nistb409", NID_sect409r1, 409},
+-        {"nistb571", NID_sect571r1, 571},
+-        {"brainpoolP256r1", NID_brainpoolP256r1, 256},
+-        {"brainpoolP256t1", NID_brainpoolP256t1, 256},
+-        {"brainpoolP384r1", NID_brainpoolP384r1, 384},
+-        {"brainpoolP384t1", NID_brainpoolP384t1, 384},
+-        {"brainpoolP512r1", NID_brainpoolP512r1, 512},
+-        {"brainpoolP512t1", NID_brainpoolP512t1, 512},
+         /* Other and ECDH only ones */
+         {"X25519", NID_X25519, 253},
+         {"X448", NID_X448, 448}
+@@ -2017,9 +1944,9 @@ int speed_main(int argc, char **argv)
+ #  endif
+ 
+ #  ifndef OPENSSL_NO_EC
+-    ecdsa_c[R_EC_P160][0] = count / 1000;
+-    ecdsa_c[R_EC_P160][1] = count / 1000 / 2;
+-    for (i = R_EC_P192; i <= R_EC_P521; i++) {
++    ecdsa_c[R_EC_P224][0] = count / 1000;
++    ecdsa_c[R_EC_P224][1] = count / 1000 / 2;
++    for (i = R_EC_P256; i <= R_EC_P521; i++) {
+         ecdsa_c[i][0] = ecdsa_c[i - 1][0] / 2;
+         ecdsa_c[i][1] = ecdsa_c[i - 1][1] / 2;
+         if (ecdsa_doit[i] <= 1 && ecdsa_c[i][0] == 0)
+@@ -2031,6 +1958,7 @@ int speed_main(int argc, char **argv)
+             }
+         }
+     }
++#if 0
+     ecdsa_c[R_EC_K163][0] = count / 1000;
+     ecdsa_c[R_EC_K163][1] = count / 1000 / 2;
+     for (i = R_EC_K233; i <= R_EC_K571; i++) {
+@@ -2059,9 +1987,9 @@ int speed_main(int argc, char **argv)
+             }
+         }
+     }
+-
+-    ecdh_c[R_EC_P160][0] = count / 1000;
+-    for (i = R_EC_P192; i <= R_EC_P521; i++) {
++#endif
++    ecdh_c[R_EC_P224][0] = count / 1000;
++    for (i = R_EC_P256; i <= R_EC_P521; i++) {
+         ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
+         if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0)
+             ecdh_doit[i] = 0;
+@@ -2071,6 +1999,7 @@ int speed_main(int argc, char **argv)
+             }
+         }
+     }
++#if 0
+     ecdh_c[R_EC_K163][0] = count / 1000;
+     for (i = R_EC_K233; i <= R_EC_K571; i++) {
+         ecdh_c[i][0] = ecdh_c[i - 1][0] / 2;
+@@ -2116,6 +2045,7 @@ int speed_main(int argc, char **argv)
+             }
+         }
+     }
++#endif
+     /* default iteration count for the last two EC Curves */
+     ecdh_c[R_EC_X25519][0] = count / 1800;
+     ecdh_c[R_EC_X448][0] = count / 7200;
+diff -up openssl-1.1.1/crypto/ec/ecp_smpl.c.curves openssl-1.1.1/crypto/ec/ecp_smpl.c
+--- openssl-1.1.1/crypto/ec/ecp_smpl.c.curves	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/ec/ecp_smpl.c	2018-09-13 09:09:26.841792619 +0200
+@@ -144,6 +144,11 @@ int ec_GFp_simple_group_set_curve(EC_GRO
+         return 0;
+     }
+ 
++    if (BN_num_bits(p) < 224) {
++        ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD);
++        return 0;
++    }
++
+     if (ctx == NULL) {
+         ctx = new_ctx = BN_CTX_new();
+         if (ctx == NULL)
+diff -up openssl-1.1.1/test/ecdsatest.c.curves openssl-1.1.1/test/ecdsatest.c
+--- openssl-1.1.1/test/ecdsatest.c.curves	2018-09-11 14:48:24.000000000 +0200
++++ openssl-1.1.1/test/ecdsatest.c	2018-09-13 09:09:26.841792619 +0200
+@@ -173,6 +173,7 @@ static int x9_62_tests(void)
+     if (!change_rand())
+         goto x962_err;
+ 
++#if 0
+     if (!TEST_true(x9_62_test_internal(NID_X9_62_prime192v1,
+                  "3342403536405981729393488334694600415596881826869351677613",
+                  "5735822328888155254683894997897571951568553642892029982342")))
+@@ -183,6 +184,7 @@ static int x9_62_tests(void)
+                  "3238135532097973577080787768312505059318910517550078427819"
+                              "78505179448783")))
+         goto x962_err;
++#endif
+ 
+ # ifndef OPENSSL_NO_EC2M
+     if (!TEST_true(x9_62_test_internal(NID_X9_62_c2tnb191v1,
diff --git a/SOURCES/openssl-1.1.1-fips-post-rand.patch b/SOURCES/openssl-1.1.1-fips-post-rand.patch
new file mode 100644
index 0000000..3852859
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-fips-post-rand.patch
@@ -0,0 +1,164 @@
+diff -up openssl-1.1.1/crypto/fips/fips.c.fips-post-rand openssl-1.1.1/crypto/fips/fips.c
+--- openssl-1.1.1/crypto/fips/fips.c.fips-post-rand	2018-10-12 17:40:50.631506976 +0200
++++ openssl-1.1.1/crypto/fips/fips.c	2018-11-08 17:49:08.091064655 +0100
+@@ -68,6 +68,7 @@
+ 
+ # include <openssl/fips.h>
+ # include "internal/thread_once.h"
++# include "internal/rand_int.h"
+ 
+ # ifndef PATH_MAX
+ #  define PATH_MAX 1024
+@@ -76,6 +77,7 @@
+ static int fips_selftest_fail = 0;
+ static int fips_mode = 0;
+ static int fips_started = 0;
++static int fips_post = 0;
+ 
+ static int fips_is_owning_thread(void);
+ static int fips_set_owning_thread(void);
+@@ -158,6 +160,11 @@ void fips_set_selftest_fail(void)
+     fips_selftest_fail = 1;
+ }
+ 
++int fips_in_post(void)
++{
++    return fips_post;
++}
++
+ /* we implement what libfipscheck does ourselves */
+ 
+ static int
+@@ -445,6 +452,8 @@ int FIPS_module_mode_set(int onoff)
+         }
+ # endif
+ 
++        fips_post = 1;
++
+         if (!FIPS_selftest()) {
+             fips_selftest_fail = 1;
+             ret = 0;
+@@ -459,7 +468,12 @@ int FIPS_module_mode_set(int onoff)
+             goto end;
+         }
+ 
++        fips_post = 0;
++
+         fips_set_mode(onoff);
++        /* force RNG reseed with entropy from getrandom() on next call */
++        rand_fork();
++
+         ret = 1;
+         goto end;
+     }
+diff -up openssl-1.1.1/crypto/include/internal/fips_int.h.fips-post-rand openssl-1.1.1/crypto/include/internal/fips_int.h
+--- openssl-1.1.1/crypto/include/internal/fips_int.h.fips-post-rand	2018-11-08 17:32:50.806526458 +0100
++++ openssl-1.1.1/crypto/include/internal/fips_int.h	2018-11-08 17:32:20.533828167 +0100
+@@ -76,6 +76,8 @@ int FIPS_selftest_hmac(void);
+ int FIPS_selftest_drbg(void);
+ int FIPS_selftest_cmac(void);
+ 
++int fips_in_post(void);
++
+ int fips_pkey_signature_test(EVP_PKEY *pkey,
+                                  const unsigned char *tbs, int tbslen,
+                                  const unsigned char *kat,
+diff -up openssl-1.1.1/crypto/rand/rand_unix.c.fips-post-rand openssl-1.1.1/crypto/rand/rand_unix.c
+--- openssl-1.1.1/crypto/rand/rand_unix.c.fips-post-rand	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rand/rand_unix.c	2018-11-09 14:03:48.504301170 +0100
+@@ -16,10 +16,12 @@
+ #include <openssl/rand.h>
+ #include "rand_lcl.h"
+ #include "internal/rand_int.h"
++#include "internal/fips_int.h"
+ #include <stdio.h>
+ #include "internal/dso.h"
+ #if defined(__linux)
+ # include <sys/syscall.h>
++# include <sys/random.h>
+ #endif
+ #if defined(__FreeBSD__)
+ # include <sys/types.h>
+@@ -86,7 +88,7 @@ static uint64_t get_timer_bits(void);
+     || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_VXWORKS) \
+     || defined(OPENSSL_SYS_UEFI))
+ 
+-static ssize_t syscall_random(void *buf, size_t buflen);
++static ssize_t syscall_random(void *buf, size_t buflen, int nonblock);
+ 
+ # if defined(OPENSSL_SYS_VOS)
+ 
+@@ -248,7 +250,7 @@ static ssize_t sysctl_random(char *buf,
+  * syscall_random(): Try to get random data using a system call
+  * returns the number of bytes returned in buf, or < 0 on error.
+  */
+-static ssize_t syscall_random(void *buf, size_t buflen)
++static ssize_t syscall_random(void *buf, size_t buflen, int nonblock)
+ {
+     /*
+      * Note: 'buflen' equals the size of the buffer which is used by the
+@@ -270,6 +272,7 @@ static ssize_t syscall_random(void *buf,
+      * - Linux since 3.17 with glibc 2.25
+      * - FreeBSD since 12.0 (1200061)
+      */
++#  if 0
+ #  if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__) && !defined(__hpux)
+     extern int getentropy(void *buffer, size_t length) __attribute__((weak));
+ 
+@@ -291,10 +294,10 @@ static ssize_t syscall_random(void *buf,
+     if (p_getentropy.p != NULL)
+         return p_getentropy.f(buf, buflen) == 0 ? (ssize_t)buflen : -1;
+ #  endif
+-
++#  endif
+     /* Linux supports this since version 3.17 */
+ #  if defined(__linux) && defined(SYS_getrandom)
+-    return syscall(SYS_getrandom, buf, buflen, 0);
++    return syscall(SYS_getrandom, buf, buflen, nonblock?GRND_NONBLOCK:0);
+ #  elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
+     return sysctl_random(buf, buflen);
+ #  else
+@@ -456,8 +459,10 @@ size_t rand_pool_acquire_entropy(RAND_PO
+     size_t bytes_needed;
+     size_t entropy_available = 0;
+     unsigned char *buffer;
+-
+ #   ifdef OPENSSL_RAND_SEED_GETRANDOM
++    int in_post;
++
++    for (in_post = fips_in_post(); in_post >= 0; --in_post) {
+     {
+         ssize_t bytes;
+         /* Maximum allowed number of consecutive unsuccessful attempts */
+@@ -466,7 +471,7 @@ size_t rand_pool_acquire_entropy(RAND_PO
+         bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
+         while (bytes_needed != 0 && attempts-- > 0) {
+             buffer = rand_pool_add_begin(pool, bytes_needed);
+-            bytes = syscall_random(buffer, bytes_needed);
++            bytes = syscall_random(buffer, bytes_needed, in_post);
+             if (bytes > 0) {
+                 rand_pool_add_end(pool, bytes, 8 * bytes);
+                 bytes_needed -= bytes;
+@@ -498,8 +503,10 @@ size_t rand_pool_acquire_entropy(RAND_PO
+             int attempts = 3;
+             const int fd = get_random_device(i);
+ 
+-            if (fd == -1)
++            if (fd == -1) {
++                OPENSSL_showfatal("Random device %s cannot be opened.\n", random_device_paths[i]);
+                 continue;
++            }
+ 
+             while (bytes_needed != 0 && attempts-- > 0) {
+                 buffer = rand_pool_add_begin(pool, bytes_needed);
+@@ -559,7 +566,9 @@ size_t rand_pool_acquire_entropy(RAND_PO
+         }
+     }
+ #   endif
+-
++#   ifdef OPENSSL_RAND_SEED_GETRANDOM
++    }
++#   endif
+     return rand_pool_entropy_available(pool);
+ #  endif
+ }
diff --git a/SOURCES/openssl-1.1.1-fips.patch b/SOURCES/openssl-1.1.1-fips.patch
new file mode 100644
index 0000000..069cfde
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-fips.patch
@@ -0,0 +1,11596 @@
+diff -up openssl-1.1.1/apps/speed.c.fips openssl-1.1.1/apps/speed.c
+--- openssl-1.1.1/apps/speed.c.fips	2018-09-13 08:51:22.089521413 +0200
++++ openssl-1.1.1/apps/speed.c	2018-09-13 08:51:22.101521133 +0200
+@@ -1629,7 +1629,8 @@ int speed_main(int argc, char **argv)
+             continue;
+         if (strcmp(*argv, "rsa") == 0) {
+             for (loop = 0; loop < OSSL_NELEM(rsa_doit); loop++)
+-                rsa_doit[loop] = 1;
++		if (!FIPS_mode() || loop != R_RSA_512)
++                    rsa_doit[loop] = 1;
+             continue;
+         }
+         if (found(*argv, rsa_choices, &i)) {
+@@ -1639,7 +1640,9 @@ int speed_main(int argc, char **argv)
+ #endif
+ #ifndef OPENSSL_NO_DSA
+         if (strcmp(*argv, "dsa") == 0) {
+-            dsa_doit[R_DSA_512] = dsa_doit[R_DSA_1024] =
++            if (!FIPS_mode())
++                dsa_doit[R_DSA_512] = 1;
++            dsa_doit[R_DSA_1024] =
+                 dsa_doit[R_DSA_2048] = 1;
+             continue;
+         }
+@@ -1771,15 +1774,21 @@ int speed_main(int argc, char **argv)
+     /* No parameters; turn on everything. */
+     if ((argc == 0) && !doit[D_EVP]) {
+         for (i = 0; i < ALGOR_NUM; i++)
+-            if (i != D_EVP)
++            if (i != D_EVP &&
++                (!FIPS_mode() || (i != D_WHIRLPOOL &&
++                                  i != D_MD2 && i != D_MD4 &&
++                                  i != D_MD5 && i != D_MDC2 &&
++                                  i != D_RMD160)))
+                 doit[i] = 1;
+ #ifndef OPENSSL_NO_RSA
+         for (i = 0; i < RSA_NUM; i++)
+-            rsa_doit[i] = 1;
++            if (!FIPS_mode() || i != R_RSA_512)
++                rsa_doit[i] = 1;
+ #endif
+ #ifndef OPENSSL_NO_DSA
+         for (i = 0; i < DSA_NUM; i++)
+-            dsa_doit[i] = 1;
++            if (!FIPS_mode() || i != R_DSA_512)
++                dsa_doit[i] = 1;
+ #endif
+ #ifndef OPENSSL_NO_EC
+         for (loop = 0; loop < OSSL_NELEM(ecdsa_doit); loop++)
+@@ -1835,30 +1844,46 @@ int speed_main(int argc, char **argv)
+     AES_set_encrypt_key(key24, 192, &aes_ks2);
+     AES_set_encrypt_key(key32, 256, &aes_ks3);
+ #ifndef OPENSSL_NO_CAMELLIA
+-    Camellia_set_key(key16, 128, &camellia_ks1);
+-    Camellia_set_key(ckey24, 192, &camellia_ks2);
+-    Camellia_set_key(ckey32, 256, &camellia_ks3);
++    if (doit[D_CBC_128_CML] || doit[D_CBC_192_CML] || doit[D_CBC_256_CML]) {
++        Camellia_set_key(key16, 128, &camellia_ks1);
++        Camellia_set_key(ckey24, 192, &camellia_ks2);
++        Camellia_set_key(ckey32, 256, &camellia_ks3);
++    }
+ #endif
+ #ifndef OPENSSL_NO_IDEA
+-    IDEA_set_encrypt_key(key16, &idea_ks);
++    if (doit[D_CBC_IDEA]) {
++        IDEA_set_encrypt_key(key16, &idea_ks);
++    }
+ #endif
+ #ifndef OPENSSL_NO_SEED
+-    SEED_set_key(key16, &seed_ks);
++    if (doit[D_CBC_SEED]) {
++        SEED_set_key(key16, &seed_ks);
++    }
+ #endif
+ #ifndef OPENSSL_NO_RC4
+-    RC4_set_key(&rc4_ks, 16, key16);
++   if (doit[D_RC4]) {
++        RC4_set_key(&rc4_ks, 16, key16);
++    }
+ #endif
+ #ifndef OPENSSL_NO_RC2
+-    RC2_set_key(&rc2_ks, 16, key16, 128);
++    if (doit[D_CBC_RC2]) {
++        RC2_set_key(&rc2_ks, 16, key16, 128);
++    }
+ #endif
+ #ifndef OPENSSL_NO_RC5
+-    RC5_32_set_key(&rc5_ks, 16, key16, 12);
++    if (doit[D_CBC_RC5]) {
++        RC5_32_set_key(&rc5_ks, 16, key16, 12);
++    }
+ #endif
+ #ifndef OPENSSL_NO_BF
+-    BF_set_key(&bf_ks, 16, key16);
++    if (doit[D_CBC_BF]) {
++        BF_set_key(&bf_ks, 16, key16);
++    }
+ #endif
+ #ifndef OPENSSL_NO_CAST
+-    CAST_set_key(&cast_ks, 16, key16);
++    if (doit[D_CBC_CAST]) {
++        CAST_set_key(&cast_ks, 16, key16);
++    }
+ #endif
+ #ifndef SIGALRM
+ # ifndef OPENSSL_NO_DES
+@@ -2152,6 +2177,7 @@ int speed_main(int argc, char **argv)
+ 
+         for (i = 0; i < loopargs_len; i++) {
+             loopargs[i].hctx = HMAC_CTX_new();
++            HMAC_CTX_set_flags(loopargs[i].hctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+             if (loopargs[i].hctx == NULL) {
+                 BIO_printf(bio_err, "HMAC malloc failure, exiting...");
+                 exit(1);
+diff -up openssl-1.1.1/Configure.fips openssl-1.1.1/Configure
+--- openssl-1.1.1/Configure.fips	2018-09-13 08:51:22.097521227 +0200
++++ openssl-1.1.1/Configure	2018-09-13 08:51:22.101521133 +0200
+@@ -310,7 +310,7 @@ $config{sdirs} = [
+     "md2", "md4", "md5", "sha", "mdc2", "hmac", "ripemd", "whrlpool", "poly1305", "blake2", "siphash", "sm3",
+     "des", "aes", "rc2", "rc4", "rc5", "idea", "aria", "bf", "cast", "camellia", "seed", "sm4", "chacha", "modes",
+     "bn", "ec", "rsa", "dsa", "dh", "sm2", "dso", "engine",
+-    "buffer", "bio", "stack", "lhash", "rand", "err",
++    "buffer", "bio", "stack", "lhash", "rand", "err", "fips",
+     "evp", "asn1", "pem", "x509", "x509v3", "conf", "txt_db", "pkcs7", "pkcs12", "comp", "ocsp", "ui",
+     "cms", "ts", "srp", "cmac", "ct", "async", "kdf", "store"
+     ];
+diff -up openssl-1.1.1/crypto/dh/dh_err.c.fips openssl-1.1.1/crypto/dh/dh_err.c
+--- openssl-1.1.1/crypto/dh/dh_err.c.fips	2018-09-11 14:48:20.000000000 +0200
++++ openssl-1.1.1/crypto/dh/dh_err.c	2018-09-13 08:51:22.101521133 +0200
+@@ -25,6 +25,9 @@ static const ERR_STRING_DATA DH_str_func
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_PEERKEY, 0), "dh_cms_set_peerkey"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_SHARED_INFO, 0),
+      "dh_cms_set_shared_info"},
++    {ERR_PACK(ERR_LIB_DH, DH_F_DH_COMPUTE_KEY, 0), "DH_compute_key"},
++    {ERR_PACK(ERR_LIB_DH, DH_F_DH_GENERATE_KEY, 0), "DH_generate_key"},
++    {ERR_PACK(ERR_LIB_DH, DH_F_DH_GENERATE_PARAMETERS_EX, 0), "DH_generate_parameters_ex"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_DUP, 0), "DH_meth_dup"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_NEW, 0), "DH_meth_new"},
+     {ERR_PACK(ERR_LIB_DH, DH_F_DH_METH_SET1_NAME, 0), "DH_meth_set1_name"},
+@@ -72,12 +75,14 @@ static const ERR_STRING_DATA DH_str_reas
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_INVALID_PUBKEY), "invalid public key"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_KDF_PARAMETER_ERROR), "kdf parameter error"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_KEYS_NOT_SET), "keys not set"},
++    {ERR_PACK(ERR_LIB_DH, 0, DH_R_KEY_SIZE_TOO_SMALL), "key size too small"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_MISSING_PUBKEY), "missing pubkey"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_MODULUS_TOO_LARGE), "modulus too large"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NOT_SUITABLE_GENERATOR),
+     "not suitable generator"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NO_PARAMETERS_SET), "no parameters set"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_NO_PRIVATE_VALUE), "no private value"},
++    {ERR_PACK(ERR_LIB_DH, 0, DH_R_NON_FIPS_METHOD), "non FIPS method"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR),
+     "parameter encoding error"},
+     {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"},
+diff -up openssl-1.1.1/crypto/dh/dh_gen.c.fips openssl-1.1.1/crypto/dh/dh_gen.c
+--- openssl-1.1.1/crypto/dh/dh_gen.c.fips	2018-09-11 14:48:20.000000000 +0200
++++ openssl-1.1.1/crypto/dh/dh_gen.c	2018-09-13 08:51:22.101521133 +0200
+@@ -16,6 +16,9 @@
+ #include "internal/cryptlib.h"
+ #include <openssl/bn.h>
+ #include "dh_locl.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
+                                 BN_GENCB *cb);
+@@ -23,6 +26,13 @@ static int dh_builtin_genparams(DH *ret,
+ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
+                               BN_GENCB *cb)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
++        && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW)) {
++        DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
++        return 0;
++    }
++#endif
+     if (ret->meth->generate_params)
+         return ret->meth->generate_params(ret, prime_len, generator, cb);
+     return dh_builtin_genparams(ret, prime_len, generator, cb);
+@@ -62,6 +72,18 @@ static int dh_builtin_genparams(DH *ret,
+     int g, ok = -1;
+     BN_CTX *ctx = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DH_BUILTIN_GENPARAMS, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++
++    if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN)) {
++        DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
++
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+         goto err;
+diff -up openssl-1.1.1/crypto/dh/dh_key.c.fips openssl-1.1.1/crypto/dh/dh_key.c
+--- openssl-1.1.1/crypto/dh/dh_key.c.fips	2018-09-11 14:48:20.000000000 +0200
++++ openssl-1.1.1/crypto/dh/dh_key.c	2018-09-13 08:51:22.101521133 +0200
+@@ -11,6 +11,9 @@
+ #include "internal/cryptlib.h"
+ #include "dh_locl.h"
+ #include "internal/bn_int.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static int generate_key(DH *dh);
+ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
+@@ -22,18 +25,32 @@ static int dh_finish(DH *dh);
+ 
+ int DH_generate_key(DH *dh)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
++        && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW)) {
++        DHerr(DH_F_DH_GENERATE_KEY, DH_R_NON_FIPS_METHOD);
++        return 0;
++    }
++#endif
+     return dh->meth->generate_key(dh);
+ }
+ 
+ int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
++        && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW)) {
++        DHerr(DH_F_DH_COMPUTE_KEY, DH_R_NON_FIPS_METHOD);
++        return 0;
++    }
++#endif
+     return dh->meth->compute_key(key, pub_key, dh);
+ }
+ 
+ int DH_compute_key_padded(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+ {
+     int rv, pad;
+-    rv = dh->meth->compute_key(key, pub_key, dh);
++    rv = DH_compute_key(key, pub_key, dh);
+     if (rv <= 0)
+         return rv;
+     pad = BN_num_bytes(dh->p) - rv;
+@@ -82,6 +99,14 @@ static int generate_key(DH *dh)
+     BN_MONT_CTX *mont = NULL;
+     BIGNUM *pub_key = NULL, *priv_key = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode()
++        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {
++        DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
++        return 0;
++    }
++#endif
++
+     if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
+         DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
+         return 0;
+@@ -170,6 +195,13 @@ static int compute_key(unsigned char *ke
+         DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE);
+         goto err;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode()
++        && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS)) {
++        DHerr(DH_F_COMPUTE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
+ 
+     ctx = BN_CTX_new();
+     if (ctx == NULL)
+@@ -221,6 +253,9 @@ static int dh_bn_mod_exp(const DH *dh, B
+ 
+ static int dh_init(DH *dh)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     dh->flags |= DH_FLAG_CACHE_MONT_P;
+     return 1;
+ }
+diff -up openssl-1.1.1/crypto/dsa/dsa_err.c.fips openssl-1.1.1/crypto/dsa/dsa_err.c
+--- openssl-1.1.1/crypto/dsa/dsa_err.c.fips	2018-09-11 14:48:20.000000000 +0200
++++ openssl-1.1.1/crypto/dsa/dsa_err.c	2018-09-13 08:51:22.102521110 +0200
+@@ -16,12 +16,15 @@
+ static const ERR_STRING_DATA DSA_str_functs[] = {
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSAPARAMS_PRINT, 0), "DSAparams_print"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSAPARAMS_PRINT_FP, 0), "DSAparams_print_fp"},
++    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_KEYGEN, 0), "dsa_builtin_keygen"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_PARAMGEN, 0),
+      "dsa_builtin_paramgen"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_BUILTIN_PARAMGEN2, 0),
+      "dsa_builtin_paramgen2"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_DO_SIGN, 0), "DSA_do_sign"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_DO_VERIFY, 0), "DSA_do_verify"},
++    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_GENERATE_KEY, 0), "DSA_generate_key"},
++    {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_GENERATE_PARAMETERS_EX, 0), "DSA_generate_parameters_ex"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_DUP, 0), "DSA_meth_dup"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_NEW, 0), "DSA_meth_new"},
+     {ERR_PACK(ERR_LIB_DSA, DSA_F_DSA_METH_SET1_NAME, 0), "DSA_meth_set1_name"},
+@@ -51,9 +54,12 @@ static const ERR_STRING_DATA DSA_str_rea
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_INVALID_DIGEST_TYPE),
+     "invalid digest type"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_INVALID_PARAMETERS), "invalid parameters"},
++    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_KEY_SIZE_INVALID), "key size invalid"},
++    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_KEY_SIZE_TOO_SMALL), "key size too small"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_MISSING_PARAMETERS), "missing parameters"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_MODULUS_TOO_LARGE), "modulus too large"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_NO_PARAMETERS_SET), "no parameters set"},
++    {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_NON_FIPS_DSA_METHOD), "non FIPS DSA method"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_PARAMETER_ENCODING_ERROR),
+     "parameter encoding error"},
+     {ERR_PACK(ERR_LIB_DSA, 0, DSA_R_Q_NOT_PRIME), "q not prime"},
+diff -up openssl-1.1.1/crypto/dsa/dsa_gen.c.fips openssl-1.1.1/crypto/dsa/dsa_gen.c
+--- openssl-1.1.1/crypto/dsa/dsa_gen.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/dsa/dsa_gen.c	2018-09-13 08:51:22.102521110 +0200
+@@ -22,12 +22,22 @@
+ #include <openssl/rand.h>
+ #include <openssl/sha.h>
+ #include "dsa_locl.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ int DSA_generate_parameters_ex(DSA *ret, int bits,
+                                const unsigned char *seed_in, int seed_len,
+                                int *counter_ret, unsigned long *h_ret,
+                                BN_GENCB *cb)
+ {
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
++        && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW)) {
++        DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
++        return 0;
++    }
++# endif
+     if (ret->meth->dsa_paramgen)
+         return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
+                                        counter_ret, h_ret, cb);
+@@ -35,9 +45,15 @@ int DSA_generate_parameters_ex(DSA *ret,
+         const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();
+         size_t qbits = EVP_MD_size(evpmd) * 8;
+ 
++# ifdef OPENSSL_FIPS
++        return dsa_builtin_paramgen2(ret, bits, qbits, evpmd,
++                          seed_in, seed_len, -1, NULL, counter_ret,
++                          h_ret, cb);
++# else
+         return dsa_builtin_paramgen(ret, bits, qbits, evpmd,
+                                     seed_in, seed_len, NULL, counter_ret,
+                                     h_ret, cb);
++# endif
+     }
+ }
+ 
+@@ -310,7 +326,7 @@ int dsa_builtin_paramgen2(DSA *ret, size
+                           int *counter_ret, unsigned long *h_ret,
+                           BN_GENCB *cb)
+ {
+-    int ok = -1;
++    int ok = 0;
+     unsigned char *seed = NULL, *seed_tmp = NULL;
+     unsigned char md[EVP_MAX_MD_SIZE];
+     int mdsize;
+@@ -327,6 +343,20 @@ int dsa_builtin_paramgen2(DSA *ret, size
+     if (mctx == NULL)
+         goto err;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_BUILTIN_PARAMGEN2, FIPS_R_FIPS_SELFTEST_FAILED);
++        goto err;
++    }
++
++    if (FIPS_mode() && (L != 1024 || N != 160) &&
++        (L != 2048 || N != 224) && (L != 2048 || N != 256) &&
++        (L != 3072 || N != 256)) {
++        DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_KEY_SIZE_INVALID);
++        goto err;
++    }
++# endif
++
+     if (evpmd == NULL) {
+         if (N == 160)
+             evpmd = EVP_sha1();
+@@ -427,9 +457,10 @@ int dsa_builtin_paramgen2(DSA *ret, size
+                 goto err;
+             /* Provided seed didn't produce a prime: error */
+             if (seed_in) {
+-                ok = 0;
+-                DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_Q_NOT_PRIME);
+-                goto err;
++                /* Different seed_out will indicate that seed_in
++                 * did not generate primes.
++                 */
++                seed_in = NULL;
+             }
+ 
+             /* do a callback call */
+@@ -515,11 +546,14 @@ int dsa_builtin_paramgen2(DSA *ret, size
+             if (counter >= (int)(4 * L))
+                 break;
+         }
++#if 0
++        /* Cannot happen */
+         if (seed_in) {
+             ok = 0;
+             DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_INVALID_PARAMETERS);
+             goto err;
+         }
++#endif
+     }
+  end:
+     if (!BN_GENCB_call(cb, 2, 1))
+@@ -590,7 +624,7 @@ int dsa_builtin_paramgen2(DSA *ret, size
+         BN_free(ret->g);
+         ret->g = BN_dup(g);
+         if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
+-            ok = -1;
++            ok = 0;
+             goto err;
+         }
+         if (counter_ret != NULL)
+@@ -608,3 +642,53 @@ int dsa_builtin_paramgen2(DSA *ret, size
+     EVP_MD_CTX_free(mctx);
+     return ok;
+ }
++
++#ifdef OPENSSL_FIPS
++
++int FIPS_dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
++                               const EVP_MD *evpmd, const unsigned char *seed_in,
++                               size_t seed_len, int idx, unsigned char *seed_out,
++                               int *counter_ret, unsigned long *h_ret,
++                               BN_GENCB *cb)
++{
++    return dsa_builtin_paramgen2(ret, L, N, evpmd, seed_in, seed_len,
++        idx, seed_out, counter_ret, h_ret, cb);
++}
++
++int FIPS_dsa_paramgen_check_g(DSA *dsa)
++{
++    BN_CTX *ctx;
++    BIGNUM *tmp;
++    BN_MONT_CTX *mont = NULL;
++    int rv = -1;
++
++    ctx = BN_CTX_new();
++    if (ctx == NULL)
++        return -1;
++    if (BN_cmp(dsa->g, BN_value_one()) <= 0)
++        return 0;
++    if (BN_cmp(dsa->g, dsa->p) >= 0)
++        return 0;
++    BN_CTX_start(ctx);
++    tmp = BN_CTX_get(ctx);
++    if (tmp == NULL)
++        goto err;
++    if ((mont=BN_MONT_CTX_new()) == NULL)
++        goto err;
++    if (!BN_MONT_CTX_set(mont,dsa->p,ctx))
++        goto err;
++    /* Work out g^q mod p */
++    if (!BN_mod_exp_mont(tmp,dsa->g,dsa->q, dsa->p, ctx, mont))
++        goto err;
++    if (!BN_cmp(tmp, BN_value_one()))
++        rv = 1;
++    else
++        rv = 0;
++ err:
++    BN_CTX_end(ctx);
++    BN_MONT_CTX_free(mont);
++    BN_CTX_free(ctx);
++    return rv;
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/dsa/dsa_key.c.fips openssl-1.1.1/crypto/dsa/dsa_key.c
+--- openssl-1.1.1/crypto/dsa/dsa_key.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/dsa/dsa_key.c	2018-09-13 08:51:22.102521110 +0200
+@@ -13,10 +13,49 @@
+ #include <openssl/bn.h>
+ #include "dsa_locl.h"
+ 
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++
++static int fips_check_dsa(DSA *dsa)
++{
++    EVP_PKEY *pk;
++    unsigned char tbs[] = "DSA Pairwise Check Data";
++    int ret = 0;
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_DSA(pk, dsa);
++
++    if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))
++        ret = 1;
++
++ err:
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_CHECK_DSA, FIPS_R_PAIRWISE_TEST_FAILED);
++        fips_set_selftest_fail();
++    }
++
++    if (pk)
++        EVP_PKEY_free(pk);
++
++    return ret;
++}
++
++#endif
++
+ static int dsa_builtin_keygen(DSA *dsa);
+ 
+ int DSA_generate_key(DSA *dsa)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
++        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)) {
++        DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);
++        return 0;
++    }
++#endif
+     if (dsa->meth->dsa_keygen)
+         return dsa->meth->dsa_keygen(dsa);
+     return dsa_builtin_keygen(dsa);
+@@ -28,6 +67,14 @@ static int dsa_builtin_keygen(DSA *dsa)
+     BN_CTX *ctx = NULL;
+     BIGNUM *pub_key = NULL, *priv_key = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN)) {
++        DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);
++        goto err;
++    }
++#endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+ 
+@@ -65,6 +112,13 @@ static int dsa_builtin_keygen(DSA *dsa)
+ 
+     dsa->priv_key = priv_key;
+     dsa->pub_key = pub_key;
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !fips_check_dsa(dsa)) {
++        dsa->pub_key = NULL;
++        dsa->priv_key = NULL;
++        goto err;
++    }
++#endif
+     ok = 1;
+ 
+  err:
+diff -up openssl-1.1.1/crypto/dsa/dsa_ossl.c.fips openssl-1.1.1/crypto/dsa/dsa_ossl.c
+--- openssl-1.1.1/crypto/dsa/dsa_ossl.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/dsa/dsa_ossl.c	2018-09-13 08:51:22.102521110 +0200
+@@ -13,6 +13,9 @@
+ #include <openssl/sha.h>
+ #include "dsa_locl.h"
+ #include <openssl/asn1.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+ static int dsa_sign_setup_no_digest(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
+@@ -70,6 +73,19 @@ static DSA_SIG *dsa_do_sign(const unsign
+         goto err;
+     }
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_DO_SIGN, FIPS_R_FIPS_SELFTEST_FAILED);
++        return NULL;
++    }
++
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {
++        DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_KEY_SIZE_TOO_SMALL);
++        return NULL;
++    }
++#endif
++
+     ret = DSA_SIG_new();
+     if (ret == NULL)
+         goto err;
+@@ -296,6 +312,18 @@ static int dsa_do_verify(const unsigned
+         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_BAD_Q_VALUE);
+         return -1;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_DSA_DO_VERIFY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++
++    if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
++        && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS)) {
++        DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);
++        return -1;
++    }
++#endif
+ 
+     if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
+         DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_MODULUS_TOO_LARGE);
+@@ -384,6 +412,9 @@ static int dsa_do_verify(const unsigned
+ 
+ static int dsa_init(DSA *dsa)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     dsa->flags |= DSA_FLAG_CACHE_MONT_P;
+     return 1;
+ }
+diff -up openssl-1.1.1/crypto/dsa/dsa_pmeth.c.fips openssl-1.1.1/crypto/dsa/dsa_pmeth.c
+--- openssl-1.1.1/crypto/dsa/dsa_pmeth.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/dsa/dsa_pmeth.c	2018-09-13 08:51:22.102521110 +0200
+@@ -211,8 +211,8 @@ static int pkey_dsa_paramgen(EVP_PKEY_CT
+         BN_GENCB_free(pcb);
+         return 0;
+     }
+-    ret = dsa_builtin_paramgen(dsa, dctx->nbits, dctx->qbits, dctx->pmd,
+-                               NULL, 0, NULL, NULL, NULL, pcb);
++    ret = dsa_builtin_paramgen2(dsa, dctx->nbits, dctx->qbits, dctx->pmd,
++                               NULL, 0, -1, NULL, NULL, NULL, pcb);
+     BN_GENCB_free(pcb);
+     if (ret)
+         EVP_PKEY_assign_DSA(pkey, dsa);
+diff -up openssl-1.1.1/crypto/ec/ecdh_ossl.c.fips openssl-1.1.1/crypto/ec/ecdh_ossl.c
+--- openssl-1.1.1/crypto/ec/ecdh_ossl.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/ec/ecdh_ossl.c	2018-09-13 08:51:22.102521110 +0200
+@@ -19,9 +19,20 @@
+ #include <openssl/ec.h>
+ #include "ec_lcl.h"
+ 
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++
+ int ossl_ecdh_compute_key(unsigned char **psec, size_t *pseclen,
+                           const EC_POINT *pub_key, const EC_KEY *ecdh)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_ECDH_COMPUTE_KEY, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++#endif
++
+     if (ecdh->group->meth->ecdh_compute_key == NULL) {
+         ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_CURVE_DOES_NOT_SUPPORT_ECDH);
+         return 0;
+diff -up openssl-1.1.1/crypto/ec/ecdsa_ossl.c.fips openssl-1.1.1/crypto/ec/ecdsa_ossl.c
+--- openssl-1.1.1/crypto/ec/ecdsa_ossl.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/ec/ecdsa_ossl.c	2018-09-13 08:51:22.103521086 +0200
+@@ -14,6 +14,10 @@
+ #include "internal/bn_int.h"
+ #include "ec_lcl.h"
+ 
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++
+ int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen,
+                     unsigned char *sig, unsigned int *siglen,
+                     const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey)
+@@ -159,6 +163,13 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const uns
+     ECDSA_SIG *ret;
+     const BIGNUM *priv_key;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_OSSL_ECDSA_SIGN_SIG, FIPS_R_FIPS_SELFTEST_FAILED);
++        return NULL;
++    }
++#endif
++
+     group = EC_KEY_get0_group(eckey);
+     priv_key = EC_KEY_get0_private_key(eckey);
+ 
+@@ -317,6 +328,13 @@ int ossl_ecdsa_verify_sig(const unsigned
+     const EC_GROUP *group;
+     const EC_POINT *pub_key;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_OSSL_ECDSA_VERIFY_SIG, FIPS_R_FIPS_SELFTEST_FAILED);
++        return -1;
++    }
++#endif
++
+     /* check input values */
+     if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||
+         (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {
+diff -up openssl-1.1.1/crypto/ec/ec_key.c.fips openssl-1.1.1/crypto/ec/ec_key.c
+--- openssl-1.1.1/crypto/ec/ec_key.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/ec/ec_key.c	2018-09-13 08:51:22.103521086 +0200
+@@ -178,14 +178,62 @@ ENGINE *EC_KEY_get0_engine(const EC_KEY
+     return eckey->engine;
+ }
+ 
++#ifdef OPENSSL_FIPS
++
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++
++static int fips_check_ec(EC_KEY *key)
++{
++    EVP_PKEY *pk;
++    unsigned char tbs[] = "ECDSA Pairwise Check Data";
++    int ret = 0;
++
++    if (!EC_KEY_can_sign(key)) /* no test for non-signing keys */
++        return 1;
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_EC_KEY(pk, key);
++
++    if (fips_pkey_signature_test(pk, tbs, -1, NULL, 0, NULL, 0, NULL))
++        ret = 1;
++
++ err:
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_CHECK_EC, FIPS_R_PAIRWISE_TEST_FAILED);
++        fips_set_selftest_fail();
++    }
++    if (pk)
++        EVP_PKEY_free(pk);
++    return ret;
++}
++
++#endif
++
+ int EC_KEY_generate_key(EC_KEY *eckey)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        ECerr(EC_F_EC_KEY_GENERATE_KEY, EC_R_NOT_INITIALIZED);
++        return 0;
++    }
++#endif
+     if (eckey == NULL || eckey->group == NULL) {
+         ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
+         return 0;
+     }
+-    if (eckey->meth->keygen != NULL)
+-        return eckey->meth->keygen(eckey);
++    if (eckey->meth->keygen != NULL) {
++        int rv = eckey->meth->keygen(eckey);
++
++#ifdef OPENSSL_FIPS
++        if (rv > 0 && FIPS_mode()) {
++            rv = fips_check_ec(eckey);
++        }
++#endif
++        return rv;
++    }
+     ECerr(EC_F_EC_KEY_GENERATE_KEY, EC_R_OPERATION_NOT_SUPPORTED);
+     return 0;
+ }
+diff -up openssl-1.1.1/crypto/evp/c_allc.c.fips openssl-1.1.1/crypto/evp/c_allc.c
+--- openssl-1.1.1/crypto/evp/c_allc.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/c_allc.c	2018-09-13 08:51:22.103521086 +0200
+@@ -17,6 +17,9 @@
+ void openssl_add_all_ciphers_int(void)
+ {
+ 
++#ifdef OPENSSL_FIPS
++    if (!FIPS_mode()) {
++#endif
+ #ifndef OPENSSL_NO_DES
+     EVP_add_cipher(EVP_des_cfb());
+     EVP_add_cipher(EVP_des_cfb1());
+@@ -263,4 +266,70 @@ void openssl_add_all_ciphers_int(void)
+     EVP_add_cipher(EVP_chacha20_poly1305());
+ # endif
+ #endif
++#ifdef OPENSSL_FIPS
++    } else {
++# ifndef OPENSSL_NO_DES
++        EVP_add_cipher(EVP_des_ede3_cfb());
++
++        EVP_add_cipher(EVP_des_ede3_ofb());
++
++        EVP_add_cipher(EVP_des_ede3_cbc());
++        EVP_add_cipher_alias(SN_des_ede3_cbc, "DES3");
++        EVP_add_cipher_alias(SN_des_ede3_cbc, "des3");
++
++        EVP_add_cipher(EVP_des_ede3());
++        EVP_add_cipher_alias(SN_des_ede3_ecb, "DES-EDE3-ECB");
++        EVP_add_cipher_alias(SN_des_ede3_ecb, "des-ede3-ecb");
++        EVP_add_cipher(EVP_des_ede3_wrap());
++        EVP_add_cipher_alias(SN_id_smime_alg_CMS3DESwrap, "des3-wrap");
++# endif
++
++# ifndef OPENSSL_NO_AES
++        EVP_add_cipher(EVP_aes_128_ecb());
++        EVP_add_cipher(EVP_aes_128_cbc());
++        EVP_add_cipher(EVP_aes_128_cfb());
++        EVP_add_cipher(EVP_aes_128_cfb1());
++        EVP_add_cipher(EVP_aes_128_cfb8());
++        EVP_add_cipher(EVP_aes_128_ofb());
++        EVP_add_cipher(EVP_aes_128_ctr());
++        EVP_add_cipher(EVP_aes_128_gcm());
++        EVP_add_cipher(EVP_aes_128_xts());
++        EVP_add_cipher(EVP_aes_128_ccm());
++        EVP_add_cipher(EVP_aes_128_wrap());
++        EVP_add_cipher_alias(SN_id_aes128_wrap, "aes128-wrap");
++        EVP_add_cipher(EVP_aes_128_wrap_pad());
++        EVP_add_cipher_alias(SN_aes_128_cbc, "AES128");
++        EVP_add_cipher_alias(SN_aes_128_cbc, "aes128");
++        EVP_add_cipher(EVP_aes_192_ecb());
++        EVP_add_cipher(EVP_aes_192_cbc());
++        EVP_add_cipher(EVP_aes_192_cfb());
++        EVP_add_cipher(EVP_aes_192_cfb1());
++        EVP_add_cipher(EVP_aes_192_cfb8());
++        EVP_add_cipher(EVP_aes_192_ofb());
++        EVP_add_cipher(EVP_aes_192_ctr());
++        EVP_add_cipher(EVP_aes_192_gcm());
++        EVP_add_cipher(EVP_aes_192_ccm());
++        EVP_add_cipher(EVP_aes_192_wrap());
++        EVP_add_cipher_alias(SN_id_aes192_wrap, "aes192-wrap");
++        EVP_add_cipher(EVP_aes_192_wrap_pad());
++        EVP_add_cipher_alias(SN_aes_192_cbc, "AES192");
++        EVP_add_cipher_alias(SN_aes_192_cbc, "aes192");
++        EVP_add_cipher(EVP_aes_256_ecb());
++        EVP_add_cipher(EVP_aes_256_cbc());
++        EVP_add_cipher(EVP_aes_256_cfb());
++        EVP_add_cipher(EVP_aes_256_cfb1());
++        EVP_add_cipher(EVP_aes_256_cfb8());
++        EVP_add_cipher(EVP_aes_256_ofb());
++        EVP_add_cipher(EVP_aes_256_ctr());
++        EVP_add_cipher(EVP_aes_256_gcm());
++        EVP_add_cipher(EVP_aes_256_xts());
++        EVP_add_cipher(EVP_aes_256_ccm());
++        EVP_add_cipher(EVP_aes_256_wrap());
++        EVP_add_cipher_alias(SN_id_aes256_wrap, "aes256-wrap");
++        EVP_add_cipher(EVP_aes_256_wrap_pad());
++        EVP_add_cipher_alias(SN_aes_256_cbc, "AES256");
++        EVP_add_cipher_alias(SN_aes_256_cbc, "aes256");
++# endif
++    }
++#endif
+ }
+diff -up openssl-1.1.1/crypto/evp/c_alld.c.fips openssl-1.1.1/crypto/evp/c_alld.c
+--- openssl-1.1.1/crypto/evp/c_alld.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/c_alld.c	2018-09-13 08:51:22.103521086 +0200
+@@ -16,6 +16,9 @@
+ 
+ void openssl_add_all_digests_int(void)
+ {
++#ifdef OPENSSL_FIPS
++    if (!FIPS_mode()) {
++#endif
+ #ifndef OPENSSL_NO_MD4
+     EVP_add_digest(EVP_md4());
+ #endif
+@@ -57,4 +60,24 @@ void openssl_add_all_digests_int(void)
+     EVP_add_digest(EVP_sha3_512());
+     EVP_add_digest(EVP_shake128());
+     EVP_add_digest(EVP_shake256());
++#ifdef OPENSSL_FIPS
++    } else {
++        EVP_add_digest(EVP_md5_sha1());
++        EVP_add_digest(EVP_sha1());
++        EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
++        EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
++        EVP_add_digest(EVP_sha224());
++        EVP_add_digest(EVP_sha256());
++        EVP_add_digest(EVP_sha384());
++        EVP_add_digest(EVP_sha512());
++        EVP_add_digest(EVP_sha512_224());
++        EVP_add_digest(EVP_sha512_256());
++        EVP_add_digest(EVP_sha3_224());
++        EVP_add_digest(EVP_sha3_256());
++        EVP_add_digest(EVP_sha3_384());
++        EVP_add_digest(EVP_sha3_512());
++        EVP_add_digest(EVP_shake128());
++        EVP_add_digest(EVP_shake256());
++    }
++#endif
+ }
+diff -up openssl-1.1.1/crypto/evp/digest.c.fips openssl-1.1.1/crypto/evp/digest.c
+--- openssl-1.1.1/crypto/evp/digest.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/digest.c	2018-09-13 08:51:22.103521086 +0200
+@@ -14,6 +14,9 @@
+ #include <openssl/engine.h>
+ #include "internal/evp_int.h"
+ #include "evp_locl.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ /* This call frees resources associated with the context */
+ int EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
+@@ -66,6 +69,12 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, cons
+ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
+ {
+     EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_DIGESTINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++#endif
+ #ifndef OPENSSL_NO_ENGINE
+     /*
+      * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
+@@ -119,6 +128,15 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c
+     }
+ #endif
+     if (ctx->digest != type) {
++#ifdef OPENSSL_FIPS
++        if (FIPS_mode()) {
++            if (!(type->flags & EVP_MD_FLAG_FIPS)
++                && !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)) {
++                EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_DISABLED_FOR_FIPS);
++                return 0;
++            }
++        }
++#endif
+         if (ctx->digest && ctx->digest->ctx_size) {
+             OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
+             ctx->md_data = NULL;
+@@ -150,6 +168,9 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c
+ 
+ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     return ctx->update(ctx, data, count);
+ }
+ 
+@@ -167,6 +188,9 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx,
+ {
+     int ret;
+ 
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
+     ret = ctx->digest->final(ctx, md);
+     if (size != NULL)
+diff -up openssl-1.1.1/crypto/evp/e_aes.c.fips openssl-1.1.1/crypto/evp/e_aes.c
+--- openssl-1.1.1/crypto/evp/e_aes.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/e_aes.c	2018-09-13 08:51:22.104521063 +0200
+@@ -2794,9 +2794,9 @@ static int aes_ctr_cipher(EVP_CIPHER_CTX
+     return 1;
+ }
+ 
+-BLOCK_CIPHER_generic_pack(NID_aes, 128, 0)
+-    BLOCK_CIPHER_generic_pack(NID_aes, 192, 0)
+-    BLOCK_CIPHER_generic_pack(NID_aes, 256, 0)
++BLOCK_CIPHER_generic_pack(NID_aes, 128, EVP_CIPH_FLAG_FIPS)
++    BLOCK_CIPHER_generic_pack(NID_aes, 192, EVP_CIPH_FLAG_FIPS)
++    BLOCK_CIPHER_generic_pack(NID_aes, 256, EVP_CIPH_FLAG_FIPS)
+ 
+ static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
+ {
+@@ -2826,6 +2826,11 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *
+     case EVP_CTRL_AEAD_SET_IVLEN:
+         if (arg <= 0)
+             return 0;
++# ifdef OPENSSL_FIPS
++        if (FIPS_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
++            && arg < 12)
++            return 0;
++# endif
+         /* Allocate memory for IV if needed */
+         if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) {
+             if (gctx->iv != c->iv)
+@@ -3275,11 +3280,14 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX
+                 | EVP_CIPH_CUSTOM_COPY)
+ 
+ BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, gcm, GCM,
+-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |
++                    CUSTOM_FLAGS)
+     BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, gcm, GCM,
+-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |
++                    CUSTOM_FLAGS)
+     BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, gcm, GCM,
+-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER |
++                    CUSTOM_FLAGS)
+ 
+ static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+ {
+@@ -3414,6 +3422,14 @@ static int aes_xts_cipher(EVP_CIPHER_CTX
+         return 0;
+     if (!out || !in || len < AES_BLOCK_SIZE)
+         return 0;
++# ifdef OPENSSL_FIPS
++    /* Requirement of SP800-38E */
++    if (FIPS_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
++        (len > (1UL << 20) * 16)) {
++        EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_TOO_LARGE);
++        return 0;
++    }
++# endif
+     if (xctx->stream)
+         (*xctx->stream) (in, out, len,
+                          xctx->xts.key1, xctx->xts.key2,
+@@ -3431,8 +3447,10 @@ static int aes_xts_cipher(EVP_CIPHER_CTX
+                          | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \
+                          | EVP_CIPH_CUSTOM_COPY)
+ 
+-BLOCK_CIPHER_custom(NID_aes, 128, 1, 16, xts, XTS, XTS_FLAGS)
+-    BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
++BLOCK_CIPHER_custom(NID_aes, 128, 1, 16, xts, XTS,
++                    EVP_CIPH_FLAG_FIPS | XTS_FLAGS)
++    BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS,
++                    EVP_CIPH_FLAG_FIPS | XTS_FLAGS)
+ 
+ static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+ {
+@@ -3697,11 +3715,11 @@ static int aes_ccm_cipher(EVP_CIPHER_CTX
+ #define aes_ccm_cleanup NULL
+ 
+ BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, ccm, CCM,
+-                    EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                    EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
+     BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, ccm, CCM,
+-                        EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                        EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
+     BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, ccm, CCM,
+-                        EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
++                        EVP_CIPH_FLAG_FIPS | EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
+ 
+ typedef struct {
+     union {
+@@ -3794,7 +3812,7 @@ static int aes_wrap_cipher(EVP_CIPHER_CT
+     return rv ? (int)rv : -1;
+ }
+ 
+-#define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE \
++#define WRAP_FLAGS      (EVP_CIPH_WRAP_MODE | EVP_CIPH_FLAG_FIPS \
+                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
+                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_FLAG_DEFAULT_ASN1)
+ 
+diff -up openssl-1.1.1/crypto/evp/e_des3.c.fips openssl-1.1.1/crypto/evp/e_des3.c
+--- openssl-1.1.1/crypto/evp/e_des3.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/e_des3.c	2018-09-13 08:51:22.104521063 +0200
+@@ -211,16 +211,19 @@ BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY,
+ # define des_ede3_cbc_cipher des_ede_cbc_cipher
+ # define des_ede3_ecb_cipher des_ede_ecb_cipher
+     BLOCK_CIPHER_defs(des_ede3, DES_EDE_KEY, NID_des_ede3, 8, 24, 8, 64,
+-                  EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
+-                  des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
++                  EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |
++                  EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL, NULL,
++                  des3_ctrl)
+ 
+     BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 1,
+-                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
+-                     des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
++                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |
++                     EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL,
++                     NULL, des3_ctrl)
+ 
+     BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 8,
+-                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
+-                     des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
++                     EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_FIPS |
++                     EVP_CIPH_FLAG_DEFAULT_ASN1, des_ede3_init_key, NULL, NULL,
++                     NULL, des3_ctrl)
+ 
+ static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                             const unsigned char *iv, int enc)
+diff -up openssl-1.1.1/crypto/evp/e_null.c.fips openssl-1.1.1/crypto/evp/e_null.c
+--- openssl-1.1.1/crypto/evp/e_null.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/e_null.c	2018-09-13 08:51:22.104521063 +0200
+@@ -19,7 +19,8 @@ static int null_cipher(EVP_CIPHER_CTX *c
+                        const unsigned char *in, size_t inl);
+ static const EVP_CIPHER n_cipher = {
+     NID_undef,
+-    1, 0, 0, 0,
++    1, 0, 0,
++    EVP_CIPH_FLAG_FIPS,
+     null_init_key,
+     null_cipher,
+     NULL,
+diff -up openssl-1.1.1/crypto/evp/evp_enc.c.fips openssl-1.1.1/crypto/evp/evp_enc.c
+--- openssl-1.1.1/crypto/evp/evp_enc.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/evp_enc.c	2018-09-13 08:51:22.104521063 +0200
+@@ -17,10 +17,19 @@
+ #include <openssl/engine.h>
+ #include "internal/evp_int.h"
+ #include "evp_locl.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
+ 
+ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *c)
+ {
+-    if (c == NULL)
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_CIPHER_CTX_RESET, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++#endif
++   if (c == NULL)
+         return 1;
+     if (c->cipher != NULL) {
+         if (c->cipher->cleanup && !c->cipher->cleanup(c))
+@@ -39,6 +48,12 @@ int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX
+ 
+ EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_CIPHER_CTX_NEW, FIPS_R_FIPS_SELFTEST_FAILED);
++        return NULL;
++    }
++#endif
+     return OPENSSL_zalloc(sizeof(EVP_CIPHER_CTX));
+ }
+ 
+@@ -67,6 +82,12 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct
+             enc = 1;
+         ctx->encrypt = enc;
+     }
++#ifdef OPENSSL_FIPS
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_EVP_CIPHERINIT_EX, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++#endif
+ #ifndef OPENSSL_NO_ENGINE
+     /*
+      * Whether it's nice or not, "Inits" can be used on "Final"'d contexts so
+@@ -136,7 +157,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct
+         }
+         ctx->key_len = cipher->key_len;
+         /* Preserve wrap enable flag, zero everything else */
+-        ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
++        ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW | EVP_CIPH_FLAG_NON_FIPS_ALLOW;
+         if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {
+             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {
+                 ctx->cipher = NULL;
+@@ -195,6 +216,18 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct
+             return 0;
+         }
+     }
++#ifdef OPENSSL_FIPS
++    /* After 'key' is set no further parameters changes are permissible.
++     * So only check for non FIPS enabling at this point.
++     */
++    if (key && FIPS_mode()) {
++        if (!(ctx->cipher->flags & EVP_CIPH_FLAG_FIPS)
++            & !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)) {
++            EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_DISABLED_FOR_FIPS);
++            return 0;
++        }
++    }
++#endif
+ 
+     if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
+         if (!ctx->cipher->init(ctx, key, iv, enc))
+diff -up openssl-1.1.1/crypto/evp/evp_err.c.fips openssl-1.1.1/crypto/evp/evp_err.c
+--- openssl-1.1.1/crypto/evp/evp_err.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/evp_err.c	2018-09-13 08:51:22.104521063 +0200
+@@ -20,6 +20,7 @@ static const ERR_STRING_DATA EVP_str_fun
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_OCB_CIPHER, 0), "aes_ocb_cipher"},
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_T4_INIT_KEY, 0), "aes_t4_init_key"},
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_WRAP_CIPHER, 0), "aes_wrap_cipher"},
++    {ERR_PACK(ERR_LIB_EVP, EVP_F_AES_XTS_CIPHER, 0), "aes_xts_cipher"},
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_ALG_MODULE_INIT, 0), "alg_module_init"},
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_CCM_INIT_KEY, 0), "aria_ccm_init_key"},
+     {ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_GCM_CTRL, 0), "aria_gcm_ctrl"},
+@@ -177,6 +178,7 @@ static const ERR_STRING_DATA EVP_str_rea
+     "different key types"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_DIFFERENT_PARAMETERS),
+     "different parameters"},
++    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_DISABLED_FOR_FIPS), "disabled for FIPS"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ERROR_LOADING_SECTION),
+     "error loading section"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ERROR_SETTING_FIPS_MODE),
+@@ -239,6 +241,7 @@ static const ERR_STRING_DATA EVP_str_rea
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PRIVATE_KEY_ENCODE_ERROR),
+     "private key encode error"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"},
++    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_TOO_LARGE), "too large"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_CIPHER), "unknown cipher"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_DIGEST), "unknown digest"},
+     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_UNKNOWN_OPTION), "unknown option"},
+diff -up openssl-1.1.1/crypto/evp/evp_lib.c.fips openssl-1.1.1/crypto/evp/evp_lib.c
+--- openssl-1.1.1/crypto/evp/evp_lib.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/evp_lib.c	2018-09-13 08:51:22.105521040 +0200
+@@ -192,6 +192,9 @@ int EVP_CIPHER_impl_ctx_size(const EVP_C
+ int EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, unsigned int inl)
+ {
++#ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++#endif
+     return ctx->cipher->do_cipher(ctx, out, in, inl);
+ }
+ 
+diff -up openssl-1.1.1/crypto/evp/m_sha1.c.fips openssl-1.1.1/crypto/evp/m_sha1.c
+--- openssl-1.1.1/crypto/evp/m_sha1.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/evp/m_sha1.c	2018-09-13 08:51:22.105521040 +0200
+@@ -95,7 +95,7 @@ static const EVP_MD sha1_md = {
+     NID_sha1,
+     NID_sha1WithRSAEncryption,
+     SHA_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init,
+     update,
+     final,
+@@ -145,7 +145,7 @@ static const EVP_MD sha224_md = {
+     NID_sha224,
+     NID_sha224WithRSAEncryption,
+     SHA224_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init224,
+     update224,
+     final224,
+@@ -164,7 +164,7 @@ static const EVP_MD sha256_md = {
+     NID_sha256,
+     NID_sha256WithRSAEncryption,
+     SHA256_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init256,
+     update256,
+     final256,
+@@ -224,7 +224,7 @@ static const EVP_MD sha512_224_md = {
+     NID_sha512_224,
+     NID_sha512_224WithRSAEncryption,
+     SHA224_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init512_224,
+     update512,
+     final512,
+@@ -243,7 +243,7 @@ static const EVP_MD sha512_256_md = {
+     NID_sha512_256,
+     NID_sha512_256WithRSAEncryption,
+     SHA256_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init512_256,
+     update512,
+     final512,
+@@ -262,7 +262,7 @@ static const EVP_MD sha384_md = {
+     NID_sha384,
+     NID_sha384WithRSAEncryption,
+     SHA384_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init384,
+     update384,
+     final384,
+@@ -281,7 +281,7 @@ static const EVP_MD sha512_md = {
+     NID_sha512,
+     NID_sha512WithRSAEncryption,
+     SHA512_DIGEST_LENGTH,
+-    EVP_MD_FLAG_DIGALGID_ABSENT,
++    EVP_MD_FLAG_DIGALGID_ABSENT | EVP_MD_FLAG_FIPS,
+     init512,
+     update512,
+     final512,
+diff -up openssl-1.1.1/crypto/fips/build.info.fips openssl-1.1.1/crypto/fips/build.info
+--- openssl-1.1.1/crypto/fips/build.info.fips	2018-09-13 08:51:22.105521040 +0200
++++ openssl-1.1.1/crypto/fips/build.info	2018-09-13 08:51:22.105521040 +0200
+@@ -0,0 +1,15 @@
++LIBS=../../libcrypto
++SOURCE[../../libcrypto]=\
++        fips_aes_selftest.c fips_des_selftest.c fips_hmac_selftest.c \
++        fips_rsa_selftest.c fips_sha_selftest.c fips.c fips_dsa_selftest.c \
++        fips_post.c fips_drbg_ctr.c fips_drbg_hash.c fips_drbg_hmac.c \
++        fips_drbg_lib.c fips_drbg_rand.c fips_drbg_selftest.c fips_rand_lib.c \
++        fips_cmac_selftest.c fips_ecdh_selftest.c fips_ecdsa_selftest.c \
++        fips_enc.c fips_md.c fips_dh_selftest.c fips_ers.c
++
++PROGRAMS_NO_INST=\
++          fips_standalone_hmac
++
++SOURCE[fips_standalone_hmac]=fips_standalone_hmac.c
++INCLUDE[fips_standalone_hmac]=../../include
++DEPEND[fips_standalone_hmac]=../../libcrypto
+diff -up openssl-1.1.1/crypto/fips/fips_aes_selftest.c.fips openssl-1.1.1/crypto/fips/fips_aes_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_aes_selftest.c.fips	2018-09-13 08:51:22.105521040 +0200
++++ openssl-1.1.1/crypto/fips/fips_aes_selftest.c	2018-09-13 08:51:22.105521040 +0200
+@@ -0,0 +1,372 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++#endif
++
++#ifdef OPENSSL_FIPS
++static const struct {
++    const unsigned char key[16];
++    const unsigned char plaintext[16];
++    const unsigned char ciphertext[16];
++} tests[] = {
++    {
++        {
++        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++                0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F}, {
++        0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
++                0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}, {
++0x69, 0xC4, 0xE0, 0xD8, 0x6A, 0x7B, 0x04, 0x30,
++                0xD8, 0xCD, 0xB7, 0x80, 0x70, 0xB4, 0xC5, 0x5A},},};
++
++int FIPS_selftest_aes()
++{
++    int n;
++    int ret = 0;
++    EVP_CIPHER_CTX *ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL)
++        goto err;
++
++    for (n = 0; n < 1; ++n) {
++        unsigned char key[16];
++
++        memcpy(key, tests[n].key, sizeof(key));
++        if (fips_cipher_test(ctx, EVP_aes_128_ecb(),
++                             key, NULL,
++                             tests[n].plaintext,
++                             tests[n].ciphertext, 16) <= 0)
++            goto err;
++    }
++    ret = 1;
++ err:
++    EVP_CIPHER_CTX_free(ctx);
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES, FIPS_R_SELFTEST_FAILED);
++    return ret;
++}
++
++/* AES-CCM test data from NIST public test vectors */
++
++static const unsigned char ccm_key[] = {
++    0xce, 0xb0, 0x09, 0xae, 0xa4, 0x45, 0x44, 0x51, 0xfe, 0xad, 0xf0, 0xe6,
++    0xb3, 0x6f, 0x45, 0x55, 0x5d, 0xd0, 0x47, 0x23, 0xba, 0xa4, 0x48, 0xe8
++};
++
++static const unsigned char ccm_nonce[] = {
++    0x76, 0x40, 0x43, 0xc4, 0x94, 0x60, 0xb7
++};
++
++static const unsigned char ccm_adata[] = {
++    0x6e, 0x80, 0xdd, 0x7f, 0x1b, 0xad, 0xf3, 0xa1, 0xc9, 0xab, 0x25, 0xc7,
++    0x5f, 0x10, 0xbd, 0xe7, 0x8c, 0x23, 0xfa, 0x0e, 0xb8, 0xf9, 0xaa, 0xa5,
++    0x3a, 0xde, 0xfb, 0xf4, 0xcb, 0xf7, 0x8f, 0xe4
++};
++
++static const unsigned char ccm_pt[] = {
++    0xc8, 0xd2, 0x75, 0xf9, 0x19, 0xe1, 0x7d, 0x7f, 0xe6, 0x9c, 0x2a, 0x1f,
++    0x58, 0x93, 0x9d, 0xfe, 0x4d, 0x40, 0x37, 0x91, 0xb5, 0xdf, 0x13, 0x10
++};
++
++static const unsigned char ccm_ct[] = {
++    0x8a, 0x0f, 0x3d, 0x82, 0x29, 0xe4, 0x8e, 0x74, 0x87, 0xfd, 0x95, 0xa2,
++    0x8a, 0xd3, 0x92, 0xc8, 0x0b, 0x36, 0x81, 0xd4, 0xfb, 0xc7, 0xbb, 0xfd
++};
++
++static const unsigned char ccm_tag[] = {
++    0x2d, 0xd6, 0xef, 0x1c, 0x45, 0xd4, 0xcc, 0xb7, 0x23, 0xdc, 0x07, 0x44,
++    0x14, 0xdb, 0x50, 0x6d
++};
++
++int FIPS_selftest_aes_ccm(void)
++{
++    int ret = 0;
++    unsigned char out[128], tag[16];
++    EVP_CIPHER_CTX *ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL)
++        goto err;
++
++    memset(out, 0, sizeof(out));
++    if (!EVP_CipherInit_ex(ctx, EVP_aes_192_ccm(), NULL, NULL, NULL, 1))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN,
++                             sizeof(ccm_nonce), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG,
++                             sizeof(ccm_tag), NULL))
++        goto err;
++    if (!EVP_CipherInit_ex(ctx, NULL, NULL, ccm_key, ccm_nonce, 1))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, NULL, sizeof(ccm_pt)) != sizeof(ccm_pt))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, ccm_adata, sizeof(ccm_adata)) < 0)
++        goto err;
++    if (EVP_Cipher(ctx, out, ccm_pt, sizeof(ccm_pt)) != sizeof(ccm_ct))
++        goto err;
++
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_GET_TAG, 16, tag))
++        goto err;
++    if (memcmp(tag, ccm_tag, sizeof(ccm_tag))
++        || memcmp(out, ccm_ct, sizeof(ccm_ct)))
++        goto err;
++
++    memset(out, 0, sizeof(out));
++
++    if (!EVP_CipherInit_ex(ctx, EVP_aes_192_ccm(), NULL, NULL, NULL, 0))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN,
++                             sizeof(ccm_nonce), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, 16, tag))
++        goto err;
++    if (!EVP_CipherInit_ex(ctx, NULL, NULL, ccm_key, ccm_nonce, 0))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, NULL, sizeof(ccm_ct)) != sizeof(ccm_ct))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, ccm_adata, sizeof(ccm_adata)) < 0)
++        goto err;
++    if (EVP_Cipher(ctx, out, ccm_ct, sizeof(ccm_ct)) != sizeof(ccm_pt))
++        goto err;
++
++    if (memcmp(out, ccm_pt, sizeof(ccm_pt)))
++        goto err;
++
++    ret = 1;
++
++ err:
++    EVP_CIPHER_CTX_free(ctx);
++
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_CCM, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    } else
++        return ret;
++
++}
++
++/* AES-GCM test data from NIST public test vectors */
++
++static const unsigned char gcm_key[] = {
++    0xee, 0xbc, 0x1f, 0x57, 0x48, 0x7f, 0x51, 0x92, 0x1c, 0x04, 0x65, 0x66,
++    0x5f, 0x8a, 0xe6, 0xd1, 0x65, 0x8b, 0xb2, 0x6d, 0xe6, 0xf8, 0xa0, 0x69,
++    0xa3, 0x52, 0x02, 0x93, 0xa5, 0x72, 0x07, 0x8f
++};
++
++static const unsigned char gcm_iv[] = {
++    0x99, 0xaa, 0x3e, 0x68, 0xed, 0x81, 0x73, 0xa0, 0xee, 0xd0, 0x66, 0x84
++};
++
++static const unsigned char gcm_pt[] = {
++    0xf5, 0x6e, 0x87, 0x05, 0x5b, 0xc3, 0x2d, 0x0e, 0xeb, 0x31, 0xb2, 0xea,
++    0xcc, 0x2b, 0xf2, 0xa5
++};
++
++static const unsigned char gcm_aad[] = {
++    0x4d, 0x23, 0xc3, 0xce, 0xc3, 0x34, 0xb4, 0x9b, 0xdb, 0x37, 0x0c, 0x43,
++    0x7f, 0xec, 0x78, 0xde
++};
++
++static const unsigned char gcm_ct[] = {
++    0xf7, 0x26, 0x44, 0x13, 0xa8, 0x4c, 0x0e, 0x7c, 0xd5, 0x36, 0x86, 0x7e,
++    0xb9, 0xf2, 0x17, 0x36
++};
++
++static const unsigned char gcm_tag[] = {
++    0x67, 0xba, 0x05, 0x10, 0x26, 0x2a, 0xe4, 0x87, 0xd7, 0x37, 0xee, 0x62,
++    0x98, 0xf7, 0x7e, 0x0c
++};
++
++int FIPS_selftest_aes_gcm(void)
++{
++    int ret = 0;
++    unsigned char out[128], tag[16];
++    EVP_CIPHER_CTX *ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL)
++        goto err;
++
++    memset(out, 0, sizeof(out));
++    memset(tag, 0, sizeof(tag));
++    if (!EVP_CipherInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL, 1))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN,
++                             sizeof(gcm_iv), NULL))
++        goto err;
++    if (!EVP_CipherInit_ex(ctx, NULL, NULL, gcm_key, gcm_iv, 1))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, gcm_aad, sizeof(gcm_aad)) < 0)
++        goto err;
++    if (EVP_Cipher(ctx, out, gcm_pt, sizeof(gcm_pt)) != sizeof(gcm_ct))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, NULL, 0) < 0)
++        goto err;
++
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, tag))
++        goto err;
++
++    if (memcmp(tag, gcm_tag, 16) || memcmp(out, gcm_ct, 16))
++        goto err;
++
++    memset(out, 0, sizeof(out));
++
++    if (!EVP_CipherInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL, 0))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN,
++                             sizeof(gcm_iv), NULL))
++        goto err;
++    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, tag))
++        goto err;
++    if (!EVP_CipherInit_ex(ctx, NULL, NULL, gcm_key, gcm_iv, 0))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, gcm_aad, sizeof(gcm_aad)) < 0)
++        goto err;
++    if (EVP_Cipher(ctx, out, gcm_ct, sizeof(gcm_ct)) != sizeof(gcm_pt))
++        goto err;
++    if (EVP_Cipher(ctx, NULL, NULL, 0) < 0)
++        goto err;
++
++    if (memcmp(out, gcm_pt, 16))
++        goto err;
++
++    ret = 1;
++
++ err:
++    EVP_CIPHER_CTX_free(ctx);
++
++    if (ret == 0) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_GCM, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    } else
++        return ret;
++
++}
++
++static const unsigned char XTS_128_key[] = {
++    0xa1, 0xb9, 0x0c, 0xba, 0x3f, 0x06, 0xac, 0x35, 0x3b, 0x2c, 0x34, 0x38,
++    0x76, 0x08, 0x17, 0x62, 0x09, 0x09, 0x23, 0x02, 0x6e, 0x91, 0x77, 0x18,
++    0x15, 0xf2, 0x9d, 0xab, 0x01, 0x93, 0x2f, 0x2f
++};
++
++static const unsigned char XTS_128_i[] = {
++    0x4f, 0xae, 0xf7, 0x11, 0x7c, 0xda, 0x59, 0xc6, 0x6e, 0x4b, 0x92, 0x01,
++    0x3e, 0x76, 0x8a, 0xd5
++};
++
++static const unsigned char XTS_128_pt[] = {
++    0xeb, 0xab, 0xce, 0x95, 0xb1, 0x4d, 0x3c, 0x8d, 0x6f, 0xb3, 0x50, 0x39,
++    0x07, 0x90, 0x31, 0x1c
++};
++
++static const unsigned char XTS_128_ct[] = {
++    0x77, 0x8a, 0xe8, 0xb4, 0x3c, 0xb9, 0x8d, 0x5a, 0x82, 0x50, 0x81, 0xd5,
++    0xbe, 0x47, 0x1c, 0x63
++};
++
++static const unsigned char XTS_256_key[] = {
++    0x1e, 0xa6, 0x61, 0xc5, 0x8d, 0x94, 0x3a, 0x0e, 0x48, 0x01, 0xe4, 0x2f,
++    0x4b, 0x09, 0x47, 0x14, 0x9e, 0x7f, 0x9f, 0x8e, 0x3e, 0x68, 0xd0, 0xc7,
++    0x50, 0x52, 0x10, 0xbd, 0x31, 0x1a, 0x0e, 0x7c, 0xd6, 0xe1, 0x3f, 0xfd,
++    0xf2, 0x41, 0x8d, 0x8d, 0x19, 0x11, 0xc0, 0x04, 0xcd, 0xa5, 0x8d, 0xa3,
++    0xd6, 0x19, 0xb7, 0xe2, 0xb9, 0x14, 0x1e, 0x58, 0x31, 0x8e, 0xea, 0x39,
++    0x2c, 0xf4, 0x1b, 0x08
++};
++
++static const unsigned char XTS_256_i[] = {
++    0xad, 0xf8, 0xd9, 0x26, 0x27, 0x46, 0x4a, 0xd2, 0xf0, 0x42, 0x8e, 0x84,
++    0xa9, 0xf8, 0x75, 0x64
++};
++
++static const unsigned char XTS_256_pt[] = {
++    0x2e, 0xed, 0xea, 0x52, 0xcd, 0x82, 0x15, 0xe1, 0xac, 0xc6, 0x47, 0xe8,
++    0x10, 0xbb, 0xc3, 0x64, 0x2e, 0x87, 0x28, 0x7f, 0x8d, 0x2e, 0x57, 0xe3,
++    0x6c, 0x0a, 0x24, 0xfb, 0xc1, 0x2a, 0x20, 0x2e
++};
++
++static const unsigned char XTS_256_ct[] = {
++    0xcb, 0xaa, 0xd0, 0xe2, 0xf6, 0xce, 0xa3, 0xf5, 0x0b, 0x37, 0xf9, 0x34,
++    0xd4, 0x6a, 0x9b, 0x13, 0x0b, 0x9d, 0x54, 0xf0, 0x7e, 0x34, 0xf3, 0x6a,
++    0xf7, 0x93, 0xe8, 0x6f, 0x73, 0xc6, 0xd7, 0xdb
++};
++
++int FIPS_selftest_aes_xts()
++{
++    int ret = 1;
++    EVP_CIPHER_CTX *ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL)
++        goto err;
++
++    if (fips_cipher_test(ctx, EVP_aes_128_xts(),
++                         XTS_128_key, XTS_128_i, XTS_128_pt, XTS_128_ct,
++                         sizeof(XTS_128_pt)) <= 0)
++        ret = 0;
++
++    if (fips_cipher_test(ctx, EVP_aes_256_xts(),
++                         XTS_256_key, XTS_256_i, XTS_256_pt, XTS_256_ct,
++                         sizeof(XTS_256_pt)) <= 0)
++        ret = 0;
++
++    EVP_CIPHER_CTX_free(ctx);
++
++ err:
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_AES_XTS, FIPS_R_SELFTEST_FAILED);
++    return ret;
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips.c.fips openssl-1.1.1/crypto/fips/fips.c
+--- openssl-1.1.1/crypto/fips/fips.c.fips	2018-09-13 08:51:22.105521040 +0200
++++ openssl-1.1.1/crypto/fips/fips.c	2018-09-13 08:51:22.105521040 +0200
+@@ -0,0 +1,526 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define _GNU_SOURCE
++
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include <openssl/err.h>
++#include <openssl/bio.h>
++#include <openssl/hmac.h>
++#include <openssl/rsa.h>
++#include <string.h>
++#include <limits.h>
++#include <dlfcn.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <errno.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++# include <openssl/fips.h>
++# include "internal/thread_once.h"
++
++# ifndef PATH_MAX
++#  define PATH_MAX 1024
++# endif
++
++static int fips_selftest_fail = 0;
++static int fips_mode = 0;
++static int fips_started = 0;
++
++static int fips_is_owning_thread(void);
++static int fips_set_owning_thread(void);
++static int fips_clear_owning_thread(void);
++
++static CRYPTO_RWLOCK *fips_lock = NULL;
++static CRYPTO_RWLOCK *fips_owning_lock = NULL;
++static CRYPTO_ONCE fips_lock_init = CRYPTO_ONCE_STATIC_INIT;
++
++DEFINE_RUN_ONCE_STATIC(do_fips_lock_init)
++{
++    fips_lock = CRYPTO_THREAD_lock_new();
++    fips_owning_lock = CRYPTO_THREAD_lock_new();
++    return fips_lock != NULL && fips_owning_lock != NULL;
++}
++
++# define fips_w_lock()   CRYPTO_THREAD_write_lock(fips_lock)
++# define fips_w_unlock() CRYPTO_THREAD_unlock(fips_lock)
++# define fips_r_lock()   CRYPTO_THREAD_read_lock(fips_lock)
++# define fips_r_unlock() CRYPTO_THREAD_unlock(fips_lock)
++
++static void fips_set_mode(int onoff)
++{
++    int owning_thread = fips_is_owning_thread();
++
++    if (fips_started) {
++        if (!owning_thread)
++            fips_w_lock();
++        fips_mode = onoff;
++        if (!owning_thread)
++            fips_w_unlock();
++    }
++}
++
++int FIPS_module_mode(void)
++{
++    int ret = 0;
++    int owning_thread = fips_is_owning_thread();
++
++    if (fips_started) {
++        if (!owning_thread)
++            fips_r_lock();
++        ret = fips_mode;
++        if (!owning_thread)
++            fips_r_unlock();
++    }
++    return ret;
++}
++
++/* just a compat symbol - return NULL */
++int FIPS_selftest_failed(void)
++{
++    int ret = 0;
++    if (fips_started) {
++        int owning_thread = fips_is_owning_thread();
++
++        if (!owning_thread)
++            fips_r_lock();
++        ret = fips_selftest_fail;
++        if (!owning_thread)
++            fips_r_unlock();
++    }
++    return ret;
++}
++
++/* Selftest failure fatal exit routine. This will be called
++ * during *any* cryptographic operation. It has the minimum
++ * overhead possible to avoid too big a performance hit.
++ */
++
++void FIPS_selftest_check(void)
++{
++    if (fips_selftest_fail) {
++        OpenSSLDie(__FILE__, __LINE__, "FATAL FIPS SELFTEST FAILURE");
++    }
++}
++
++void fips_set_selftest_fail(void)
++{
++    fips_selftest_fail = 1;
++}
++
++/* we implement what libfipscheck does ourselves */
++
++static int
++get_library_path(const char *libname, const char *symbolname, char *path,
++                 size_t pathlen)
++{
++    Dl_info info;
++    void *dl, *sym;
++    int rv = -1;
++
++    dl = dlopen(libname, RTLD_LAZY);
++    if (dl == NULL) {
++        return -1;
++    }
++
++    sym = dlsym(dl, symbolname);
++
++    if (sym != NULL && dladdr(sym, &info)) {
++        strncpy(path, info.dli_fname, pathlen - 1);
++        path[pathlen - 1] = '\0';
++        rv = 0;
++    }
++
++    dlclose(dl);
++
++    return rv;
++}
++
++static const char conv[] = "0123456789abcdef";
++
++static char *bin2hex(void *buf, size_t len)
++{
++    char *hex, *p;
++    unsigned char *src = buf;
++
++    hex = malloc(len * 2 + 1);
++    if (hex == NULL)
++        return NULL;
++
++    p = hex;
++
++    while (len > 0) {
++        unsigned c;
++
++        c = *src;
++        src++;
++
++        *p = conv[c >> 4];
++        ++p;
++        *p = conv[c & 0x0f];
++        ++p;
++        --len;
++    }
++    *p = '\0';
++    return hex;
++}
++
++# define HMAC_PREFIX "."
++# ifndef HMAC_SUFFIX
++#  define HMAC_SUFFIX ".hmac"
++# endif
++# define READ_BUFFER_LENGTH 16384
++
++static char *make_hmac_path(const char *origpath)
++{
++    char *path, *p;
++    const char *fn;
++
++    path =
++        malloc(sizeof(HMAC_PREFIX) + sizeof(HMAC_SUFFIX) + strlen(origpath));
++    if (path == NULL) {
++        return NULL;
++    }
++
++    fn = strrchr(origpath, '/');
++    if (fn == NULL) {
++        fn = origpath;
++    } else {
++        ++fn;
++    }
++
++    strncpy(path, origpath, fn - origpath);
++    p = path + (fn - origpath);
++    p = stpcpy(p, HMAC_PREFIX);
++    p = stpcpy(p, fn);
++    p = stpcpy(p, HMAC_SUFFIX);
++
++    return path;
++}
++
++static const char hmackey[] = "orboDeJITITejsirpADONivirpUkvarP";
++
++static int compute_file_hmac(const char *path, void **buf, size_t *hmaclen)
++{
++    FILE *f = NULL;
++    int rv = -1;
++    unsigned char rbuf[READ_BUFFER_LENGTH];
++    size_t len;
++    unsigned int hlen;
++    HMAC_CTX *c;
++
++    c = HMAC_CTX_new();
++    if (c == NULL)
++        return rv;
++
++    f = fopen(path, "r");
++
++    if (f == NULL) {
++        goto end;
++    }
++
++    if (HMAC_Init_ex(c, hmackey, sizeof(hmackey) - 1, EVP_sha256(), NULL) <= 0) {
++        goto end;
++    }
++
++    while ((len = fread(rbuf, 1, sizeof(rbuf), f)) != 0) {
++        if (HMAC_Update(c, rbuf, len) <= 0) {
++            goto end;
++        }
++    }
++
++    len = sizeof(rbuf);
++    /* reuse rbuf for hmac */
++    if (HMAC_Final(c, rbuf, &hlen) <= 0) {
++        goto end;
++    }
++
++    *buf = malloc(hlen);
++    if (*buf == NULL) {
++        goto end;
++    }
++
++    *hmaclen = hlen;
++
++    memcpy(*buf, rbuf, hlen);
++
++    rv = 0;
++ end:
++    HMAC_CTX_free(c);
++
++    if (f)
++        fclose(f);
++
++    return rv;
++}
++
++static int FIPSCHECK_verify(const char *path)
++{
++    int rv = 0;
++    FILE *hf;
++    char *hmacpath, *p;
++    char *hmac = NULL;
++    size_t n;
++
++    hmacpath = make_hmac_path(path);
++    if (hmacpath == NULL)
++        return 0;
++
++    hf = fopen(hmacpath, "r");
++    if (hf == NULL) {
++        free(hmacpath);
++        return 0;
++    }
++
++    if (getline(&hmac, &n, hf) > 0) {
++        void *buf;
++        size_t hmaclen;
++        char *hex;
++
++        if ((p = strchr(hmac, '\n')) != NULL)
++            *p = '\0';
++
++        if (compute_file_hmac(path, &buf, &hmaclen) < 0) {
++            rv = -4;
++            goto end;
++        }
++
++        if ((hex = bin2hex(buf, hmaclen)) == NULL) {
++            free(buf);
++            rv = -5;
++            goto end;
++        }
++
++        if (strcmp(hex, hmac) != 0) {
++            rv = -1;
++        }
++        free(buf);
++        free(hex);
++    } else {
++        rv = -1;
++    }
++
++ end:
++    free(hmac);
++    free(hmacpath);
++    fclose(hf);
++
++    if (rv < 0)
++        return 0;
++
++    /* check successful */
++    return 1;
++}
++
++static int verify_checksums(void)
++{
++    int rv;
++    char path[PATH_MAX + 1];
++    char *p;
++
++    /* we need to avoid dlopening libssl, assume both libcrypto and libssl
++       are in the same directory */
++
++    rv = get_library_path("libcrypto.so." SHLIB_VERSION_NUMBER,
++                          "FIPS_mode_set", path, sizeof(path));
++    if (rv < 0)
++        return 0;
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++
++    /* replace libcrypto with libssl */
++    while ((p = strstr(path, "libcrypto.so")) != NULL) {
++        p = stpcpy(p, "libssl");
++        memmove(p, p + 3, strlen(p + 2));
++    }
++
++    rv = FIPSCHECK_verify(path);
++    if (!rv)
++        return 0;
++    return 1;
++}
++
++# ifndef FIPS_MODULE_PATH
++#  define FIPS_MODULE_PATH "/etc/system-fips"
++# endif
++
++int FIPS_module_installed(void)
++{
++    int rv;
++    rv = access(FIPS_MODULE_PATH, F_OK);
++    if (rv < 0 && errno != ENOENT)
++        rv = 0;
++
++    /* Installed == true */
++    return !rv;
++}
++
++int FIPS_module_mode_set(int onoff)
++{
++    int ret = 0;
++
++    if (!RUN_ONCE(&fips_lock_init, do_fips_lock_init))
++        return 0;
++
++    fips_w_lock();
++    fips_started = 1;
++    fips_set_owning_thread();
++
++    if (onoff) {
++
++        fips_selftest_fail = 0;
++
++        /* Don't go into FIPS mode twice, just so we can do automagic
++           seeding */
++        if (FIPS_module_mode()) {
++            FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++                    FIPS_R_FIPS_MODE_ALREADY_SET);
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++# ifdef OPENSSL_IA32_SSE2
++        {
++            extern unsigned int OPENSSL_ia32cap_P[2];
++            if ((OPENSSL_ia32cap_P[0] & (1 << 25 | 1 << 26)) !=
++                (1 << 25 | 1 << 26)) {
++                FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++                        FIPS_R_UNSUPPORTED_PLATFORM);
++                fips_selftest_fail = 1;
++                ret = 0;
++                goto end;
++            }
++        }
++# endif
++
++        if (!FIPS_selftest()) {
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++
++        if (!verify_checksums()) {
++            FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,
++                    FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
++            fips_selftest_fail = 1;
++            ret = 0;
++            goto end;
++        }
++
++        fips_set_mode(onoff);
++        ret = 1;
++        goto end;
++    }
++    fips_set_mode(0);
++    fips_selftest_fail = 0;
++    ret = 1;
++ end:
++    fips_clear_owning_thread();
++    fips_w_unlock();
++    return ret;
++}
++
++static CRYPTO_THREAD_ID fips_threadid;
++static int fips_thread_set = 0;
++
++static int fips_is_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_THREAD_read_lock(fips_owning_lock);
++        if (fips_thread_set) {
++            CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id();
++            if (CRYPTO_THREAD_compare_id(fips_threadid, cur))
++                ret = 1;
++        }
++        CRYPTO_THREAD_unlock(fips_owning_lock);
++    }
++    return ret;
++}
++
++int fips_set_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_THREAD_write_lock(fips_owning_lock);
++        if (!fips_thread_set) {
++            fips_threadid = CRYPTO_THREAD_get_current_id();
++            ret = 1;
++            fips_thread_set = 1;
++        }
++        CRYPTO_THREAD_unlock(fips_owning_lock);
++    }
++    return ret;
++}
++
++int fips_clear_owning_thread(void)
++{
++    int ret = 0;
++
++    if (fips_started) {
++        CRYPTO_THREAD_write_lock(fips_owning_lock);
++        if (fips_thread_set) {
++            CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id();
++            if (CRYPTO_THREAD_compare_id(fips_threadid, cur))
++                fips_thread_set = 0;
++        }
++        CRYPTO_THREAD_unlock(fips_owning_lock);
++    }
++    return ret;
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_cmac_selftest.c.fips openssl-1.1.1/crypto/fips/fips_cmac_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_cmac_selftest.c.fips	2018-09-13 08:51:22.105521040 +0200
++++ openssl-1.1.1/crypto/fips/fips_cmac_selftest.c	2018-09-13 08:51:22.105521040 +0200
+@@ -0,0 +1,156 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/cmac.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++typedef struct {
++    int nid;
++    const unsigned char key[EVP_MAX_KEY_LENGTH];
++    size_t keysize;
++    const unsigned char msg[64];
++    size_t msgsize;
++    const unsigned char mac[32];
++    size_t macsize;
++} CMAC_KAT;
++
++/* from http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf */
++static const CMAC_KAT vector[] = {
++    {NID_aes_128_cbc,           /* Count = 32 from CMACGenAES128.txt */
++     {0x77, 0xa7, 0x7f, 0xaf, 0x29, 0x0c, 0x1f, 0xa3,
++      0x0c, 0x68, 0x3d, 0xf1, 0x6b, 0xa7, 0xa7, 0x7b,}, 128,
++     {0x02, 0x06, 0x83, 0xe1, 0xf0, 0x39, 0x2f, 0x4c,
++      0xac, 0x54, 0x31, 0x8b, 0x60, 0x29, 0x25, 0x9e,
++      0x9c, 0x55, 0x3d, 0xbc, 0x4b, 0x6a, 0xd9, 0x98,
++      0xe6, 0x4d, 0x58, 0xe4, 0xe7, 0xdc, 0x2e, 0x13,}, 256,
++     {0xfb, 0xfe, 0xa4, 0x1b,}, 32},
++    {NID_aes_192_cbc,           /* Count = 23 from CMACGenAES192.txt */
++     {0x7b, 0x32, 0x39, 0x13, 0x69, 0xaa, 0x4c, 0xa9,
++      0x75, 0x58, 0x09, 0x5b, 0xe3, 0xc3, 0xec, 0x86,
++      0x2b, 0xd0, 0x57, 0xce, 0xf1, 0xe3, 0x2d, 0x62,}, 192,
++     {0x0}, 0,
++     {0xe4, 0xd9, 0x34, 0x0b, 0x03, 0xe6, 0x7d, 0xef,
++      0xd4, 0x96, 0x9c, 0xc1, 0xed, 0x37, 0x35, 0xe6,}, 128,
++     },
++    {NID_aes_256_cbc,           /* Count = 33 from CMACGenAES256.txt */
++     {0x0b, 0x12, 0x2a, 0xc8, 0xf3, 0x4e, 0xd1, 0xfe,
++      0x08, 0x2a, 0x36, 0x25, 0xd1, 0x57, 0x56, 0x14,
++      0x54, 0x16, 0x7a, 0xc1, 0x45, 0xa1, 0x0b, 0xbf,
++      0x77, 0xc6, 0xa7, 0x05, 0x96, 0xd5, 0x74, 0xf1,}, 256,
++     {0x49, 0x8b, 0x53, 0xfd, 0xec, 0x87, 0xed, 0xcb,
++      0xf0, 0x70, 0x97, 0xdc, 0xcd, 0xe9, 0x3a, 0x08,
++      0x4b, 0xad, 0x75, 0x01, 0xa2, 0x24, 0xe3, 0x88,
++      0xdf, 0x34, 0x9c, 0xe1, 0x89, 0x59, 0xfe, 0x84,
++      0x85, 0xf8, 0xad, 0x15, 0x37, 0xf0, 0xd8, 0x96,
++      0xea, 0x73, 0xbe, 0xdc, 0x72, 0x14, 0x71, 0x3f,}, 384,
++     {0xf6, 0x2c, 0x46, 0x32, 0x9b,}, 40,
++     },
++    {NID_des_ede3_cbc,          /* Count = 41 from CMACGenTDES3.req */
++     {0x89, 0xbc, 0xd9, 0x52, 0xa8, 0xc8, 0xab, 0x37,
++      0x1a, 0xf4, 0x8a, 0xc7, 0xd0, 0x70, 0x85, 0xd5,
++      0xef, 0xf7, 0x02, 0xe6, 0xd6, 0x2c, 0xdc, 0x23,}, 192,
++     {0xfa, 0x62, 0x0c, 0x1b, 0xbe, 0x97, 0x31, 0x9e,
++      0x9a, 0x0c, 0xf0, 0x49, 0x21, 0x21, 0xf7, 0xa2,
++      0x0e, 0xb0, 0x8a, 0x6a, 0x70, 0x9d, 0xcb, 0xd0,
++      0x0a, 0xaf, 0x38, 0xe4, 0xf9, 0x9e, 0x75, 0x4e,}, 256,
++     {0x8f, 0x49, 0xa1, 0xb7, 0xd6, 0xaa, 0x22, 0x58,}, 64,
++     },
++};
++
++int FIPS_selftest_cmac()
++{
++    size_t n, outlen;
++    unsigned char out[32];
++    const EVP_CIPHER *cipher;
++    CMAC_CTX *ctx = CMAC_CTX_new();
++    const CMAC_KAT *t;
++    int rv = 1;
++
++    for (n = 0, t = vector; n < sizeof(vector) / sizeof(vector[0]); n++, t++) {
++        cipher = FIPS_get_cipherbynid(t->nid);
++        if (!cipher) {
++            rv = -1;
++            goto err;
++        }
++        if (!CMAC_Init(ctx, t->key, t->keysize / 8, cipher, 0)) {
++            rv = -1;
++            goto err;
++        }
++        if (!CMAC_Update(ctx, t->msg, t->msgsize / 8)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!CMAC_Final(ctx, out, &outlen)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (outlen < t->macsize / 8 || memcmp(out, t->mac, t->macsize / 8)) {
++            rv = 0;
++        }
++    }
++
++ err:
++    CMAC_CTX_free(ctx);
++
++    if (rv == -1) {
++        rv = 0;
++    }
++    if (!rv)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_CMAC, FIPS_R_SELFTEST_FAILED);
++
++    return rv;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_des_selftest.c.fips openssl-1.1.1/crypto/fips/fips_des_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_des_selftest.c.fips	2018-09-13 08:51:22.106521016 +0200
++++ openssl-1.1.1/crypto/fips/fips_des_selftest.c	2018-09-13 08:51:22.106521016 +0200
+@@ -0,0 +1,133 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++#endif
++#include <openssl/opensslconf.h>
++
++#ifdef OPENSSL_FIPS
++
++static const struct {
++    const unsigned char key[16];
++    const unsigned char plaintext[8];
++    const unsigned char ciphertext[8];
++} tests2[] = {
++    {
++        {
++        0x7c, 0x4f, 0x6e, 0xf7, 0xa2, 0x04, 0x16, 0xec,
++                0x0b, 0x6b, 0x7c, 0x9e, 0x5e, 0x19, 0xa7, 0xc4}, {
++        0x06, 0xa7, 0xd8, 0x79, 0xaa, 0xce, 0x69, 0xef}, {
++        0x4c, 0x11, 0x17, 0x55, 0xbf, 0xc4, 0x4e, 0xfd}
++    }, {
++        {
++        0x5d, 0x9e, 0x01, 0xd3, 0x25, 0xc7, 0x3e, 0x34,
++                0x01, 0x16, 0x7c, 0x85, 0x23, 0xdf, 0xe0, 0x68}, {
++        0x9c, 0x50, 0x09, 0x0f, 0x5e, 0x7d, 0x69, 0x7e}, {
++    0xd2, 0x0b, 0x18, 0xdf, 0xd9, 0x0d, 0x9e, 0xff},}
++};
++
++static const struct {
++    const unsigned char key[24];
++    const unsigned char plaintext[8];
++    const unsigned char ciphertext[8];
++} tests3[] = {
++    {
++        {
++        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++                0xFE, 0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10,
++                0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0}, {
++        0x8f, 0x8f, 0xbf, 0x9b, 0x5d, 0x48, 0xb4, 0x1c}, {
++    0x59, 0x8c, 0xe5, 0xd3, 0x6c, 0xa2, 0xea, 0x1b},}, {
++        {
++        0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10, 0xFE,
++                0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF,
++                0xED, 0x39, 0xD9, 0x50, 0xFA, 0x74, 0xBC, 0xC4}, {
++        0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF}, {
++0x11, 0x25, 0xb0, 0x35, 0xbe, 0xa0, 0x82, 0x86},},};
++
++int FIPS_selftest_des()
++{
++    int n, ret = 0;
++    EVP_CIPHER_CTX *ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL)
++        goto err;
++
++    /* Encrypt/decrypt with 2-key 3DES and compare to known answers */
++    for (n = 0; n < 2; ++n) {
++        unsigned char plaintext[8];
++
++        memcpy(plaintext, tests2[n].plaintext, sizeof(plaintext));
++        if (!fips_cipher_test(ctx, EVP_des_ede_ecb(),
++                              tests2[n].key, NULL,
++                              plaintext, tests2[n].ciphertext, 8))
++            goto err;
++    }
++
++    /* Encrypt/decrypt with 3DES and compare to known answers */
++    for (n = 0; n < 2; ++n) {
++        if (!fips_cipher_test(ctx, EVP_des_ede3_ecb(),
++                              tests3[n].key, NULL,
++                              tests3[n].plaintext, tests3[n].ciphertext, 8))
++            goto err;
++    }
++    ret = 1;
++ err:
++    EVP_CIPHER_CTX_free(ctx);
++    if (ret == 0)
++        FIPSerr(FIPS_F_FIPS_SELFTEST_DES, FIPS_R_SELFTEST_FAILED);
++
++    return ret;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_dh_selftest.c.fips openssl-1.1.1/crypto/fips/fips_dh_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_dh_selftest.c.fips	2018-09-13 08:51:22.109520946 +0200
++++ openssl-1.1.1/crypto/fips/fips_dh_selftest.c	2018-09-13 08:51:22.109520946 +0200
+@@ -0,0 +1,180 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ * Copyright (c) 2013 Red Hat, Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/dh.h>
++#include <openssl/fips.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++static const unsigned char dh_test_2048_p[] = {
++    0xAE, 0xEC, 0xEE, 0x22, 0xFA, 0x3A, 0xA5, 0x22, 0xC0, 0xDE, 0x0F, 0x09,
++    0x7E, 0x17, 0xC0, 0x05, 0xF9, 0xF1, 0xE7, 0xC6, 0x87, 0x14, 0x6D, 0x11,
++    0xE7, 0xAE, 0xED, 0x2F, 0x72, 0x59, 0xC5, 0xA9, 0x9B, 0xB8, 0x02, 0xA5,
++    0xF3, 0x69, 0x70, 0xD6, 0xDD, 0x90, 0xF9, 0x19, 0x79, 0xBE, 0x60, 0x8F,
++    0x25, 0x92, 0x30, 0x1C, 0x51, 0x51, 0x38, 0x26, 0x82, 0x25, 0xE6, 0xFC,
++    0xED, 0x65, 0x96, 0x8F, 0x57, 0xE5, 0x53, 0x8B, 0x38, 0x63, 0xC7, 0xCE,
++    0xBC, 0x1B, 0x4D, 0x18, 0x2A, 0x5B, 0x04, 0x3F, 0x6A, 0x3C, 0x94, 0x39,
++    0xAE, 0x36, 0xD6, 0x5E, 0x0F, 0xA2, 0xCC, 0xD0, 0xD4, 0xD5, 0xC6, 0x1E,
++    0xF6, 0xA0, 0xF5, 0x89, 0x4E, 0xB4, 0x0B, 0xA4, 0xB3, 0x2B, 0x3D, 0xE2,
++    0x4E, 0xE1, 0x49, 0x25, 0x99, 0x5F, 0x32, 0x16, 0x33, 0x32, 0x1B, 0x7A,
++    0xA5, 0x5C, 0x6B, 0x34, 0x0D, 0x39, 0x99, 0xDC, 0xF0, 0x76, 0xE5, 0x5A,
++    0xD4, 0x71, 0x00, 0xED, 0x5A, 0x73, 0xFB, 0xC8, 0x01, 0xAD, 0x99, 0xCF,
++    0x99, 0x52, 0x7C, 0x9C, 0x64, 0xC6, 0x76, 0x40, 0x57, 0xAF, 0x59, 0xD7,
++    0x38, 0x0B, 0x40, 0xDE, 0x33, 0x0D, 0xB8, 0x76, 0xEC, 0xA9, 0xD8, 0x73,
++    0xF8, 0xEF, 0x26, 0x66, 0x06, 0x27, 0xDD, 0x7C, 0xA4, 0x10, 0x9C, 0xA6,
++    0xAA, 0xF9, 0x53, 0x62, 0x73, 0x1D, 0xBA, 0x1C, 0xF1, 0x67, 0xF4, 0x35,
++    0xED, 0x6F, 0x37, 0x92, 0xE8, 0x4F, 0x6C, 0xBA, 0x52, 0x6E, 0xA1, 0xED,
++    0xDA, 0x9F, 0x85, 0x11, 0x82, 0x52, 0x62, 0x08, 0x44, 0xF1, 0x30, 0x03,
++    0xC3, 0x38, 0x2C, 0x79, 0xBD, 0xD4, 0x43, 0x45, 0xEE, 0x8E, 0x50, 0xFC,
++    0x29, 0x46, 0x9A, 0xFE, 0x54, 0x1A, 0x19, 0x8F, 0x4B, 0x84, 0x08, 0xDE,
++    0x20, 0x62, 0x73, 0xCC, 0xDD, 0x7E, 0xF0, 0xEF, 0xA2, 0xFD, 0x86, 0x58,
++    0x4B, 0xD8, 0x37, 0xEB
++};
++
++static const unsigned char dh_test_2048_g[] = {
++    0x02
++};
++
++static const unsigned char dh_test_2048_pub_key[] = {
++    0xA0, 0x39, 0x11, 0x77, 0x9A, 0xC1, 0x30, 0x1F, 0xBE, 0x48, 0xA7, 0xAA,
++    0xA0, 0x84, 0x54, 0x64, 0xAD, 0x1B, 0x70, 0xFA, 0x13, 0x55, 0x63, 0xD2,
++    0x1F, 0x62, 0x32, 0x93, 0x8E, 0xC9, 0x3E, 0x09, 0xA7, 0x64, 0xE4, 0x12,
++    0x6E, 0x1B, 0xF2, 0x92, 0x3B, 0xB9, 0xCB, 0x56, 0xEA, 0x07, 0x88, 0xB5,
++    0xA6, 0xBC, 0x16, 0x1F, 0x27, 0xFE, 0xD8, 0xAA, 0x40, 0xB2, 0xB0, 0x2D,
++    0x37, 0x76, 0xA6, 0xA4, 0x82, 0x2C, 0x0E, 0x22, 0x64, 0x9D, 0xCB, 0xD1,
++    0x00, 0xB7, 0x89, 0x14, 0x72, 0x4E, 0xBE, 0x48, 0x41, 0xF8, 0xB2, 0x51,
++    0x11, 0x09, 0x4B, 0x22, 0x01, 0x23, 0x39, 0x96, 0xE0, 0x15, 0xD7, 0x9F,
++    0x60, 0xD1, 0xB7, 0xAE, 0xFE, 0x5F, 0xDB, 0xE7, 0x03, 0x17, 0x97, 0xA6,
++    0x16, 0x74, 0xBD, 0x53, 0x81, 0x19, 0xC5, 0x47, 0x5E, 0xCE, 0x8D, 0xED,
++    0x45, 0x5D, 0x3C, 0x00, 0xA0, 0x0A, 0x68, 0x6A, 0xE0, 0x8E, 0x06, 0x46,
++    0x6F, 0xD7, 0xF9, 0xDF, 0x31, 0x7E, 0x77, 0x44, 0x0D, 0x98, 0xE0, 0xCA,
++    0x98, 0x09, 0x52, 0x04, 0x90, 0xEA, 0x6D, 0xF4, 0x30, 0x69, 0x8F, 0xB1,
++    0x9B, 0xC1, 0x43, 0xDB, 0xD5, 0x8D, 0xC8, 0x8E, 0xB6, 0x0B, 0x05, 0xBE,
++    0x0E, 0xC5, 0x99, 0xC8, 0x6E, 0x4E, 0xF3, 0xCB, 0xC3, 0x5E, 0x9B, 0x53,
++    0xF7, 0x06, 0x1C, 0x4F, 0xC7, 0xB8, 0x6E, 0x30, 0x18, 0xCA, 0x9B, 0xB9,
++    0xBC, 0x5F, 0x17, 0x72, 0x29, 0x5A, 0xE5, 0xD9, 0x96, 0xB7, 0x0B, 0xF3,
++    0x2D, 0x8C, 0xF1, 0xE1, 0x0E, 0x0D, 0x74, 0xD5, 0x9D, 0xF0, 0x06, 0xA9,
++    0xB4, 0x95, 0x63, 0x76, 0x46, 0x55, 0x48, 0x82, 0x39, 0x90, 0xEF, 0x56,
++    0x75, 0x34, 0xB8, 0x34, 0xC3, 0x18, 0x6E, 0x1E, 0xAD, 0xE3, 0x48, 0x7E,
++    0x93, 0x2C, 0x23, 0xE7, 0xF8, 0x90, 0x73, 0xB1, 0x77, 0x80, 0x67, 0xA9,
++    0x36, 0x9E, 0xDA, 0xD2
++};
++
++static const unsigned char dh_test_2048_priv_key[] = {
++    0x0C, 0x4B, 0x30, 0x89, 0xD1, 0xB8, 0x62, 0xCB, 0x3C, 0x43, 0x64, 0x91,
++    0xF0, 0x91, 0x54, 0x70, 0xC5, 0x27, 0x96, 0xE3, 0xAC, 0xBE, 0xE8, 0x00,
++    0xEC, 0x55, 0xF6, 0xCC
++};
++
++int FIPS_selftest_dh()
++{
++    DH *dh = NULL;
++    int ret = 0;
++    void *pub_key_bin = NULL;
++    int len;
++    BIGNUM *p = NULL, *g = NULL, *priv_key = NULL, *tmp_pub_key = NULL;
++    const BIGNUM *pub_key;
++
++    fips_load_key_component(p, dh_test_2048);
++    fips_load_key_component(g, dh_test_2048);
++    /* note that the private key is much shorter than normally used
++     * but still g ** priv_key > p
++     */
++    fips_load_key_component(priv_key, dh_test_2048);
++    if ((tmp_pub_key = BN_new()) == NULL)
++        goto err;
++
++    dh = DH_new();
++
++    if (dh == NULL)
++        goto err;
++
++    DH_set0_pqg(dh, p, NULL, g);
++    DH_set0_key(dh, tmp_pub_key, priv_key);
++
++    if (DH_generate_key(dh) <= 0)
++        goto err;
++
++    DH_get0_key(dh, &pub_key, NULL);
++
++    if (pub_key == NULL)
++        goto err;
++
++    len = BN_num_bytes(pub_key);
++    if ((pub_key_bin = OPENSSL_malloc(len)) == NULL)
++        goto err;
++    BN_bn2bin(pub_key, pub_key_bin);
++
++    if (len != sizeof(dh_test_2048_pub_key) ||
++        memcmp(pub_key_bin, dh_test_2048_pub_key, len) != 0)
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (dh)
++        DH_free(dh);
++    else {
++        BN_free(p);
++        BN_free(g);
++        BN_free(priv_key);
++        BN_free(tmp_pub_key);
++    }
++
++    OPENSSL_free(pub_key_bin);
++    return ret;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_ctr.c.fips openssl-1.1.1/crypto/fips/fips_drbg_ctr.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_ctr.c.fips	2018-09-13 08:51:22.109520946 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_ctr.c	2018-09-13 08:51:22.109520946 +0200
+@@ -0,0 +1,406 @@
++/* fips/rand/fips_drbg_ctr.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++static void inc_128(DRBG_CTR_CTX * cctx)
++{
++    int i;
++    unsigned char c;
++    unsigned char *p = cctx->V + 15;
++    for (i = 0; i < 16; i++) {
++        c = *p;
++        c++;
++        *p = c;
++        if (c)
++            return;
++        p--;
++    }
++}
++
++static void ctr_XOR(DRBG_CTR_CTX * cctx, const unsigned char *in,
++                    size_t inlen)
++{
++    size_t i, n;
++    /* Any zero padding will have no effect on the result as we
++     * are XORing. So just process however much input we have.
++     */
++
++    if (!in || !inlen)
++        return;
++
++    if (inlen < cctx->keylen)
++        n = inlen;
++    else
++        n = cctx->keylen;
++
++    for (i = 0; i < n; i++)
++        cctx->K[i] ^= in[i];
++    if (inlen <= cctx->keylen)
++        return;
++
++    n = inlen - cctx->keylen;
++    /* Should never happen */
++    if (n > 16)
++        n = 16;
++    for (i = 0; i < 16; i++)
++        cctx->V[i] ^= in[i + cctx->keylen];
++}
++
++/* Process a complete block using BCC algorithm of SPP 800-90 10.4.3 */
++
++static void ctr_BCC_block(DRBG_CTR_CTX * cctx, unsigned char *out,
++                          const unsigned char *in)
++{
++    int i;
++    for (i = 0; i < 16; i++)
++        out[i] ^= in[i];
++    AES_encrypt(out, out, &cctx->df_ks);
++#if 0
++    fprintf(stderr, "BCC in+out\n");
++    BIO_dump_fp(stderr, in, 16);
++    BIO_dump_fp(stderr, out, 16);
++#endif
++}
++
++/* Handle several BCC operations for as much data as we need for K and X */
++static void ctr_BCC_blocks(DRBG_CTR_CTX * cctx, const unsigned char *in)
++{
++    ctr_BCC_block(cctx, cctx->KX, in);
++    ctr_BCC_block(cctx, cctx->KX + 16, in);
++    if (cctx->keylen != 16)
++        ctr_BCC_block(cctx, cctx->KX + 32, in);
++}
++
++/* Initialise BCC blocks: these have the value 0,1,2 in leftmost positions:
++ * see 10.4.2 stage 7.
++ */
++static void ctr_BCC_init(DRBG_CTR_CTX * cctx)
++{
++    memset(cctx->KX, 0, 48);
++    memset(cctx->bltmp, 0, 16);
++    ctr_BCC_block(cctx, cctx->KX, cctx->bltmp);
++    cctx->bltmp[3] = 1;
++    ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp);
++    if (cctx->keylen != 16) {
++        cctx->bltmp[3] = 2;
++        ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp);
++    }
++}
++
++/* Process several blocks into BCC algorithm, some possibly partial */
++static void ctr_BCC_update(DRBG_CTR_CTX * cctx,
++                           const unsigned char *in, size_t inlen)
++{
++    if (!in || !inlen)
++        return;
++    /* If we have partial block handle it first */
++    if (cctx->bltmp_pos) {
++        size_t left = 16 - cctx->bltmp_pos;
++        /* If we now have a complete block process it */
++        if (inlen >= left) {
++            memcpy(cctx->bltmp + cctx->bltmp_pos, in, left);
++            ctr_BCC_blocks(cctx, cctx->bltmp);
++            cctx->bltmp_pos = 0;
++            inlen -= left;
++            in += left;
++        }
++    }
++    /* Process zero or more complete blocks */
++    while (inlen >= 16) {
++        ctr_BCC_blocks(cctx, in);
++        in += 16;
++        inlen -= 16;
++    }
++    /* Copy any remaining partial block to the temporary buffer */
++    if (inlen > 0) {
++        memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen);
++        cctx->bltmp_pos += inlen;
++    }
++}
++
++static void ctr_BCC_final(DRBG_CTR_CTX * cctx)
++{
++    if (cctx->bltmp_pos) {
++        memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos);
++        ctr_BCC_blocks(cctx, cctx->bltmp);
++    }
++}
++
++static void ctr_df(DRBG_CTR_CTX * cctx,
++                   const unsigned char *in1, size_t in1len,
++                   const unsigned char *in2, size_t in2len,
++                   const unsigned char *in3, size_t in3len)
++{
++    size_t inlen;
++    unsigned char *p = cctx->bltmp;
++    static unsigned char c80 = 0x80;
++
++    ctr_BCC_init(cctx);
++    if (!in1)
++        in1len = 0;
++    if (!in2)
++        in2len = 0;
++    if (!in3)
++        in3len = 0;
++    inlen = in1len + in2len + in3len;
++    /* Initialise L||N in temporary block */
++    *p++ = (inlen >> 24) & 0xff;
++    *p++ = (inlen >> 16) & 0xff;
++    *p++ = (inlen >> 8) & 0xff;
++    *p++ = inlen & 0xff;
++    /* NB keylen is at most 32 bytes */
++    *p++ = 0;
++    *p++ = 0;
++    *p++ = 0;
++    *p = (unsigned char)((cctx->keylen + 16) & 0xff);
++    cctx->bltmp_pos = 8;
++    ctr_BCC_update(cctx, in1, in1len);
++    ctr_BCC_update(cctx, in2, in2len);
++    ctr_BCC_update(cctx, in3, in3len);
++    ctr_BCC_update(cctx, &c80, 1);
++    ctr_BCC_final(cctx);
++    /* Set up key K */
++    AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks);
++    /* X follows key K */
++    AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks);
++    AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks);
++    if (cctx->keylen != 16)
++        AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks);
++#if 0
++    fprintf(stderr, "Output of ctr_df:\n");
++    BIO_dump_fp(stderr, cctx->KX, cctx->keylen + 16);
++#endif
++}
++
++/* NB the no-df  Update in SP800-90 specifies a constant input length
++ * of seedlen, however other uses of this algorithm pad the input with
++ * zeroes if necessary and have up to two parameters XORed together,
++ * handle both cases in this function instead.
++ */
++
++static void ctr_Update(DRBG_CTX *dctx,
++                       const unsigned char *in1, size_t in1len,
++                       const unsigned char *in2, size_t in2len,
++                       const unsigned char *nonce, size_t noncelen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    /* ks is already setup for correct key */
++    inc_128(cctx);
++    AES_encrypt(cctx->V, cctx->K, &cctx->ks);
++    /* If keylen longer than 128 bits need extra encrypt */
++    if (cctx->keylen != 16) {
++        inc_128(cctx);
++        AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks);
++    }
++    inc_128(cctx);
++    AES_encrypt(cctx->V, cctx->V, &cctx->ks);
++    /* If 192 bit key part of V is on end of K */
++    if (cctx->keylen == 24) {
++        memcpy(cctx->V + 8, cctx->V, 8);
++        memcpy(cctx->V, cctx->K + 24, 8);
++    }
++
++    if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++        /* If no input reuse existing derived value */
++        if (in1 || nonce || in2)
++            ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len);
++        /* If this a reuse input in1len != 0 */
++        if (in1len)
++            ctr_XOR(cctx, cctx->KX, dctx->seedlen);
++    } else {
++        ctr_XOR(cctx, in1, in1len);
++        ctr_XOR(cctx, in2, in2len);
++    }
++
++    AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
++#if 0
++    fprintf(stderr, "K+V after update is:\n");
++    BIO_dump_fp(stderr, cctx->K, cctx->keylen);
++    BIO_dump_fp(stderr, cctx->V, 16);
++#endif
++}
++
++static int drbg_ctr_instantiate(DRBG_CTX *dctx,
++                                const unsigned char *ent, size_t entlen,
++                                const unsigned char *nonce, size_t noncelen,
++                                const unsigned char *pers, size_t perslen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    memset(cctx->K, 0, sizeof(cctx->K));
++    memset(cctx->V, 0, sizeof(cctx->V));
++    AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
++    ctr_Update(dctx, ent, entlen, pers, perslen, nonce, noncelen);
++    return 1;
++}
++
++static int drbg_ctr_reseed(DRBG_CTX *dctx,
++                           const unsigned char *ent, size_t entlen,
++                           const unsigned char *adin, size_t adinlen)
++{
++    ctr_Update(dctx, ent, entlen, adin, adinlen, NULL, 0);
++    return 1;
++}
++
++static int drbg_ctr_generate(DRBG_CTX *dctx,
++                             unsigned char *out, size_t outlen,
++                             const unsigned char *adin, size_t adinlen)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++    if (adin && adinlen) {
++        ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
++        /* This means we reuse derived value */
++        if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++            adin = NULL;
++            adinlen = 1;
++        }
++    } else
++        adinlen = 0;
++
++    for (;;) {
++        inc_128(cctx);
++        if (outlen < 16) {
++            /* Use K as temp space as it will be updated */
++            AES_encrypt(cctx->V, cctx->K, &cctx->ks);
++            memcpy(out, cctx->K, outlen);
++            break;
++        }
++        AES_encrypt(cctx->V, out, &cctx->ks);
++        out += 16;
++        outlen -= 16;
++        if (outlen == 0)
++            break;
++    }
++
++    ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
++
++    return 1;
++
++}
++
++static int drbg_ctr_uninstantiate(DRBG_CTX *dctx)
++{
++    memset(&dctx->d.ctr, 0, sizeof(DRBG_CTR_CTX));
++    return 1;
++}
++
++int fips_drbg_ctr_init(DRBG_CTX *dctx)
++{
++    DRBG_CTR_CTX *cctx = &dctx->d.ctr;
++
++    size_t keylen;
++
++    switch (dctx->type) {
++    case NID_aes_128_ctr:
++        keylen = 16;
++        break;
++
++    case NID_aes_192_ctr:
++        keylen = 24;
++        break;
++
++    case NID_aes_256_ctr:
++        keylen = 32;
++        break;
++
++    default:
++        return -2;
++    }
++
++    dctx->instantiate = drbg_ctr_instantiate;
++    dctx->reseed = drbg_ctr_reseed;
++    dctx->generate = drbg_ctr_generate;
++    dctx->uninstantiate = drbg_ctr_uninstantiate;
++
++    cctx->keylen = keylen;
++    dctx->strength = keylen * 8;
++    dctx->blocklength = 16;
++    dctx->seedlen = keylen + 16;
++
++    if (dctx->xflags & DRBG_FLAG_CTR_USE_DF) {
++        /* df initialisation */
++        static unsigned char df_key[32] = {
++            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++            0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
++            0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
++        };
++        /* Set key schedule for df_key */
++        AES_set_encrypt_key(df_key, dctx->strength, &cctx->df_ks);
++
++        dctx->min_entropy = cctx->keylen;
++        dctx->max_entropy = DRBG_MAX_LENGTH;
++        dctx->min_nonce = dctx->min_entropy / 2;
++        dctx->max_nonce = DRBG_MAX_LENGTH;
++        dctx->max_pers = DRBG_MAX_LENGTH;
++        dctx->max_adin = DRBG_MAX_LENGTH;
++    } else {
++        dctx->min_entropy = dctx->seedlen;
++        dctx->max_entropy = dctx->seedlen;
++        /* Nonce not used */
++        dctx->min_nonce = 0;
++        dctx->max_nonce = 0;
++        dctx->max_pers = dctx->seedlen;
++        dctx->max_adin = dctx->seedlen;
++    }
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_hash.c.fips openssl-1.1.1/crypto/fips/fips_drbg_hash.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_hash.c.fips	2018-09-13 08:51:22.109520946 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_hash.c	2018-09-13 08:51:22.109520946 +0200
+@@ -0,0 +1,354 @@
++/* fips/rand/fips_drbg_hash.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++/* This is Hash_df from SP 800-90 10.4.1 */
++
++static int hash_df(DRBG_CTX *dctx, unsigned char *out,
++                   const unsigned char *in1, size_t in1len,
++                   const unsigned char *in2, size_t in2len,
++                   const unsigned char *in3, size_t in3len,
++                   const unsigned char *in4, size_t in4len)
++{
++    EVP_MD_CTX *mctx = dctx->d.hash.mctx;
++    unsigned char *vtmp = dctx->d.hash.vtmp;
++    unsigned char tmp[6];
++    /* Standard only ever needs seedlen bytes which is always less than
++     * maximum permitted so no need to check length.
++     */
++    size_t outlen = dctx->seedlen;
++    tmp[0] = 1;
++    tmp[1] = ((outlen * 8) >> 24) & 0xff;
++    tmp[2] = ((outlen * 8) >> 16) & 0xff;
++    tmp[3] = ((outlen * 8) >> 8) & 0xff;
++    tmp[4] = (outlen * 8) & 0xff;
++    if (!in1) {
++        tmp[5] = (unsigned char)in1len;
++        in1 = tmp + 5;
++        in1len = 1;
++    }
++    for (;;) {
++        if (!FIPS_digestinit(mctx, dctx->d.hash.md))
++            return 0;
++        if (!FIPS_digestupdate(mctx, tmp, 5))
++            return 0;
++        if (in1 && !FIPS_digestupdate(mctx, in1, in1len))
++            return 0;
++        if (in2 && !FIPS_digestupdate(mctx, in2, in2len))
++            return 0;
++        if (in3 && !FIPS_digestupdate(mctx, in3, in3len))
++            return 0;
++        if (in4 && !FIPS_digestupdate(mctx, in4, in4len))
++            return 0;
++        if (outlen < dctx->blocklength) {
++            if (!FIPS_digestfinal(mctx, vtmp, NULL))
++                return 0;
++            memcpy(out, vtmp, outlen);
++            OPENSSL_cleanse(vtmp, dctx->blocklength);
++            return 1;
++        } else if (!FIPS_digestfinal(mctx, out, NULL))
++            return 0;
++
++        outlen -= dctx->blocklength;
++        if (outlen == 0)
++            return 1;
++        tmp[0]++;
++        out += dctx->blocklength;
++    }
++}
++
++/* Add an unsigned buffer to the buf value, storing the result in buf. For
++ * this algorithm the length of input never exceeds the seed length.
++ */
++
++static void ctx_add_buf(DRBG_CTX *dctx, unsigned char *buf,
++                        unsigned char *in, size_t inlen)
++{
++    size_t i = inlen;
++    const unsigned char *q;
++    unsigned char c, *p;
++    p = buf + dctx->seedlen;
++    q = in + inlen;
++
++    OPENSSL_assert(i <= dctx->seedlen);
++
++    /* Special case: zero length, just increment buffer */
++    if (i)
++        c = 0;
++    else
++        c = 1;
++
++    while (i) {
++        int r;
++        p--;
++        q--;
++        r = *p + *q + c;
++        /* Carry */
++        if (r > 0xff)
++            c = 1;
++        else
++            c = 0;
++        *p = r & 0xff;
++        i--;
++    }
++
++    i = dctx->seedlen - inlen;
++
++    /* If not adding whole buffer handle final carries */
++    if (c && i) {
++        do {
++            p--;
++            c = *p;
++            c++;
++            *p = c;
++            if (c)
++                return;
++        } while (i--);
++    }
++}
++
++/* Finalise and add hash to V */
++
++static int ctx_add_md(DRBG_CTX *dctx)
++{
++    if (!FIPS_digestfinal(dctx->d.hash.mctx, dctx->d.hash.vtmp, NULL))
++        return 0;
++    ctx_add_buf(dctx, dctx->d.hash.V, dctx->d.hash.vtmp, dctx->blocklength);
++    return 1;
++}
++
++static int hash_gen(DRBG_CTX *dctx, unsigned char *out, size_t outlen)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    if (outlen == 0)
++        return 1;
++    memcpy(hctx->vtmp, hctx->V, dctx->seedlen);
++    for (;;) {
++        FIPS_digestinit(hctx->mctx, hctx->md);
++        FIPS_digestupdate(hctx->mctx, hctx->vtmp, dctx->seedlen);
++        if (outlen < dctx->blocklength) {
++            FIPS_digestfinal(hctx->mctx, hctx->vtmp, NULL);
++            memcpy(out, hctx->vtmp, outlen);
++            return 1;
++        } else {
++            FIPS_digestfinal(hctx->mctx, out, NULL);
++            outlen -= dctx->blocklength;
++            if (outlen == 0)
++                return 1;
++            out += dctx->blocklength;
++        }
++        ctx_add_buf(dctx, hctx->vtmp, NULL, 0);
++    }
++}
++
++static int drbg_hash_instantiate(DRBG_CTX *dctx,
++                                 const unsigned char *ent, size_t ent_len,
++                                 const unsigned char *nonce, size_t nonce_len,
++                                 const unsigned char *pstr, size_t pstr_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    if (!hash_df(dctx, hctx->V,
++                 ent, ent_len, nonce, nonce_len, pstr, pstr_len, NULL, 0))
++        return 0;
++    if (!hash_df(dctx, hctx->C,
++                 NULL, 0, hctx->V, dctx->seedlen, NULL, 0, NULL, 0))
++        return 0;
++
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after instantiate:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_reseed(DRBG_CTX *dctx,
++                            const unsigned char *ent, size_t ent_len,
++                            const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    /* V about to be updated so use C as output instead */
++    if (!hash_df(dctx, hctx->C,
++                 NULL, 1, hctx->V, dctx->seedlen,
++                 ent, ent_len, adin, adin_len))
++        return 0;
++    memcpy(hctx->V, hctx->C, dctx->seedlen);
++    if (!hash_df(dctx, hctx->C, NULL, 0,
++                 hctx->V, dctx->seedlen, NULL, 0, NULL, 0))
++        return 0;
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after reseed:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_generate(DRBG_CTX *dctx,
++                              unsigned char *out, size_t outlen,
++                              const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    EVP_MD_CTX *mctx = hctx->mctx;
++    unsigned char tmp[4];
++    if (adin && adin_len) {
++        tmp[0] = 2;
++        if (!FIPS_digestinit(mctx, hctx->md))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, tmp, 1))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, hctx->V, dctx->seedlen))
++            return 0;
++        if (!EVP_DigestUpdate(mctx, adin, adin_len))
++            return 0;
++        if (!ctx_add_md(dctx))
++            return 0;
++    }
++    if (!hash_gen(dctx, out, outlen))
++        return 0;
++
++    tmp[0] = 3;
++    if (!FIPS_digestinit(mctx, hctx->md))
++        return 0;
++    if (!EVP_DigestUpdate(mctx, tmp, 1))
++        return 0;
++    if (!EVP_DigestUpdate(mctx, hctx->V, dctx->seedlen))
++        return 0;
++
++    if (!ctx_add_md(dctx))
++        return 0;
++
++    ctx_add_buf(dctx, hctx->V, hctx->C, dctx->seedlen);
++
++    tmp[0] = (dctx->reseed_counter >> 24) & 0xff;
++    tmp[1] = (dctx->reseed_counter >> 16) & 0xff;
++    tmp[2] = (dctx->reseed_counter >> 8) & 0xff;
++    tmp[3] = dctx->reseed_counter & 0xff;
++    ctx_add_buf(dctx, hctx->V, tmp, 4);
++#ifdef HASH_DRBG_TRACE
++    fprintf(stderr, "V+C after generate:\n");
++    hexprint(stderr, hctx->V, dctx->seedlen);
++    hexprint(stderr, hctx->C, dctx->seedlen);
++#endif
++    return 1;
++}
++
++static int drbg_hash_uninstantiate(DRBG_CTX *dctx)
++{
++    EVP_MD_CTX_free(dctx->d.hash.mctx);
++    OPENSSL_cleanse(&dctx->d.hash, sizeof(DRBG_HASH_CTX));
++    return 1;
++}
++
++int fips_drbg_hash_init(DRBG_CTX *dctx)
++{
++    const EVP_MD *md;
++    DRBG_HASH_CTX *hctx = &dctx->d.hash;
++    md = FIPS_get_digestbynid(dctx->type);
++    if (!md)
++        return -2;
++    switch (dctx->type) {
++    case NID_sha1:
++        dctx->strength = 128;
++        break;
++
++    case NID_sha224:
++        dctx->strength = 192;
++        break;
++
++    default:
++        dctx->strength = 256;
++        break;
++    }
++
++    dctx->instantiate = drbg_hash_instantiate;
++    dctx->reseed = drbg_hash_reseed;
++    dctx->generate = drbg_hash_generate;
++    dctx->uninstantiate = drbg_hash_uninstantiate;
++
++    dctx->d.hash.md = md;
++    hctx->mctx = EVP_MD_CTX_new();
++    if (hctx->mctx == NULL)
++        return -1;
++
++    /* These are taken from SP 800-90 10.1 table 2 */
++
++    dctx->blocklength = EVP_MD_size(md);
++    if (dctx->blocklength > 32)
++        dctx->seedlen = 111;
++    else
++        dctx->seedlen = 55;
++
++    dctx->min_entropy = dctx->strength / 8;
++    dctx->max_entropy = DRBG_MAX_LENGTH;
++
++    dctx->min_nonce = dctx->min_entropy / 2;
++    dctx->max_nonce = DRBG_MAX_LENGTH;
++
++    dctx->max_pers = DRBG_MAX_LENGTH;
++    dctx->max_adin = DRBG_MAX_LENGTH;
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_hmac.c.fips openssl-1.1.1/crypto/fips/fips_drbg_hmac.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_hmac.c.fips	2018-09-13 08:51:22.110520923 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_hmac.c	2018-09-13 08:51:22.110520923 +0200
+@@ -0,0 +1,262 @@
++/* fips/rand/fips_drbg_hmac.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/evp.h>
++#include <openssl/hmac.h>
++#include <openssl/aes.h>
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++static int drbg_hmac_update(DRBG_CTX *dctx,
++                            const unsigned char *in1, size_t in1len,
++                            const unsigned char *in2, size_t in2len,
++                            const unsigned char *in3, size_t in3len)
++{
++    static unsigned char c0 = 0, c1 = 1;
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    HMAC_CTX *hctx = hmac->hctx;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++    if (!HMAC_Update(hctx, &c0, 1))
++        return 0;
++    if (in1len && !HMAC_Update(hctx, in1, in1len))
++        return 0;
++    if (in2len && !HMAC_Update(hctx, in2, in2len))
++        return 0;
++    if (in3len && !HMAC_Update(hctx, in3, in3len))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->K, NULL))
++        return 0;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->V, NULL))
++        return 0;
++
++    if (!in1len && !in2len && !in3len)
++        return 1;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++    if (!HMAC_Update(hctx, &c1, 1))
++        return 0;
++    if (in1len && !HMAC_Update(hctx, in1, in1len))
++        return 0;
++    if (in2len && !HMAC_Update(hctx, in2, in2len))
++        return 0;
++    if (in3len && !HMAC_Update(hctx, in3, in3len))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->K, NULL))
++        return 0;
++
++    if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++        return 0;
++    if (!HMAC_Update(hctx, hmac->V, dctx->blocklength))
++        return 0;
++
++    if (!HMAC_Final(hctx, hmac->V, NULL))
++        return 0;
++
++    return 1;
++
++}
++
++static int drbg_hmac_instantiate(DRBG_CTX *dctx,
++                                 const unsigned char *ent, size_t ent_len,
++                                 const unsigned char *nonce, size_t nonce_len,
++                                 const unsigned char *pstr, size_t pstr_len)
++{
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    memset(hmac->K, 0, dctx->blocklength);
++    memset(hmac->V, 1, dctx->blocklength);
++    if (!drbg_hmac_update(dctx,
++                          ent, ent_len, nonce, nonce_len, pstr, pstr_len))
++        return 0;
++
++#ifdef HMAC_DRBG_TRACE
++    fprintf(stderr, "K+V after instantiate:\n");
++    hexprint(stderr, hmac->K, hmac->blocklength);
++    hexprint(stderr, hmac->V, hmac->blocklength);
++#endif
++    return 1;
++}
++
++static int drbg_hmac_reseed(DRBG_CTX *dctx,
++                            const unsigned char *ent, size_t ent_len,
++                            const unsigned char *adin, size_t adin_len)
++{
++    if (!drbg_hmac_update(dctx, ent, ent_len, adin, adin_len, NULL, 0))
++        return 0;
++
++#ifdef HMAC_DRBG_TRACE
++    {
++        DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++        fprintf(stderr, "K+V after reseed:\n");
++        hexprint(stderr, hmac->K, hmac->blocklength);
++        hexprint(stderr, hmac->V, hmac->blocklength);
++    }
++#endif
++    return 1;
++}
++
++static int drbg_hmac_generate(DRBG_CTX *dctx,
++                              unsigned char *out, size_t outlen,
++                              const unsigned char *adin, size_t adin_len)
++{
++    DRBG_HMAC_CTX *hmac = &dctx->d.hmac;
++    HMAC_CTX *hctx = hmac->hctx;
++    const unsigned char *Vtmp = hmac->V;
++    if (adin_len && !drbg_hmac_update(dctx, adin, adin_len, NULL, 0, NULL, 0))
++        return 0;
++    for (;;) {
++        if (!HMAC_Init_ex(hctx, hmac->K, dctx->blocklength, hmac->md, NULL))
++            return 0;
++        if (!HMAC_Update(hctx, Vtmp, dctx->blocklength))
++            return 0;
++        if (outlen > dctx->blocklength) {
++            if (!HMAC_Final(hctx, out, NULL))
++                return 0;
++            Vtmp = out;
++        } else {
++            if (!HMAC_Final(hctx, hmac->V, NULL))
++                return 0;
++            memcpy(out, hmac->V, outlen);
++            break;
++        }
++        out += dctx->blocklength;
++        outlen -= dctx->blocklength;
++    }
++    if (!drbg_hmac_update(dctx, adin, adin_len, NULL, 0, NULL, 0))
++        return 0;
++
++    return 1;
++}
++
++static int drbg_hmac_uninstantiate(DRBG_CTX *dctx)
++{
++    HMAC_CTX_free(dctx->d.hmac.hctx);
++    OPENSSL_cleanse(&dctx->d.hmac, sizeof(DRBG_HMAC_CTX));
++    return 1;
++}
++
++int fips_drbg_hmac_init(DRBG_CTX *dctx)
++{
++    const EVP_MD *md = NULL;
++    DRBG_HMAC_CTX *hctx = &dctx->d.hmac;
++    dctx->strength = 256;
++    switch (dctx->type) {
++    case NID_hmacWithSHA1:
++        md = EVP_sha1();
++        dctx->strength = 128;
++        break;
++
++    case NID_hmacWithSHA224:
++        md = EVP_sha224();
++        dctx->strength = 192;
++        break;
++
++    case NID_hmacWithSHA256:
++        md = EVP_sha256();
++        break;
++
++    case NID_hmacWithSHA384:
++        md = EVP_sha384();
++        break;
++
++    case NID_hmacWithSHA512:
++        md = EVP_sha512();
++        break;
++
++    default:
++        dctx->strength = 0;
++        return -2;
++    }
++    dctx->instantiate = drbg_hmac_instantiate;
++    dctx->reseed = drbg_hmac_reseed;
++    dctx->generate = drbg_hmac_generate;
++    dctx->uninstantiate = drbg_hmac_uninstantiate;
++    hctx->hctx = HMAC_CTX_new();
++    if (hctx->hctx == NULL)
++        return -1;
++    hctx->md = md;
++    dctx->blocklength = M_EVP_MD_size(md);
++    dctx->seedlen = M_EVP_MD_size(md);
++
++    dctx->min_entropy = dctx->strength / 8;
++    dctx->max_entropy = DRBG_MAX_LENGTH;
++
++    dctx->min_nonce = dctx->min_entropy / 2;
++    dctx->max_nonce = DRBG_MAX_LENGTH;
++
++    dctx->max_pers = DRBG_MAX_LENGTH;
++    dctx->max_adin = DRBG_MAX_LENGTH;
++
++    dctx->max_request = 1 << 16;
++    dctx->reseed_interval = 1 << 24;
++
++    return 1;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_lib.c.fips openssl-1.1.1/crypto/fips/fips_drbg_lib.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_lib.c.fips	2018-09-13 08:51:22.110520923 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_lib.c	2018-09-13 08:51:22.110520923 +0200
+@@ -0,0 +1,528 @@
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/fips_rand.h>
++#include "fips_locl.h"
++#include "fips_rand_lcl.h"
++
++/* Support framework for SP800-90 DRBGs */
++
++int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags)
++{
++    int rv;
++    memset(dctx, 0, sizeof(DRBG_CTX));
++    dctx->status = DRBG_STATUS_UNINITIALISED;
++    dctx->xflags = flags;
++    dctx->type = type;
++
++    dctx->iflags = 0;
++    dctx->entropy_blocklen = 0;
++    dctx->health_check_cnt = 0;
++    dctx->health_check_interval = DRBG_HEALTH_INTERVAL;
++
++    rv = fips_drbg_hash_init(dctx);
++
++    if (rv == -2)
++        rv = fips_drbg_ctr_init(dctx);
++    if (rv == -2)
++        rv = fips_drbg_hmac_init(dctx);
++
++    if (rv <= 0) {
++        if (rv == -2)
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_UNSUPPORTED_DRBG_TYPE);
++        else
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_ERROR_INITIALISING_DRBG);
++    }
++
++    /* If not in test mode run selftests on DRBG of the same type */
++
++    if (!(dctx->xflags & DRBG_FLAG_TEST)) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_INIT, FIPS_R_SELFTEST_FAILURE);
++            return 0;
++        }
++    }
++
++    return rv;
++}
++
++DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags)
++{
++    DRBG_CTX *dctx;
++    dctx = OPENSSL_malloc(sizeof(DRBG_CTX));
++    if (!dctx) {
++        FIPSerr(FIPS_F_FIPS_DRBG_NEW, ERR_R_MALLOC_FAILURE);
++        return NULL;
++    }
++
++    if (type == 0) {
++        memset(dctx, 0, sizeof(DRBG_CTX));
++        dctx->type = 0;
++        dctx->status = DRBG_STATUS_UNINITIALISED;
++        return dctx;
++    }
++
++    if (FIPS_drbg_init(dctx, type, flags) <= 0) {
++        OPENSSL_free(dctx);
++        return NULL;
++    }
++
++    return dctx;
++}
++
++void FIPS_drbg_free(DRBG_CTX *dctx)
++{
++    if (dctx->uninstantiate)
++        dctx->uninstantiate(dctx);
++    /* Don't free up default DRBG */
++    if (dctx == FIPS_get_default_drbg()) {
++        memset(dctx, 0, sizeof(DRBG_CTX));
++        dctx->type = 0;
++        dctx->status = DRBG_STATUS_UNINITIALISED;
++    } else {
++        OPENSSL_cleanse(&dctx->d, sizeof(dctx->d));
++        OPENSSL_free(dctx);
++    }
++}
++
++static size_t fips_get_entropy(DRBG_CTX *dctx, unsigned char **pout,
++                               int entropy, size_t min_len, size_t max_len)
++{
++    unsigned char *tout, *p;
++    size_t bl = dctx->entropy_blocklen, rv;
++    if (!dctx->get_entropy)
++        return 0;
++    if (dctx->xflags & DRBG_FLAG_TEST || !bl)
++        return dctx->get_entropy(dctx, pout, entropy, min_len, max_len);
++    rv = dctx->get_entropy(dctx, &tout, entropy + bl,
++                           min_len + bl, max_len + bl);
++    if (tout == NULL)
++        return 0;
++    *pout = tout + bl;
++    if (rv < (min_len + bl) || (rv % bl))
++        return 0;
++    /* Compare consecutive blocks for continuous PRNG test */
++    for (p = tout; p < tout + rv - bl; p += bl) {
++        if (!memcmp(p, p + bl, bl)) {
++            FIPSerr(FIPS_F_FIPS_GET_ENTROPY, FIPS_R_ENTROPY_SOURCE_STUCK);
++            return 0;
++        }
++    }
++    rv -= bl;
++    if (rv > max_len)
++        return max_len;
++    return rv;
++}
++
++static void fips_cleanup_entropy(DRBG_CTX *dctx,
++                                 unsigned char *out, size_t olen)
++{
++    size_t bl;
++    if (dctx->xflags & DRBG_FLAG_TEST)
++        bl = 0;
++    else
++        bl = dctx->entropy_blocklen;
++    /* Call cleanup with original arguments */
++    dctx->cleanup_entropy(dctx, out - bl, olen + bl);
++}
++
++int FIPS_drbg_instantiate(DRBG_CTX *dctx,
++                          const unsigned char *pers, size_t perslen)
++{
++    size_t entlen = 0, noncelen = 0;
++    unsigned char *nonce = NULL, *entropy = NULL;
++
++#if 0
++    /* Put here so error script picks them up */
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE,
++            FIPS_R_PERSONALISATION_STRING_TOO_LONG);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_IN_ERROR_STATE);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ALREADY_INSTANTIATED);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_ENTROPY);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_ERROR_RETRIEVING_NONCE);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_INSTANTIATE_ERROR);
++    FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, FIPS_R_DRBG_NOT_INITIALISED);
++#endif
++
++    int r = 0;
++
++    if (perslen > dctx->max_pers) {
++        r = FIPS_R_PERSONALISATION_STRING_TOO_LONG;
++        goto end;
++    }
++
++    if (!dctx->instantiate) {
++        r = FIPS_R_DRBG_NOT_INITIALISED;
++        goto end;
++    }
++
++    if (dctx->status != DRBG_STATUS_UNINITIALISED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else
++            r = FIPS_R_ALREADY_INSTANTIATED;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_ERROR;
++
++    entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
++                              dctx->min_entropy, dctx->max_entropy);
++
++    if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) {
++        r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
++        goto end;
++    }
++
++    if (dctx->max_nonce > 0 && dctx->get_nonce) {
++        noncelen = dctx->get_nonce(dctx, &nonce,
++                                   dctx->strength / 2,
++                                   dctx->min_nonce, dctx->max_nonce);
++
++        if (noncelen < dctx->min_nonce || noncelen > dctx->max_nonce) {
++            r = FIPS_R_ERROR_RETRIEVING_NONCE;
++            goto end;
++        }
++
++    }
++
++    if (!dctx->instantiate(dctx,
++                           entropy, entlen, nonce, noncelen, pers, perslen)) {
++        r = FIPS_R_ERROR_INSTANTIATING_DRBG;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_READY;
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
++        dctx->reseed_counter = 1;
++
++ end:
++
++    if (entropy && dctx->cleanup_entropy)
++        fips_cleanup_entropy(dctx, entropy, entlen);
++
++    if (nonce && dctx->cleanup_nonce)
++        dctx->cleanup_nonce(dctx, nonce, noncelen);
++
++    if (dctx->status == DRBG_STATUS_READY)
++        return 1;
++
++    if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_FIPS_DRBG_INSTANTIATE, r);
++
++    return 0;
++
++}
++
++static int drbg_reseed(DRBG_CTX *dctx,
++                       const unsigned char *adin, size_t adinlen, int hcheck)
++{
++    unsigned char *entropy = NULL;
++    size_t entlen = 0;
++    int r = 0;
++
++#if 0
++    FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_NOT_INSTANTIATED);
++    FIPSerr(FIPS_F_DRBG_RESEED, FIPS_R_ADDITIONAL_INPUT_TOO_LONG);
++#endif
++    if (dctx->status != DRBG_STATUS_READY
++        && dctx->status != DRBG_STATUS_RESEED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else if (dctx->status == DRBG_STATUS_UNINITIALISED)
++            r = FIPS_R_NOT_INSTANTIATED;
++        goto end;
++    }
++
++    if (!adin)
++        adinlen = 0;
++    else if (adinlen > dctx->max_adin) {
++        r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
++        goto end;
++    }
++
++    dctx->status = DRBG_STATUS_ERROR;
++    /* Peform health check on all reseed operations if not a prediction
++     * resistance request and not in test mode.
++     */
++    if (hcheck && !(dctx->xflags & DRBG_FLAG_TEST)) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            r = FIPS_R_SELFTEST_FAILURE;
++            goto end;
++        }
++    }
++
++    entlen = fips_get_entropy(dctx, &entropy, dctx->strength,
++                              dctx->min_entropy, dctx->max_entropy);
++
++    if (entlen < dctx->min_entropy || entlen > dctx->max_entropy) {
++        r = FIPS_R_ERROR_RETRIEVING_ENTROPY;
++        goto end;
++    }
++
++    if (!dctx->reseed(dctx, entropy, entlen, adin, adinlen))
++        goto end;
++
++    dctx->status = DRBG_STATUS_READY;
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED))
++        dctx->reseed_counter = 1;
++ end:
++
++    if (entropy && dctx->cleanup_entropy)
++        fips_cleanup_entropy(dctx, entropy, entlen);
++
++    if (dctx->status == DRBG_STATUS_READY)
++        return 1;
++
++    if (r && !(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_DRBG_RESEED, r);
++
++    return 0;
++}
++
++int FIPS_drbg_reseed(DRBG_CTX *dctx,
++                     const unsigned char *adin, size_t adinlen)
++{
++    return drbg_reseed(dctx, adin, adinlen, 1);
++}
++
++static int fips_drbg_check(DRBG_CTX *dctx)
++{
++    if (dctx->xflags & DRBG_FLAG_TEST)
++        return 1;
++    dctx->health_check_cnt++;
++    if (dctx->health_check_cnt >= dctx->health_check_interval) {
++        if (!FIPS_drbg_health_check(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_CHECK, FIPS_R_SELFTEST_FAILURE);
++            return 0;
++        }
++    }
++    return 1;
++}
++
++int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
++                       int prediction_resistance,
++                       const unsigned char *adin, size_t adinlen)
++{
++    int r = 0;
++
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    if (!fips_drbg_check(dctx))
++        return 0;
++
++    if (dctx->status != DRBG_STATUS_READY
++        && dctx->status != DRBG_STATUS_RESEED) {
++        if (dctx->status == DRBG_STATUS_ERROR)
++            r = FIPS_R_IN_ERROR_STATE;
++        else if (dctx->status == DRBG_STATUS_UNINITIALISED)
++            r = FIPS_R_NOT_INSTANTIATED;
++        goto end;
++    }
++
++    if (outlen > dctx->max_request) {
++        r = FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG;
++        return 0;
++    }
++
++    if (adinlen > dctx->max_adin) {
++        r = FIPS_R_ADDITIONAL_INPUT_TOO_LONG;
++        goto end;
++    }
++
++    if (dctx->iflags & DRBG_CUSTOM_RESEED)
++        dctx->generate(dctx, NULL, outlen, NULL, 0);
++    else if (dctx->reseed_counter >= dctx->reseed_interval)
++        dctx->status = DRBG_STATUS_RESEED;
++
++    if (dctx->status == DRBG_STATUS_RESEED || prediction_resistance) {
++        /* If prediction resistance request don't do health check */
++        int hcheck = prediction_resistance ? 0 : 1;
++
++        if (!drbg_reseed(dctx, adin, adinlen, hcheck)) {
++            r = FIPS_R_RESEED_ERROR;
++            goto end;
++        }
++        adin = NULL;
++        adinlen = 0;
++    }
++
++    if (!dctx->generate(dctx, out, outlen, adin, adinlen)) {
++        r = FIPS_R_GENERATE_ERROR;
++        dctx->status = DRBG_STATUS_ERROR;
++        goto end;
++    }
++    if (!(dctx->iflags & DRBG_CUSTOM_RESEED)) {
++        if (dctx->reseed_counter >= dctx->reseed_interval)
++            dctx->status = DRBG_STATUS_RESEED;
++        else
++            dctx->reseed_counter++;
++    }
++
++ end:
++    if (r) {
++        if (!(dctx->iflags & DRBG_FLAG_NOERR))
++            FIPSerr(FIPS_F_FIPS_DRBG_GENERATE, r);
++        return 0;
++    }
++
++    return 1;
++}
++
++int FIPS_drbg_uninstantiate(DRBG_CTX *dctx)
++{
++    int rv;
++    if (!dctx->uninstantiate)
++        rv = 1;
++    else
++        rv = dctx->uninstantiate(dctx);
++    /* Although we'd like to cleanse here we can't because we have to
++     * test the uninstantiate really zeroes the data.
++     */
++    memset(&dctx->d, 0, sizeof(dctx->d));
++    dctx->status = DRBG_STATUS_UNINITIALISED;
++    /* If method has problems uninstantiating, return error */
++    return rv;
++}
++
++int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
++                            size_t (*get_entropy) (DRBG_CTX *ctx,
++                                                   unsigned char **pout,
++                                                   int entropy,
++                                                   size_t min_len,
++                                                   size_t max_len),
++                            void (*cleanup_entropy) (DRBG_CTX *ctx,
++                                                     unsigned char *out,
++                                                     size_t olen),
++                            size_t entropy_blocklen,
++                            size_t (*get_nonce) (DRBG_CTX *ctx,
++                                                 unsigned char **pout,
++                                                 int entropy, size_t min_len,
++                                                 size_t max_len),
++                            void (*cleanup_nonce) (DRBG_CTX *ctx,
++                                                   unsigned char *out,
++                                                   size_t olen))
++{
++    if (dctx->status != DRBG_STATUS_UNINITIALISED)
++        return 0;
++    dctx->entropy_blocklen = entropy_blocklen;
++    dctx->get_entropy = get_entropy;
++    dctx->cleanup_entropy = cleanup_entropy;
++    dctx->get_nonce = get_nonce;
++    dctx->cleanup_nonce = cleanup_nonce;
++    return 1;
++}
++
++int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
++                                 size_t (*get_adin) (DRBG_CTX *ctx,
++                                                     unsigned char **pout),
++                                 void (*cleanup_adin) (DRBG_CTX *ctx,
++                                                       unsigned char *out,
++                                                       size_t olen),
++                                 int (*rand_seed_cb) (DRBG_CTX *ctx,
++                                                      const void *buf,
++                                                      int num),
++                                 int (*rand_add_cb) (DRBG_CTX *ctx,
++                                                     const void *buf, int num,
++                                                     double entropy))
++{
++    if (dctx->status != DRBG_STATUS_UNINITIALISED)
++        return 0;
++    dctx->get_adin = get_adin;
++    dctx->cleanup_adin = cleanup_adin;
++    dctx->rand_seed_cb = rand_seed_cb;
++    dctx->rand_add_cb = rand_add_cb;
++    return 1;
++}
++
++void *FIPS_drbg_get_app_data(DRBG_CTX *dctx)
++{
++    return dctx->app_data;
++}
++
++void FIPS_drbg_set_app_data(DRBG_CTX *dctx, void *app_data)
++{
++    dctx->app_data = app_data;
++}
++
++size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx)
++{
++    return dctx->blocklength;
++}
++
++int FIPS_drbg_get_strength(DRBG_CTX *dctx)
++{
++    return dctx->strength;
++}
++
++void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval)
++{
++    dctx->health_check_interval = interval;
++}
++
++void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval)
++{
++    dctx->reseed_interval = interval;
++}
++
++void FIPS_drbg_stick(int onoff)
++{
++    /* Just backwards compatibility API call with no effect. */
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_rand.c.fips openssl-1.1.1/crypto/fips/fips_drbg_rand.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_rand.c.fips	2018-09-13 08:51:22.110520923 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_rand.c	2018-09-13 08:51:22.110520923 +0200
+@@ -0,0 +1,185 @@
++/* fips/rand/fips_drbg_rand.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include "internal/thread_once.h"
++#include <openssl/err.h>
++#include <openssl/rand.h>
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++
++/* Mapping of SP800-90 DRBGs to OpenSSL RAND_METHOD */
++
++/* Since we only have one global PRNG used at any time in OpenSSL use a global
++ * variable to store context.
++ */
++
++static DRBG_CTX ossl_dctx;
++
++static CRYPTO_RWLOCK *fips_rand_lock = NULL;
++static CRYPTO_ONCE fips_rand_lock_init = CRYPTO_ONCE_STATIC_INIT;
++
++DEFINE_RUN_ONCE_STATIC(do_fips_rand_lock_init)
++{
++    fips_rand_lock = CRYPTO_THREAD_lock_new();
++    return fips_rand_lock != NULL;
++}
++
++DRBG_CTX *FIPS_get_default_drbg(void)
++{
++    if (!RUN_ONCE(&fips_rand_lock_init, do_fips_rand_lock_init))
++        return NULL;
++    return &ossl_dctx;
++}
++
++static int fips_drbg_bytes(unsigned char *out, int count)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int rv = 0;
++    unsigned char *adin = NULL;
++    size_t adinlen = 0;
++    CRYPTO_THREAD_write_lock(fips_rand_lock);
++    do {
++        size_t rcnt;
++        if (count > (int)dctx->max_request)
++            rcnt = dctx->max_request;
++        else
++            rcnt = count;
++        if (dctx->get_adin) {
++            adinlen = dctx->get_adin(dctx, &adin);
++            if (adinlen && !adin) {
++                FIPSerr(FIPS_F_FIPS_DRBG_BYTES,
++                        FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT);
++                goto err;
++            }
++        }
++        rv = FIPS_drbg_generate(dctx, out, rcnt, 0, adin, adinlen);
++        if (adin) {
++            if (dctx->cleanup_adin)
++                dctx->cleanup_adin(dctx, adin, adinlen);
++            adin = NULL;
++        }
++        if (!rv)
++            goto err;
++        out += rcnt;
++        count -= rcnt;
++    }
++    while (count);
++    rv = 1;
++ err:
++    CRYPTO_THREAD_unlock(fips_rand_lock);
++    return rv;
++}
++
++static int fips_drbg_pseudo(unsigned char *out, int count)
++{
++    if (fips_drbg_bytes(out, count) <= 0)
++        return -1;
++    return 1;
++}
++
++static int fips_drbg_status(void)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int rv;
++    CRYPTO_THREAD_read_lock(fips_rand_lock);
++    rv = dctx->status == DRBG_STATUS_READY ? 1 : 0;
++    CRYPTO_THREAD_unlock(fips_rand_lock);
++    return rv;
++}
++
++static void fips_drbg_cleanup(void)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    CRYPTO_THREAD_write_lock(fips_rand_lock);
++    FIPS_drbg_uninstantiate(dctx);
++    CRYPTO_THREAD_unlock(fips_rand_lock);
++}
++
++static int fips_drbg_seed(const void *seed, int seedlen)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int ret = 1;
++    CRYPTO_THREAD_write_lock(fips_rand_lock);
++    if (dctx->rand_seed_cb)
++        ret = dctx->rand_seed_cb(dctx, seed, seedlen);
++    CRYPTO_THREAD_unlock(fips_rand_lock);
++    return ret;
++}
++
++static int fips_drbg_add(const void *seed, int seedlen, double add_entropy)
++{
++    DRBG_CTX *dctx = &ossl_dctx;
++    int ret = 1;
++    CRYPTO_THREAD_write_lock(fips_rand_lock);
++    if (dctx->rand_add_cb)
++        ret = dctx->rand_add_cb(dctx, seed, seedlen, add_entropy);
++    CRYPTO_THREAD_unlock(fips_rand_lock);
++    return ret;
++}
++
++static const RAND_METHOD rand_drbg_meth = {
++    fips_drbg_seed,
++    fips_drbg_bytes,
++    fips_drbg_cleanup,
++    fips_drbg_add,
++    fips_drbg_pseudo,
++    fips_drbg_status
++};
++
++const RAND_METHOD *FIPS_drbg_method(void)
++{
++    return &rand_drbg_meth;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_selftest.c.fips openssl-1.1.1/crypto/fips/fips_drbg_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_drbg_selftest.c.fips	2018-09-13 08:51:22.111520900 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_selftest.c	2018-09-13 08:51:22.111520900 +0200
+@@ -0,0 +1,828 @@
++/* fips/rand/fips_drbg_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++#include <openssl/fips_rand.h>
++#include "fips_rand_lcl.h"
++#include "fips_locl.h"
++
++#include "fips_drbg_selftest.h"
++
++typedef struct {
++    int post;
++    int nid;
++    unsigned int flags;
++
++    /* KAT data for no PR */
++    const unsigned char *ent;
++    size_t entlen;
++    const unsigned char *nonce;
++    size_t noncelen;
++    const unsigned char *pers;
++    size_t perslen;
++    const unsigned char *adin;
++    size_t adinlen;
++    const unsigned char *entreseed;
++    size_t entreseedlen;
++    const unsigned char *adinreseed;
++    size_t adinreseedlen;
++    const unsigned char *adin2;
++    size_t adin2len;
++    const unsigned char *kat;
++    size_t katlen;
++    const unsigned char *kat2;
++    size_t kat2len;
++
++    /* KAT data for PR */
++    const unsigned char *ent_pr;
++    size_t entlen_pr;
++    const unsigned char *nonce_pr;
++    size_t noncelen_pr;
++    const unsigned char *pers_pr;
++    size_t perslen_pr;
++    const unsigned char *adin_pr;
++    size_t adinlen_pr;
++    const unsigned char *entpr_pr;
++    size_t entprlen_pr;
++    const unsigned char *ading_pr;
++    size_t adinglen_pr;
++    const unsigned char *entg_pr;
++    size_t entglen_pr;
++    const unsigned char *kat_pr;
++    size_t katlen_pr;
++    const unsigned char *kat2_pr;
++    size_t kat2len_pr;
++
++} DRBG_SELFTEST_DATA;
++
++#define make_drbg_test_data(nid, flag, pr, p) {p, nid, flag | DRBG_FLAG_TEST, \
++        pr##_entropyinput, sizeof(pr##_entropyinput), \
++        pr##_nonce, sizeof(pr##_nonce), \
++        pr##_personalizationstring, sizeof(pr##_personalizationstring), \
++        pr##_additionalinput, sizeof(pr##_additionalinput), \
++        pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
++        pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
++        pr##_additionalinput2, sizeof(pr##_additionalinput2), \
++        pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
++        pr##_returnedbits, sizeof(pr##_returnedbits), \
++        pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
++        pr##_pr_nonce, sizeof(pr##_pr_nonce), \
++        pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
++        pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
++        pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
++        pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
++        pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
++        pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
++        pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits), \
++        }
++
++#define make_drbg_test_data_df(nid, pr, p) \
++        make_drbg_test_data(nid, DRBG_FLAG_CTR_USE_DF, pr, p)
++
++#define make_drbg_test_data_ec(curve, md, pr, p) \
++        make_drbg_test_data((curve << 16) | md , 0, pr, p)
++
++static DRBG_SELFTEST_DATA drbg_test[] = {
++    make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0),
++    make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0),
++    make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1),
++    make_drbg_test_data(NID_aes_128_ctr, 0, aes_128_no_df, 0),
++    make_drbg_test_data(NID_aes_192_ctr, 0, aes_192_no_df, 0),
++    make_drbg_test_data(NID_aes_256_ctr, 0, aes_256_no_df, 1),
++    make_drbg_test_data(NID_sha1, 0, sha1, 0),
++    make_drbg_test_data(NID_sha224, 0, sha224, 0),
++    make_drbg_test_data(NID_sha256, 0, sha256, 1),
++    make_drbg_test_data(NID_sha384, 0, sha384, 0),
++    make_drbg_test_data(NID_sha512, 0, sha512, 0),
++    make_drbg_test_data(NID_hmacWithSHA1, 0, hmac_sha1, 0),
++    make_drbg_test_data(NID_hmacWithSHA224, 0, hmac_sha224, 0),
++    make_drbg_test_data(NID_hmacWithSHA256, 0, hmac_sha256, 1),
++    make_drbg_test_data(NID_hmacWithSHA384, 0, hmac_sha384, 0),
++    make_drbg_test_data(NID_hmacWithSHA512, 0, hmac_sha512, 0),
++    {0, 0, 0}
++};
++
++typedef struct {
++    const unsigned char *ent;
++    size_t entlen;
++    int entcnt;
++    const unsigned char *nonce;
++    size_t noncelen;
++    int noncecnt;
++} TEST_ENT;
++
++static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,
++                           int entropy, size_t min_len, size_t max_len)
++{
++    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
++    *pout = (unsigned char *)t->ent;
++    t->entcnt++;
++    return t->entlen;
++}
++
++static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,
++                         int entropy, size_t min_len, size_t max_len)
++{
++    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);
++    *pout = (unsigned char *)t->nonce;
++    t->noncecnt++;
++    return t->noncelen;
++}
++
++static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,
++                                int quick)
++{
++    TEST_ENT t;
++    int rv = 0;
++    size_t adinlen;
++    unsigned char randout[1024];
++
++    /* Initial test without PR */
++
++    /* Instantiate DRBG with test entropy, nonce and personalisation
++     * string.
++     */
++
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, &t);
++
++    t.ent = td->ent;
++    t.entlen = td->entlen;
++    t.nonce = td->nonce;
++    t.noncelen = td->noncelen;
++    t.entcnt = 0;
++    t.noncecnt = 0;
++
++    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
++        goto err;
++
++    /* Note for CTR without DF some additional input values
++     * ignore bytes after the keylength: so reduce adinlen
++     * to half to ensure invalid data is fed in.
++     */
++    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))
++        adinlen = td->adinlen / 2;
++    else
++        adinlen = td->adinlen;
++
++    /* Generate with no PR and verify output matches expected data */
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, adinlen))
++        goto err;
++
++    if (memcmp(randout, td->kat, td->katlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);
++        goto err2;
++    }
++    /* If abbreviated POST end of test */
++    if (quick) {
++        rv = 1;
++        goto err;
++    }
++    /* Reseed DRBG with test entropy and additional input */
++    t.ent = td->entreseed;
++    t.entlen = td->entreseedlen;
++
++    if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))
++        goto err;
++
++    /* Generate with no PR and verify output matches expected data */
++    if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0,
++                            td->adin2, td->adin2len))
++        goto err;
++
++    if (memcmp(randout, td->kat2, td->kat2len)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST2_FAILURE);
++        goto err2;
++    }
++
++    FIPS_drbg_uninstantiate(dctx);
++
++    /* Now test with PR */
++
++    /* Instantiate DRBG with test entropy, nonce and personalisation
++     * string.
++     */
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, &t);
++
++    t.ent = td->ent_pr;
++    t.entlen = td->entlen_pr;
++    t.nonce = td->nonce_pr;
++    t.noncelen = td->noncelen_pr;
++    t.entcnt = 0;
++    t.noncecnt = 0;
++
++    if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))
++        goto err;
++
++    /* Now generate with PR: we need to supply entropy as this will
++     * perform a reseed operation. Check output matches expected value.
++     */
++
++    t.ent = td->entpr_pr;
++    t.entlen = td->entprlen_pr;
++
++    /* Note for CTR without DF some additional input values
++     * ignore bytes after the keylength: so reduce adinlen
++     * to half to ensure invalid data is fed in.
++     */
++    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))
++        adinlen = td->adinlen_pr / 2;
++    else
++        adinlen = td->adinlen_pr;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 1,
++                            td->adin_pr, adinlen))
++        goto err;
++
++    if (memcmp(randout, td->kat_pr, td->katlen_pr)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST1_FAILURE);
++        goto err2;
++    }
++
++    /* Now generate again with PR: supply new entropy again.
++     * Check output matches expected value.
++     */
++
++    t.ent = td->entg_pr;
++    t.entlen = td->entglen_pr;
++
++    if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 1,
++                            td->ading_pr, td->adinglen_pr))
++        goto err;
++
++    if (memcmp(randout, td->kat2_pr, td->kat2len_pr)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);
++        goto err2;
++    }
++    /* All OK, test complete */
++    rv = 1;
++
++ err:
++    if (rv == 0)
++        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_SELFTEST_FAILED);
++ err2:
++    FIPS_drbg_uninstantiate(dctx);
++
++    return rv;
++
++}
++
++/* Initialise a DRBG based on selftest data */
++
++static int do_drbg_init(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td, TEST_ENT * t)
++{
++
++    if (!FIPS_drbg_init(dctx, td->nid, td->flags))
++        return 0;
++
++    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))
++        return 0;
++
++    FIPS_drbg_set_app_data(dctx, t);
++
++    t->ent = td->ent;
++    t->entlen = td->entlen;
++    t->nonce = td->nonce;
++    t->noncelen = td->noncelen;
++    t->entcnt = 0;
++    t->noncecnt = 0;
++    return 1;
++}
++
++/* Initialise and instantiate DRBG based on selftest data */
++static int do_drbg_instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,
++                               TEST_ENT * t)
++{
++    if (!do_drbg_init(dctx, td, t))
++        return 0;
++    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))
++        return 0;
++
++    return 1;
++}
++
++/* This function performs extensive error checking as required by SP800-90.
++ * Induce several failure modes and check an error condition is set.
++ * This function along with fips_drbg_single_kat peforms the health checking
++ * operation.
++ */
++
++static int fips_drbg_error_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td)
++{
++    unsigned char randout[1024];
++    TEST_ENT t;
++    size_t i;
++    unsigned int reseed_counter_tmp;
++    unsigned char *p = (unsigned char *)dctx;
++
++    /* Initialise DRBG */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    /* Don't report induced errors */
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Personalisation string tests */
++
++    /* Test detection of too large personlisation string */
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_PERSONALISATION_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Entropy source tests */
++
++    /* Test entropy source failure detecion: i.e. returns no data */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Try to generate output from uninstantiated DRBG */
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_GENERATE_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Test insufficient entropy */
++
++    t.entlen = dctx->min_entropy - 1;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test too much entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->max_entropy + 1;
++
++    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Nonce tests */
++
++    /* Test too small nonce */
++
++    if (dctx->min_nonce) {
++
++        if (!do_drbg_init(dctx, td, &t))
++            goto err;
++
++        dctx->iflags |= DRBG_FLAG_NOERR;
++
++        t.noncelen = dctx->min_nonce - 1;
++
++        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_NONCE_ERROR_UNDETECTED);
++            goto err;
++        }
++
++        dctx->iflags &= ~DRBG_FLAG_NOERR;
++        if (!FIPS_drbg_uninstantiate(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++            goto err;
++        }
++
++    }
++
++    /* Test too large nonce */
++
++    if (dctx->max_nonce) {
++
++        if (!do_drbg_init(dctx, td, &t))
++            goto err;
++
++        dctx->iflags |= DRBG_FLAG_NOERR;
++
++        t.noncelen = dctx->max_nonce + 1;
++
++        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_NONCE_ERROR_UNDETECTED);
++            goto err;
++        }
++
++        dctx->iflags &= ~DRBG_FLAG_NOERR;
++        if (!FIPS_drbg_uninstantiate(dctx)) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++            goto err;
++        }
++
++    }
++
++    /* Instantiate with valid data. */
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++
++    /* Check generation is now OK */
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    /* Request too much data for one request */
++    if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Try too large additional input */
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                           td->adin, dctx->max_adin + 1)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Check prediction resistance request fails if entropy source
++     * failure.
++     */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Instantiate again with valid data */
++
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++    /* Test reseed counter works */
++    /* Save initial reseed counter */
++    reseed_counter_tmp = dctx->reseed_counter;
++    /* Set reseed counter to beyond interval */
++    dctx->reseed_counter = dctx->reseed_interval;
++
++    /* Generate output and check entropy has been requested for reseed */
++    t.entcnt = 0;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++    if (t.entcnt != 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
++        goto err;
++    }
++    /* Check reseed counter has been reset */
++    if (dctx->reseed_counter != reseed_counter_tmp + 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Check prediction resistance request fails if entropy source
++     * failure.
++     */
++
++    t.entlen = 0;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,
++                           td->adin, td->adinlen)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    if (!do_drbg_instantiate(dctx, td, &t))
++        goto err;
++    /* Test reseed counter works */
++    /* Save initial reseed counter */
++    reseed_counter_tmp = dctx->reseed_counter;
++    /* Set reseed counter to beyond interval */
++    dctx->reseed_counter = dctx->reseed_interval;
++
++    /* Generate output and check entropy has been requested for reseed */
++    t.entcnt = 0;
++    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,
++                            td->adin, td->adinlen))
++        goto err;
++    if (t.entcnt != 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);
++        goto err;
++    }
++    /* Check reseed counter has been reset */
++    if (dctx->reseed_counter != reseed_counter_tmp + 1) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);
++        goto err;
++    }
++
++    dctx->iflags &= ~DRBG_FLAG_NOERR;
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Explicit reseed tests */
++
++    /* Test explicit reseed with too large additional input */
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, dctx->max_adin + 1) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    /* Test explicit reseed with entropy source failure */
++
++    t.entlen = 0;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test explicit reseed with too much entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->max_entropy + 1;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    /* Test explicit reseed with too little entropy */
++
++    if (!do_drbg_init(dctx, td, &t))
++        goto err;
++
++    dctx->iflags |= DRBG_FLAG_NOERR;
++
++    t.entlen = dctx->min_entropy - 1;
++
++    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                FIPS_R_ENTROPY_ERROR_UNDETECTED);
++        goto err;
++    }
++
++    if (!FIPS_drbg_uninstantiate(dctx)) {
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
++        goto err;
++    }
++
++    p = (unsigned char *)&dctx->d;
++    /* Standard says we have to check uninstantiate really zeroes
++     * the data...
++     */
++    for (i = 0; i < sizeof(dctx->d); i++) {
++        if (*p != 0) {
++            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,
++                    FIPS_R_UNINSTANTIATE_ZEROISE_ERROR);
++            goto err;
++        }
++        p++;
++    }
++
++    return 1;
++
++ err:
++    /* A real error as opposed to an induced one: underlying function will
++     * indicate the error.
++     */
++    if (!(dctx->iflags & DRBG_FLAG_NOERR))
++        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_FUNCTION_ERROR);
++    FIPS_drbg_uninstantiate(dctx);
++    return 0;
++
++}
++
++int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)
++{
++    DRBG_SELFTEST_DATA *td;
++    flags |= DRBG_FLAG_TEST;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (td->nid == nid && td->flags == flags) {
++            if (!fips_drbg_single_kat(dctx, td, 0))
++                return 0;
++            return fips_drbg_error_check(dctx, td);
++        }
++    }
++    return 0;
++}
++
++int FIPS_drbg_health_check(DRBG_CTX *dctx)
++{
++    int rv;
++    DRBG_CTX *tctx = NULL;
++    tctx = FIPS_drbg_new(0, 0);
++    fips_post_started(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    if (!tctx)
++        return 0;
++    rv = fips_drbg_kat(tctx, dctx->type, dctx->xflags);
++    if (tctx)
++        FIPS_drbg_free(tctx);
++    if (rv)
++        fips_post_success(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    else
++        fips_post_failed(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);
++    if (!rv)
++        dctx->status = DRBG_STATUS_ERROR;
++    else
++        dctx->health_check_cnt = 0;
++    return rv;
++}
++
++int FIPS_selftest_drbg(void)
++{
++    DRBG_CTX *dctx;
++    DRBG_SELFTEST_DATA *td;
++    int rv = 1;
++    dctx = FIPS_drbg_new(0, 0);
++    if (!dctx)
++        return 0;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (td->post != 1)
++            continue;
++        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 1;
++        if (!fips_drbg_single_kat(dctx, td, 1)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 0;
++    }
++    FIPS_drbg_free(dctx);
++    return rv;
++}
++
++int FIPS_selftest_drbg_all(void)
++{
++    DRBG_CTX *dctx;
++    DRBG_SELFTEST_DATA *td;
++    int rv = 1;
++    dctx = FIPS_drbg_new(0, 0);
++    if (!dctx)
++        return 0;
++    for (td = drbg_test; td->nid != 0; td++) {
++        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 1;
++        if (!fips_drbg_single_kat(dctx, td, 0)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_drbg_error_check(dctx, td)) {
++            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);
++            rv = 0;
++            continue;
++        }
++        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))
++            return 0;
++    }
++    FIPS_drbg_free(dctx);
++    return rv;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_drbg_selftest.h.fips openssl-1.1.1/crypto/fips/fips_drbg_selftest.h
+--- openssl-1.1.1/crypto/fips/fips_drbg_selftest.h.fips	2018-09-13 08:51:22.111520900 +0200
++++ openssl-1.1.1/crypto/fips/fips_drbg_selftest.h	2018-09-13 08:51:22.111520900 +0200
+@@ -0,0 +1,1791 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++/* Selftest and health check data for the SP800-90 DRBG */
++
++#define __fips_constseg
++
++/* AES-128 use df PR  */
++__fips_constseg static const unsigned char aes_128_use_df_pr_entropyinput[] = {
++    0x61, 0x52, 0x7c, 0xe3, 0x23, 0x7d, 0x0a, 0x07, 0x10, 0x0c, 0x50, 0x33,
++    0xc8, 0xdb, 0xff, 0x12
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_pr_nonce[] = {
++    0x51, 0x0d, 0x85, 0x77, 0xed, 0x22, 0x97, 0x28
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_personalizationstring[] = {
++    0x59, 0x9f, 0xbb, 0xcd, 0xd5, 0x25, 0x69, 0xb5, 0xcb, 0xb5, 0x03, 0xfe,
++    0xd7, 0xd7, 0x01, 0x67
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_additionalinput[] = {
++    0xef, 0x88, 0x76, 0x01, 0xaf, 0x3c, 0xfe, 0x8b, 0xaf, 0x26, 0x06, 0x9e,
++    0x9a, 0x47, 0x08, 0x76
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_entropyinputpr[] = {
++    0xe2, 0x76, 0xf9, 0xf6, 0x3a, 0xba, 0x10, 0x9f, 0xbf, 0x47, 0x0e, 0x51,
++    0x09, 0xfb, 0xa3, 0xb6
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_int_returnedbits[] = {
++    0xd4, 0x98, 0x8a, 0x46, 0x80, 0x4c, 0xdb, 0xa3, 0x59, 0x02, 0x57, 0x52,
++    0x66, 0x1c, 0xea, 0x5b
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_additionalinput2[] = {
++    0x88, 0x8c, 0x91, 0xd6, 0xbe, 0x56, 0x6e, 0x08, 0x9a, 0x62, 0x2b, 0x11,
++    0x3f, 0x5e, 0x31, 0x06
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_pr_entropyinputpr2[] = {
++    0xc0, 0x5c, 0x6b, 0x98, 0x01, 0x0d, 0x58, 0x18, 0x51, 0x18, 0x96, 0xae,
++    0xa7, 0xe3, 0xa8, 0x67
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_pr_returnedbits[] = {
++    0xcf, 0x01, 0xac, 0x22, 0x31, 0x06, 0x8e, 0xfc, 0xce, 0x56, 0xea, 0x24,
++    0x0f, 0x38, 0x43, 0xc6
++};
++
++/* AES-128 use df No PR  */
++__fips_constseg static const unsigned char aes_128_use_df_entropyinput[] = {
++    0x1f, 0x8e, 0x34, 0x82, 0x0c, 0xb7, 0xbe, 0xc5, 0x01, 0x3e, 0xd0, 0xa3,
++    0x9d, 0x7d, 0x1c, 0x9b
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_nonce[] = {
++    0xd5, 0x4d, 0xbd, 0x4a, 0x93, 0x7f, 0xb8, 0x96
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_personalizationstring[] = {
++    0xab, 0xd6, 0x3f, 0x04, 0xfe, 0x27, 0x6b, 0x2d, 0xd7, 0xc3, 0x1c, 0xf3,
++    0x38, 0x66, 0xba, 0x1b
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_additionalinput[] = {
++    0xfe, 0xf4, 0x09, 0xa8, 0xb7, 0x73, 0x27, 0x9c, 0x5f, 0xa7, 0xea, 0x46,
++    0xb5, 0xe2, 0xb2, 0x41
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_int_returnedbits[] = {
++    0x42, 0xe4, 0x4e, 0x7b, 0x27, 0xdd, 0xcb, 0xbc, 0x0a, 0xcf, 0xa6, 0x67,
++    0xe7, 0x57, 0x11, 0xb4
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_entropyinputreseed[] = {
++    0x14, 0x26, 0x69, 0xd9, 0xf3, 0x65, 0x03, 0xd6, 0x6b, 0xb9, 0x44, 0x0b,
++    0xc7, 0xc4, 0x9e, 0x39
++};
++
++__fips_constseg
++    static const unsigned char aes_128_use_df_additionalinputreseed[] = {
++    0x55, 0x2e, 0x60, 0x9a, 0x05, 0x72, 0x8a, 0xa8, 0xef, 0x22, 0x81, 0x5a,
++    0xc8, 0x93, 0xfa, 0x84
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_additionalinput2[] = {
++    0x3c, 0x40, 0xc8, 0xc4, 0x16, 0x0c, 0x21, 0xa4, 0x37, 0x2c, 0x8f, 0xa5,
++    0x06, 0x0c, 0x15, 0x2c
++};
++
++__fips_constseg static const unsigned char aes_128_use_df_returnedbits[] = {
++    0xe1, 0x3e, 0x99, 0x98, 0x86, 0x67, 0x0b, 0x63, 0x7b, 0xbe, 0x3f, 0x88,
++    0x46, 0x81, 0xc7, 0x19
++};
++
++/* AES-192 use df PR  */
++__fips_constseg static const unsigned char aes_192_use_df_pr_entropyinput[] = {
++    0x2b, 0x4e, 0x8b, 0xe1, 0xf1, 0x34, 0x80, 0x56, 0x81, 0xf9, 0x74, 0xec,
++    0x17, 0x44, 0x2a, 0xf1, 0x14, 0xb0, 0xbf, 0x97, 0x39, 0xb7, 0x04, 0x7d
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_pr_nonce[] = {
++    0xd6, 0x9d, 0xeb, 0x14, 0x4e, 0x6c, 0x30, 0x1e, 0x39, 0x55, 0x73, 0xd0,
++    0xd1, 0x80, 0x78, 0xfa
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_personalizationstring[] = {
++    0xfc, 0x43, 0x4a, 0xf8, 0x9a, 0x55, 0xb3, 0x53, 0x83, 0xe2, 0x18, 0x16,
++    0x0c, 0xdc, 0xcd, 0x5e, 0x4f, 0xa0, 0x03, 0x01, 0x2b, 0x9f, 0xe4, 0xd5,
++    0x7d, 0x49, 0xf0, 0x41, 0x9e, 0x3d, 0x99, 0x04
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_additionalinput[] = {
++    0x5e, 0x9f, 0x49, 0x6f, 0x21, 0x8b, 0x1d, 0x32, 0xd5, 0x84, 0x5c, 0xac,
++    0xaf, 0xdf, 0xe4, 0x79, 0x9e, 0xaf, 0xa9, 0x82, 0xd0, 0xf8, 0x4f, 0xcb,
++    0x69, 0x10, 0x0a, 0x7e, 0x81, 0x57, 0xb5, 0x36
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_entropyinputpr[] = {
++    0xd4, 0x81, 0x0c, 0xd7, 0x66, 0x39, 0xec, 0x42, 0x53, 0x87, 0x41, 0xa5,
++    0x1e, 0x7d, 0x80, 0x91, 0x8e, 0xbb, 0xed, 0xac, 0x14, 0x02, 0x1a, 0xd5
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_int_returnedbits[] = {
++    0xdf, 0x1d, 0x39, 0x45, 0x7c, 0x9b, 0xc6, 0x2b, 0x7d, 0x8c, 0x93, 0xe9,
++    0x19, 0x30, 0x6b, 0x67
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_additionalinput2[] = {
++    0x00, 0x71, 0x27, 0x4e, 0xd3, 0x14, 0xf1, 0x20, 0x7f, 0x4a, 0x41, 0x32,
++    0x2a, 0x97, 0x11, 0x43, 0x8f, 0x4a, 0x15, 0x7b, 0x9b, 0x51, 0x79, 0xda,
++    0x49, 0x3d, 0xde, 0xe8, 0xbc, 0x93, 0x91, 0x99
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_pr_entropyinputpr2[] = {
++    0x90, 0xee, 0x76, 0xa1, 0x45, 0x8d, 0xb7, 0x40, 0xb0, 0x11, 0xbf, 0xd0,
++    0x65, 0xd7, 0x3c, 0x7c, 0x4f, 0x20, 0x3f, 0x4e, 0x11, 0x9d, 0xb3, 0x5e
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_pr_returnedbits[] = {
++    0x24, 0x3b, 0x20, 0xa4, 0x37, 0x66, 0xba, 0x72, 0x39, 0x3f, 0xcf, 0x3c,
++    0x7e, 0x1a, 0x2b, 0x83
++};
++
++/* AES-192 use df No PR  */
++__fips_constseg static const unsigned char aes_192_use_df_entropyinput[] = {
++    0x8d, 0x74, 0xa4, 0x50, 0x1a, 0x02, 0x68, 0x0c, 0x2a, 0x69, 0xc4, 0x82,
++    0x3b, 0xbb, 0xda, 0x0e, 0x7f, 0x77, 0xa3, 0x17, 0x78, 0x57, 0xb2, 0x7b
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_nonce[] = {
++    0x75, 0xd5, 0x1f, 0xac, 0xa4, 0x8d, 0x42, 0x78, 0xd7, 0x69, 0x86, 0x9d,
++    0x77, 0xd7, 0x41, 0x0e
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_personalizationstring[] = {
++    0x4e, 0x33, 0x41, 0x3c, 0x9c, 0xc2, 0xd2, 0x53, 0xaf, 0x90, 0xea, 0xcf,
++    0x19, 0x50, 0x1e, 0xe6, 0x6f, 0x63, 0xc8, 0x32, 0x22, 0xdc, 0x07, 0x65,
++    0x9c, 0xd3, 0xf8, 0x30, 0x9e, 0xed, 0x35, 0x70
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_additionalinput[] = {
++    0x5d, 0x8b, 0x8c, 0xc1, 0xdf, 0x0e, 0x02, 0x78, 0xfb, 0x19, 0xb8, 0x69,
++    0x78, 0x4e, 0x9c, 0x52, 0xbc, 0xc7, 0x20, 0xc9, 0xe6, 0x5e, 0x77, 0x22,
++    0x28, 0x3d, 0x0c, 0x9e, 0x68, 0xa8, 0x45, 0xd7
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_int_returnedbits[] = {
++    0xd5, 0xe7, 0x08, 0xc5, 0x19, 0x99, 0xd5, 0x31, 0x03, 0x0a, 0x74, 0xb6,
++    0xb7, 0xed, 0xe9, 0xea
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_entropyinputreseed[] = {
++    0x9c, 0x26, 0xda, 0xf1, 0xac, 0xd9, 0x5a, 0xd6, 0xa8, 0x65, 0xf5, 0x02,
++    0x8f, 0xdc, 0xa2, 0x09, 0x54, 0xa6, 0xe2, 0xa4, 0xde, 0x32, 0xe0, 0x01
++};
++
++__fips_constseg
++    static const unsigned char aes_192_use_df_additionalinputreseed[] = {
++    0x9b, 0x90, 0xb0, 0x3a, 0x0e, 0x3a, 0x80, 0x07, 0x4a, 0xf4, 0xda, 0x76,
++    0x28, 0x30, 0x3c, 0xee, 0x54, 0x1b, 0x94, 0x59, 0x51, 0x43, 0x56, 0x77,
++    0xaf, 0x88, 0xdd, 0x63, 0x89, 0x47, 0x06, 0x65
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_additionalinput2[] = {
++    0x3c, 0x11, 0x64, 0x7a, 0x96, 0xf5, 0xd8, 0xb8, 0xae, 0xd6, 0x70, 0x4e,
++    0x16, 0x96, 0xde, 0xe9, 0x62, 0xbc, 0xee, 0x28, 0x2f, 0x26, 0xa6, 0xf0,
++    0x56, 0xef, 0xa3, 0xf1, 0x6b, 0xa1, 0xb1, 0x77
++};
++
++__fips_constseg static const unsigned char aes_192_use_df_returnedbits[] = {
++    0x0b, 0xe2, 0x56, 0x03, 0x1e, 0xdb, 0x2c, 0x6d, 0x7f, 0x1b, 0x15, 0x58,
++    0x1a, 0xf9, 0x13, 0x28
++};
++
++/* AES-256 use df PR  */
++__fips_constseg static const unsigned char aes_256_use_df_pr_entropyinput[] = {
++    0x61, 0x68, 0xfc, 0x1a, 0xf0, 0xb5, 0x95, 0x6b, 0x85, 0x09, 0x9b, 0x74,
++    0x3f, 0x13, 0x78, 0x49, 0x3b, 0x85, 0xec, 0x93, 0x13, 0x3b, 0xa9, 0x4f,
++    0x96, 0xab, 0x2c, 0xe4, 0xc8, 0x8f, 0xdd, 0x6a
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_pr_nonce[] = {
++    0xad, 0xd2, 0xbb, 0xba, 0xb7, 0x65, 0x89, 0xc3, 0x21, 0x6c, 0x55, 0x33,
++    0x2b, 0x36, 0xff, 0xa4
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_personalizationstring[] = {
++    0x6e, 0xca, 0xe7, 0x20, 0x72, 0xd3, 0x84, 0x5a, 0x32, 0xd3, 0x4b, 0x24,
++    0x72, 0xc4, 0x63, 0x2b, 0x9d, 0x12, 0x24, 0x0c, 0x23, 0x26, 0x8e, 0x83,
++    0x16, 0x37, 0x0b, 0xd1, 0x06, 0x4f, 0x68, 0x6d
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_additionalinput[] = {
++    0x7e, 0x08, 0x4a, 0xbb, 0xe3, 0x21, 0x7c, 0xc9, 0x23, 0xd2, 0xf8, 0xb0,
++    0x73, 0x98, 0xba, 0x84, 0x74, 0x23, 0xab, 0x06, 0x8a, 0xe2, 0x22, 0xd3,
++    0x7b, 0xce, 0x9b, 0xd2, 0x4a, 0x76, 0xb8, 0xde
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_entropyinputpr[] = {
++    0x0b, 0x23, 0xaf, 0xdf, 0xf1, 0x62, 0xd7, 0xd3, 0x43, 0x97, 0xf8, 0x77,
++    0x04, 0xa8, 0x42, 0x20, 0xbd, 0xf6, 0x0f, 0xc1, 0x17, 0x2f, 0x9f, 0x54,
++    0xbb, 0x56, 0x17, 0x86, 0x68, 0x0e, 0xba, 0xa9
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_int_returnedbits[] = {
++    0x31, 0x8e, 0xad, 0xaf, 0x40, 0xeb, 0x6b, 0x74, 0x31, 0x46, 0x80, 0xc7,
++    0x17, 0xab, 0x3c, 0x7a
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_additionalinput2[] = {
++    0x94, 0x6b, 0xc9, 0x9f, 0xab, 0x8d, 0xc5, 0xec, 0x71, 0x88, 0x1d, 0x00,
++    0x8c, 0x89, 0x68, 0xe4, 0xc8, 0x07, 0x77, 0x36, 0x17, 0x6d, 0x79, 0x78,
++    0xc7, 0x06, 0x4e, 0x99, 0x04, 0x28, 0x29, 0xc3
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_pr_entropyinputpr2[] = {
++    0xbf, 0x6c, 0x59, 0x2a, 0x0d, 0x44, 0x0f, 0xae, 0x9a, 0x5e, 0x03, 0x73,
++    0xd8, 0xa6, 0xe1, 0xcf, 0x25, 0x61, 0x38, 0x24, 0x86, 0x9e, 0x53, 0xe8,
++    0xa4, 0xdf, 0x56, 0xf4, 0x06, 0x07, 0x9c, 0x0f
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_pr_returnedbits[] = {
++    0x22, 0x4a, 0xb4, 0xb8, 0xb6, 0xee, 0x7d, 0xb1, 0x9e, 0xc9, 0xf9, 0xa0,
++    0xd9, 0xe2, 0x97, 0x00
++};
++
++/* AES-256 use df No PR  */
++__fips_constseg static const unsigned char aes_256_use_df_entropyinput[] = {
++    0xa5, 0x3e, 0x37, 0x10, 0x17, 0x43, 0x91, 0x93, 0x59, 0x1e, 0x47, 0x50,
++    0x87, 0xaa, 0xdd, 0xd5, 0xc1, 0xc3, 0x86, 0xcd, 0xca, 0x0d, 0xdb, 0x68,
++    0xe0, 0x02, 0xd8, 0x0f, 0xdc, 0x40, 0x1a, 0x47
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_nonce[] = {
++    0xa9, 0x4d, 0xa5, 0x5a, 0xfd, 0xc5, 0x0c, 0xe5, 0x1c, 0x9a, 0x3b, 0x8a,
++    0x4c, 0x44, 0x84, 0x40
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_personalizationstring[] = {
++    0x8b, 0x52, 0xa2, 0x4a, 0x93, 0xc3, 0x4e, 0xa7, 0x1e, 0x1c, 0xa7, 0x05,
++    0xeb, 0x82, 0x9b, 0xa6, 0x5d, 0xe4, 0xd4, 0xe0, 0x7f, 0xa3, 0xd8, 0x6b,
++    0x37, 0x84, 0x5f, 0xf1, 0xc7, 0xd5, 0xf6, 0xd2
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_additionalinput[] = {
++    0x20, 0xf4, 0x22, 0xed, 0xf8, 0x5c, 0xa1, 0x6a, 0x01, 0xcf, 0xbe, 0x5f,
++    0x8d, 0x6c, 0x94, 0x7f, 0xae, 0x12, 0xa8, 0x57, 0xdb, 0x2a, 0xa9, 0xbf,
++    0xc7, 0xb3, 0x65, 0x81, 0x80, 0x8d, 0x0d, 0x46
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_int_returnedbits[] = {
++    0x4e, 0x44, 0xfd, 0xf3, 0x9e, 0x29, 0xa2, 0xb8, 0x0f, 0x5d, 0x6c, 0xe1,
++    0x28, 0x0c, 0x3b, 0xc1
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_entropyinputreseed[] = {
++    0xdd, 0x40, 0xe5, 0x98, 0x7b, 0x27, 0x16, 0x73, 0x15, 0x68, 0xd2, 0x76,
++    0xbf, 0x0c, 0x67, 0x15, 0x75, 0x79, 0x03, 0xd3, 0xde, 0xde, 0x91, 0x46,
++    0x42, 0xdd, 0xd4, 0x67, 0xc8, 0x79, 0xc8, 0x1e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_use_df_additionalinputreseed[] = {
++    0x7f, 0xd8, 0x1f, 0xbd, 0x2a, 0xb5, 0x1c, 0x11, 0x5d, 0x83, 0x4e, 0x99,
++    0xf6, 0x5c, 0xa5, 0x40, 0x20, 0xed, 0x38, 0x8e, 0xd5, 0x9e, 0xe0, 0x75,
++    0x93, 0xfe, 0x12, 0x5e, 0x5d, 0x73, 0xfb, 0x75
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_additionalinput2[] = {
++    0xcd, 0x2c, 0xff, 0x14, 0x69, 0x3e, 0x4c, 0x9e, 0xfd, 0xfe, 0x26, 0x0d,
++    0xe9, 0x86, 0x00, 0x49, 0x30, 0xba, 0xb1, 0xc6, 0x50, 0x57, 0x77, 0x2a,
++    0x62, 0x39, 0x2c, 0x3b, 0x74, 0xeb, 0xc9, 0x0d
++};
++
++__fips_constseg static const unsigned char aes_256_use_df_returnedbits[] = {
++    0x4f, 0x78, 0xbe, 0xb9, 0x4d, 0x97, 0x8c, 0xe9, 0xd0, 0x97, 0xfe, 0xad,
++    0xfa, 0xfd, 0x35, 0x5e
++};
++
++/* AES-128 no df PR  */
++__fips_constseg static const unsigned char aes_128_no_df_pr_entropyinput[] = {
++    0x9a, 0x25, 0x65, 0x10, 0x67, 0xd5, 0xb6, 0x6b, 0x70, 0xa1, 0xb3, 0xa4,
++    0x43, 0x95, 0x80, 0xc0, 0x84, 0x0a, 0x79, 0xb0, 0x88, 0x74, 0xf2, 0xbf,
++    0x31, 0x6c, 0x33, 0x38, 0x0b, 0x00, 0xb2, 0x5a
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_nonce[] = {
++    0x78, 0x47, 0x6b, 0xf7, 0x90, 0x8e, 0x87, 0xf1
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_personalizationstring[] = {
++    0xf7, 0x22, 0x1d, 0x3a, 0xbe, 0x1d, 0xca, 0x32, 0x1b, 0xbd, 0x87, 0x0c,
++    0x51, 0x24, 0x19, 0xee, 0xa3, 0x23, 0x09, 0x63, 0x33, 0x3d, 0xa8, 0x0c,
++    0x1c, 0xfa, 0x42, 0x89, 0xcc, 0x6f, 0xa0, 0xa8
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_additionalinput[] = {
++    0xc9, 0xe0, 0x80, 0xbf, 0x8c, 0x45, 0x58, 0x39, 0xff, 0x00, 0xab, 0x02,
++    0x4c, 0x3e, 0x3a, 0x95, 0x9b, 0x80, 0xa8, 0x21, 0x2a, 0xee, 0xba, 0x73,
++    0xb1, 0xd9, 0xcf, 0x28, 0xf6, 0x8f, 0x9b, 0x12
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_entropyinputpr[] = {
++    0x4c, 0xa8, 0xc5, 0xf0, 0x59, 0x9e, 0xa6, 0x8d, 0x26, 0x53, 0xd7, 0x8a,
++    0xa9, 0xd8, 0xf7, 0xed, 0xb2, 0xf9, 0x12, 0x42, 0xe1, 0xe5, 0xbd, 0xe7,
++    0xe7, 0x1d, 0x74, 0x99, 0x00, 0x9d, 0x31, 0x3e
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_int_returnedbits[] = {
++    0xe2, 0xac, 0x20, 0xf0, 0x80, 0xe7, 0xbc, 0x7e, 0x9c, 0x7b, 0x65, 0x71,
++    0xaf, 0x19, 0x32, 0x16
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_additionalinput2[] = {
++    0x32, 0x7f, 0x38, 0x8b, 0x73, 0x0a, 0x78, 0x83, 0xdc, 0x30, 0xbe, 0x9f,
++    0x10, 0x1f, 0xf5, 0x1f, 0xca, 0x00, 0xb5, 0x0d, 0xd6, 0x9d, 0x60, 0x83,
++    0x51, 0x54, 0x7d, 0x38, 0x23, 0x3a, 0x52, 0x50
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_pr_entropyinputpr2[] = {
++    0x18, 0x61, 0x53, 0x56, 0xed, 0xed, 0xd7, 0x20, 0xfb, 0x71, 0x04, 0x7a,
++    0xb2, 0xac, 0xc1, 0x28, 0xcd, 0xf2, 0xc2, 0xfc, 0xaa, 0xb1, 0x06, 0x07,
++    0xe9, 0x46, 0x95, 0x02, 0x48, 0x01, 0x78, 0xf9
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_pr_returnedbits[] = {
++    0x29, 0xc8, 0x1b, 0x15, 0xb1, 0xd1, 0xc2, 0xf6, 0x71, 0x86, 0x68, 0x33,
++    0x57, 0x82, 0x33, 0xaf
++};
++
++/* AES-128 no df No PR  */
++__fips_constseg static const unsigned char aes_128_no_df_entropyinput[] = {
++    0xc9, 0xc5, 0x79, 0xbc, 0xe8, 0xc5, 0x19, 0xd8, 0xbc, 0x66, 0x73, 0x67,
++    0xf6, 0xd3, 0x72, 0xaa, 0xa6, 0x16, 0xb8, 0x50, 0xb7, 0x47, 0x3a, 0x42,
++    0xab, 0xf4, 0x16, 0xb2, 0x96, 0xd2, 0xb6, 0x60
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_nonce[] = {
++    0x5f, 0xbf, 0x97, 0x0c, 0x4b, 0xa4, 0x87, 0x13
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_personalizationstring[] = {
++    0xce, 0xfb, 0x7b, 0x3f, 0xd4, 0x6b, 0x29, 0x0d, 0x69, 0x06, 0xff, 0xbb,
++    0xf2, 0xe5, 0xc6, 0x6c, 0x0a, 0x10, 0xa0, 0xcf, 0x1a, 0x48, 0xc7, 0x8b,
++    0x3c, 0x16, 0x88, 0xed, 0x50, 0x13, 0x81, 0xce
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_additionalinput[] = {
++    0x4b, 0x22, 0x46, 0x18, 0x02, 0x7b, 0xd2, 0x1b, 0x22, 0x42, 0x7c, 0x37,
++    0xd9, 0xf6, 0xe8, 0x9b, 0x12, 0x30, 0x5f, 0xe9, 0x90, 0xe8, 0x08, 0x24,
++    0x4f, 0x06, 0x66, 0xdb, 0x19, 0x2b, 0x13, 0x95
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_int_returnedbits[] = {
++    0x2e, 0x96, 0x70, 0x64, 0xfa, 0xdf, 0xdf, 0x57, 0xb5, 0x82, 0xee, 0xd6,
++    0xed, 0x3e, 0x65, 0xc2
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_entropyinputreseed[] = {
++    0x26, 0xc0, 0x72, 0x16, 0x3a, 0x4b, 0xb7, 0x99, 0xd4, 0x07, 0xaf, 0x66,
++    0x62, 0x36, 0x96, 0xa4, 0x51, 0x17, 0xfa, 0x07, 0x8b, 0x17, 0x5e, 0xa1,
++    0x2f, 0x3c, 0x10, 0xe7, 0x90, 0xd0, 0x46, 0x00
++};
++
++__fips_constseg
++    static const unsigned char aes_128_no_df_additionalinputreseed[] = {
++    0x83, 0x39, 0x37, 0x7b, 0x02, 0x06, 0xd2, 0x12, 0x13, 0x8d, 0x8b, 0xf2,
++    0xf0, 0xf6, 0x26, 0xeb, 0xa4, 0x22, 0x7b, 0xc2, 0xe7, 0xba, 0x79, 0xe4,
++    0x3b, 0x77, 0x5d, 0x4d, 0x47, 0xb2, 0x2d, 0xb4
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_additionalinput2[] = {
++    0x0b, 0xb9, 0x67, 0x37, 0xdb, 0x83, 0xdf, 0xca, 0x81, 0x8b, 0xf9, 0x3f,
++    0xf1, 0x11, 0x1b, 0x2f, 0xf0, 0x61, 0xa6, 0xdf, 0xba, 0xa3, 0xb1, 0xac,
++    0xd3, 0xe6, 0x09, 0xb8, 0x2c, 0x6a, 0x67, 0xd6
++};
++
++__fips_constseg static const unsigned char aes_128_no_df_returnedbits[] = {
++    0x1e, 0xa7, 0xa4, 0xe4, 0xe1, 0xa6, 0x7c, 0x69, 0x9a, 0x44, 0x6c, 0x36,
++    0x81, 0x37, 0x19, 0xd4
++};
++
++/* AES-192 no df PR  */
++__fips_constseg static const unsigned char aes_192_no_df_pr_entropyinput[] = {
++    0x9d, 0x2c, 0xd2, 0x55, 0x66, 0xea, 0xe0, 0xbe, 0x18, 0xb7, 0x76, 0xe7,
++    0x73, 0x35, 0xd8, 0x1f, 0xad, 0x3a, 0xe3, 0x81, 0x0e, 0x92, 0xd0, 0x61,
++    0xc9, 0x12, 0x26, 0xf6, 0x1c, 0xdf, 0xfe, 0x47, 0xaa, 0xfe, 0x7d, 0x5a,
++    0x17, 0x1f, 0x8d, 0x9a
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_nonce[] = {
++    0x44, 0x82, 0xed, 0xe8, 0x4c, 0x28, 0x5a, 0x14, 0xff, 0x88, 0x8d, 0x19,
++    0x61, 0x5c, 0xee, 0x0f
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_personalizationstring[] = {
++    0x47, 0xd7, 0x9b, 0x99, 0xaa, 0xcb, 0xe7, 0xd2, 0x57, 0x66, 0x2c, 0xe1,
++    0x78, 0xd6, 0x2c, 0xea, 0xa3, 0x23, 0x5f, 0x2a, 0xc1, 0x3a, 0xf0, 0xa4,
++    0x20, 0x3b, 0xfa, 0x07, 0xd5, 0x05, 0x02, 0xe4, 0x57, 0x01, 0xb6, 0x10,
++    0x57, 0x2e, 0xe7, 0x55
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_additionalinput[] = {
++    0x4b, 0x74, 0x0b, 0x40, 0xce, 0x6b, 0xc2, 0x6a, 0x24, 0xb4, 0xf3, 0xad,
++    0x7a, 0xa5, 0x7a, 0xa2, 0x15, 0xe2, 0xc8, 0x61, 0x15, 0xc6, 0xb7, 0x85,
++    0x69, 0x11, 0xad, 0x7b, 0x14, 0xd2, 0xf6, 0x12, 0xa1, 0x95, 0x5d, 0x3f,
++    0xe2, 0xd0, 0x0c, 0x2f
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_entropyinputpr[] = {
++    0x0c, 0x9c, 0xad, 0x05, 0xee, 0xae, 0x48, 0x23, 0x89, 0x59, 0xa1, 0x94,
++    0xd7, 0xd8, 0x75, 0xd5, 0x54, 0x93, 0xc7, 0x4a, 0xd9, 0x26, 0xde, 0xeb,
++    0xba, 0xb0, 0x7e, 0x30, 0x1d, 0x5f, 0x69, 0x40, 0x9c, 0x3b, 0x17, 0x58,
++    0x1d, 0x30, 0xb3, 0x78
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_int_returnedbits[] = {
++    0xf7, 0x93, 0xb0, 0x6d, 0x77, 0x83, 0xd5, 0x38, 0x01, 0xe1, 0x52, 0x40,
++    0x7e, 0x3e, 0x0c, 0x26
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_additionalinput2[] = {
++    0xbc, 0x4b, 0x37, 0x44, 0x1c, 0xc5, 0x45, 0x5f, 0x8f, 0x51, 0x62, 0x8a,
++    0x85, 0x30, 0x1d, 0x7c, 0xe4, 0xcf, 0xf7, 0x44, 0xce, 0x32, 0x3e, 0x57,
++    0x95, 0xa4, 0x2a, 0xdf, 0xfd, 0x9e, 0x38, 0x41, 0xb3, 0xf6, 0xc5, 0xee,
++    0x0c, 0x4b, 0xee, 0x6e
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_pr_entropyinputpr2[] = {
++    0xec, 0xaf, 0xf6, 0x4f, 0xb1, 0xa0, 0x54, 0xb5, 0x5b, 0xe3, 0x46, 0xb0,
++    0x76, 0x5a, 0x7c, 0x3f, 0x7b, 0x94, 0x69, 0x21, 0x51, 0x02, 0xe5, 0x9f,
++    0x04, 0x59, 0x02, 0x98, 0xc6, 0x43, 0x2c, 0xcc, 0x26, 0x4c, 0x87, 0x6b,
++    0x8e, 0x0a, 0x83, 0xdf
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_pr_returnedbits[] = {
++    0x74, 0x45, 0xfb, 0x53, 0x84, 0x96, 0xbe, 0xff, 0x15, 0xcc, 0x41, 0x91,
++    0xb9, 0xa1, 0x21, 0x68
++};
++
++/* AES-192 no df No PR  */
++__fips_constseg static const unsigned char aes_192_no_df_entropyinput[] = {
++    0x3c, 0x7d, 0xb5, 0xe0, 0x54, 0xd9, 0x6e, 0x8c, 0xa9, 0x86, 0xce, 0x4e,
++    0x6b, 0xaf, 0xeb, 0x2f, 0xe7, 0x75, 0xe0, 0x8b, 0xa4, 0x3b, 0x07, 0xfe,
++    0xbe, 0x33, 0x75, 0x93, 0x80, 0x27, 0xb5, 0x29, 0x47, 0x8b, 0xc7, 0x28,
++    0x94, 0xc3, 0x59, 0x63
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_nonce[] = {
++    0x43, 0xf1, 0x7d, 0xb8, 0xc3, 0xfe, 0xd0, 0x23, 0x6b, 0xb4, 0x92, 0xdb,
++    0x29, 0xfd, 0x45, 0x71
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_personalizationstring[] = {
++    0x9f, 0x24, 0x29, 0x99, 0x9e, 0x01, 0xab, 0xe9, 0x19, 0xd8, 0x23, 0x08,
++    0xb7, 0xd6, 0x7e, 0x8c, 0xc0, 0x9e, 0x7f, 0x6e, 0x5b, 0x33, 0x20, 0x96,
++    0x0b, 0x23, 0x2c, 0xa5, 0x6a, 0xf8, 0x1b, 0x04, 0x26, 0xdb, 0x2e, 0x2b,
++    0x3b, 0x88, 0xce, 0x35
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_additionalinput[] = {
++    0x94, 0xe9, 0x7c, 0x3d, 0xa7, 0xdb, 0x60, 0x83, 0x1f, 0x98, 0x3f, 0x0b,
++    0x88, 0x59, 0x57, 0x51, 0x88, 0x9f, 0x76, 0x49, 0x9f, 0xa6, 0xda, 0x71,
++    0x1d, 0x0d, 0x47, 0x16, 0x63, 0xc5, 0x68, 0xe4, 0x5d, 0x39, 0x69, 0xb3,
++    0x3e, 0xbe, 0xd4, 0x8e
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_int_returnedbits[] = {
++    0xf9, 0xd7, 0xad, 0x69, 0xab, 0x8f, 0x23, 0x56, 0x70, 0x17, 0x4f, 0x2a,
++    0x45, 0xe7, 0x4a, 0xc5
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_entropyinputreseed[] = {
++    0xa6, 0x71, 0x6a, 0x3d, 0xba, 0xd1, 0xe8, 0x66, 0xa6, 0xef, 0xb2, 0x0e,
++    0xa8, 0x9c, 0xaa, 0x4e, 0xaf, 0x17, 0x89, 0x50, 0x00, 0xda, 0xa1, 0xb1,
++    0x0b, 0xa4, 0xd9, 0x35, 0x89, 0xc8, 0xe5, 0xb0, 0xd9, 0xb7, 0xc4, 0x33,
++    0x9b, 0xcb, 0x7e, 0x75
++};
++
++__fips_constseg
++    static const unsigned char aes_192_no_df_additionalinputreseed[] = {
++    0x27, 0x21, 0xfc, 0xc2, 0xbd, 0xf3, 0x3c, 0xce, 0xc3, 0xca, 0xc1, 0x01,
++    0xe0, 0xff, 0x93, 0x12, 0x7d, 0x54, 0x42, 0xe3, 0x9f, 0x03, 0xdf, 0x27,
++    0x04, 0x07, 0x3c, 0x53, 0x7f, 0xa8, 0x66, 0xc8, 0x97, 0x4b, 0x61, 0x40,
++    0x5d, 0x7a, 0x25, 0x79
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_additionalinput2[] = {
++    0x2d, 0x8e, 0x16, 0x5d, 0x0b, 0x9f, 0xeb, 0xaa, 0xd6, 0xec, 0x28, 0x71,
++    0x7c, 0x0b, 0xc1, 0x1d, 0xd4, 0x44, 0x19, 0x47, 0xfd, 0x1d, 0x7c, 0xe5,
++    0xf3, 0x27, 0xe1, 0xb6, 0x72, 0x0a, 0xe0, 0xec, 0x0e, 0xcd, 0xef, 0x1a,
++    0x91, 0x6a, 0xe3, 0x5f
++};
++
++__fips_constseg static const unsigned char aes_192_no_df_returnedbits[] = {
++    0xe5, 0xda, 0xb8, 0xe0, 0x63, 0x59, 0x5a, 0xcc, 0x3d, 0xdc, 0x9f, 0xe8,
++    0x66, 0x67, 0x2c, 0x92
++};
++
++/* AES-256 no df PR  */
++__fips_constseg static const unsigned char aes_256_no_df_pr_entropyinput[] = {
++    0x15, 0xc7, 0x5d, 0xcb, 0x41, 0x4b, 0x16, 0x01, 0x3a, 0xd1, 0x44, 0xe8,
++    0x22, 0x32, 0xc6, 0x9c, 0x3f, 0xe7, 0x43, 0xf5, 0x9a, 0xd3, 0xea, 0xf2,
++    0xd7, 0x4e, 0x6e, 0x6a, 0x55, 0x73, 0x40, 0xef, 0x89, 0xad, 0x0d, 0x03,
++    0x96, 0x7e, 0x78, 0x81, 0x2f, 0x91, 0x1b, 0x44, 0xb0, 0x02, 0xba, 0x1c
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_nonce[] = {
++    0xdc, 0xe4, 0xd4, 0x27, 0x7a, 0x90, 0xd7, 0x99, 0x43, 0xa1, 0x3c, 0x30,
++    0xcc, 0x4b, 0xee, 0x2e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_personalizationstring[] = {
++    0xe3, 0xe6, 0xb9, 0x11, 0xe4, 0x7a, 0xa4, 0x40, 0x6b, 0xf8, 0x73, 0xf7,
++    0x7e, 0xec, 0xc7, 0xb9, 0x97, 0xbf, 0xf8, 0x25, 0x7b, 0xbe, 0x11, 0x9b,
++    0x5b, 0x6a, 0x0c, 0x2e, 0x2b, 0x01, 0x51, 0xcd, 0x41, 0x4b, 0x6b, 0xac,
++    0x31, 0xa8, 0x0b, 0xf7, 0xe6, 0x59, 0x42, 0xb8, 0x03, 0x0c, 0xf8, 0x06
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_additionalinput[] = {
++    0x6a, 0x9f, 0x00, 0x91, 0xae, 0xfe, 0xcf, 0x84, 0x99, 0xce, 0xb1, 0x40,
++    0x6d, 0x5d, 0x33, 0x28, 0x84, 0xf4, 0x8c, 0x63, 0x4c, 0x7e, 0xbd, 0x2c,
++    0x80, 0x76, 0xee, 0x5a, 0xaa, 0x15, 0x07, 0x31, 0xd8, 0xbb, 0x8c, 0x69,
++    0x9d, 0x9d, 0xbc, 0x7e, 0x49, 0xae, 0xec, 0x39, 0x6b, 0xd1, 0x1f, 0x7e
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_entropyinputpr[] = {
++    0xf3, 0xb9, 0x75, 0x9c, 0xbd, 0x88, 0xea, 0xa2, 0x50, 0xad, 0xd6, 0x16,
++    0x1a, 0x12, 0x3c, 0x86, 0x68, 0xaf, 0x6f, 0xbe, 0x19, 0xf2, 0xee, 0xcc,
++    0xa5, 0x70, 0x84, 0x53, 0x50, 0xcb, 0x9f, 0x14, 0xa9, 0xe5, 0xee, 0xb9,
++    0x48, 0x45, 0x40, 0xe2, 0xc7, 0xc9, 0x9a, 0x74, 0xff, 0x8c, 0x99, 0x1f
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_int_returnedbits[] = {
++    0x2e, 0xf2, 0x45, 0x4c, 0x62, 0x2e, 0x0a, 0xb9, 0x6b, 0xa2, 0xfd, 0x56,
++    0x79, 0x60, 0x93, 0xcf
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_additionalinput2[] = {
++    0xaf, 0x69, 0x20, 0xe9, 0x3b, 0x37, 0x9d, 0x3f, 0xb4, 0x80, 0x02, 0x7a,
++    0x25, 0x7d, 0xb8, 0xde, 0x71, 0xc5, 0x06, 0x0c, 0xb4, 0xe2, 0x8f, 0x35,
++    0xd8, 0x14, 0x0d, 0x7f, 0x76, 0x63, 0x4e, 0xb5, 0xee, 0xe9, 0x6f, 0x34,
++    0xc7, 0x5f, 0x56, 0x14, 0x4a, 0xe8, 0x73, 0x95, 0x5b, 0x1c, 0xb9, 0xcb
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_pr_entropyinputpr2[] = {
++    0xe5, 0xb0, 0x2e, 0x7e, 0x52, 0x30, 0xe3, 0x63, 0x82, 0xb6, 0x44, 0xd3,
++    0x25, 0x19, 0x05, 0x24, 0x9a, 0x9f, 0x5f, 0x27, 0x6a, 0x29, 0xab, 0xfa,
++    0x07, 0xa2, 0x42, 0x0f, 0xc5, 0xa8, 0x94, 0x7c, 0x17, 0x7b, 0x85, 0x83,
++    0x0c, 0x25, 0x0e, 0x63, 0x0b, 0xe9, 0x12, 0x60, 0xcd, 0xef, 0x80, 0x0f
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_pr_returnedbits[] = {
++    0x5e, 0xf2, 0x26, 0xef, 0x9f, 0x58, 0x5d, 0xd5, 0x4a, 0x10, 0xfe, 0xa7,
++    0x2d, 0x5f, 0x4a, 0x46
++};
++
++/* AES-256 no df No PR  */
++__fips_constseg static const unsigned char aes_256_no_df_entropyinput[] = {
++    0xfb, 0xcf, 0x1b, 0x61, 0x16, 0x89, 0x78, 0x23, 0xf5, 0xd8, 0x96, 0xe3,
++    0x4e, 0x64, 0x0b, 0x29, 0x9a, 0x3f, 0xf8, 0xa5, 0xed, 0xf2, 0xfe, 0xdb,
++    0x16, 0xca, 0x7f, 0x10, 0xfa, 0x5e, 0x18, 0x76, 0x2c, 0x63, 0x5e, 0x96,
++    0xcf, 0xb3, 0xd6, 0xfc, 0xaf, 0x99, 0x39, 0x28, 0x9c, 0x61, 0xe8, 0xb3
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_nonce[] = {
++    0x12, 0x96, 0xf0, 0x52, 0xf3, 0x8d, 0x81, 0xcf, 0xde, 0x86, 0xf2, 0x99,
++    0x43, 0x96, 0xb9, 0xf0
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_personalizationstring[] = {
++    0x63, 0x0d, 0x78, 0xf5, 0x90, 0x8e, 0x32, 0x47, 0xb0, 0x4d, 0x37, 0x60,
++    0x09, 0x96, 0xbc, 0xbf, 0x97, 0x7a, 0x62, 0x14, 0x45, 0xbd, 0x8d, 0xcc,
++    0x69, 0xfb, 0x03, 0xe1, 0x80, 0x1c, 0xc7, 0xe2, 0x2a, 0xf9, 0x37, 0x3f,
++    0x66, 0x4d, 0x62, 0xd9, 0x10, 0xe0, 0xad, 0xc8, 0x9a, 0xf0, 0xa8, 0x6d
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_additionalinput[] = {
++    0x36, 0xc6, 0x13, 0x60, 0xbb, 0x14, 0xad, 0x22, 0xb0, 0x38, 0xac, 0xa6,
++    0x18, 0x16, 0x93, 0x25, 0x86, 0xb7, 0xdc, 0xdc, 0x36, 0x98, 0x2b, 0xf9,
++    0x68, 0x33, 0xd3, 0xc6, 0xff, 0xce, 0x8d, 0x15, 0x59, 0x82, 0x76, 0xed,
++    0x6f, 0x8d, 0x49, 0x74, 0x2f, 0xda, 0xdc, 0x1f, 0x17, 0xd0, 0xde, 0x17
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_int_returnedbits[] = {
++    0x16, 0x2f, 0x8e, 0x3f, 0x21, 0x7a, 0x1c, 0x20, 0x56, 0xd1, 0x92, 0xf6,
++    0xd2, 0x25, 0x75, 0x0e
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_entropyinputreseed[] = {
++    0x91, 0x79, 0x76, 0xee, 0xe0, 0xcf, 0x9e, 0xc2, 0xd5, 0xd4, 0x23, 0x9b,
++    0x12, 0x8c, 0x7e, 0x0a, 0xb7, 0xd2, 0x8b, 0xd6, 0x7c, 0xa3, 0xc6, 0xe5,
++    0x0e, 0xaa, 0xc7, 0x6b, 0xae, 0x0d, 0xfa, 0x53, 0x06, 0x79, 0xa1, 0xed,
++    0x4d, 0x6a, 0x0e, 0xd8, 0x9d, 0xbe, 0x1b, 0x31, 0x93, 0x7b, 0xec, 0xfb
++};
++
++__fips_constseg
++    static const unsigned char aes_256_no_df_additionalinputreseed[] = {
++    0xd2, 0x46, 0x50, 0x22, 0x10, 0x14, 0x63, 0xf7, 0xea, 0x0f, 0xb9, 0x7e,
++    0x0d, 0xe1, 0x94, 0x07, 0xaf, 0x09, 0x44, 0x31, 0xea, 0x64, 0xa4, 0x18,
++    0x5b, 0xf9, 0xd8, 0xc2, 0xfa, 0x03, 0x47, 0xc5, 0x39, 0x43, 0xd5, 0x3b,
++    0x62, 0x86, 0x64, 0xea, 0x2c, 0x73, 0x8c, 0xae, 0x9d, 0x98, 0x98, 0x29
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_additionalinput2[] = {
++    0x8c, 0xab, 0x18, 0xf8, 0xc3, 0xec, 0x18, 0x5c, 0xb3, 0x1e, 0x9d, 0xbe,
++    0x3f, 0x03, 0xb4, 0x00, 0x98, 0x9d, 0xae, 0xeb, 0xf4, 0x94, 0xf8, 0x42,
++    0x8f, 0xe3, 0x39, 0x07, 0xe1, 0xc9, 0xad, 0x0b, 0x1f, 0xed, 0xc0, 0xba,
++    0xf6, 0xd1, 0xec, 0x27, 0x86, 0x7b, 0xd6, 0x55, 0x9b, 0x60, 0xa5, 0xc6
++};
++
++__fips_constseg static const unsigned char aes_256_no_df_returnedbits[] = {
++    0xef, 0xd2, 0xd8, 0x5c, 0xdc, 0x62, 0x25, 0x9f, 0xaa, 0x1e, 0x2c, 0x67,
++    0xf6, 0x02, 0x32, 0xe2
++};
++
++/* SHA-1 PR  */
++__fips_constseg static const unsigned char sha1_pr_entropyinput[] = {
++    0xd2, 0x36, 0xa5, 0x27, 0x31, 0x73, 0xdd, 0x11, 0x4f, 0x93, 0xbd, 0xe2,
++    0x31, 0xa5, 0x91, 0x13
++};
++
++__fips_constseg static const unsigned char sha1_pr_nonce[] = {
++    0xb5, 0xb3, 0x60, 0xef, 0xf7, 0x63, 0x31, 0xf3
++};
++
++__fips_constseg static const unsigned char sha1_pr_personalizationstring[] = {
++    0xd4, 0xbb, 0x02, 0x10, 0xb2, 0x71, 0xdb, 0x81, 0xd6, 0xf0, 0x42, 0x60,
++    0xda, 0xea, 0x77, 0x52
++};
++
++__fips_constseg static const unsigned char sha1_pr_additionalinput[] = {
++    0x4d, 0xd2, 0x6c, 0x87, 0xfb, 0x2c, 0x4f, 0xa6, 0x8d, 0x16, 0x63, 0x22,
++    0x6a, 0x51, 0xe3, 0xf8
++};
++
++__fips_constseg static const unsigned char sha1_pr_entropyinputpr[] = {
++    0xc9, 0x83, 0x9e, 0x16, 0xf6, 0x1c, 0x0f, 0xb2, 0xec, 0x60, 0x31, 0xa9,
++    0xcb, 0xa9, 0x36, 0x7a
++};
++
++__fips_constseg static const unsigned char sha1_pr_int_returnedbits[] = {
++    0xa8, 0x13, 0x4f, 0xf4, 0x31, 0x02, 0x44, 0xe3, 0xd3, 0x3d, 0x61, 0x9e,
++    0xe5, 0xc6, 0x3e, 0x89, 0xb5, 0x9b, 0x0f, 0x35
++};
++
++__fips_constseg static const unsigned char sha1_pr_additionalinput2[] = {
++    0xf9, 0xe8, 0xd2, 0x72, 0x13, 0x34, 0x95, 0x6f, 0x15, 0x49, 0x47, 0x99,
++    0x16, 0x03, 0x19, 0x47
++};
++
++__fips_constseg static const unsigned char sha1_pr_entropyinputpr2[] = {
++    0x4e, 0x8c, 0x49, 0x9b, 0x4a, 0x5c, 0x9b, 0x9c, 0x3a, 0xee, 0xfb, 0xd2,
++    0xae, 0xcd, 0x8c, 0xc4
++};
++
++__fips_constseg static const unsigned char sha1_pr_returnedbits[] = {
++    0x50, 0xb4, 0xb4, 0xcd, 0x68, 0x57, 0xfc, 0x2e, 0xc1, 0x52, 0xcc, 0xf6,
++    0x68, 0xa4, 0x81, 0xed, 0x7e, 0xe4, 0x1d, 0x87
++};
++
++/* SHA-1 No PR  */
++__fips_constseg static const unsigned char sha1_entropyinput[] = {
++    0xa9, 0x47, 0x1b, 0x29, 0x2d, 0x1c, 0x05, 0xdf, 0x76, 0xd0, 0x62, 0xf9,
++    0xe2, 0x7f, 0x4c, 0x7b
++};
++
++__fips_constseg static const unsigned char sha1_nonce[] = {
++    0x53, 0x23, 0x24, 0xe3, 0xec, 0x0c, 0x54, 0x14
++};
++
++__fips_constseg static const unsigned char sha1_personalizationstring[] = {
++    0x7a, 0x87, 0xa1, 0xac, 0x1c, 0xfd, 0xab, 0xae, 0xf7, 0xd6, 0xfb, 0x76,
++    0x28, 0xec, 0x6d, 0xca
++};
++
++__fips_constseg static const unsigned char sha1_additionalinput[] = {
++    0xfc, 0x92, 0x35, 0xd6, 0x7e, 0xb7, 0x24, 0x65, 0xfd, 0x12, 0x27, 0x35,
++    0xc0, 0x72, 0xca, 0x28
++};
++
++__fips_constseg static const unsigned char sha1_int_returnedbits[] = {
++    0x57, 0x88, 0x82, 0xe5, 0x25, 0xa5, 0x2c, 0x4a, 0x06, 0x20, 0x6c, 0x72,
++    0x55, 0x61, 0xdd, 0x90, 0x71, 0x9f, 0x95, 0xea
++};
++
++__fips_constseg static const unsigned char sha1_entropyinputreseed[] = {
++    0x69, 0xa5, 0x40, 0x62, 0x98, 0x47, 0x56, 0x73, 0x4a, 0x8f, 0x60, 0x96,
++    0xd6, 0x99, 0x27, 0xed
++};
++
++__fips_constseg static const unsigned char sha1_additionalinputreseed[] = {
++    0xe5, 0x40, 0x4e, 0xbd, 0x50, 0x00, 0xf5, 0x15, 0xa6, 0xee, 0x45, 0xda,
++    0x84, 0x3d, 0xd4, 0xc0
++};
++
++__fips_constseg static const unsigned char sha1_additionalinput2[] = {
++    0x11, 0x51, 0x14, 0xf0, 0x09, 0x1b, 0x4e, 0x56, 0x0d, 0xe9, 0xf6, 0x1e,
++    0x52, 0x65, 0xcd, 0x96
++};
++
++__fips_constseg static const unsigned char sha1_returnedbits[] = {
++    0xa1, 0x9c, 0x94, 0x6e, 0x29, 0xe1, 0x33, 0x0d, 0x32, 0xd6, 0xaa, 0xce,
++    0x71, 0x3f, 0x52, 0x72, 0x8b, 0x42, 0xa8, 0xd7
++};
++
++/* SHA-224 PR  */
++__fips_constseg static const unsigned char sha224_pr_entropyinput[] = {
++    0x12, 0x69, 0x32, 0x4f, 0x83, 0xa6, 0xf5, 0x14, 0xe3, 0x49, 0x3e, 0x75,
++    0x3e, 0xde, 0xad, 0xa1, 0x29, 0xc3, 0xf3, 0x19, 0x20, 0xb5, 0x4c, 0xd9
++};
++
++__fips_constseg static const unsigned char sha224_pr_nonce[] = {
++    0x6a, 0x78, 0xd0, 0xeb, 0xbb, 0x5a, 0xf0, 0xee, 0xe8, 0xc3, 0xba, 0x71
++};
++
++__fips_constseg static const unsigned char sha224_pr_personalizationstring[] = {
++    0xd5, 0xb8, 0xb6, 0xbc, 0xc1, 0x5b, 0x60, 0x31, 0x3c, 0xf5, 0xe5, 0xc0,
++    0x8e, 0x52, 0x7a, 0xbd, 0xea, 0x47, 0xa9, 0x5f, 0x8f, 0xf9, 0x8b, 0xae
++};
++
++__fips_constseg static const unsigned char sha224_pr_additionalinput[] = {
++    0x1f, 0x55, 0xec, 0xae, 0x16, 0x12, 0x84, 0xba, 0x84, 0x16, 0x19, 0x88,
++    0x8e, 0xb8, 0x33, 0x25, 0x54, 0xff, 0xca, 0x79, 0xaf, 0x07, 0x25, 0x50
++};
++
++__fips_constseg static const unsigned char sha224_pr_entropyinputpr[] = {
++    0x92, 0xa3, 0x32, 0xa8, 0x9a, 0x0a, 0x58, 0x7c, 0x1d, 0x5a, 0x7e, 0xe1,
++    0xb2, 0x73, 0xab, 0x0e, 0x16, 0x79, 0x23, 0xd3, 0x29, 0x89, 0x81, 0xe1
++};
++
++__fips_constseg static const unsigned char sha224_pr_int_returnedbits[] = {
++    0xf3, 0x38, 0x91, 0x40, 0x37, 0x7a, 0x51, 0x72, 0x42, 0x74, 0x78, 0x0a,
++    0x69, 0xfd, 0xa6, 0x44, 0x43, 0x45, 0x6c, 0x0c, 0x5a, 0x19, 0xff, 0xf1,
++    0x54, 0x60, 0xee, 0x6a
++};
++
++__fips_constseg static const unsigned char sha224_pr_additionalinput2[] = {
++    0x75, 0xf3, 0x04, 0x25, 0xdd, 0x36, 0xa8, 0x37, 0x46, 0xae, 0x0c, 0x52,
++    0x05, 0x79, 0x4c, 0x26, 0xdb, 0xe9, 0x71, 0x16, 0x4c, 0x0a, 0xf2, 0x60
++};
++
++__fips_constseg static const unsigned char sha224_pr_entropyinputpr2[] = {
++    0xea, 0xc5, 0x03, 0x0a, 0x4f, 0xb0, 0x38, 0x8d, 0x23, 0xd4, 0xc8, 0x77,
++    0xe2, 0x6d, 0x9c, 0x0b, 0x44, 0xf7, 0x2d, 0x5b, 0xbf, 0x5d, 0x2a, 0x11
++};
++
++__fips_constseg static const unsigned char sha224_pr_returnedbits[] = {
++    0x60, 0x50, 0x2b, 0xe7, 0x86, 0xd8, 0x26, 0x73, 0xe3, 0x1d, 0x95, 0x20,
++    0xb3, 0x2c, 0x32, 0x1c, 0xf5, 0xce, 0x57, 0xa6, 0x67, 0x2b, 0xdc, 0x4e,
++    0xdd, 0x11, 0x4c, 0xc4
++};
++
++/* SHA-224 No PR  */
++__fips_constseg static const unsigned char sha224_entropyinput[] = {
++    0xb2, 0x1c, 0x77, 0x4d, 0xf6, 0xd3, 0xb6, 0x40, 0xb7, 0x30, 0x3e, 0x29,
++    0xb0, 0x85, 0x1c, 0xbe, 0x4a, 0xea, 0x6b, 0x5a, 0xb5, 0x8a, 0x97, 0xeb
++};
++
++__fips_constseg static const unsigned char sha224_nonce[] = {
++    0x42, 0x02, 0x0a, 0x1c, 0x98, 0x9a, 0x77, 0x9e, 0x9f, 0x80, 0xba, 0xe0
++};
++
++__fips_constseg static const unsigned char sha224_personalizationstring[] = {
++    0x98, 0xb8, 0x04, 0x41, 0xfc, 0xc1, 0x5d, 0xc5, 0xe9, 0xb9, 0x08, 0xda,
++    0xf9, 0xfa, 0x0d, 0x90, 0xce, 0xdf, 0x1d, 0x10, 0xa9, 0x8d, 0x50, 0x0c
++};
++
++__fips_constseg static const unsigned char sha224_additionalinput[] = {
++    0x9a, 0x8d, 0x39, 0x49, 0x42, 0xd5, 0x0b, 0xae, 0xe1, 0xaf, 0xb7, 0x00,
++    0x02, 0xfa, 0x96, 0xb1, 0xa5, 0x1d, 0x2d, 0x25, 0x78, 0xee, 0x83, 0x3f
++};
++
++__fips_constseg static const unsigned char sha224_int_returnedbits[] = {
++    0xe4, 0xf5, 0x53, 0x79, 0x5a, 0x97, 0x58, 0x06, 0x08, 0xba, 0x7b, 0xfa,
++    0xf0, 0x83, 0x05, 0x8c, 0x22, 0xc0, 0xc9, 0xdb, 0x15, 0xe7, 0xde, 0x20,
++    0x55, 0x22, 0x9a, 0xad
++};
++
++__fips_constseg static const unsigned char sha224_entropyinputreseed[] = {
++    0x67, 0x09, 0x48, 0xaa, 0x07, 0x16, 0x99, 0x89, 0x7f, 0x6d, 0xa0, 0xe5,
++    0x8f, 0xdf, 0xbc, 0xdb, 0xfe, 0xe5, 0x6c, 0x7a, 0x95, 0x4a, 0x66, 0x17
++};
++
++__fips_constseg static const unsigned char sha224_additionalinputreseed[] = {
++    0x0f, 0x4b, 0x1c, 0x6f, 0xb7, 0xe3, 0x47, 0xe5, 0x5d, 0x7d, 0x38, 0xd6,
++    0x28, 0x9b, 0xeb, 0x55, 0x63, 0x09, 0x3e, 0x7c, 0x56, 0xea, 0xf8, 0x19
++};
++
++__fips_constseg static const unsigned char sha224_additionalinput2[] = {
++    0x2d, 0x26, 0x7c, 0x37, 0xe4, 0x7a, 0x28, 0x5e, 0x5a, 0x3c, 0xaf, 0x3d,
++    0x5a, 0x8e, 0x55, 0xa2, 0x1a, 0x6e, 0xc0, 0xe5, 0xf6, 0x21, 0xd3, 0xf6
++};
++
++__fips_constseg static const unsigned char sha224_returnedbits[] = {
++    0x4d, 0x83, 0x35, 0xdf, 0x67, 0xa9, 0xfc, 0x17, 0xda, 0x70, 0xcc, 0x8b,
++    0x7f, 0x77, 0xae, 0xa2, 0x5f, 0xb9, 0x7e, 0x74, 0x4c, 0x26, 0xc1, 0x7a,
++    0x3b, 0xa7, 0x5c, 0x93
++};
++
++/* SHA-256 PR  */
++__fips_constseg static const unsigned char sha256_pr_entropyinput[] = {
++    0xce, 0x49, 0x00, 0x7a, 0x56, 0xe3, 0x67, 0x8f, 0xe1, 0xb6, 0xa7, 0xd4,
++    0x4f, 0x08, 0x7a, 0x1b, 0x01, 0xf4, 0xfa, 0x6b, 0xef, 0xb7, 0xe5, 0xeb,
++    0x07, 0x3d, 0x11, 0x0d, 0xc8, 0xea, 0x2b, 0xfe
++};
++
++__fips_constseg static const unsigned char sha256_pr_nonce[] = {
++    0x73, 0x41, 0xc8, 0x92, 0x94, 0xe2, 0xc5, 0x5f, 0x93, 0xfd, 0x39, 0x5d,
++    0x2b, 0x91, 0x4d, 0x38
++};
++
++__fips_constseg static const unsigned char sha256_pr_personalizationstring[] = {
++    0x50, 0x6d, 0x01, 0x01, 0x07, 0x5a, 0x80, 0x35, 0x7a, 0x56, 0x1a, 0x56,
++    0x2f, 0x9a, 0x0b, 0x35, 0xb2, 0xb1, 0xc9, 0xe5, 0xca, 0x69, 0x61, 0x48,
++    0xff, 0xfb, 0x0f, 0xd9, 0x4b, 0x79, 0x1d, 0xba
++};
++
++__fips_constseg static const unsigned char sha256_pr_additionalinput[] = {
++    0x20, 0xb8, 0xdf, 0x44, 0x77, 0x5a, 0xb8, 0xd3, 0xbf, 0xf6, 0xcf, 0xac,
++    0x5e, 0xa6, 0x96, 0x62, 0x73, 0x44, 0x40, 0x4a, 0x30, 0xfb, 0x38, 0xa5,
++    0x7b, 0x0d, 0xe4, 0x0d, 0xc6, 0xe4, 0x9a, 0x1f
++};
++
++__fips_constseg static const unsigned char sha256_pr_entropyinputpr[] = {
++    0x04, 0xc4, 0x65, 0xf4, 0xd3, 0xbf, 0x83, 0x4b, 0xab, 0xc8, 0x41, 0xa8,
++    0xc2, 0xe0, 0x44, 0x63, 0x77, 0x4c, 0x6f, 0x6c, 0x49, 0x46, 0xff, 0x94,
++    0x17, 0xea, 0xe6, 0x1a, 0x9d, 0x5e, 0x66, 0x78
++};
++
++__fips_constseg static const unsigned char sha256_pr_int_returnedbits[] = {
++    0x07, 0x4d, 0xac, 0x9b, 0x86, 0xca, 0x4a, 0xaa, 0x6e, 0x7a, 0x03, 0xa2,
++    0x5d, 0x10, 0xea, 0x0b, 0xf9, 0x83, 0xcc, 0xd1, 0xfc, 0xe2, 0x07, 0xc7,
++    0x06, 0x34, 0x60, 0x6f, 0x83, 0x94, 0x99, 0x76
++};
++
++__fips_constseg static const unsigned char sha256_pr_additionalinput2[] = {
++    0x89, 0x4e, 0x45, 0x8c, 0x11, 0xf9, 0xbc, 0x5b, 0xac, 0x74, 0x8b, 0x4b,
++    0x5f, 0xf7, 0x19, 0xf3, 0xf5, 0x24, 0x54, 0x14, 0xd1, 0x15, 0xb1, 0x43,
++    0x12, 0xa4, 0x5f, 0xd4, 0xec, 0xfc, 0xcd, 0x09
++};
++
++__fips_constseg static const unsigned char sha256_pr_entropyinputpr2[] = {
++    0x0e, 0xeb, 0x1f, 0xd7, 0xfc, 0xd1, 0x9d, 0xd4, 0x05, 0x36, 0x8b, 0xb2,
++    0xfb, 0xe4, 0xf4, 0x51, 0x0c, 0x87, 0x9b, 0x02, 0x44, 0xd5, 0x92, 0x4d,
++    0x44, 0xfe, 0x1a, 0x03, 0x43, 0x56, 0xbd, 0x86
++};
++
++__fips_constseg static const unsigned char sha256_pr_returnedbits[] = {
++    0x02, 0xaa, 0xb6, 0x1d, 0x7e, 0x2a, 0x40, 0x03, 0x69, 0x2d, 0x49, 0xa3,
++    0x41, 0xe7, 0x44, 0x0b, 0xaf, 0x7b, 0x85, 0xe4, 0x5f, 0x53, 0x3b, 0x64,
++    0xbc, 0x89, 0xc8, 0x82, 0xd4, 0x78, 0x37, 0xa2
++};
++
++/* SHA-256 No PR  */
++__fips_constseg static const unsigned char sha256_entropyinput[] = {
++    0x5b, 0x1b, 0xec, 0x4d, 0xa9, 0x38, 0x74, 0x5a, 0x34, 0x0b, 0x7b, 0xc5,
++    0xe5, 0xd7, 0x66, 0x7c, 0xbc, 0x82, 0xb9, 0x0e, 0x2d, 0x1f, 0x92, 0xd7,
++    0xc1, 0xbc, 0x67, 0x69, 0xec, 0x6b, 0x03, 0x3c
++};
++
++__fips_constseg static const unsigned char sha256_nonce[] = {
++    0xa4, 0x0c, 0xd8, 0x9c, 0x61, 0xd8, 0xc3, 0x54, 0xfe, 0x53, 0xc9, 0xe5,
++    0x5d, 0x6f, 0x6d, 0x35
++};
++
++__fips_constseg static const unsigned char sha256_personalizationstring[] = {
++    0x22, 0x5e, 0x62, 0x93, 0x42, 0x83, 0x78, 0x24, 0xd8, 0x40, 0x8c, 0xde,
++    0x6f, 0xf9, 0xa4, 0x7a, 0xc5, 0xa7, 0x3b, 0x88, 0xa3, 0xee, 0x42, 0x20,
++    0xfd, 0x61, 0x56, 0xc6, 0x4c, 0x13, 0x41, 0x9c
++};
++
++__fips_constseg static const unsigned char sha256_additionalinput[] = {
++    0xbf, 0x74, 0x5b, 0xf6, 0xc5, 0x64, 0x5e, 0x99, 0x34, 0x8f, 0xbc, 0xa4,
++    0xe2, 0xbd, 0xd8, 0x85, 0x26, 0x37, 0xea, 0xba, 0x4f, 0xf2, 0x9a, 0x9a,
++    0x66, 0xfc, 0xdf, 0x63, 0x26, 0x26, 0x19, 0x87
++};
++
++__fips_constseg static const unsigned char sha256_int_returnedbits[] = {
++    0xb3, 0xc6, 0x07, 0x07, 0xd6, 0x75, 0xf6, 0x2b, 0xd6, 0x21, 0x96, 0xf1,
++    0xae, 0xdb, 0x2b, 0xac, 0x25, 0x2a, 0xae, 0xae, 0x41, 0x72, 0x03, 0x5e,
++    0xbf, 0xd3, 0x64, 0xbc, 0x59, 0xf9, 0xc0, 0x76
++};
++
++__fips_constseg static const unsigned char sha256_entropyinputreseed[] = {
++    0xbf, 0x20, 0x33, 0x56, 0x29, 0xa8, 0x37, 0x04, 0x1f, 0x78, 0x34, 0x3d,
++    0x81, 0x2a, 0xc9, 0x86, 0xc6, 0x7a, 0x2f, 0x88, 0x5e, 0xd5, 0xbe, 0x34,
++    0x46, 0x20, 0xa4, 0x35, 0xeb, 0xc7, 0xe2, 0x9d
++};
++
++__fips_constseg static const unsigned char sha256_additionalinputreseed[] = {
++    0x9b, 0xae, 0x2d, 0x2d, 0x61, 0xa4, 0x89, 0xeb, 0x43, 0x46, 0xa7, 0xda,
++    0xef, 0x40, 0xca, 0x4a, 0x99, 0x11, 0x41, 0xdc, 0x5c, 0x94, 0xe9, 0xac,
++    0xd4, 0xd0, 0xe6, 0xbd, 0xfb, 0x03, 0x9c, 0xa8
++};
++
++__fips_constseg static const unsigned char sha256_additionalinput2[] = {
++    0x23, 0xaa, 0x0c, 0xbd, 0x28, 0x33, 0xe2, 0x51, 0xfc, 0x71, 0xd2, 0x15,
++    0x1f, 0x76, 0xfd, 0x0d, 0xe0, 0xb7, 0xb5, 0x84, 0x75, 0x5b, 0xbe, 0xf3,
++    0x5c, 0xca, 0xc5, 0x30, 0xf2, 0x75, 0x1f, 0xda
++};
++
++__fips_constseg static const unsigned char sha256_returnedbits[] = {
++    0x90, 0x3c, 0xc1, 0x10, 0x8c, 0x12, 0x01, 0xc6, 0xa6, 0x3a, 0x0f, 0x4d,
++    0xb6, 0x3a, 0x4f, 0x41, 0x9c, 0x61, 0x75, 0x84, 0xe9, 0x74, 0x75, 0xfd,
++    0xfe, 0xf2, 0x1f, 0x43, 0xd8, 0x5e, 0x24, 0xa3
++};
++
++/* SHA-384 PR  */
++__fips_constseg static const unsigned char sha384_pr_entropyinput[] = {
++    0x71, 0x9d, 0xb2, 0x5a, 0x71, 0x6d, 0x04, 0xe9, 0x1e, 0xc7, 0x92, 0x24,
++    0x6e, 0x12, 0x33, 0xa9, 0x52, 0x64, 0x31, 0xef, 0x71, 0xeb, 0x22, 0x55,
++    0x28, 0x97, 0x06, 0x6a, 0xc0, 0x0c, 0xa0, 0x7e
++};
++
++__fips_constseg static const unsigned char sha384_pr_nonce[] = {
++    0xf5, 0x0d, 0xfa, 0xb0, 0xec, 0x6a, 0x7c, 0xd6, 0xbd, 0x9b, 0x05, 0xfd,
++    0x38, 0x3e, 0x2e, 0x56
++};
++
++__fips_constseg static const unsigned char sha384_pr_personalizationstring[] = {
++    0x74, 0xac, 0x7e, 0x6d, 0xb1, 0xa4, 0xe7, 0x21, 0xd1, 0x1e, 0x6e, 0x96,
++    0x6d, 0x4d, 0x53, 0x46, 0x82, 0x96, 0x6e, 0xcf, 0xaa, 0x81, 0x8d, 0x7d,
++    0x9e, 0xe1, 0x0f, 0x15, 0xea, 0x41, 0xbf, 0xe3
++};
++
++__fips_constseg static const unsigned char sha384_pr_additionalinput[] = {
++    0xda, 0x95, 0xd4, 0xd0, 0xb8, 0x11, 0xd3, 0x49, 0x27, 0x5d, 0xa9, 0x39,
++    0x68, 0xf3, 0xa8, 0xe9, 0x5d, 0x19, 0x8a, 0x2b, 0x66, 0xe8, 0x69, 0x06,
++    0x7c, 0x9e, 0x03, 0xa1, 0x8b, 0x26, 0x2d, 0x6e
++};
++
++__fips_constseg static const unsigned char sha384_pr_entropyinputpr[] = {
++    0x49, 0xdf, 0x44, 0x00, 0xe4, 0x1c, 0x75, 0x0b, 0x26, 0x5a, 0x59, 0x64,
++    0x1f, 0x4e, 0xb1, 0xb2, 0x13, 0xf1, 0x22, 0x4e, 0xb4, 0x6d, 0x9a, 0xcc,
++    0xa0, 0x48, 0xe6, 0xcf, 0x1d, 0xd1, 0x92, 0x0d
++};
++
++__fips_constseg static const unsigned char sha384_pr_int_returnedbits[] = {
++    0xc8, 0x52, 0xae, 0xbf, 0x04, 0x3c, 0x27, 0xb7, 0x78, 0x18, 0xaa, 0x8f,
++    0xff, 0xcf, 0xa4, 0xf1, 0xcc, 0xe7, 0x68, 0xfa, 0x22, 0xa2, 0x13, 0x45,
++    0xe8, 0xdd, 0x87, 0xe6, 0xf2, 0x6e, 0xdd, 0xc7, 0x52, 0x90, 0x9f, 0x7b,
++    0xfa, 0x61, 0x2d, 0x9d, 0x9e, 0xcf, 0x98, 0xac, 0x52, 0x40, 0xce, 0xaf
++};
++
++__fips_constseg static const unsigned char sha384_pr_additionalinput2[] = {
++    0x61, 0x7c, 0x03, 0x9a, 0x3e, 0x50, 0x57, 0x60, 0xc5, 0x83, 0xc9, 0xb2,
++    0xd1, 0x87, 0x85, 0x66, 0x92, 0x5d, 0x84, 0x0e, 0x53, 0xfb, 0x70, 0x03,
++    0x72, 0xfd, 0xba, 0xae, 0x9c, 0x8f, 0xf8, 0x18
++};
++
++__fips_constseg static const unsigned char sha384_pr_entropyinputpr2[] = {
++    0xf8, 0xeb, 0x89, 0xb1, 0x8d, 0x78, 0xbe, 0x21, 0xe0, 0xbb, 0x9d, 0xb7,
++    0x95, 0x0e, 0xd9, 0x46, 0x0c, 0x8c, 0xe2, 0x63, 0xb7, 0x9d, 0x67, 0x90,
++    0xbd, 0xc7, 0x0b, 0xa5, 0xce, 0xb2, 0x65, 0x81
++};
++
++__fips_constseg static const unsigned char sha384_pr_returnedbits[] = {
++    0xe6, 0x9f, 0xfe, 0x68, 0xd6, 0xb5, 0x79, 0xf1, 0x06, 0x5f, 0xa3, 0xbb,
++    0x23, 0x85, 0xd8, 0xf0, 0x29, 0x5a, 0x68, 0x9e, 0xf5, 0xf4, 0xa6, 0x12,
++    0xe0, 0x9a, 0xe2, 0xac, 0x00, 0x1d, 0x98, 0x26, 0xfc, 0x53, 0x95, 0x53,
++    0xe4, 0x3e, 0x17, 0xd5, 0x08, 0x0b, 0x70, 0x3d, 0x67, 0x99, 0xac, 0x66
++};
++
++/* SHA-384 No PR  */
++__fips_constseg static const unsigned char sha384_entropyinput[] = {
++    0x07, 0x15, 0x27, 0x2a, 0xaf, 0x74, 0x24, 0x37, 0xbc, 0xd5, 0x14, 0x69,
++    0xce, 0x11, 0xff, 0xa2, 0x6b, 0xb8, 0x05, 0x67, 0x34, 0xf8, 0xbd, 0x6d,
++    0x6a, 0xcc, 0xcd, 0x60, 0xa3, 0x68, 0xca, 0xf4
++};
++
++__fips_constseg static const unsigned char sha384_nonce[] = {
++    0x70, 0x17, 0xc2, 0x5b, 0x5d, 0x22, 0x0b, 0x06, 0x15, 0x54, 0x78, 0x77,
++    0x44, 0xaf, 0x2f, 0x09
++};
++
++__fips_constseg static const unsigned char sha384_personalizationstring[] = {
++    0x89, 0x39, 0x28, 0xb0, 0x60, 0xeb, 0x3d, 0xdc, 0x55, 0x75, 0x86, 0xeb,
++    0xae, 0xa2, 0x8f, 0xbc, 0x1b, 0x75, 0xd4, 0xe1, 0x0f, 0xaa, 0x38, 0xca,
++    0x62, 0x8b, 0xcb, 0x2c, 0x26, 0xf6, 0xbc, 0xb1
++};
++
++__fips_constseg static const unsigned char sha384_additionalinput[] = {
++    0x30, 0x2b, 0x42, 0x35, 0xef, 0xda, 0x40, 0x55, 0x28, 0xc6, 0x95, 0xfb,
++    0x54, 0x01, 0x62, 0xd7, 0x87, 0x14, 0x48, 0x6d, 0x90, 0x4c, 0xa9, 0x02,
++    0x54, 0x40, 0x22, 0xc8, 0x66, 0xa5, 0x48, 0x48
++};
++
++__fips_constseg static const unsigned char sha384_int_returnedbits[] = {
++    0x82, 0xc4, 0xa1, 0x9c, 0x21, 0xd2, 0xe7, 0xa5, 0xa6, 0xf6, 0x5f, 0x04,
++    0x5c, 0xc7, 0x31, 0x9d, 0x8d, 0x59, 0x74, 0x50, 0x19, 0x89, 0x2f, 0x63,
++    0xd5, 0xb7, 0x7e, 0xeb, 0x15, 0xe3, 0x70, 0x83, 0xa1, 0x24, 0x59, 0xfa,
++    0x2c, 0x56, 0xf6, 0x88, 0x3a, 0x92, 0x93, 0xa1, 0xfb, 0x79, 0xc1, 0x7a
++};
++
++__fips_constseg static const unsigned char sha384_entropyinputreseed[] = {
++    0x39, 0xa6, 0xe8, 0x5c, 0x82, 0x17, 0x71, 0x26, 0x57, 0x4f, 0x9f, 0xc2,
++    0x55, 0xff, 0x5c, 0x9b, 0x53, 0x1a, 0xd1, 0x5f, 0xbc, 0x62, 0xe4, 0x27,
++    0x2d, 0x32, 0xf0, 0xe4, 0x52, 0x8c, 0xc5, 0x0c
++};
++
++__fips_constseg static const unsigned char sha384_additionalinputreseed[] = {
++    0x8d, 0xcb, 0x8d, 0xce, 0x08, 0xea, 0x80, 0xe8, 0x9b, 0x61, 0xa8, 0x0f,
++    0xaf, 0x49, 0x20, 0x9e, 0x74, 0xcb, 0x57, 0x80, 0x42, 0xb0, 0x84, 0x5e,
++    0x30, 0x2a, 0x67, 0x08, 0xf4, 0xe3, 0x40, 0x22
++};
++
++__fips_constseg static const unsigned char sha384_additionalinput2[] = {
++    0x7c, 0x8f, 0xc2, 0xae, 0x22, 0x4a, 0xd6, 0xf6, 0x05, 0xa4, 0x7a, 0xea,
++    0xbb, 0x25, 0xd0, 0xb7, 0x5a, 0xd6, 0xcf, 0x9d, 0xf3, 0x6c, 0xe2, 0xb2,
++    0x4e, 0xb4, 0xbd, 0xf4, 0xe5, 0x40, 0x80, 0x94
++};
++
++__fips_constseg static const unsigned char sha384_returnedbits[] = {
++    0x9e, 0x7e, 0xfb, 0x59, 0xbb, 0xaa, 0x3c, 0xf7, 0xe1, 0xf8, 0x76, 0xdd,
++    0x63, 0x5f, 0xaf, 0x23, 0xd6, 0x64, 0x61, 0xc0, 0x9a, 0x09, 0x47, 0xc9,
++    0x33, 0xdf, 0x6d, 0x55, 0x91, 0x34, 0x79, 0x70, 0xc4, 0x99, 0x6e, 0x54,
++    0x09, 0x64, 0x21, 0x1a, 0xbd, 0x1e, 0x80, 0x40, 0x34, 0xad, 0xfa, 0xd7
++};
++
++/* SHA-512 PR  */
++__fips_constseg static const unsigned char sha512_pr_entropyinput[] = {
++    0x13, 0xf7, 0x61, 0x75, 0x65, 0x28, 0xa2, 0x59, 0x13, 0x5a, 0x4a, 0x4f,
++    0x56, 0x60, 0x8c, 0x53, 0x7d, 0xb0, 0xbd, 0x06, 0x4f, 0xed, 0xcc, 0xd2,
++    0xa2, 0xb5, 0xfd, 0x5b, 0x3a, 0xab, 0xec, 0x28
++};
++
++__fips_constseg static const unsigned char sha512_pr_nonce[] = {
++    0xbe, 0xa3, 0x91, 0x93, 0x1d, 0xc3, 0x31, 0x3a, 0x23, 0x33, 0x50, 0x67,
++    0x88, 0xc7, 0xa2, 0xc4
++};
++
++__fips_constseg static const unsigned char sha512_pr_personalizationstring[] = {
++    0x1f, 0x59, 0x4d, 0x7b, 0xe6, 0x46, 0x91, 0x48, 0xc1, 0x25, 0xfa, 0xff,
++    0x89, 0x12, 0x77, 0x35, 0xdf, 0x3e, 0xf4, 0x80, 0x5f, 0xd9, 0xb0, 0x07,
++    0x22, 0x41, 0xdd, 0x48, 0x78, 0x6b, 0x77, 0x2b
++};
++
++__fips_constseg static const unsigned char sha512_pr_additionalinput[] = {
++    0x30, 0xff, 0x63, 0x6f, 0xac, 0xd9, 0x84, 0x39, 0x6f, 0xe4, 0x99, 0xce,
++    0x91, 0x7d, 0x7e, 0xc8, 0x58, 0xf2, 0x12, 0xc3, 0xb6, 0xad, 0xda, 0x22,
++    0x04, 0xa0, 0xd2, 0x21, 0xfe, 0xf2, 0x95, 0x1d
++};
++
++__fips_constseg static const unsigned char sha512_pr_entropyinputpr[] = {
++    0x64, 0x54, 0x13, 0xec, 0x4f, 0x77, 0xda, 0xb2, 0x92, 0x2e, 0x52, 0x80,
++    0x11, 0x10, 0xc2, 0xf8, 0xe6, 0xa7, 0xcd, 0x4b, 0xfc, 0x32, 0x2e, 0x9e,
++    0xeb, 0xbb, 0xb1, 0xbf, 0x15, 0x5c, 0x73, 0x08
++};
++
++__fips_constseg static const unsigned char sha512_pr_int_returnedbits[] = {
++    0xef, 0x1e, 0xdc, 0x0a, 0xa4, 0x36, 0x91, 0x9c, 0x3d, 0x27, 0x97, 0x50,
++    0x8d, 0x36, 0x29, 0x8d, 0xce, 0x6a, 0x0c, 0xf7, 0x21, 0xc0, 0x91, 0xae,
++    0x0c, 0x96, 0x72, 0xbd, 0x52, 0x81, 0x58, 0xfc, 0x6d, 0xe5, 0xf7, 0xa5,
++    0xfd, 0x5d, 0xa7, 0x58, 0x68, 0xc8, 0x99, 0x58, 0x8e, 0xc8, 0xce, 0x95,
++    0x01, 0x7d, 0xff, 0xa4, 0xc8, 0xf7, 0x63, 0xfe, 0x5f, 0x69, 0x83, 0x53,
++    0xe2, 0xc6, 0x8b, 0xc3
++};
++
++__fips_constseg static const unsigned char sha512_pr_additionalinput2[] = {
++    0xe6, 0x9b, 0xc4, 0x88, 0x34, 0xca, 0xea, 0x29, 0x2f, 0x98, 0x05, 0xa4,
++    0xd3, 0xc0, 0x7b, 0x11, 0xe8, 0xbb, 0x75, 0xf2, 0xbd, 0x29, 0xb7, 0x40,
++    0x25, 0x7f, 0xc1, 0xb7, 0xb1, 0xf1, 0x25, 0x61
++};
++
++__fips_constseg static const unsigned char sha512_pr_entropyinputpr2[] = {
++    0x23, 0x6d, 0xff, 0xde, 0xfb, 0xd1, 0xba, 0x33, 0x18, 0xe6, 0xbe, 0xb5,
++    0x48, 0x77, 0x6d, 0x7f, 0xa7, 0xe1, 0x4d, 0x48, 0x1e, 0x3c, 0xa7, 0x34,
++    0x1a, 0xc8, 0x60, 0xdb, 0x8f, 0x99, 0x15, 0x99
++};
++
++__fips_constseg static const unsigned char sha512_pr_returnedbits[] = {
++    0x70, 0x27, 0x31, 0xdb, 0x92, 0x70, 0x21, 0xfe, 0x16, 0xb6, 0xc8, 0x51,
++    0x34, 0x87, 0x65, 0xd0, 0x4e, 0xfd, 0xfe, 0x68, 0xec, 0xac, 0xdc, 0x93,
++    0x41, 0x38, 0x92, 0x90, 0xb4, 0x94, 0xf9, 0x0d, 0xa4, 0xf7, 0x4e, 0x80,
++    0x92, 0x67, 0x48, 0x40, 0xa7, 0x08, 0xc7, 0xbc, 0x66, 0x00, 0xfd, 0xf7,
++    0x4c, 0x8b, 0x17, 0x6e, 0xd1, 0x8f, 0x9b, 0xf3, 0x6f, 0xf6, 0x34, 0xdd,
++    0x67, 0xf7, 0x68, 0xdd
++};
++
++/* SHA-512 No PR  */
++__fips_constseg static const unsigned char sha512_entropyinput[] = {
++    0xb6, 0x0b, 0xb7, 0xbc, 0x84, 0x56, 0xf6, 0x12, 0xaf, 0x45, 0x67, 0x17,
++    0x7c, 0xd1, 0xb2, 0x78, 0x2b, 0xa0, 0xf2, 0xbe, 0xb6, 0x6d, 0x8b, 0x56,
++    0xc6, 0xbc, 0x4d, 0xe1, 0xf7, 0xbe, 0xce, 0xbd
++};
++
++__fips_constseg static const unsigned char sha512_nonce[] = {
++    0x9d, 0xed, 0xc0, 0xe5, 0x5a, 0x98, 0x6a, 0xcb, 0x51, 0x7d, 0x76, 0x31,
++    0x5a, 0x64, 0xf0, 0xf7
++};
++
++__fips_constseg static const unsigned char sha512_personalizationstring[] = {
++    0xc2, 0x6d, 0xa3, 0xc3, 0x06, 0x74, 0xe5, 0x01, 0x5c, 0x10, 0x17, 0xc7,
++    0xaf, 0x83, 0x9d, 0x59, 0x8d, 0x2d, 0x29, 0x38, 0xc5, 0x59, 0x70, 0x8b,
++    0x46, 0x48, 0x2d, 0xcf, 0x36, 0x7d, 0x59, 0xc0
++};
++
++__fips_constseg static const unsigned char sha512_additionalinput[] = {
++    0xec, 0x8c, 0xd4, 0xf7, 0x61, 0x6e, 0x0d, 0x95, 0x79, 0xb7, 0x28, 0xad,
++    0x5f, 0x69, 0x74, 0x5f, 0x2d, 0x36, 0x06, 0x8a, 0x6b, 0xac, 0x54, 0x97,
++    0xc4, 0xa1, 0x12, 0x85, 0x0a, 0xdf, 0x4b, 0x34
++};
++
++__fips_constseg static const unsigned char sha512_int_returnedbits[] = {
++    0x84, 0x2f, 0x1f, 0x68, 0x6a, 0xa3, 0xad, 0x1e, 0xfb, 0xf4, 0x15, 0xbd,
++    0xde, 0x38, 0xd4, 0x30, 0x80, 0x51, 0xe9, 0xd3, 0xc7, 0x20, 0x88, 0xe9,
++    0xf5, 0xcc, 0xdf, 0x57, 0x5c, 0x47, 0x2f, 0x57, 0x3c, 0x5f, 0x13, 0x56,
++    0xcc, 0xc5, 0x4f, 0x84, 0xf8, 0x10, 0x41, 0xd5, 0x7e, 0x58, 0x6e, 0x19,
++    0x19, 0x9e, 0xaf, 0xc2, 0x22, 0x58, 0x41, 0x50, 0x79, 0xc2, 0xd8, 0x04,
++    0x28, 0xd4, 0x39, 0x9a
++};
++
++__fips_constseg static const unsigned char sha512_entropyinputreseed[] = {
++    0xfa, 0x7f, 0x46, 0x51, 0x83, 0x62, 0x98, 0x16, 0x9a, 0x19, 0xa2, 0x49,
++    0xa9, 0xe6, 0x4a, 0xd8, 0x85, 0xe7, 0xd4, 0x3b, 0x2c, 0x82, 0xc5, 0x82,
++    0xbf, 0x11, 0xf9, 0x9e, 0xbc, 0xd0, 0x01, 0xee
++};
++
++__fips_constseg static const unsigned char sha512_additionalinputreseed[] = {
++    0xb9, 0x12, 0xe0, 0x4f, 0xf7, 0xa7, 0xc4, 0xd8, 0xd0, 0x8e, 0x99, 0x29,
++    0x7c, 0x9a, 0xe9, 0xcf, 0xc4, 0x6c, 0xf8, 0xc3, 0xa7, 0x41, 0x83, 0xd6,
++    0x2e, 0xfa, 0xb8, 0x5e, 0x8e, 0x6b, 0x78, 0x20
++};
++
++__fips_constseg static const unsigned char sha512_additionalinput2[] = {
++    0xd7, 0x07, 0x52, 0xb9, 0x83, 0x2c, 0x03, 0x71, 0xee, 0xc9, 0xc0, 0x85,
++    0xe1, 0x57, 0xb2, 0xcd, 0x3a, 0xf0, 0xc9, 0x34, 0x24, 0x41, 0x1c, 0x42,
++    0x99, 0xb2, 0x84, 0xe9, 0x17, 0xd2, 0x76, 0x92
++};
++
++__fips_constseg static const unsigned char sha512_returnedbits[] = {
++    0x36, 0x17, 0x5d, 0x98, 0x2b, 0x65, 0x25, 0x8e, 0xc8, 0x29, 0xdf, 0x27,
++    0x05, 0x36, 0x26, 0x12, 0x8a, 0x68, 0x74, 0x27, 0x37, 0xd4, 0x7f, 0x32,
++    0xb1, 0x12, 0xd6, 0x85, 0x83, 0xeb, 0x2e, 0xa0, 0xed, 0x4b, 0xb5, 0x7b,
++    0x6f, 0x39, 0x3c, 0x71, 0x77, 0x02, 0x12, 0xcc, 0x2c, 0x3a, 0x8e, 0x63,
++    0xdf, 0x4a, 0xbd, 0x6f, 0x6e, 0x2e, 0xed, 0x0a, 0x85, 0xa5, 0x2f, 0xa2,
++    0x68, 0xde, 0x42, 0xb5
++};
++
++/* HMAC SHA-1 PR  */
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinput[] = {
++    0x26, 0x5f, 0x36, 0x14, 0xff, 0x3d, 0x83, 0xfa, 0x73, 0x5e, 0x75, 0xdc,
++    0x2c, 0x18, 0x17, 0x1b
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_nonce[] = {
++    0xc8, 0xe3, 0x57, 0xa5, 0x7b, 0x74, 0x86, 0x6e
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha1_pr_personalizationstring[] = {
++    0x6e, 0xdb, 0x0d, 0xfe, 0x7d, 0xac, 0x79, 0xd0, 0xa5, 0x3a, 0x48, 0x85,
++    0x80, 0xe2, 0x7f, 0x2a
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_additionalinput[] = {
++    0x31, 0xcd, 0x5e, 0x43, 0xdc, 0xfb, 0x7a, 0x79, 0xca, 0x88, 0xde, 0x1f,
++    0xd7, 0xbb, 0x42, 0x09
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinputpr[] = {
++    0x7c, 0x23, 0x95, 0x38, 0x00, 0x95, 0xc1, 0x78, 0x1f, 0x8f, 0xd7, 0x63,
++    0x23, 0x87, 0x2a, 0xed
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_int_returnedbits[] = {
++    0xbb, 0x34, 0xe7, 0x93, 0xa3, 0x02, 0x2c, 0x4a, 0xd0, 0x89, 0xda, 0x7f,
++    0xed, 0xf4, 0x4c, 0xde, 0x17, 0xec, 0xe5, 0x6c
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_additionalinput2[] = {
++    0x49, 0xbc, 0x2d, 0x2c, 0xb7, 0x32, 0xcb, 0x20, 0xdf, 0xf5, 0x77, 0x58,
++    0xa0, 0x4b, 0x93, 0x6e
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_entropyinputpr2[] = {
++    0x3c, 0xaa, 0xb0, 0x21, 0x42, 0xb0, 0xdd, 0x34, 0xf0, 0x16, 0x7f, 0x0c,
++    0x0f, 0xff, 0x2e, 0xaf
++};
++
++__fips_constseg static const unsigned char hmac_sha1_pr_returnedbits[] = {
++    0x8e, 0xcb, 0xa3, 0x64, 0xb2, 0xb8, 0x33, 0x6c, 0x64, 0x3b, 0x78, 0x16,
++    0x99, 0x35, 0xc8, 0x30, 0xcb, 0x3e, 0xa0, 0xd8
++};
++
++/* HMAC SHA-1 No PR  */
++__fips_constseg static const unsigned char hmac_sha1_entropyinput[] = {
++    0x32, 0x9a, 0x2a, 0x87, 0x7b, 0x89, 0x7c, 0xf6, 0xcb, 0x95, 0xd5, 0x40,
++    0x17, 0xfe, 0x47, 0x70
++};
++
++__fips_constseg static const unsigned char hmac_sha1_nonce[] = {
++    0x16, 0xd8, 0xe0, 0xc7, 0x52, 0xcf, 0x4a, 0x25
++};
++
++__fips_constseg static const unsigned char hmac_sha1_personalizationstring[] = {
++    0x35, 0x35, 0xa9, 0xa5, 0x40, 0xbe, 0x9b, 0xd1, 0x56, 0xdd, 0x44, 0x00,
++    0x72, 0xf7, 0xd3, 0x5e
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinput[] = {
++    0x1b, 0x2c, 0x84, 0x2d, 0x4a, 0x89, 0x8f, 0x69, 0x19, 0xf1, 0xf3, 0xdb,
++    0xbb, 0xe3, 0xaa, 0xea
++};
++
++__fips_constseg static const unsigned char hmac_sha1_int_returnedbits[] = {
++    0xcf, 0xfa, 0x7d, 0x72, 0x0f, 0xe6, 0xc7, 0x96, 0xa0, 0x69, 0x31, 0x11,
++    0x9b, 0x0b, 0x1a, 0x20, 0x1f, 0x3f, 0xaa, 0xd1
++};
++
++__fips_constseg static const unsigned char hmac_sha1_entropyinputreseed[] = {
++    0x90, 0x75, 0x15, 0x04, 0x95, 0xf1, 0xba, 0x81, 0x0c, 0x37, 0x94, 0x6f,
++    0x86, 0x52, 0x6d, 0x9c
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinputreseed[] = {
++    0x5b, 0x40, 0xba, 0x5f, 0x17, 0x70, 0xf0, 0x4b, 0xdf, 0xc9, 0x97, 0x92,
++    0x79, 0xc5, 0x82, 0x28
++};
++
++__fips_constseg static const unsigned char hmac_sha1_additionalinput2[] = {
++    0x97, 0xc8, 0x80, 0x90, 0xb3, 0xaa, 0x6e, 0x60, 0xea, 0x83, 0x7a, 0xe3,
++    0x8a, 0xca, 0xa4, 0x7f
++};
++
++__fips_constseg static const unsigned char hmac_sha1_returnedbits[] = {
++    0x90, 0xbd, 0x05, 0x56, 0x6d, 0xb5, 0x22, 0xd5, 0xb9, 0x5a, 0x29, 0x2d,
++    0xe9, 0x0b, 0xe1, 0xac, 0xde, 0x27, 0x0b, 0xb0
++};
++
++/* HMAC SHA-224 PR  */
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinput[] = {
++    0x17, 0x32, 0x2b, 0x2e, 0x6f, 0x1b, 0x9c, 0x6d, 0x31, 0xe0, 0x34, 0x07,
++    0xcf, 0xed, 0xf6, 0xb6, 0x5a, 0x76, 0x4c, 0xbc, 0x62, 0x85, 0x01, 0x90
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_nonce[] = {
++    0x38, 0xbf, 0x5f, 0x20, 0xb3, 0x68, 0x2f, 0x43, 0x61, 0x05, 0x8f, 0x23
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_pr_personalizationstring[] = {
++    0xc0, 0xc9, 0x45, 0xac, 0x8d, 0x27, 0x77, 0x08, 0x0b, 0x17, 0x6d, 0xed,
++    0xc1, 0x7d, 0xd5, 0x07, 0x9d, 0x6e, 0xf8, 0x23, 0x2a, 0x22, 0x13, 0xbd
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_additionalinput[] = {
++    0xa4, 0x3c, 0xe7, 0x3b, 0xea, 0x19, 0x45, 0x32, 0xc2, 0x83, 0x6d, 0x21,
++    0x8a, 0xc0, 0xee, 0x67, 0x45, 0xde, 0x13, 0x7d, 0x9d, 0x61, 0x00, 0x3b
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinputpr[] = {
++    0x15, 0x05, 0x74, 0x4a, 0x7f, 0x8d, 0x5c, 0x60, 0x16, 0xe5, 0x7b, 0xad,
++    0xf5, 0x41, 0x8f, 0x55, 0x60, 0xc4, 0x09, 0xee, 0x1e, 0x11, 0x81, 0xab
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_int_returnedbits[] = {
++    0x6f, 0xf5, 0x9a, 0xe2, 0x54, 0x53, 0x30, 0x3d, 0x5a, 0x27, 0x29, 0x38,
++    0x27, 0xf2, 0x0d, 0x05, 0xe9, 0x26, 0xcb, 0x16, 0xc3, 0x51, 0x5f, 0x13,
++    0x41, 0xfe, 0x99, 0xf2
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_additionalinput2[] = {
++    0x73, 0x81, 0x88, 0x84, 0x8f, 0xed, 0x6f, 0x10, 0x9f, 0x93, 0xbf, 0x17,
++    0x35, 0x7c, 0xef, 0xd5, 0x8d, 0x26, 0xa6, 0x7a, 0xe8, 0x09, 0x36, 0x4f
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_entropyinputpr2[] = {
++    0xe6, 0xcf, 0xcf, 0x7e, 0x12, 0xe5, 0x43, 0xd2, 0x38, 0xd8, 0x24, 0x6f,
++    0x5a, 0x37, 0x68, 0xbf, 0x4f, 0xa0, 0xff, 0xd5, 0x61, 0x8a, 0x93, 0xe0
++};
++
++__fips_constseg static const unsigned char hmac_sha224_pr_returnedbits[] = {
++    0xaf, 0xf9, 0xd8, 0x19, 0x91, 0x30, 0x82, 0x6f, 0xa9, 0x1e, 0x9d, 0xd7,
++    0xf3, 0x50, 0xe0, 0xc7, 0xd5, 0x64, 0x96, 0x7d, 0x4c, 0x4d, 0x78, 0x03,
++    0x6d, 0xd8, 0x9e, 0x72
++};
++
++/* HMAC SHA-224 No PR  */
++__fips_constseg static const unsigned char hmac_sha224_entropyinput[] = {
++    0x11, 0x82, 0xfd, 0xd9, 0x42, 0xf4, 0xfa, 0xc8, 0xf2, 0x41, 0xe6, 0x54,
++    0x01, 0xae, 0x22, 0x6e, 0xc6, 0xaf, 0xaf, 0xd0, 0xa6, 0xb2, 0xe2, 0x6d
++};
++
++__fips_constseg static const unsigned char hmac_sha224_nonce[] = {
++    0xa9, 0x48, 0xd7, 0x92, 0x39, 0x7e, 0x2a, 0xdc, 0x30, 0x1f, 0x0e, 0x2b
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_personalizationstring[] = {
++    0x11, 0xd5, 0xf4, 0xbd, 0x67, 0x8c, 0x31, 0xcf, 0xa3, 0x3f, 0x1e, 0x6b,
++    0xa8, 0x07, 0x02, 0x0b, 0xc8, 0x2e, 0x6c, 0x64, 0x41, 0x5b, 0xc8, 0x37
++};
++
++__fips_constseg static const unsigned char hmac_sha224_additionalinput[] = {
++    0x68, 0x18, 0xc2, 0x06, 0xeb, 0x3e, 0x04, 0x95, 0x44, 0x5e, 0xfb, 0xe6,
++    0x41, 0xc1, 0x5c, 0xcc, 0x40, 0x2f, 0xb7, 0xd2, 0x0f, 0xf3, 0x6b, 0xe7
++};
++
++__fips_constseg static const unsigned char hmac_sha224_int_returnedbits[] = {
++    0x7f, 0x45, 0xc7, 0x5d, 0x32, 0xe6, 0x17, 0x60, 0xba, 0xdc, 0xb8, 0x42,
++    0x1b, 0x9c, 0xf1, 0xfa, 0x3b, 0x4d, 0x29, 0x54, 0xc6, 0x90, 0xff, 0x5c,
++    0xcd, 0xd6, 0xa9, 0xcc
++};
++
++__fips_constseg static const unsigned char hmac_sha224_entropyinputreseed[] = {
++    0xc4, 0x8e, 0x37, 0x95, 0x69, 0x53, 0x28, 0xd7, 0x37, 0xbb, 0x70, 0x95,
++    0x1c, 0x07, 0x1d, 0xd9, 0xb7, 0xe6, 0x1b, 0xbb, 0xfe, 0x41, 0xeb, 0xc9
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha224_additionalinputreseed[] = {
++    0x53, 0x17, 0xa1, 0x6a, 0xfa, 0x77, 0x47, 0xb0, 0x95, 0x56, 0x9a, 0x20,
++    0x57, 0xde, 0x5c, 0x89, 0x9f, 0x7f, 0xe2, 0xde, 0x17, 0x3a, 0x50, 0x23
++};
++
++__fips_constseg static const unsigned char hmac_sha224_additionalinput2[] = {
++    0x3a, 0x32, 0xf9, 0x85, 0x0c, 0xc1, 0xed, 0x76, 0x2d, 0xdf, 0x40, 0xc3,
++    0x06, 0x22, 0x66, 0xd4, 0x9a, 0x9a, 0xff, 0x5a, 0x7e, 0x7a, 0xf3, 0x96
++};
++
++__fips_constseg static const unsigned char hmac_sha224_returnedbits[] = {
++    0x43, 0xb4, 0x57, 0x5c, 0x38, 0x25, 0x9d, 0xae, 0xec, 0x96, 0xd1, 0x85,
++    0x3a, 0x84, 0x8d, 0xfe, 0x68, 0xd5, 0x0e, 0x5c, 0x8f, 0x65, 0xa5, 0x4e,
++    0x45, 0x84, 0xa8, 0x94
++};
++
++/* HMAC SHA-256 PR  */
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinput[] = {
++    0x4d, 0xb0, 0x43, 0xd8, 0x34, 0x4b, 0x10, 0x70, 0xb1, 0x8b, 0xed, 0xea,
++    0x07, 0x92, 0x9f, 0x6c, 0x79, 0x31, 0xaf, 0x81, 0x29, 0xeb, 0x6e, 0xca,
++    0x32, 0x48, 0x28, 0xe7, 0x02, 0x5d, 0xa6, 0xa6
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_nonce[] = {
++    0x3a, 0xae, 0x15, 0xa9, 0x99, 0xdc, 0xe4, 0x67, 0x34, 0x3b, 0x70, 0x15,
++    0xaa, 0xd3, 0x30, 0x9a
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_pr_personalizationstring[] = {
++    0x13, 0x1d, 0x24, 0x04, 0xb0, 0x18, 0x81, 0x15, 0x21, 0x51, 0x2a, 0x24,
++    0x52, 0x61, 0xbe, 0x64, 0x82, 0x6b, 0x55, 0x2f, 0xe2, 0xf1, 0x40, 0x7d,
++    0x71, 0xd8, 0x01, 0x86, 0x15, 0xb7, 0x8b, 0xb5
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_additionalinput[] = {
++    0x8f, 0xa6, 0x54, 0x5f, 0xb1, 0xd0, 0xd8, 0xc3, 0xe7, 0x0c, 0x15, 0xa9,
++    0x23, 0x6e, 0xfe, 0xfb, 0x93, 0xf7, 0x3a, 0xbd, 0x59, 0x01, 0xfa, 0x18,
++    0x8e, 0xe9, 0x1a, 0xa9, 0x78, 0xfc, 0x79, 0x0b
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinputpr[] = {
++    0xcf, 0x24, 0xb9, 0xeb, 0xb3, 0xd4, 0xcd, 0x17, 0x37, 0x38, 0x75, 0x79,
++    0x15, 0xcb, 0x2d, 0x75, 0x51, 0xf1, 0xcc, 0xaa, 0x32, 0xa4, 0xa7, 0x36,
++    0x7c, 0x5c, 0xe4, 0x47, 0xf1, 0x3e, 0x1d, 0xe5
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_int_returnedbits[] = {
++    0x52, 0x42, 0xfa, 0xeb, 0x85, 0xe0, 0x30, 0x22, 0x79, 0x00, 0x16, 0xb2,
++    0x88, 0x2f, 0x14, 0x6a, 0xb7, 0xfc, 0xb7, 0x53, 0xdc, 0x4a, 0x12, 0xef,
++    0x54, 0xd6, 0x33, 0xe9, 0x20, 0xd6, 0xfd, 0x56
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_additionalinput2[] = {
++    0xf4, 0xf6, 0x49, 0xa1, 0x2d, 0x64, 0x2b, 0x30, 0x58, 0xf8, 0xbd, 0xb8,
++    0x75, 0xeb, 0xbb, 0x5e, 0x1c, 0x9b, 0x81, 0x6a, 0xda, 0x14, 0x86, 0x6e,
++    0xd0, 0xda, 0x18, 0xb7, 0x88, 0xfb, 0x59, 0xf3
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_entropyinputpr2[] = {
++    0x21, 0xcd, 0x6e, 0x46, 0xad, 0x99, 0x07, 0x17, 0xb4, 0x3d, 0x76, 0x0a,
++    0xff, 0x5b, 0x52, 0x50, 0x78, 0xdf, 0x1f, 0x24, 0x06, 0x0d, 0x3f, 0x74,
++    0xa9, 0xc9, 0x37, 0xcf, 0xd8, 0x26, 0x25, 0x91
++};
++
++__fips_constseg static const unsigned char hmac_sha256_pr_returnedbits[] = {
++    0xa7, 0xaf, 0x2f, 0x29, 0xe0, 0x3a, 0x72, 0x95, 0x96, 0x1c, 0xa9, 0xf0,
++    0x4a, 0x17, 0x4d, 0x66, 0x06, 0x10, 0xbf, 0x39, 0x89, 0x88, 0xb8, 0x91,
++    0x37, 0x18, 0x99, 0xcf, 0x8c, 0x53, 0x3b, 0x7e
++};
++
++/* HMAC SHA-256 No PR  */
++__fips_constseg static const unsigned char hmac_sha256_entropyinput[] = {
++    0x96, 0xb7, 0x53, 0x22, 0x1e, 0x52, 0x2a, 0x96, 0xb1, 0x15, 0x3c, 0x35,
++    0x5a, 0x8b, 0xd3, 0x4a, 0xa6, 0x6c, 0x83, 0x0a, 0x7d, 0xa3, 0x23, 0x3d,
++    0x43, 0xa1, 0x07, 0x2c, 0x2d, 0xe3, 0x81, 0xcc
++};
++
++__fips_constseg static const unsigned char hmac_sha256_nonce[] = {
++    0xf1, 0xac, 0x97, 0xcb, 0x5e, 0x06, 0x48, 0xd2, 0x94, 0xbe, 0x15, 0x2e,
++    0xc7, 0xfc, 0xc2, 0x01
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_personalizationstring[] = {
++    0x98, 0xc5, 0x1e, 0x35, 0x5e, 0x89, 0x0d, 0xce, 0x64, 0x6d, 0x18, 0xa7,
++    0x5a, 0xc6, 0xf3, 0xe7, 0xd6, 0x9e, 0xc0, 0xea, 0xb7, 0x3a, 0x8d, 0x65,
++    0xb8, 0xeb, 0x10, 0xd7, 0x57, 0x18, 0xa0, 0x32
++};
++
++__fips_constseg static const unsigned char hmac_sha256_additionalinput[] = {
++    0x1b, 0x10, 0xaf, 0xac, 0xd0, 0x65, 0x95, 0xad, 0x04, 0xad, 0x03, 0x1c,
++    0xe0, 0x40, 0xd6, 0x3e, 0x1c, 0x46, 0x53, 0x39, 0x7c, 0xe2, 0xbc, 0xda,
++    0x8c, 0xa2, 0x33, 0xa7, 0x9a, 0x26, 0xd3, 0x27
++};
++
++__fips_constseg static const unsigned char hmac_sha256_int_returnedbits[] = {
++    0xba, 0x61, 0x0e, 0x55, 0xfe, 0x11, 0x8a, 0x9e, 0x0f, 0x80, 0xdf, 0x1d,
++    0x03, 0x0a, 0xfe, 0x15, 0x94, 0x28, 0x4b, 0xba, 0xf4, 0x9f, 0x51, 0x25,
++    0x88, 0xe5, 0x4e, 0xfb, 0xaf, 0xce, 0x69, 0x90
++};
++
++__fips_constseg static const unsigned char hmac_sha256_entropyinputreseed[] = {
++    0x62, 0x7f, 0x1e, 0x6b, 0xe8, 0x8e, 0xe1, 0x35, 0x7d, 0x9b, 0x4f, 0xc7,
++    0xec, 0xc8, 0xac, 0xef, 0x6b, 0x13, 0x9e, 0x05, 0x56, 0xc1, 0x08, 0xf9,
++    0x2f, 0x0f, 0x27, 0x9c, 0xd4, 0x15, 0xed, 0x2d
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha256_additionalinputreseed[] = {
++    0xc7, 0x76, 0x6e, 0xa9, 0xd2, 0xb2, 0x76, 0x40, 0x82, 0x25, 0x2c, 0xb3,
++    0x6f, 0xac, 0xe9, 0x74, 0xef, 0x8f, 0x3c, 0x8e, 0xcd, 0xf1, 0xbf, 0xb3,
++    0x49, 0x77, 0x34, 0x88, 0x52, 0x36, 0xe6, 0x2e
++};
++
++__fips_constseg static const unsigned char hmac_sha256_additionalinput2[] = {
++    0x8d, 0xb8, 0x0c, 0xd1, 0xbf, 0x70, 0xf6, 0x19, 0xc3, 0x41, 0x80, 0x9f,
++    0xe1, 0xa5, 0xa4, 0x1f, 0x2c, 0x26, 0xb1, 0xe5, 0xd8, 0xeb, 0xbe, 0xf8,
++    0xdf, 0x88, 0x6a, 0x89, 0xd6, 0x05, 0xd8, 0x9d
++};
++
++__fips_constseg static const unsigned char hmac_sha256_returnedbits[] = {
++    0x43, 0x12, 0x2a, 0x2c, 0x40, 0x53, 0x2e, 0x7c, 0x66, 0x34, 0xac, 0xc3,
++    0x43, 0xe3, 0xe0, 0x6a, 0xfc, 0xfa, 0xea, 0x87, 0x21, 0x1f, 0xe2, 0x26,
++    0xc4, 0xf9, 0x09, 0x9a, 0x0d, 0x6e, 0x7f, 0xe0
++};
++
++/* HMAC SHA-384 PR  */
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinput[] = {
++    0x69, 0x81, 0x98, 0x88, 0x44, 0xf5, 0xd6, 0x2e, 0x00, 0x08, 0x3b, 0xc5,
++    0xfb, 0xd7, 0x8e, 0x6f, 0x23, 0xf8, 0x6d, 0x09, 0xd6, 0x85, 0x49, 0xd1,
++    0xf8, 0x6d, 0xa4, 0x58, 0x54, 0xfd, 0x88, 0xa9
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_nonce[] = {
++    0x6e, 0x38, 0x81, 0xca, 0xb7, 0xe8, 0x6e, 0x66, 0x49, 0x8a, 0xb2, 0x59,
++    0xee, 0x16, 0xc9, 0xde
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_pr_personalizationstring[] = {
++    0xfe, 0x4c, 0xd9, 0xf4, 0x78, 0x3b, 0x08, 0x41, 0x8d, 0x8f, 0x55, 0xc4,
++    0x43, 0x56, 0xb6, 0x12, 0x36, 0x6b, 0x30, 0xb7, 0x5e, 0xe1, 0xb9, 0x47,
++    0x04, 0xb1, 0x4e, 0xa9, 0x00, 0xa1, 0x52, 0xa1
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_additionalinput[] = {
++    0x89, 0xe9, 0xcc, 0x8f, 0x27, 0x3c, 0x26, 0xd1, 0x95, 0xc8, 0x7d, 0x0f,
++    0x5b, 0x1a, 0xf0, 0x78, 0x39, 0x56, 0x6f, 0xa4, 0x23, 0xe7, 0xd1, 0xda,
++    0x7c, 0x66, 0x33, 0xa0, 0x90, 0xc9, 0x92, 0x88
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinputpr[] = {
++    0xbe, 0x3d, 0x7c, 0x0d, 0xca, 0xda, 0x7c, 0x49, 0xb8, 0x12, 0x36, 0xc0,
++    0xdb, 0xad, 0x35, 0xa8, 0xc7, 0x0b, 0x2a, 0x2c, 0x69, 0x6d, 0x25, 0x56,
++    0x63, 0x82, 0x11, 0x3e, 0xa7, 0x33, 0x70, 0x72
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_int_returnedbits[] = {
++    0x82, 0x3d, 0xe6, 0x54, 0x80, 0x42, 0xf8, 0xba, 0x90, 0x4f, 0x06, 0xa6,
++    0xd2, 0x7f, 0xbf, 0x79, 0x7c, 0x12, 0x7d, 0xa6, 0xa2, 0x66, 0xe8, 0xa6,
++    0xc0, 0xd6, 0x4a, 0x55, 0xbf, 0xd8, 0x0a, 0xc5, 0xf8, 0x03, 0x88, 0xdd,
++    0x8e, 0x87, 0xd1, 0x5a, 0x48, 0x26, 0x72, 0x2a, 0x8e, 0xcf, 0xee, 0xba
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_additionalinput2[] = {
++    0x8f, 0xff, 0xd9, 0x84, 0xbb, 0x85, 0x3a, 0x66, 0xa1, 0x21, 0xce, 0xb2,
++    0x3a, 0x3a, 0x17, 0x22, 0x19, 0xae, 0xc7, 0xb6, 0x63, 0x81, 0xd5, 0xff,
++    0x0d, 0xc8, 0xe1, 0xaf, 0x57, 0xd2, 0xcb, 0x60
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_entropyinputpr2[] = {
++    0xd7, 0xfb, 0xc9, 0xe8, 0xe2, 0xf2, 0xaa, 0x4c, 0xb8, 0x51, 0x2f, 0xe1,
++    0x22, 0xba, 0xf3, 0xda, 0x0a, 0x19, 0x76, 0x71, 0x57, 0xb2, 0x1d, 0x94,
++    0x09, 0x69, 0x6c, 0xd3, 0x97, 0x51, 0x81, 0x87
++};
++
++__fips_constseg static const unsigned char hmac_sha384_pr_returnedbits[] = {
++    0xe6, 0x19, 0x28, 0xa8, 0x21, 0xce, 0x5e, 0xdb, 0x24, 0x79, 0x8c, 0x76,
++    0x5d, 0x73, 0xb2, 0xdf, 0xac, 0xef, 0x85, 0xa7, 0x3b, 0x19, 0x09, 0x8b,
++    0x7f, 0x98, 0x28, 0xa9, 0x93, 0xd8, 0x7a, 0xad, 0x55, 0x8b, 0x24, 0x9d,
++    0xe6, 0x98, 0xfe, 0x47, 0xd5, 0x48, 0xc1, 0x23, 0xd8, 0x1d, 0x62, 0x75
++};
++
++/* HMAC SHA-384 No PR  */
++__fips_constseg static const unsigned char hmac_sha384_entropyinput[] = {
++    0xc3, 0x56, 0x2b, 0x1d, 0xc2, 0xbb, 0xa8, 0xf0, 0xae, 0x1b, 0x0d, 0xd3,
++    0x5a, 0x6c, 0xda, 0x57, 0x8e, 0xa5, 0x8a, 0x0d, 0x6c, 0x4b, 0x18, 0xb1,
++    0x04, 0x3e, 0xb4, 0x99, 0x35, 0xc4, 0xc0, 0x5f
++};
++
++__fips_constseg static const unsigned char hmac_sha384_nonce[] = {
++    0xc5, 0x49, 0x1e, 0x66, 0x27, 0x92, 0xbe, 0xec, 0xb5, 0x1e, 0x4b, 0xb1,
++    0x38, 0xe3, 0xeb, 0x62
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_personalizationstring[] = {
++    0xbe, 0xe7, 0x6b, 0x57, 0xde, 0x88, 0x11, 0x96, 0x9b, 0x6e, 0xea, 0xe5,
++    0x63, 0x83, 0x4c, 0xb6, 0x8d, 0x66, 0xaa, 0x1f, 0x8b, 0x54, 0xe7, 0x62,
++    0x6d, 0x5a, 0xfc, 0xbf, 0x97, 0xba, 0xcd, 0x77
++};
++
++__fips_constseg static const unsigned char hmac_sha384_additionalinput[] = {
++    0xe5, 0x28, 0x5f, 0x43, 0xf5, 0x83, 0x6e, 0x0a, 0x83, 0x5c, 0xe3, 0x81,
++    0x03, 0xf2, 0xf8, 0x78, 0x00, 0x7c, 0x95, 0x87, 0x16, 0xd6, 0x6c, 0x58,
++    0x33, 0x6c, 0x53, 0x35, 0x0d, 0x66, 0xe3, 0xce
++};
++
++__fips_constseg static const unsigned char hmac_sha384_int_returnedbits[] = {
++    0xe2, 0x1f, 0xf3, 0xda, 0x0d, 0x19, 0x99, 0x87, 0xc4, 0x90, 0xa2, 0x31,
++    0xca, 0x2a, 0x89, 0x58, 0x43, 0x44, 0xb8, 0xde, 0xcf, 0xa4, 0xbe, 0x3b,
++    0x53, 0x26, 0x22, 0x31, 0x76, 0x41, 0x22, 0xb5, 0xa8, 0x70, 0x2f, 0x4b,
++    0x64, 0x95, 0x4d, 0x48, 0x96, 0x35, 0xe6, 0xbd, 0x3c, 0x34, 0xdb, 0x1b
++};
++
++__fips_constseg static const unsigned char hmac_sha384_entropyinputreseed[] = {
++    0x77, 0x61, 0xba, 0xbc, 0xf2, 0xc1, 0xf3, 0x4b, 0x86, 0x65, 0xfd, 0x48,
++    0x0e, 0x3c, 0x02, 0x5e, 0xa2, 0x7a, 0x6b, 0x7c, 0xed, 0x21, 0x5e, 0xf9,
++    0xcd, 0xcd, 0x77, 0x07, 0x2b, 0xbe, 0xc5, 0x5c
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha384_additionalinputreseed[] = {
++    0x18, 0x24, 0x5f, 0xc6, 0x84, 0xd1, 0x67, 0xc3, 0x9a, 0x11, 0xa5, 0x8c,
++    0x07, 0x39, 0x21, 0x83, 0x4d, 0x04, 0xc4, 0x6a, 0x28, 0x19, 0xcf, 0x92,
++    0x21, 0xd9, 0x9e, 0x41, 0x72, 0x6c, 0x9e, 0x63
++};
++
++__fips_constseg static const unsigned char hmac_sha384_additionalinput2[] = {
++    0x96, 0x67, 0x41, 0x28, 0x9b, 0xb7, 0x92, 0x8d, 0x64, 0x3b, 0xe4, 0xcf,
++    0x7e, 0xaa, 0x1e, 0xb1, 0x4b, 0x1d, 0x09, 0x56, 0x67, 0x9c, 0xc6, 0x6d,
++    0x3b, 0xe8, 0x91, 0x9d, 0xe1, 0x8a, 0xb7, 0x32
++};
++
++__fips_constseg static const unsigned char hmac_sha384_returnedbits[] = {
++    0xe3, 0x59, 0x61, 0x38, 0x92, 0xec, 0xe2, 0x3c, 0xff, 0xb7, 0xdb, 0x19,
++    0x0f, 0x5b, 0x93, 0x68, 0x0d, 0xa4, 0x94, 0x40, 0x72, 0x0b, 0xe0, 0xed,
++    0x4d, 0xcd, 0x68, 0xa0, 0x1e, 0xfe, 0x67, 0xb2, 0xfa, 0x21, 0x56, 0x74,
++    0xa4, 0xad, 0xcf, 0xb7, 0x60, 0x66, 0x2e, 0x40, 0xde, 0x82, 0xca, 0xfb
++};
++
++/* HMAC SHA-512 PR  */
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinput[] = {
++    0xaa, 0x9e, 0x45, 0x67, 0x0e, 0x00, 0x2a, 0x67, 0x98, 0xd6, 0xda, 0x0b,
++    0x0f, 0x17, 0x7e, 0xac, 0xfd, 0x27, 0xc4, 0xca, 0x84, 0xdf, 0xde, 0xba,
++    0x85, 0xd9, 0xbe, 0x8f, 0xf3, 0xff, 0x91, 0x4d
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_nonce[] = {
++    0x8c, 0x49, 0x2f, 0x58, 0x1e, 0x7a, 0xda, 0x4b, 0x7e, 0x8a, 0x30, 0x7b,
++    0x86, 0xea, 0xaf, 0xa2
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_pr_personalizationstring[] = {
++    0x71, 0xe1, 0xbb, 0xad, 0xa7, 0x4b, 0x2e, 0x31, 0x3b, 0x0b, 0xec, 0x24,
++    0x99, 0x38, 0xbc, 0xaa, 0x05, 0x4c, 0x46, 0x44, 0xfa, 0xad, 0x8e, 0x02,
++    0xc1, 0x7e, 0xad, 0xec, 0x54, 0xa6, 0xd0, 0xad
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_additionalinput[] = {
++    0x3d, 0x6e, 0xa6, 0xa8, 0x29, 0x2a, 0xb2, 0xf5, 0x98, 0x42, 0xe4, 0x92,
++    0x78, 0x22, 0x67, 0xfd, 0x1b, 0x15, 0x1e, 0x29, 0xaa, 0x71, 0x3c, 0x3c,
++    0xe7, 0x05, 0x20, 0xa9, 0x29, 0xc6, 0x75, 0x71
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinputpr[] = {
++    0xab, 0xb9, 0x16, 0xd8, 0x55, 0x35, 0x54, 0xb7, 0x97, 0x3f, 0x94, 0xbc,
++    0x2f, 0x7c, 0x70, 0xc7, 0xd0, 0xed, 0xb7, 0x4b, 0xf7, 0xf6, 0x6c, 0x03,
++    0x0c, 0xb0, 0x03, 0xd8, 0xbb, 0x71, 0xd9, 0x10
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_int_returnedbits[] = {
++    0x8e, 0xd3, 0xfd, 0x52, 0x9e, 0x83, 0x08, 0x49, 0x18, 0x6e, 0x23, 0x56,
++    0x5c, 0x45, 0x93, 0x34, 0x05, 0xe2, 0x98, 0x8f, 0x0c, 0xd4, 0x32, 0x0c,
++    0xfd, 0xda, 0x5f, 0x92, 0x3a, 0x8c, 0x81, 0xbd, 0xf6, 0x6c, 0x55, 0xfd,
++    0xb8, 0x20, 0xce, 0x8d, 0x97, 0x27, 0xe8, 0xe8, 0xe0, 0xb3, 0x85, 0x50,
++    0xa2, 0xc2, 0xb2, 0x95, 0x1d, 0x48, 0xd3, 0x7b, 0x4b, 0x78, 0x13, 0x35,
++    0x05, 0x17, 0xbe, 0x0d
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_additionalinput2[] = {
++    0xc3, 0xfc, 0x95, 0xaa, 0x69, 0x06, 0xae, 0x59, 0x41, 0xce, 0x26, 0x08,
++    0x29, 0x6d, 0x45, 0xda, 0xe8, 0xb3, 0x6c, 0x95, 0x60, 0x0f, 0x70, 0x2c,
++    0x10, 0xba, 0x38, 0x8c, 0xcf, 0x29, 0x99, 0xaa
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_entropyinputpr2[] = {
++    0x3b, 0x9a, 0x25, 0xce, 0xd7, 0xf9, 0x5c, 0xd1, 0x3a, 0x3e, 0xaa, 0x71,
++    0x14, 0x3e, 0x19, 0xe8, 0xce, 0xe6, 0xfe, 0x51, 0x84, 0xe9, 0x1b, 0xfe,
++    0x3f, 0xa7, 0xf2, 0xfd, 0x76, 0x5f, 0x6a, 0xe7
++};
++
++__fips_constseg static const unsigned char hmac_sha512_pr_returnedbits[] = {
++    0xb7, 0x82, 0xa9, 0x57, 0x81, 0x67, 0x53, 0xb5, 0xa1, 0xe9, 0x3d, 0x35,
++    0xf9, 0xe4, 0x97, 0xbe, 0xa6, 0xca, 0xf1, 0x01, 0x13, 0x09, 0xe7, 0x21,
++    0xc0, 0xed, 0x93, 0x5d, 0x4b, 0xf4, 0xeb, 0x8d, 0x53, 0x25, 0x8a, 0xc4,
++    0xb1, 0x6f, 0x6e, 0x37, 0xcd, 0x2e, 0xac, 0x39, 0xb2, 0xb6, 0x99, 0xa3,
++    0x82, 0x00, 0xb0, 0x21, 0xf0, 0xc7, 0x2f, 0x4c, 0x73, 0x92, 0xfd, 0x00,
++    0xb6, 0xaf, 0xbc, 0xd3
++};
++
++/* HMAC SHA-512 No PR  */
++__fips_constseg static const unsigned char hmac_sha512_entropyinput[] = {
++    0x6e, 0x85, 0xe6, 0x25, 0x96, 0x29, 0xa7, 0x52, 0x5b, 0x60, 0xba, 0xaa,
++    0xde, 0xdb, 0x36, 0x0a, 0x51, 0x9a, 0x15, 0xae, 0x6e, 0x18, 0xd3, 0xfe,
++    0x39, 0xb9, 0x4a, 0x96, 0xf8, 0x77, 0xcb, 0x95
++};
++
++__fips_constseg static const unsigned char hmac_sha512_nonce[] = {
++    0xe0, 0xa6, 0x5d, 0x08, 0xc3, 0x7c, 0xae, 0x25, 0x2e, 0x80, 0xd1, 0x3e,
++    0xd9, 0xaf, 0x43, 0x3c
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_personalizationstring[] = {
++    0x53, 0x99, 0x52, 0x5f, 0x11, 0xa9, 0x64, 0x66, 0x20, 0x5e, 0x1b, 0x5f,
++    0x42, 0xb3, 0xf4, 0xda, 0xed, 0xbb, 0x63, 0xc1, 0x23, 0xaf, 0xd0, 0x01,
++    0x90, 0x3b, 0xd0, 0x78, 0xe4, 0x0b, 0xa7, 0x20
++};
++
++__fips_constseg static const unsigned char hmac_sha512_additionalinput[] = {
++    0x85, 0x90, 0x80, 0xd3, 0x98, 0xf1, 0x53, 0x6d, 0x68, 0x15, 0x8f, 0xe5,
++    0x60, 0x3f, 0x17, 0x29, 0x55, 0x8d, 0x33, 0xb1, 0x45, 0x64, 0x64, 0x8d,
++    0x50, 0x21, 0x89, 0xae, 0xf6, 0xfd, 0x32, 0x73
++};
++
++__fips_constseg static const unsigned char hmac_sha512_int_returnedbits[] = {
++    0x28, 0x56, 0x30, 0x6f, 0xf4, 0xa1, 0x48, 0xe0, 0xc9, 0xf5, 0x75, 0x90,
++    0xcc, 0xfb, 0xdf, 0xdf, 0x71, 0x3d, 0x0a, 0x9a, 0x03, 0x65, 0x3b, 0x18,
++    0x61, 0xe3, 0xd1, 0xda, 0xcc, 0x4a, 0xfe, 0x55, 0x38, 0xf8, 0x21, 0x6b,
++    0xfa, 0x18, 0x01, 0x42, 0x39, 0x2f, 0x99, 0x53, 0x38, 0x15, 0x82, 0x34,
++    0xc5, 0x93, 0x92, 0xbc, 0x4d, 0x75, 0x1a, 0x5f, 0x21, 0x27, 0xcc, 0xa1,
++    0xb1, 0x57, 0x69, 0xe8
++};
++
++__fips_constseg static const unsigned char hmac_sha512_entropyinputreseed[] = {
++    0x8c, 0x52, 0x7e, 0x77, 0x72, 0x3f, 0xa3, 0x04, 0x97, 0x10, 0x9b, 0x41,
++    0xbd, 0xe8, 0xff, 0x89, 0xed, 0x80, 0xe3, 0xbd, 0xaa, 0x12, 0x2d, 0xca,
++    0x75, 0x82, 0x36, 0x77, 0x88, 0xcd, 0xa6, 0x73
++};
++
++__fips_constseg
++    static const unsigned char hmac_sha512_additionalinputreseed[] = {
++    0x7e, 0x32, 0xe3, 0x69, 0x69, 0x07, 0x34, 0xa2, 0x16, 0xa2, 0x5d, 0x1a,
++    0x10, 0x91, 0xd3, 0xe2, 0x21, 0xa2, 0xa3, 0xdd, 0xcd, 0x0c, 0x09, 0x86,
++    0x11, 0xe1, 0x50, 0xff, 0x5c, 0xb7, 0xeb, 0x5c
++};
++
++__fips_constseg static const unsigned char hmac_sha512_additionalinput2[] = {
++    0x7f, 0x78, 0x66, 0xd8, 0xfb, 0x67, 0xcf, 0x8d, 0x8c, 0x08, 0x30, 0xa5,
++    0xf8, 0x7d, 0xcf, 0x44, 0x59, 0xce, 0xf8, 0xdf, 0x58, 0xd3, 0x60, 0xcb,
++    0xa8, 0x60, 0xb9, 0x07, 0xc4, 0xb1, 0x95, 0x48
++};
++
++__fips_constseg static const unsigned char hmac_sha512_returnedbits[] = {
++    0xdf, 0xa7, 0x36, 0xd4, 0xdc, 0x5d, 0x4d, 0x31, 0xad, 0x69, 0x46, 0x9f,
++    0xf1, 0x7c, 0xd7, 0x3b, 0x4f, 0x55, 0xf2, 0xd7, 0xb9, 0x9d, 0xad, 0x7a,
++    0x79, 0x08, 0x59, 0xa5, 0xdc, 0x74, 0xf5, 0x9b, 0x73, 0xd2, 0x13, 0x25,
++    0x0b, 0x81, 0x08, 0x08, 0x25, 0xfb, 0x39, 0xf2, 0xf0, 0xa3, 0xa4, 0x8d,
++    0xef, 0x05, 0x9e, 0xb8, 0xc7, 0x52, 0xe4, 0x0e, 0x42, 0xaa, 0x7c, 0x79,
++    0xc2, 0xd6, 0xfd, 0xa5
++};
+diff -up openssl-1.1.1/crypto/fips/fips_dsa_selftest.c.fips openssl-1.1.1/crypto/fips/fips_dsa_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_dsa_selftest.c.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_dsa_selftest.c	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,195 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/dsa.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++static const unsigned char dsa_test_2048_p[] = {
++    0xa8, 0x53, 0x78, 0xd8, 0xfd, 0x3f, 0x8d, 0x72, 0xec, 0x74, 0x18, 0x08,
++    0x0d, 0xa2, 0x13, 0x17, 0xe4, 0x3e, 0xc4, 0xb6, 0x2b, 0xa8, 0xc8, 0x62,
++    0x3b, 0x7e, 0x4d, 0x04, 0x44, 0x1d, 0xd1, 0xa0, 0x65, 0x86, 0x62, 0x59,
++    0x64, 0x93, 0xca, 0x8e, 0x9e, 0x8f, 0xbb, 0x7e, 0x34, 0xaa, 0xdd, 0xb6,
++    0x2e, 0x5d, 0x67, 0xb6, 0xd0, 0x9a, 0x6e, 0x61, 0xb7, 0x69, 0xe7, 0xc3,
++    0x52, 0xaa, 0x2b, 0x10, 0xe2, 0x0c, 0xa0, 0x63, 0x69, 0x63, 0xb5, 0x52,
++    0x3e, 0x86, 0x47, 0x0d, 0xec, 0xbb, 0xed, 0xa0, 0x27, 0xe7, 0x97, 0xe7,
++    0xb6, 0x76, 0x35, 0xd4, 0xd4, 0x9c, 0x30, 0x70, 0x0e, 0x74, 0xaf, 0x8a,
++    0x0f, 0xf1, 0x56, 0xa8, 0x01, 0xaf, 0x57, 0xa2, 0x6e, 0x70, 0x78, 0xf1,
++    0xd8, 0x2f, 0x74, 0x90, 0x8e, 0xcb, 0x6d, 0x07, 0xe7, 0x0b, 0x35, 0x03,
++    0xee, 0xd9, 0x4f, 0xa3, 0x2c, 0xf1, 0x7a, 0x7f, 0xc3, 0xd6, 0xcf, 0x40,
++    0xdc, 0x7b, 0x00, 0x83, 0x0e, 0x6a, 0x25, 0x66, 0xdc, 0x07, 0x3e, 0x34,
++    0x33, 0x12, 0x51, 0x7c, 0x6a, 0xa5, 0x15, 0x2b, 0x4b, 0xfe, 0xcd, 0x2e,
++    0x55, 0x1f, 0xee, 0x34, 0x63, 0x18, 0xa1, 0x53, 0x42, 0x3c, 0x99, 0x6b,
++    0x0d, 0x5d, 0xcb, 0x91, 0x02, 0xae, 0xdd, 0x38, 0x79, 0x86, 0x16, 0xf1,
++    0xf1, 0xe0, 0xd6, 0xc4, 0x03, 0x52, 0x5b, 0x1f, 0x9b, 0x3d, 0x4d, 0xc7,
++    0x66, 0xde, 0x2d, 0xfc, 0x4a, 0x56, 0xd7, 0xb8, 0xba, 0x59, 0x63, 0xd6,
++    0x0f, 0x3e, 0x16, 0x31, 0x88, 0x70, 0xad, 0x43, 0x69, 0x52, 0xe5, 0x57,
++    0x65, 0x37, 0x4e, 0xab, 0x85, 0xe8, 0xec, 0x17, 0xd6, 0xb9, 0xa4, 0x54,
++    0x7b, 0x9b, 0x5f, 0x27, 0x52, 0xf3, 0x10, 0x5b, 0xe8, 0x09, 0xb2, 0x3a,
++    0x2c, 0x8d, 0x74, 0x69, 0xdb, 0x02, 0xe2, 0x4d, 0x59, 0x23, 0x94, 0xa7,
++    0xdb, 0xa0, 0x69, 0xe9
++};
++
++static const unsigned char dsa_test_2048_q[] = {
++    0xd2, 0x77, 0x04, 0x4e, 0x50, 0xf5, 0xa4, 0xe3, 0xf5, 0x10, 0xa5, 0x0a,
++    0x0b, 0x84, 0xfd, 0xff, 0xbc, 0xa0, 0x47, 0xed, 0x27, 0x60, 0x20, 0x56,
++    0x74, 0x41, 0xa0, 0xa5
++};
++
++static const unsigned char dsa_test_2048_g[] = {
++    0x13, 0xd7, 0x54, 0xe2, 0x1f, 0xd2, 0x41, 0x65, 0x5d, 0xa8, 0x91, 0xc5,
++    0x22, 0xa6, 0x5a, 0x72, 0xa8, 0x9b, 0xdc, 0x64, 0xec, 0x9b, 0x54, 0xa8,
++    0x21, 0xed, 0x4a, 0x89, 0x8b, 0x49, 0x0e, 0x0c, 0x4f, 0xcb, 0x72, 0x19,
++    0x2a, 0x4a, 0x20, 0xf5, 0x41, 0xf3, 0xf2, 0x92, 0x53, 0x99, 0xf0, 0xba,
++    0xec, 0xf9, 0x29, 0xaa, 0xfb, 0xf7, 0x9d, 0xfe, 0x43, 0x32, 0x39, 0x3b,
++    0x32, 0xcd, 0x2e, 0x2f, 0xcf, 0x27, 0x2f, 0x32, 0xa6, 0x27, 0x43, 0x4a,
++    0x0d, 0xf2, 0x42, 0xb7, 0x5b, 0x41, 0x4d, 0xf3, 0x72, 0x12, 0x1e, 0x53,
++    0xa5, 0x53, 0xf2, 0x22, 0xf8, 0x36, 0xb0, 0x00, 0xf0, 0x16, 0x48, 0x5b,
++    0x6b, 0xd0, 0x89, 0x84, 0x51, 0x80, 0x1d, 0xcd, 0x8d, 0xe6, 0x4c, 0xd5,
++    0x36, 0x56, 0x96, 0xff, 0xc5, 0x32, 0xd5, 0x28, 0xc5, 0x06, 0x62, 0x0a,
++    0x94, 0x2a, 0x03, 0x05, 0x04, 0x6d, 0x8f, 0x18, 0x76, 0x34, 0x1f, 0x1e,
++    0x57, 0x0b, 0xc3, 0x97, 0x4b, 0xa6, 0xb9, 0xa4, 0x38, 0xe9, 0x70, 0x23,
++    0x02, 0xa2, 0xe6, 0xe6, 0x7b, 0xfd, 0x06, 0xd3, 0x2b, 0xc6, 0x79, 0x96,
++    0x22, 0x71, 0xd7, 0xb4, 0x0c, 0xd7, 0x2f, 0x38, 0x6e, 0x64, 0xe0, 0xd7,
++    0xef, 0x86, 0xca, 0x8c, 0xa5, 0xd1, 0x42, 0x28, 0xdc, 0x2a, 0x4f, 0x16,
++    0xe3, 0x18, 0x98, 0x86, 0xb5, 0x99, 0x06, 0x74, 0xf4, 0x20, 0x0f, 0x3a,
++    0x4c, 0xf6, 0x5a, 0x3f, 0x0d, 0xdb, 0xa1, 0xfa, 0x67, 0x2d, 0xff, 0x2f,
++    0x5e, 0x14, 0x3d, 0x10, 0xe4, 0xe9, 0x7a, 0xe8, 0x4f, 0x6d, 0xa0, 0x95,
++    0x35, 0xd5, 0xb9, 0xdf, 0x25, 0x91, 0x81, 0xa7, 0x9b, 0x63, 0xb0, 0x69,
++    0xe9, 0x49, 0x97, 0x2b, 0x02, 0xba, 0x36, 0xb3, 0x58, 0x6a, 0xab, 0x7e,
++    0x45, 0xf3, 0x22, 0xf8, 0x2e, 0x4e, 0x85, 0xca, 0x3a, 0xb8, 0x55, 0x91,
++    0xb3, 0xc2, 0xa9, 0x66
++};
++
++static const unsigned char dsa_test_2048_pub_key[] = {
++    0x24, 0x52, 0xf3, 0xcc, 0xbe, 0x9e, 0xd5, 0xca, 0x7d, 0xc7, 0x4c, 0x60,
++    0x2b, 0x99, 0x22, 0x6e, 0x8f, 0x2f, 0xab, 0x38, 0xe7, 0xd7, 0xdd, 0xfb,
++    0x75, 0x53, 0x9b, 0x17, 0x15, 0x5e, 0x9f, 0xcf, 0xd1, 0xab, 0xa5, 0x64,
++    0xeb, 0x85, 0x35, 0xd8, 0x12, 0xc9, 0xc2, 0xdc, 0xf9, 0x72, 0x84, 0x44,
++    0x1b, 0xc4, 0x82, 0x24, 0x36, 0x24, 0xc7, 0xf4, 0x57, 0x58, 0x0c, 0x1c,
++    0x38, 0xa5, 0x7c, 0x46, 0xc4, 0x57, 0x39, 0x24, 0x70, 0xed, 0xb5, 0x2c,
++    0xb5, 0xa6, 0xe0, 0x3f, 0xe6, 0x28, 0x7b, 0xb6, 0xf4, 0x9a, 0x42, 0xa2,
++    0x06, 0x5a, 0x05, 0x4f, 0x03, 0x08, 0x39, 0xdf, 0x1f, 0xd3, 0x14, 0x9c,
++    0x4c, 0xa0, 0x53, 0x1d, 0xd8, 0xca, 0x8a, 0xaa, 0x9c, 0xc7, 0x33, 0x71,
++    0x93, 0x38, 0x73, 0x48, 0x33, 0x61, 0x18, 0x22, 0x45, 0x45, 0xe8, 0x8c,
++    0x80, 0xff, 0xd8, 0x76, 0x5d, 0x74, 0x36, 0x03, 0x33, 0xcc, 0xab, 0x99,
++    0x72, 0x77, 0x9b, 0x65, 0x25, 0xa6, 0x5b, 0xdd, 0x0d, 0x10, 0xc6, 0x75,
++    0xc1, 0x09, 0xbb, 0xd3, 0xe5, 0xbe, 0x4d, 0x72, 0xef, 0x6e, 0xba, 0x6e,
++    0x43, 0x8d, 0x52, 0x26, 0x23, 0x7d, 0xb8, 0x88, 0x37, 0x9c, 0x5f, 0xcc,
++    0x47, 0xa3, 0x84, 0x7f, 0xf6, 0x37, 0x11, 0xba, 0xed, 0x6d, 0x03, 0xaf,
++    0xe8, 0x1e, 0x69, 0x4a, 0x41, 0x3b, 0x68, 0x0b, 0xd3, 0x8a, 0xb4, 0x90,
++    0x3f, 0x83, 0x70, 0xa7, 0x07, 0xef, 0x55, 0x1d, 0x49, 0x41, 0x02, 0x6d,
++    0x95, 0x79, 0xd6, 0x91, 0xde, 0x8e, 0xda, 0xa1, 0x61, 0x05, 0xeb, 0x9d,
++    0xba, 0x3c, 0x2f, 0x4c, 0x1b, 0xec, 0x50, 0x82, 0x75, 0xaa, 0x02, 0x07,
++    0xe2, 0x51, 0xb5, 0xec, 0xcb, 0x28, 0x6a, 0x4b, 0x01, 0xd4, 0x49, 0xd3,
++    0x0a, 0xcb, 0x67, 0x37, 0x17, 0xa0, 0xd2, 0xfb, 0x3b, 0x50, 0xc8, 0x93,
++    0xf7, 0xda, 0xb1, 0x4f
++};
++
++static const unsigned char dsa_test_2048_priv_key[] = {
++    0x0c, 0x4b, 0x30, 0x89, 0xd1, 0xb8, 0x62, 0xcb, 0x3c, 0x43, 0x64, 0x91,
++    0xf0, 0x91, 0x54, 0x70, 0xc5, 0x27, 0x96, 0xe3, 0xac, 0xbe, 0xe8, 0x00,
++    0xec, 0x55, 0xf6, 0xcc
++};
++
++int FIPS_selftest_dsa()
++{
++    DSA *dsa = NULL;
++    EVP_PKEY *pk = NULL;
++    int ret = -1;
++    BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub_key = NULL, *priv_key = NULL;
++
++    fips_load_key_component(p, dsa_test_2048);
++    fips_load_key_component(q, dsa_test_2048);
++    fips_load_key_component(g, dsa_test_2048);
++    fips_load_key_component(pub_key, dsa_test_2048);
++    fips_load_key_component(priv_key, dsa_test_2048);
++
++    dsa = DSA_new();
++
++    if (dsa == NULL)
++        goto err;
++
++    DSA_set0_pqg(dsa, p, q, g);
++
++    DSA_set0_key(dsa, pub_key, priv_key);
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_assign_DSA(pk, dsa);
++
++    if (!fips_pkey_signature_test(pk, NULL, 0,
++                                  NULL, 0, EVP_sha256(), 0, "DSA SHA256"))
++        goto err;
++    ret = 1;
++
++ err:
++    if (pk)
++        EVP_PKEY_free(pk);
++    else if (dsa)
++        DSA_free(dsa);
++    else {
++        BN_free(p);
++        BN_free(q);
++        BN_free(g);
++        BN_free(pub_key);
++        BN_free(priv_key);
++    }
++    return ret;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_ecdh_selftest.c.fips openssl-1.1.1/crypto/fips/fips_ecdh_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_ecdh_selftest.c.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_ecdh_selftest.c	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,242 @@
++/* fips/ecdh/fips_ecdh_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project 2011.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/ec.h>
++#include <openssl/ecdh.h>
++#include <openssl/fips.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++
++# include "fips_locl.h"
++
++static const unsigned char p256_qcavsx[] = {
++    0x52, 0xc6, 0xa5, 0x75, 0xf3, 0x04, 0x98, 0xb3, 0x29, 0x66, 0x0c, 0x62,
++    0x18, 0x60, 0x55, 0x41, 0x59, 0xd4, 0x60, 0x85, 0x99, 0xc1, 0x51, 0x13,
++    0x6f, 0x97, 0x85, 0x93, 0x33, 0x34, 0x07, 0x50
++};
++
++static const unsigned char p256_qcavsy[] = {
++    0x6f, 0x69, 0x24, 0xeb, 0xe9, 0x3b, 0xa7, 0xcc, 0x47, 0x17, 0xaa, 0x3f,
++    0x70, 0xfc, 0x10, 0x73, 0x0a, 0xcd, 0x21, 0xee, 0x29, 0x19, 0x1f, 0xaf,
++    0xb4, 0x1c, 0x1e, 0xc2, 0x8e, 0x97, 0x81, 0x6e
++};
++
++static const unsigned char p256_qiutx[] = {
++    0x71, 0x46, 0x88, 0x08, 0x92, 0x21, 0x1b, 0x10, 0x21, 0x74, 0xff, 0x0c,
++    0x94, 0xde, 0x34, 0x7c, 0x86, 0x74, 0xbe, 0x67, 0x41, 0x68, 0xd4, 0xc1,
++    0xe5, 0x75, 0x63, 0x9c, 0xa7, 0x46, 0x93, 0x6f
++};
++
++static const unsigned char p256_qiuty[] = {
++    0x33, 0x40, 0xa9, 0x6a, 0xf5, 0x20, 0xb5, 0x9e, 0xfc, 0x60, 0x1a, 0xae,
++    0x3d, 0xf8, 0x21, 0xd2, 0xa7, 0xca, 0x52, 0x34, 0xb9, 0x5f, 0x27, 0x75,
++    0x6c, 0x81, 0xbe, 0x32, 0x4d, 0xba, 0xbb, 0xf8
++};
++
++static const unsigned char p256_qiutd[] = {
++    0x1a, 0x48, 0x55, 0x6b, 0x11, 0xbe, 0x92, 0xd4, 0x1c, 0xd7, 0x45, 0xc3,
++    0x82, 0x81, 0x51, 0xf1, 0x23, 0x40, 0xb7, 0x83, 0xfd, 0x01, 0x6d, 0xbc,
++    0xa1, 0x66, 0xaf, 0x0a, 0x03, 0x23, 0xcd, 0xc8
++};
++
++static const unsigned char p256_ziut[] = {
++    0x77, 0x2a, 0x1e, 0x37, 0xee, 0xe6, 0x51, 0x02, 0x71, 0x40, 0xf8, 0x6a,
++    0x36, 0xf8, 0x65, 0x61, 0x2b, 0x18, 0x71, 0x82, 0x23, 0xe6, 0xf2, 0x77,
++    0xce, 0xec, 0xb8, 0x49, 0xc7, 0xbf, 0x36, 0x4f
++};
++
++typedef struct {
++    int curve;
++    const unsigned char *x1;
++    size_t x1len;
++    const unsigned char *y1;
++    size_t y1len;
++    const unsigned char *d1;
++    size_t d1len;
++    const unsigned char *x2;
++    size_t x2len;
++    const unsigned char *y2;
++    size_t y2len;
++    const unsigned char *z;
++    size_t zlen;
++} ECDH_SELFTEST_DATA;
++
++# define make_ecdh_test(nid, pr) { nid, \
++                                pr##_qiutx, sizeof(pr##_qiutx), \
++                                pr##_qiuty, sizeof(pr##_qiuty), \
++                                pr##_qiutd, sizeof(pr##_qiutd), \
++                                pr##_qcavsx, sizeof(pr##_qcavsx), \
++                                pr##_qcavsy, sizeof(pr##_qcavsy), \
++                                pr##_ziut, sizeof(pr##_ziut) }
++
++static ECDH_SELFTEST_DATA test_ecdh_data[] = {
++    make_ecdh_test(NID_X9_62_prime256v1, p256),
++};
++
++int FIPS_selftest_ecdh(void)
++{
++    EC_KEY *ec1 = NULL, *ec2 = NULL;
++    const EC_POINT *ecp = NULL;
++    BIGNUM *x = NULL, *y = NULL, *d = NULL;
++    unsigned char *ztmp = NULL;
++    int rv = 1;
++    size_t i;
++
++    for (i = 0; i < sizeof(test_ecdh_data) / sizeof(ECDH_SELFTEST_DATA); i++) {
++        ECDH_SELFTEST_DATA *ecd = test_ecdh_data + i;
++        if (!fips_post_started(FIPS_TEST_ECDH, ecd->curve, 0))
++            continue;
++        ztmp = OPENSSL_malloc(ecd->zlen);
++
++        x = BN_bin2bn(ecd->x1, ecd->x1len, x);
++        y = BN_bin2bn(ecd->y1, ecd->y1len, y);
++        d = BN_bin2bn(ecd->d1, ecd->d1len, d);
++
++        if (!x || !y || !d || !ztmp) {
++            rv = -1;
++            goto err;
++        }
++
++        ec1 = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec1) {
++            rv = -1;
++            goto err;
++        }
++        EC_KEY_set_flags(ec1, EC_FLAG_COFACTOR_ECDH);
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec1, x, y)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!EC_KEY_set_private_key(ec1, d)) {
++            rv = -1;
++            goto err;
++        }
++
++        x = BN_bin2bn(ecd->x2, ecd->x2len, x);
++        y = BN_bin2bn(ecd->y2, ecd->y2len, y);
++
++        if (!x || !y) {
++            rv = -1;
++            goto err;
++        }
++
++        ec2 = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec2) {
++            rv = -1;
++            goto err;
++        }
++        EC_KEY_set_flags(ec1, EC_FLAG_COFACTOR_ECDH);
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec2, x, y)) {
++            rv = -1;
++            goto err;
++        }
++
++        ecp = EC_KEY_get0_public_key(ec2);
++        if (!ecp) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!ECDH_compute_key(ztmp, ecd->zlen, ecp, ec1, 0)) {
++            rv = -1;
++            goto err;
++        }
++
++        if (!fips_post_corrupt(FIPS_TEST_ECDH, ecd->curve, NULL))
++            ztmp[0] ^= 0x1;
++
++        if (memcmp(ztmp, ecd->z, ecd->zlen)) {
++            fips_post_failed(FIPS_TEST_ECDH, ecd->curve, 0);
++            rv = 0;
++        } else if (!fips_post_success(FIPS_TEST_ECDH, ecd->curve, 0))
++            goto err;
++
++        EC_KEY_free(ec1);
++        ec1 = NULL;
++        EC_KEY_free(ec2);
++        ec2 = NULL;
++        OPENSSL_free(ztmp);
++        ztmp = NULL;
++    }
++
++ err:
++
++    if (x)
++        BN_clear_free(x);
++    if (y)
++        BN_clear_free(y);
++    if (d)
++        BN_clear_free(d);
++    if (ec1)
++        EC_KEY_free(ec1);
++    if (ec2)
++        EC_KEY_free(ec2);
++    if (ztmp)
++        OPENSSL_free(ztmp);
++
++    return rv;
++
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_ecdsa_selftest.c.fips openssl-1.1.1/crypto/fips/fips_ecdsa_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_ecdsa_selftest.c.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_ecdsa_selftest.c	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,166 @@
++/* fips/ecdsa/fips_ecdsa_selftest.c */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project 2011.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <string.h>
++#include <openssl/crypto.h>
++#include <openssl/ec.h>
++#include <openssl/ecdsa.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifdef OPENSSL_FIPS
++
++static const char P_256_name[] = "ECDSA P-256";
++
++static const unsigned char P_256_d[] = {
++    0x51, 0xbd, 0x06, 0xa1, 0x1c, 0xda, 0xe2, 0x12, 0x99, 0xc9, 0x52, 0x3f,
++    0xea, 0xa4, 0xd2, 0xd1, 0xf4, 0x7f, 0xd4, 0x3e, 0xbd, 0xf8, 0xfc, 0x87,
++    0xdc, 0x82, 0x53, 0x21, 0xee, 0xa0, 0xdc, 0x64
++};
++
++static const unsigned char P_256_qx[] = {
++    0x23, 0x89, 0xe0, 0xf4, 0x69, 0xe0, 0x49, 0xe5, 0xc7, 0xe5, 0x40, 0x6e,
++    0x8f, 0x25, 0xdd, 0xad, 0x11, 0x16, 0x14, 0x9b, 0xab, 0x44, 0x06, 0x31,
++    0xbf, 0x5e, 0xa6, 0x44, 0xac, 0x86, 0x00, 0x07
++};
++
++static const unsigned char P_256_qy[] = {
++    0xb3, 0x05, 0x0d, 0xd0, 0xdc, 0xf7, 0x40, 0xe6, 0xf9, 0xd8, 0x6d, 0x7b,
++    0x63, 0xca, 0x97, 0xe6, 0x12, 0xf9, 0xd4, 0x18, 0x59, 0xbe, 0xb2, 0x5e,
++    0x4a, 0x6a, 0x77, 0x23, 0xf4, 0x11, 0x9d, 0xeb
++};
++
++typedef struct {
++    int curve;
++    const char *name;
++    const unsigned char *x;
++    size_t xlen;
++    const unsigned char *y;
++    size_t ylen;
++    const unsigned char *d;
++    size_t dlen;
++} EC_SELFTEST_DATA;
++
++# define make_ecdsa_test(nid, pr) { nid, pr##_name, \
++                                pr##_qx, sizeof(pr##_qx), \
++                                pr##_qy, sizeof(pr##_qy), \
++                                pr##_d, sizeof(pr##_d)}
++
++static EC_SELFTEST_DATA test_ec_data[] = {
++    make_ecdsa_test(NID_X9_62_prime256v1, P_256),
++};
++
++int FIPS_selftest_ecdsa()
++{
++    EC_KEY *ec = NULL;
++    BIGNUM *x = NULL, *y = NULL, *d = NULL;
++    EVP_PKEY *pk = NULL;
++    int rv = 0;
++    size_t i;
++
++    for (i = 0; i < sizeof(test_ec_data) / sizeof(EC_SELFTEST_DATA); i++) {
++        EC_SELFTEST_DATA *ecd = test_ec_data + i;
++
++        x = BN_bin2bn(ecd->x, ecd->xlen, x);
++        y = BN_bin2bn(ecd->y, ecd->ylen, y);
++        d = BN_bin2bn(ecd->d, ecd->dlen, d);
++
++        if (!x || !y || !d)
++            goto err;
++
++        ec = EC_KEY_new_by_curve_name(ecd->curve);
++        if (!ec)
++            goto err;
++
++        if (!EC_KEY_set_public_key_affine_coordinates(ec, x, y))
++            goto err;
++
++        if (!EC_KEY_set_private_key(ec, d))
++            goto err;
++
++        if ((pk = EVP_PKEY_new()) == NULL)
++            goto err;
++
++        EVP_PKEY_assign_EC_KEY(pk, ec);
++
++        if (!fips_pkey_signature_test(pk, NULL, 0,
++                                      NULL, 0, EVP_sha256(), 0, ecd->name))
++            goto err;
++    }
++
++    rv = 1;
++
++ err:
++
++    if (x)
++        BN_clear_free(x);
++    if (y)
++        BN_clear_free(y);
++    if (d)
++        BN_clear_free(d);
++    if (pk)
++        EVP_PKEY_free(pk);
++    else if (ec)
++        EC_KEY_free(ec);
++
++    return rv;
++
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_enc.c.fips openssl-1.1.1/crypto/fips/fips_enc.c
+--- openssl-1.1.1/crypto/fips/fips_enc.c.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_enc.c	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,189 @@
++/* fipe/evp/fips_enc.c */
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ * 
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ * 
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ * 
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from 
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ * 
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ * 
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++
++#include <stdio.h>
++#include <string.h>
++#include <openssl/evp.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++
++const EVP_CIPHER *FIPS_get_cipherbynid(int nid)
++{
++    switch (nid) {
++    case NID_aes_128_cbc:
++        return EVP_aes_128_cbc();
++
++    case NID_aes_128_ccm:
++        return EVP_aes_128_ccm();
++
++    case NID_aes_128_cfb1:
++        return EVP_aes_128_cfb1();
++
++    case NID_aes_128_cfb128:
++        return EVP_aes_128_cfb128();
++
++    case NID_aes_128_cfb8:
++        return EVP_aes_128_cfb8();
++
++    case NID_aes_128_ctr:
++        return EVP_aes_128_ctr();
++
++    case NID_aes_128_ecb:
++        return EVP_aes_128_ecb();
++
++    case NID_aes_128_gcm:
++        return EVP_aes_128_gcm();
++
++    case NID_aes_128_ofb128:
++        return EVP_aes_128_ofb();
++
++    case NID_aes_128_xts:
++        return EVP_aes_128_xts();
++
++    case NID_aes_192_cbc:
++        return EVP_aes_192_cbc();
++
++    case NID_aes_192_ccm:
++        return EVP_aes_192_ccm();
++
++    case NID_aes_192_cfb1:
++        return EVP_aes_192_cfb1();
++
++    case NID_aes_192_cfb128:
++        return EVP_aes_192_cfb128();
++
++    case NID_aes_192_cfb8:
++        return EVP_aes_192_cfb8();
++
++    case NID_aes_192_ctr:
++        return EVP_aes_192_ctr();
++
++    case NID_aes_192_ecb:
++        return EVP_aes_192_ecb();
++
++    case NID_aes_192_gcm:
++        return EVP_aes_192_gcm();
++
++    case NID_aes_192_ofb128:
++        return EVP_aes_192_ofb();
++
++    case NID_aes_256_cbc:
++        return EVP_aes_256_cbc();
++
++    case NID_aes_256_ccm:
++        return EVP_aes_256_ccm();
++
++    case NID_aes_256_cfb1:
++        return EVP_aes_256_cfb1();
++
++    case NID_aes_256_cfb128:
++        return EVP_aes_256_cfb128();
++
++    case NID_aes_256_cfb8:
++        return EVP_aes_256_cfb8();
++
++    case NID_aes_256_ctr:
++        return EVP_aes_256_ctr();
++
++    case NID_aes_256_ecb:
++        return EVP_aes_256_ecb();
++
++    case NID_aes_256_gcm:
++        return EVP_aes_256_gcm();
++
++    case NID_aes_256_ofb128:
++        return EVP_aes_256_ofb();
++
++    case NID_aes_256_xts:
++        return EVP_aes_256_xts();
++
++    case NID_des_ede_ecb:
++        return EVP_des_ede();
++
++    case NID_des_ede3_ecb:
++        return EVP_des_ede3();
++
++    case NID_des_ede3_cbc:
++        return EVP_des_ede3_cbc();
++
++    case NID_des_ede3_cfb1:
++        return EVP_des_ede3_cfb1();
++
++    case NID_des_ede3_cfb64:
++        return EVP_des_ede3_cfb64();
++
++    case NID_des_ede3_cfb8:
++        return EVP_des_ede3_cfb8();
++
++    case NID_des_ede3_ofb64:
++        return EVP_des_ede3_ofb();
++
++    case NID_des_ede_cbc:
++        return EVP_des_ede_cbc();
++
++    case NID_des_ede_cfb64:
++        return EVP_des_ede_cfb64();
++
++    case NID_des_ede_ofb64:
++        return EVP_des_ede_ofb();
++
++    default:
++        return NULL;
++
++    }
++}
+diff -up openssl-1.1.1/crypto/fips/fips_err.h.fips openssl-1.1.1/crypto/fips/fips_err.h
+--- openssl-1.1.1/crypto/fips/fips_err.h.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_err.h	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,196 @@
++/* crypto/fips_err.h */
++/* ====================================================================
++ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ * This product includes cryptographic software written by Eric Young
++ * (eay@cryptsoft.com).  This product includes software written by Tim
++ * Hudson (tjh@cryptsoft.com).
++ *
++ */
++
++/*
++ * NOTE: this file was auto generated by the mkerr.pl script: any changes
++ * made to it will be overwritten when the script next updates this file,
++ * only reason strings will be preserved.
++ */
++
++#include <stdio.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++
++/* BEGIN ERROR CODES */
++#ifndef OPENSSL_NO_ERR
++
++# define ERR_FUNC(func) ERR_PACK(ERR_LIB_FIPS,func,0)
++# define ERR_REASON(reason) ERR_PACK(ERR_LIB_FIPS,0,reason)
++
++static ERR_STRING_DATA FIPS_str_functs[] = {
++    {ERR_FUNC(FIPS_F_DH_BUILTIN_GENPARAMS), "dh_builtin_genparams"},
++    {ERR_FUNC(FIPS_F_DRBG_RESEED), "drbg_reseed"},
++    {ERR_FUNC(FIPS_F_DSA_BUILTIN_PARAMGEN2), "dsa_builtin_paramgen2"},
++    {ERR_FUNC(FIPS_F_DSA_DO_SIGN), "DSA_do_sign"},
++    {ERR_FUNC(FIPS_F_DSA_DO_VERIFY), "DSA_do_verify"},
++    {ERR_FUNC(FIPS_F_ECDH_COMPUTE_KEY), "ECDH_compute_key"},
++    {ERR_FUNC(FIPS_F_EVP_CIPHER_CTX_NEW), "EVP_CIPHER_CTX_new"},
++    {ERR_FUNC(FIPS_F_EVP_CIPHER_CTX_RESET), "EVP_CIPHER_CTX_reset"},
++    {ERR_FUNC(FIPS_F_FIPS_CHECK_DSA), "fips_check_dsa"},
++    {ERR_FUNC(FIPS_F_FIPS_CHECK_EC), "fips_check_ec"},
++    {ERR_FUNC(FIPS_F_FIPS_CHECK_RSA), "fips_check_rsa"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_BYTES), "fips_drbg_bytes"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_CHECK), "fips_drbg_check"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_CPRNG_TEST), "fips_drbg_cprng_test"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_ERROR_CHECK), "fips_drbg_error_check"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_GENERATE), "FIPS_drbg_generate"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_INIT), "FIPS_drbg_init"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_INSTANTIATE), "FIPS_drbg_instantiate"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_NEW), "FIPS_drbg_new"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_RESEED), "FIPS_drbg_reseed"},
++    {ERR_FUNC(FIPS_F_FIPS_DRBG_SINGLE_KAT), "FIPS_DRBG_SINGLE_KAT"},
++    {ERR_FUNC(FIPS_F_FIPS_GET_ENTROPY), "fips_get_entropy"},
++    {ERR_FUNC(FIPS_F_FIPS_MODULE_MODE_SET), "FIPS_module_mode_set"},
++    {ERR_FUNC(FIPS_F_FIPS_PKEY_SIGNATURE_TEST), "fips_pkey_signature_test"},
++    {ERR_FUNC(FIPS_F_FIPS_RAND_BYTES), "FIPS_rand_bytes"},
++    {ERR_FUNC(FIPS_F_FIPS_RAND_SEED), "FIPS_rand_seed"},
++    {ERR_FUNC(FIPS_F_FIPS_RAND_SET_METHOD), "FIPS_rand_set_method"},
++    {ERR_FUNC(FIPS_F_FIPS_RAND_STATUS), "FIPS_rand_status"},
++    {ERR_FUNC(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN), "fips_rsa_builtin_keygen"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES), "FIPS_selftest_aes"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_CCM), "FIPS_selftest_aes_ccm"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_GCM), "FIPS_selftest_aes_gcm"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_AES_XTS), "FIPS_selftest_aes_xts"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_CMAC), "FIPS_selftest_cmac"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_DES), "FIPS_selftest_des"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_DSA), "FIPS_selftest_dsa"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_ECDSA), "FIPS_selftest_ecdsa"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_HMAC), "FIPS_selftest_hmac"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_SHA1), "FIPS_selftest_sha1"},
++    {ERR_FUNC(FIPS_F_FIPS_SELFTEST_SHA2), "FIPS_selftest_sha2"},
++    {ERR_FUNC(FIPS_F_OSSL_ECDSA_SIGN_SIG), "ossl_ecdsa_sign_sig"},
++    {ERR_FUNC(FIPS_F_OSSL_ECDSA_VERIFY_SIG), "ossl_ecdsa_verify_sig"},
++    {ERR_FUNC(FIPS_F_RSA_BUILTIN_KEYGEN), "rsa_builtin_keygen"},
++    {ERR_FUNC(FIPS_F_RSA_OSSL_INIT), "rsa_ossl_init"},
++    {ERR_FUNC(FIPS_F_RSA_OSSL_PRIVATE_DECRYPT), "rsa_ossl_private_decrypt"},
++    {ERR_FUNC(FIPS_F_RSA_OSSL_PRIVATE_ENCRYPT), "rsa_ossl_private_encrypt"},
++    {ERR_FUNC(FIPS_F_RSA_OSSL_PUBLIC_DECRYPT), "rsa_ossl_public_decrypt"},
++    {ERR_FUNC(FIPS_F_RSA_OSSL_PUBLIC_ENCRYPT), "rsa_ossl_public_encrypt"},
++    {0, NULL}
++};
++
++static ERR_STRING_DATA FIPS_str_reasons[] = {
++    {ERR_REASON(FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED),
++     "additional input error undetected"},
++    {ERR_REASON(FIPS_R_ADDITIONAL_INPUT_TOO_LONG),
++     "additional input too long"},
++    {ERR_REASON(FIPS_R_ALREADY_INSTANTIATED), "already instantiated"},
++    {ERR_REASON(FIPS_R_DRBG_NOT_INITIALISED), "drbg not initialised"},
++    {ERR_REASON(FIPS_R_DRBG_STUCK), "drbg stuck"},
++    {ERR_REASON(FIPS_R_ENTROPY_ERROR_UNDETECTED), "entropy error undetected"},
++    {ERR_REASON(FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED),
++     "entropy not requested for reseed"},
++    {ERR_REASON(FIPS_R_ENTROPY_SOURCE_STUCK), "entropy source stuck"},
++    {ERR_REASON(FIPS_R_ERROR_INITIALISING_DRBG), "error initialising drbg"},
++    {ERR_REASON(FIPS_R_ERROR_INSTANTIATING_DRBG), "error instantiating drbg"},
++    {ERR_REASON(FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT),
++     "error retrieving additional input"},
++    {ERR_REASON(FIPS_R_ERROR_RETRIEVING_ENTROPY), "error retrieving entropy"},
++    {ERR_REASON(FIPS_R_ERROR_RETRIEVING_NONCE), "error retrieving nonce"},
++    {ERR_REASON(FIPS_R_FINGERPRINT_DOES_NOT_MATCH),
++     "fingerprint does not match"},
++    {ERR_REASON(FIPS_R_FIPS_MODE_ALREADY_SET), "fips mode already set"},
++    {ERR_REASON(FIPS_R_FIPS_SELFTEST_FAILED), "fips selftest failed"},
++    {ERR_REASON(FIPS_R_FUNCTION_ERROR), "function error"},
++    {ERR_REASON(FIPS_R_GENERATE_ERROR), "generate error"},
++    {ERR_REASON(FIPS_R_GENERATE_ERROR_UNDETECTED),
++     "generate error undetected"},
++    {ERR_REASON(FIPS_R_INSTANTIATE_ERROR), "instantiate error"},
++    {ERR_REASON(FIPS_R_INTERNAL_ERROR), "internal error"},
++    {ERR_REASON(FIPS_R_INVALID_KEY_LENGTH), "invalid key length"},
++    {ERR_REASON(FIPS_R_IN_ERROR_STATE), "in error state"},
++    {ERR_REASON(FIPS_R_KEY_TOO_SHORT), "key too short"},
++    {ERR_REASON(FIPS_R_NONCE_ERROR_UNDETECTED), "nonce error undetected"},
++    {ERR_REASON(FIPS_R_NON_FIPS_METHOD), "non fips method"},
++    {ERR_REASON(FIPS_R_NOPR_TEST1_FAILURE), "nopr test1 failure"},
++    {ERR_REASON(FIPS_R_NOPR_TEST2_FAILURE), "nopr test2 failure"},
++    {ERR_REASON(FIPS_R_NOT_INSTANTIATED), "not instantiated"},
++    {ERR_REASON(FIPS_R_PAIRWISE_TEST_FAILED), "pairwise test failed"},
++    {ERR_REASON(FIPS_R_PERSONALISATION_ERROR_UNDETECTED),
++     "personalisation error undetected"},
++    {ERR_REASON(FIPS_R_PERSONALISATION_STRING_TOO_LONG),
++     "personalisation string too long"},
++    {ERR_REASON(FIPS_R_PR_TEST1_FAILURE), "pr test1 failure"},
++    {ERR_REASON(FIPS_R_PR_TEST2_FAILURE), "pr test2 failure"},
++    {ERR_REASON(FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED),
++     "request length error undetected"},
++    {ERR_REASON(FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG),
++     "request too large for drbg"},
++    {ERR_REASON(FIPS_R_RESEED_COUNTER_ERROR), "reseed counter error"},
++    {ERR_REASON(FIPS_R_RESEED_ERROR), "reseed error"},
++    {ERR_REASON(FIPS_R_SELFTEST_FAILED), "selftest failed"},
++    {ERR_REASON(FIPS_R_SELFTEST_FAILURE), "selftest failure"},
++    {ERR_REASON(FIPS_R_TEST_FAILURE), "test failure"},
++    {ERR_REASON(FIPS_R_UNINSTANTIATE_ERROR), "uninstantiate error"},
++    {ERR_REASON(FIPS_R_UNINSTANTIATE_ZEROISE_ERROR),
++     "uninstantiate zeroise error"},
++    {ERR_REASON(FIPS_R_UNSUPPORTED_DRBG_TYPE), "unsupported drbg type"},
++    {ERR_REASON(FIPS_R_UNSUPPORTED_PLATFORM), "unsupported platform"},
++    {0, NULL}
++};
++
++#endif
++
++int ERR_load_FIPS_strings(void)
++{
++#ifndef OPENSSL_NO_ERR
++
++    if (ERR_func_error_string(FIPS_str_functs[0].error) == NULL) {
++        ERR_load_strings(0, FIPS_str_functs);
++        ERR_load_strings(0, FIPS_str_reasons);
++    }
++#endif
++    return 1;
++}
+diff -up openssl-1.1.1/crypto/fips/fips_ers.c.fips openssl-1.1.1/crypto/fips/fips_ers.c
+--- openssl-1.1.1/crypto/fips/fips_ers.c.fips	2018-09-13 08:51:22.112520876 +0200
++++ openssl-1.1.1/crypto/fips/fips_ers.c	2018-09-13 08:51:22.112520876 +0200
+@@ -0,0 +1,7 @@
++#include <openssl/opensslconf.h>
++
++#ifdef OPENSSL_FIPS
++# include "fips_err.h"
++#else
++static void *dummy = &dummy;
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_hmac_selftest.c.fips openssl-1.1.1/crypto/fips/fips_hmac_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_hmac_selftest.c.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_hmac_selftest.c	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,134 @@
++/* ====================================================================
++ * Copyright (c) 2005 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/hmac.h>
++
++#ifdef OPENSSL_FIPS
++typedef struct {
++    const EVP_MD *(*alg) (void);
++    const char *key, *iv;
++    unsigned char kaval[EVP_MAX_MD_SIZE];
++} HMAC_KAT;
++
++static const HMAC_KAT vector[] = {
++    {EVP_sha1,
++     /* from http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf */
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x09, 0x22, 0xd3, 0x40, 0x5f, 0xaa, 0x3d, 0x19,
++      0x4f, 0x82, 0xa4, 0x58, 0x30, 0x73, 0x7d, 0x5c,
++      0xc6, 0xc7, 0x5d, 0x24}
++     },
++    {EVP_sha224,
++     /* just keep extending the above... */
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0xdd, 0xef, 0x0a, 0x40, 0xcb, 0x7d, 0x50, 0xfb,
++      0x6e, 0xe6, 0xce, 0xa1, 0x20, 0xba, 0x26, 0xaa,
++      0x08, 0xf3, 0x07, 0x75, 0x87, 0xb8, 0xad, 0x1b,
++      0x8c, 0x8d, 0x12, 0xc7}
++     },
++    {EVP_sha256,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0xb8, 0xf2, 0x0d, 0xb5, 0x41, 0xea, 0x43, 0x09,
++      0xca, 0x4e, 0xa9, 0x38, 0x0c, 0xd0, 0xe8, 0x34,
++      0xf7, 0x1f, 0xbe, 0x91, 0x74, 0xa2, 0x61, 0x38,
++      0x0d, 0xc1, 0x7e, 0xae, 0x6a, 0x34, 0x51, 0xd9}
++     },
++    {EVP_sha384,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x08, 0xbc, 0xb0, 0xda, 0x49, 0x1e, 0x87, 0xad,
++      0x9a, 0x1d, 0x6a, 0xce, 0x23, 0xc5, 0x0b, 0xf6,
++      0xb7, 0x18, 0x06, 0xa5, 0x77, 0xcd, 0x49, 0x04,
++      0x89, 0xf1, 0xe6, 0x23, 0x44, 0x51, 0x51, 0x9f,
++      0x85, 0x56, 0x80, 0x79, 0x0c, 0xbd, 0x4d, 0x50,
++      0xa4, 0x5f, 0x29, 0xe3, 0x93, 0xf0, 0xe8, 0x7f}
++     },
++    {EVP_sha512,
++     "0123456789:;<=>?@ABC",
++     "Sample #2",
++     {0x80, 0x9d, 0x44, 0x05, 0x7c, 0x5b, 0x95, 0x41,
++      0x05, 0xbd, 0x04, 0x13, 0x16, 0xdb, 0x0f, 0xac,
++      0x44, 0xd5, 0xa4, 0xd5, 0xd0, 0x89, 0x2b, 0xd0,
++      0x4e, 0x86, 0x64, 0x12, 0xc0, 0x90, 0x77, 0x68,
++      0xf1, 0x87, 0xb7, 0x7c, 0x4f, 0xae, 0x2c, 0x2f,
++      0x21, 0xa5, 0xb5, 0x65, 0x9a, 0x4f, 0x4b, 0xa7,
++      0x47, 0x02, 0xa3, 0xde, 0x9b, 0x51, 0xf1, 0x45,
++      0xbd, 0x4f, 0x25, 0x27, 0x42, 0x98, 0x99, 0x05}
++     },
++};
++
++int FIPS_selftest_hmac()
++{
++    int n;
++    unsigned int outlen;
++    unsigned char out[EVP_MAX_MD_SIZE];
++    const EVP_MD *md;
++    const HMAC_KAT *t;
++
++    for (n = 0, t = vector; n < sizeof(vector) / sizeof(vector[0]); n++, t++) {
++        md = (*t->alg) ();
++        HMAC(md, t->key, strlen(t->key),
++             (const unsigned char *)t->iv, strlen(t->iv), out, &outlen);
++
++        if (memcmp(out, t->kaval, outlen)) {
++            FIPSerr(FIPS_F_FIPS_SELFTEST_HMAC, FIPS_R_SELFTEST_FAILED);
++            return 0;
++        }
++    }
++    return 1;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_locl.h.fips openssl-1.1.1/crypto/fips/fips_locl.h
+--- openssl-1.1.1/crypto/fips/fips_locl.h.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_locl.h	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,71 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#ifdef OPENSSL_FIPS
++
++# ifdef  __cplusplus
++extern "C" {
++# endif
++
++# define FIPS_MAX_CIPHER_TEST_SIZE       32
++# define fips_load_key_component(comp, pre) \
++        comp = BN_bin2bn(pre##_##comp, sizeof(pre##_##comp), NULL); \
++        if (!comp) \
++                goto err
++
++# define fips_post_started(id, subid, ex) 1
++# define fips_post_success(id, subid, ex) 1
++# define fips_post_failed(id, subid, ex) 1
++# define fips_post_corrupt(id, subid, ex) 1
++# define fips_post_status() 1
++
++# ifdef  __cplusplus
++}
++# endif
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_md.c.fips openssl-1.1.1/crypto/fips/fips_md.c
+--- openssl-1.1.1/crypto/fips/fips_md.c.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_md.c	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,144 @@
++/* fips/evp/fips_md.c */
++/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
++ * All rights reserved.
++ *
++ * This package is an SSL implementation written
++ * by Eric Young (eay@cryptsoft.com).
++ * The implementation was written so as to conform with Netscapes SSL.
++ * 
++ * This library is free for commercial and non-commercial use as long as
++ * the following conditions are aheared to.  The following conditions
++ * apply to all code found in this distribution, be it the RC4, RSA,
++ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
++ * included with this distribution is covered by the same copyright terms
++ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
++ * 
++ * Copyright remains Eric Young's, and as such any Copyright notices in
++ * the code are not to be removed.
++ * If this package is used in a product, Eric Young should be given attribution
++ * as the author of the parts of the library used.
++ * This can be in the form of a textual message at program startup or
++ * in documentation (online or textual) provided with the package.
++ * 
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ *    "This product includes cryptographic software written by
++ *     Eric Young (eay@cryptsoft.com)"
++ *    The word 'cryptographic' can be left out if the rouines from the library
++ *    being used are not cryptographic related :-).
++ * 4. If you include any Windows specific code (or a derivative thereof) from 
++ *    the apps directory (application code) you must include an acknowledgement:
++ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
++ * 
++ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
++ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ * 
++ * The licence and distribution terms for any publically available version or
++ * derivative of this code cannot be changed.  i.e. this code cannot simply be
++ * copied and put under another distribution licence
++ * [including the GNU Public Licence.]
++ */
++/* ====================================================================
++ * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ * This product includes cryptographic software written by Eric Young
++ * (eay@cryptsoft.com).  This product includes software written by Tim
++ * Hudson (tjh@cryptsoft.com).
++ *
++ */
++
++/* Minimal standalone FIPS versions of Digest operations */
++
++#define OPENSSL_FIPSAPI
++
++#include <stdio.h>
++#include <string.h>
++#include <openssl/objects.h>
++#include <openssl/evp.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++
++const EVP_MD *FIPS_get_digestbynid(int nid)
++{
++    switch (nid) {
++    case NID_sha1:
++        return EVP_sha1();
++
++    case NID_sha224:
++        return EVP_sha224();
++
++    case NID_sha256:
++        return EVP_sha256();
++
++    case NID_sha384:
++        return EVP_sha384();
++
++    case NID_sha512:
++        return EVP_sha512();
++
++    default:
++        return NULL;
++    }
++}
+diff -up openssl-1.1.1/crypto/fips/fips_post.c.fips openssl-1.1.1/crypto/fips/fips_post.c
+--- openssl-1.1.1/crypto/fips/fips_post.c.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_post.c	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,222 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#define OPENSSL_FIPSAPI
++
++#include <openssl/crypto.h>
++#include <openssl/rand.h>
++#include <openssl/fips_rand.h>
++#include <openssl/err.h>
++#include <openssl/bio.h>
++#include <openssl/hmac.h>
++#include <openssl/rsa.h>
++#include <openssl/dsa.h>
++#include <openssl/evp.h>
++#include <string.h>
++#include <limits.h>
++
++#ifdef OPENSSL_FIPS
++
++/* Power on self test (POST) support functions */
++
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++# include "fips_locl.h"
++
++/* Run all selftests */
++int FIPS_selftest(void)
++{
++    int rv = 1;
++    if (!FIPS_selftest_drbg())
++        rv = 0;
++    if (!FIPS_selftest_sha1())
++        rv = 0;
++    if (!FIPS_selftest_sha2())
++        rv = 0;
++    if (!FIPS_selftest_hmac())
++        rv = 0;
++    if (!FIPS_selftest_cmac())
++        rv = 0;
++    if (!FIPS_selftest_aes())
++        rv = 0;
++    if (!FIPS_selftest_aes_ccm())
++        rv = 0;
++    if (!FIPS_selftest_aes_gcm())
++        rv = 0;
++    if (!FIPS_selftest_aes_xts())
++        rv = 0;
++    if (!FIPS_selftest_des())
++        rv = 0;
++    if (!FIPS_selftest_rsa())
++        rv = 0;
++    if (!FIPS_selftest_ecdsa())
++        rv = 0;
++    if (!FIPS_selftest_dsa())
++        rv = 0;
++    if (!FIPS_selftest_dh())
++        rv = 0;
++    if (!FIPS_selftest_ecdh())
++        rv = 0;
++    return rv;
++}
++
++/* Generalized public key test routine. Signs and verifies the data
++ * supplied in tbs using mesage digest md and setting option digest
++ * flags md_flags. If the 'kat' parameter is not NULL it will
++ * additionally check the signature matches it: a known answer test
++ * The string "fail_str" is used for identification purposes in case
++ * of failure. If "pkey" is NULL just perform a message digest check.
++ */
++
++int fips_pkey_signature_test(EVP_PKEY *pkey,
++                             const unsigned char *tbs, int tbslen,
++                             const unsigned char *kat, unsigned int katlen,
++                             const EVP_MD *digest, unsigned int flags,
++                             const char *fail_str)
++{
++    int ret = 0;
++    unsigned char sigtmp[256], *sig = sigtmp;
++    size_t siglen = sizeof(sigtmp);
++    EVP_MD_CTX *mctx;
++    EVP_PKEY_CTX *pctx;
++
++    if (digest == NULL)
++        digest = EVP_sha256();
++
++    mctx = EVP_MD_CTX_new();
++
++    if ((EVP_PKEY_id(pkey) == EVP_PKEY_RSA)
++        && (RSA_size(EVP_PKEY_get0_RSA(pkey)) > sizeof(sigtmp))) {
++        sig = OPENSSL_malloc(RSA_size(EVP_PKEY_get0_RSA(pkey)));
++        siglen = RSA_size(EVP_PKEY_get0_RSA(pkey));
++    }
++    if (!sig || ! mctx) {
++        EVP_MD_CTX_free(mctx);
++        FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, ERR_R_MALLOC_FAILURE);
++        return 0;
++    }
++
++    if (tbslen == -1)
++        tbslen = strlen((char *)tbs);
++
++    if (EVP_DigestSignInit(mctx, &pctx, digest, NULL, pkey) <= 0)
++        goto error;
++
++    if (flags == EVP_MD_CTX_FLAG_PAD_PSS) {
++        EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING);
++        EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, 0);
++    }
++
++    if (EVP_DigestSignUpdate(mctx, tbs, tbslen) <= 0)
++        goto error;
++
++    if (EVP_DigestSignFinal(mctx, sig, &siglen) <= 0)
++        goto error;
++
++    if (kat && ((siglen != katlen) || memcmp(kat, sig, katlen)))
++        goto error;
++
++    if (EVP_DigestVerifyInit(mctx, &pctx, digest, NULL, pkey) <= 0)
++        goto error;
++
++    if (flags == EVP_MD_CTX_FLAG_PAD_PSS) {
++        EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING);
++        EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, 0);
++    }
++
++    if (EVP_DigestVerifyUpdate(mctx, tbs, tbslen) <= 0)
++        goto error;
++
++    ret = EVP_DigestVerifyFinal(mctx, sig, siglen);
++
++ error:
++    if (sig != sigtmp)
++        OPENSSL_free(sig);
++    EVP_MD_CTX_free(mctx);
++    if (ret <= 0) {
++        FIPSerr(FIPS_F_FIPS_PKEY_SIGNATURE_TEST, FIPS_R_TEST_FAILURE);
++        if (fail_str)
++            ERR_add_error_data(2, "Type=", fail_str);
++        return 0;
++    }
++    return 1;
++}
++
++/* Generalized symmetric cipher test routine. Encrypt data, verify result
++ * against known answer, decrypt and compare with original plaintext.
++ */
++
++int fips_cipher_test(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
++                     const unsigned char *key,
++                     const unsigned char *iv,
++                     const unsigned char *plaintext,
++                     const unsigned char *ciphertext, int len)
++{
++    unsigned char pltmp[FIPS_MAX_CIPHER_TEST_SIZE];
++    unsigned char citmp[FIPS_MAX_CIPHER_TEST_SIZE];
++
++    OPENSSL_assert(len <= FIPS_MAX_CIPHER_TEST_SIZE);
++    memset(pltmp, 0, FIPS_MAX_CIPHER_TEST_SIZE);
++    memset(citmp, 0, FIPS_MAX_CIPHER_TEST_SIZE);
++
++    if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1) <= 0)
++        return 0;
++    if (EVP_Cipher(ctx, citmp, plaintext, len) <= 0)
++        return 0;
++    if (memcmp(citmp, ciphertext, len))
++        return 0;
++    if (EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0) <= 0)
++        return 0;
++    if (EVP_Cipher(ctx, pltmp, citmp, len) <= 0)
++        return 0;
++    if (memcmp(pltmp, plaintext, len))
++        return 0;
++    return 1;
++}
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_rand_lcl.h.fips openssl-1.1.1/crypto/fips/fips_rand_lcl.h
+--- openssl-1.1.1/crypto/fips/fips_rand_lcl.h.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_rand_lcl.h	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,203 @@
++/* fips/rand/fips_rand_lcl.h */
++/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
++ * project.
++ */
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    licensing@OpenSSL.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ */
++
++typedef struct drbg_hash_ctx_st DRBG_HASH_CTX;
++typedef struct drbg_hmac_ctx_st DRBG_HMAC_CTX;
++typedef struct drbg_ctr_ctx_st DRBG_CTR_CTX;
++
++/* 888 bits from 10.1 table 2 */
++#define HASH_PRNG_MAX_SEEDLEN   111
++
++struct drbg_hash_ctx_st {
++    const EVP_MD *md;
++    EVP_MD_CTX *mctx;
++    unsigned char V[HASH_PRNG_MAX_SEEDLEN];
++    unsigned char C[HASH_PRNG_MAX_SEEDLEN];
++    /* Temporary value storage: should always exceed max digest length */
++    unsigned char vtmp[HASH_PRNG_MAX_SEEDLEN];
++};
++
++struct drbg_hmac_ctx_st {
++    const EVP_MD *md;
++    HMAC_CTX *hctx;
++    unsigned char K[EVP_MAX_MD_SIZE];
++    unsigned char V[EVP_MAX_MD_SIZE];
++};
++
++struct drbg_ctr_ctx_st {
++    AES_KEY ks;
++    size_t keylen;
++    unsigned char K[32];
++    unsigned char V[16];
++    /* Temp variables used by derivation function */
++    AES_KEY df_ks;
++    AES_KEY df_kxks;
++    /* Temporary block storage used by ctr_df */
++    unsigned char bltmp[16];
++    size_t bltmp_pos;
++    unsigned char KX[48];
++};
++
++/* DRBG internal flags */
++
++/* Functions shouldn't call err library */
++#define DRBG_FLAG_NOERR                 0x1
++/* Custom reseed checking */
++#define DRBG_CUSTOM_RESEED              0x2
++
++/* DRBG status values */
++/* not initialised */
++#define DRBG_STATUS_UNINITIALISED       0
++/* ok and ready to generate random bits */
++#define DRBG_STATUS_READY               1
++/* reseed required */
++#define DRBG_STATUS_RESEED              2
++/* fatal error condition */
++#define DRBG_STATUS_ERROR               3
++
++/* A default maximum length: larger than any reasonable value used in pratice */
++
++#define DRBG_MAX_LENGTH                 0x7ffffff0
++/* Maximum DRBG block length: all md sizes are bigger than cipher blocks sizes
++ * so use max digest length.
++ */
++#define DRBG_MAX_BLOCK                  EVP_MAX_MD_SIZE
++
++#define DRBG_HEALTH_INTERVAL            (1 << 24)
++
++/* DRBG context structure */
++
++struct drbg_ctx_st {
++    /* First types common to all implementations */
++    /* DRBG type: a NID for the underlying algorithm */
++    int type;
++    /* Various external flags */
++    unsigned int xflags;
++    /* Various internal use only flags */
++    unsigned int iflags;
++    /* Used for periodic health checks */
++    int health_check_cnt, health_check_interval;
++
++    /* The following parameters are setup by mechanism drbg_init() call */
++    int strength;
++    size_t blocklength;
++    size_t max_request;
++
++    size_t min_entropy, max_entropy;
++    size_t min_nonce, max_nonce;
++    size_t max_pers, max_adin;
++    unsigned int reseed_counter;
++    unsigned int reseed_interval;
++    size_t seedlen;
++    int status;
++    /* Application data: typically used by test get_entropy */
++    void *app_data;
++    /* Implementation specific structures */
++    union {
++        DRBG_HASH_CTX hash;
++        DRBG_HMAC_CTX hmac;
++        DRBG_CTR_CTX ctr;
++    } d;
++    /* Initialiase PRNG and setup callbacks below */
++    int (*init) (DRBG_CTX *ctx, int nid, int security, unsigned int flags);
++    /* Intantiate PRNG */
++    int (*instantiate) (DRBG_CTX *ctx,
++                        const unsigned char *ent, size_t entlen,
++                        const unsigned char *nonce, size_t noncelen,
++                        const unsigned char *pers, size_t perslen);
++    /* reseed */
++    int (*reseed) (DRBG_CTX *ctx,
++                   const unsigned char *ent, size_t entlen,
++                   const unsigned char *adin, size_t adinlen);
++    /* generat output */
++    int (*generate) (DRBG_CTX *ctx,
++                     unsigned char *out, size_t outlen,
++                     const unsigned char *adin, size_t adinlen);
++    /* uninstantiate */
++    int (*uninstantiate) (DRBG_CTX *ctx);
++
++    /* Entropy source block length */
++    size_t entropy_blocklen;
++
++    /* entropy gathering function */
++    size_t (*get_entropy) (DRBG_CTX *ctx, unsigned char **pout,
++                           int entropy, size_t min_len, size_t max_len);
++    /* Indicates we have finished with entropy buffer */
++    void (*cleanup_entropy) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++
++    /* nonce gathering function */
++    size_t (*get_nonce) (DRBG_CTX *ctx, unsigned char **pout,
++                         int entropy, size_t min_len, size_t max_len);
++    /* Indicates we have finished with nonce buffer */
++    void (*cleanup_nonce) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++
++    /* Callbacks used when called through RAND interface */
++    /* Get any additional input for generate */
++    size_t (*get_adin) (DRBG_CTX *ctx, unsigned char **pout);
++    void (*cleanup_adin) (DRBG_CTX *ctx, unsigned char *out, size_t olen);
++    /* Callback for RAND_seed(), RAND_add() */
++    int (*rand_seed_cb) (DRBG_CTX *ctx, const void *buf, int num);
++    int (*rand_add_cb) (DRBG_CTX *ctx,
++                        const void *buf, int num, double entropy);
++};
++
++int fips_drbg_ctr_init(DRBG_CTX *dctx);
++int fips_drbg_hash_init(DRBG_CTX *dctx);
++int fips_drbg_hmac_init(DRBG_CTX *dctx);
++int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags);
++int fips_drbg_cprng_test(DRBG_CTX *dctx, const unsigned char *out);
++
++#define FIPS_digestinit EVP_DigestInit
++#define FIPS_digestupdate EVP_DigestUpdate
++#define FIPS_digestfinal EVP_DigestFinal
++#define M_EVP_MD_size EVP_MD_size
+diff -up openssl-1.1.1/crypto/fips/fips_rand_lib.c.fips openssl-1.1.1/crypto/fips/fips_rand_lib.c
+--- openssl-1.1.1/crypto/fips/fips_rand_lib.c.fips	2018-09-13 08:51:22.113520853 +0200
++++ openssl-1.1.1/crypto/fips/fips_rand_lib.c	2018-09-13 08:51:22.113520853 +0200
+@@ -0,0 +1,234 @@
++/* ====================================================================
++ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++/* If we don't define _XOPEN_SOURCE_EXTENDED, struct timeval won't
++   be defined and gettimeofday() won't be declared with strict compilers
++   like DEC C in ANSI C mode.  */
++#ifndef _XOPEN_SOURCE_EXTENDED
++# define _XOPEN_SOURCE_EXTENDED 1
++#endif
++
++#include <openssl/crypto.h>
++#include <openssl/rand.h>
++#include <openssl/err.h>
++#include <openssl/fips.h>
++#include "internal/fips_int.h"
++#include <openssl/fips_rand.h>
++#include "e_os.h"
++
++#if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS))
++# include <sys/time.h>
++#endif
++#if defined(OPENSSL_SYS_VXWORKS)
++# include <time.h>
++#endif
++#ifndef OPENSSL_SYS_WIN32
++# ifdef OPENSSL_UNISTD
++#  include OPENSSL_UNISTD
++# else
++#  include <unistd.h>
++# endif
++#endif
++
++/* FIPS API for PRNG use. Similar to RAND functionality but without
++ * ENGINE and additional checking for non-FIPS rand methods.
++ */
++
++static const RAND_METHOD *fips_rand_meth = NULL;
++static int fips_approved_rand_meth = 0;
++static int fips_rand_bits = 0;
++
++/* Allows application to override number of bits and uses non-FIPS methods */
++void FIPS_rand_set_bits(int nbits)
++{
++    fips_rand_bits = nbits;
++}
++
++int FIPS_rand_set_method(const RAND_METHOD *meth)
++{
++    if (!fips_rand_bits) {
++        if (meth == FIPS_drbg_method())
++            fips_approved_rand_meth = 1;
++        else {
++            fips_approved_rand_meth = 0;
++            if (FIPS_module_mode()) {
++                FIPSerr(FIPS_F_FIPS_RAND_SET_METHOD, FIPS_R_NON_FIPS_METHOD);
++                return 0;
++            }
++        }
++    }
++    fips_rand_meth = meth;
++    return 1;
++}
++
++const RAND_METHOD *FIPS_rand_get_method(void)
++{
++    return fips_rand_meth;
++}
++
++void FIPS_rand_reset(void)
++{
++    if (fips_rand_meth && fips_rand_meth->cleanup)
++        fips_rand_meth->cleanup();
++}
++
++int FIPS_rand_seed(const void *buf, int num)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_SEED, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->seed)
++        fips_rand_meth->seed(buf, num);
++    return 1;
++}
++
++int FIPS_rand_bytes(unsigned char *buf, int num)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_BYTES, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->bytes)
++        return fips_rand_meth->bytes(buf, num);
++    return 0;
++}
++
++int FIPS_rand_status(void)
++{
++    if (!fips_approved_rand_meth && FIPS_module_mode()) {
++        FIPSerr(FIPS_F_FIPS_RAND_STATUS, FIPS_R_NON_FIPS_METHOD);
++        return 0;
++    }
++    if (fips_rand_meth && fips_rand_meth->status)
++        return fips_rand_meth->status();
++    return 0;
++}
++
++/* Return instantiated strength of PRNG. For DRBG this is an internal
++ * parameter. Any other type of PRNG is not approved and returns 0 in
++ * FIPS mode and maximum 256 outside FIPS mode.
++ */
++
++int FIPS_rand_strength(void)
++{
++    if (fips_rand_bits)
++        return fips_rand_bits;
++    if (fips_approved_rand_meth == 1)
++        return FIPS_drbg_get_strength(FIPS_get_default_drbg());
++    else if (fips_approved_rand_meth == 0) {
++        if (FIPS_module_mode())
++            return 0;
++        else
++            return 256;
++    }
++    return 0;
++}
++
++void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr)
++{
++# ifdef OPENSSL_SYS_WIN32
++    FILETIME ft;
++# elif defined(OPENSSL_SYS_VXWORKS)
++    struct timespec ts;
++# else
++    struct timeval tv;
++# endif
++
++# ifndef GETPID_IS_MEANINGLESS
++    unsigned long pid;
++# endif
++
++# ifdef OPENSSL_SYS_WIN32
++    GetSystemTimeAsFileTime(&ft);
++    buf[0] = (unsigned char)(ft.dwHighDateTime & 0xff);
++    buf[1] = (unsigned char)((ft.dwHighDateTime >> 8) & 0xff);
++    buf[2] = (unsigned char)((ft.dwHighDateTime >> 16) & 0xff);
++    buf[3] = (unsigned char)((ft.dwHighDateTime >> 24) & 0xff);
++    buf[4] = (unsigned char)(ft.dwLowDateTime & 0xff);
++    buf[5] = (unsigned char)((ft.dwLowDateTime >> 8) & 0xff);
++    buf[6] = (unsigned char)((ft.dwLowDateTime >> 16) & 0xff);
++    buf[7] = (unsigned char)((ft.dwLowDateTime >> 24) & 0xff);
++# elif defined(OPENSSL_SYS_VXWORKS)
++    clock_gettime(CLOCK_REALTIME, &ts);
++    buf[0] = (unsigned char)(ts.tv_sec & 0xff);
++    buf[1] = (unsigned char)((ts.tv_sec >> 8) & 0xff);
++    buf[2] = (unsigned char)((ts.tv_sec >> 16) & 0xff);
++    buf[3] = (unsigned char)((ts.tv_sec >> 24) & 0xff);
++    buf[4] = (unsigned char)(ts.tv_nsec & 0xff);
++    buf[5] = (unsigned char)((ts.tv_nsec >> 8) & 0xff);
++    buf[6] = (unsigned char)((ts.tv_nsec >> 16) & 0xff);
++    buf[7] = (unsigned char)((ts.tv_nsec >> 24) & 0xff);
++# else
++    gettimeofday(&tv, NULL);
++    buf[0] = (unsigned char)(tv.tv_sec & 0xff);
++    buf[1] = (unsigned char)((tv.tv_sec >> 8) & 0xff);
++    buf[2] = (unsigned char)((tv.tv_sec >> 16) & 0xff);
++    buf[3] = (unsigned char)((tv.tv_sec >> 24) & 0xff);
++    buf[4] = (unsigned char)(tv.tv_usec & 0xff);
++    buf[5] = (unsigned char)((tv.tv_usec >> 8) & 0xff);
++    buf[6] = (unsigned char)((tv.tv_usec >> 16) & 0xff);
++    buf[7] = (unsigned char)((tv.tv_usec >> 24) & 0xff);
++# endif
++    buf[8] = (unsigned char)(*pctr & 0xff);
++    buf[9] = (unsigned char)((*pctr >> 8) & 0xff);
++    buf[10] = (unsigned char)((*pctr >> 16) & 0xff);
++    buf[11] = (unsigned char)((*pctr >> 24) & 0xff);
++
++    (*pctr)++;
++
++# ifndef GETPID_IS_MEANINGLESS
++    pid = (unsigned long)getpid();
++    buf[12] = (unsigned char)(pid & 0xff);
++    buf[13] = (unsigned char)((pid >> 8) & 0xff);
++    buf[14] = (unsigned char)((pid >> 16) & 0xff);
++    buf[15] = (unsigned char)((pid >> 24) & 0xff);
++# endif
++}
++
+diff -up openssl-1.1.1/crypto/fips/fips_rsa_selftest.c.fips openssl-1.1.1/crypto/fips/fips_rsa_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_rsa_selftest.c.fips	2018-09-13 08:51:22.114520830 +0200
++++ openssl-1.1.1/crypto/fips/fips_rsa_selftest.c	2018-09-13 08:51:22.114520830 +0200
+@@ -0,0 +1,338 @@
++/* ====================================================================
++ * Copyright (c) 2003-2007 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++#endif
++#include <openssl/rsa.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++#include <openssl/opensslconf.h>
++#include "fips_locl.h"
++
++#ifdef OPENSSL_FIPS
++
++static int setrsakey(RSA *key)
++{
++    static const unsigned char keydata_n[] = {
++        0x00, 0xc9, 0xd5, 0x6d, 0x9d, 0x90, 0xdb, 0x43, 0xd6, 0x02, 0xed, 0x96, 0x88, 0x13, 0x8a,
++        0xb2, 0xbf, 0x6e, 0xa1, 0x06, 0x10, 0xb2, 0x78, 0x37, 0xa7, 0x14, 0xa8, 0xff, 0xdd, 0x00,
++        0xdd, 0xb4, 0x93, 0xa0, 0x45, 0xcc, 0x96, 0x90, 0xed, 0xad, 0xa9, 0xdd, 0xc4, 0xd6, 0xca,
++        0x0c, 0xf0, 0xed, 0x4f, 0x72, 0x5e, 0x21, 0x49, 0x9a, 0x18, 0x12, 0x15, 0x8f, 0x90, 0x5a,
++        0xdb, 0xb6, 0x33, 0x99, 0xa3, 0xe6, 0xb4, 0xf0, 0xc4, 0x97, 0x21, 0x26, 0xbb, 0xe3, 0xba,
++        0xf2, 0xff, 0xa0, 0x72, 0xda, 0x89, 0x63, 0x8e, 0x8b, 0x3e, 0x08, 0x9d, 0x92, 0x2a, 0xbe,
++        0x16, 0xe1, 0x43, 0x15, 0xfc, 0x57, 0xc7, 0x1f, 0x09, 0x11, 0x67, 0x1c, 0xa9, 0x96, 0xd1,
++        0x8b, 0x3e, 0x80, 0x93, 0xc1, 0x59, 0xd0, 0x6d, 0x39, 0xf2, 0xac, 0x95, 0xcc, 0x10, 0x75,
++        0xe9, 0x31, 0x24, 0xd1, 0x43, 0xaf, 0x68, 0x52, 0x4b, 0xe7, 0x16, 0xd7, 0x49, 0x65, 0x6f,
++        0x26, 0xc0, 0x86, 0xad, 0xc0, 0x07, 0x0a, 0xc1, 0xe1, 0x2f, 0x87, 0x85, 0x86, 0x3b, 0xdc,
++        0x5a, 0x99, 0xbe, 0xe9, 0xf9, 0xb9, 0xe9, 0x82, 0x27, 0x51, 0x04, 0x15, 0xab, 0x06, 0x0e,
++        0x76, 0x5a, 0x28, 0x8d, 0x92, 0xbd, 0xc5, 0xb5, 0x7b, 0xa8, 0xdf, 0x4e, 0x47, 0xa2, 0xc1,
++        0xe7, 0x52, 0xbf, 0x47, 0xf7, 0x62, 0xe0, 0x3a, 0x6f, 0x4d, 0x6a, 0x4d, 0x4e, 0xd4, 0xb9,
++        0x59, 0x69, 0xfa, 0xb2, 0x14, 0xc1, 0xee, 0xe6, 0x2f, 0x95, 0xcd, 0x94, 0x72, 0xae, 0xe4,
++        0xdb, 0x18, 0x9a, 0xc4, 0xcd, 0x70, 0xbd, 0xee, 0x31, 0x16, 0xb7, 0x49, 0x65, 0xac, 0x40,
++        0x19, 0x0e, 0xb5, 0x6d, 0x83, 0xf1, 0x36, 0xbb, 0x08, 0x2f, 0x2e, 0x4e, 0x92, 0x62, 0xa4,
++        0xff, 0x50, 0xdb, 0x20, 0x45, 0xa2, 0xeb, 0x16, 0x7a, 0xf2, 0xd5, 0x28, 0xc1, 0xfd, 0x4e,
++        0x03, 0x71
++    };
++
++    static const unsigned char keydata_e[] = { 0x01, 0x00, 0x01 };
++
++    static const unsigned char keydata_d[] = {
++        0x36, 0x27, 0x3d, 0xb1, 0xf9, 0x1b, 0xdb, 0xa7, 0xa0, 0x41, 0x7f, 0x12, 0x23, 0xac, 0x23,
++        0x29, 0x99, 0xd5, 0x3a, 0x7b, 0x60, 0x67, 0x41, 0x07, 0x63, 0x53, 0xb4, 0xd2, 0xe7, 0x58,
++        0x95, 0x0a, 0xc7, 0x05, 0xf3, 0x4e, 0xb2, 0xb4, 0x12, 0xd4, 0x70, 0xdc, 0x4f, 0x85, 0x06,
++        0xd3, 0xdd, 0xd8, 0x63, 0x27, 0x3e, 0x67, 0x31, 0x21, 0x24, 0x39, 0x04, 0xbc, 0x06, 0xa4,
++        0xcc, 0xce, 0x2b, 0x7a, 0xfe, 0x7b, 0xad, 0xde, 0x11, 0x6e, 0xa3, 0xa5, 0xe6, 0x04, 0x53,
++        0x0e, 0xa3, 0x4e, 0x2d, 0xb4, 0x8f, 0x31, 0xbf, 0xca, 0x75, 0x25, 0x52, 0x02, 0x85, 0xde,
++        0x3d, 0xb2, 0x72, 0x43, 0xb2, 0x89, 0x8a, 0x9a, 0x34, 0x41, 0x26, 0x3f, 0x9a, 0x67, 0xbe,
++        0xa4, 0x96, 0x7b, 0x0e, 0x75, 0xba, 0xa6, 0x93, 0xd5, 0xb8, 0xd8, 0xb8, 0x57, 0xf2, 0x4b,
++        0x0f, 0x14, 0x81, 0xd1, 0x57, 0x4e, 0xf6, 0x45, 0x4c, 0xa6, 0x3b, 0xd0, 0x70, 0xca, 0xd3,
++        0x9d, 0x55, 0xde, 0x22, 0x05, 0xe7, 0x8e, 0x28, 0x4d, 0xee, 0x11, 0xcf, 0xb6, 0x67, 0x76,
++        0x09, 0xd3, 0xe3, 0x3c, 0x13, 0xf9, 0x99, 0x34, 0x10, 0x7b, 0xec, 0x81, 0x38, 0xf0, 0xb6,
++        0x34, 0x9c, 0x9b, 0x50, 0x6f, 0x0b, 0x91, 0x81, 0x4d, 0x89, 0x94, 0x04, 0x7b, 0xf0, 0x3c,
++        0xf4, 0xb1, 0xb2, 0x00, 0x48, 0x8d, 0x5a, 0x8f, 0x88, 0x9e, 0xc5, 0xab, 0x3a, 0x9e, 0x44,
++        0x3f, 0x54, 0xe7, 0xd9, 0x6e, 0x47, 0xaa, 0xa1, 0xbd, 0x40, 0x46, 0x31, 0xf9, 0xf0, 0x34,
++        0xb6, 0x04, 0xe1, 0x2b, 0x5b, 0x73, 0x86, 0xdd, 0x3a, 0x92, 0x1b, 0x71, 0xc7, 0x3f, 0x32,
++        0xe5, 0xc3, 0xc2, 0xab, 0xa1, 0x7e, 0xbf, 0xa4, 0x52, 0xa0, 0xb0, 0x68, 0x90, 0xd1, 0x20,
++        0x12, 0x79, 0xe9, 0xd7, 0xc9, 0x40, 0xba, 0xf2, 0x19, 0xc7, 0xa5, 0x00, 0x92, 0x86, 0x0d,
++        0x01
++    };
++
++    static const unsigned char keydata_p[] = {
++        0x00, 0xfc, 0x5c, 0x6e, 0x16, 0xce, 0x1f, 0x03, 0x7b, 0xcd, 0xf7, 0xb3, 0x72, 0xb2, 0x8f,
++        0x16, 0x72, 0xb8, 0x56, 0xae, 0xf7, 0xcd, 0x67, 0xd8, 0x4e, 0x7d, 0x07, 0xaf, 0xd5, 0x43,
++        0x26, 0xc3, 0x35, 0xbe, 0x43, 0x8f, 0x4e, 0x2f, 0x1c, 0x43, 0x4e, 0x6b, 0xd2, 0xb2, 0xec,
++        0x52, 0x6d, 0x97, 0x52, 0x2b, 0xcc, 0x5c, 0x3a, 0x6b, 0xf4, 0x14, 0xc6, 0x74, 0xda, 0x66,
++        0x38, 0x1c, 0x7a, 0x3f, 0x84, 0x2f, 0xe3, 0xf9, 0x5a, 0xb8, 0x65, 0x69, 0x46, 0x06, 0xa3,
++        0x37, 0x79, 0xb2, 0xa1, 0x5b, 0x58, 0xed, 0x5e, 0xa7, 0x5f, 0x8c, 0x65, 0x66, 0xbb, 0xd1,
++        0x24, 0x36, 0xe6, 0x37, 0xa7, 0x3d, 0x49, 0x77, 0x8a, 0x8c, 0x34, 0xd8, 0x69, 0x29, 0xf3,
++        0x4d, 0x58, 0x22, 0xb0, 0x51, 0x24, 0xb6, 0x40, 0xa8, 0x86, 0x59, 0x0a, 0xb7, 0xba, 0x5c,
++        0x97, 0xda, 0x57, 0xe8, 0x36, 0xda, 0x7a, 0x9c, 0xad
++    };
++
++    static const unsigned char keydata_q[] = {
++        0x00, 0xcc, 0xbe, 0x7b, 0x09, 0x69, 0x06, 0xee, 0x45, 0xbf, 0x88, 0x47, 0x38, 0xa8, 0xf8,
++        0x17, 0xe5, 0xb6, 0xba, 0x67, 0x55, 0xe3, 0xe8, 0x05, 0x8b, 0xb8, 0xe2, 0x53, 0xd6, 0x8e,
++        0xef, 0x2c, 0xe7, 0x4f, 0x4a, 0xf7, 0x4e, 0x26, 0x8d, 0x85, 0x0b, 0x3f, 0xec, 0xc3, 0x1c,
++        0xd4, 0xeb, 0xec, 0x6a, 0xc8, 0x72, 0x2a, 0x25, 0x7d, 0xfd, 0xa6, 0x77, 0x96, 0xf0, 0x1e,
++        0xcd, 0x28, 0x57, 0xf8, 0x37, 0x30, 0x75, 0x6b, 0xbd, 0xd4, 0x7b, 0x0c, 0x87, 0xc5, 0x6c,
++        0x87, 0x40, 0xa5, 0xbb, 0x27, 0x2c, 0x78, 0xc9, 0x74, 0x5a, 0x54, 0x5b, 0x0b, 0x30, 0x6f,
++        0x44, 0x4a, 0xfa, 0x71, 0xe4, 0x21, 0x61, 0x66, 0xf9, 0xee, 0x65, 0xde, 0x7c, 0x04, 0xd7,
++        0xfd, 0xa9, 0x15, 0x5b, 0x7f, 0xe2, 0x7a, 0xba, 0x69, 0x86, 0x72, 0xa6, 0x06, 0x8d, 0x9b,
++        0x90, 0x55, 0x60, 0x9e, 0x4c, 0x5d, 0xa9, 0xb6, 0x55
++    };
++
++    static const unsigned char keydata_dmp1[] = {
++        0x7a, 0xd6, 0x12, 0xd0, 0x0e, 0xec, 0x91, 0xa9, 0x85, 0x8b, 0xf8, 0x50, 0xf0, 0x11, 0x2e,
++        0x00, 0x11, 0x32, 0x40, 0x60, 0x66, 0x1f, 0x11, 0xee, 0xc2, 0x75, 0x27, 0x65, 0x4b, 0x16,
++        0x67, 0x16, 0x95, 0xd2, 0x14, 0xc3, 0x1d, 0xb3, 0x48, 0x1f, 0xb7, 0xe4, 0x0b, 0x2b, 0x74,
++        0xc3, 0xdb, 0x50, 0x27, 0xf9, 0x85, 0x3a, 0xfa, 0xa9, 0x08, 0x23, 0xc1, 0x65, 0x3d, 0x34,
++        0x3a, 0xc8, 0x56, 0x7a, 0x65, 0x45, 0x36, 0x6e, 0xae, 0x2a, 0xce, 0x9f, 0x43, 0x43, 0xd7,
++        0x10, 0xe9, 0x9e, 0x18, 0xf4, 0xa4, 0x35, 0xda, 0x8a, 0x6b, 0xb0, 0x3f, 0xdd, 0x53, 0xe3,
++        0xa8, 0xc5, 0x4e, 0x79, 0x9d, 0x1f, 0x51, 0x8c, 0xa2, 0xca, 0x66, 0x3c, 0x6a, 0x2a, 0xff,
++        0x8e, 0xd2, 0xf3, 0xb7, 0xcb, 0x82, 0xda, 0xde, 0x2c, 0xe6, 0xd2, 0x8c, 0xb3, 0xad, 0xb6,
++        0x4c, 0x95, 0x55, 0x76, 0xbd, 0xc9, 0xc8, 0xd1
++    };
++
++    static const unsigned char keydata_dmq1[] = {
++        0x00, 0x83, 0x23, 0x1d, 0xbb, 0x11, 0x42, 0x17, 0x2b, 0x25, 0x5a, 0x2c, 0x03, 0xe6, 0x75,
++        0xc1, 0x18, 0xa8, 0xc9, 0x0b, 0x96, 0xbf, 0xba, 0xc4, 0x92, 0x91, 0x80, 0xa5, 0x22, 0x2f,
++        0xba, 0x91, 0x90, 0x36, 0x01, 0x56, 0x15, 0x00, 0x2c, 0x74, 0xa2, 0x97, 0xf7, 0x15, 0xa1,
++        0x49, 0xdf, 0x32, 0x35, 0xd2, 0xdd, 0x0c, 0x91, 0xa6, 0xf8, 0xe7, 0xbe, 0x81, 0x36, 0x9b,
++        0x03, 0xdc, 0x6b, 0x3b, 0xd8, 0x5d, 0x79, 0x57, 0xe0, 0xe6, 0x4f, 0x49, 0xdf, 0x4c, 0x5c,
++        0x0e, 0xe5, 0x21, 0x41, 0x95, 0xfd, 0xad, 0xff, 0x9a, 0x3e, 0xa0, 0xf9, 0x0f, 0x59, 0x9e,
++        0x6a, 0xa7, 0x7b, 0x71, 0xa7, 0x24, 0x9a, 0x36, 0x52, 0xae, 0x97, 0x20, 0xc1, 0x5e, 0x78,
++        0xd9, 0x47, 0x8b, 0x1e, 0x67, 0xf2, 0xaf, 0x98, 0xe6, 0x2d, 0xef, 0x10, 0xd7, 0xf1, 0xab,
++        0x49, 0xee, 0xe5, 0x4b, 0x7e, 0xae, 0x1f, 0x1d, 0x61
++    };
++
++    static const unsigned char keydata_iqmp[] = {
++        0x23, 0x96, 0xc1, 0x91, 0x17, 0x5e, 0x0a, 0x83, 0xd2, 0xdc, 0x7b, 0x69, 0xb2, 0x59, 0x1d,
++        0x33, 0x58, 0x52, 0x3f, 0x18, 0xc7, 0x09, 0x50, 0x1c, 0xb9, 0xa1, 0xbb, 0x4c, 0xa2, 0x38,
++        0x40, 0x4c, 0x9a, 0x8e, 0xfe, 0x9c, 0x90, 0x92, 0xd0, 0x71, 0x9f, 0x89, 0x99, 0x50, 0x91,
++        0x1f, 0x34, 0x8b, 0x74, 0x53, 0x11, 0x11, 0x4a, 0x70, 0xe2, 0xf7, 0x30, 0xd8, 0x8c, 0x80,
++        0xe1, 0xcc, 0x9f, 0xf1, 0x63, 0x17, 0x1a, 0x7d, 0x67, 0x29, 0x4c, 0xcb, 0x4e, 0x74, 0x7b,
++        0xe0, 0x3e, 0x9e, 0x2f, 0xf4, 0x67, 0x8f, 0xec, 0xb9, 0x5c, 0x00, 0x1e, 0x7e, 0xa2, 0x7b,
++        0x92, 0xc9, 0x6f, 0x4c, 0xe4, 0x0e, 0xf9, 0x48, 0x63, 0xcd, 0x50, 0x22, 0x5d, 0xbf, 0xb6,
++        0x9d, 0x01, 0x33, 0x6a, 0xf4, 0x50, 0xbe, 0x86, 0x98, 0x4f, 0xca, 0x3f, 0x3a, 0xfa, 0xcf,
++        0x07, 0x40, 0xc4, 0xaa, 0xad, 0xae, 0xbe, 0xbf
++    };
++
++    int rv = 0;
++    BIGNUM *n = NULL, *e = NULL, *d = NULL, *p = NULL, *q = NULL, *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
++
++    fips_load_key_component(n, keydata);
++    fips_load_key_component(e, keydata);
++    fips_load_key_component(d, keydata);
++    fips_load_key_component(p, keydata);
++    fips_load_key_component(q, keydata);
++    fips_load_key_component(dmp1, keydata);
++    fips_load_key_component(dmq1, keydata);
++    fips_load_key_component(iqmp, keydata);
++
++    RSA_set0_key(key, n, e, d);
++    RSA_set0_factors(key, p, q);
++    RSA_set0_crt_params(key, dmp1, dmq1, iqmp);
++
++    rv = 1;
++err:
++    if (!rv) {
++        BN_free(n);
++        BN_free(e);
++        BN_free(d);
++        BN_free(p);
++        BN_free(q);
++        BN_free(dmp1);
++        BN_free(dmq1);
++        BN_free(iqmp);
++    }
++    return rv;
++}
++
++/* Known Answer Test (KAT) data for the above RSA private key signing
++ * kat_tbs.
++ */
++
++static const unsigned char kat_tbs[] =
++    "OpenSSL FIPS 140-2 Public Key RSA KAT";
++
++static const unsigned char kat_RSA_PSS_SHA256[] = {
++    0x38, 0xDA, 0x99, 0x51, 0x26, 0x38, 0xC6, 0x7F, 0xC4, 0x81, 0x57, 0x19,
++    0x35, 0xC6, 0xF6, 0x1E, 0x90, 0x47, 0x20, 0x55, 0x47, 0x56, 0x26, 0xE9,
++    0xF2, 0xA8, 0x39, 0x6C, 0xD5, 0xCD, 0xCB, 0x55, 0xFC, 0x0C, 0xC5, 0xCB,
++    0xF7, 0x40, 0x17, 0x3B, 0xCF, 0xE4, 0x05, 0x03, 0x3B, 0xA0, 0xB2, 0xC9,
++    0x0D, 0x5E, 0x48, 0x3A, 0xE9, 0xAD, 0x28, 0x71, 0x7D, 0x8F, 0x89, 0x16,
++    0x59, 0x93, 0x35, 0xDC, 0x4D, 0x7B, 0xDF, 0x84, 0xE4, 0x68, 0xAA, 0x33,
++    0xAA, 0xDC, 0x66, 0x50, 0xC8, 0xA9, 0x32, 0x12, 0xDC, 0xC6, 0x90, 0x49,
++    0x0B, 0x75, 0xFF, 0x9B, 0x95, 0x00, 0x9A, 0x90, 0xE0, 0xD4, 0x0E, 0x67,
++    0xAB, 0x3C, 0x47, 0x36, 0xC5, 0x2E, 0x1C, 0x46, 0xF0, 0x2D, 0xD3, 0x8B,
++    0x42, 0x08, 0xDE, 0x0D, 0xB6, 0x2C, 0x86, 0xB0, 0x35, 0x71, 0x18, 0x6B,
++    0x89, 0x67, 0xC0, 0x05, 0xAD, 0xF4, 0x1D, 0x62, 0x4E, 0x75, 0xEC, 0xD6,
++    0xC2, 0xDB, 0x07, 0xB0, 0xB6, 0x8D, 0x15, 0xAD, 0xCD, 0xBF, 0xF5, 0x60,
++    0x76, 0xAE, 0x48, 0xB8, 0x77, 0x7F, 0xC5, 0x01, 0xD9, 0x29, 0xBB, 0xD6,
++    0x17, 0xA2, 0x20, 0x5A, 0xC0, 0x4A, 0x3B, 0x34, 0xC8, 0xB9, 0x39, 0xCF,
++    0x06, 0x89, 0x95, 0x6F, 0xC7, 0xCA, 0xC4, 0xE4, 0x43, 0xDF, 0x5A, 0x23,
++    0xE2, 0x89, 0xA3, 0x38, 0x78, 0x31, 0x38, 0xC6, 0xA4, 0x6F, 0x5F, 0x73,
++    0x5A, 0xE5, 0x9E, 0x09, 0xE7, 0x6F, 0xD4, 0xF8, 0x3E, 0xB7, 0xB0, 0x56,
++    0x9A, 0xF3, 0x65, 0xF0, 0xC2, 0xA6, 0x8A, 0x08, 0xBA, 0x44, 0xAC, 0x97,
++    0xDE, 0xB4, 0x16, 0x83, 0xDF, 0xE3, 0xEE, 0x71, 0xFA, 0xF9, 0x51, 0x50,
++    0x14, 0xDC, 0xFD, 0x6A, 0x82, 0x20, 0x68, 0x64, 0x7D, 0x4E, 0x82, 0x68,
++    0xD7, 0x45, 0xFA, 0x6A, 0xE4, 0xE5, 0x29, 0x3A, 0x70, 0xFB, 0xE4, 0x62,
++    0x2B, 0x31, 0xB9, 0x7D
++};
++
++static const unsigned char kat_RSA_SHA256[] = {
++    0xC2, 0xB1, 0x97, 0x00, 0x9A, 0xE5, 0x80, 0x6A, 0xE2, 0x51, 0x68, 0xB9,
++    0x7A, 0x0C, 0xF2, 0xB4, 0x77, 0xED, 0x15, 0x0C, 0x4E, 0xE1, 0xDC, 0xFF,
++    0x8E, 0xBC, 0xDE, 0xC7, 0x9A, 0x96, 0xF1, 0x47, 0x45, 0x24, 0x9D, 0x6F,
++    0xA6, 0xF3, 0x1D, 0x0D, 0x35, 0x4C, 0x1A, 0xF3, 0x58, 0x2C, 0x6C, 0x06,
++    0xD6, 0x22, 0x37, 0x77, 0x8C, 0x33, 0xE5, 0x07, 0x53, 0x93, 0x28, 0xCF,
++    0x67, 0xFA, 0xC4, 0x1F, 0x1B, 0x24, 0xDB, 0x4C, 0xC5, 0x2A, 0x51, 0xA2,
++    0x60, 0x15, 0x8C, 0x54, 0xB4, 0x30, 0xE2, 0x24, 0x47, 0x86, 0xF2, 0xF8,
++    0x6C, 0xD6, 0x12, 0x59, 0x2C, 0x74, 0x9A, 0x37, 0xF3, 0xC4, 0xA2, 0xD5,
++    0x4E, 0x1F, 0x77, 0xF0, 0x27, 0xCE, 0x77, 0xF8, 0x4A, 0x79, 0x03, 0xBE,
++    0xC8, 0x06, 0x2D, 0xA7, 0xA6, 0x46, 0xF5, 0x55, 0x79, 0xD7, 0x5C, 0xC6,
++    0x5B, 0xB1, 0x00, 0x4E, 0x7C, 0xD9, 0x11, 0x85, 0xE0, 0xB1, 0x4D, 0x2D,
++    0x13, 0xD7, 0xAC, 0xEA, 0x64, 0xD1, 0xAC, 0x8F, 0x8D, 0x8F, 0xEA, 0x42,
++    0x7F, 0xF9, 0xB7, 0x7D, 0x2C, 0x68, 0x49, 0x07, 0x7A, 0x74, 0xEF, 0xB4,
++    0xC9, 0x97, 0x16, 0x5C, 0x6C, 0x6E, 0x5C, 0x09, 0x2E, 0x8E, 0x13, 0x2E,
++    0x1A, 0x8D, 0xA6, 0x0C, 0x6E, 0x0C, 0x1C, 0x0F, 0xCC, 0xB2, 0x78, 0x8A,
++    0x07, 0xFC, 0x5C, 0xC2, 0xF5, 0x65, 0xEC, 0xAB, 0x8B, 0x3C, 0xCA, 0x91,
++    0x6F, 0x84, 0x7C, 0x21, 0x0E, 0xB8, 0xDA, 0x7B, 0x6C, 0xF7, 0xDF, 0xAB,
++    0x7E, 0x15, 0xFD, 0x85, 0x0B, 0x33, 0x9B, 0x6A, 0x3A, 0xC3, 0xEF, 0x65,
++    0x04, 0x6E, 0xB2, 0xAC, 0x98, 0xFD, 0xEB, 0x02, 0xF5, 0xC0, 0x0B, 0x5E,
++    0xCB, 0xD4, 0x83, 0x82, 0x18, 0x1B, 0xDA, 0xB4, 0xCD, 0xE8, 0x71, 0x6B,
++    0x1D, 0xB5, 0x4F, 0xE9, 0xD6, 0x43, 0xA0, 0x0A, 0x14, 0xA0, 0xE7, 0x5D,
++    0x47, 0x9D, 0x18, 0xD7
++};
++
++static int fips_rsa_encrypt_test(RSA *rsa, const unsigned char *plaintext,
++                                 int ptlen)
++{
++    unsigned char *ctbuf = NULL, *ptbuf = NULL;
++    int ret = 0;
++    int len;
++
++    ctbuf = OPENSSL_malloc(RSA_size(rsa));
++    if (!ctbuf)
++        goto err;
++
++    len = RSA_public_encrypt(ptlen, plaintext, ctbuf, rsa, RSA_PKCS1_PADDING);
++    if (len <= 0)
++        goto err;
++    /* Check ciphertext doesn't match plaintext */
++    if (len >= ptlen && !memcmp(plaintext, ctbuf, ptlen))
++        goto err;
++
++    ptbuf = OPENSSL_malloc(RSA_size(rsa));
++    if (!ptbuf)
++        goto err;
++
++    len = RSA_private_decrypt(len, ctbuf, ptbuf, rsa, RSA_PKCS1_PADDING);
++    if (len != ptlen)
++        goto err;
++    if (memcmp(ptbuf, plaintext, len))
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (ctbuf)
++        OPENSSL_free(ctbuf);
++    if (ptbuf)
++        OPENSSL_free(ptbuf);
++    return ret;
++}
++
++int FIPS_selftest_rsa()
++{
++    int ret = 0;
++    RSA *key;
++    EVP_PKEY *pk = NULL;
++
++    if ((key = RSA_new()) == NULL)
++        goto err;
++
++    if (!setrsakey(key))
++        goto err;
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_RSA(pk, key);
++
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_SHA256, sizeof(kat_RSA_SHA256),
++                                  EVP_sha256(), EVP_MD_CTX_FLAG_PAD_PKCS1,
++                                  "RSA SHA256 PKCS#1"))
++        goto err;
++
++    if (!fips_pkey_signature_test(pk, kat_tbs, sizeof(kat_tbs) - 1,
++                                  kat_RSA_PSS_SHA256,
++                                  sizeof(kat_RSA_PSS_SHA256), EVP_sha256(),
++                                  EVP_MD_CTX_FLAG_PAD_PSS, "RSA SHA256 PSS"))
++        goto err;
++
++    if (!fips_rsa_encrypt_test(key, kat_tbs, sizeof(kat_tbs) - 1))
++        goto err;
++
++    ret = 1;
++
++ err:
++    if (pk)
++        EVP_PKEY_free(pk);
++    if (key)
++        RSA_free(key);
++    return ret;
++}
++
++#endif                          /* def OPENSSL_FIPS */
+diff -up openssl-1.1.1/crypto/fips/fips_sha_selftest.c.fips openssl-1.1.1/crypto/fips/fips_sha_selftest.c
+--- openssl-1.1.1/crypto/fips/fips_sha_selftest.c.fips	2018-09-13 08:51:22.114520830 +0200
++++ openssl-1.1.1/crypto/fips/fips_sha_selftest.c	2018-09-13 08:51:22.114520830 +0200
+@@ -0,0 +1,138 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <string.h>
++#include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++#include <openssl/evp.h>
++#include <openssl/sha.h>
++
++#ifdef OPENSSL_FIPS
++static const char test[][60] = {
++    "",
++    "abc",
++    "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
++};
++
++static const unsigned char ret[][SHA_DIGEST_LENGTH] = {
++    {0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55,
++     0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09},
++    {0xa9, 0x99, 0x3e, 0x36, 0x47, 0x06, 0x81, 0x6a, 0xba, 0x3e,
++     0x25, 0x71, 0x78, 0x50, 0xc2, 0x6c, 0x9c, 0xd0, 0xd8, 0x9d},
++    {0x84, 0x98, 0x3e, 0x44, 0x1c, 0x3b, 0xd2, 0x6e, 0xba, 0xae,
++     0x4a, 0xa1, 0xf9, 0x51, 0x29, 0xe5, 0xe5, 0x46, 0x70, 0xf1},
++};
++
++int FIPS_selftest_sha1()
++{
++    int n;
++
++    for (n = 0; n < sizeof(test) / sizeof(test[0]); ++n) {
++        unsigned char md[SHA_DIGEST_LENGTH];
++
++        EVP_Digest(test[n], strlen(test[n]), md, NULL,
++                   EVP_sha1(), NULL);
++        if (memcmp(md, ret[n], sizeof md)) {
++            FIPSerr(FIPS_F_FIPS_SELFTEST_SHA1, FIPS_R_SELFTEST_FAILED);
++            return 0;
++        }
++    }
++    return 1;
++}
++
++static const unsigned char msg_sha256[] =
++    { 0xfa, 0x48, 0x59, 0x2a, 0xe1, 0xae, 0x1f, 0x30,
++    0xfc
++};
++
++static const unsigned char dig_sha256[] =
++    { 0xf7, 0x26, 0xd8, 0x98, 0x47, 0x91, 0x68, 0x5b,
++    0x9e, 0x39, 0xb2, 0x58, 0xbb, 0x75, 0xbf, 0x01,
++    0x17, 0x0c, 0x84, 0x00, 0x01, 0x7a, 0x94, 0x83,
++    0xf3, 0x0b, 0x15, 0x84, 0x4b, 0x69, 0x88, 0x8a
++};
++
++static const unsigned char msg_sha512[] =
++    { 0x37, 0xd1, 0x35, 0x9d, 0x18, 0x41, 0xe9, 0xb7,
++    0x6d, 0x9a, 0x13, 0xda, 0x5f, 0xf3, 0xbd
++};
++
++static const unsigned char dig_sha512[] =
++    { 0x11, 0x13, 0xc4, 0x19, 0xed, 0x2b, 0x1d, 0x16,
++    0x11, 0xeb, 0x9b, 0xbe, 0xf0, 0x7f, 0xcf, 0x44,
++    0x8b, 0xd7, 0x57, 0xbd, 0x8d, 0xa9, 0x25, 0xb0,
++    0x47, 0x25, 0xd6, 0x6c, 0x9a, 0x54, 0x7f, 0x8f,
++    0x0b, 0x53, 0x1a, 0x10, 0x68, 0x32, 0x03, 0x38,
++    0x82, 0xc4, 0x87, 0xc4, 0xea, 0x0e, 0xd1, 0x04,
++    0xa9, 0x98, 0xc1, 0x05, 0xa3, 0xf3, 0xf8, 0xb1,
++    0xaf, 0xbc, 0xd9, 0x78, 0x7e, 0xee, 0x3d, 0x43
++};
++
++int FIPS_selftest_sha2(void)
++{
++    unsigned char md[SHA512_DIGEST_LENGTH];
++
++    EVP_Digest(msg_sha256, sizeof(msg_sha256), md, NULL, EVP_sha256(), NULL);
++    if (memcmp(dig_sha256, md, sizeof(dig_sha256))) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_SHA2, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    EVP_Digest(msg_sha512, sizeof(msg_sha512), md, NULL, EVP_sha512(), NULL);
++    if (memcmp(dig_sha512, md, sizeof(dig_sha512))) {
++        FIPSerr(FIPS_F_FIPS_SELFTEST_SHA2, FIPS_R_SELFTEST_FAILED);
++        return 0;
++    }
++
++    return 1;
++}
++
++#endif
+diff -up openssl-1.1.1/crypto/fips/fips_standalone_hmac.c.fips openssl-1.1.1/crypto/fips/fips_standalone_hmac.c
+--- openssl-1.1.1/crypto/fips/fips_standalone_hmac.c.fips	2018-09-13 08:51:22.114520830 +0200
++++ openssl-1.1.1/crypto/fips/fips_standalone_hmac.c	2018-09-13 08:51:22.114520830 +0200
+@@ -0,0 +1,127 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <openssl/opensslconf.h>
++#include <openssl/hmac.h>
++#include <openssl/sha.h>
++
++int main(int argc, char **argv)
++{
++#ifdef OPENSSL_FIPS
++    static char key[] = "orboDeJITITejsirpADONivirpUkvarP";
++    int n, binary = 0;
++
++    if (argc < 2) {
++        fprintf(stderr, "%s [<file>]+\n", argv[0]);
++        exit(1);
++    }
++
++    n = 1;
++    if (!strcmp(argv[n], "-binary")) {
++        n++;
++        binary = 1;             /* emit binary fingerprint... */
++    }
++
++    for (; n < argc; ++n) {
++        FILE *f = fopen(argv[n], "rb");
++        HMAC_CTX *hmac_ctx;
++        unsigned char mac[EVP_MAX_MD_SIZE];
++        unsigned int len;
++        unsigned int i;
++
++        if (!f) {
++            perror(argv[n]);
++            exit(2);
++        }
++        hmac_ctx = HMAC_CTX_new();
++        if (!hmac_ctx)
++            exit(3);
++
++        if (HMAC_Init_ex(hmac_ctx, key, strlen(key), EVP_sha256(), NULL) <= 0) {
++            fprintf(stderr, "HMAC SHA256 initialization failed.\n");
++            exit(4);
++        }
++
++        for (;;) {
++            unsigned char buf[1024];
++            size_t l = fread(buf, 1, sizeof buf, f);
++
++            if (l == 0) {
++                if (ferror(f)) {
++                    perror(argv[n]);
++                    exit(3);
++                } else
++                    break;
++            }
++            if (HMAC_Update(hmac_ctx, buf, l) <= 0) {
++                fprintf(stderr, "HMAC_Update() failed.\n");
++                exit(4);
++            }
++        }
++        if (HMAC_Final(hmac_ctx, mac, &len) <= 0) {
++            fprintf(stderr, "HMAC_Final() failed.\n");
++            exit(4);
++        }
++
++        if (binary) {
++            fwrite(mac, len, 1, stdout);
++            break;              /* ... for single(!) file */
++        }
++
++/*      printf("HMAC-SHA1(%s)= ",argv[n]); */
++        for (i = 0; i < len; ++i)
++            printf("%02x", mac[i]);
++        printf("\n");
++    }
++#endif
++    return 0;
++}
+diff -up openssl-1.1.1/crypto/hmac/hmac.c.fips openssl-1.1.1/crypto/hmac/hmac.c
+--- openssl-1.1.1/crypto/hmac/hmac.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/hmac/hmac.c	2018-09-13 08:51:22.114520830 +0200
+@@ -36,6 +36,13 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const vo
+     }
+ 
+     if (key != NULL) {
++#ifdef OPENSSL_FIPS
++        if (FIPS_mode() && !(EVP_MD_flags(md) & EVP_MD_FLAG_FIPS)
++            && (!EVP_MD_CTX_test_flags(ctx->md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
++                || !EVP_MD_CTX_test_flags(ctx->i_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
++                || !EVP_MD_CTX_test_flags(ctx->o_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)))
++            goto err;
++#endif
+         reset = 1;
+         j = EVP_MD_block_size(md);
+         if (!ossl_assert(j <= (int)sizeof(ctx->key)))
+diff -up openssl-1.1.1/crypto/include/internal/fips_int.h.fips openssl-1.1.1/crypto/include/internal/fips_int.h
+--- openssl-1.1.1/crypto/include/internal/fips_int.h.fips	2018-09-13 08:51:22.114520830 +0200
++++ openssl-1.1.1/crypto/include/internal/fips_int.h	2018-09-13 08:51:22.114520830 +0200
+@@ -0,0 +1,101 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <openssl/opensslconf.h>
++#include <openssl/evp.h>
++
++#ifndef OPENSSL_FIPS
++# error FIPS is disabled.
++#endif
++
++#ifdef OPENSSL_FIPS
++
++int FIPS_module_mode_set(int onoff);
++int FIPS_module_mode(void);
++int FIPS_module_installed(void);
++int FIPS_selftest_sha1(void);
++int FIPS_selftest_sha2(void);
++int FIPS_selftest_aes_ccm(void);
++int FIPS_selftest_aes_gcm(void);
++int FIPS_selftest_aes_xts(void);
++int FIPS_selftest_aes(void);
++int FIPS_selftest_des(void);
++int FIPS_selftest_rsa(void);
++int FIPS_selftest_dsa(void);
++int FIPS_selftest_ecdsa(void);
++int FIPS_selftest_ecdh(void);
++int FIPS_selftest_dh(void);
++void FIPS_drbg_stick(int onoff);
++int FIPS_selftest_hmac(void);
++int FIPS_selftest_drbg(void);
++int FIPS_selftest_cmac(void);
++
++int fips_pkey_signature_test(EVP_PKEY *pkey,
++                                 const unsigned char *tbs, int tbslen,
++                                 const unsigned char *kat,
++                                 unsigned int katlen,
++                                 const EVP_MD *digest,
++                                 unsigned int md_flags, const char *fail_str);
++
++int fips_cipher_test(EVP_CIPHER_CTX *ctx,
++                         const EVP_CIPHER *cipher,
++                         const unsigned char *key,
++                         const unsigned char *iv,
++                         const unsigned char *plaintext,
++                         const unsigned char *ciphertext, int len);
++
++void fips_set_selftest_fail(void);
++
++const EVP_MD *FIPS_get_digestbynid(int nid);
++
++const EVP_CIPHER *FIPS_get_cipherbynid(int nid);
++
++void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr);
++
++#endif
+diff -up openssl-1.1.1/crypto/o_fips.c.fips openssl-1.1.1/crypto/o_fips.c
+--- openssl-1.1.1/crypto/o_fips.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/o_fips.c	2018-10-09 18:12:06.787802422 +0200
+@@ -8,17 +8,28 @@
+  */
+ 
+ #include "internal/cryptlib.h"
++#include "internal/fips_int.h"
+ 
+ int FIPS_mode(void)
+ {
++#ifdef OPENSSL_FIPS
++    return FIPS_module_mode();
++#else
+     /* This version of the library does not support FIPS mode. */
+     return 0;
++#endif
+ }
+ 
+ int FIPS_mode_set(int r)
+ {
++#ifdef OPENSSL_FIPS
++    if (r && FIPS_module_mode()) /* can be implicitly initialized by OPENSSL_init() */
++        return 1;
++    return FIPS_module_mode_set(r);
++#else
+     if (r == 0)
+         return 1;
+     CRYPTOerr(CRYPTO_F_FIPS_MODE_SET, CRYPTO_R_FIPS_MODE_NOT_SUPPORTED);
+     return 0;
++#endif
+ }
+diff -up openssl-1.1.1/crypto/o_init.c.fips openssl-1.1.1/crypto/o_init.c
+--- openssl-1.1.1/crypto/o_init.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/o_init.c	2018-09-13 08:51:22.115520806 +0200
+@@ -7,8 +7,68 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "e_os.h"
+ #include <openssl/err.h>
++#ifdef OPENSSL_FIPS
++# include <sys/types.h>
++# include <sys/stat.h>
++# include <fcntl.h>
++# include <unistd.h>
++# include <errno.h>
++# include <stdlib.h>
++# include <openssl/rand.h>
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++
++# define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
++
++static void init_fips_mode(void)
++{
++    char buf[2] = "0";
++    int fd;
++
++    /* Ensure the selftests always run */
++    /* XXX: TO SOLVE - premature initialization due to selftests */
++    FIPS_mode_set(1);
++
++    if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
++        buf[0] = '1';
++    } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
++        while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
++        close(fd);
++    }
++    /* Failure reading the fips mode switch file means just not
++     * switching into FIPS mode. We would break too many things
++     * otherwise..
++     */
++
++    if (buf[0] != '1') {
++        /* drop down to non-FIPS mode if it is not requested */
++        FIPS_mode_set(0);
++    } else {
++        /* abort if selftest failed */
++        FIPS_selftest_check();
++    }
++}
++
++/*
++ * Perform FIPS module power on selftest and automatic FIPS mode switch.
++ */
++
++void __attribute__ ((constructor)) OPENSSL_init_library(void)
++{
++    static int done = 0;
++    if (done)
++        return;
++    done = 1;
++    if (!FIPS_module_installed()) {
++        return;
++    }
++    init_fips_mode();
++}
++#endif
+ 
+ /*
+  * Perform any essential OpenSSL initialization operations. Currently does
+diff -up openssl-1.1.1/crypto/rand/rand_lib.c.fips openssl-1.1.1/crypto/rand/rand_lib.c
+--- openssl-1.1.1/crypto/rand/rand_lib.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rand/rand_lib.c	2018-09-13 08:51:22.115520806 +0200
+@@ -16,6 +16,10 @@
+ #include "internal/thread_once.h"
+ #include "rand_lcl.h"
+ #include "e_os.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include <openssl/fips_rand.h>
++#endif
+ 
+ #ifndef OPENSSL_NO_ENGINE
+ /* non-NULL if default_RAND_meth is ENGINE-provided */
+@@ -797,3 +801,15 @@ int RAND_status(void)
+         return meth->status();
+     return 0;
+ }
++
++#ifdef OPENSSL_FIPS
++void RAND_set_fips_drbg_type(int type, int flags)
++{   /* just a stub for ABI compatibility */
++}
++
++int RAND_init_fips(void)
++{
++   /* just a stub for ABI compatibility */
++    return 1;
++}
++#endif
+diff -up openssl-1.1.1/crypto/rsa/rsa_crpt.c.fips openssl-1.1.1/crypto/rsa/rsa_crpt.c
+--- openssl-1.1.1/crypto/rsa/rsa_crpt.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_crpt.c	2018-09-13 08:51:22.117520759 +0200
+@@ -27,24 +27,52 @@ int RSA_size(const RSA *r)
+ int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
+                        RSA *rsa, int padding)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PUBLIC_ENCRYPT, RSA_R_NON_FIPS_RSA_METHOD);
++        return -1;
++    }
++#endif
+     return rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding);
+ }
+ 
+ int RSA_private_encrypt(int flen, const unsigned char *from,
+                         unsigned char *to, RSA *rsa, int padding)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PRIVATE_ENCRYPT,
++               RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
++        return -1;
++    }
++#endif
+     return rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding);
+ }
+ 
+ int RSA_private_decrypt(int flen, const unsigned char *from,
+                         unsigned char *to, RSA *rsa, int padding)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PRIVATE_DECRYPT, RSA_R_NON_FIPS_RSA_METHOD);
++        return -1;
++    }
++#endif
+     return rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding);
+ }
+ 
+ int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
+                        RSA *rsa, int padding)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_PUBLIC_DECRYPT,
++               RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
++        return -1;
++    }
++#endif
+     return rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding);
+ }
+ 
+diff -up openssl-1.1.1/crypto/rsa/rsa_err.c.fips openssl-1.1.1/crypto/rsa/rsa_err.c
+--- openssl-1.1.1/crypto/rsa/rsa_err.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_err.c	2018-09-13 08:51:22.117520759 +0200
+@@ -16,6 +16,8 @@
+ static const ERR_STRING_DATA RSA_str_functs[] = {
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_CHECK_PADDING_MD, 0), "check_padding_md"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_ENCODE_PKCS1, 0), "encode_pkcs1"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_FIPS_RSA_BUILTIN_KEYGEN, 0),
++     "fips_rsa_builtin_keygen"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_INT_RSA_VERIFY, 0), "int_rsa_verify"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_OLD_RSA_PRIV_DECODE, 0),
+      "old_rsa_priv_decode"},
+@@ -32,6 +34,9 @@ static const ERR_STRING_DATA RSA_str_fun
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_CHECK_KEY_EX, 0), "RSA_check_key_ex"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_CMS_DECRYPT, 0), "rsa_cms_decrypt"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_CMS_VERIFY, 0), "rsa_cms_verify"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_GENERATE_KEY_EX, 0), "RSA_generate_key_ex"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_GENERATE_MULTI_PRIME_KEY, 0),
++     "RSA_generate_multi_prime_key"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_ITEM_VERIFY, 0), "rsa_item_verify"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_METH_DUP, 0), "RSA_meth_dup"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_METH_NEW, 0), "RSA_meth_new"},
+@@ -90,9 +95,13 @@ static const ERR_STRING_DATA RSA_str_fun
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PRINT_FP, 0), "RSA_print_fp"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PRIV_DECODE, 0), "rsa_priv_decode"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PRIV_ENCODE, 0), "rsa_priv_encode"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PRIVATE_DECRYPT, 0), "RSA_private_decrypt"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PRIVATE_ENCRYPT, 0), "RSA_private_encrypt"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PSS_GET_PARAM, 0), "rsa_pss_get_param"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PSS_TO_CTX, 0), "rsa_pss_to_ctx"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PUB_DECODE, 0), "rsa_pub_decode"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PUBLIC_DECRYPT, 0), "RSA_public_decrypt"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_PUBLIC_ENCRYPT, 0), "RSA_public_encrypt"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_SETUP_BLINDING, 0), "RSA_setup_blinding"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_SIGN, 0), "RSA_sign"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_SIGN_ASN1_OCTET_STRING, 0),
+@@ -102,6 +111,8 @@ static const ERR_STRING_DATA RSA_str_fun
+      "RSA_verify_ASN1_OCTET_STRING"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, 0),
+      "RSA_verify_PKCS1_PSS_mgf1"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_SET_DEFAULT_METHOD, 0), "RSA_set_default_method"},
++    {ERR_PACK(ERR_LIB_RSA, RSA_F_RSA_SET_METHOD, 0), "RSA_set_method"},
+     {ERR_PACK(ERR_LIB_RSA, RSA_F_SETUP_TBUF, 0), "setup_tbuf"},
+     {0, NULL}
+ };
+@@ -181,6 +192,7 @@ static const ERR_STRING_DATA RSA_str_rea
+     "mp exponent not congruent to d"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_MP_R_NOT_PRIME), "mp r not prime"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_NO_PUBLIC_EXPONENT), "no public exponent"},
++    {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_NON_FIPS_RSA_METHOD), "non FIPS rsa method"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_NULL_BEFORE_BLOCK_MISSING),
+     "null before block missing"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES),
+@@ -189,6 +201,8 @@ static const ERR_STRING_DATA RSA_str_rea
+     "n does not equal p q"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_OAEP_DECODING_ERROR),
+     "oaep decoding error"},
++    {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),
++    "operation not allowed in FIPS mode"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),
+     "operation not supported for this keytype"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_PADDING_CHECK_FAILED),
+@@ -224,6 +238,8 @@ static const ERR_STRING_DATA RSA_str_rea
+     "unsupported mask algorithm"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_UNSUPPORTED_MASK_PARAMETER),
+     "unsupported mask parameter"},
++    {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_UNSUPPORTED_PARAMETERS),
++    "unsupported parameters"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_UNSUPPORTED_SIGNATURE_TYPE),
+     "unsupported signature type"},
+     {ERR_PACK(ERR_LIB_RSA, 0, RSA_R_VALUE_MISSING), "value missing"},
+diff -up openssl-1.1.1/crypto/rsa/rsa_gen.c.fips openssl-1.1.1/crypto/rsa/rsa_gen.c
+--- openssl-1.1.1/crypto/rsa/rsa_gen.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_gen.c	2018-09-13 08:51:22.118520736 +0200
+@@ -18,6 +18,78 @@
+ #include "internal/cryptlib.h"
+ #include <openssl/bn.h>
+ #include "rsa_locl.h"
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++# include "internal/fips_int.h"
++
++int fips_check_rsa(RSA *rsa)
++{
++    const unsigned char tbs[] = "RSA Pairwise Check Data";
++    unsigned char *ctbuf = NULL, *ptbuf = NULL;
++    int len, ret = 0;
++    EVP_PKEY *pk;
++
++    if ((pk = EVP_PKEY_new()) == NULL)
++        goto err;
++
++    EVP_PKEY_set1_RSA(pk, rsa);
++
++    /* Perform pairwise consistency signature test */
++    if (!fips_pkey_signature_test(pk, tbs, -1,
++                                  NULL, 0, EVP_sha1(),
++                                  EVP_MD_CTX_FLAG_PAD_PKCS1, NULL)
++        || !fips_pkey_signature_test(pk, tbs, -1, NULL, 0, EVP_sha1(),
++                                     EVP_MD_CTX_FLAG_PAD_X931, NULL)
++        || !fips_pkey_signature_test(pk, tbs, -1, NULL, 0, EVP_sha1(),
++                                     EVP_MD_CTX_FLAG_PAD_PSS, NULL))
++        goto err;
++    /* Now perform pairwise consistency encrypt/decrypt test */
++    ctbuf = OPENSSL_malloc(RSA_size(rsa));
++    if (!ctbuf)
++        goto err;
++
++    len =
++        RSA_public_encrypt(sizeof(tbs) - 1, tbs, ctbuf, rsa,
++                           RSA_PKCS1_PADDING);
++    if (len <= 0)
++        goto err;
++    /* Check ciphertext doesn't match plaintext */
++    if ((len == (sizeof(tbs) - 1)) && !memcmp(tbs, ctbuf, len))
++        goto err;
++    ptbuf = OPENSSL_malloc(RSA_size(rsa));
++
++    if (!ptbuf)
++        goto err;
++    len = RSA_private_decrypt(len, ctbuf, ptbuf, rsa, RSA_PKCS1_PADDING);
++    if (len != (sizeof(tbs) - 1))
++        goto err;
++    if (memcmp(ptbuf, tbs, len))
++        goto err;
++
++    ret = 1;
++
++    if (!ptbuf)
++        goto err;
++
++ err:
++    if (ret == 0) {
++        fips_set_selftest_fail();
++        FIPSerr(FIPS_F_FIPS_CHECK_RSA, FIPS_R_PAIRWISE_TEST_FAILED);
++    }
++
++    if (ctbuf)
++        OPENSSL_free(ctbuf);
++    if (ptbuf)
++        OPENSSL_free(ptbuf);
++    if (pk)
++        EVP_PKEY_free(pk);
++
++    return ret;
++}
++
++static int fips_rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
++                                   BN_GENCB *cb);
++#endif
+ 
+ static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
+                               BN_GENCB *cb);
+@@ -31,6 +103,13 @@ static int rsa_builtin_keygen(RSA *rsa,
+  */
+ int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_GENERATE_KEY_EX, RSA_R_NON_FIPS_RSA_METHOD);
++        return 0;
++    }
++#endif
+     if (rsa->meth->rsa_keygen != NULL)
+         return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
+ 
+@@ -41,6 +120,13 @@ int RSA_generate_key_ex(RSA *rsa, int bi
+ int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
+                                  BIGNUM *e_value, BN_GENCB *cb)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_GENERATE_MULTI_PRIME_KEY, RSA_R_NON_FIPS_RSA_METHOD);
++        return 0;
++    }
++#endif
+     /* multi-prime is only supported with the builtin key generation */
+     if (rsa->meth->rsa_multi_prime_keygen != NULL) {
+         return rsa->meth->rsa_multi_prime_keygen(rsa, bits, primes,
+@@ -57,10 +143,285 @@ int RSA_generate_multi_prime_key(RSA *rs
+         else
+             return 0;
+     }
+-
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (primes != 2) {
++            RSAerr(RSA_F_RSA_GENERATE_MULTI_PRIME_KEY, RSA_R_UNSUPPORTED_PARAMETERS);
++            return 0;
++        }
++        return fips_rsa_builtin_keygen(rsa, bits, e_value, cb);
++    }
++#endif
+     return rsa_builtin_keygen(rsa, bits, primes, e_value, cb);
+ }
+ 
++#ifdef OPENSSL_FIPS
++static int fips_rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
++                                   BN_GENCB *cb)
++{
++    BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *r3 = NULL, *tmp;
++    BN_CTX *ctx = NULL;
++    int ok = -1;
++    int i;
++    int n = 0;
++    int test = 0;
++    int pbits = bits / 2;
++    unsigned long error = 0;
++
++    if (FIPS_selftest_failed()) {
++        FIPSerr(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN, FIPS_R_FIPS_SELFTEST_FAILED);
++        return 0;
++    }
++
++    if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS
++        || (getenv("OPENSSL_ENFORCE_MODULUS_BITS") && bits < 2048)) {
++        FIPSerr(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN, FIPS_R_KEY_TOO_SHORT);
++        return 0;
++    }
++    if ((pbits & 0xFF) != 0) {
++        FIPSerr(FIPS_F_FIPS_RSA_BUILTIN_KEYGEN, FIPS_R_INVALID_KEY_LENGTH);
++        return 0;
++    }
++
++    ctx = BN_CTX_new();
++    if (ctx == NULL)
++        goto err;
++    BN_CTX_start(ctx);
++    r0 = BN_CTX_get(ctx);
++    r1 = BN_CTX_get(ctx);
++    r2 = BN_CTX_get(ctx);
++    r3 = BN_CTX_get(ctx);
++
++    if (r3 == NULL)
++        goto err;
++
++    /* We need the RSA components non-NULL */
++    if (!rsa->n && ((rsa->n = BN_new()) == NULL))
++        goto err;
++    if (!rsa->d && ((rsa->d = BN_secure_new()) == NULL))
++        goto err;
++    if (!rsa->e && ((rsa->e = BN_new()) == NULL))
++        goto err;
++    if (!rsa->p && ((rsa->p = BN_secure_new()) == NULL))
++        goto err;
++    if (!rsa->q && ((rsa->q = BN_secure_new()) == NULL))
++        goto err;
++    if (!rsa->dmp1 && ((rsa->dmp1 = BN_secure_new()) == NULL))
++        goto err;
++    if (!rsa->dmq1 && ((rsa->dmq1 = BN_secure_new()) == NULL))
++        goto err;
++    if (!rsa->iqmp && ((rsa->iqmp = BN_secure_new()) == NULL))
++        goto err;
++
++    if (!BN_set_word(r0, RSA_F4))
++        goto err;
++    if (BN_cmp(e_value, r0) < 0 || BN_num_bits(e_value) > 256) {
++        ok = 0;                 /* we set our own err */
++        RSAerr(RSA_F_FIPS_RSA_BUILTIN_KEYGEN, RSA_R_BAD_E_VALUE);
++        goto err;
++    }
++
++    /* prepare approximate minimum p and q */
++    if (!BN_set_word(r0, 0xB504F334))
++        goto err;
++    if (!BN_lshift(r0, r0, pbits - 32))
++        goto err;
++
++    /* prepare minimum p and q difference */
++    if (!BN_one(r3))
++        goto err;
++    if (!BN_lshift(r3, r3, pbits - 100))
++        goto err;
++
++    BN_copy(rsa->e, e_value);
++
++    if (!BN_is_zero(rsa->p) && !BN_is_zero(rsa->q))
++        test = 1;
++
++    BN_set_flags(r0, BN_FLG_CONSTTIME);
++    BN_set_flags(r1, BN_FLG_CONSTTIME);
++    BN_set_flags(r2, BN_FLG_CONSTTIME);
++    BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
++    BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
++
++ retry:
++    /* generate p and q */
++    for (i = 0; i < 5 * pbits; i++) {
++ ploop:
++        if (!test)
++            if (!BN_rand(rsa->p, pbits, 0, 1))
++                goto err;
++        if (BN_cmp(rsa->p, r0) < 0) {
++            if (test)
++                goto err;
++            goto ploop;
++        }
++
++        if (!BN_sub(r2, rsa->p, BN_value_one()))
++            goto err;
++        ERR_set_mark();
++        if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {
++            /* GCD == 1 since inverse exists */
++            int r;
++            r = BN_is_prime_fasttest_ex(rsa->p, pbits > 1024 ? 4 : 5, ctx, 0,
++                                        cb);
++            if (r == -1 || (test && r <= 0))
++                goto err;
++            if (r > 0)
++                break;
++        } else {
++            error = ERR_peek_last_error();
++            if (ERR_GET_LIB(error) == ERR_LIB_BN
++                && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {
++                /* GCD != 1 */
++                ERR_pop_to_mark();
++            } else {
++                goto err;
++            }
++        }
++        if (!BN_GENCB_call(cb, 2, n++))
++            goto err;
++    }
++
++    if (!BN_GENCB_call(cb, 3, 0))
++        goto err;
++
++    if (i >= 5 * pbits)
++        /* prime not found */
++        goto err;
++
++    for (i = 0; i < 5 * pbits; i++) {
++ qloop:
++        if (!test)
++            if (!BN_rand(rsa->q, pbits, 0, 1))
++                goto err;
++        if (BN_cmp(rsa->q, r0) < 0) {
++            if (test)
++                goto err;
++            goto qloop;
++        }
++        if (!BN_sub(r2, rsa->q, rsa->p))
++            goto err;
++        if (BN_ucmp(r2, r3) <= 0) {
++            if (test)
++                goto err;
++            goto qloop;
++        }
++
++        if (!BN_sub(r2, rsa->q, BN_value_one()))
++            goto err;
++        ERR_set_mark();
++        if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {
++            /* GCD == 1 since inverse exists */
++            int r;
++            r = BN_is_prime_fasttest_ex(rsa->q, pbits > 1024 ? 4 : 5, ctx, 0,
++                                        cb);
++            if (r == -1 || (test && r <= 0))
++                goto err;
++            if (r > 0)
++                break;
++        } else {
++            error = ERR_peek_last_error();
++            if (ERR_GET_LIB(error) == ERR_LIB_BN
++                && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {
++                /* GCD != 1 */
++                ERR_pop_to_mark();
++            } else {
++                goto err;
++            }
++        }
++        if (!BN_GENCB_call(cb, 2, n++))
++            goto err;
++    }
++
++    if (!BN_GENCB_call(cb, 3, 1))
++        goto err;
++
++    if (i >= 5 * pbits)
++        /* prime not found */
++        goto err;
++
++    if (test) {
++        /* do not try to calculate the remaining key values */
++        BN_clear(rsa->n);
++        ok = 1;
++        goto err;
++    }
++
++    if (BN_cmp(rsa->p, rsa->q) < 0) {
++        tmp = rsa->p;
++        rsa->p = rsa->q;
++        rsa->q = tmp;
++    }
++
++    /* calculate n */
++    if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx))
++        goto err;
++
++    /* calculate d */
++    if (!BN_sub(r1, rsa->p, BN_value_one()))
++        goto err;               /* p-1 */
++    if (!BN_sub(r2, rsa->q, BN_value_one()))
++        goto err;               /* q-1 */
++
++    /* note that computing gcd is not safe to timing attacks */
++    if (!BN_gcd(r0, r1, r2, ctx))
++        goto err;
++
++    {
++        if (!BN_div(r0, NULL, r1, r0, ctx))
++            goto err;
++
++        if (!BN_mul(r0, r0, r2, ctx)) /* lcm(p-1, q-1) */
++            goto err;
++
++        if (!BN_mod_inverse(rsa->d, rsa->e, r0, ctx)) /* d */
++            goto err;
++    }
++
++    if (BN_num_bits(rsa->d) < pbits)
++        goto retry;             /* d is too small */
++
++    {
++        BIGNUM *d = BN_new();
++
++        if (d == NULL)
++            goto err;
++        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
++
++        if (/* calculate d mod (p-1) */
++            !BN_mod(rsa->dmp1, d, r1, ctx)
++            /* calculate d mod (q-1) */
++            || !BN_mod(rsa->dmq1, d, r2, ctx)) {
++            BN_free(d);
++            goto err;
++        }
++        /* We MUST free d before any further use of rsa->d */
++        BN_free(d);
++    }
++
++    /* calculate inverse of q mod p */
++    if (!BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx))
++        goto err;
++
++    if (!fips_check_rsa(rsa))
++        goto err;
++
++    ok = 1;
++ err:
++    if (ok == -1) {
++        RSAerr(RSA_F_FIPS_RSA_BUILTIN_KEYGEN, ERR_LIB_BN);
++        ok = 0;
++    }
++    if (ctx != NULL) {
++        BN_CTX_end(ctx);
++        BN_CTX_free(ctx);
++    }
++
++    return ok;
++}
++#endif
++
+ static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
+                               BN_GENCB *cb)
+ {
+diff -up openssl-1.1.1/crypto/rsa/rsa_lib.c.fips openssl-1.1.1/crypto/rsa/rsa_lib.c
+--- openssl-1.1.1/crypto/rsa/rsa_lib.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_lib.c	2018-09-13 08:51:22.118520736 +0200
+@@ -34,6 +34,12 @@ int RSA_set_method(RSA *rsa, const RSA_M
+      * to deal with which ENGINE it comes from.
+      */
+     const RSA_METHOD *mtmp;
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_SET_METHOD, RSA_R_NON_FIPS_RSA_METHOD);
++        return 0;
++    }
++#endif
+     mtmp = rsa->meth;
+     if (mtmp->finish)
+         mtmp->finish(rsa);
+@@ -66,7 +72,6 @@ RSA *RSA_new_method(ENGINE *engine)
+ 
+     ret->meth = RSA_get_default_method();
+ #ifndef OPENSSL_NO_ENGINE
+-    ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
+     if (engine) {
+         if (!ENGINE_init(engine)) {
+             RSAerr(RSA_F_RSA_NEW_METHOD, ERR_R_ENGINE_LIB);
+@@ -84,8 +89,19 @@ RSA *RSA_new_method(ENGINE *engine)
+         }
+     }
+ #endif
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(ret->meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_NEW_METHOD, RSA_R_NON_FIPS_RSA_METHOD);
++# ifndef OPENSSL_NO_ENGINE
++        if (ret->engine)
++            ENGINE_finish(ret->engine);
++# endif
++        OPENSSL_free(ret);
++        return NULL;
++    }
++#endif
+ 
+-    ret->flags = ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
++    ret->flags = ret->meth->flags;
+     if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data)) {
+         goto err;
+     }
+diff -up openssl-1.1.1/crypto/rsa/rsa_ossl.c.fips openssl-1.1.1/crypto/rsa/rsa_ossl.c
+--- openssl-1.1.1/crypto/rsa/rsa_ossl.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_ossl.c	2018-09-13 08:51:22.118520736 +0200
+@@ -11,6 +11,10 @@
+ #include "internal/bn_int.h"
+ #include "rsa_locl.h"
+ 
++#ifdef OPENSSL_FIPS
++# include <openssl/fips.h>
++#endif
++
+ static int rsa_ossl_public_encrypt(int flen, const unsigned char *from,
+                                   unsigned char *to, RSA *rsa, int padding);
+ static int rsa_ossl_private_encrypt(int flen, const unsigned char *from,
+@@ -46,6 +50,12 @@ static const RSA_METHOD *default_RSA_met
+ 
+ void RSA_set_default_method(const RSA_METHOD *meth)
+ {
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(meth->flags & RSA_FLAG_FIPS_METHOD)) {
++        RSAerr(RSA_F_RSA_SET_DEFAULT_METHOD, RSA_R_NON_FIPS_RSA_METHOD);
++        return;
++    }
++#endif
+     default_RSA_meth = meth;
+ }
+ 
+@@ -72,6 +82,22 @@ static int rsa_ossl_public_encrypt(int f
+     unsigned char *buf = NULL;
+     BN_CTX *ctx = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_OSSL_PUBLIC_ENCRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            goto err;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
+         RSAerr(RSA_F_RSA_OSSL_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+         return -1;
+@@ -246,6 +272,22 @@ static int rsa_ossl_private_encrypt(int
+     BIGNUM *unblind = NULL;
+     BN_BLINDING *blinding = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_OSSL_PRIVATE_ENCRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            return -1;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+     BN_CTX_start(ctx);
+@@ -378,6 +420,22 @@ static int rsa_ossl_private_decrypt(int
+     BIGNUM *unblind = NULL;
+     BN_BLINDING *blinding = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_OSSL_PRIVATE_DECRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            return -1;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if ((ctx = BN_CTX_new()) == NULL)
+         goto err;
+     BN_CTX_start(ctx);
+@@ -501,6 +559,22 @@ static int rsa_ossl_public_decrypt(int f
+     unsigned char *buf = NULL;
+     BN_CTX *ctx = NULL;
+ 
++# ifdef OPENSSL_FIPS
++    if (FIPS_mode()) {
++        if (FIPS_selftest_failed()) {
++            FIPSerr(FIPS_F_RSA_OSSL_PUBLIC_DECRYPT,
++                    FIPS_R_FIPS_SELFTEST_FAILED);
++            goto err;
++        }
++
++        if (!(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
++            && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)) {
++            RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
++            return -1;
++        }
++    }
++# endif
++
+     if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) {
+         RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+         return -1;
+diff -up openssl-1.1.1/crypto/rsa/rsa_sign.c.fips openssl-1.1.1/crypto/rsa/rsa_sign.c
+--- openssl-1.1.1/crypto/rsa/rsa_sign.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/rsa/rsa_sign.c	2018-09-13 08:51:22.118520736 +0200
+@@ -73,6 +73,13 @@ int RSA_sign(int type, const unsigned ch
+     unsigned char *tmps = NULL;
+     const unsigned char *encoded = NULL;
+ 
++#ifdef OPENSSL_FIPS
++    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
++        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
++        RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
++        return 0;
++    }
++#endif
+     if (rsa->meth->rsa_sign) {
+         return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
+     }
+@@ -100,8 +107,9 @@ int RSA_sign(int type, const unsigned ch
+         RSAerr(RSA_F_RSA_SIGN, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
+         goto err;
+     }
+-    encrypt_len = RSA_private_encrypt(encoded_len, encoded, sigret, rsa,
+-                                      RSA_PKCS1_PADDING);
++    /* NB: call underlying method directly to avoid FIPS blocking */
++    encrypt_len = rsa->meth->rsa_priv_enc ? rsa->meth->rsa_priv_enc(encoded_len, encoded, sigret, rsa,
++                                                                    RSA_PKCS1_PADDING) : 0;
+     if (encrypt_len <= 0)
+         goto err;
+ 
+diff -up openssl-1.1.1/crypto/sha/sha256.c.fips openssl-1.1.1/crypto/sha/sha256.c
+--- openssl-1.1.1/crypto/sha/sha256.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/sha/sha256.c	2018-09-13 08:51:22.118520736 +0200
+@@ -18,6 +18,9 @@
+ 
+ int SHA224_Init(SHA256_CTX *c)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     memset(c, 0, sizeof(*c));
+     c->h[0] = 0xc1059ed8UL;
+     c->h[1] = 0x367cd507UL;
+@@ -33,6 +36,9 @@ int SHA224_Init(SHA256_CTX *c)
+ 
+ int SHA256_Init(SHA256_CTX *c)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     memset(c, 0, sizeof(*c));
+     c->h[0] = 0x6a09e667UL;
+     c->h[1] = 0xbb67ae85UL;
+diff -up openssl-1.1.1/crypto/sha/sha512.c.fips openssl-1.1.1/crypto/sha/sha512.c
+--- openssl-1.1.1/crypto/sha/sha512.c.fips	2018-09-11 14:48:21.000000000 +0200
++++ openssl-1.1.1/crypto/sha/sha512.c	2018-09-13 08:51:22.119520713 +0200
+@@ -98,6 +98,9 @@ int sha512_256_init(SHA512_CTX *c)
+ 
+ int SHA384_Init(SHA512_CTX *c)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     c->h[0] = U64(0xcbbb9d5dc1059ed8);
+     c->h[1] = U64(0x629a292a367cd507);
+     c->h[2] = U64(0x9159015a3070dd17);
+@@ -116,6 +119,9 @@ int SHA384_Init(SHA512_CTX *c)
+ 
+ int SHA512_Init(SHA512_CTX *c)
+ {
++# ifdef OPENSSL_FIPS
++    FIPS_selftest_check();
++# endif
+     c->h[0] = U64(0x6a09e667f3bcc908);
+     c->h[1] = U64(0xbb67ae8584caa73b);
+     c->h[2] = U64(0x3c6ef372fe94f82b);
+diff -up openssl-1.1.1/crypto/sha/sha_locl.h.fips openssl-1.1.1/crypto/sha/sha_locl.h
+--- openssl-1.1.1/crypto/sha/sha_locl.h.fips	2018-09-13 08:51:21.768528910 +0200
++++ openssl-1.1.1/crypto/sha/sha_locl.h	2018-09-13 08:51:22.118520736 +0200
+@@ -52,6 +52,9 @@ void sha1_block_data_order(SHA_CTX *c, c
+ 
+ int HASH_INIT(SHA_CTX *c)
+ {
++#if defined(OPENSSL_FIPS)
++    FIPS_selftest_check();
++#endif
+     memset(c, 0, sizeof(*c));
+     c->h0 = INIT_DATA_h0;
+     c->h1 = INIT_DATA_h1;
+diff -up openssl-1.1.1/doc/man3/DSA_generate_parameters.pod.fips openssl-1.1.1/doc/man3/DSA_generate_parameters.pod
+--- openssl-1.1.1/doc/man3/DSA_generate_parameters.pod.fips	2018-09-11 14:48:22.000000000 +0200
++++ openssl-1.1.1/doc/man3/DSA_generate_parameters.pod	2018-09-13 08:51:22.119520713 +0200
+@@ -30,8 +30,10 @@ B<bits> is the length of the prime p to
+ For lengths under 2048 bits, the length of q is 160 bits; for lengths
+ greater than or equal to 2048 bits, the length of q is set to 256 bits.
+ 
+-If B<seed> is NULL, the primes will be generated at random.
+-If B<seed_len> is less than the length of q, an error is returned.
++If B<seed> is NULL, or it does not generate primes, the primes will be
++generated at random.
++If B<seed_len> is less than the length of q, an error is returned
++if old DSA parameter generation method is used as a backend.
+ 
+ DSA_generate_parameters_ex() places the iteration count in
+ *B<counter_ret> and a counter used for finding a generator in
+diff -up openssl-1.1.1/include/openssl/crypto.h.fips openssl-1.1.1/include/openssl/crypto.h
+--- openssl-1.1.1/include/openssl/crypto.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/crypto.h	2018-09-13 08:51:22.119520713 +0200
+@@ -336,6 +336,11 @@ int OPENSSL_isservice(void);
+ int FIPS_mode(void);
+ int FIPS_mode_set(int r);
+ 
++# ifdef OPENSSL_FIPS
++/* die if FIPS selftest failed */
++void FIPS_selftest_check(void);
++# endif
++
+ void OPENSSL_init(void);
+ # ifdef OPENSSL_SYS_UNIX
+ void OPENSSL_fork_prepare(void);
+diff -up openssl-1.1.1/include/openssl/dherr.h.fips openssl-1.1.1/include/openssl/dherr.h
+--- openssl-1.1.1/include/openssl/dherr.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/dherr.h	2018-09-13 08:51:22.119520713 +0200
+@@ -32,6 +32,9 @@ int ERR_load_DH_strings(void);
+ #  define DH_F_DH_CMS_DECRYPT                              114
+ #  define DH_F_DH_CMS_SET_PEERKEY                          115
+ #  define DH_F_DH_CMS_SET_SHARED_INFO                      116
++#  define DH_F_DH_COMPUTE_KEY                              203
++#  define DH_F_DH_GENERATE_KEY                             202
++#  define DH_F_DH_GENERATE_PARAMETERS_EX                   201
+ #  define DH_F_DH_METH_DUP                                 117
+ #  define DH_F_DH_METH_NEW                                 118
+ #  define DH_F_DH_METH_SET1_NAME                           119
+@@ -69,12 +72,14 @@ int ERR_load_DH_strings(void);
+ #  define DH_R_INVALID_PARAMETER_NID                       114
+ #  define DH_R_INVALID_PUBKEY                              102
+ #  define DH_R_KDF_PARAMETER_ERROR                         112
++#  define DH_R_KEY_SIZE_TOO_SMALL                          201
+ #  define DH_R_KEYS_NOT_SET                                108
+ #  define DH_R_MISSING_PUBKEY                              125
+ #  define DH_R_MODULUS_TOO_LARGE                           103
+ #  define DH_R_NOT_SUITABLE_GENERATOR                      120
+ #  define DH_R_NO_PARAMETERS_SET                           107
+ #  define DH_R_NO_PRIVATE_VALUE                            100
++#  define DH_R_NON_FIPS_METHOD                             202
+ #  define DH_R_PARAMETER_ENCODING_ERROR                    105
+ #  define DH_R_PEER_KEY_ERROR                              111
+ #  define DH_R_SHARED_INFO_ERROR                           113
+diff -up openssl-1.1.1/include/openssl/dh.h.fips openssl-1.1.1/include/openssl/dh.h
+--- openssl-1.1.1/include/openssl/dh.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/dh.h	2018-09-13 08:51:22.119520713 +0200
+@@ -31,6 +31,7 @@ extern "C" {
+ # endif
+ 
+ # define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
++# define OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN 2048
+ 
+ # define DH_FLAG_CACHE_MONT_P     0x01
+ 
+diff -up openssl-1.1.1/include/openssl/dsaerr.h.fips openssl-1.1.1/include/openssl/dsaerr.h
+--- openssl-1.1.1/include/openssl/dsaerr.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/dsaerr.h	2018-09-13 08:51:22.119520713 +0200
+@@ -25,8 +25,11 @@ int ERR_load_DSA_strings(void);
+  */
+ #  define DSA_F_DSAPARAMS_PRINT                            100
+ #  define DSA_F_DSAPARAMS_PRINT_FP                         101
++#  define DSA_F_DSA_BUILTIN_KEYGEN                         202
+ #  define DSA_F_DSA_BUILTIN_PARAMGEN                       125
+ #  define DSA_F_DSA_BUILTIN_PARAMGEN2                      126
++#  define DSA_F_DSA_GENERATE_KEY                           201
++#  define DSA_F_DSA_GENERATE_PARAMETERS_EX                 200
+ #  define DSA_F_DSA_DO_SIGN                                112
+ #  define DSA_F_DSA_DO_VERIFY                              113
+ #  define DSA_F_DSA_METH_DUP                               127
+@@ -56,9 +59,12 @@ int ERR_load_DSA_strings(void);
+ #  define DSA_R_DECODE_ERROR                               104
+ #  define DSA_R_INVALID_DIGEST_TYPE                        106
+ #  define DSA_R_INVALID_PARAMETERS                         112
++#  define DSA_R_KEY_SIZE_INVALID                           201
++#  define DSA_R_KEY_SIZE_TOO_SMALL                         202
+ #  define DSA_R_MISSING_PARAMETERS                         101
+ #  define DSA_R_MODULUS_TOO_LARGE                          103
+ #  define DSA_R_NO_PARAMETERS_SET                          107
++#  define DSA_R_NON_FIPS_DSA_METHOD                        200
+ #  define DSA_R_PARAMETER_ENCODING_ERROR                   105
+ #  define DSA_R_Q_NOT_PRIME                                113
+ #  define DSA_R_SEED_LEN_SMALL                             110
+diff -up openssl-1.1.1/include/openssl/dsa.h.fips openssl-1.1.1/include/openssl/dsa.h
+--- openssl-1.1.1/include/openssl/dsa.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/dsa.h	2018-09-13 08:51:22.119520713 +0200
+@@ -31,6 +31,7 @@ extern "C" {
+ # endif
+ 
+ # define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024
++# define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN 2048
+ 
+ # define DSA_FLAG_CACHE_MONT_P   0x01
+ # if OPENSSL_API_COMPAT < 0x10100000L
+diff -up openssl-1.1.1/include/openssl/evperr.h.fips openssl-1.1.1/include/openssl/evperr.h
+--- openssl-1.1.1/include/openssl/evperr.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/evperr.h	2018-09-13 08:51:22.120520689 +0200
+@@ -25,6 +25,7 @@ int ERR_load_EVP_strings(void);
+ # define EVP_F_AES_OCB_CIPHER                             169
+ # define EVP_F_AES_T4_INIT_KEY                            178
+ # define EVP_F_AES_WRAP_CIPHER                            170
++# define EVP_F_AES_XTS_CIPHER                             300
+ # define EVP_F_ALG_MODULE_INIT                            177
+ # define EVP_F_ARIA_CCM_INIT_KEY                          175
+ # define EVP_F_ARIA_GCM_CTRL                              197
+@@ -132,6 +133,7 @@ int ERR_load_EVP_strings(void);
+ # define EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED             133
+ # define EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH          138
+ # define EVP_R_DECODE_ERROR                               114
++# define EVP_R_DISABLED_FOR_FIPS                          200
+ # define EVP_R_DIFFERENT_KEY_TYPES                        101
+ # define EVP_R_DIFFERENT_PARAMETERS                       153
+ # define EVP_R_ERROR_LOADING_SECTION                      165
+@@ -174,6 +176,7 @@ int ERR_load_EVP_strings(void);
+ # define EVP_R_PRIVATE_KEY_DECODE_ERROR                   145
+ # define EVP_R_PRIVATE_KEY_ENCODE_ERROR                   146
+ # define EVP_R_PUBLIC_KEY_NOT_RSA                         106
++# define EVP_R_TOO_LARGE                                  201
+ # define EVP_R_UNKNOWN_CIPHER                             160
+ # define EVP_R_UNKNOWN_DIGEST                             161
+ # define EVP_R_UNKNOWN_OPTION                             169
+diff -up openssl-1.1.1/include/openssl/fips.h.fips openssl-1.1.1/include/openssl/fips.h
+--- openssl-1.1.1/include/openssl/fips.h.fips	2018-09-13 08:51:22.120520689 +0200
++++ openssl-1.1.1/include/openssl/fips.h	2018-09-13 08:51:22.120520689 +0200
+@@ -0,0 +1,186 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#include <openssl/opensslconf.h>
++#include <openssl/dsa.h>
++#include <openssl/evp.h>
++#include <openssl/bn.h>
++
++#ifndef OPENSSL_FIPS
++# error FIPS is disabled.
++#endif
++
++#ifdef OPENSSL_FIPS
++
++# ifdef  __cplusplus
++extern "C" {
++# endif
++
++    int FIPS_selftest(void);
++    int FIPS_selftest_failed(void);
++    int FIPS_selftest_drbg_all(void);
++
++    int FIPS_dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
++                               const EVP_MD *evpmd, const unsigned char *seed_in,
++                               size_t seed_len, int idx, unsigned char *seed_out,
++                               int *counter_ret, unsigned long *h_ret,
++                               BN_GENCB *cb);
++    int FIPS_dsa_paramgen_check_g(DSA *dsa);
++
++/* BEGIN ERROR CODES */
++/* The following lines are auto generated by the script mkerr.pl. Any changes
++ * made after this point may be overwritten when the script is next run.
++ */
++    int ERR_load_FIPS_strings(void);
++
++/* Error codes for the FIPS functions. */
++
++/* Function codes. */
++# define FIPS_F_DH_BUILTIN_GENPARAMS                      100
++# define FIPS_F_DRBG_RESEED                               121
++# define FIPS_F_DSA_BUILTIN_PARAMGEN2                     107
++# define FIPS_F_DSA_DO_SIGN                               102
++# define FIPS_F_DSA_DO_VERIFY                             103
++# define FIPS_F_EVP_CIPHER_CTX_NEW                        137
++# define FIPS_F_EVP_CIPHER_CTX_RESET                      122
++# define FIPS_F_ECDH_COMPUTE_KEY                          123
++# define FIPS_F_EVP_CIPHERINIT_EX                         124
++# define FIPS_F_EVP_DIGESTINIT_EX                         125
++# define FIPS_F_FIPS_CHECK_DSA                            104
++# define FIPS_F_FIPS_CHECK_EC                             142
++# define FIPS_F_FIPS_CHECK_RSA                            106
++# define FIPS_F_FIPS_DRBG_BYTES                           131
++# define FIPS_F_FIPS_DRBG_CHECK                           146
++# define FIPS_F_FIPS_DRBG_CPRNG_TEST                      132
++# define FIPS_F_FIPS_DRBG_ERROR_CHECK                     136
++# define FIPS_F_FIPS_DRBG_GENERATE                        134
++# define FIPS_F_FIPS_DRBG_INIT                            135
++# define FIPS_F_FIPS_DRBG_INSTANTIATE                     138
++# define FIPS_F_FIPS_DRBG_NEW                             139
++# define FIPS_F_FIPS_DRBG_RESEED                          140
++# define FIPS_F_FIPS_DRBG_SINGLE_KAT                      141
++# define FIPS_F_FIPS_GET_ENTROPY                          147
++# define FIPS_F_FIPS_MODULE_MODE_SET                      108
++# define FIPS_F_FIPS_PKEY_SIGNATURE_TEST                  109
++# define FIPS_F_FIPS_RAND_BYTES                           114
++# define FIPS_F_FIPS_RAND_SEED                            128
++# define FIPS_F_FIPS_RAND_SET_METHOD                      126
++# define FIPS_F_FIPS_RAND_STATUS                          127
++# define FIPS_F_FIPS_RSA_BUILTIN_KEYGEN                   101
++# define FIPS_F_FIPS_SELFTEST_AES                         110
++# define FIPS_F_FIPS_SELFTEST_AES_CCM                     145
++# define FIPS_F_FIPS_SELFTEST_AES_GCM                     129
++# define FIPS_F_FIPS_SELFTEST_AES_XTS                     144
++# define FIPS_F_FIPS_SELFTEST_CMAC                        130
++# define FIPS_F_FIPS_SELFTEST_DES                         111
++# define FIPS_F_FIPS_SELFTEST_DSA                         112
++# define FIPS_F_FIPS_SELFTEST_ECDSA                       133
++# define FIPS_F_FIPS_SELFTEST_HMAC                        113
++# define FIPS_F_FIPS_SELFTEST_SHA1                        115
++# define FIPS_F_FIPS_SELFTEST_SHA2                        105
++# define FIPS_F_OSSL_ECDSA_SIGN_SIG                       143
++# define FIPS_F_OSSL_ECDSA_VERIFY_SIG                     148
++# define FIPS_F_RSA_BUILTIN_KEYGEN                        116
++# define FIPS_F_RSA_OSSL_INIT                             149
++# define FIPS_F_RSA_OSSL_PRIVATE_DECRYPT                  117
++# define FIPS_F_RSA_OSSL_PRIVATE_ENCRYPT                  118
++# define FIPS_F_RSA_OSSL_PUBLIC_DECRYPT                   119
++# define FIPS_F_RSA_OSSL_PUBLIC_ENCRYPT                   120
++
++/* Reason codes. */
++# define FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED         150
++# define FIPS_R_ADDITIONAL_INPUT_TOO_LONG                 125
++# define FIPS_R_ALREADY_INSTANTIATED                      134
++# define FIPS_R_DRBG_NOT_INITIALISED                      152
++# define FIPS_R_DRBG_STUCK                                103
++# define FIPS_R_ENTROPY_ERROR_UNDETECTED                  104
++# define FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED          105
++# define FIPS_R_ENTROPY_SOURCE_STUCK                      142
++# define FIPS_R_ERROR_INITIALISING_DRBG                   115
++# define FIPS_R_ERROR_INSTANTIATING_DRBG                  127
++# define FIPS_R_ERROR_RETRIEVING_ADDITIONAL_INPUT         124
++# define FIPS_R_ERROR_RETRIEVING_ENTROPY                  122
++# define FIPS_R_ERROR_RETRIEVING_NONCE                    140
++# define FIPS_R_FINGERPRINT_DOES_NOT_MATCH                110
++# define FIPS_R_FIPS_MODE_ALREADY_SET                     102
++# define FIPS_R_FIPS_SELFTEST_FAILED                      106
++# define FIPS_R_FUNCTION_ERROR                            116
++# define FIPS_R_GENERATE_ERROR                            137
++# define FIPS_R_GENERATE_ERROR_UNDETECTED                 118
++# define FIPS_R_INSTANTIATE_ERROR                         119
++# define FIPS_R_INTERNAL_ERROR                            121
++# define FIPS_R_INVALID_KEY_LENGTH                        109
++# define FIPS_R_IN_ERROR_STATE                            123
++# define FIPS_R_KEY_TOO_SHORT                             108
++# define FIPS_R_NONCE_ERROR_UNDETECTED                    149
++# define FIPS_R_NON_FIPS_METHOD                           100
++# define FIPS_R_NOPR_TEST1_FAILURE                        145
++# define FIPS_R_NOPR_TEST2_FAILURE                        146
++# define FIPS_R_NOT_INSTANTIATED                          126
++# define FIPS_R_PAIRWISE_TEST_FAILED                      107
++# define FIPS_R_PERSONALISATION_ERROR_UNDETECTED          128
++# define FIPS_R_PERSONALISATION_STRING_TOO_LONG           129
++# define FIPS_R_PR_TEST1_FAILURE                          147
++# define FIPS_R_PR_TEST2_FAILURE                          148
++# define FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED           130
++# define FIPS_R_REQUEST_TOO_LARGE_FOR_DRBG                131
++# define FIPS_R_RESEED_COUNTER_ERROR                      132
++# define FIPS_R_RESEED_ERROR                              133
++# define FIPS_R_SELFTEST_FAILED                           101
++# define FIPS_R_SELFTEST_FAILURE                          135
++# define FIPS_R_TEST_FAILURE                              117
++# define FIPS_R_UNINSTANTIATE_ERROR                       141
++# define FIPS_R_UNINSTANTIATE_ZEROISE_ERROR               138
++# define FIPS_R_UNSUPPORTED_DRBG_TYPE                     139
++# define FIPS_R_UNSUPPORTED_PLATFORM                      113
++
++# ifdef  __cplusplus
++}
++# endif
++#endif
+diff -up openssl-1.1.1/include/openssl/fips_rand.h.fips openssl-1.1.1/include/openssl/fips_rand.h
+--- openssl-1.1.1/include/openssl/fips_rand.h.fips	2018-09-13 08:51:22.120520689 +0200
++++ openssl-1.1.1/include/openssl/fips_rand.h	2018-09-13 08:51:22.120520689 +0200
+@@ -0,0 +1,145 @@
++/* ====================================================================
++ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer. 
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++
++#ifndef HEADER_FIPS_RAND_H
++# define HEADER_FIPS_RAND_H
++
++# include <openssl/aes.h>
++# include <openssl/evp.h>
++# include <openssl/hmac.h>
++# include <openssl/rand.h>
++
++# ifdef OPENSSL_FIPS
++
++#  ifdef  __cplusplus
++extern "C" {
++#  endif
++    typedef struct drbg_ctx_st DRBG_CTX;
++/* DRBG external flags */
++/* Flag for CTR mode only: use derivation function ctr_df */
++#  define DRBG_FLAG_CTR_USE_DF            0x1
++/* PRNG is in test state */
++#  define DRBG_FLAG_TEST                  0x2
++
++    DRBG_CTX *FIPS_drbg_new(int type, unsigned int flags);
++    int FIPS_drbg_init(DRBG_CTX *dctx, int type, unsigned int flags);
++    int FIPS_drbg_instantiate(DRBG_CTX *dctx,
++                              const unsigned char *pers, size_t perslen);
++    int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin,
++                         size_t adinlen);
++    int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
++                           int prediction_resistance,
++                           const unsigned char *adin, size_t adinlen);
++
++    int FIPS_drbg_uninstantiate(DRBG_CTX *dctx);
++    void FIPS_drbg_free(DRBG_CTX *dctx);
++
++    int FIPS_drbg_set_callbacks(DRBG_CTX *dctx,
++                                size_t (*get_entropy) (DRBG_CTX *ctx,
++                                                       unsigned char **pout,
++                                                       int entropy,
++                                                       size_t min_len,
++                                                       size_t max_len),
++                                void (*cleanup_entropy) (DRBG_CTX *ctx,
++                                                         unsigned char *out,
++                                                         size_t olen),
++                                size_t entropy_blocklen,
++                                size_t (*get_nonce) (DRBG_CTX *ctx,
++                                                     unsigned char **pout,
++                                                     int entropy,
++                                                     size_t min_len,
++                                                     size_t max_len),
++                                void (*cleanup_nonce) (DRBG_CTX *ctx,
++                                                       unsigned char *out,
++                                                       size_t olen));
++
++    int FIPS_drbg_set_rand_callbacks(DRBG_CTX *dctx,
++                                     size_t (*get_adin) (DRBG_CTX *ctx,
++                                                         unsigned char
++                                                         **pout),
++                                     void (*cleanup_adin) (DRBG_CTX *ctx,
++                                                           unsigned char *out,
++                                                           size_t olen),
++                                     int (*rand_seed_cb) (DRBG_CTX *ctx,
++                                                          const void *buf,
++                                                          int num),
++                                     int (*rand_add_cb) (DRBG_CTX *ctx,
++                                                         const void *buf,
++                                                         int num,
++                                                         double entropy));
++
++    void *FIPS_drbg_get_app_data(DRBG_CTX *ctx);
++    void FIPS_drbg_set_app_data(DRBG_CTX *ctx, void *app_data);
++    size_t FIPS_drbg_get_blocklength(DRBG_CTX *dctx);
++    int FIPS_drbg_get_strength(DRBG_CTX *dctx);
++    void FIPS_drbg_set_check_interval(DRBG_CTX *dctx, int interval);
++    void FIPS_drbg_set_reseed_interval(DRBG_CTX *dctx, int interval);
++
++    int FIPS_drbg_health_check(DRBG_CTX *dctx);
++
++    DRBG_CTX *FIPS_get_default_drbg(void);
++    const RAND_METHOD *FIPS_drbg_method(void);
++
++    int FIPS_rand_set_method(const RAND_METHOD *meth);
++    const RAND_METHOD *FIPS_rand_get_method(void);
++
++    void FIPS_rand_set_bits(int nbits);
++
++    int FIPS_rand_strength(void);
++
++/* 1.0.0 compat functions */
++    int FIPS_rand_seed(const void *buf, int num);
++    int FIPS_rand_bytes(unsigned char *out, int outlen);
++    void FIPS_rand_reset(void);
++    int FIPS_rand_status(void);
++#  ifdef  __cplusplus
++}
++#  endif
++# endif
++#endif
+diff -up openssl-1.1.1/include/openssl/opensslconf.h.in.fips openssl-1.1.1/include/openssl/opensslconf.h.in
+--- openssl-1.1.1/include/openssl/opensslconf.h.in.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/opensslconf.h.in	2018-09-13 08:51:22.120520689 +0200
+@@ -150,6 +150,11 @@ extern "C" {
+ 
+ #define RC4_INT {- $config{rc4_int} -}
+ 
++/* Always build FIPS module */
++#ifndef OPENSSL_FIPS
++# define OPENSSL_FIPS
++#endif
++
+ #ifdef  __cplusplus
+ }
+ #endif
+diff -up openssl-1.1.1/include/openssl/randerr.h.fips openssl-1.1.1/include/openssl/randerr.h
+--- openssl-1.1.1/include/openssl/randerr.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/randerr.h	2018-09-13 08:51:22.120520689 +0200
+@@ -35,6 +35,7 @@ int ERR_load_RAND_strings(void);
+ # define RAND_F_RAND_DRBG_SET                             104
+ # define RAND_F_RAND_DRBG_SET_DEFAULTS                    121
+ # define RAND_F_RAND_DRBG_UNINSTANTIATE                   118
++# define RAND_F_RAND_INIT_FIPS                            200
+ # define RAND_F_RAND_LOAD_FILE                            111
+ # define RAND_F_RAND_POOL_ACQUIRE_ENTROPY                 122
+ # define RAND_F_RAND_POOL_ADD                             103
+diff -up openssl-1.1.1/include/openssl/rand.h.fips openssl-1.1.1/include/openssl/rand.h
+--- openssl-1.1.1/include/openssl/rand.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/rand.h	2018-09-13 08:51:22.120520689 +0200
+@@ -69,6 +69,11 @@ DEPRECATEDIN_1_1_0(void RAND_screen(void
+ DEPRECATEDIN_1_1_0(int RAND_event(UINT, WPARAM, LPARAM))
+ # endif
+ 
++# ifdef OPENSSL_FIPS
++/* just stubs for API compatibility */
++void RAND_set_fips_drbg_type(int type, int flags);
++int RAND_init_fips(void);
++# endif
+ 
+ #ifdef  __cplusplus
+ }
+diff -up openssl-1.1.1/include/openssl/rsaerr.h.fips openssl-1.1.1/include/openssl/rsaerr.h
+--- openssl-1.1.1/include/openssl/rsaerr.h.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/openssl/rsaerr.h	2018-09-13 08:51:22.121520666 +0200
+@@ -21,6 +21,7 @@ int ERR_load_RSA_strings(void);
+  */
+ # define RSA_F_CHECK_PADDING_MD                           140
+ # define RSA_F_ENCODE_PKCS1                               146
++# define RSA_F_FIPS_RSA_BUILTIN_KEYGEN                    206
+ # define RSA_F_INT_RSA_VERIFY                             145
+ # define RSA_F_OLD_RSA_PRIV_DECODE                        147
+ # define RSA_F_PKEY_PSS_INIT                              165
+@@ -35,6 +36,8 @@ int ERR_load_RSA_strings(void);
+ # define RSA_F_RSA_CHECK_KEY_EX                           160
+ # define RSA_F_RSA_CMS_DECRYPT                            159
+ # define RSA_F_RSA_CMS_VERIFY                             158
++# define RSA_F_RSA_GENERATE_KEY_EX                        204
++# define RSA_F_RSA_GENERATE_MULTI_PRIME_KEY               207
+ # define RSA_F_RSA_ITEM_VERIFY                            148
+ # define RSA_F_RSA_METH_DUP                               161
+ # define RSA_F_RSA_METH_NEW                               162
+@@ -72,10 +75,16 @@ int ERR_load_RSA_strings(void);
+ # define RSA_F_RSA_PRINT_FP                               116
+ # define RSA_F_RSA_PRIV_DECODE                            150
+ # define RSA_F_RSA_PRIV_ENCODE                            138
++# define RSA_F_RSA_PRIVATE_DECRYPT                        200
++# define RSA_F_RSA_PRIVATE_ENCRYPT                        201
+ # define RSA_F_RSA_PSS_GET_PARAM                          151
+ # define RSA_F_RSA_PSS_TO_CTX                             155
+ # define RSA_F_RSA_PUB_DECODE                             139
++# define RSA_F_RSA_PUBLIC_DECRYPT                         202
++# define RSA_F_RSA_PUBLIC_ENCRYPT                         203
+ # define RSA_F_RSA_SETUP_BLINDING                         136
++# define RSA_F_RSA_SET_DEFAULT_METHOD                     205
++# define RSA_F_RSA_SET_METHOD                             204
+ # define RSA_F_RSA_SIGN                                   117
+ # define RSA_F_RSA_SIGN_ASN1_OCTET_STRING                 118
+ # define RSA_F_RSA_VERIFY                                 119
+@@ -132,10 +141,12 @@ int ERR_load_RSA_strings(void);
+ # define RSA_R_MP_EXPONENT_NOT_CONGRUENT_TO_D             169
+ # define RSA_R_MP_R_NOT_PRIME                             170
+ # define RSA_R_NO_PUBLIC_EXPONENT                         140
++# define RSA_R_NON_FIPS_RSA_METHOD                        200
+ # define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
+ # define RSA_R_N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES         172
+ # define RSA_R_N_DOES_NOT_EQUAL_P_Q                       127
+ # define RSA_R_OAEP_DECODING_ERROR                        121
++# define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE         201
+ # define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE   148
+ # define RSA_R_PADDING_CHECK_FAILED                       114
+ # define RSA_R_PKCS_DECODING_ERROR                        159
+@@ -155,6 +166,7 @@ int ERR_load_RSA_strings(void);
+ # define RSA_R_UNSUPPORTED_LABEL_SOURCE                   163
+ # define RSA_R_UNSUPPORTED_MASK_ALGORITHM                 153
+ # define RSA_R_UNSUPPORTED_MASK_PARAMETER                 154
++# define RSA_R_UNSUPPORTED_PARAMETERS                     202
+ # define RSA_R_UNSUPPORTED_SIGNATURE_TYPE                 155
+ # define RSA_R_VALUE_MISSING                              147
+ # define RSA_R_WRONG_SIGNATURE_LENGTH                     119
+diff -up openssl-1.1.1/ssl/ssl_ciph.c.fips openssl-1.1.1/ssl/ssl_ciph.c
+--- openssl-1.1.1/ssl/ssl_ciph.c.fips	2018-09-13 08:51:22.098521203 +0200
++++ openssl-1.1.1/ssl/ssl_ciph.c	2018-09-13 08:51:22.121520666 +0200
+@@ -385,7 +385,7 @@ int ssl_load_ciphers(void)
+         }
+     }
+     /* Make sure we can access MD5 and SHA1 */
+-    if (!ossl_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL))
++    if (!FIPS_mode() && !ossl_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL))
+         return 0;
+     if (!ossl_assert(ssl_digest_methods[SSL_MD_SHA1_IDX] != NULL))
+         return 0;
+@@ -557,6 +557,9 @@ int ssl_cipher_get_evp(const SSL_SESSION
+             s->ssl_version < TLS1_VERSION)
+             return 1;
+ 
++        if (FIPS_mode())
++            return 1;
++
+         if (c->algorithm_enc == SSL_RC4 &&
+             c->algorithm_mac == SSL_MD5 &&
+             (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))
+@@ -665,6 +668,8 @@ static void ssl_cipher_collect_ciphers(c
+         /* drop those that use any of that is not available */
+         if (c == NULL || !c->valid)
+             continue;
++        if (FIPS_mode() && !(c->algo_strength & SSL_FIPS))
++            continue;
+         if ((c->algorithm_mkey & disabled_mkey) ||
+             (c->algorithm_auth & disabled_auth) ||
+             (c->algorithm_enc & disabled_enc) ||
+@@ -1668,7 +1673,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+      * to the resulting precedence to the STACK_OF(SSL_CIPHER).
+      */
+     for (curr = head; curr != NULL; curr = curr->next) {
+-        if (curr->active) {
++        if (curr->active
++            && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS)) {
+             if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {
+                 OPENSSL_free(co_list);
+                 sk_SSL_CIPHER_free(cipherstack);
+diff -up openssl-1.1.1/ssl/ssl_init.c.fips openssl-1.1.1/ssl/ssl_init.c
+--- openssl-1.1.1/ssl/ssl_init.c.fips	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/ssl/ssl_init.c	2018-09-13 08:51:22.121520666 +0200
+@@ -27,6 +27,10 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_ssl_bas
+     fprintf(stderr, "OPENSSL_INIT: ossl_init_ssl_base: "
+             "Adding SSL ciphers and digests\n");
+ #endif
++#ifdef OPENSSL_FIPS
++    if (!FIPS_mode()) {
++#endif
++
+ #ifndef OPENSSL_NO_DES
+     EVP_add_cipher(EVP_des_cbc());
+     EVP_add_cipher(EVP_des_ede3_cbc());
+@@ -87,6 +91,31 @@ DEFINE_RUN_ONCE_STATIC(ossl_init_ssl_bas
+     EVP_add_digest(EVP_sha256());
+     EVP_add_digest(EVP_sha384());
+     EVP_add_digest(EVP_sha512());
++#ifdef OPENSSL_FIPS
++    } else {
++# ifndef OPENSSL_NO_DES
++        EVP_add_cipher(EVP_des_ede3_cbc());
++# endif
++        EVP_add_cipher(EVP_aes_128_cbc());
++        EVP_add_cipher(EVP_aes_192_cbc());
++        EVP_add_cipher(EVP_aes_256_cbc());
++        EVP_add_cipher(EVP_aes_128_gcm());
++        EVP_add_cipher(EVP_aes_256_gcm());
++        EVP_add_cipher(EVP_aes_128_ccm());
++        EVP_add_cipher(EVP_aes_256_ccm());
++# ifndef OPENSSL_NO_MD5
++        /* needed even in the FIPS mode for TLS-1.0 */
++        EVP_add_digest(EVP_md5_sha1());
++# endif
++        EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
++        EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
++        EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
++        EVP_add_digest(EVP_sha224());
++        EVP_add_digest(EVP_sha256());
++        EVP_add_digest(EVP_sha384());
++        EVP_add_digest(EVP_sha512());
++    }
++#endif
+ #ifndef OPENSSL_NO_COMP
+ # ifdef OPENSSL_INIT_DEBUG
+     fprintf(stderr, "OPENSSL_INIT: ossl_init_ssl_base: "
+diff -up openssl-1.1.1/ssl/ssl_lib.c.fips openssl-1.1.1/ssl/ssl_lib.c
+--- openssl-1.1.1/ssl/ssl_lib.c.fips	2018-09-13 08:51:22.099521180 +0200
++++ openssl-1.1.1/ssl/ssl_lib.c	2018-09-13 08:51:22.122520643 +0200
+@@ -2883,6 +2883,11 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
+     if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
+         return NULL;
+ 
++    if (FIPS_mode() && (meth->version < TLS1_VERSION)) {
++        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE);
++        return NULL;
++    }
++
+     if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
+         SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
+         goto err;
+@@ -2939,13 +2944,17 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
+     if (ret->param == NULL)
+         goto err;
+ 
+-    if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
+-        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
+-        goto err2;
+-    }
+-    if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
+-        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
+-        goto err2;
++    if (!FIPS_mode()) {
++        if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
++            SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
++            goto err2;
++        }
++        if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
++            SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
++            goto err2;
++        }
++    } else {
++        ret->min_proto_version = TLS1_VERSION;
+     }
+ 
+     if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
+diff -up openssl-1.1.1/test/dsatest.c.fips openssl-1.1.1/test/dsatest.c
+--- openssl-1.1.1/test/dsatest.c.fips	2018-09-11 14:48:24.000000000 +0200
++++ openssl-1.1.1/test/dsatest.c	2018-09-13 08:51:22.122520643 +0200
+@@ -24,41 +24,42 @@
+ #ifndef OPENSSL_NO_DSA
+ static int dsa_cb(int p, int n, BN_GENCB *arg);
+ 
+-/*
+- * seed, out_p, out_q, out_g are taken from the updated Appendix 5 to FIPS
+- * PUB 186 and also appear in Appendix 5 to FIPS PIB 186-1
+- */
+ static unsigned char seed[20] = {
+-    0xd5, 0x01, 0x4e, 0x4b, 0x60, 0xef, 0x2b, 0xa8, 0xb6, 0x21, 0x1b, 0x40,
+-    0x62, 0xba, 0x32, 0x24, 0xe0, 0x42, 0x7d, 0xd3,
++    0x02, 0x47, 0x11, 0x92, 0x11, 0x88, 0xC8, 0xFB, 0xAF, 0x48, 0x4C, 0x62,
++    0xDF, 0xA5, 0xBE, 0xA0, 0xA4, 0x3C, 0x56, 0xE3,
+ };
+ 
+ static unsigned char out_p[] = {
+-    0x8d, 0xf2, 0xa4, 0x94, 0x49, 0x22, 0x76, 0xaa,
+-    0x3d, 0x25, 0x75, 0x9b, 0xb0, 0x68, 0x69, 0xcb,
+-    0xea, 0xc0, 0xd8, 0x3a, 0xfb, 0x8d, 0x0c, 0xf7,
+-    0xcb, 0xb8, 0x32, 0x4f, 0x0d, 0x78, 0x82, 0xe5,
+-    0xd0, 0x76, 0x2f, 0xc5, 0xb7, 0x21, 0x0e, 0xaf,
+-    0xc2, 0xe9, 0xad, 0xac, 0x32, 0xab, 0x7a, 0xac,
+-    0x49, 0x69, 0x3d, 0xfb, 0xf8, 0x37, 0x24, 0xc2,
+-    0xec, 0x07, 0x36, 0xee, 0x31, 0xc8, 0x02, 0x91,
++    0xAC, 0xCB, 0x1E, 0x63, 0x60, 0x69, 0x0C, 0xFB, 0x06, 0x19, 0x68, 0x3E,
++    0xA5, 0x01, 0x5A, 0xA2, 0x15, 0x5C, 0xE2, 0x99, 0x2D, 0xD5, 0x30, 0x99,
++    0x7E, 0x5F, 0x8D, 0xE2, 0xF7, 0xC6, 0x2E, 0x8D, 0xA3, 0x9F, 0x58, 0xAD,
++    0xD6, 0xA9, 0x7D, 0x0E, 0x0D, 0x95, 0x53, 0xA6, 0x71, 0x3A, 0xDE, 0xAB,
++    0xAC, 0xE9, 0xF4, 0x36, 0x55, 0x9E, 0xB9, 0xD6, 0x93, 0xBF, 0xF3, 0x18,
++    0x1C, 0x14, 0x7B, 0xA5, 0x42, 0x2E, 0xCD, 0x00, 0xEB, 0x35, 0x3B, 0x1B,
++    0xA8, 0x51, 0xBB, 0xE1, 0x58, 0x42, 0x85, 0x84, 0x22, 0xA7, 0x97, 0x5E,
++    0x99, 0x6F, 0x38, 0x20, 0xBD, 0x9D, 0xB6, 0xD9, 0x33, 0x37, 0x2A, 0xFD,
++    0xBB, 0xD4, 0xBC, 0x0C, 0x2A, 0x67, 0xCB, 0x9F, 0xBB, 0xDF, 0xF9, 0x93,
++    0xAA, 0xD6, 0xF0, 0xD6, 0x95, 0x0B, 0x5D, 0x65, 0x14, 0xD0, 0x18, 0x9D,
++    0xC6, 0xAF, 0xF0, 0xC6, 0x37, 0x7C, 0xF3, 0x5F,
+ };
+ 
+ static unsigned char out_q[] = {
+-    0xc7, 0x73, 0x21, 0x8c, 0x73, 0x7e, 0xc8, 0xee,
+-    0x99, 0x3b, 0x4f, 0x2d, 0xed, 0x30, 0xf4, 0x8e,
+-    0xda, 0xce, 0x91, 0x5f,
++    0xE3, 0x8E, 0x5E, 0x6D, 0xBF, 0x2B, 0x79, 0xF8, 0xC5, 0x4B, 0x89, 0x8B,
++    0xBA, 0x2D, 0x91, 0xC3, 0x6C, 0x80, 0xAC, 0x87,
+ };
+ 
+ static unsigned char out_g[] = {
+-    0x62, 0x6d, 0x02, 0x78, 0x39, 0xea, 0x0a, 0x13,
+-    0x41, 0x31, 0x63, 0xa5, 0x5b, 0x4c, 0xb5, 0x00,
+-    0x29, 0x9d, 0x55, 0x22, 0x95, 0x6c, 0xef, 0xcb,
+-    0x3b, 0xff, 0x10, 0xf3, 0x99, 0xce, 0x2c, 0x2e,
+-    0x71, 0xcb, 0x9d, 0xe5, 0xfa, 0x24, 0xba, 0xbf,
+-    0x58, 0xe5, 0xb7, 0x95, 0x21, 0x92, 0x5c, 0x9c,
+-    0xc4, 0x2e, 0x9f, 0x6f, 0x46, 0x4b, 0x08, 0x8c,
+-    0xc5, 0x72, 0xaf, 0x53, 0xe6, 0xd7, 0x88, 0x02,
++    0x42, 0x4A, 0x04, 0x4E, 0x79, 0xB4, 0x99, 0x7F, 0xFD, 0x58, 0x36, 0x2C,
++    0x1B, 0x5F, 0x18, 0x7E, 0x0D, 0xCC, 0xAB, 0x81, 0xC9, 0x5D, 0x10, 0xCE,
++    0x4E, 0x80, 0x7E, 0x58, 0xB4, 0x34, 0x3F, 0xA7, 0x45, 0xC7, 0xAA, 0x36,
++    0x24, 0x42, 0xA9, 0x3B, 0xE8, 0x0E, 0x04, 0x02, 0x2D, 0xFB, 0xA6, 0x13,
++    0xB9, 0xB5, 0x15, 0xA5, 0x56, 0x07, 0x35, 0xE4, 0x03, 0xB6, 0x79, 0x7C,
++    0x62, 0xDD, 0xDF, 0x3F, 0x71, 0x3A, 0x9D, 0x8B, 0xC4, 0xF6, 0xE7, 0x1D,
++    0x52, 0xA8, 0xA9, 0x43, 0x1D, 0x33, 0x51, 0x88, 0x39, 0xBD, 0x73, 0xE9,
++    0x5F, 0xBE, 0x82, 0x49, 0x27, 0xE6, 0xB5, 0x53, 0xC1, 0x38, 0xAC, 0x2F,
++    0x6D, 0x97, 0x6C, 0xEB, 0x67, 0xC1, 0x5F, 0x67, 0xF8, 0x35, 0x05, 0x5E,
++    0xD5, 0x68, 0x80, 0xAA, 0x96, 0xCA, 0x0B, 0x8A, 0xE6, 0xF1, 0xB1, 0x41,
++    0xC6, 0x75, 0x94, 0x0A, 0x0A, 0x2A, 0xFA, 0x29,
+ };
+ 
+ static const unsigned char str1[] = "12345678901234567890";
+@@ -79,11 +80,11 @@ static int dsa_test(void)
+ 
+     BN_GENCB_set(cb, dsa_cb, NULL);
+     if (!TEST_ptr(dsa = DSA_new())
+-        || !TEST_true(DSA_generate_parameters_ex(dsa, 512, seed, 20,
++        || !TEST_true(DSA_generate_parameters_ex(dsa, 1024, seed, 20,
+                                                 &counter, &h, cb)))
+         goto end;
+ 
+-    if (!TEST_int_eq(counter, 105))
++    if (!TEST_int_eq(counter, 239))
+         goto end;
+     if (!TEST_int_eq(h, 2))
+         goto end;
+diff -up openssl-1.1.1/util/libcrypto.num.fips openssl-1.1.1/util/libcrypto.num
+--- openssl-1.1.1/util/libcrypto.num.fips	2018-09-13 08:51:22.123520619 +0200
++++ openssl-1.1.1/util/libcrypto.num	2018-09-13 08:53:01.879190825 +0200
+@@ -4577,3 +4577,38 @@ OCSP_resp_get0_respdata
+ EVP_MD_CTX_set_pkey_ctx                 4531	1_1_1	EXIST::FUNCTION:
+ EVP_PKEY_meth_set_digest_custom         4532	1_1_1	EXIST::FUNCTION:
+ EVP_PKEY_meth_get_digest_custom         4533	1_1_1	EXIST::FUNCTION:
++FIPS_drbg_reseed                        6348	1_1_0g	EXIST::FUNCTION:
++FIPS_selftest_check                     6349	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_set_method                    6350	1_1_0g	EXIST::FUNCTION:
++FIPS_get_default_drbg                   6351	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_set_reseed_interval           6352	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_set_app_data                  6353	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_method                        6354	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_status                        6355	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_instantiate                   6356	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_set_callbacks                 6357	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_new                           6358	1_1_0g	EXIST::FUNCTION:
++FIPS_dsa_paramgen_check_g               6359	1_1_0g	EXIST::FUNCTION:
++FIPS_selftest                           6360	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_set_bits                      6361	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_bytes                         6362	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_get_app_data                  6363	1_1_0g	EXIST::FUNCTION:
++FIPS_selftest_failed                    6364	1_1_0g	EXIST::FUNCTION:
++FIPS_dsa_builtin_paramgen2              6365	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_reset                         6366	1_1_0g	EXIST::FUNCTION:
++ERR_load_FIPS_strings                   6367	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_generate                      6368	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_uninstantiate                 6369	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_set_check_interval            6370	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_free                          6371	1_1_0g	EXIST::FUNCTION:
++FIPS_selftest_drbg_all                  6372	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_get_method                    6373	1_1_0g	EXIST::FUNCTION:
++RAND_set_fips_drbg_type                 6374	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_health_check                  6375	1_1_0g	EXIST::FUNCTION:
++RAND_init_fips                          6376	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_set_rand_callbacks            6377	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_seed                          6378	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_get_strength                  6379	1_1_0g	EXIST::FUNCTION:
++FIPS_rand_strength                      6380	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_get_blocklength               6381	1_1_0g	EXIST::FUNCTION:
++FIPS_drbg_init                          6382	1_1_0g	EXIST::FUNCTION:
diff --git a/SOURCES/openssl-1.1.1-ignore-bound.patch b/SOURCES/openssl-1.1.1-ignore-bound.patch
new file mode 100644
index 0000000..4838f3d
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-ignore-bound.patch
@@ -0,0 +1,14 @@
+Do not return failure when setting version bound on fixed protocol
+version method.
+diff -up openssl-1.1.1-pre8/ssl/statem/statem_lib.c.ignore-bound openssl-1.1.1-pre8/ssl/statem/statem_lib.c
+--- openssl-1.1.1-pre8/ssl/statem/statem_lib.c.ignore-bound	2018-06-20 16:48:13.000000000 +0200
++++ openssl-1.1.1-pre8/ssl/statem/statem_lib.c	2018-08-13 11:07:52.826304045 +0200
+@@ -1595,7 +1595,7 @@ int ssl_set_version_bound(int method_ver
+          * methods are not subject to controls that disable individual protocol
+          * versions.
+          */
+-        return 0;
++        return 1;
+ 
+     case TLS_ANY_VERSION:
+         if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
diff --git a/SOURCES/openssl-1.1.1-man-rename.patch b/SOURCES/openssl-1.1.1-man-rename.patch
new file mode 100644
index 0000000..4e504b4
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-man-rename.patch
@@ -0,0 +1,19 @@
+diff -up openssl-1.1.1-pre9/doc/man1/openssl.pod.man-rename openssl-1.1.1-pre9/doc/man1/openssl.pod
+--- openssl-1.1.1-pre9/doc/man1/openssl.pod.man-rename	2018-08-21 14:14:13.000000000 +0200
++++ openssl-1.1.1-pre9/doc/man1/openssl.pod	2018-08-22 12:13:04.092568064 +0200
+@@ -482,13 +482,13 @@ L<dhparam(1)>, L<dsa(1)>, L<dsaparam(1)>
+ L<ec(1)>, L<ecparam(1)>,
+ L<enc(1)>, L<engine(1)>, L<errstr(1)>, L<gendsa(1)>, L<genpkey(1)>,
+ L<genrsa(1)>, L<nseq(1)>, L<ocsp(1)>,
+-L<passwd(1)>,
+ L<pkcs12(1)>, L<pkcs7(1)>, L<pkcs8(1)>,
+ L<pkey(1)>, L<pkeyparam(1)>, L<pkeyutl(1)>, L<prime(1)>,
+-L<rand(1)>, L<rehash(1)>, L<req(1)>, L<rsa(1)>,
++L<rehash(1)>, L<req(1)>, L<rsa(1)>,
+ L<rsautl(1)>, L<s_client(1)>,
+ L<s_server(1)>, L<s_time(1)>, L<sess_id(1)>,
+ L<smime(1)>, L<speed(1)>, L<spkac(1)>, L<srp(1)>, L<storeutl(1)>,
++L<sslpasswd(1)>, L<sslrand(1)>,
+ L<ts(1)>,
+ L<verify(1)>, L<version(1)>, L<x509(1)>,
+ L<crypto(7)>, L<ssl(7)>, L<x509v3_config(5)>
diff --git a/SOURCES/openssl-1.1.1-seclevel.patch b/SOURCES/openssl-1.1.1-seclevel.patch
new file mode 100644
index 0000000..5f640a4
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-seclevel.patch
@@ -0,0 +1,246 @@
+diff -up openssl-1.1.1/crypto/x509/x509_vfy.c.seclevel openssl-1.1.1/crypto/x509/x509_vfy.c
+--- openssl-1.1.1/crypto/x509/x509_vfy.c.seclevel	2018-09-11 14:48:22.000000000 +0200
++++ openssl-1.1.1/crypto/x509/x509_vfy.c	2018-10-01 14:34:43.083145020 +0200
+@@ -3220,6 +3220,7 @@ static int build_chain(X509_STORE_CTX *c
+ }
+ 
+ static const int minbits_table[] = { 80, 112, 128, 192, 256 };
++static const int minbits_digest_table[] = { 80, 80, 128, 192, 256 };
+ static const int NUM_AUTH_LEVELS = OSSL_NELEM(minbits_table);
+ 
+ /*
+@@ -3264,6 +3265,8 @@ static int check_sig_level(X509_STORE_CT
+ 
+     if (!X509_get_signature_info(cert, NULL, NULL, &secbits, NULL))
+         return 0;
+-
+-    return secbits >= minbits_table[level - 1];
++    /* Allow SHA1 in SECLEVEL 2 in non-FIPS mode */
++    if (FIPS_mode())
++        return secbits >= minbits_table[level - 1];
++    return secbits >= minbits_digest_table[level - 1];
+ }
+diff -up openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod.seclevel openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod
+--- openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod.seclevel	2018-09-11 14:48:22.000000000 +0200
++++ openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod	2018-10-01 14:34:43.083145020 +0200
+@@ -81,8 +81,10 @@ using MD5 for the MAC is also prohibited
+ 
+ =item B<Level 2>
+ 
+-Security level set to 112 bits of security. As a result RSA, DSA and DH keys
+-shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited.
++Security level set to 112 bits of security with the exception of SHA1 allowed
++for signatures.
++As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys
++shorter than 224 bits are prohibited.
+ In addition to the level 1 exclusions any cipher suite using RC4 is also
+ prohibited. SSL version 3 is also not allowed. Compression is disabled.
+ 
+diff -up openssl-1.1.1/ssl/ssl_cert.c.seclevel openssl-1.1.1/ssl/ssl_cert.c
+--- openssl-1.1.1/ssl/ssl_cert.c.seclevel	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/ssl/ssl_cert.c	2018-10-12 14:22:38.561931080 +0200
+@@ -951,8 +951,8 @@ static int ssl_security_default_callback
+             if (level >= 2 && c->algorithm_enc == SSL_RC4)
+                 return 0;
+             /* Level 3: forward secure ciphersuites only */
+-            if (level >= 3 && (c->min_tls != TLS1_3_VERSION ||
+-                               !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH))))
++            if (level >= 3 && c->min_tls != TLS1_3_VERSION &&
++                               !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH)))
+                 return 0;
+             break;
+         }
+@@ -983,6 +983,9 @@ static int ssl_security_default_callback
+             return 0;
+         break;
+     default:
++        /* allow SHA1 in SECLEVEL 2 in non FIPS mode */
++        if (nid == NID_sha1 && minbits == 112 && !FIPS_mode())
++            break;
+         if (bits < minbits)
+             return 0;
+     }
+diff -up openssl-1.1.1/test/recipes/25-test_verify.t.seclevel openssl-1.1.1/test/recipes/25-test_verify.t
+--- openssl-1.1.1/test/recipes/25-test_verify.t.seclevel	2018-09-11 14:48:24.000000000 +0200
++++ openssl-1.1.1/test/recipes/25-test_verify.t	2018-10-01 14:34:43.084145044 +0200
+@@ -342,8 +342,8 @@ ok(verify("ee-pss-sha1-cert", "sslserver
+ ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+     "CA with PSS signature using SHA256");
+ 
+-ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+-    "Reject PSS signature using SHA1 and auth level 2");
++ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
++    "Reject PSS signature using SHA1 and auth level 3");
+ 
+ ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+     "PSS signature using SHA256 and auth level 2");
+diff -up openssl-1.1.1/test/recipes/80-test_ssl_new.t.seclevel openssl-1.1.1/test/recipes/80-test_ssl_new.t
+--- openssl-1.1.1/test/recipes/80-test_ssl_new.t.seclevel	2018-09-11 14:48:25.000000000 +0200
++++ openssl-1.1.1/test/recipes/80-test_ssl_new.t	2018-10-15 10:45:16.178992425 +0200
+@@ -28,7 +28,7 @@ map { s/\^// } @conf_files if $^O eq "VM
+ 
+ # We hard-code the number of tests to double-check that the globbing above
+ # finds all files as expected.
+-plan tests => 27;  # = scalar @conf_srcs
++plan tests => 28;  # = scalar @conf_srcs
+ 
+ # Some test results depend on the configuration of enabled protocols. We only
+ # verify generated sources in the default configuration.
+diff -up openssl-1.1.1/test/ssl-tests/28-seclevel.conf.in.seclevel openssl-1.1.1/test/ssl-tests/28-seclevel.conf.in
+--- openssl-1.1.1/test/ssl-tests/28-seclevel.conf.in.seclevel	2018-10-15 10:44:02.119198865 +0200
++++ openssl-1.1.1/test/ssl-tests/28-seclevel.conf.in	2018-10-15 10:34:37.014517257 +0200
+@@ -0,0 +1,48 @@
++# -*- mode: perl; -*-
++# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
++#
++# Licensed under the OpenSSL license (the "License").  You may not use
++# this file except in compliance with the License.  You can obtain a copy
++# in the file LICENSE in the source distribution or at
++# https://www.openssl.org/source/license.html
++
++
++## SSL test configurations
++
++package ssltests;
++
++our @tests = (
++    {
++        name => "SECLEVEL 3 with default key",
++        server => { "CipherString" => "DEFAULT:\@SECLEVEL=3" },
++        client => { },
++        test   => { "ExpectedResult" => "ServerFail" },
++    },
++    {
++        name => "SECLEVEL 3 with ED448 key",
++        server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
++                    "Certificate" => test_pem("server-ed448-cert.pem"),
++                    "PrivateKey" => test_pem("server-ed448-key.pem") },
++        client => { },
++        test   => { "ExpectedResult" => "Success" },
++    },
++    {
++        name => "SECLEVEL 3 with ED448 key, TLSv1.2",
++        server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
++                    "Certificate" => test_pem("server-ed448-cert.pem"),
++                    "PrivateKey" => test_pem("server-ed448-key.pem"),
++                    "MaxProtocol" => "TLSv1.2" },
++        client => { },
++        test   => { "ExpectedResult" => "Success" },
++    },
++    {
++        name => "SECLEVEL 3 with P-384 key, X25519 ECDHE",
++        server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
++                    "Certificate" => test_pem("p384-server-cert.pem"),
++                    "PrivateKey" => test_pem("p384-server-key.pem"),
++                    "Groups" => "X25519" },
++        client => { "CipherString" => "ECDHE:\@SECLEVEL=3",
++                    "VerifyCAFile" => test_pem("p384-root.pem") },
++        test   => { "ExpectedResult" => "Success" },
++    },
++);
+diff -up openssl-1.1.1/test/ssl-tests/28-seclevel.conf.seclevel openssl-1.1.1/test/ssl-tests/28-seclevel.conf
+--- openssl-1.1.1/test/ssl-tests/28-seclevel.conf.seclevel	2018-10-15 10:43:53.424988302 +0200
++++ openssl-1.1.1/test/ssl-tests/28-seclevel.conf	2018-10-15 10:34:46.350742591 +0200
+@@ -0,0 +1,102 @@
++# Generated with generate_ssl_tests.pl
++
++num_tests = 4
++
++test-0 = 0-SECLEVEL 3 with default key
++test-1 = 1-SECLEVEL 3 with ED448 key
++test-2 = 2-SECLEVEL 3 with ED448 key, TLSv1.2
++test-3 = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE
++# ===========================================================
++
++[0-SECLEVEL 3 with default key]
++ssl_conf = 0-SECLEVEL 3 with default key-ssl
++
++[0-SECLEVEL 3 with default key-ssl]
++server = 0-SECLEVEL 3 with default key-server
++client = 0-SECLEVEL 3 with default key-client
++
++[0-SECLEVEL 3 with default key-server]
++Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
++CipherString = DEFAULT:@SECLEVEL=3
++PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
++
++[0-SECLEVEL 3 with default key-client]
++CipherString = DEFAULT
++VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
++VerifyMode = Peer
++
++[test-0]
++ExpectedResult = ServerFail
++
++
++# ===========================================================
++
++[1-SECLEVEL 3 with ED448 key]
++ssl_conf = 1-SECLEVEL 3 with ED448 key-ssl
++
++[1-SECLEVEL 3 with ED448 key-ssl]
++server = 1-SECLEVEL 3 with ED448 key-server
++client = 1-SECLEVEL 3 with ED448 key-client
++
++[1-SECLEVEL 3 with ED448 key-server]
++Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
++CipherString = DEFAULT:@SECLEVEL=3
++PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
++
++[1-SECLEVEL 3 with ED448 key-client]
++CipherString = DEFAULT
++VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
++VerifyMode = Peer
++
++[test-1]
++ExpectedResult = Success
++
++
++# ===========================================================
++
++[2-SECLEVEL 3 with ED448 key, TLSv1.2]
++ssl_conf = 2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl
++
++[2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl]
++server = 2-SECLEVEL 3 with ED448 key, TLSv1.2-server
++client = 2-SECLEVEL 3 with ED448 key, TLSv1.2-client
++
++[2-SECLEVEL 3 with ED448 key, TLSv1.2-server]
++Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
++CipherString = DEFAULT:@SECLEVEL=3
++MaxProtocol = TLSv1.2
++PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
++
++[2-SECLEVEL 3 with ED448 key, TLSv1.2-client]
++CipherString = DEFAULT
++VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
++VerifyMode = Peer
++
++[test-2]
++ExpectedResult = Success
++
++
++# ===========================================================
++
++[3-SECLEVEL 3 with P-384 key, X25519 ECDHE]
++ssl_conf = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl
++
++[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl]
++server = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server
++client = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client
++
++[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server]
++Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
++CipherString = DEFAULT:@SECLEVEL=3
++Groups = X25519
++PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
++
++[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client]
++CipherString = ECDHE:@SECLEVEL=3
++VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
++VerifyMode = Peer
++
++[test-3]
++ExpectedResult = Success
++
++
diff --git a/SOURCES/openssl-1.1.1-secure-getenv.patch b/SOURCES/openssl-1.1.1-secure-getenv.patch
new file mode 100644
index 0000000..c3d14a1
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-secure-getenv.patch
@@ -0,0 +1,173 @@
+diff -up openssl-1.1.1-pre8/crypto/conf/conf_api.c.secure-getenv openssl-1.1.1-pre8/crypto/conf/conf_api.c
+--- openssl-1.1.1-pre8/crypto/conf/conf_api.c.secure-getenv	2018-06-20 16:48:10.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/conf/conf_api.c	2018-07-16 18:01:11.708359766 +0200
+@@ -9,6 +9,8 @@
+ 
+ /* Part of the code in here was originally in conf.c, which is now removed */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "e_os.h"
+ #include <stdlib.h>
+ #include <string.h>
+@@ -82,7 +84,7 @@ char *_CONF_get_string(const CONF *conf,
+             if (v != NULL)
+                 return v->value;
+             if (strcmp(section, "ENV") == 0) {
+-                p = getenv(name);
++                p = secure_getenv(name);
+                 if (p != NULL)
+                     return p;
+             }
+diff -up openssl-1.1.1-pre8/crypto/conf/conf_mod.c.secure-getenv openssl-1.1.1-pre8/crypto/conf/conf_mod.c
+--- openssl-1.1.1-pre8/crypto/conf/conf_mod.c.secure-getenv	2018-06-20 16:48:10.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/conf/conf_mod.c	2018-07-16 18:02:37.308383955 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "internal/cryptlib.h"
+ #include <stdio.h>
+ #include <ctype.h>
+@@ -481,7 +483,7 @@ char *CONF_get1_default_config_file(void
+     int len;
+ 
+     if (!OPENSSL_issetugid()) {
+-        file = getenv("OPENSSL_CONF");
++        file = secure_getenv("OPENSSL_CONF");
+         if (file)
+             return OPENSSL_strdup(file);
+     }
+diff -up openssl-1.1.1-pre8/crypto/ct/ct_log.c.secure-getenv openssl-1.1.1-pre8/crypto/ct/ct_log.c
+--- openssl-1.1.1-pre8/crypto/ct/ct_log.c.secure-getenv	2018-06-20 16:48:10.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/ct/ct_log.c	2018-07-16 18:01:11.708359766 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdlib.h>
+ #include <string.h>
+ 
+@@ -137,7 +139,7 @@ static int ctlog_new_from_conf(CTLOG **c
+ 
+ int CTLOG_STORE_load_default_file(CTLOG_STORE *store)
+ {
+-    const char *fpath = getenv(CTLOG_FILE_EVP);
++    const char *fpath = secure_getenv(CTLOG_FILE_EVP);
+ 
+     if (fpath == NULL)
+       fpath = CTLOG_FILE;
+diff -up openssl-1.1.1-pre8/crypto/engine/eng_list.c.secure-getenv openssl-1.1.1-pre8/crypto/engine/eng_list.c
+--- openssl-1.1.1-pre8/crypto/engine/eng_list.c.secure-getenv	2018-06-20 16:48:10.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/engine/eng_list.c	2018-07-16 18:03:03.190996004 +0200
+@@ -8,6 +8,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "eng_int.h"
+ 
+ /*
+@@ -318,7 +320,7 @@ ENGINE *ENGINE_by_id(const char *id)
+      */
+     if (strcmp(id, "dynamic")) {
+         if (OPENSSL_issetugid()
+-                || (load_dir = getenv("OPENSSL_ENGINES")) == NULL)
++                || (load_dir = secure_getenv("OPENSSL_ENGINES")) == NULL)
+             load_dir = ENGINESDIR;
+         iterator = ENGINE_by_id("dynamic");
+         if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||
+diff -up openssl-1.1.1-pre8/crypto/mem.c.secure-getenv openssl-1.1.1-pre8/crypto/mem.c
+--- openssl-1.1.1-pre8/crypto/mem.c.secure-getenv	2018-06-20 16:48:11.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/mem.c	2018-07-16 18:01:11.709359790 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "e_os.h"
+ #include "internal/cryptlib.h"
+ #include "internal/cryptlib_int.h"
+@@ -180,11 +182,11 @@ static int shouldfail(void)
+ 
+ void ossl_malloc_setup_failures(void)
+ {
+-    const char *cp = getenv("OPENSSL_MALLOC_FAILURES");
++    const char *cp = secure_getenv("OPENSSL_MALLOC_FAILURES");
+ 
+     if (cp != NULL && (md_failstring = strdup(cp)) != NULL)
+         parseit();
+-    if ((cp = getenv("OPENSSL_MALLOC_FD")) != NULL)
++    if ((cp = secure_getenv("OPENSSL_MALLOC_FD")) != NULL)
+         md_tracefd = atoi(cp);
+ }
+ #endif
+diff -up openssl-1.1.1-pre8/crypto/rand/randfile.c.secure-getenv openssl-1.1.1-pre8/crypto/rand/randfile.c
+--- openssl-1.1.1-pre8/crypto/rand/randfile.c.secure-getenv	2018-06-20 16:48:11.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/rand/randfile.c	2018-07-16 18:01:11.709359790 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "internal/cryptlib.h"
+ 
+ #include <errno.h>
+@@ -264,7 +266,7 @@ const char *RAND_file_name(char *buf, si
+ #else
+     if (OPENSSL_issetugid() != 0) {
+         use_randfile = 0;
+-    } else if ((s = getenv("RANDFILE")) == NULL || *s == '\0') {
++    } else if ((s = secure_getenv("RANDFILE")) == NULL || *s == '\0') {
+         use_randfile = 0;
+         s = getenv("HOME");
+     }
+diff -up openssl-1.1.1-pre8/crypto/x509/by_dir.c.secure-getenv openssl-1.1.1-pre8/crypto/x509/by_dir.c
+--- openssl-1.1.1-pre8/crypto/x509/by_dir.c.secure-getenv	2018-06-20 16:48:11.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/x509/by_dir.c	2018-07-16 18:03:43.355945786 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include "e_os.h"
+ #include "internal/cryptlib.h"
+ #include <stdio.h>
+@@ -73,7 +75,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, in
+     switch (cmd) {
+     case X509_L_ADD_DIR:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            const char *dir = getenv(X509_get_default_cert_dir_env());
++            const char *dir = secure_getenv(X509_get_default_cert_dir_env());
+ 
+             if (dir)
+                 ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
+diff -up openssl-1.1.1-pre8/crypto/x509/by_file.c.secure-getenv openssl-1.1.1-pre8/crypto/x509/by_file.c
+--- openssl-1.1.1-pre8/crypto/x509/by_file.c.secure-getenv	2018-06-20 16:48:11.000000000 +0200
++++ openssl-1.1.1-pre8/crypto/x509/by_file.c	2018-07-16 18:01:11.709359790 +0200
+@@ -7,6 +7,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <time.h>
+ #include <errno.h>
+@@ -46,7 +48,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx
+     switch (cmd) {
+     case X509_L_FILE_LOAD:
+         if (argl == X509_FILETYPE_DEFAULT) {
+-            file = getenv(X509_get_default_cert_file_env());
++            file = secure_getenv(X509_get_default_cert_file_env());
+             if (file)
+                 ok = (X509_load_cert_crl_file(ctx, file,
+                                               X509_FILETYPE_PEM) != 0);
diff --git a/SOURCES/openssl-1.1.1-sslv3-keep-abi.patch b/SOURCES/openssl-1.1.1-sslv3-keep-abi.patch
new file mode 100644
index 0000000..0a9d6b6
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-sslv3-keep-abi.patch
@@ -0,0 +1,72 @@
+diff -up openssl-1.1.1/include/openssl/ssl.h.sslv3-abi openssl-1.1.1/include/openssl/ssl.h
+--- openssl-1.1.1/include/openssl/ssl.h.sslv3-abi	2018-10-01 14:15:47.926252469 +0200
++++ openssl-1.1.1/include/openssl/ssl.h	2018-10-01 14:13:23.221851065 +0200
+@@ -1838,11 +1838,11 @@ __owur const char *SSL_get_version(const
+ /* This sets the 'default' SSL version that SSL_new() will create */
+ __owur int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
+ 
+-# ifndef OPENSSL_NO_SSL3_METHOD
++/* # ifndef OPENSSL_NO_SSL3_METHOD */
+ DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_method(void)) /* SSLv3 */
+ DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_server_method(void))
+ DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_client_method(void))
+-# endif
++/* # endif */
+ 
+ #define SSLv23_method           TLS_method
+ #define SSLv23_server_method    TLS_server_method
+diff -up openssl-1.1.1/ssl/methods.c.sslv3-abi openssl-1.1.1/ssl/methods.c
+--- openssl-1.1.1/ssl/methods.c.sslv3-abi	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/ssl/methods.c	2018-10-01 13:24:46.357116737 +0200
+@@ -275,4 +275,21 @@ const SSL_METHOD *DTLSv1_client_method(v
+ }
+ # endif
+ 
++# ifdef OPENSSL_NO_SSL3_METHOD
++const SSL_METHOD *SSLv3_method(void)
++{
++    return NULL;
++}
++
++const SSL_METHOD *SSLv3_server_method(void)
++{
++    return NULL;
++}
++
++const SSL_METHOD *SSLv3_client_method(void)
++{
++    return NULL;
++}
++# endif
++
+ #endif
+diff -up openssl-1.1.1/util/libssl.num.sslv3-abi openssl-1.1.1/util/libssl.num
+--- openssl-1.1.1/util/libssl.num.sslv3-abi	2018-09-11 14:48:25.000000000 +0200
++++ openssl-1.1.1/util/libssl.num	2018-10-01 13:24:46.358116760 +0200
+@@ -60,7 +60,7 @@ SSL_get_rfd
+ DTLSv1_listen                           61	1_1_0	EXIST::FUNCTION:SOCK
+ SSL_set_ssl_method                      62	1_1_0	EXIST::FUNCTION:
+ SSL_get0_security_ex_data               63	1_1_0	EXIST::FUNCTION:
+-SSLv3_client_method                     64	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
++SSLv3_client_method                     64	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0
+ SSL_set_security_level                  65	1_1_0	EXIST::FUNCTION:
+ DTLSv1_2_method                         66	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
+ SSL_get_fd                              67	1_1_0	EXIST::FUNCTION:
+@@ -205,7 +205,7 @@ SSL_do_handshake
+ SSL_CTX_get_ex_data                     206	1_1_0	EXIST::FUNCTION:
+ SSL_is_init_finished                    207	1_1_0	EXIST::FUNCTION:
+ SSL_CTX_set_default_verify_file         208	1_1_0	EXIST::FUNCTION:
+-SSLv3_method                            209	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
++SSLv3_method                            209	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0
+ SSL_CTX_set_cookie_generate_cb          210	1_1_0	EXIST::FUNCTION:
+ SSL_certs_clear                         211	1_1_0	EXIST::FUNCTION:
+ SSL_set_connect_state                   212	1_1_0	EXIST::FUNCTION:
+@@ -324,7 +324,7 @@ SSL_CTX_use_RSAPrivateKey_ASN1
+ SSL_CTX_use_PrivateKey_ASN1             325	1_1_0	EXIST::FUNCTION:
+ SSL_CTX_get0_privatekey                 326	1_1_0	EXIST::FUNCTION:
+ BIO_f_ssl                               327	1_1_0	EXIST::FUNCTION:
+-SSLv3_server_method                     328	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
++SSLv3_server_method                     328	1_1_0	EXIST::FUNCTION:DEPRECATEDIN_1_1_0
+ SSL_SESSION_free                        329	1_1_0	EXIST::FUNCTION:
+ SSL_get_shutdown                        330	1_1_0	EXIST::FUNCTION:
+ SSL_get_peer_finished                   331	1_1_0	EXIST::FUNCTION:
diff --git a/SOURCES/openssl-1.1.1-system-cipherlist.patch b/SOURCES/openssl-1.1.1-system-cipherlist.patch
new file mode 100644
index 0000000..b83c29b
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-system-cipherlist.patch
@@ -0,0 +1,310 @@
+diff -up openssl-1.1.1-pre9/Configurations/unix-Makefile.tmpl.system-cipherlist openssl-1.1.1-pre9/Configurations/unix-Makefile.tmpl
+--- openssl-1.1.1-pre9/Configurations/unix-Makefile.tmpl.system-cipherlist	2018-08-22 12:15:54.520742678 +0200
++++ openssl-1.1.1-pre9/Configurations/unix-Makefile.tmpl	2018-08-22 12:15:54.554743511 +0200
+@@ -180,6 +180,10 @@ MANDIR=$(INSTALLTOP)/share/man
+ DOCDIR=$(INSTALLTOP)/share/doc/$(BASENAME)
+ HTMLDIR=$(DOCDIR)/html
+ 
++{- output_off() if $config{system_ciphers_file} eq ""; "" -}
++SYSTEM_CIPHERS_FILE_DEFINE=-DSYSTEM_CIPHERS_FILE="\"{- $config{system_ciphers_file} -}\""
++{- output_on() if $config{system_ciphers_file} eq ""; "" -}
++
+ # MANSUFFIX is for the benefit of anyone who may want to have a suffix
+ # appended after the manpage file section number.  "ssl" is popular,
+ # resulting in files such as config.5ssl rather than config.5.
+@@ -203,6 +207,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -}
+ CXX={- $config{CXX} ? "\$(CROSS_COMPILE)$config{CXX}" : '' -}
+ CPPFLAGS={- our $cppflags1 = join(" ",
+                                   (map { "-D".$_} @{$config{CPPDEFINES}}),
++                                  "\$(SYSTEM_CIPHERS_FILE_DEFINE)",
+                                   (map { "-I".$_} @{$config{CPPINCLUDES}}),
+                                   @{$config{CPPFLAGS}}) -}
+ CFLAGS={- join(' ', @{$config{CFLAGS}}) -}
+diff -up openssl-1.1.1-pre9/Configure.system-cipherlist openssl-1.1.1-pre9/Configure
+--- openssl-1.1.1-pre9/Configure.system-cipherlist	2018-08-21 14:14:11.000000000 +0200
++++ openssl-1.1.1-pre9/Configure	2018-08-22 12:16:46.600018343 +0200
+@@ -24,7 +24,7 @@ use OpenSSL::Glob;
+ my $orig_death_handler = $SIG{__DIE__};
+ $SIG{__DIE__} = \&death_handler;
+ 
+-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
++my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--system-ciphers-file=SYSTEMCIPHERFILE] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
+ 
+ # Options:
+ #
+@@ -41,6 +41,9 @@ my $usage="Usage: Configure [no-<cipher>
+ #               This becomes the value of OPENSSLDIR in Makefile and in C.
+ #               (Default: PREFIX/ssl)
+ #
++# --system-ciphers-file  A file to read cipher string from when the PROFILE=SYSTEM
++#		cipher is specified (default).
++#
+ # --cross-compile-prefix Add specified prefix to binutils components.
+ #
+ # --api         One of 0.9.8, 1.0.0 or 1.1.0.  Do not compile support for
+@@ -295,6 +298,7 @@ $config{prefix}="";
+ $config{openssldir}="";
+ $config{processor}="";
+ $config{libdir}="";
++$config{system_ciphers_file}="";
+ my $auto_threads=1;    # enable threads automatically? true by default
+ my $default_ranlib;
+ 
+@@ -817,6 +821,10 @@ while (@argvcopy)
+ 			    push @seed_sources, $x;
+ 			    }
+                         }
++		elsif (/^--system-ciphers-file=(.*)$/)
++			{
++			$config{system_ciphers_file}=$1;
++			}
+ 		elsif (/^--cross-compile-prefix=(.*)$/)
+ 			{
+ 			$user{CROSS_COMPILE}=$1;
+@@ -1003,6 +1011,8 @@ if ($target eq "HASH") {
+     exit 0;
+ }
+ 
++chop $config{system_ciphers_file} if $config{system_ciphers_file} =~ /\/$/;
++
+ print "Configuring OpenSSL version $config{version} ($config{version_num}) ";
+ print "for $target\n";
+ 
+diff -up openssl-1.1.1-pre9/doc/man1/ciphers.pod.system-cipherlist openssl-1.1.1-pre9/doc/man1/ciphers.pod
+--- openssl-1.1.1-pre9/doc/man1/ciphers.pod.system-cipherlist	2018-08-21 14:14:13.000000000 +0200
++++ openssl-1.1.1-pre9/doc/man1/ciphers.pod	2018-08-22 12:15:54.555743536 +0200
+@@ -182,6 +182,15 @@ As of OpenSSL 1.0.0, the B<ALL> cipher s
+ 
+ The cipher suites not enabled by B<ALL>, currently B<eNULL>.
+ 
++=item B<PROFILE=SYSTEM>
++
++The list of enabled cipher suites will be loaded from the system crypto policy
++configuration file B</etc/crypto-policies/back-ends/openssl.config>.
++See also L<update-crypto-policies(8)>.
++This is the default behavior unless an application explicitly sets a cipher
++list. If used in a cipher list configuration value this string must be at the
++beginning of the cipher list, otherwise it will not be recognized.
++
+ =item B<HIGH>
+ 
+ "High" encryption cipher suites. This currently means those with key lengths
+diff -up openssl-1.1.1-pre9/include/openssl/ssl.h.system-cipherlist openssl-1.1.1-pre9/include/openssl/ssl.h
+--- openssl-1.1.1-pre9/include/openssl/ssl.h.system-cipherlist	2018-08-21 14:14:15.000000000 +0200
++++ openssl-1.1.1-pre9/include/openssl/ssl.h	2018-08-22 12:15:54.557743585 +0200
+@@ -186,6 +186,11 @@ extern "C" {
+  * throwing out anonymous and unencrypted ciphersuites! (The latter are not
+  * actually enabled by ALL, but "ALL:RSA" would enable some of them.)
+  */
++# ifdef SYSTEM_CIPHERS_FILE
++#  define SSL_SYSTEM_DEFAULT_CIPHER_LIST "PROFILE=SYSTEM"
++# else
++#  define SSL_SYSTEM_DEFAULT_CIPHER_LIST SSL_DEFAULT_CIPHER_LIST
++# endif
+ 
+ /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
+ # define SSL_SENT_SHUTDOWN       1
+diff -up openssl-1.1.1-pre9/ssl/ssl_ciph.c.system-cipherlist openssl-1.1.1-pre9/ssl/ssl_ciph.c
+--- openssl-1.1.1-pre9/ssl/ssl_ciph.c.system-cipherlist	2018-08-21 14:14:15.000000000 +0200
++++ openssl-1.1.1-pre9/ssl/ssl_ciph.c	2018-08-22 12:15:54.557743585 +0200
+@@ -9,6 +9,8 @@
+  * https://www.openssl.org/source/license.html
+  */
+ 
++/* for secure_getenv */
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <ctype.h>
+ #include <openssl/objects.h>
+@@ -1397,6 +1399,53 @@ int SSL_set_ciphersuites(SSL *s, const c
+     return ret;
+ }
+ 
++#ifdef SYSTEM_CIPHERS_FILE
++static char *load_system_str(const char *suffix)
++{
++    FILE *fp;
++    char buf[1024];
++    char *new_rules;
++    const char *ciphers_path;
++    unsigned len, slen;
++
++    if ((ciphers_path = secure_getenv("OPENSSL_SYSTEM_CIPHERS_OVERRIDE")) == NULL)
++        ciphers_path = SYSTEM_CIPHERS_FILE;
++    fp = fopen(ciphers_path, "r");
++    if (fp == NULL || fgets(buf, sizeof(buf), fp) == NULL) {
++        /* cannot open or file is empty */
++        snprintf(buf, sizeof(buf), "%s", SSL_DEFAULT_CIPHER_LIST);
++    }
++
++    if (fp)
++        fclose(fp);
++
++    slen = strlen(suffix);
++    len = strlen(buf);
++
++    if (buf[len - 1] == '\n') {
++        len--;
++        buf[len] = 0;
++    }
++    if (buf[len - 1] == '\r') {
++        len--;
++        buf[len] = 0;
++    }
++
++    new_rules = OPENSSL_malloc(len + slen + 1);
++    if (new_rules == 0)
++        return NULL;
++
++    memcpy(new_rules, buf, len);
++    if (slen > 0) {
++        memcpy(&new_rules[len], suffix, slen);
++        len += slen;
++    }
++    new_rules[len] = 0;
++
++    return new_rules;
++}
++#endif
++
+ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+                                              STACK_OF(SSL_CIPHER) *tls13_ciphersuites,
+                                              STACK_OF(SSL_CIPHER) **cipher_list,
+@@ -1410,15 +1459,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     const char *rule_p;
+     CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
+     const SSL_CIPHER **ca_list = NULL;
++#ifdef SYSTEM_CIPHERS_FILE
++    char *new_rules = NULL;
++
++    if (rule_str != NULL && strncmp(rule_str, "PROFILE=SYSTEM", 14) == 0) {
++        char *p = rule_str + 14;
++    
++        new_rules = load_system_str(p);
++        rule_str = new_rules;
++    }
++#endif
+ 
+     /*
+      * Return with error if nothing to do.
+      */
+     if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
+-        return NULL;
++        goto err;
+ #ifndef OPENSSL_NO_EC
+     if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
+-        return NULL;
++        goto err;
+ #endif
+ 
+     /*
+@@ -1441,7 +1500,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
+     if (co_list == NULL) {
+         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
+-        return NULL;          /* Failure */
++        goto err;
+     }
+ 
+     ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
+@@ -1507,8 +1566,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+      * in force within each class
+      */
+     if (!ssl_cipher_strength_sort(&head, &tail)) {
+-        OPENSSL_free(co_list);
+-        return NULL;
++        goto err;
+     }
+ 
+     /*
+@@ -1553,9 +1611,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
+     ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
+     if (ca_list == NULL) {
+-        OPENSSL_free(co_list);
+         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
+-        return NULL;          /* Failure */
++        goto err;
+     }
+     ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
+                                disabled_mkey, disabled_auth, disabled_enc,
+@@ -1581,8 +1638,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     OPENSSL_free(ca_list);      /* Not needed anymore */
+ 
+     if (!ok) {                  /* Rule processing failure */
+-        OPENSSL_free(co_list);
+-        return NULL;
++        goto err;
+     }
+ 
+     /*
+@@ -1590,14 +1646,18 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+      * if we cannot get one.
+      */
+     if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
+-        OPENSSL_free(co_list);
+-        return NULL;
++        goto err;
+     }
+ 
++#ifdef SYSTEM_CIPHERS_FILE
++    OPENSSL_free(new_rules);    /* Not needed anymore */
++#endif
++
+     /* Add TLSv1.3 ciphers first - we always prefer those if possible */
+     for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) {
+         if (!sk_SSL_CIPHER_push(cipherstack,
+                                 sk_SSL_CIPHER_value(tls13_ciphersuites, i))) {
++            OPENSSL_free(co_list);
+             sk_SSL_CIPHER_free(cipherstack);
+             return NULL;
+         }
+@@ -1629,6 +1689,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_
+     *cipher_list = cipherstack;
+ 
+     return cipherstack;
++
++err:
++    OPENSSL_free(co_list);
++#ifdef SYSTEM_CIPHERS_FILE
++    OPENSSL_free(new_rules);
++#endif
++    return NULL;
++  
+ }
+ 
+ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
+diff -up openssl-1.1.1-pre9/ssl/ssl_lib.c.system-cipherlist openssl-1.1.1-pre9/ssl/ssl_lib.c
+--- openssl-1.1.1-pre9/ssl/ssl_lib.c.system-cipherlist	2018-08-22 12:15:54.552743462 +0200
++++ openssl-1.1.1-pre9/ssl/ssl_lib.c	2018-08-22 12:15:54.558743609 +0200
+@@ -658,7 +658,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx
+                                 ctx->tls13_ciphersuites,
+                                 &(ctx->cipher_list),
+                                 &(ctx->cipher_list_by_id),
+-                                SSL_DEFAULT_CIPHER_LIST, ctx->cert);
++                                SSL_SYSTEM_DEFAULT_CIPHER_LIST, ctx->cert);
+     if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
+         SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
+         return 0;
+@@ -2933,7 +2933,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *m
+     if (!ssl_create_cipher_list(ret->method,
+                                 ret->tls13_ciphersuites,
+                                 &ret->cipher_list, &ret->cipher_list_by_id,
+-                                SSL_DEFAULT_CIPHER_LIST, ret->cert)
++                                SSL_SYSTEM_DEFAULT_CIPHER_LIST, ret->cert)
+         || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
+         SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
+         goto err2;
+diff -up openssl-1.1.1-pre9/test/cipherlist_test.c.system-cipherlist openssl-1.1.1-pre9/test/cipherlist_test.c
+--- openssl-1.1.1-pre9/test/cipherlist_test.c.system-cipherlist	2018-08-21 14:14:15.000000000 +0200
++++ openssl-1.1.1-pre9/test/cipherlist_test.c	2018-08-22 12:15:54.558743609 +0200
+@@ -217,7 +217,9 @@ static int test_default_cipherlist_expli
+ 
+ int setup_tests(void)
+ {
++#ifndef SYSTEM_CIPHERS_FILE
+     ADD_TEST(test_default_cipherlist_implicit);
++#endif
+     ADD_TEST(test_default_cipherlist_explicit);
+     return 1;
+ }
diff --git a/SOURCES/openssl-1.1.1-ts-sha256-default.patch b/SOURCES/openssl-1.1.1-ts-sha256-default.patch
new file mode 100644
index 0000000..d99dc47
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-ts-sha256-default.patch
@@ -0,0 +1,50 @@
+diff --git a/apps/ts.c b/apps/ts.c
+index 63c5210183..4ef8a72eef 100644
+--- a/apps/ts.c
++++ b/apps/ts.c
+@@ -425,7 +425,7 @@ static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
+     ASN1_OBJECT *policy_obj = NULL;
+     ASN1_INTEGER *nonce_asn1 = NULL;
+ 
+-    if (md == NULL && (md = EVP_get_digestbyname("sha1")) == NULL)
++    if (md == NULL && (md = EVP_get_digestbyname("sha256")) == NULL)
+         goto err;
+     if ((ts_req = TS_REQ_new()) == NULL)
+         goto err;
+diff --git a/doc/man1/ts.pod b/doc/man1/ts.pod
+index 078905a845..83b8fe4350 100644
+--- a/doc/man1/ts.pod
++++ b/doc/man1/ts.pod
+@@ -517,7 +517,7 @@ included. Default is no. (Optional)
+ =item B<ess_cert_id_alg>
+ 
+ This option specifies the hash function to be used to calculate the TSA's
+-public key certificate identifier. Default is sha1. (Optional)
++public key certificate identifier. Default is sha256. (Optional)
+ 
+ =back
+ 
+@@ -529,7 +529,7 @@ openssl/apps/openssl.cnf will do.
+ 
+ =head2 Time Stamp Request
+ 
+-To create a time stamp request for design1.txt with SHA-1
++To create a time stamp request for design1.txt with SHA-256
+ without nonce and policy and no certificate is required in the response:
+ 
+   openssl ts -query -data design1.txt -no_nonce \
+@@ -545,12 +545,12 @@ To print the content of the previous request in human readable format:
+ 
+   openssl ts -query -in design1.tsq -text
+ 
+-To create a time stamp request which includes the MD-5 digest
++To create a time stamp request which includes the SHA-512 digest
+ of design2.txt, requests the signer certificate and nonce,
+ specifies a policy id (assuming the tsa_policy1 name is defined in the
+ OID section of the config file):
+ 
+-  openssl ts -query -data design2.txt -md5 \
++  openssl ts -query -data design2.txt -sha512 \
+         -tspolicy tsa_policy1 -cert -out design2.tsq
+ 
+ =head2 Time Stamp Response
diff --git a/SOURCES/openssl-1.1.1-version-add-engines.patch b/SOURCES/openssl-1.1.1-version-add-engines.patch
new file mode 100644
index 0000000..3c3f58e
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-version-add-engines.patch
@@ -0,0 +1,38 @@
+diff -up openssl-1.1.1-pre8/apps/version.c.version-add-engines openssl-1.1.1-pre8/apps/version.c
+--- openssl-1.1.1-pre8/apps/version.c.version-add-engines	2018-06-20 16:48:09.000000000 +0200
++++ openssl-1.1.1-pre8/apps/version.c	2018-07-16 18:00:40.608624346 +0200
+@@ -64,7 +64,7 @@ int version_main(int argc, char **argv)
+ {
+     int ret = 1, dirty = 0, seed = 0;
+     int cflags = 0, version = 0, date = 0, options = 0, platform = 0, dir = 0;
+-    int engdir = 0;
++    int engdir = 0, engines = 0;
+     char *prog;
+     OPTION_CHOICE o;
+ 
+@@ -106,7 +106,7 @@ opthelp:
+             break;
+         case OPT_A:
+             seed = options = cflags = version = date = platform = dir = engdir
+-                = 1;
++                = engines = 1;
+             break;
+         }
+     }
+@@ -188,6 +188,16 @@ opthelp:
+ #endif
+         printf("\n");
+     }
++    if (engines) {
++        ENGINE *e;
++        printf("engines:  ");
++        e = ENGINE_get_first();
++        while (e) {
++            printf("%s ", ENGINE_get_id(e));
++            e = ENGINE_get_next(e);
++        }
++        printf("\n");
++    }
+     ret = 0;
+  end:
+     return ret;
diff --git a/SOURCES/openssl-1.1.1-version-override.patch b/SOURCES/openssl-1.1.1-version-override.patch
new file mode 100644
index 0000000..513f27e
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-version-override.patch
@@ -0,0 +1,12 @@
+diff -up openssl-1.1.1/include/openssl/opensslv.h.version-override openssl-1.1.1/include/openssl/opensslv.h
+--- openssl-1.1.1/include/openssl/opensslv.h.version-override	2018-09-13 08:54:38.247940128 +0200
++++ openssl-1.1.1/include/openssl/opensslv.h	2018-09-13 08:56:10.757779555 +0200
+@@ -40,7 +40,7 @@ extern "C" {
+  *  major minor fix final patch/beta)
+  */
+ # define OPENSSL_VERSION_NUMBER  0x1010100fL
+-# define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.1  11 Sep 2018"
++# define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.1 FIPS  11 Sep 2018"
+ 
+ /*-
+  * The macros below are to be used for shared library (.so, .dll, ...)
diff --git a/SOURCES/openssl-1.1.1-weak-ciphers.patch b/SOURCES/openssl-1.1.1-weak-ciphers.patch
new file mode 100644
index 0000000..0083643
--- /dev/null
+++ b/SOURCES/openssl-1.1.1-weak-ciphers.patch
@@ -0,0 +1,57 @@
+diff -up openssl-1.1.1/ssl/s3_lib.c.weak-ciphers openssl-1.1.1/ssl/s3_lib.c
+--- openssl-1.1.1/ssl/s3_lib.c.weak-ciphers	2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/ssl/s3_lib.c	2018-09-17 12:53:33.850637181 +0200
+@@ -2612,7 +2612,7 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      SSL_GOST89MAC,
+      TLS1_VERSION, TLS1_2_VERSION,
+      0, 0,
+-     SSL_HIGH,
++     SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC,
+      256,
+      256,
+@@ -2644,7 +2644,7 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      SSL_GOST89MAC12,
+      TLS1_VERSION, TLS1_2_VERSION,
+      0, 0,
+-     SSL_HIGH,
++     SSL_MEDIUM,
+      SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
+      256,
+      256,
+@@ -2753,7 +2753,7 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      },
+ #endif                          /* OPENSSL_NO_SEED */
+ 
+-#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
++#if 0 /* No MD5 ciphersuites */
+     {
+      1,
+      SSL3_TXT_RSA_RC4_128_MD5,
+@@ -2770,6 +2770,8 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      128,
+      128,
+      },
++#endif
++#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
+     {
+      1,
+      SSL3_TXT_RSA_RC4_128_SHA,
+@@ -2786,6 +2788,8 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      128,
+      128,
+      },
++#endif
++#if 0
+     {
+      1,
+      SSL3_TXT_ADH_RC4_128_MD5,
+@@ -2802,6 +2806,8 @@ static SSL_CIPHER ssl3_ciphers[] = {
+      128,
+      128,
+      },
++#endif
++#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
+     {
+      1,
+      TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA,
diff --git a/SOURCES/opensslconf-new-warning.h b/SOURCES/opensslconf-new-warning.h
new file mode 100644
index 0000000..de091c8
--- /dev/null
+++ b/SOURCES/opensslconf-new-warning.h
@@ -0,0 +1,7 @@
+/* Prepended at openssl package build-time.  Don't include this file directly,
+ * use <openssl/opensslconf.h> instead. */
+
+#ifndef openssl_opensslconf_multilib_redirection_h
+#error "Don't include this file directly, use <openssl/opensslconf.h> instead!"
+#endif
+
diff --git a/SOURCES/opensslconf-new.h b/SOURCES/opensslconf-new.h
new file mode 100644
index 0000000..04363c3
--- /dev/null
+++ b/SOURCES/opensslconf-new.h
@@ -0,0 +1,47 @@
+/* This file is here to prevent a file conflict on multiarch systems.  A
+ * conflict will frequently occur because arch-specific build-time
+ * configuration options are stored (and used, so they can't just be stripped
+ * out) in opensslconf.h.  The original opensslconf.h has been renamed.
+ * DO NOT INCLUDE THE NEW FILE DIRECTLY -- ALWAYS INCLUDE THIS ONE INSTEAD. */
+
+#ifdef openssl_opensslconf_multilib_redirection_h
+#error "Do not define openssl_opensslconf_multilib_redirection_h!"
+#endif
+#define openssl_opensslconf_multilib_redirection_h
+
+#if defined(__i386__)
+#include "opensslconf-i386.h"
+#elif defined(__ia64__)
+#include "opensslconf-ia64.h"
+#elif defined(__mips64) && defined(__MIPSEL__)
+#include "opensslconf-mips64el.h"
+#elif defined(__mips64)
+#include "opensslconf-mips64.h"
+#elif defined(__mips) && defined(__MIPSEL__)
+#include "opensslconf-mipsel.h"
+#elif defined(__mips)
+#include "opensslconf-mips.h"
+#elif defined(__powerpc64__)
+#include <endian.h>
+#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+#include "opensslconf-ppc64.h"
+#else
+#include "opensslconf-ppc64le.h"
+#endif
+#elif defined(__powerpc__)
+#include "opensslconf-ppc.h"
+#elif defined(__s390x__)
+#include "opensslconf-s390x.h"
+#elif defined(__s390__)
+#include "opensslconf-s390.h"
+#elif defined(__sparc__) && defined(__arch64__)
+#include "opensslconf-sparc64.h"
+#elif defined(__sparc__)
+#include "opensslconf-sparc.h"
+#elif defined(__x86_64__)
+#include "opensslconf-x86_64.h"
+#else
+#error "This openssl-devel package does not work your architecture?"
+#endif
+
+#undef openssl_opensslconf_multilib_redirection_h
diff --git a/SOURCES/renew-dummy-cert b/SOURCES/renew-dummy-cert
new file mode 100755
index 0000000..92e271c
--- /dev/null
+++ b/SOURCES/renew-dummy-cert
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+if [ $# -eq 0 ]; then
+	echo $"Usage: `basename $0` filename" 1>&2
+	exit 1
+fi
+
+PEM=$1
+REQ=`/bin/mktemp /tmp/openssl.XXXXXX`
+KEY=`/bin/mktemp /tmp/openssl.XXXXXX`
+CRT=`/bin/mktemp /tmp/openssl.XXXXXX`
+NEW=${PEM}_
+
+trap "rm -f $REQ $KEY $CRT $NEW" SIGINT
+
+if [ ! -f $PEM ]; then
+	echo "$PEM: file not found" 1>&2
+	exit 1
+fi
+
+umask 077
+
+OWNER=`ls -l $PEM | awk '{ printf "%s.%s", $3, $4; }'`
+
+openssl rsa -inform pem -in $PEM -out $KEY
+openssl x509 -x509toreq -in $PEM -signkey $KEY -out $REQ
+openssl x509 -req -in $REQ -signkey $KEY -days 365 \
+	-extfile /etc/pki/tls/openssl.cnf -extensions v3_ca -out $CRT
+
+(cat $KEY ; echo "" ; cat $CRT) > $NEW
+
+chown $OWNER $NEW
+
+mv -f $NEW $PEM
+
+rm -f $REQ $KEY $CRT
+
+exit 0
+
diff --git a/SPECS/openssl.spec b/SPECS/openssl.spec
new file mode 100644
index 0000000..408b630
--- /dev/null
+++ b/SPECS/openssl.spec
@@ -0,0 +1,2029 @@
+# For the curious:
+# 0.9.5a soversion = 0
+# 0.9.6  soversion = 1
+# 0.9.6a soversion = 2
+# 0.9.6c soversion = 3
+# 0.9.7a soversion = 4
+# 0.9.7ef soversion = 5
+# 0.9.8ab soversion = 6
+# 0.9.8g soversion = 7
+# 0.9.8jk + EAP-FAST soversion = 8
+# 1.0.0 soversion = 10
+# 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
+#                        depends on build configuration options)
+%define soversion 1.1
+
+# Arches on which we need to prevent arch conflicts on opensslconf.h, must
+# also be handled in opensslconf-new.h.
+%define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
+
+%global _performance_build 1
+
+Summary: Utilities from the general purpose cryptography library with TLS implementation
+Name: openssl
+Version: 1.1.1
+Release: 8%{?dist}
+Epoch: 1
+# We have to remove certain patented algorithms from the openssl source
+# tarball with the hobble-openssl script which is included below.
+# The original openssl upstream tarball cannot be shipped in the .src.rpm.
+Source: openssl-%{version}-hobbled.tar.xz
+Source1: hobble-openssl
+Source2: Makefile.certificate
+Source6: make-dummy-cert
+Source7: renew-dummy-cert
+Source9: opensslconf-new.h
+Source10: opensslconf-new-warning.h
+Source11: README.FIPS
+Source12: ec_curve.c
+Source13: ectest.c
+# Build changes
+Patch1: openssl-1.1.1-build.patch
+Patch2: openssl-1.1.0-defaults.patch
+Patch3: openssl-1.1.0-no-html.patch
+Patch4: openssl-1.1.1-man-rename.patch
+# Bug fixes
+Patch21: openssl-1.1.0-issuer-hash.patch
+# Functionality changes
+Patch31: openssl-1.1.1-conf-paths.patch
+Patch32: openssl-1.1.1-version-add-engines.patch
+Patch33: openssl-1.1.0-apps-dgst.patch
+Patch36: openssl-1.1.1-secure-getenv.patch
+Patch37: openssl-1.1.1-ec-curves.patch
+Patch38: openssl-1.1.0-no-weak-verify.patch
+Patch40: openssl-1.1.1-sslv3-keep-abi.patch
+Patch41: openssl-1.1.1-system-cipherlist.patch
+Patch42: openssl-1.1.1-fips.patch
+Patch43: openssl-1.1.1-ignore-bound.patch
+Patch44: openssl-1.1.1-version-override.patch
+Patch45: openssl-1.1.1-weak-ciphers.patch
+Patch46: openssl-1.1.1-seclevel.patch
+Patch47: openssl-1.1.1-coverity.patch
+Patch48: openssl-1.1.1-fips-post-rand.patch
+Patch49: openssl-1.1.1-ts-sha256-default.patch
+# Backported fixes including security fixes
+
+License: OpenSSL
+Group: System Environment/Libraries
+URL: http://www.openssl.org/
+BuildRequires: gcc
+BuildRequires: coreutils, krb5-devel, perl-interpreter, sed, zlib-devel, /usr/bin/cmp
+BuildRequires: lksctp-tools-devel
+BuildRequires: /usr/bin/rename
+BuildRequires: /usr/bin/pod2man
+BuildRequires: /usr/sbin/sysctl
+BuildRequires: perl(Test::Harness), perl(Test::More), perl(Math::BigInt)
+BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
+BuildRequires: perl(Time::HiRes)
+Requires: coreutils
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description
+The OpenSSL toolkit provides support for secure communications between
+machines. OpenSSL includes a certificate management tool and shared
+libraries which provide various cryptographic algorithms and
+protocols.
+
+%package libs
+Summary: A general purpose cryptography library with TLS implementation
+Group: System Environment/Libraries
+Requires: ca-certificates >= 2008-5
+Requires: crypto-policies >= 20180730
+Recommends: openssl-pkcs11%{?_isa}
+# Needed obsoletes due to the base/lib subpackage split
+Obsoletes: openssl < 1:1.0.1-0.3.beta3
+Obsoletes: openssl-fips < 1:1.0.1e-28
+Provides: openssl-fips = %{epoch}:%{version}-%{release}
+
+%description libs
+OpenSSL is a toolkit for supporting cryptography. The openssl-libs
+package contains the libraries that are used by various applications which
+support cryptographic algorithms and protocols.
+
+%package devel
+Summary: Files for development of applications which will use OpenSSL
+Group: Development/Libraries
+Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: krb5-devel%{?_isa}, zlib-devel%{?_isa}
+Requires: pkgconfig
+
+%description devel
+OpenSSL is a toolkit for supporting cryptography. The openssl-devel
+package contains include files needed to develop applications which
+support various cryptographic algorithms and protocols.
+
+%package static
+Summary:  Libraries for static linking of applications which will use OpenSSL
+Group: Development/Libraries
+Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description static
+OpenSSL is a toolkit for supporting cryptography. The openssl-static
+package contains static libraries needed for static linking of
+applications which support various cryptographic algorithms and
+protocols.
+
+%package perl
+Summary: Perl scripts provided with OpenSSL
+Group: Applications/Internet
+Requires: perl-interpreter
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description perl
+OpenSSL is a toolkit for supporting cryptography. The openssl-perl
+package provides Perl scripts for converting certificates and keys
+from other formats to the formats used by the OpenSSL toolkit.
+
+%prep
+%setup -q -n %{name}-%{version}
+
+# The hobble_openssl is called here redundantly, just to be sure.
+# The tarball has already the sources removed.
+%{SOURCE1} > /dev/null
+
+cp %{SOURCE12} crypto/ec/
+cp %{SOURCE13} test/
+
+%patch1 -p1 -b .build   %{?_rawbuild}
+%patch2 -p1 -b .defaults
+%patch3 -p1 -b .no-html  %{?_rawbuild}
+%patch4 -p1 -b .man-rename
+
+%patch21 -p1 -b .issuer-hash
+
+%patch31 -p1 -b .conf-paths
+%patch32 -p1 -b .version-add-engines
+%patch33 -p1 -b .dgst
+%patch36 -p1 -b .secure-getenv
+%patch37 -p1 -b .curves
+%patch38 -p1 -b .no-weak-verify
+%patch40 -p1 -b .sslv3-abi
+%patch41 -p1 -b .system-cipherlist
+%patch42 -p1 -b .fips
+%patch43 -p1 -b .ignore-bound
+%patch44 -p1 -b .version-override
+%patch45 -p1 -b .weak-ciphers
+%patch46 -p1 -b .seclevel
+%patch47 -p1 -b .coverity
+%patch48 -p1 -b .fips-post-rand
+%patch49 -p1 -b .ts-sha256-default
+
+
+%build
+# Figure out which flags we want to use.
+# default
+sslarch=%{_os}-%{_target_cpu}
+%ifarch %ix86
+sslarch=linux-elf
+if ! echo %{_target} | grep -q i686 ; then
+	sslflags="no-asm 386"
+fi
+%endif
+%ifarch x86_64
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch sparcv9
+sslarch=linux-sparcv9
+sslflags=no-asm
+%endif
+%ifarch sparc64
+sslarch=linux64-sparcv9
+sslflags=no-asm
+%endif
+%ifarch alpha alphaev56 alphaev6 alphaev67
+sslarch=linux-alpha-gcc
+%endif
+%ifarch s390 sh3eb sh4eb
+sslarch="linux-generic32 -DB_ENDIAN"
+%endif
+%ifarch s390x
+sslarch="linux64-s390x"
+%endif
+%ifarch %{arm}
+sslarch=linux-armv4
+%endif
+%ifarch aarch64
+sslarch=linux-aarch64
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch sh3 sh4
+sslarch=linux-generic32
+%endif
+%ifarch ppc64 ppc64p7
+sslarch=linux-ppc64
+%endif
+%ifarch ppc64le
+sslarch="linux-ppc64le"
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch mips mipsel
+sslarch="linux-mips32 -mips32r2"
+%endif
+%ifarch mips64 mips64el
+sslarch="linux64-mips64 -mips64r2"
+%endif
+%ifarch mips64el
+sslflags=enable-ec_nistp_64_gcc_128
+%endif
+%ifarch riscv64
+sslarch=linux-generic64
+%endif
+
+# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
+# marked as not requiring an executable stack.
+# Also add -DPURIFY to make using valgrind with openssl easier as we do not
+# want to depend on the uninitialized memory as a source of entropy anyway.
+RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -DPURIFY $RPM_LD_FLAGS"
+
+export HASHBANGPERL=/usr/bin/perl
+
+# ia64, x86_64, ppc are OK by default
+# Configure the build tree.  Override OpenSSL defaults with known-good defaults
+# usable on all platforms.  The Configure script already knows to use -fPIC and
+# RPM_OPT_FLAGS, so we can skip specifiying them here.
+./Configure \
+	--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
+	--system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
+	zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
+	enable-cms enable-md2 enable-rc5\
+	enable-weak-ssl-ciphers \
+	no-mdc2 no-ec2m no-sm2 no-sm4 \
+	shared  ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\""'
+
+# Do not run this in a production package the FIPS symbols must be patched-in
+#util/mkdef.pl crypto update
+
+make all
+
+# Overwrite FIPS README
+cp -f %{SOURCE11} .
+
+# Clean up the .pc files
+for i in libcrypto.pc libssl.pc openssl.pc ; do
+  sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
+done
+
+%check
+# Verify that what was compiled actually works.
+
+# Hack - either enable SCTP AUTH chunks in kernel or disable sctp for check
+(sysctl net.sctp.addip_enable=1 && sysctl net.sctp.auth_enable=1) || \
+(echo 'Failed to enable SCTP AUTH chunks, disabling SCTP for tests...' &&
+ sed '/"zlib-dynamic" => "default",/a\ \ "sctp" => "default",' configdata.pm > configdata.pm.new && \
+ touch -r configdata.pm configdata.pm.new && \
+ mv -f configdata.pm.new configdata.pm)
+
+# We must revert patch31 before tests otherwise they will fail
+patch -p1 -R < %{PATCH31}
+
+LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
+export LD_LIBRARY_PATH
+crypto/fips/fips_standalone_hmac libcrypto.so.%{soversion} >.libcrypto.so.%{soversion}.hmac
+ln -s .libcrypto.so.%{soversion}.hmac .libcrypto.so.hmac
+crypto/fips/fips_standalone_hmac libssl.so.%{soversion} >.libssl.so.%{soversion}.hmac
+ln -s .libssl.so.%{soversion}.hmac .libssl.so.hmac
+OPENSSL_ENABLE_MD5_VERIFY=
+export OPENSSL_ENABLE_MD5_VERIFY
+OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file
+export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
+make test
+
+# Add generation of HMAC checksum of the final stripped library
+%define __spec_install_post \
+    %{?__debug_package:%{__debug_install_post}} \
+    %{__arch_install_post} \
+    %{__os_install_post} \
+    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{version}.hmac \
+    ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{soversion}.hmac \
+    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{version}.hmac \
+    ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{soversion}.hmac \
+%{nil}
+
+%define __provides_exclude_from %{_libdir}/openssl
+
+%install
+[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
+# Install OpenSSL.
+install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
+make DESTDIR=$RPM_BUILD_ROOT install
+rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
+for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
+	chmod 755 ${lib}
+	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
+	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
+done
+
+# Install a makefile for generating keys and self-signed certs, and a script
+# for generating them on the fly.
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
+install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate
+install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert
+install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert
+
+# Move runable perl scripts to bindir
+mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/*.pl $RPM_BUILD_ROOT%{_bindir}
+mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/tsget $RPM_BUILD_ROOT%{_bindir}
+
+# Drop the SSLv3 methods from includes
+sed -i '/ifndef OPENSSL_NO_SSL3_METHOD/,+4d' $RPM_BUILD_ROOT%{_includedir}/openssl/ssl.h
+
+# Rename man pages so that they don't conflict with other system man pages.
+pushd $RPM_BUILD_ROOT%{_mandir}
+ln -s -f config.5 man5/openssl.cnf.5
+for manpage in man*/* ; do
+	if [ -L ${manpage} ]; then
+		TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
+		ln -snf ${TARGET}ssl ${manpage}ssl
+		rm -f ${manpage}
+	else
+		mv ${manpage} ${manpage}ssl
+	fi
+done
+for conflict in passwd rand ; do
+	rename ${conflict} ssl${conflict} man*/${conflict}*
+# Fix dangling symlinks
+	manpage=man1/openssl-${conflict}.*
+	if [ -L ${manpage} ] ; then
+		ln -snf ssl${conflict}.1ssl ${manpage}
+	fi
+done
+popd
+
+mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
+mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
+mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
+mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
+mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
+
+# Ensure the config file timestamps are identical across builds to avoid
+# mulitlib conflicts and unnecessary renames on upgrade
+touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
+touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf
+
+rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf.dist
+rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
+
+# Determine which arch opensslconf.h is going to try to #include.
+basearch=%{_arch}
+%ifarch %{ix86}
+basearch=i386
+%endif
+%ifarch sparcv9
+basearch=sparc
+%endif
+%ifarch sparc64
+basearch=sparc64
+%endif
+
+%ifarch %{multilib_arches}
+# Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
+# can have both a 32- and 64-bit version of the library, and they each need
+# their own correct-but-different versions of opensslconf.h to be usable.
+install -m644 %{SOURCE10} \
+	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
+cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
+	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
+install -m644 %{SOURCE9} \
+	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
+%endif
+LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
+export LD_LIBRARY_PATH
+
+%files
+%{!?_licensedir:%global license %%doc}
+%license LICENSE
+%doc FAQ NEWS README README.FIPS
+%{_bindir}/make-dummy-cert
+%{_bindir}/renew-dummy-cert
+%{_bindir}/openssl
+%{_mandir}/man1*/*
+%{_mandir}/man5*/*
+%{_mandir}/man7*/*
+%{_pkgdocdir}/Makefile.certificate
+%exclude %{_mandir}/man1*/*.pl*
+%exclude %{_mandir}/man1*/c_rehash*
+%exclude %{_mandir}/man1*/tsget*
+%exclude %{_mandir}/man1*/openssl-tsget*
+
+%files libs
+%{!?_licensedir:%global license %%doc}
+%license LICENSE
+%dir %{_sysconfdir}/pki/tls
+%dir %{_sysconfdir}/pki/tls/certs
+%dir %{_sysconfdir}/pki/tls/misc
+%dir %{_sysconfdir}/pki/tls/private
+%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
+%config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
+%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
+%attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}
+%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
+%attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}
+%attr(0644,root,root) %{_libdir}/.libcrypto.so.*.hmac
+%attr(0644,root,root) %{_libdir}/.libssl.so.*.hmac
+%attr(0755,root,root) %{_libdir}/engines-%{soversion}
+
+%files devel
+%doc CHANGES doc/dir-locals.example.el doc/openssl-c-indent.el
+%{_prefix}/include/openssl
+%{_libdir}/*.so
+%{_mandir}/man3*/*
+%{_libdir}/pkgconfig/*.pc
+
+%files static
+%{_libdir}/*.a
+
+%files perl
+%{_bindir}/c_rehash
+%{_bindir}/*.pl
+%{_bindir}/tsget
+%{_mandir}/man1*/*.pl*
+%{_mandir}/man1*/c_rehash*
+%{_mandir}/man1*/tsget*
+%{_mandir}/man1*/openssl-tsget*
+%dir %{_sysconfdir}/pki/CA
+%dir %{_sysconfdir}/pki/CA/private
+%dir %{_sysconfdir}/pki/CA/certs
+%dir %{_sysconfdir}/pki/CA/crl
+%dir %{_sysconfdir}/pki/CA/newcerts
+
+%post libs -p /sbin/ldconfig
+
+%postun libs -p /sbin/ldconfig
+
+%changelog
+* Fri Dec 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-8
+- make openssl ts default to using SHA256 digest
+
+* Wed Nov 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-7
+- use /dev/urandom for seeding the RNG in FIPS POST
+
+* Mon Oct 15 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-6
+- make SECLEVEL=3 work
+
+* Tue Oct  9 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-5
+- fix defects found in Coverity scan
+
+* Mon Oct  1 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-4
+- drop SSLv3 support
+
+* Tue Sep 25 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-3
+- drop the TLS-1.3 version revert
+
+* Mon Sep 17 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-2
+- disable RC4-MD5 ciphersuites completely
+
+* Fri Sep 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-1
+- update to the final 1.1.1 version
+- for consistent support of security policies we build
+  RC4 support in TLS (not default) and allow SHA1 in SECLEVEL 2
+- use only /dev/urandom if getrandom() is not available
+- disable SM4
+
+* Thu Aug 23 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-0.pre9.1
+- update to the latest 1.1.1 beta version
+- temporarily revert TLS-1.3 to draft 28 version
+
+* Mon Aug 13 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-0.pre8.4
+- bidirectional shutdown fixes from upstream
+
+* Mon Aug 13 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-0.pre8.3
+- do not put error on stack when using fixed protocol version
+  with the default config (#1615098)
+
+* Fri Jul 27 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-0.pre8.2
+- load crypto policy config file from the default config
+
+* Wed Jul 25 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.1-0.pre8
+- update to the latest 1.1.1 beta version
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.0h-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Tue Jun 19 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0h-5
+- fix FIPS RSA key generation failure
+
+* Mon Jun  4 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0h-4
+- ppc64le is not multilib arch (#1584994)
+
+* Tue Apr  3 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0h-3
+- fix regression of c_rehash (#1562953)
+
+* Thu Mar 29 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0h-2
+- fix FIPS symbol versions
+
+* Thu Mar 29 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0h-1
+- update to upstream version 1.1.0h
+- add Recommends for openssl-pkcs11
+
+* Fri Feb 23 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0g-6
+- one more try to apply RPM_LD_FLAGS properly (#1541033)
+- dropped unneeded starttls xmpp patch (#1417017)
+
+* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.0g-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Feb  1 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0g-4
+- apply RPM_LD_FLAGS properly (#1541033)
+
+* Thu Jan 11 2018 Tomáš Mráz <tmraz@redhat.com> 1.1.0g-3
+- silence the .rnd write failure as that is auxiliary functionality (#1524833)
+
+* Thu Dec 14 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0g-2
+- put the Makefile.certificate in pkgdocdir and drop the requirement on make
+
+* Fri Nov  3 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0g-1
+- update to upstream version 1.1.0g
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.0f-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.0f-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Mon Jul 17 2017 Tomáš Mráz <tmraz@redhat.com> 1:1.1.0f-7
+- make s_client and s_server work with -ssl3 option (#1471783)
+
+* Thu Jul 13 2017 Petr Pisar <ppisar@redhat.com> - 1:1.1.0f-6
+- perl dependency renamed to perl-interpreter
+  <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>
+
+* Mon Jun 26 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0f-5
+- disable verification of all insecure hashes
+
+* Fri Jun 23 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0f-4
+- make DTLS work (#1462541)
+
+* Thu Jun 15 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0f-3
+- enable 3DES SSL ciphersuites, RC4 is kept disabled (#1453066)
+
+* Mon Jun  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0f-2
+- only release thread-local key if we created it (from upstream) (#1458775)
+
+* Fri Jun  2 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0f-1
+- update to upstream version 1.1.0f
+- SRP and GOST is now allowed, note that GOST support requires
+  adding GOST engine which is not part of openssl anymore
+
+* Thu Feb 16 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0e-1
+- update to upstream version 1.1.0e
+- add documentation of the PROFILE=SYSTEM special cipher string (#1420232)
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.1.0d-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Feb  1 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0d-2
+- applied upstream fixes (fix regression in X509_CRL_digest)
+
+* Thu Jan 26 2017 Tomáš Mráz <tmraz@redhat.com> 1.1.0d-1
+- update to upstream version 1.1.0d
+
+* Thu Dec 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0c-5
+- preserve new line in fd BIO BIO_gets() as other BIOs do
+
+* Fri Dec  2 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0c-4
+- FIPS mode fixes for TLS
+
+* Wed Nov 30 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0c-3
+- revert SSL_read() behavior change - patch from upstream (#1394677)
+- fix behavior on client certificate request in renegotiation (#1393579)
+
+* Tue Nov 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0c-2
+- EC curve NIST P-224 is now allowed, still kept disabled in TLS due
+  to less than optimal security
+
+* Fri Nov 11 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0c-1
+- update to upstream version 1.1.0c
+
+* Fri Nov  4 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0b-4
+- use a random seed if the supplied one did not generate valid
+  parameters in dsa_builtin_paramgen2()
+
+* Wed Oct 12 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0b-3
+- do not break contract on return value when using dsa_builtin_paramgen2()
+
+* Wed Oct 12 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0b-2
+- fix afalg failure on big endian
+
+* Tue Oct 11 2016 Tomáš Mráz <tmraz@redhat.com> 1.1.0b-1
+- update to upstream version 1.1.0b
+
+* Fri Oct 07 2016 Richard W.M. Jones <rjones@redhat.com> - 1:1.0.2j-2
+- Add flags for riscv64.
+
+* Mon Sep 26 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-1
+- minor upstream release 1.0.2j fixing regression from previous release
+
+* Sat Sep 24 2016 David Woodhouse <dwmw2@infradead.org> 1.0.2i-2
+- Fix enginesdir in libcrypto.c (#1375361)
+
+* Thu Sep 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2i-1
+- minor upstream release 1.0.2i fixing security issues
+- move man pages for perl based scripts to perl subpackage (#1377617)
+
+* Wed Aug 10 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2h-3
+- fix regression in Cisco AnyConnect VPN support (#1354588)
+
+* Mon Jun 27 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2h-2
+- require libcrypto in libssl.pc (#1301301)
+
+* Tue May  3 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2h-1
+- minor upstream release 1.0.2h fixing security issues
+
+* Tue Mar 29 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2g-4
+- disable SSLv2 support altogether (without ABI break)
+
+* Mon Mar  7 2016 Tom Callaway <spot@fedoraproject.org> - 1.0.2g-3
+- enable RC5
+
+* Wed Mar  2 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2g-2
+- reenable SSL2 in the build to avoid ABI break (it does not
+  make the openssl vulnerable to DROWN attack)
+
+* Tue Mar  1 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2g-1
+- minor upstream release 1.0.2g fixing security issues
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.0.2f-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Thu Jan 28 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2f-1
+- minor upstream release 1.0.2f fixing security issues
+- add support for MIPS secondary architecture
+
+* Fri Jan 15 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.2e-5
+- document some options of openssl speed command
+
+* Fri Dec 18 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2e-4
+- enable sctp support in DTLS
+
+* Tue Dec  8 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2e-3
+- remove unimplemented EC method from header (#1289599)
+
+* Mon Dec  7 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2e-2
+- the fast nistp implementation works only on little endian architectures
+
+* Fri Dec  4 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2e-1
+- minor upstream release 1.0.2e fixing moderate severity security issues
+- enable fast assembler implementation for NIST P-256 and P-521
+  elliptic curves (#1164210)
+- filter out unwanted link options from the .pc files (#1257836)
+- do not set serial to 0 in Makefile.certificate (#1135719)
+
+* Mon Nov 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2d-3
+- fix sigill on some AMD CPUs (#1278194)
+
+* Wed Aug 12 2015 Tom Callaway <spot@fedoraproject.org> 1.0.2d-2
+- re-enable secp256k1 (bz1021898)
+
+* Thu Jul  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2d-1
+- minor upstream release 1.0.2d fixing a high severity security issue
+
+* Tue Jul  7 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2c-3
+- fix the aarch64 build
+
+* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.0.2c-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Mon Jun 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2c-1
+- minor upstream release 1.0.2c fixing multiple security issues
+
+* Thu May  7 2015 Peter Robinson <pbrobinson@fedoraproject.org> 1.0.2a-4
+- Add aarch64 sslarch details
+
+* Thu May  7 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2a-3
+- fix some 64 bit build targets
+
+* Tue Apr 28 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2a-2
+- add alternative certificate chain discovery support from upstream
+
+* Thu Apr 23 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.2a-1
+- rebase to 1.0.2 branch
+
+* Thu Apr  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-7
+- drop the AES-GCM restriction of 2^32 operations because the IV is
+  always 96 bits (32 bit fixed field + 64 bit invocation field)
+
+* Thu Mar 19 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-6
+- fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
+- fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
+- fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
+- fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
+- fix CVE-2015-0293 - triggerable assert in SSLv2 server
+
+* Mon Mar 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-5
+- fix bug in the CRYPTO_128_unwrap()
+
+* Fri Feb 27 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-4
+- fix bug in the RFC 5649 support (#1185878)
+
+* Sat Feb 21 2015 Till Maas <opensource@till.name> - 1:1.0.1k-3
+- Rebuilt for Fedora 23 Change
+  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
+
+* Thu Jan 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-2
+- test in the non-FIPS RSA keygen for minimal distance of p and q
+  similarly to the FIPS RSA keygen
+
+* Fri Jan  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1k-1
+- new upstream release fixing multiple security issues
+
+* Thu Nov 20 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1j-3
+- disable SSLv3 by default again (mail servers and possibly
+  LDAP servers should probably allow it explicitly for legacy
+  clients)
+
+* Tue Oct 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1j-2
+- update the FIPS RSA keygen to be FIPS 186-4 compliant
+
+* Thu Oct 16 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1j-1
+- new upstream release fixing multiple security issues
+
+* Fri Oct 10 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1i-5
+- copy negotiated digests when switching certs by SNI (#1150032)
+
+* Mon Sep  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1i-4
+- add support for RFC 5649
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.0.1i-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Wed Aug 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1i-2
+- drop RSA X9.31 from RSA FIPS selftests
+- add Power 8 optimalizations
+
+* Thu Aug  7 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1i-1
+- new upstream release fixing multiple moderate security issues
+- for now disable only SSLv2 by default
+
+* Fri Jul 18 2014 Tom Callaway <spot@fedoraproject.org> 1.0.1h-6
+- fix license handling
+
+* Mon Jun 30 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1h-5
+- disable SSLv2 and SSLv3 protocols by default (can be enabled
+  via appropriate SSL_CTX_clear_options() call)
+
+* Wed Jun 11 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1h-4
+- use system profile for default cipher list
+
+* Tue Jun 10 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1h-3
+- make FIPS mode keygen bit length restriction enforced only when
+  OPENSSL_ENFORCE_MODULUS_BITS is set
+- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.0.1h-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Thu Jun  5 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1h-1
+- new upstream release 1.0.1h
+
+* Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.0.1g-2
+- Drop obsolete and irrelevant docs
+- Move devel docs to appropriate package
+
+* Wed May  7 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1g-1
+- new upstream release 1.0.1g
+- do not include ECC ciphersuites in SSLv2 client hello (#1090952)
+- fail on hmac integrity check if the .hmac file is empty
+
+* Mon Apr 07 2014 Dennis Gilmore <dennis@ausil.us> - 1.0.1e-44
+- pull in upstream patch for CVE-2014-0160
+- removed CHANGES file portion from patch for expediency
+
+* Thu Apr  3 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
+- add support for ppc64le architecture (#1072633)
+
+* Mon Mar 17 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
+- properly detect encryption failure in BIO
+- use 2048 bit RSA key in FIPS selftests
+
+* Fri Feb 14 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
+- use the key length from configuration file if req -newkey rsa is invoked
+
+* Thu Feb 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
+- print ephemeral key size negotiated in TLS handshake (#1057715)
+- add DH_compute_key_padded needed for FIPS CAVS testing
+
+* Thu Feb  6 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
+- make expiration and key length changeable by DAYS and KEYLEN
+  variables in the certificate Makefile (#1058108)
+- change default hash to sha256 (#1062325)
+
+* Wed Jan 22 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
+- make 3des strength to be 128 bits instead of 168 (#1056616)
+
+* Tue Jan  7 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
+- fix CVE-2013-4353 - Invalid TLS handshake crash
+- fix CVE-2013-6450 - possible MiTM attack on DTLS1
+
+* Fri Dec 20 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-36
+- fix CVE-2013-6449 - crash when version in SSL structure is incorrect
+- more FIPS validation requirement changes
+
+* Wed Dec 18 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
+- drop weak ciphers from the default TLS ciphersuite list
+- add back some symbols that were dropped with update to 1.0.1 branch
+- more FIPS validation requirement changes
+
+* Tue Nov 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
+- fix locking and reseeding problems with FIPS drbg
+
+* Fri Nov 15 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-33
+- additional changes required for FIPS validation
+
+* Wed Nov 13 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-32
+- disable verification of certificate, CRL, and OCSP signatures
+  using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
+  is not set
+
+* Fri Nov  8 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
+- add back support for secp521r1 EC curve
+- add aarch64 to Configure (#969692)
+
+* Tue Oct 29 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30
+- fix misdetection of RDRAND support on Cyrix CPUS (from upstream) (#1022346)
+
+* Thu Oct 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
+- do not advertise ECC curves we do not support (#1022493)
+
+* Wed Oct 16 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
+- only ECC NIST Suite B curves support
+- drop -fips subpackage
+
+* Mon Oct 14 2013 Tom Callaway <spot@fedoraproject.org> - 1.0.1e-27
+- resolve bugzilla 319901 (phew! only took 6 years & 9 days)
+
+* Fri Sep 27 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
+- make DTLS1 work in FIPS mode
+- avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode
+
+* Mon Sep 23 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-25
+- avoid dlopening libssl.so from libcrypto (#1010357)
+
+* Fri Sep 20 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-24
+- fix small memory leak in FIPS aes selftest
+
+* Thu Sep 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-23
+- fix segfault in openssl speed hmac in the FIPS mode
+
+* Thu Sep 12 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-22
+- document the nextprotoneg option in manual pages
+  original patch by Hubert Kario
+
+* Tue Sep 10 2013 Kyle McMartin <kyle@redhat.com> 1.0.1e-21
+- [arm] use elf auxv to figure out armcap.c instead of playing silly
+  games with SIGILL handlers. (#1006474)
+
+* Wed Sep  4 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-20
+- try to avoid some races when updating the -fips subpackage
+
+* Mon Sep  2 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-19
+- use version-release in .hmac suffix to avoid overwrite
+  during upgrade
+
+* Thu Aug 29 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-18
+- allow deinitialization of the FIPS mode
+
+* Thu Aug 29 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-17
+- always perform the FIPS selftests in library constructor
+  if FIPS module is installed
+
+* Tue Aug 27 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-16
+- add -fips subpackage that contains the FIPS module files
+
+* Fri Aug 16 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-15
+- fix use of rdrand if available
+- more commits cherry picked from upstream
+- documentation fixes
+
+* Sat Aug 03 2013 Petr Pisar <ppisar@redhat.com> - 1:1.0.1e-14
+- Perl 5.18 rebuild
+
+* Fri Jul 26 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-13
+- additional manual page fix
+- use symbol versioning also for the textual version
+
+* Thu Jul 25 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-12
+- additional manual page fixes
+
+* Fri Jul 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-11
+- use _prefix macro
+
+* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> - 1:1.0.1e-10
+- Perl 5.18 rebuild
+
+* Thu Jul 11 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-9
+- add openssl.cnf.5 manpage symlink to config.5
+
+* Wed Jul 10 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-8
+- add relro linking flag
+
+* Wed Jul 10 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-7
+- add support for the -trusted_first option for certificate chain verification
+
+* Fri May  3 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-6
+- fix build of manual pages with current pod2man (#959439)
+
+* Sun Apr 21 2013 Peter Robinson <pbrobinson@fedoraproject.org> 1.0.1e-5
+- Enable ARM optimised build
+
+* Mon Mar 18 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-4
+- fix random bad record mac errors (#918981)
+
+* Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-3
+- fix up the SHLIB_VERSION_NUMBER
+
+* Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-2
+- disable ZLIB loading by default (due to CRIME attack)
+
+* Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-1
+- new upstream version
+
+* Wed Jan 30 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1c-12
+- more fixes from upstream
+- fix errors in manual causing build failure (#904777)
+
+* Fri Dec 21 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
+- add script for renewal of a self-signed cert by Philip Prindeville (#871566)
+- allow X509_issuer_and_serial_hash() produce correct result in
+  the FIPS mode (#881336)
+
+* Thu Dec  6 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-10
+- do not load default verify paths if CApath or CAfile specified (#884305)
+
+* Tue Nov 20 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-9
+- more fixes from upstream CVS
+- fix DSA key pairwise check (#878597)
+
+* Thu Nov 15 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
+- use 1024 bit DH parameters in s_server as 512 bit is not allowed
+  in FIPS mode and it is quite weak anyway
+
+* Mon Sep 10 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
+- add missing initialization of str in aes_ccm_init_key (#853963)
+- add important patches from upstream CVS
+- use the secure_getenv() with new glibc
+
+* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.0.1c-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Fri Jul 13 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-5
+- use __getenv_secure() instead of __libc_enable_secure
+
+* Fri Jul 13 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
+- do not move libcrypto to /lib
+- do not use environment variables if __libc_enable_secure is on
+- fix strict aliasing problems in modes
+
+* Thu Jul 12 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
+- fix DSA key generation in FIPS mode (#833866)
+- allow duplicate FIPS_mode_set(1)
+- enable build on ppc64 subarch (#834652)
+
+* Wed Jul 11 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-2
+- fix s_server with new glibc when no global IPv6 address (#839031)
+- make it build with new Perl
+
+* Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-1
+- new upstream version
+
+* Thu Apr 26 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1b-1
+- new upstream version
+
+* Fri Apr 20 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1a-1
+- new upstream version fixing CVE-2012-2110
+
+* Wed Apr 11 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-3
+- add Kerberos 5 libraries to pkgconfig for static linking (#807050)
+
+* Thu Apr  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-2
+- backports from upstream CVS
+- fix segfault when /dev/urandom is not available (#809586)
+
+* Wed Mar 14 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-1
+- new upstream release
+
+* Mon Mar  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.3.beta3
+- add obsoletes to assist multilib updates (#799636)
+
+* Wed Feb 29 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
+- epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
+- new upstream release from the 1.0.1 branch
+- fix s390x build (#798411)
+- versioning for the SSLeay symbol (#794950)
+- add -DPURIFY to build flags (#797323)
+- filter engine provides
+- split the libraries to a separate -libs package
+- add make to requires on the base package (#783446)
+
+* Tue Feb  7 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
+- new upstream release from the 1.0.1 branch, ABI compatible
+- add documentation for the -no_ign_eof option
+
+* Thu Jan 19 2012 Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
+- new upstream release fixing CVE-2012-0050 - DoS regression in
+  DTLS support introduced by the previous release (#782795)
+
+* Thu Jan  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.0f-1
+- new upstream release fixing multiple CVEs
+
+* Tue Nov 22 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-4
+- move the libraries needed for static linking to Libs.private
+
+* Thu Nov  3 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
+- do not use AVX instructions when osxsave bit not set
+- add direct known answer tests for SHA2 algorithms
+
+* Wed Sep 21 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-2
+- fix missing initialization of variable in CHIL engine
+
+* Wed Sep  7 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-1
+- new upstream release fixing CVE-2011-3207 (#736088)
+
+* Wed Aug 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
+- drop the separate engine for Intel acceleration improvements
+  and merge in the AES-NI, SHA1, and RC4 optimizations
+- add support for OPENSSL_DISABLE_AES_NI environment variable
+  that disables the AES-NI support
+
+* Tue Jul 26 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
+- correct openssl cms help output (#636266)
+- more tolerant starttls detection in XMPP protocol (#608239)
+
+* Wed Jul 20 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
+- add support for newest Intel acceleration improvements backported
+  from upstream by Intel in form of a separate engine
+
+* Thu Jun  9 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-5
+- allow the AES-NI engine in the FIPS mode
+
+* Tue May 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-4
+- add API necessary for CAVS testing of the new DSA parameter generation
+
+* Thu Apr 28 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
+- add support for VIA Padlock on 64bit arch from upstream (#617539)
+- do not return bogus values from load_certs (#652286)
+
+* Tue Apr  5 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-2
+- clarify apps help texts for available digest algorithms (#693858)
+
+* Thu Feb 10 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-1
+- new upstream release fixing CVE-2011-0014 (OCSP stapling vulnerability)
+
+* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0c-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Fri Feb  4 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
+- add -x931 parameter to openssl genrsa command to use the ANSI X9.31
+  key generation method
+- use FIPS-186-3 method for DSA parameter generation
+- add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
+  to allow using MD5 when the system is in the maintenance state
+  even if the /proc fips flag is on
+- make openssl pkcs12 command work by default in the FIPS mode
+
+* Mon Jan 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
+- listen on ipv6 wildcard in s_server so we accept connections
+  from both ipv4 and ipv6 (#601612)
+- fix openssl speed command so it can be used in the FIPS mode
+  with FIPS allowed ciphers
+
+* Fri Dec  3 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0c-1
+- new upstream version fixing CVE-2010-4180
+
+* Tue Nov 23 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-3
+- replace the revert for the s390x bignum asm routines with
+  fix from upstream
+
+* Mon Nov 22 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-2
+- revert upstream change in s390x bignum asm routines
+
+* Tue Nov 16 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-1
+- new upstream version fixing CVE-2010-3864 (#649304)
+
+* Tue Sep  7 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-3
+- make SHLIB_VERSION reflect the library suffix
+
+* Wed Jun 30 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-2
+- openssl man page fix (#609484)
+
+* Fri Jun  4 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-1
+- new upstream patch release, fixes CVE-2010-0742 (#598738)
+  and CVE-2010-1633 (#598732)
+
+* Wed May 19 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-5
+- pkgconfig files now contain the correct libdir (#593723)
+
+* Tue May 18 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-4
+- make CA dir readable - the private keys are in private subdir (#584810)
+
+* Fri Apr  9 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-3
+- a few fixes from upstream CVS
+- move libcrypto to /lib (#559953)
+
+* Tue Apr  6 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-2
+- set UTC timezone on pod2man run (#578842)
+- make X509_NAME_hash_old work in FIPS mode
+
+* Tue Mar 30 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-1
+- update to final 1.0.0 upstream release
+
+* Tue Feb 16 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.22.beta5
+- make TLS work in the FIPS mode
+
+* Fri Feb 12 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
+- gracefully handle zero length in assembler implementations of
+  OPENSSL_cleanse (#564029)
+- do not fail in s_server if client hostname not resolvable (#561260)
+
+* Wed Jan 20 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.20.beta5
+- new upstream release
+
+* Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
+- fix CVE-2009-4355 - leak in applications incorrectly calling
+  CRYPTO_free_all_ex_data() before application exit (#546707)
+- upstream fix for future TLS protocol version handling
+
+* Wed Jan 13 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.18.beta4
+- add support for Intel AES-NI
+
+* Thu Jan  7 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
+- upstream fix compression handling on session resumption
+- various null checks and other small fixes from upstream
+- upstream changes for the renegotiation info according to the latest draft
+
+* Mon Nov 23 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.16.beta4
+- fix non-fips mingw build (patch by Kalev Lember)
+- add IPV6 fix for DTLS
+
+* Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.15.beta4
+- add better error reporting for the unsafe renegotiation
+
+* Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.14.beta4
+- fix build on s390x
+
+* Wed Nov 18 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
+- disable enforcement of the renegotiation extension on the client (#537962)
+- add fixes from the current upstream snapshot
+
+* Fri Nov 13 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
+- keep the beta status in version number at 3 so we do not have to rebuild
+  openssh and possibly other dependencies with too strict version check
+
+* Thu Nov 12 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
+- update to new upstream version, no soname bump needed
+- fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
+  so the compatibility with unfixed clients is not broken. The
+  protocol extension is also not final.
+
+* Fri Oct 16 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.10.beta3
+- fix use of freed memory if SSL_CTX_free() is called before
+  SSL_free() (#521342)
+
+* Thu Oct  8 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.9.beta3
+- fix typo in DTLS1 code (#527015)
+- fix leak in error handling of d2i_SSL_SESSION()
+
+* Wed Sep 30 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.8.beta3
+- fix RSA and DSA FIPS selftests
+- reenable fixed x86_64 camellia assembler code (#521127)
+
+* Fri Sep  4 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.7.beta3
+- temporarily disable x86_64 camellia assembler code (#521127)
+
+* Mon Aug 31 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.6.beta3
+- fix openssl dgst -dss1 (#520152)
+
+* Wed Aug 26 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.5.beta3
+- drop the compat symlink hacks
+
+* Sat Aug 22 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.4.beta3
+- constify SSL_CIPHER_description()
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.3.beta3
+- fix WWW:Curl:Easy reference in tsget
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.2.beta3
+- enable MD-2
+
+* Thu Aug 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.1.beta3
+- update to new major upstream release
+
+* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8k-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Wed Jul 22 2009 Bill Nottingham <notting@redhat.com>
+- do not build special 'optimized' versions for i686, as that's the base
+  arch in Fedora now
+
+* Tue Jun 30 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
+- abort if selftests failed and random number generator is polled
+- mention EVP_aes and EVP_sha2xx routines in the manpages
+- add README.FIPS
+- make CA dir absolute path (#445344)
+- change default length for RSA key generation to 2048 (#484101)
+
+* Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-5
+- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
+  (DTLS DoS problems) (#501253, #501254, #501572)
+
+* Tue Apr 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-4
+- support compatibility DTLS mode for CISCO AnyConnect (#464629)
+
+* Fri Apr 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-3
+- correct the SHLIB_VERSION define
+
+* Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-2
+- add support for multiple CRLs with same subject
+- load only dynamic engine support in FIPS mode
+
+* Wed Mar 25 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
+- update to new upstream release (minor bug fixes, security
+  fixes and machine code optimizations only)
+
+* Thu Mar 19 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-10
+- move libraries to /usr/lib (#239375)
+
+* Fri Mar 13 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-9
+- add a static subpackage
+
+* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8j-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Mon Feb  2 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
+- must also verify checksum of libssl.so in the FIPS mode
+- obtain the seed for FIPS rng directly from the kernel device
+- drop the temporary symlinks
+
+* Mon Jan 26 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
+- drop the temporary triggerpostun and symlinking in post
+- fix the pkgconfig files and drop the unnecessary buildrequires
+  on pkgconfig as it is a rpmbuild dependency (#481419)
+
+* Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-5
+- add temporary triggerpostun to reinstate the symlinks
+
+* Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-4
+- no pairwise key tests in non-fips mode (#479817)
+
+* Fri Jan 16 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-3
+- even more robust test for the temporary symlinks
+
+* Fri Jan 16 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-2
+- try to ensure the temporary symlinks exist
+
+* Thu Jan 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
+- new upstream version with necessary soname bump (#455753)
+- temporarily provide symlink to old soname to make it possible to rebuild
+  the dependent packages in rawhide
+- add eap-fast support (#428181)
+- add possibility to disable zlib by setting
+- add fips mode support for testing purposes
+- do not null dereference on some invalid smime files
+- add buildrequires pkgconfig (#479493)
+
+* Sun Aug 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-11
+- do not add tls extensions to server hello for SSLv3 either
+
+* Mon Jun  2 2008 Joe Orton <jorton@redhat.com> 0.9.8g-10
+- move root CA bundle to ca-certificates package
+
+* Wed May 28 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
+- fix CVE-2008-0891 - server name extension crash (#448492)
+- fix CVE-2008-1672 - server key exchange message omit crash (#448495)
+
+* Tue May 27 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-8
+- super-H arch support
+- drop workaround for bug 199604 as it should be fixed in gcc-4.3
+
+* Mon May 19 2008 Tom "spot" Callaway <tcallawa@redhat.com> 0.9.8g-7
+- sparc handling
+
+* Mon Mar 10 2008 Joe Orton <jorton@redhat.com> 0.9.8g-6
+- update to new root CA bundle from mozilla.org (r1.45)
+
+* Wed Feb 20 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 0.9.8g-5
+- Autorebuild for GCC 4.3
+
+* Thu Jan 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-4
+- merge review fixes (#226220)
+- adjust the SHLIB_VERSION_NUMBER to reflect library name (#429846)
+
+* Thu Dec 13 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
+- set default paths when no explicit paths are set (#418771)
+- do not add tls extensions to client hello for SSLv3 (#422081)
+
+* Tue Dec  4 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
+- enable some new crypto algorithms and features
+- add some more important bug fixes from openssl CVS
+
+* Mon Dec  3 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-1
+- update to latest upstream release, SONAME bumped to 7
+
+* Mon Oct 15 2007 Joe Orton <jorton@redhat.com> 0.9.8b-17
+- update to new CA bundle from mozilla.org
+
+* Fri Oct 12 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
+- fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
+- fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
+- add alpha sub-archs (#296031)
+
+* Tue Aug 21 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-15
+- rebuild
+
+* Fri Aug  3 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
+- use localhost in testsuite, hopefully fixes slow build in koji
+- CVE-2007-3108 - fix side channel attack on private keys (#250577)
+- make ssl session cache id matching strict (#233599)
+
+* Wed Jul 25 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
+- allow building on ARM architectures (#245417)
+- use reference timestamps to prevent multilib conflicts (#218064)
+- -devel package must require pkgconfig (#241031)
+
+* Mon Dec 11 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-12
+- detect duplicates in add_dir properly (#206346)
+
+* Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-11
+- the previous change still didn't make X509_NAME_cmp transitive
+
+* Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
+- make X509_NAME_cmp transitive otherwise certificate lookup
+  is broken (#216050)
+
+* Thu Nov  2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
+- aliasing bug in engine loading, patch by IBM (#213216)
+
+* Mon Oct  2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
+- CVE-2006-2940 fix was incorrect (#208744)
+
+* Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
+- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
+- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
+- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
+- fix CVE-2006-4343 - sslv2 client DoS (#206940)
+
+* Tue Sep  5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
+- fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
+
+* Wed Aug  2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
+- set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
+  patch by IBM
+
+* Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
+- rebuild with new binutils (#200330)
+
+* Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
+- add a temporary workaround for sha512 test failure on s390 (#199604)
+
+* Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
+- add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
+- add patches for BN threadsafety, AES cache collision attack hazard fix and
+  pkcs7 code memleak fix from upstream CVS
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
+- rebuild
+
+* Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
+- dropped libica and ica engine from build
+
+* Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
+- update to new CA bundle from mozilla.org; adds CA certificates
+  from netlock.hu and startcom.org
+
+* Mon Jun  5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
+- fixed a few rpmlint warnings
+- better fix for #173399 from upstream
+- upstream fix for pkcs12
+
+* Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
+- upgrade to new version, stays ABI compatible
+- there is no more linux/config.h (it was empty anyway)
+
+* Tue Apr  4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
+- fix stale open handles in libica (#177155)
+- fix build if 'rand' or 'passwd' in buildroot path (#178782)
+- initialize VIA Padlock engine (#186857)
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
+- bump again for double-long bug on ppc(64)
+
+* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
+- rebuilt for new gcc4.1 snapshot and glibc changes
+
+* Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
+- don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
+  in SSL_OP_ALL (#175779)
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
+- fix build (-lcrypto was erroneusly dropped) of the updated libica
+- updated ICA engine to 1.3.6-rc3
+
+* Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
+- disable builtin compression methods for now until they work
+  properly (#173399)
+
+* Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
+- don't set -rpath for openssl binary
+
+* Tue Nov  8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
+- new upstream version
+- patches partially renumbered
+
+* Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
+- updated IBM ICA engine library and patch to latest upstream version
+
+* Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
+- fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
+  disables the countermeasure against man in the middle attack in SSLv2
+  (#169863)
+- use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
+
+* Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
+- add *.so.soversion as symlinks in /lib (#165264)
+- remove unpackaged symlinks (#159595)
+- fixes from upstream (constant time fixes for DSA,
+  bn assembler div on ppc arch, initialize memory on realloc)
+
+* Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
+- Updated ICA engine IBM patch to latest upstream version.
+
+* Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
+- fix CAN-2005-0109 - use constant time/memory access mod_exp
+  so bits of private key aren't leaked by cache eviction (#157631)
+- a few more fixes from upstream 0.9.7g
+
+* Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
+- use poll instead of select in rand (#128285)
+- fix Makefile.certificate to point to /etc/pki/tls
+- change the default string mask in ASN1 to PrintableString+UTF8String
+
+* Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
+- update to revision 1.37 of Mozilla CA bundle
+
+* Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
+- move certificates to _sysconfdir/pki/tls (#143392)
+- move CA directories to _sysconfdir/pki/CA
+- patch the CA script and the default config so it points to the
+  CA directories
+
+* Fri Apr  1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
+- uninitialized variable mustn't be used as input in inline
+  assembly
+- reenable the x86_64 assembly again
+
+* Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
+- add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
+- disable broken bignum assembly on x86_64
+
+* Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
+- reenable optimizations on ppc64 and assembly code on ia64
+- upgrade to new upstream version (no soname bump needed)
+- disable thread test - it was testing the backport of the
+  RSA blinding - no longer needed
+- added support for changing serial number to
+  Makefile.certificate (#151188)
+- make ca-bundle.crt a config file (#118903)
+
+* Tue Mar  1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
+- libcrypto shouldn't depend on libkrb5 (#135961)
+
+* Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
+- rebuild
+
+* Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
+- new upstream source, updated patches
+- added patch so we are hopefully ABI compatible with upcoming
+  0.9.7f
+
+* Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
+- Support UTF-8 charset in the Makefile.certificate (#134944)
+- Added cmp to BuildPrereq
+
+* Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
+- generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
+
+* Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
+- Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
+
+* Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
+- rebuild
+
+* Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
+- rebuild
+
+* Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
+- rebuild
+
+* Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
+- remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
+
+* Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
+- Include latest libica version with important bugfixes
+
+* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
+- Updated ICA engine IBM patch to latest upstream version.
+
+* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
+- build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
+
+* Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
+- handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
+  header (#124303)
+
+* Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
+- add security fixes for CAN-2004-0079, CAN-2004-0112
+
+* Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
+- Fixed libica filespec.
+
+* Thu Mar 11 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
+- ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
+  the intermediate header
+
+* Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
+- add an intermediate <openssl/opensslconf.h> which points to the right
+  arch-specific opensslconf.h on multilib arches
+
+* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
+- Updated libica to latest upstream version 1.3.5.
+
+* Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
+- Update ICA crypto engine patch from IBM to latest version.
+
+* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
+- rebuilt
+
+* Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
+- Fixed libica build.
+
+* Wed Feb  4 2004 Nalin Dahyabhai <nalin@redhat.com>
+- add "-ldl" to link flags added for Linux-on-ARM (#99313)
+
+* Wed Feb  4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
+- updated ca-bundle.crt: removed expired GeoTrust roots, added
+  freessl.com root, removed trustcenter.de Class 0 root
+
+* Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
+- Fix link line for libssl (bug #111154).
+
+* Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
+- add dependency on zlib-devel for the -devel package, which depends on zlib
+  symbols because we enable zlib for libssl (#102962)
+
+* Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
+- Use /dev/urandom instead of PRNG for libica.
+- Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
+- Use latest ICA engine patch from IBM.
+
+* Sat Oct  4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
+- rebuild
+
+* Wed Oct  1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
+- rebuild (22 wasn't actually built, fun eh?)
+
+* Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
+- re-disable optimizations on ppc64
+
+* Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
+- add a_mbstr.c fix for 64-bit platforms from CVS
+
+* Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
+- add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
+  as not needing executable stacks
+
+* Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
+- rebuild
+
+* Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
+- re-enable optimizations on ppc64
+
+* Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
+- remove exclusivearch
+
+* Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
+- only parse a client cert if one was requested
+- temporarily exclusivearch for %%{ix86}
+
+* Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
+- add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
+  and heap corruption (CAN-2003-0545)
+- update RHNS-CA-CERT files
+- ease back on the number of threads used in the threading test
+
+* Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
+- rebuild to fix gzipped file md5sums (#91211)
+
+* Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
+- Updated libica to version 1.3.4.
+
+* Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
+- rebuild
+
+* Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
+- free the kssl_ctx structure when we free an SSL structure (#99066)
+
+* Fri Jul 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
+- rebuild
+
+* Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
+- lower thread test count on s390x
+
+* Tue Jul  8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
+- rebuild
+
+* Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
+- disable assembly on arches where it seems to conflict with threading
+
+* Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
+- Updated libica to latest upstream version 1.3.0
+
+* Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
+- rebuild
+
+* Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
+- rebuild
+
+* Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
+- ubsec: don't stomp on output data which might also be input data
+
+* Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
+- temporarily disable optimizations on ppc64
+
+* Mon Jun  9 2003 Nalin Dahyabhai <nalin@redhat.com>
+- backport fix for engine-used-for-everything from 0.9.7b
+- backport fix for prng not being seeded causing problems, also from 0.9.7b
+- add a check at build-time to ensure that RSA is thread-safe
+- keep perlpath from stomping on the libica configure scripts
+
+* Fri Jun  6 2003 Nalin Dahyabhai <nalin@redhat.com>
+- thread-safety fix for RSA blinding
+
+* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
+- rebuilt
+
+* Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
+- Added libica-1.2 to openssl (featurerequest).
+
+* Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
+- fix building with incorrect flags on ppc64
+
+* Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
+- add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
+  attack (CAN-2003-0131)
+
+* Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com>  0.9.7a-4
+- add patch to enable RSA blinding by default, closing a timing attack
+  (CAN-2003-0147)
+
+* Wed Mar  5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
+- disable use of BN assembly module on x86_64, but continue to allow inline
+  assembly (#83403)
+
+* Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
+- disable EC algorithms
+
+* Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
+- update to 0.9.7a
+
+* Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
+- add fix to guard against attempts to allocate negative amounts of memory
+- add patch for CAN-2003-0078, fixing a timing attack
+
+* Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
+- Add openssl-ppc64.patch
+
+* Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
+- EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
+  to get the right behavior when passed uninitialized context structures
+  (#83766)
+- build with -mcpu=ev5 on alpha family (#83828)
+
+* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
+- rebuilt
+
+* Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
+- Added IBM hw crypto support patch.
+
+* Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
+- add missing builddep on sed
+
+* Thu Jan  9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
+- debloat
+- fix broken manpage symlinks
+
+* Wed Jan  8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
+- fix double-free in 'openssl ca'
+
+* Fri Jan  3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
+- update to 0.9.7 final
+
+* Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
+- update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
+
+* Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
+- update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
+
+* Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
+- add configuration stanza for x86_64 and use it on x86_64
+- build for linux-ppc on ppc
+- start running the self-tests again
+
+* Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
+- Merge fixes from previous hammer packages, including general x86-64 and
+  multilib
+
+* Tue Aug  6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
+- rebuild
+
+* Thu Aug  1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
+- update asn patch to fix accidental reversal of a logic check
+
+* Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
+- update asn patch to reduce chance that compiler optimization will remove
+  one of the added tests
+
+* Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
+- rebuild
+
+* Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
+- add patch to fix ASN.1 vulnerabilities
+
+* Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
+- add backport of Ben Laurie's patches for OpenSSL 0.9.6d
+
+* Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
+- own {_datadir}/ssl/misc
+
+* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Sun May 26 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
+- free ride through the build system (whee!)
+
+* Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
+- rebuild in new environment
+
+* Thu Apr  4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
+- merge RHL-specific bits into stronghold package, rename
+
+* Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
+- add support for Chrysalis Luna token
+
+* Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
+- disable AEP random number generation, other AEP fixes
+
+* Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
+- only build subpackages on primary arches
+
+* Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
+- on ia32, only disable use of assembler on i386
+- enable assembly on ia64
+
+* Mon Jan  7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
+- fix sparcv9 entry
+
+* Mon Jan  7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
+- upgrade to 0.9.6c
+- bump BuildArch to i686 and enable assembler on all platforms
+- synchronise with shrimpy and rawhide
+- bump soversion to 3
+
+* Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
+- delete BN_LLONG for s390x, patch from Oliver Paukstadt
+
+* Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
+- update AEP driver patch
+
+* Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
+- adjust RNG disabling patch to match version of patch from Broadcom
+
+* Fri Sep  7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
+- disable the RNG in the ubsec engine driver
+
+* Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
+- tweaks to the ubsec engine driver
+
+* Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
+- tweaks to the ubsec engine driver
+
+* Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
+- update ubsec engine driver from Broadcom
+
+* Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
+- move man pages back to %%{_mandir}/man?/foo.?ssl from
+  %%{_mandir}/man?ssl/foo.?
+- add an [ engine ] section to the default configuration file
+
+* Thu Aug  9 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add a patch for selecting a default engine in SSL_library_init()
+
+* Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
+- add patches for AEP hardware support
+- add patch to keep trying when we fail to load a cert from a file and
+  there are more in the file
+- add missing prototype for ENGINE_ubsec() in engine_int.h
+
+* Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
+- actually add hw_ubsec to the engine list
+
+* Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add in the hw_ubsec driver from CVS
+
+* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
+- update to 0.9.6b
+
+* Thu Jul  5 2001 Nalin Dahyabhai <nalin@redhat.com>
+- move .so symlinks back to %%{_libdir}
+
+* Tue Jul  3 2001 Nalin Dahyabhai <nalin@redhat.com>
+- move shared libraries to /lib (#38410)
+
+* Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
+- switch to engine code base
+
+* Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add a script for creating dummy certificates
+- move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
+
+* Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
+- add s390x support
+
+* Fri Jun  1 2001 Nalin Dahyabhai <nalin@redhat.com>
+- change two memcpy() calls to memmove()
+- don't define L_ENDIAN on alpha
+
+* Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
+- Add 'stronghold-' prefix to package names.
+- Obsolete standard openssl packages.
+
+* Wed May 16 2001 Joe Orton <jorton@redhat.com>
+- Add BuildArch: i586 as per Nalin's advice.
+
+* Tue May 15 2001 Joe Orton <jorton@redhat.com>
+- Enable assembler on ix86 (using new .tar.bz2 which does
+  include the asm directories).
+
+* Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
+- make subpackages depend on the main package
+
+* Tue May  1 2001 Nalin Dahyabhai <nalin@redhat.com>
+- adjust the hobble script to not disturb symlinks in include/ (fix from
+  Joe Orton)
+
+* Fri Apr 27 2001 Nalin Dahyabhai <nalin@redhat.com>
+- drop the m2crypo patch we weren't using
+
+* Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
+- configure using "shared" as well
+
+* Sun Apr  8 2001 Nalin Dahyabhai <nalin@redhat.com>
+- update to 0.9.6a
+- use the build-shared target to build shared libraries
+- bump the soversion to 2 because we're no longer compatible with
+  our 0.9.5a packages or our 0.9.6 packages
+- drop the patch for making rsatest a no-op when rsa null support is used
+- put all man pages into <section>ssl instead of <section>
+- break the m2crypto modules into a separate package
+
+* Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
+- use BN_LLONG on s390
+
+* Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
+- fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
+
+* Sat Mar  3 2001 Nalin Dahyabhai <nalin@redhat.com>
+- move c_rehash to the perl subpackage, because it's a perl script now
+
+* Fri Mar  2 2001 Nalin Dahyabhai <nalin@redhat.com>
+- update to 0.9.6
+- enable MD2
+- use the libcrypto.so and libssl.so targets to build shared libs with
+- bump the soversion to 1 because we're no longer compatible with any of
+  the various 0.9.5a packages circulating around, which provide lib*.so.0
+
+* Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
+- change hobble-openssl for disabling MD2 again
+
+* Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
+- re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
+  bytes or so, causing EVP_DigestInit() to zero out stack variables in
+  apps built against a version of the library without it
+
+* Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
+- disable some inline assembly, which on x86 is Pentium-specific
+- re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
+
+* Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
+- fix s390 patch
+
+* Fri Dec 8 2000 Than Ngo <than@redhat.com>
+- added support s390
+
+* Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
+- remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
+- add the CA.pl man page to the perl subpackage
+
+* Thu Nov  2 2000 Nalin Dahyabhai <nalin@redhat.com>
+- always build with -mcpu=ev5 on alpha
+
+* Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add a symlink from cert.pem to ca-bundle.crt
+
+* Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add a ca-bundle file for packages like Samba to reference for CA certificates
+
+* Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
+- remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
+
+* Mon Oct  2 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add unzip as a buildprereq (#17662)
+- update m2crypto to 0.05-snap4
+
+* Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
+- fix some issues in building when it's not installed
+
+* Wed Sep  6 2000 Nalin Dahyabhai <nalin@redhat.com>
+- make sure the headers we include are the ones we built with (aaaaarrgh!)
+
+* Fri Sep  1 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add Richard Henderson's patch for BN on ia64
+- clean up the changelog
+
+* Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix the building of python modules without openssl-devel already installed
+
+* Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
+- byte-compile python extensions without the build-root
+- adjust the makefile to not remove temporary files (like .key files when
+  building .csr files) by marking them as .PRECIOUS
+
+* Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
+- break out python extensions into a subpackage
+
+* Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
+- tweak the makefile some more
+
+* Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
+- disable MD2 support
+
+* Thu Jul  6 2000 Nalin Dahyabhai <nalin@redhat.com>
+- disable MDC2 support
+
+* Sun Jul  2 2000 Nalin Dahyabhai <nalin@redhat.com>
+- tweak the disabling of RC5, IDEA support
+- tweak the makefile
+
+* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
+- strip binaries and libraries
+- rework certificate makefile to have the right parts for Apache
+
+* Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
+- use %%{_perl} instead of /usr/bin/perl
+- disable alpha until it passes its own test suite
+
+* Fri Jun  9 2000 Nalin Dahyabhai <nalin@redhat.com>
+- move the passwd.1 man page out of the passwd package's way
+
+* Fri Jun  2 2000 Nalin Dahyabhai <nalin@redhat.com>
+- update to 0.9.5a, modified for U.S.
+- add perl as a build-time requirement
+- move certificate makefile to another package
+- disable RC5, IDEA, RSA support
+- remove optimizations for now
+
+* Wed Mar  1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
+- Bero told me to move the Makefile into this package
+
+* Wed Mar  1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
+- add lib*.so symlinks to link dynamically against shared libs
+
+* Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
+- update to 0.9.5
+- run ldconfig directly in post/postun
+- add FAQ
+
+* Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
+- Fix build on non-x86 platforms
+
+* Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
+- move /usr/share/ssl/* from -devel to main package
+
+* Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
+- inital packaging
+- changes from base:
+  - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
+  - handle RPM_OPT_FLAGS