Changeset 372 for asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src

Timestamp:

Feb 7, 2019, 8:36:33 AM (5 years ago)

Author:

coas-nagasima

Message:

wolfsslを3.15.7にバージョンアップ

Location:

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src

Files:

• aes.c (modified) (111 diffs)
• arc4.c (modified) (1 diff)
• asn.c (modified) (323 diffs)
• blake2b.c (modified) (5 diffs)
• camellia.c (modified) (2 diffs)
• coding.c (modified) (8 diffs)
• des3.c (modified) (4 diffs)
• dh.c (modified) (21 diffs)
• dsa.c (modified) (4 diffs)
• ecc.c (modified) (242 diffs)
• error.c (modified) (6 diffs)
• hash.c (modified) (31 diffs)
• hc128.c (modified) (2 diffs)
• hmac.c (modified) (35 diffs)
• integer.c (modified) (18 diffs)
• logging.c (modified) (26 diffs)
• md4.c (modified) (1 diff)
• md5.c (modified) (8 diffs)
• memory.c (modified) (11 diffs)
• misc.c (modified) (19 diffs)
• pwdbased.c (modified) (14 diffs)
• rabbit.c (modified) (2 diffs)
• random.c (modified) (53 diffs)
• ripemd.c (modified) (1 diff)
• rsa.c (modified) (89 diffs)
• sha.c (modified) (14 diffs)
• sha256.c (modified) (51 diffs)
• sha512.c (modified) (45 diffs)
• wc_encrypt.c (modified) (2 diffs)
• wc_port.c (modified) (20 diffs)
• wolfmath.c (modified) (4 diffs)

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/aes.c

@@ -28 +28 @@
 #include <wolfssl/wolfcrypt/error-crypt.h>
 
-#ifndef NO_AES
+#if !defined(NO_AES)
+
+/* Tip: Locate the software cipher modes by searching for "Software AES" */
+
+#if defined(HAVE_FIPS) && \
+    defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$g")
+        #pragma const_seg(".fipsB$g")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/aes.h>
 #include <wolfssl/wolfcrypt/cpuid.h>
 
+#ifdef WOLF_CRYPTO_DEV
+    #include <wolfssl/wolfcrypt/cryptodev.h>
+#endif
+
 
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
     int wc_AesSetKey(Aes* aes, const byte* key, word32 len, const byte* iv,
                               int dir)
@@ -173 +194 @@
 
     /* AES-CCM */
-    #ifdef HAVE_AESCCM
-        void wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz)
+    #if defined(HAVE_AESCCM) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+        int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz)
         {
-            AesCcmSetKey(aes, key, keySz);
+            return AesCcmSetKey(aes, key, keySz);
         }
         int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
@@ -210 +232 @@
             }
         #endif /* HAVE_AES_DECRYPT */
-    #endif /* HAVE_AESCCM */
+    #endif /* HAVE_AESCCM && HAVE_FIPS_VERSION 2 */
 
     int  wc_AesInit(Aes* aes, void* h, int i)
     {
-        (void)aes;
+        if (aes == NULL)
+            return BAD_FUNC_ARG;
+
         (void)h;
         (void)i;
+
         /* FIPS doesn't support:
             return AesInit(aes, h, i); */
@@ -228 +253 @@
     }
 
-#else /* HAVE_FIPS */
+#else /* else build without fips, or for FIPS v2 */
 
 
@@ -244 +269 @@
 #endif
 
-#ifndef WOLFSSL_ARMASM
+#if !defined(WOLFSSL_ARMASM)
+
+#ifdef WOLFSSL_IMX6_CAAM_BLOB
+    /* case of possibly not using hardware acceleration for AES but using key
+       blobs */
+    #include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>
+#endif
 
 #ifdef DEBUG_AESNI
@@ -258 +289 @@
 /* Define AES implementation includes and functions */
 #if defined(STM32_CRYPTO)
-     /* STM32F2/F4 hardware AES support for CBC, CTR modes */
-
-    /* CRYPT_AES_GCM starts the IV with 2 */
-    #define STM32_GCM_IV_START 2
+     /* STM32F2/F4/F7/L4 hardware AES support for ECB, CBC, CTR and GCM modes */
 
 #if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESGCM) || defined(HAVE_AESCCM)
+
     static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
     {
@@ -269 +298 @@
     #ifdef WOLFSSL_STM32_CUBEMX
         CRYP_HandleTypeDef hcryp;
-
-        XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-        switch(aes->rounds) {
-            case 10: /* 128-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-                break;
-            case 12: /* 192-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                break;
-            case 14: /* 256-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                break;
-            default:
-                break;
-        }
-        hcryp.Instance = CRYP;
-        hcryp.Init.DataType = CRYP_DATATYPE_8B;
-        hcryp.Init.pKey = (uint8_t*)aes->key;
-
+    #else
+        CRYP_InitTypeDef cryptInit;
+        CRYP_KeyInitTypeDef keyInit;
+    #endif
+
+    #ifdef WOLFSSL_STM32_CUBEMX
+        ret = wc_Stm32_Aes_Init(aes, &hcryp);
+        if (ret != 0)
+            return ret;
+
+    #ifdef STM32_CRYPTO_AES_ONLY
+        hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
+        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_ECB;
+        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;
+    #endif
         HAL_CRYP_Init(&hcryp);
 
-        if (HAL_CRYP_AESECB_Encrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
-                                    outBlock, STM32_HAL_TIMEOUT) != HAL_OK) {
+    #ifdef STM32_CRYPTO_AES_ONLY
+        ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
+            outBlock, STM32_HAL_TIMEOUT);
+    #else
+        ret = HAL_CRYP_AESECB_Encrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
+            outBlock, STM32_HAL_TIMEOUT);
+    #endif
+        if (ret != HAL_OK) {
             ret = WC_TIMEOUT_E;
         }
-
         HAL_CRYP_DeInit(&hcryp);
-    #else
-        word32 *enc_key;
-        CRYP_InitTypeDef AES_CRYP_InitStructure;
-        CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure;
-
-        enc_key = aes->key;
-
-        /* crypto structure initialization */
-        CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure);
-        CRYP_StructInit(&AES_CRYP_InitStructure);
+
+    #else /* STD_PERI_LIB */
+        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
+        if (ret != 0)
+            return ret;
 
         /* reset registers to their default values */
         CRYP_DeInit();
 
-        /* load key into correct registers */
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b;
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3];
-                break;
-
-            case 12: /* 192-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b;
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5];
-                break;
-
-            case 14: /* 256-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b;
-                AES_CRYP_KeyInitStructure.CRYP_Key0Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[6];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7];
-                break;
-
-            default:
-                break;
-        }
-        CRYP_KeyInit(&AES_CRYP_KeyInitStructure);
-
-        /* set direction, mode, and datatype */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-        CRYP_Init(&AES_CRYP_InitStructure);
+        /* setup key */
+        CRYP_KeyInit(&keyInit);
+
+        /* set direction and mode */
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
+        CRYP_Init(&cryptInit);
 
         /* enable crypto processor */
@@ -386 +376 @@
     #ifdef WOLFSSL_STM32_CUBEMX
         CRYP_HandleTypeDef hcryp;
-
-        XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-        switch(aes->rounds) {
-            case 10: /* 128-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-                break;
-            case 12: /* 192-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                break;
-            case 14: /* 256-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                break;
-            default:
-                break;
-        }
-        hcryp.Instance = CRYP;
-        hcryp.Init.DataType = CRYP_DATATYPE_8B;
-        hcryp.Init.pKey = (uint8_t*)aes->key;
-
+    #else
+        CRYP_InitTypeDef cryptInit;
+        CRYP_KeyInitTypeDef keyInit;
+    #endif
+
+    #ifdef WOLFSSL_STM32_CUBEMX
+        ret = wc_Stm32_Aes_Init(aes, &hcryp);
+        if (ret != 0)
+            return ret;
+
+    #ifdef STM32_CRYPTO_AES_ONLY
+        hcryp.Init.OperatingMode = CRYP_ALGOMODE_DECRYPT;
+        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_ECB;
+        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;
+    #endif
         HAL_CRYP_Init(&hcryp);
 
-        if (HAL_CRYP_AESECB_Decrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
-                                       outBlock, STM32_HAL_TIMEOUT) != HAL_OK) {
+    #ifdef STM32_CRYPTO_AES_ONLY
+        ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
+            outBlock, STM32_HAL_TIMEOUT);
+    #else
+        ret = HAL_CRYP_AESECB_Decrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE,
+            outBlock, STM32_HAL_TIMEOUT)
+    #endif
+        if (ret != HAL_OK) {
             ret = WC_TIMEOUT_E;
         }
-
         HAL_CRYP_DeInit(&hcryp);
-    #else
-        word32 *enc_key;
-        CRYP_InitTypeDef AES_CRYP_InitStructure;
-        CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure;
-
-        enc_key = aes->key;
-
-        /* crypto structure initialization */
-        CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure);
-        CRYP_StructInit(&AES_CRYP_InitStructure);
+
+    #else /* STD_PERI_LIB */
+        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
+        if (ret != 0)
+            return ret;
 
         /* reset registers to their default values */
         CRYP_DeInit();
 
-        /* load key into correct registers */
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b;
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3];
-                break;
-
-            case 12: /* 192-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b;
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5];
-                break;
-
-            case 14: /* 256-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b;
-                AES_CRYP_KeyInitStructure.CRYP_Key0Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[6];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7];
-                break;
-
-            default:
-                break;
-        }
-        CRYP_KeyInit(&AES_CRYP_KeyInitStructure);
-
-        /* set direction, key, and datatype */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-        CRYP_Init(&AES_CRYP_InitStructure);
+        /* set direction and key */
+        CRYP_KeyInit(&keyInit);
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
+        CRYP_Init(&cryptInit);
 
         /* enable crypto processor */
         CRYP_Cmd(ENABLE);
 
-        /* wait until decrypt key has been intialized */
+        /* wait until decrypt key has been initialized */
         while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
 
-        /* set direction, mode, and datatype */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-        CRYP_Init(&AES_CRYP_InitStructure);
+        /* set direction and mode */
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB;
+        CRYP_Init(&cryptInit);
 
         /* enable crypto processor */
@@ -782 +730 @@
     #endif /* HAVE_AES_DECRYPT */
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+        static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
+        {
+            wc_AesEncryptDirect(aes, outBlock, inBlock);
+            return 0;
+        }
+
+#elif defined(WOLFSSL_AFALG)
+#elif defined(WOLFSSL_DEVCRYPTO_AES)
+    /* if all AES is enabled with devcrypto then tables are not needed */
+
 #else
 
-    /* using wolfCrypt software AES implementation */
+    /* using wolfCrypt software implementation */
     #define NEED_AES_TABLES
 #endif
@@ -1336 +1295 @@
 
 
+#if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)
 static const byte Td4[256] =
 {
@@ -1371 +1331 @@
     0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
 };
+#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
 #endif /* HAVE_AES_DECRYPT */
 
@@ -1391 +1352 @@
 
 /* load 4 Te Tables into cache by cache line stride */
-static INLINE word32 PreFetchTe(void)
+static WC_INLINE word32 PreFetchTe(void)
 {
     word32 x = 0;
@@ -1405 +1366 @@
 }
 
-
+/* Software AES - ECB Encrypt */
 static void wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 {
@@ -1415 +1376 @@
     if (r > 7 || r == 0) {
         WOLFSSL_MSG("AesEncrypt encountered improper key, set it up");
-        return;  /* stop instead of segfaulting, set up your keys! */
+        return;  /* stop instead of seg-faulting, set up your keys! */
     }
 
@@ -1594 +1555 @@
 
 #if defined(HAVE_AES_DECRYPT)
-#if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)
+#if (defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT)) && \
+    !defined(WOLFSSL_DEVCRYPTO_CBC)
 
 /* load 4 Td Tables into cache by cache line stride */
-static INLINE word32 PreFetchTd(void)
+static WC_INLINE word32 PreFetchTd(void)
 {
     word32 x = 0;
@@ -1612 +1574 @@
 
 /* load Td Table4 into cache by cache line stride */
-static INLINE word32 PreFetchTd4(void)
+static WC_INLINE word32 PreFetchTd4(void)
 {
     word32 x = 0;
@@ -1623 +1585 @@
 }
 
+/* Software AES - ECB Decrypt */
 static void wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 {
@@ -1632 +1595 @@
     if (r > 7 || r == 0) {
         WOLFSSL_MSG("AesDecrypt encountered improper key, set it up");
-        return;  /* stop instead of segfaulting, set up your keys! */
+        return;  /* stop instead of seg-faulting, set up your keys! */
     }
 #ifdef WOLFSSL_AESNI
@@ -1803 +1766 @@
         (void)dir;
 
-        if (!((keylen == 16) || (keylen == 24) || (keylen == 32)))
+        if (keylen != 16 &&
+        #ifdef WOLFSSL_AES_192
+            keylen != 24 &&
+        #endif
+            keylen != 32) {
             return BAD_FUNC_ARG;
+        }
 
         aes->keylen = keylen;
@@ -1812 +1780 @@
         ByteReverseWords(rk, rk, keylen);
     #endif
-    #ifdef WOLFSSL_AES_COUNTER
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
         aes->left = 0;
     #endif
@@ -1885 +1853 @@
             XMEMCPY(aes->reg, iv, AES_BLOCK_SIZE);
 
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
+        aes->left = 0;
+    #endif
+
         return 0;
     }
@@ -1891 +1863 @@
                   int dir)
     {
-        if (!((keylen == 16) || (keylen == 24) || (keylen == 32)))
+        if (aes == NULL || !((keylen == 16) || (keylen == 24) || (keylen == 32)))
             return BAD_FUNC_ARG;
 
         aes->rounds = keylen/4 + 6;
         XMEMCPY(aes->key, userKey, keylen);
-    #ifdef WOLFSSL_AES_COUNTER
+
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
         aes->left = 0;
     #endif
@@ -1923 +1896 @@
             return BAD_FUNC_ARG;
 
-    #ifdef WOLFSSL_AES_COUNTER
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
         aes->left = 0;
     #endif
-        aes->keylen = keylen;
+
         aes->rounds = keylen/4 + 6;
 
@@ -1966 +1939 @@
         ret = nrf51_aes_set_key(userKey);
 
+    #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
+        aes->left = 0;
+    #endif
+
         return ret;
     }
@@ -1975 +1952 @@
     }
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+      /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
+
+#elif defined(WOLFSSL_AFALG)
+    /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_AES)
+    /* implemented in wolfcrypt/src/port/devcrypto/devcrypto_aes.c */
+
 #else
+
+    /* Software AES - SetKey */
     static int wc_AesSetKeyLocal(Aes* aes, const byte* userKey, word32 keylen,
                 const byte* iv, int dir)
@@ -1988 +1976 @@
         aes->use_aesni = 0;
     #endif /* WOLFSSL_AESNI */
-    #ifdef WOLFSSL_AES_COUNTER
+        #if defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_COUNTER)
         aes->left = 0;
-    #endif /* WOLFSSL_AES_COUNTER */
+        #endif
 
         aes->keylen = keylen;
@@ -2003 +1991 @@
 
         switch (keylen) {
-    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128
+    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 && \
+            defined(WOLFSSL_AES_128)
         case 16:
             while (1)
@@ -2024 +2013 @@
     #endif /* 128 */
 
-    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192
+    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192 && \
+            defined(WOLFSSL_AES_192)
         case 24:
             /* for (;;) here triggers a bug in VC60 SP4 w/ Pro Pack */
@@ -2048 +2038 @@
     #endif /* 192 */
 
-    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256
+    #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256 && \
+            defined(WOLFSSL_AES_256)
         case 32:
             while (1)
@@ -2132 +2123 @@
         const byte* iv, int dir)
     {
+        int ret;
     #if defined(AES_MAX_KEY_SIZE)
         const word32 max_key_len = (AES_MAX_KEY_SIZE / 8);
     #endif
 
+    #ifdef WOLFSSL_IMX6_CAAM_BLOB
+        byte   local[32];
+        word32 localSz = 32;
+
+        if (keylen == (16 + WC_CAAM_BLOB_SZ) ||
+                keylen == (24 + WC_CAAM_BLOB_SZ) ||
+                keylen == (32 + WC_CAAM_BLOB_SZ)) {
+            if (wc_caamOpenBlob((byte*)userKey, keylen, local, &localSz) != 0) {
+                return BAD_FUNC_ARG;
+            }
+
+            /* set local values */
+            userKey = local;
+            keylen = localSz;
+        }
+    #endif
         if (aes == NULL ||
                 !((keylen == 16) || (keylen == 24) || (keylen == 32))) {
@@ -2164 +2172 @@
         }
         if (haveAESNI) {
-            #ifdef WOLFSSL_AES_COUNTER
+            #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB)
                 aes->left = 0;
             #endif /* WOLFSSL_AES_COUNTER */
@@ -2179 +2187 @@
     #endif /* WOLFSSL_AESNI */
 
-        return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir);
+        ret = wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir);
+
+    #if defined(WOLFSSL_DEVCRYPTO) && \
+        (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
+        aes->ctx.cfd = -1;
+        XMEMCPY(aes->devKey, userKey, keylen);
+    #endif
+    #ifdef WOLFSSL_IMX6_CAAM_BLOB
+        ForceZero(local, sizeof(local));
+    #endif
+        return ret;
     }
 
@@ -2187 +2205 @@
                             const byte* iv, int dir)
         {
-            return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir);
+            int ret;
+
+        #ifdef WOLFSSL_IMX6_CAAM_BLOB
+            byte   local[32];
+            word32 localSz = 32;
+
+            if (keylen == (16 + WC_CAAM_BLOB_SZ) ||
+             keylen == (24 + WC_CAAM_BLOB_SZ) ||
+             keylen == (32 + WC_CAAM_BLOB_SZ)) {
+                if (wc_caamOpenBlob((byte*)userKey, keylen, local, &localSz)
+                        != 0) {
+                    return BAD_FUNC_ARG;
+                }
+
+                /* set local values */
+                userKey = local;
+                keylen = localSz;
+            }
+        #endif
+            ret = wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir);
+
+        #ifdef WOLFSSL_IMX6_CAAM_BLOB
+            ForceZero(local, sizeof(local));
+        #endif
+
+            return ret;
         }
     #endif /* WOLFSSL_AES_DIRECT || WOLFSSL_AES_COUNTER */
@@ -2239 +2282 @@
         }
 
+    #elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+        /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
+
+    #elif defined(WOLFSSL_AFALG)
+        /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
+
+    #elif defined(WOLFSSL_DEVCRYPTO_AES)
+        /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
+
     #else
         /* Allow direct access to one block encrypt */
@@ -2267 +2319 @@
         CRYP_HandleTypeDef hcryp;
 
-        XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-                break;
-            case 12: /* 192-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                break;
-            case 14: /* 256-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                break;
-            default:
-                break;
-        }
-        hcryp.Instance = CRYP;
-        hcryp.Init.DataType = CRYP_DATATYPE_8B;
-        hcryp.Init.pKey = (uint8_t*)aes->key;
+        ret = wc_Stm32_Aes_Init(aes, &hcryp);
+        if (ret != 0)
+            return ret;
+
+    #ifdef STM32_CRYPTO_AES_ONLY
+        hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
+        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_CBC;
+        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;
+    #endif
         hcryp.Init.pInitVect = (uint8_t*)aes->reg;
-
         HAL_CRYP_Init(&hcryp);
 
         while (blocks--) {
-            if (HAL_CRYP_AESCBC_Encrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
-                                           out, STM32_HAL_TIMEOUT) != HAL_OK) {
+        #ifdef STM32_CRYPTO_AES_ONLY
+            ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #else
+            ret = HAL_CRYP_AESCBC_Encrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #endif
+            if (ret != HAL_OK) {
                 ret = WC_TIMEOUT_E;
                 break;
@@ -2314 +2363 @@
         CRYP_HandleTypeDef hcryp;
 
-        XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
+        ret = wc_Stm32_Aes_Init(aes, &hcryp);
+        if (ret != 0)
+            return ret;
+
+        /* if input and output same will overwrite input iv */
+        XMEMCPY(aes->tmp, in + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+
+    #ifdef STM32_CRYPTO_AES_ONLY
+        hcryp.Init.OperatingMode = CRYP_ALGOMODE_KEYDERIVATION_DECRYPT;
+        hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_CBC;
+        hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;
+    #endif
+
+        hcryp.Init.pInitVect = (uint8_t*)aes->reg;
+        HAL_CRYP_Init(&hcryp);
+
+        while (blocks--) {
+        #ifdef STM32_CRYPTO_AES_ONLY
+            ret = HAL_CRYPEx_AES(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #else
+            ret = HAL_CRYP_AESCBC_Decrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #endif
+            if (ret != HAL_OK) {
+                ret = WC_TIMEOUT_E;
                 break;
-            case 12: /* 192-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                break;
-            case 14: /* 256-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                break;
-            default:
-                break;
-        }
-        hcryp.Instance = CRYP;
-        hcryp.Init.DataType = CRYP_DATATYPE_8B;
-        hcryp.Init.pKey = (uint8_t*)aes->key;
-        hcryp.Init.pInitVect = (uint8_t*)aes->reg;
-
-        HAL_CRYP_Init(&hcryp);
-
-        while (blocks--) {
-            if (HAL_CRYP_AESCBC_Decrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE,
-                                           out, STM32_HAL_TIMEOUT) != HAL_OK) {
-                ret = WC_TIMEOUT_E;
             }
 
@@ -2353 +2404 @@
     }
     #endif /* HAVE_AES_DECRYPT */
-#else
+
+#else /* STD_PERI_LIB */
     int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
-        word32 *enc_key, *iv;
+        int ret;
+        word32 *iv;
         word32 blocks = (sz / AES_BLOCK_SIZE);
-        CRYP_InitTypeDef AES_CRYP_InitStructure;
-        CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure;
-        CRYP_IVInitTypeDef AES_CRYP_IVInitStructure;
-
-        enc_key = aes->key;
-        iv = aes->reg;
-
-        /* crypto structure initialization */
-        CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure);
-        CRYP_StructInit(&AES_CRYP_InitStructure);
-        CRYP_IVStructInit(&AES_CRYP_IVInitStructure);
+        CRYP_InitTypeDef cryptInit;
+        CRYP_KeyInitTypeDef keyInit;
+        CRYP_IVInitTypeDef ivInit;
+
+        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
+        if (ret != 0)
+            return ret;
 
         /* reset registers to their default values */
         CRYP_DeInit();
 
-        /* load key into correct registers */
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b;
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3];
-                break;
-
-            case 12: /* 192-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b;
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5];
-                break;
-
-            case 14: /* 256-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b;
-                AES_CRYP_KeyInitStructure.CRYP_Key0Left  = enc_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[6];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7];
-                break;
-
-            default:
-                break;
-        }
-        CRYP_KeyInit(&AES_CRYP_KeyInitStructure);
+        /* set key */
+        CRYP_KeyInit(&keyInit);
 
         /* set iv */
+        iv = aes->reg;
+        CRYP_IVStructInit(&ivInit);
         ByteReverseWords(iv, iv, AES_BLOCK_SIZE);
-        AES_CRYP_IVInitStructure.CRYP_IV0Left  = iv[0];
-        AES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1];
-        AES_CRYP_IVInitStructure.CRYP_IV1Left  = iv[2];
-        AES_CRYP_IVInitStructure.CRYP_IV1Right = iv[3];
-        CRYP_IVInit(&AES_CRYP_IVInitStructure);
-
-        /* set direction, mode, and datatype */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-        CRYP_Init(&AES_CRYP_InitStructure);
+        ivInit.CRYP_IV0Left  = iv[0];
+        ivInit.CRYP_IV0Right = iv[1];
+        ivInit.CRYP_IV1Left  = iv[2];
+        ivInit.CRYP_IV1Right = iv[3];
+        CRYP_IVInit(&ivInit);
+
+        /* set direction and mode */
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
+        CRYP_Init(&cryptInit);
 
         /* enable crypto processor */
@@ -2455 +2471 @@
         CRYP_Cmd(DISABLE);
 
-        return 0;
+        return ret;
     }
 
@@ -2461 +2477 @@
     int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
-        word32 *dec_key, *iv;
+        int ret;
+        word32 *iv;
         word32 blocks = (sz / AES_BLOCK_SIZE);
-        CRYP_InitTypeDef AES_CRYP_InitStructure;
-        CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure;
-        CRYP_IVInitTypeDef AES_CRYP_IVInitStructure;
-
-        dec_key = aes->key;
-        iv = aes->reg;
-
-        /* crypto structure initialization */
-        CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure);
-        CRYP_StructInit(&AES_CRYP_InitStructure);
-        CRYP_IVStructInit(&AES_CRYP_IVInitStructure);
+        CRYP_InitTypeDef cryptInit;
+        CRYP_KeyInitTypeDef keyInit;
+        CRYP_IVInitTypeDef ivInit;
+
+        ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
+        if (ret != 0)
+            return ret;
 
         /* if input and output same will overwrite input iv */
@@ -2481 +2494 @@
         CRYP_DeInit();
 
-        /* load key into correct registers */
-        switch (aes->rounds) {
-            case 10: /* 128-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b;
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = dec_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = dec_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[3];
-                break;
-
-            case 12: /* 192-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b;
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = dec_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = dec_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = dec_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = dec_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[5];
-                break;
-
-            case 14: /* 256-bit key */
-                AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b;
-                AES_CRYP_KeyInitStructure.CRYP_Key0Left  = dec_key[0];
-                AES_CRYP_KeyInitStructure.CRYP_Key0Right = dec_key[1];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Left  = dec_key[2];
-                AES_CRYP_KeyInitStructure.CRYP_Key1Right = dec_key[3];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Left  = dec_key[4];
-                AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[5];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Left  = dec_key[6];
-                AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[7];
-                break;
-
-            default:
-                break;
-        }
-
-        /* set direction, mode, and datatype for key preparation */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_32b;
-        CRYP_Init(&AES_CRYP_InitStructure);
-        CRYP_KeyInit(&AES_CRYP_KeyInitStructure);
+        /* set direction and key */
+        CRYP_KeyInit(&keyInit);
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key;
+        CRYP_Init(&cryptInit);
 
         /* enable crypto processor */
@@ -2530 +2506 @@
         while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {}
 
-        /* set direction, mode, and datatype for decryption */
-        AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
-        AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
-        AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-        CRYP_Init(&AES_CRYP_InitStructure);
+        /* set direction and mode */
+        cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Decrypt;
+        cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC;
+        CRYP_Init(&cryptInit);
 
         /* set iv */
+        iv = aes->reg;
+        CRYP_IVStructInit(&ivInit);
         ByteReverseWords(iv, iv, AES_BLOCK_SIZE);
-
-        AES_CRYP_IVInitStructure.CRYP_IV0Left  = iv[0];
-        AES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1];
-        AES_CRYP_IVInitStructure.CRYP_IV1Left  = iv[2];
-        AES_CRYP_IVInitStructure.CRYP_IV1Right = iv[3];
-        CRYP_IVInit(&AES_CRYP_IVInitStructure);
+        ivInit.CRYP_IV0Left  = iv[0];
+        ivInit.CRYP_IV0Right = iv[1];
+        ivInit.CRYP_IV1Left  = iv[2];
+        ivInit.CRYP_IV1Right = iv[3];
+        CRYP_IVInit(&ivInit);
 
         /* enable crypto processor */
@@ -2575 +2551 @@
         CRYP_Cmd(DISABLE);
 
-        return 0;
+        return ret;
     }
     #endif /* HAVE_AES_DECRYPT */
@@ -2704 +2680 @@
         status = LTC_AES_EncryptCbc(LTC_BASE, in, out, blocks * AES_BLOCK_SIZE,
             iv, enc_key, keySize);
+
+        /* store iv for next call */
+        if (status == kStatus_Success) {
+            XMEMCPY(iv, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+        }
+
         return (status == kStatus_Success) ? 0 : -1;
     }
@@ -2714 +2696 @@
         byte* iv, *dec_key;
         word32 blocks = (sz / AES_BLOCK_SIZE);
+        byte temp_block[AES_BLOCK_SIZE];
 
         iv      = (byte*)aes->reg;
@@ -2723 +2706 @@
         }
 
+        /* get IV for next call */
+        XMEMCPY(temp_block, in + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+
         status = LTC_AES_DecryptCbc(LTC_BASE, in, out, blocks * AES_BLOCK_SIZE,
             iv, dec_key, keySize, kLTC_EncryptKey);
+
+        /* store IV for next call */
+        if (status == kStatus_Success) {
+            XMEMCPY(iv, temp_block, AES_BLOCK_SIZE);
+        }
+
         return (status == kStatus_Success) ? 0 : -1;
     }
@@ -2791 +2783 @@
     int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
-        return wc_Pic32AesCrypt(
+        int ret;
+
+        /* hardware fails on input that is not a multiple of AES block size */
+        if (sz % AES_BLOCK_SIZE != 0) {
+            return BAD_FUNC_ARG;
+        }
+
+        ret = wc_Pic32AesCrypt(
             aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
             out, in, sz, PIC32_ENCRYPTION,
             PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC);
+
+        /* store iv for next call */
+        if (ret == 0) {
+            XMEMCPY(aes->reg, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+        }
+
+        return ret;
     }
     #ifdef HAVE_AES_DECRYPT
     int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
-        return wc_Pic32AesCrypt(
+        int ret;
+        byte scratch[AES_BLOCK_SIZE];
+
+        /* hardware fails on input that is not a multiple of AES block size */
+        if (sz % AES_BLOCK_SIZE != 0) {
+            return BAD_FUNC_ARG;
+        }
+        XMEMCPY(scratch, in + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+
+        ret = wc_Pic32AesCrypt(
             aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
             out, in, sz, PIC32_DECRYPTION,
             PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC);
+
+        /* store iv for next call */
+        if (ret == 0) {
+            XMEMCPY((byte*)aes->reg, scratch, AES_BLOCK_SIZE);
+        }
+
+        return ret;
     }
     #endif /* HAVE_AES_DECRYPT */
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+      /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
+
+#elif defined(WOLFSSL_AFALG)
+    /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_CBC)
+    /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
+
 #else
 
+    /* Software AES - CBC Encrypt */
     int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
@@ -2897 +2929 @@
 
     #ifdef HAVE_AES_DECRYPT
+    /* Software AES - CBC Decrypt */
     int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
@@ -2977 +3010 @@
 #endif /* HAVE_AES_CBC */
 
-#ifdef HAVE_AES_ECB
-int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
-    if ((in == NULL) || (out == NULL) || (aes == NULL))
-      return BAD_FUNC_ARG;
-    while (sz>0) {
-      wc_AesEncryptDirect(aes, out, in);
-      out += AES_BLOCK_SIZE;
-      in  += AES_BLOCK_SIZE;
-      sz  -= AES_BLOCK_SIZE;
-    }
-    return 0;
-}
-int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
-{
-    if ((in == NULL) || (out == NULL) || (aes == NULL))
-      return BAD_FUNC_ARG;
-    while (sz>0) {
-      wc_AesDecryptDirect(aes, out, in);
-      out += AES_BLOCK_SIZE;
-      in  += AES_BLOCK_SIZE;
-      sz  -= AES_BLOCK_SIZE;
-    }
-    return 0;
-}
-#endif
-
 /* AES-CTR */
 #if defined(WOLFSSL_AES_COUNTER)
@@ -3016 +3022 @@
         #ifdef WOLFSSL_STM32_CUBEMX
             CRYP_HandleTypeDef hcryp;
-
-            XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-            switch (aes->rounds) {
-                case 10: /* 128-bit key */
-                    hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-                    break;
-                case 12: /* 192-bit key */
-                    hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                    break;
-                case 14: /* 256-bit key */
-                    hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                    break;
-                default:
-                    break;
-            }
-            hcryp.Instance = CRYP;
-            hcryp.Init.DataType = CRYP_DATATYPE_8B;
-            hcryp.Init.pKey = (byte*)aes->key;
-            hcryp.Init.pInitVect = (byte*)aes->reg;
-
+        #else
+            word32 *iv;
+            CRYP_InitTypeDef cryptInit;
+            CRYP_KeyInitTypeDef keyInit;
+            CRYP_IVInitTypeDef ivInit;
+        #endif
+
+        #ifdef WOLFSSL_STM32_CUBEMX
+            ret = wc_Stm32_Aes_Init(aes, &hcryp);
+            if (ret != 0)
+                return ret;
+
+        #ifdef STM32_CRYPTO_AES_ONLY
+            hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
+            hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_CTR;
+            hcryp.Init.KeyWriteFlag  = CRYP_KEY_WRITE_ENABLE;
+        #endif
+            hcryp.Init.pInitVect = (uint8_t*)aes->reg;
             HAL_CRYP_Init(&hcryp);
 
-            if (HAL_CRYP_AESCTR_Encrypt(&hcryp, (byte*)in, AES_BLOCK_SIZE, out,
-                                                STM32_HAL_TIMEOUT) != HAL_OK) {
-                /* failed */
+        #ifdef STM32_CRYPTO_AES_ONLY
+            ret = HAL_CRYPEx_AES(&hcryp, (byte*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #else
+            ret = HAL_CRYP_AESCTR_Encrypt(&hcryp, (byte*)in, AES_BLOCK_SIZE,
+                out, STM32_HAL_TIMEOUT);
+        #endif
+            if (ret != HAL_OK) {
                 ret = WC_TIMEOUT_E;
             }
-
             HAL_CRYP_DeInit(&hcryp);
 
         #else /* STD_PERI_LIB */
-            word32 *enc_key, *iv;
-            CRYP_InitTypeDef AES_CRYP_InitStructure;
-            CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure;
-            CRYP_IVInitTypeDef AES_CRYP_IVInitStructure;
-
-            enc_key = aes->key;
-            iv = aes->reg;
-
-            /* crypto structure initialization */
-            CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure);
-            CRYP_StructInit(&AES_CRYP_InitStructure);
-            CRYP_IVStructInit(&AES_CRYP_IVInitStructure);
+            ret = wc_Stm32_Aes_Init(aes, &cryptInit, &keyInit);
+            if (ret != 0)
+                return ret;
 
             /* reset registers to their default values */
             CRYP_DeInit();
 
-            /* load key into correct registers */
-            switch (aes->rounds) {
-                case 10: /* 128-bit key */
-                    AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b;
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[0];
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[2];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3];
-                    break;
-                case 12: /* 192-bit key */
-                    AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b;
-                    AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[0];
-                    AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1];
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[2];
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[4];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5];
-                    break;
-                case 14: /* 256-bit key */
-                    AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b;
-                    AES_CRYP_KeyInitStructure.CRYP_Key0Left  = enc_key[0];
-                    AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1];
-                    AES_CRYP_KeyInitStructure.CRYP_Key1Left  = enc_key[2];
-                    AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3];
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Left  = enc_key[4];
-                    AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Left  = enc_key[6];
-                    AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7];
-                    break;
-                default:
-                    break;
-            }
-            CRYP_KeyInit(&AES_CRYP_KeyInitStructure);
+            /* set key */
+            CRYP_KeyInit(&keyInit);
 
             /* set iv */
-            AES_CRYP_IVInitStructure.CRYP_IV0Left  = ByteReverseWord32(iv[0]);
-            AES_CRYP_IVInitStructure.CRYP_IV0Right = ByteReverseWord32(iv[1]);
-            AES_CRYP_IVInitStructure.CRYP_IV1Left  = ByteReverseWord32(iv[2]);
-            AES_CRYP_IVInitStructure.CRYP_IV1Right = ByteReverseWord32(iv[3]);
-            CRYP_IVInit(&AES_CRYP_IVInitStructure);
-
-            /* set direction, mode, and datatype */
-            AES_CRYP_InitStructure.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
-            AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CTR;
-            AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b;
-            CRYP_Init(&AES_CRYP_InitStructure);
+            iv = aes->reg;
+            CRYP_IVStructInit(&ivInit);
+            ivInit.CRYP_IV0Left  = ByteReverseWord32(iv[0]);
+            ivInit.CRYP_IV0Right = ByteReverseWord32(iv[1]);
+            ivInit.CRYP_IV1Left  = ByteReverseWord32(iv[2]);
+            ivInit.CRYP_IV1Right = ByteReverseWord32(iv[3]);
+            CRYP_IVInit(&ivInit);
+
+            /* set direction and mode */
+            cryptInit.CRYP_AlgoDir  = CRYP_AlgoDir_Encrypt;
+            cryptInit.CRYP_AlgoMode = CRYP_AlgoMode_AES_CTR;
+            CRYP_Init(&cryptInit);
 
             /* enable crypto processor */
@@ -3188 +3157 @@
         }
 
+    #elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+        /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
+
+    #elif defined(WOLFSSL_AFALG)
+        /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
+
+    #elif defined(WOLFSSL_DEVCRYPTO_AES)
+        /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
+
     #else
 
@@ -3196 +3174 @@
     #ifdef NEED_AES_CTR_SOFT
         /* Increment AES counter */
-        static INLINE void IncrementAesCounter(byte* inOutCtr)
+        static WC_INLINE void IncrementAesCounter(byte* inOutCtr)
         {
             /* in network byte order so start at end and work back */
@@ -3206 +3184 @@
         }
 
+        /* Software AES - CTR Encrypt */
         int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
         {
@@ -3258 +3237 @@
 
 #endif /* WOLFSSL_AES_COUNTER */
+#endif /* !WOLFSSL_ARMASM */
+
+
+/*
+ * The IV for AES GCM and CCM, stored in struct Aes's member reg, is comprised
+ * of two parts in order:
+ *   1. The fixed field which may be 0 or 4 bytes long. In TLS, this is set
+ *      to the implicit IV.
+ *   2. The explicit IV is generated by wolfCrypt. It needs to be managed
+ *      by wolfCrypt to ensure the IV is unique for each call to encrypt.
+ * The IV may be a 96-bit random value, or the 32-bit fixed value and a
+ * 64-bit set of 0 or random data. The final 32-bits of reg is used as a
+ * block counter during the encryption.
+ */
+
+#if (defined(HAVE_AESGCM) && !defined(WC_NO_RNG)) || defined(HAVE_AESCCM)
+static WC_INLINE void IncCtr(byte* ctr, word32 ctrSz)
+{
+    int i;
+    for (i = ctrSz-1; i >= 0; i--) {
+        if (++ctr[i])
+            break;
+    }
+}
+#endif /* HAVE_AESGCM || HAVE_AESCCM */
 
 
 #ifdef HAVE_AESGCM
-
-/*
- * The IV for AES GCM, stored in struct Aes's member reg, is comprised of
- * three parts in order:
- *   1. The implicit IV. This is generated from the PRF using the shared
- *      secrets between endpoints. It is 4 bytes long.
- *   2. The explicit IV. This is set by the user of the AES. It needs to be
- *      unique for each call to encrypt. The explicit IV is shared with the
- *      other end of the transaction in the clear.
- *   3. The counter. Each block of data is encrypted with its own sequence
- *      number counter.
- */
 
 #if defined(HAVE_COLDFIRE_SEC)
@@ -3282 +3274 @@
 #endif
 
-enum {
-    NONCE_SZ = 12,
-    CTR_SZ   = 4
-};
+#ifdef WOLFSSL_ARMASM
+    /* implementation is located in wolfcrypt/src/port/arm/armv8-aes.c */
+
+#elif defined(WOLFSSL_AFALG)
+    /* implemented in wolfcrypt/src/port/afalg/afalg_aes.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_AES)
+    /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
+
+#else /* software + AESNI implementation */
 
 #if !defined(FREESCALE_LTC_AES_GCM)
-static INLINE void IncrementGcmCounter(byte* inOutCtr)
+static WC_INLINE void IncrementGcmCounter(byte* inOutCtr)
 {
     int i;
@@ -3302 +3300 @@
 #if defined(GCM_SMALL) || defined(GCM_TABLE)
 
-static INLINE void FlattenSzInBits(byte* buf, word32 sz)
+static WC_INLINE void FlattenSzInBits(byte* buf, word32 sz)
 {
     /* Multiply the sz by 8 */
@@ -3320 +3318 @@
 
 
-static INLINE void RIGHTSHIFTX(byte* x)
+static WC_INLINE void RIGHTSHIFTX(byte* x)
 {
     int i;
@@ -3364 +3362 @@
 #endif /* GCM_TABLE */
 
-
+/* Software AES - GCM SetKey */
 int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
 {
     int  ret;
     byte iv[AES_BLOCK_SIZE];
+
+    #ifdef WOLFSSL_IMX6_CAAM_BLOB
+        byte   local[32];
+        word32 localSz = 32;
+
+        if (len == (16 + WC_CAAM_BLOB_SZ) ||
+          len == (24 + WC_CAAM_BLOB_SZ) ||
+          len == (32 + WC_CAAM_BLOB_SZ)) {
+            if (wc_caamOpenBlob((byte*)key, len, local, &localSz) != 0) {
+                 return BAD_FUNC_ARG;
+            }
+
+            /* set local values */
+            key = local;
+            len = localSz;
+        }
+    #endif
 
     if (!((len == 16) || (len == 24) || (len == 32)))
@@ -3393 +3408 @@
 #if defined(WOLFSSL_XILINX_CRYPT)
     wc_AesGcmSetKey_ex(aes, key, len, XSECURE_CSU_AES_KEY_SRC_KUP);
+#endif
+
+#ifdef WOLFSSL_IMX6_CAAM_BLOB
+    ForceZero(local, sizeof(local));
 #endif
 
@@ -3416 +3435 @@
 #endif
 
-static const __m128i MOD2_128 = M128_INIT(0x1, 0xc200000000000000UL);
+static const __m128i MOD2_128 = M128_INIT(0x1,
+                                           (long long int)0xc200000000000000UL);
+
+
+/* See Intel® Carry-Less Multiplication Instruction
+ * and its Usage for Computing the GCM Mode White Paper
+ * by Shay Gueron, Intel Mobility Group, Israel Development Center;
+ * and Michael E. Kounavis, Intel Labs, Circuits and Systems Research */
+
+
+/* Figure 9. AES-GCM – Encrypt With Single Block Ghash at a Time */
+
+static const __m128i ONE   = M128_INIT(0x0, 0x1);
+#ifndef AES_GCM_AESNI_NO_UNROLL
+static const __m128i TWO   = M128_INIT(0x0, 0x2);
+static const __m128i THREE = M128_INIT(0x0, 0x3);
+static const __m128i FOUR  = M128_INIT(0x0, 0x4);
+static const __m128i FIVE  = M128_INIT(0x0, 0x5);
+static const __m128i SIX   = M128_INIT(0x0, 0x6);
+static const __m128i SEVEN = M128_INIT(0x0, 0x7);
+static const __m128i EIGHT = M128_INIT(0x0, 0x8);
+#endif
+static const __m128i BSWAP_EPI64 = M128_INIT(0x0001020304050607, 0x08090a0b0c0d0e0f);
+static const __m128i BSWAP_MASK  = M128_INIT(0x08090a0b0c0d0e0f, 0x0001020304050607);
+
+
+#ifndef _MSC_VER
+
+#define _VAR(a) "" #a ""
+#define VAR(a) _VAR(a)
+
+#define HR     %%xmm14
+#define XR     %%xmm15
+#define KR     %%ebx
+#define KR64   %%rbx
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+#define CTR1   128(%%rsp)
+#define TR     144(%%rsp)
+#define HTR    %%rsp
+#define STACK_OFFSET    160
+#else
+#define CTR1   (%%rsp)
+#define TR     16(%%rsp)
+#define STACK_OFFSET    32
+#endif
+
+#define AESENC()                      \
+    "aesenc     %%xmm12, %%xmm4\n\t"  \
+    "aesenc     %%xmm12, %%xmm5\n\t"  \
+    "aesenc     %%xmm12, %%xmm6\n\t"  \
+    "aesenc     %%xmm12, %%xmm7\n\t"  \
+    "aesenc     %%xmm12, %%xmm8\n\t"  \
+    "aesenc     %%xmm12, %%xmm9\n\t"  \
+    "aesenc     %%xmm12, %%xmm10\n\t" \
+    "aesenc     %%xmm12, %%xmm11\n\t"
+
+#define AESENC_SET(o)                        \
+    "movdqa     " #o "(%[KEY]), %%xmm12\n\t" \
+    AESENC()
+
+#define AESENC_CTR()                        \
+    "movdqu     " VAR(CTR1) ", %%xmm4\n\t"  \
+    "movdqa     %[BSWAP_EPI64], %%xmm1\n\t" \
+    "movdqu     %%xmm4, %%xmm0\n\t"         \
+    "pshufb     %%xmm1, %%xmm4\n\t"         \
+    "movdqa     %%xmm0, %%xmm5\n\t"         \
+    "paddd      %[ONE], %%xmm5\n\t"         \
+    "pshufb     %%xmm1, %%xmm5\n\t"         \
+    "movdqa     %%xmm0, %%xmm6\n\t"         \
+    "paddd      %[TWO], %%xmm6\n\t"         \
+    "pshufb     %%xmm1, %%xmm6\n\t"         \
+    "movdqa     %%xmm0, %%xmm7\n\t"         \
+    "paddd      %[THREE], %%xmm7\n\t"       \
+    "pshufb     %%xmm1, %%xmm7\n\t"         \
+    "movdqa     %%xmm0, %%xmm8\n\t"         \
+    "paddd      %[FOUR], %%xmm8\n\t"        \
+    "pshufb     %%xmm1, %%xmm8\n\t"         \
+    "movdqa     %%xmm0, %%xmm9\n\t"         \
+    "paddd      %[FIVE], %%xmm9\n\t"        \
+    "pshufb     %%xmm1, %%xmm9\n\t"         \
+    "movdqa     %%xmm0, %%xmm10\n\t"        \
+    "paddd      %[SIX], %%xmm10\n\t"        \
+    "pshufb     %%xmm1, %%xmm10\n\t"        \
+    "movdqa     %%xmm0, %%xmm11\n\t"        \
+    "paddd      %[SEVEN], %%xmm11\n\t"      \
+    "pshufb     %%xmm1, %%xmm11\n\t"        \
+    "paddd      %[EIGHT], %%xmm0\n\t"
+
+#define AESENC_XOR()                       \
+    "movdqa     (%[KEY]), %%xmm12\n\t"     \
+    "movdqu     %%xmm0, " VAR(CTR1) "\n\t" \
+    "pxor       %%xmm12, %%xmm4\n\t"       \
+    "pxor       %%xmm12, %%xmm5\n\t"       \
+    "pxor       %%xmm12, %%xmm6\n\t"       \
+    "pxor       %%xmm12, %%xmm7\n\t"       \
+    "pxor       %%xmm12, %%xmm8\n\t"       \
+    "pxor       %%xmm12, %%xmm9\n\t"       \
+    "pxor       %%xmm12, %%xmm10\n\t"      \
+    "pxor       %%xmm12, %%xmm11\n\t"
+
+/* Encrypt and carry-less multiply for AVX1. */
+#define AESENC_PCLMUL_1(src, o1, o2, o3)            \
+    "movdqu     " #o3 "(" VAR(HTR) "), %%xmm12\n\t" \
+    "movdqu     " #o2 "(" #src "), %%xmm0\n\t"      \
+    "aesenc     " #o1 "(%[KEY]), %%xmm4\n\t"        \
+    "pshufb     %[BSWAP_MASK], %%xmm0\n\t"          \
+    "pxor       %%xmm2, %%xmm0\n\t"                 \
+    "pshufd     $0x4e, %%xmm12, %%xmm1\n\t"         \
+    "pshufd     $0x4e, %%xmm0, %%xmm14\n\t"         \
+    "pxor       %%xmm12, %%xmm1\n\t"                \
+    "pxor       %%xmm0, %%xmm14\n\t"                \
+    "movdqa     %%xmm0, %%xmm3\n\t"                 \
+    "pclmulqdq  $0x11, %%xmm12, %%xmm3\n\t"         \
+    "aesenc     " #o1 "(%[KEY]), %%xmm5\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm6\n\t"        \
+    "movdqa     %%xmm0, %%xmm2\n\t"                 \
+    "pclmulqdq  $0x00, %%xmm12, %%xmm2\n\t"         \
+    "aesenc     " #o1 "(%[KEY]), %%xmm7\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm8\n\t"        \
+    "pclmulqdq  $0x00, %%xmm14, %%xmm1\n\t"         \
+    "aesenc     " #o1 "(%[KEY]), %%xmm9\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm10\n\t"       \
+    "aesenc     " #o1 "(%[KEY]), %%xmm11\n\t"       \
+    "pxor      %%xmm2, %%xmm1\n\t"                  \
+    "pxor      %%xmm3, %%xmm1\n\t"                  \
+
+#define AESENC_PCLMUL_N(src, o1, o2, o3)            \
+    "movdqu     " #o3 "(" VAR(HTR) "), %%xmm12\n\t" \
+    "movdqu     " #o2 "(" #src" ), %%xmm0\n\t"      \
+    "pshufd     $0x4e, %%xmm12, %%xmm13\n\t"        \
+    "pshufb     %[BSWAP_MASK], %%xmm0\n\t"          \
+    "aesenc     " #o1 "(%[KEY]), %%xmm4\n\t"        \
+    "pxor       %%xmm12, %%xmm13\n\t"               \
+    "pshufd     $0x4e, %%xmm0, %%xmm14\n\t"         \
+    "pxor       %%xmm0, %%xmm14\n\t"                \
+    "movdqa     %%xmm0, %%xmm15\n\t"                \
+    "pclmulqdq  $0x11, %%xmm12, %%xmm15\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm5\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm6\n\t"        \
+    "pclmulqdq  $0x00, %%xmm0, %%xmm12\n\t"         \
+    "aesenc     " #o1 "(%[KEY]), %%xmm7\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm8\n\t"        \
+    "pclmulqdq  $0x00, %%xmm14, %%xmm13\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm9\n\t"        \
+    "aesenc     " #o1 "(%[KEY]), %%xmm10\n\t"       \
+    "aesenc     " #o1 "(%[KEY]), %%xmm11\n\t"       \
+    "pxor      %%xmm12, %%xmm1\n\t"                 \
+    "pxor      %%xmm12, %%xmm2\n\t"                 \
+    "pxor      %%xmm15, %%xmm1\n\t"                 \
+    "pxor      %%xmm15, %%xmm3\n\t"                 \
+    "pxor      %%xmm13, %%xmm1\n\t"                 \
+
+#define AESENC_PCLMUL_L(o)                   \
+    "movdqa     %%xmm1, %%xmm14\n\t"         \
+    "psrldq     $8, %%xmm1\n\t"              \
+    "pslldq     $8, %%xmm14\n\t"             \
+    "aesenc     " #o "(%[KEY]), %%xmm4\n\t"  \
+    "pxor      %%xmm14, %%xmm2\n\t"          \
+    "pxor      %%xmm1, %%xmm3\n\t"           \
+    "movdqa     %%xmm2, %%xmm12\n\t"         \
+    "movdqa     %%xmm2, %%xmm13\n\t"         \
+    "movdqa     %%xmm2, %%xmm14\n\t"         \
+    "aesenc     " #o "(%[KEY]), %%xmm5\n\t"  \
+    "pslld      $31, %%xmm12\n\t"            \
+    "pslld      $30, %%xmm13\n\t"            \
+    "pslld      $25, %%xmm14\n\t"            \
+    "aesenc     " #o "(%[KEY]), %%xmm6\n\t"  \
+    "pxor       %%xmm13, %%xmm12\n\t"        \
+    "pxor       %%xmm14, %%xmm12\n\t"        \
+    "aesenc     " #o "(%[KEY]), %%xmm7\n\t"  \
+    "movdqa     %%xmm12, %%xmm13\n\t"        \
+    "pslldq     $12, %%xmm12\n\t"            \
+    "psrldq     $4, %%xmm13\n\t"             \
+    "aesenc     " #o "(%[KEY]), %%xmm8\n\t"  \
+    "pxor       %%xmm12, %%xmm2\n\t"         \
+    "movdqa     %%xmm2, %%xmm14\n\t"         \
+    "movdqa     %%xmm2, %%xmm1\n\t"          \
+    "movdqa     %%xmm2, %%xmm0\n\t"          \
+    "aesenc     " #o "(%[KEY]), %%xmm9\n\t"  \
+    "psrld      $1, %%xmm14\n\t"             \
+    "psrld      $2, %%xmm1\n\t"              \
+    "psrld      $7, %%xmm0\n\t"              \
+    "aesenc     " #o "(%[KEY]), %%xmm10\n\t" \
+    "pxor       %%xmm1, %%xmm14\n\t"         \
+    "pxor       %%xmm0, %%xmm14\n\t"         \
+    "aesenc     " #o "(%[KEY]), %%xmm11\n\t" \
+    "pxor       %%xmm13, %%xmm14\n\t"        \
+    "pxor       %%xmm14, %%xmm2\n\t"         \
+    "pxor       %%xmm3, %%xmm2\n\t"          \
+
+/* Encrypt and carry-less multiply with last key. */
+#define AESENC_LAST(in, out)                \
+    "aesenclast %%xmm12, %%xmm4\n\t"        \
+    "aesenclast %%xmm12, %%xmm5\n\t"        \
+    "movdqu        (" #in "),%%xmm0\n\t"    \
+    "movdqu      16(" #in "),%%xmm1\n\t"    \
+    "pxor       %%xmm0, %%xmm4\n\t"         \
+    "pxor       %%xmm1, %%xmm5\n\t"         \
+    "movdqu     %%xmm4,    (" #out ")\n\t"  \
+    "movdqu     %%xmm5,  16(" #out ")\n\t"  \
+    "aesenclast %%xmm12, %%xmm6\n\t"        \
+    "aesenclast %%xmm12, %%xmm7\n\t"        \
+    "movdqu      32(" #in "),%%xmm0\n\t"    \
+    "movdqu      48(" #in "),%%xmm1\n\t"    \
+    "pxor       %%xmm0, %%xmm6\n\t"         \
+    "pxor       %%xmm1, %%xmm7\n\t"         \
+    "movdqu     %%xmm6,  32(" #out ")\n\t"  \
+    "movdqu     %%xmm7,  48(" #out ")\n\t"  \
+    "aesenclast %%xmm12, %%xmm8\n\t"        \
+    "aesenclast %%xmm12, %%xmm9\n\t"        \
+    "movdqu      64(" #in "),%%xmm0\n\t"    \
+    "movdqu      80(" #in "),%%xmm1\n\t"    \
+    "pxor       %%xmm0, %%xmm8\n\t"         \
+    "pxor       %%xmm1, %%xmm9\n\t"         \
+    "movdqu     %%xmm8,  64(" #out ")\n\t"  \
+    "movdqu     %%xmm9,  80(" #out ")\n\t"  \
+    "aesenclast %%xmm12, %%xmm10\n\t"       \
+    "aesenclast %%xmm12, %%xmm11\n\t"       \
+    "movdqu      96(" #in "),%%xmm0\n\t"    \
+    "movdqu     112(" #in "),%%xmm1\n\t"    \
+    "pxor       %%xmm0, %%xmm10\n\t"        \
+    "pxor       %%xmm1, %%xmm11\n\t"        \
+    "movdqu     %%xmm10,  96(" #out ")\n\t" \
+    "movdqu     %%xmm11, 112(" #out ")\n\t"
+
+#define _AESENC_AVX(r)                    \
+    "aesenc     16(%[KEY]), " #r "\n\t"   \
+    "aesenc     32(%[KEY]), " #r "\n\t"   \
+    "aesenc     48(%[KEY]), " #r "\n\t"   \
+    "aesenc     64(%[KEY]), " #r "\n\t"   \
+    "aesenc     80(%[KEY]), " #r "\n\t"   \
+    "aesenc     96(%[KEY]), " #r "\n\t"   \
+    "aesenc     112(%[KEY]), " #r "\n\t"  \
+    "aesenc     128(%[KEY]), " #r "\n\t"  \
+    "aesenc     144(%[KEY]), " #r "\n\t"  \
+    "cmpl       $11, %[nr]\n\t"           \
+    "movdqa     160(%[KEY]), %%xmm5\n\t"  \
+    "jl         %=f\n\t"                  \
+    "aesenc     %%xmm5, " #r "\n\t"       \
+    "aesenc     176(%[KEY]), " #r "\n\t"  \
+    "cmpl       $13, %[nr]\n\t"           \
+    "movdqa     192(%[KEY]), %%xmm5\n\t"  \
+    "jl         %=f\n\t"                  \
+    "aesenc     %%xmm5, " #r "\n\t"       \
+    "aesenc     208(%[KEY]), " #r "\n\t"  \
+    "movdqa     224(%[KEY]), %%xmm5\n\t"  \
+    "%=:\n\t"                             \
+    "aesenclast %%xmm5, " #r "\n\t"
+#define AESENC_AVX(r)                     \
+        _AESENC_AVX(r)
+
+#define AESENC_BLOCK(in, out)               \
+    "movdqu     " VAR(CTR1) ", %%xmm4\n\t"  \
+    "movdqu     %%xmm4, %%xmm5\n\t"         \
+    "pshufb     %[BSWAP_EPI64], %%xmm4\n\t" \
+    "paddd      %[ONE], %%xmm5\n\t"         \
+    "pxor       (%[KEY]), %%xmm4\n\t"       \
+    "movdqu     %%xmm5, " VAR(CTR1) "\n\t"  \
+    AESENC_AVX(%%xmm4)                      \
+    "movdqu     (" #in "), %%xmm5\n\t"      \
+    "pxor       %%xmm5, %%xmm4\n\t"         \
+    "movdqu     %%xmm4, (" #out ")\n\t"     \
+    "pshufb     %[BSWAP_MASK], %%xmm4\n\t"  \
+    "pxor       %%xmm4, " VAR(XR) "\n\t"
+
+#define _AESENC_GFMUL(in, out, H, X)            \
+    "movdqu     " VAR(CTR1) ", %%xmm4\n\t"      \
+    "movdqu     %%xmm4, %%xmm5\n\t"             \
+    "pshufb     %[BSWAP_EPI64], %%xmm4\n\t"     \
+    "paddd      %[ONE], %%xmm5\n\t"             \
+    "pxor       (%[KEY]), %%xmm4\n\t"           \
+    "movdqu     %%xmm5, " VAR(CTR1) "\n\t"      \
+    "movdqa     " #X ", %%xmm6\n\t"             \
+    "pclmulqdq  $0x10, " #H ", %%xmm6\n\t"      \
+    "aesenc     16(%[KEY]), %%xmm4\n\t"         \
+    "aesenc     32(%[KEY]), %%xmm4\n\t"         \
+    "movdqa     " #X ", %%xmm7\n\t"             \
+    "pclmulqdq  $0x01, " #H ", %%xmm7\n\t"      \
+    "aesenc     48(%[KEY]), %%xmm4\n\t"         \
+    "aesenc     64(%[KEY]), %%xmm4\n\t"         \
+    "movdqa     " #X ", %%xmm8\n\t"             \
+    "pclmulqdq  $0x00, " #H ", %%xmm8\n\t"      \
+    "aesenc     80(%[KEY]), %%xmm4\n\t"         \
+    "movdqa     " #X ", %%xmm1\n\t"             \
+    "pclmulqdq  $0x11, " #H ", %%xmm1\n\t"      \
+    "aesenc     96(%[KEY]), %%xmm4\n\t"         \
+    "pxor       %%xmm7, %%xmm6\n\t"             \
+    "movdqa     %%xmm6, %%xmm2\n\t"             \
+    "psrldq     $8, %%xmm6\n\t"                 \
+    "pslldq     $8, %%xmm2\n\t"                 \
+    "aesenc     112(%[KEY]), %%xmm4\n\t"        \
+    "movdqa     %%xmm1, %%xmm3\n\t"             \
+    "pxor       %%xmm8, %%xmm2\n\t"             \
+    "pxor       %%xmm6, %%xmm3\n\t"             \
+    "movdqa     %[MOD2_128], %%xmm0\n\t"        \
+    "movdqa     %%xmm2, %%xmm7\n\t"             \
+    "pclmulqdq  $0x10, %%xmm0, %%xmm7\n\t"      \
+    "aesenc     128(%[KEY]), %%xmm4\n\t"        \
+    "pshufd     $0x4e, %%xmm2, %%xmm6\n\t"      \
+    "pxor       %%xmm7, %%xmm6\n\t"             \
+    "movdqa     %%xmm6, %%xmm7\n\t"             \
+    "pclmulqdq  $0x10, %%xmm0, %%xmm7\n\t"      \
+    "aesenc     144(%[KEY]), %%xmm4\n\t"        \
+    "pshufd     $0x4e, %%xmm6, " VAR(XR) "\n\t" \
+    "pxor       %%xmm7, " VAR(XR) "\n\t"        \
+    "pxor       %%xmm3, " VAR(XR) "\n\t"        \
+    "cmpl       $11, %[nr]\n\t"                 \
+    "movdqu     160(%[KEY]), %%xmm5\n\t"        \
+    "jl         %=f\n\t"                        \
+    "aesenc     %%xmm5, %%xmm4\n\t"             \
+    "aesenc     176(%[KEY]), %%xmm4\n\t"        \
+    "cmpl       $13, %[nr]\n\t"                 \
+    "movdqu     192(%[KEY]), %%xmm5\n\t"        \
+    "jl         %=f\n\t"                        \
+    "aesenc     %%xmm5, %%xmm4\n\t"             \
+    "aesenc     208(%[KEY]), %%xmm4\n\t"        \
+    "movdqa     224(%[KEY]), %%xmm5\n\t"        \
+    "%=:\n\t"                                   \
+    "aesenclast %%xmm5, %%xmm4\n\t"             \
+    "movdqu     (" #in "), %%xmm5\n\t"          \
+    "pxor       %%xmm5, %%xmm4\n\t"             \
+    "movdqu     %%xmm4, (" #out ")\n\t"
+#define AESENC_GFMUL(in, out, H, X)             \
+       _AESENC_GFMUL(in, out, H, X)
+
+#define _GHASH_GFMUL_AVX(r, r2, a, b)      \
+    "pshufd     $0x4e, "#a", %%xmm1\n\t"   \
+    "pshufd     $0x4e, "#b", %%xmm2\n\t"   \
+    "movdqa     "#b", %%xmm3\n\t"          \
+    "movdqa     "#b", %%xmm0\n\t"          \
+    "pclmulqdq  $0x11, "#a", %%xmm3\n\t"   \
+    "pclmulqdq  $0x00, "#a", %%xmm0\n\t"   \
+    "pxor       "#a", %%xmm1\n\t"          \
+    "pxor       "#b", %%xmm2\n\t"          \
+    "pclmulqdq  $0x00, %%xmm2, %%xmm1\n\t" \
+    "pxor       %%xmm0, %%xmm1\n\t"        \
+    "pxor       %%xmm3, %%xmm1\n\t"        \
+    "movdqa     %%xmm1, %%xmm2\n\t"        \
+    "movdqa     %%xmm0, "#r2"\n\t"         \
+    "movdqa     %%xmm3, " #r "\n\t"        \
+    "pslldq     $8, %%xmm2\n\t"            \
+    "psrldq     $8, %%xmm1\n\t"            \
+    "pxor       %%xmm2, "#r2"\n\t"         \
+    "pxor       %%xmm1, " #r "\n\t"
+#define GHASH_GFMUL_AVX(r, r2, a, b)       \
+       _GHASH_GFMUL_AVX(r, r2, a, b)
+
+#define _GHASH_GFMUL_XOR_AVX(r, r2, a, b)  \
+    "pshufd     $0x4e, "#a", %%xmm1\n\t"   \
+    "pshufd     $0x4e, "#b", %%xmm2\n\t"   \
+    "movdqa     "#b", %%xmm3\n\t"          \
+    "movdqa     "#b", %%xmm0\n\t"          \
+    "pclmulqdq  $0x11, "#a", %%xmm3\n\t"   \
+    "pclmulqdq  $0x00, "#a", %%xmm0\n\t"   \
+    "pxor       "#a", %%xmm1\n\t"          \
+    "pxor       "#b", %%xmm2\n\t"          \
+    "pclmulqdq  $0x00, %%xmm2, %%xmm1\n\t" \
+    "pxor       %%xmm0, %%xmm1\n\t"        \
+    "pxor       %%xmm3, %%xmm1\n\t"        \
+    "movdqa     %%xmm1, %%xmm2\n\t"        \
+    "pxor       %%xmm0, "#r2"\n\t"         \
+    "pxor       %%xmm3, " #r "\n\t"        \
+    "pslldq     $8, %%xmm2\n\t"            \
+    "psrldq     $8, %%xmm1\n\t"            \
+    "pxor       %%xmm2, "#r2"\n\t"         \
+    "pxor       %%xmm1, " #r "\n\t"
+#define GHASH_GFMUL_XOR_AVX(r, r2, a, b)   \
+       _GHASH_GFMUL_XOR_AVX(r, r2, a, b)
+
+#define GHASH_MID_AVX(r, r2)        \
+    "movdqa     "#r2", %%xmm0\n\t"  \
+    "movdqa     " #r ", %%xmm1\n\t" \
+    "psrld      $31, %%xmm0\n\t"    \
+    "psrld      $31, %%xmm1\n\t"    \
+    "pslld      $1, "#r2"\n\t"      \
+    "pslld      $1, " #r "\n\t"     \
+    "movdqa     %%xmm0, %%xmm2\n\t" \
+    "pslldq     $4, %%xmm0\n\t"     \
+    "psrldq     $12, %%xmm2\n\t"    \
+    "pslldq     $4, %%xmm1\n\t"     \
+    "por        %%xmm2, " #r "\n\t" \
+    "por        %%xmm0, "#r2"\n\t"  \
+    "por        %%xmm1, " #r "\n\t"
+
+#define _GHASH_GFMUL_RED_AVX(r, a, b)      \
+    "pshufd     $0x4e, "#a", %%xmm5\n\t"   \
+    "pshufd     $0x4e, "#b", %%xmm6\n\t"   \
+    "movdqa     "#b", %%xmm7\n\t"          \
+    "movdqa     "#b", %%xmm4\n\t"          \
+    "pclmulqdq  $0x11, "#a", %%xmm7\n\t"   \
+    "pclmulqdq  $0x00, "#a", %%xmm4\n\t"   \
+    "pxor       "#a", %%xmm5\n\t"          \
+    "pxor       "#b", %%xmm6\n\t"          \
+    "pclmulqdq  $0x00, %%xmm6, %%xmm5\n\t" \
+    "pxor       %%xmm4, %%xmm5\n\t"        \
+    "pxor       %%xmm7, %%xmm5\n\t"        \
+    "movdqa     %%xmm5, %%xmm6\n\t"        \
+    "movdqa     %%xmm7, " #r "\n\t"        \
+    "pslldq     $8, %%xmm6\n\t"            \
+    "psrldq     $8, %%xmm5\n\t"            \
+    "pxor       %%xmm6, %%xmm4\n\t"        \
+    "pxor       %%xmm5, " #r "\n\t"        \
+    "movdqa     %%xmm4, %%xmm8\n\t"        \
+    "movdqa     %%xmm4, %%xmm9\n\t"        \
+    "movdqa     %%xmm4, %%xmm10\n\t"       \
+    "pslld      $31, %%xmm8\n\t"           \
+    "pslld      $30, %%xmm9\n\t"           \
+    "pslld      $25, %%xmm10\n\t"          \
+    "pxor       %%xmm9, %%xmm8\n\t"        \
+    "pxor       %%xmm10, %%xmm8\n\t"       \
+    "movdqa     %%xmm8, %%xmm9\n\t"        \
+    "psrldq     $4, %%xmm9\n\t"            \
+    "pslldq     $12, %%xmm8\n\t"           \
+    "pxor       %%xmm8, %%xmm4\n\t"        \
+    "movdqa     %%xmm4, %%xmm10\n\t"       \
+    "movdqa     %%xmm4, %%xmm6\n\t"        \
+    "movdqa     %%xmm4, %%xmm5\n\t"        \
+    "psrld      $1, %%xmm10\n\t"           \
+    "psrld      $2, %%xmm6\n\t"            \
+    "psrld      $7, %%xmm5\n\t"            \
+    "pxor       %%xmm6, %%xmm10\n\t"       \
+    "pxor       %%xmm5, %%xmm10\n\t"       \
+    "pxor       %%xmm9, %%xmm10\n\t"       \
+    "pxor       %%xmm4, %%xmm10\n\t"       \
+    "pxor       %%xmm10, " #r "\n\t"
+#define GHASH_GFMUL_RED_AVX(r, a, b)       \
+       _GHASH_GFMUL_RED_AVX(r, a, b)
+
+#define GHASH_RED_AVX(r, r2)           \
+    "movdqa     "#r2", %%xmm0\n\t"     \
+    "movdqa     "#r2", %%xmm1\n\t"     \
+    "movdqa     "#r2", %%xmm2\n\t"     \
+    "pslld      $31, %%xmm0\n\t"       \
+    "pslld      $30, %%xmm1\n\t"       \
+    "pslld      $25, %%xmm2\n\t"       \
+    "pxor       %%xmm1, %%xmm0\n\t"    \
+    "pxor       %%xmm2, %%xmm0\n\t"    \
+    "movdqa     %%xmm0, %%xmm1\n\t"    \
+    "psrldq     $4, %%xmm1\n\t"        \
+    "pslldq     $12, %%xmm0\n\t"       \
+    "pxor       %%xmm0, "#r2"\n\t"     \
+    "movdqa     "#r2", %%xmm2\n\t"     \
+    "movdqa     "#r2", %%xmm3\n\t"     \
+    "movdqa     "#r2", %%xmm0\n\t"     \
+    "psrld      $1, %%xmm2\n\t"        \
+    "psrld      $2, %%xmm3\n\t"        \
+    "psrld      $7, %%xmm0\n\t"        \
+    "pxor       %%xmm3, %%xmm2\n\t"    \
+    "pxor       %%xmm0, %%xmm2\n\t"    \
+    "pxor       %%xmm1, %%xmm2\n\t"    \
+    "pxor       "#r2", %%xmm2\n\t"     \
+    "pxor       %%xmm2, " #r "\n\t"
+
+#define GHASH_GFMUL_RED_XOR_AVX(r, r2, a, b) \
+    GHASH_GFMUL_XOR_AVX(r, r2, a, b)         \
+    GHASH_RED_AVX(r, r2)
+
+#define GHASH_FULL_AVX(r, r2, a, b) \
+    GHASH_GFMUL_AVX(r, r2, a, b)    \
+    GHASH_MID_AVX(r, r2)            \
+    GHASH_RED_AVX(r, r2)
+
+#define CALC_IV_12() \
+    "# Calculate values when IV is 12 bytes\n\t"      \
+    "# Set counter based on IV\n\t"                   \
+    "movl       $0x01000000, %%ecx\n\t"               \
+    "pinsrq     $0, 0(%%rax), %%xmm13\n\t"            \
+    "pinsrd     $2, 8(%%rax), %%xmm13\n\t"            \
+    "pinsrd     $3, %%ecx, %%xmm13\n\t"               \
+    "# H = Encrypt X(=0) and T = Encrypt counter\n\t" \
+    "movdqu     %%xmm13, %%xmm1\n\t"                  \
+    "movdqa       0(%[KEY]), " VAR(HR) "\n\t"         \
+    "pxor       " VAR(HR) ", %%xmm1\n\t"              \
+    "movdqa      16(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa      32(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa      48(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa      64(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa      80(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa      96(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa     112(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa     128(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa     144(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "cmpl       $11, %[nr]\n\t"                       \
+    "movdqa     160(%[KEY]), %%xmm12\n\t"             \
+    "jl 31f\n\t"                                      \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqa     176(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "cmpl       $13, %[nr]\n\t"                       \
+    "movdqa     192(%[KEY]), %%xmm12\n\t"             \
+    "jl 31f\n\t"                                      \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqu     208(%[KEY]), %%xmm12\n\t"             \
+    "aesenc     %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenc     %%xmm12, %%xmm1\n\t"                  \
+    "movdqu     224(%[KEY]), %%xmm12\n\t"             \
+    "31:\n\t"                                         \
+    "aesenclast %%xmm12, " VAR(HR) "\n\t"             \
+    "aesenclast %%xmm12, %%xmm1\n\t"                  \
+    "pshufb     %[BSWAP_MASK], " VAR(HR) "\n\t"       \
+    "movdqu     %%xmm1, " VAR(TR) "\n\t"              \
+    "jmp        39f\n\t"
+
+#define CALC_IV()                                    \
+    "# Calculate values when IV is not 12 bytes\n\t" \
+    "# H = Encrypt X(=0)\n\t"                        \
+    "movdqa     0(%[KEY]), " VAR(HR) "\n\t"          \
+    AESENC_AVX(HR)                                   \
+    "pshufb     %[BSWAP_MASK], " VAR(HR) "\n\t"      \
+    "# Calc counter\n\t"                             \
+    "# Initialization vector\n\t"                    \
+    "cmpl       $0, %%edx\n\t"                       \
+    "movq       $0, %%rcx\n\t"                       \
+    "je 45f\n\t"                                     \
+    "cmpl       $16, %%edx\n\t"                      \
+    "jl 44f\n\t"                                     \
+    "andl       $0xfffffff0, %%edx\n\t"              \
+    "\n"                                             \
+    "43:\n\t"                                        \
+    "movdqu     (%%rax,%%rcx,1), %%xmm4\n\t"         \
+    "pshufb     %[BSWAP_MASK], %%xmm4\n\t"           \
+    "pxor       %%xmm4, %%xmm13\n\t"                 \
+    GHASH_FULL_AVX(%%xmm13, %%xmm12, %%xmm13, HR)    \
+    "addl       $16, %%ecx\n\t"                      \
+    "cmpl       %%edx, %%ecx\n\t"                    \
+    "jl 43b\n\t"                                     \
+    "movl       %[ibytes], %%edx\n\t"                \
+    "cmpl       %%edx, %%ecx\n\t"                    \
+    "je 45f\n\t"                                     \
+    "\n"                                             \
+    "44:\n\t"                                        \
+    "subq       $16, %%rsp\n\t"                      \
+    "pxor       %%xmm4, %%xmm4\n\t"                  \
+    "xorl       %%ebx, %%ebx\n\t"                    \
+    "movdqu     %%xmm4, (%%rsp)\n\t"                 \
+    "42:\n\t"                                        \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t"         \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t"         \
+    "incl       %%ecx\n\t"                           \
+    "incl       %%ebx\n\t"                           \
+    "cmpl       %%edx, %%ecx\n\t"                    \
+    "jl 42b\n\t"                                     \
+    "movdqu     (%%rsp), %%xmm4\n\t"                 \
+    "addq       $16, %%rsp\n\t"                      \
+    "pshufb     %[BSWAP_MASK], %%xmm4\n\t"           \
+    "pxor       %%xmm4, %%xmm13\n\t"                 \
+    GHASH_FULL_AVX(%%xmm13, %%xmm12, %%xmm13, HR)    \
+    "\n"                                             \
+    "45:\n\t"                                        \
+    "# T = Encrypt counter\n\t"                      \
+    "pxor       %%xmm0, %%xmm0\n\t"                  \
+    "shll       $3, %%edx\n\t"                       \
+    "pinsrq     $0, %%rdx, %%xmm0\n\t"               \
+    "pxor       %%xmm0, %%xmm13\n\t"                 \
+    GHASH_FULL_AVX(%%xmm13, %%xmm12, %%xmm13, HR)    \
+    "pshufb     %[BSWAP_MASK], %%xmm13\n\t"          \
+    "#   Encrypt counter\n\t"                        \
+    "movdqa     0(%[KEY]), %%xmm4\n\t"               \
+    "pxor       %%xmm13, %%xmm4\n\t"                 \
+    AESENC_AVX(%%xmm4)                               \
+    "movdqu     %%xmm4, " VAR(TR) "\n\t"
+
+#define CALC_AAD()                           \
+    "# Additional authentication data\n\t"   \
+    "movl       %[abytes], %%edx\n\t"        \
+    "cmpl       $0, %%edx\n\t"               \
+    "je         25f\n\t"                     \
+    "movq       %[addt], %%rax\n\t"          \
+    "xorl       %%ecx, %%ecx\n\t"            \
+    "cmpl       $16, %%edx\n\t"              \
+    "jl         24f\n\t"                     \
+    "andl       $0xfffffff0, %%edx\n\t"      \
+    "\n"                                     \
+    "23:\n\t"                                \
+    "movdqu     (%%rax,%%rcx,1), %%xmm4\n\t" \
+    "pshufb     %[BSWAP_MASK], %%xmm4\n\t"   \
+    "pxor       %%xmm4, " VAR(XR) "\n\t"     \
+    GHASH_FULL_AVX(XR, %%xmm12, XR, HR)      \
+    "addl       $16, %%ecx\n\t"              \
+    "cmpl       %%edx, %%ecx\n\t"            \
+    "jl         23b\n\t"                     \
+    "movl       %[abytes], %%edx\n\t"        \
+    "cmpl       %%edx, %%ecx\n\t"            \
+    "je         25f\n\t"                     \
+    "\n"                                     \
+    "24:\n\t"                                \
+    "subq       $16, %%rsp\n\t"              \
+    "pxor       %%xmm4, %%xmm4\n\t"          \
+    "xorl       %%ebx, %%ebx\n\t"            \
+    "movdqu     %%xmm4, (%%rsp)\n\t"         \
+    "22:\n\t"                                \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t" \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t" \
+    "incl       %%ecx\n\t"                   \
+    "incl       %%ebx\n\t"                   \
+    "cmpl       %%edx, %%ecx\n\t"            \
+    "jl         22b\n\t"                     \
+    "movdqu     (%%rsp), %%xmm4\n\t"         \
+    "addq       $16, %%rsp\n\t"              \
+    "pshufb     %[BSWAP_MASK], %%xmm4\n\t"   \
+    "pxor       %%xmm4, " VAR(XR) "\n\t"     \
+    GHASH_FULL_AVX(XR, %%xmm12, XR, HR)      \
+    "\n"                                     \
+    "25:\n\t"
+
+#define CALC_HT_8_AVX()                            \
+    "movdqa     " VAR(XR) ", %%xmm2\n\t"           \
+    "# H ^ 1\n\t"                                  \
+    "movdqu     " VAR(HR) ", 0(" VAR(HTR) ")\n\t"  \
+    "# H ^ 2\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm0, HR, HR)            \
+    "movdqu     %%xmm0 ,  16(" VAR(HTR) ")\n\t"    \
+    "# H ^ 3\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm1, HR, %%xmm0)        \
+    "movdqu     %%xmm1 ,  32(" VAR(HTR) ")\n\t"    \
+    "# H ^ 4\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm3, %%xmm0, %%xmm0)    \
+    "movdqu     %%xmm3 ,  48(" VAR(HTR) ")\n\t"    \
+    "# H ^ 5\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm12, %%xmm0, %%xmm1)   \
+    "movdqu     %%xmm12,  64(" VAR(HTR) ")\n\t"    \
+    "# H ^ 6\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm12, %%xmm1, %%xmm1)   \
+    "movdqu     %%xmm12,  80(" VAR(HTR) ")\n\t"    \
+    "# H ^ 7\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm12, %%xmm1, %%xmm3)   \
+    "movdqu     %%xmm12,  96(" VAR(HTR) ")\n\t"    \
+    "# H ^ 8\n\t"                                  \
+    GHASH_GFMUL_RED_AVX(%%xmm12, %%xmm3, %%xmm3)   \
+    "movdqu     %%xmm12, 112(" VAR(HTR) ")\n\t"
+
+#define AESENC_128_GHASH_AVX(src, o)                 \
+    "leaq       (%[in]," VAR(KR64) ",1), %%rcx\n\t"  \
+    "leaq       (%[out]," VAR(KR64) ",1), %%rdx\n\t" \
+    /* src is either %%rcx or %%rdx */               \
+    AESENC_CTR()                                     \
+    AESENC_XOR()                                     \
+    AESENC_PCLMUL_1(src,  16, o-128, 112)            \
+    AESENC_PCLMUL_N(src,  32, o-112,  96)            \
+    AESENC_PCLMUL_N(src,  48, o -96,  80)            \
+    AESENC_PCLMUL_N(src,  64, o -80,  64)            \
+    AESENC_PCLMUL_N(src,  80, o -64,  48)            \
+    AESENC_PCLMUL_N(src,  96, o -48,  32)            \
+    AESENC_PCLMUL_N(src, 112, o -32,  16)            \
+    AESENC_PCLMUL_N(src, 128, o -16,   0)            \
+    AESENC_PCLMUL_L(144)                             \
+    "cmpl       $11, %[nr]\n\t"                      \
+    "movdqa     160(%[KEY]), %%xmm12\n\t"            \
+    "jl         4f\n\t"                              \
+    AESENC()                                         \
+    AESENC_SET(176)                                  \
+    "cmpl       $13, %[nr]\n\t"                      \
+    "movdqa     192(%[KEY]), %%xmm12\n\t"            \
+    "jl         4f\n\t"                              \
+    AESENC()                                         \
+    AESENC_SET(208)                                  \
+    "movdqa     224(%[KEY]), %%xmm12\n\t"            \
+    "\n"                                             \
+"4:\n\t"                                             \
+    AESENC_LAST(%%rcx, %%rdx)
+
+#define AESENC_LAST15_ENC_AVX()                       \
+    "movl       %[nbytes], %%ecx\n\t"                 \
+    "movl       %%ecx, %%edx\n\t"                     \
+    "andl       $0x0f, %%ecx\n\t"                     \
+    "jz         55f\n\t"                              \
+    "movdqu     " VAR(CTR1) ", %%xmm13\n\t"           \
+    "pshufb     %[BSWAP_EPI64], %%xmm13\n\t"          \
+    "pxor       0(%[KEY]), %%xmm13\n\t"               \
+    AESENC_AVX(%%xmm13)                               \
+    "subq       $16, %%rsp\n\t"                       \
+    "xorl       %%ecx, %%ecx\n\t"                     \
+    "movdqu     %%xmm13, (%%rsp)\n\t"                 \
+    "\n"                                              \
+    "51:\n\t"                                         \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"  \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"          \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t" \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"          \
+    "incl       " VAR(KR) "\n\t"                      \
+    "incl       %%ecx\n\t"                            \
+    "cmpl       %%edx, " VAR(KR) "\n\t"               \
+    "jl         51b\n\t"                              \
+    "xorq       %%r13, %%r13\n\t"                     \
+    "cmpl       $16, %%ecx\n\t"                       \
+    "je         53f\n\t"                              \
+    "\n"                                              \
+    "52:\n\t"                                         \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"          \
+    "incl       %%ecx\n\t"                            \
+    "cmpl       $16, %%ecx\n\t"                       \
+    "jl         52b\n\t"                              \
+    "53:\n\t"                                         \
+    "movdqu     (%%rsp), %%xmm13\n\t"                 \
+    "addq       $16, %%rsp\n\t"                       \
+    "pshufb     %[BSWAP_MASK], %%xmm13\n\t"           \
+    "pxor       %%xmm13, " VAR(XR) "\n\t"             \
+    GHASH_GFMUL_RED_AVX(XR, HR, XR)                   \
+
+#define AESENC_LAST15_DEC_AVX()                       \
+    "movl       %[nbytes], %%ecx\n\t"                 \
+    "movl       %%ecx, %%edx\n\t"                     \
+    "andl       $0x0f, %%ecx\n\t"                     \
+    "jz         55f\n\t"                              \
+    "movdqu     " VAR(CTR1) ", %%xmm13\n\t"           \
+    "pshufb     %[BSWAP_EPI64], %%xmm13\n\t"          \
+    "pxor       0(%[KEY]), %%xmm13\n\t"               \
+    AESENC_AVX(%%xmm13)                               \
+    "subq       $32, %%rsp\n\t"                       \
+    "xorl       %%ecx, %%ecx\n\t"                     \
+    "movdqu     %%xmm13, (%%rsp)\n\t"                 \
+    "pxor       %%xmm0, %%xmm0\n\t"                   \
+    "movdqu     %%xmm0, 16(%%rsp)\n\t"                \
+    "\n"                                              \
+    "51:\n\t"                                         \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"  \
+    "movb       %%r13b, 16(%%rsp,%%rcx,1)\n\t"        \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"          \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t" \
+    "incl       " VAR(KR) "\n\t"                      \
+    "incl       %%ecx\n\t"                            \
+    "cmpl       %%edx, " VAR(KR) "\n\t"               \
+    "jl         51b\n\t"                              \
+    "53:\n\t"                                         \
+    "movdqu     16(%%rsp), %%xmm13\n\t"               \
+    "addq       $32, %%rsp\n\t"                       \
+    "pshufb     %[BSWAP_MASK], %%xmm13\n\t"           \
+    "pxor       %%xmm13, " VAR(XR) "\n\t"             \
+    GHASH_GFMUL_RED_AVX(XR, HR, XR)                   \
+
+#define CALC_TAG()                              \
+    "movl       %[nbytes], %%edx\n\t"           \
+    "movl       %[abytes], %%ecx\n\t"           \
+    "shlq       $3, %%rdx\n\t"                  \
+    "shlq       $3, %%rcx\n\t"                  \
+    "pinsrq     $0, %%rdx, %%xmm0\n\t"          \
+    "pinsrq     $1, %%rcx, %%xmm0\n\t"          \
+    "pxor       %%xmm0, " VAR(XR) "\n\t"        \
+    GHASH_GFMUL_RED_AVX(XR, HR, XR)             \
+    "pshufb     %[BSWAP_MASK], " VAR(XR) "\n\t" \
+    "movdqu     " VAR(TR) ", %%xmm0\n\t"        \
+    "pxor       " VAR(XR) ", %%xmm0\n\t"        \
+
+#define STORE_TAG()                           \
+    "cmpl       $16, %[tbytes]\n\t"           \
+    "je         71f\n\t"                      \
+    "xorq       %%rcx, %%rcx\n\t"             \
+    "movdqu     %%xmm0, (%%rsp)\n\t"          \
+    "73:\n\t"                                 \
+    "movzbl     (%%rsp,%%rcx,1), %%r13d\n\t"  \
+    "movb       %%r13b, (%[tag],%%rcx,1)\n\t" \
+    "incl       %%ecx\n\t"                    \
+    "cmpl       %[tbytes], %%ecx\n\t"         \
+    "jne        73b\n\t"                      \
+    "jmp        72f\n\t"                      \
+    "\n"                                      \
+    "71:\n\t"                                 \
+    "movdqu     %%xmm0, (%[tag])\n\t"         \
+    "\n"                                      \
+    "72:\n\t"
+
+#define CMP_TAG()                                          \
+    "cmpl       $16, %[tbytes]\n\t"                        \
+    "je         71f\n\t"                                   \
+    "subq       $16, %%rsp\n\t"                            \
+    "xorq       %%rcx, %%rcx\n\t"                          \
+    "xorq       %%rax, %%rax\n\t"                          \
+    "movdqu     %%xmm0, (%%rsp)\n\t"                       \
+    "\n"                                                   \
+    "73:\n\t"                                              \
+    "movzbl     (%%rsp,%%rcx,1), %%r13d\n\t"               \
+    "xorb       (%[tag],%%rcx,1), %%r13b\n\t"              \
+    "orb        %%r13b, %%al\n\t"                          \
+    "incl       %%ecx\n\t"                                 \
+    "cmpl       %[tbytes], %%ecx\n\t"                      \
+    "jne        73b\n\t"                                   \
+    "cmpb       $0x00, %%al\n\t"                           \
+    "sete       %%al\n\t"                                  \
+    "addq       $16, %%rsp\n\t"                            \
+    "xorq       %%rcx, %%rcx\n\t"                          \
+    "jmp        72f\n\t"                                   \
+    "\n"                                                   \
+    "71:\n\t"                                              \
+    "movdqu     (%[tag]), %%xmm1\n\t"                      \
+    "pcmpeqb    %%xmm1, %%xmm0\n\t"                        \
+    "pmovmskb   %%xmm0, %%edx\n\t"                         \
+    "# %%edx == 0xFFFF then return 1 else => return 0\n\t" \
+    "xorl       %%eax, %%eax\n\t"                          \
+    "cmpl       $0xffff, %%edx\n\t"                        \
+    "sete       %%al\n\t"                                  \
+    "\n"                                                   \
+    "72:\n\t"                                              \
+    "movl       %%eax, (%[res])\n\t"
+
+static void AES_GCM_encrypt(const unsigned char *in, unsigned char *out,
+                            const unsigned char* addt,
+                            const unsigned char* ivec, unsigned char *tag,
+                            unsigned int nbytes, unsigned int abytes,
+                            unsigned int ibytes, unsigned int tbytes,
+                            const unsigned char* key, int nr)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register unsigned int ivLen asm("ebx") = ibytes;
+
+    __asm__ __volatile__ (
+        "subq   $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "pxor   %%xmm13, %%xmm13\n\t"
+        "pxor   " VAR(XR) ", " VAR(XR) "\n\t"
+        "movl   %[ibytes], %%edx\n\t"
+        "cmpl   $12, %%edx\n\t"
+        "jne    35f\n\t"
+        CALC_IV_12()
+        "\n"
+        "35:\n\t"
+        CALC_IV()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD()
+
+        "# Calculate counter and H\n\t"
+        "pshufb %[BSWAP_EPI64], %%xmm13\n\t"
+        "movdqa " VAR(HR) ", %%xmm5\n\t"
+        "paddd  %[ONE], %%xmm13\n\t"
+        "movdqa " VAR(HR) ", %%xmm4\n\t"
+        "movdqu %%xmm13, " VAR(CTR1) "\n\t"
+        "psrlq  $63, %%xmm5\n\t"
+        "psllq  $1, %%xmm4\n\t"
+        "pslldq $8, %%xmm5\n\t"
+        "por    %%xmm5, %%xmm4\n\t"
+        "pshufd $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "psrad  $31, " VAR(HR) "\n\t"
+        "pand   %[MOD2_128], " VAR(HR) "\n\t"
+        "pxor   %%xmm4, " VAR(HR) "\n\t"
+
+        "xorl   " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+        "cmpl   $128, %[nbytes]\n\t"
+        "movl   %[nbytes], %%r13d\n\t"
+        "jl     5f\n\t"
+        "andl   $0xffffff80, %%r13d\n\t"
+
+        CALC_HT_8_AVX()
+
+        "# First 128 bytes of input\n\t"
+        AESENC_CTR()
+        AESENC_XOR()
+        AESENC_SET(16)
+        AESENC_SET(32)
+        AESENC_SET(48)
+        AESENC_SET(64)
+        AESENC_SET(80)
+        AESENC_SET(96)
+        AESENC_SET(112)
+        AESENC_SET(128)
+        AESENC_SET(144)
+        "cmpl   $11, %[nr]\n\t"
+        "movdqa 160(%[KEY]), %%xmm12\n\t"
+        "jl     1f\n\t"
+        AESENC()
+        AESENC_SET(176)
+        "cmpl   $13, %[nr]\n\t"
+        "movdqa 192(%[KEY]), %%xmm12\n\t"
+        "jl     1f\n\t"
+        AESENC()
+        AESENC_SET(208)
+        "movdqa 224(%[KEY]), %%xmm12\n\t"
+        "\n"
+    "1:\n\t"
+        AESENC_LAST(%[in], %[out])
+
+        "cmpl   $128, %%r13d\n\t"
+        "movl   $128, " VAR(KR) "\n\t"
+        "jle    2f\n\t"
+
+        "# More 128 bytes of input\n\t"
+        "\n"
+    "3:\n\t"
+        AESENC_128_GHASH_AVX(%%rdx, 0)
+        "addl   $128, " VAR(KR) "\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jl     3b\n\t"
+        "\n"
+    "2:\n\t"
+        "movdqa %[BSWAP_MASK], %%xmm13\n\t"
+        "pshufb %%xmm13, %%xmm4\n\t"
+        "pshufb %%xmm13, %%xmm5\n\t"
+        "pshufb %%xmm13, %%xmm6\n\t"
+        "pshufb %%xmm13, %%xmm7\n\t"
+        "pxor   %%xmm2, %%xmm4\n\t"
+        "pshufb %%xmm13, %%xmm8\n\t"
+        "pshufb %%xmm13, %%xmm9\n\t"
+        "pshufb %%xmm13, %%xmm10\n\t"
+        "pshufb %%xmm13, %%xmm11\n\t"
+
+        "movdqu 112(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_AVX(XR, %%xmm13, %%xmm4, %%xmm12)
+        "movdqu  96(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm5, %%xmm12)
+        "movdqu  80(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm6, %%xmm12)
+        "movdqu  64(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm7, %%xmm12)
+        "movdqu  48(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm8, %%xmm12)
+        "movdqu  32(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm9, %%xmm12)
+        "movdqu  16(" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_XOR_AVX(XR, %%xmm13, %%xmm10, %%xmm12)
+        "movdqu    (" VAR(HTR) "), %%xmm12\n\t"
+        GHASH_GFMUL_RED_XOR_AVX(XR, %%xmm13, %%xmm11, %%xmm12)
+
+        "movdqu 0(" VAR(HTR) "), " VAR(HR) "\n\t"
+        "\n"
+    "5:\n\t"
+        "movl   %[nbytes], %%edx\n\t"
+        "cmpl   %%edx, " VAR(KR) "\n\t"
+        "jge    55f\n\t"
+#endif
+
+        "movl   %[nbytes], %%r13d\n\t"
+        "andl   $0xfffffff0, %%r13d\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jge    14f\n\t"
+
+        "leaq   (%[in]," VAR(KR64) ",1), %%rcx\n\t"
+        "leaq   (%[out]," VAR(KR64) ",1), %%rdx\n\t"
+        AESENC_BLOCK(%%rcx, %%rdx)
+        "addl   $16, " VAR(KR) "\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jge    13f\n\t"
+        "\n"
+        "12:\n\t"
+        "leaq   (%[in]," VAR(KR64) ",1), %%rcx\n\t"
+        "leaq   (%[out]," VAR(KR64) ",1), %%rdx\n\t"
+        AESENC_GFMUL(%%rcx, %%rdx, HR, XR)
+        "pshufb %[BSWAP_MASK], %%xmm4\n\t"
+        "pxor   %%xmm4, " VAR(XR) "\n\t"
+        "addl   $16, " VAR(KR) "\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jl     12b\n\t"
+        "\n"
+        "13:\n\t"
+        GHASH_GFMUL_RED_AVX(XR, HR, XR)
+        "\n"
+        "14:\n\t"
+
+        AESENC_LAST15_ENC_AVX()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG()
+        STORE_TAG()
+        "addq   $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tbytes),
+          [tag] "r" (tag),
+          [BSWAP_MASK] "m" (BSWAP_MASK),
+          [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+          [MOD2_128] "m" (MOD2_128)
+        : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "rdx", "r13"
+    );
+}
+
+#ifdef HAVE_INTEL_AVX1
+/* Encrypt with key in xmm12. */
+#define VAESENC()                              \
+    "vaesenc    %%xmm12, %%xmm4, %%xmm4\n\t"   \
+    "vaesenc    %%xmm12, %%xmm5, %%xmm5\n\t"   \
+    "vaesenc    %%xmm12, %%xmm6, %%xmm6\n\t"   \
+    "vaesenc    %%xmm12, %%xmm7, %%xmm7\n\t"   \
+    "vaesenc    %%xmm12, %%xmm8, %%xmm8\n\t"   \
+    "vaesenc    %%xmm12, %%xmm9, %%xmm9\n\t"   \
+    "vaesenc    %%xmm12, %%xmm10, %%xmm10\n\t" \
+    "vaesenc    %%xmm12, %%xmm11, %%xmm11\n\t"
+
+#define VAESENC_SET(o)                         \
+    "vmovdqa    "#o"(%[KEY]), %%xmm12\n\t"     \
+    VAESENC()
+
+#define VAESENC_CTR()                          \
+    "vmovdqu    " VAR(CTR1) ", %%xmm0\n\t"     \
+    "vmovdqa    %[BSWAP_EPI64], %%xmm1\n\t"    \
+    "vpshufb    %%xmm1, %%xmm0, %%xmm4\n\t"    \
+    "vpaddd     %[ONE], %%xmm0, %%xmm5\n\t"    \
+    "vpshufb    %%xmm1, %%xmm5, %%xmm5\n\t"    \
+    "vpaddd     %[TWO], %%xmm0, %%xmm6\n\t"    \
+    "vpshufb    %%xmm1, %%xmm6, %%xmm6\n\t"    \
+    "vpaddd     %[THREE], %%xmm0, %%xmm7\n\t"  \
+    "vpshufb    %%xmm1, %%xmm7, %%xmm7\n\t"    \
+    "vpaddd     %[FOUR], %%xmm0, %%xmm8\n\t"   \
+    "vpshufb    %%xmm1, %%xmm8, %%xmm8\n\t"    \
+    "vpaddd     %[FIVE], %%xmm0, %%xmm9\n\t"   \
+    "vpshufb    %%xmm1, %%xmm9, %%xmm9\n\t"    \
+    "vpaddd     %[SIX], %%xmm0, %%xmm10\n\t"   \
+    "vpshufb    %%xmm1, %%xmm10, %%xmm10\n\t"  \
+    "vpaddd     %[SEVEN], %%xmm0, %%xmm11\n\t" \
+    "vpshufb    %%xmm1, %%xmm11, %%xmm11\n\t"  \
+    "vpaddd     %[EIGHT], %%xmm0, %%xmm0\n\t"
+
+#define VAESENC_XOR()                          \
+    "vmovdqa    (%[KEY]), %%xmm12\n\t"         \
+    "vmovdqu    %%xmm0, " VAR(CTR1) "\n\t"     \
+    "vpxor      %%xmm12, %%xmm4, %%xmm4\n\t"   \
+    "vpxor      %%xmm12, %%xmm5, %%xmm5\n\t"   \
+    "vpxor      %%xmm12, %%xmm6, %%xmm6\n\t"   \
+    "vpxor      %%xmm12, %%xmm7, %%xmm7\n\t"   \
+    "vpxor      %%xmm12, %%xmm8, %%xmm8\n\t"   \
+    "vpxor      %%xmm12, %%xmm9, %%xmm9\n\t"   \
+    "vpxor      %%xmm12, %%xmm10, %%xmm10\n\t" \
+    "vpxor      %%xmm12, %%xmm11, %%xmm11\n\t"
+
+#define VAESENC_128()                     \
+    VAESENC_CTR()                         \
+    VAESENC_XOR()                         \
+    VAESENC_SET(16)                       \
+    VAESENC_SET(32)                       \
+    VAESENC_SET(48)                       \
+    VAESENC_SET(64)                       \
+    VAESENC_SET(80)                       \
+    VAESENC_SET(96)                       \
+    VAESENC_SET(112)                      \
+    VAESENC_SET(128)                      \
+    VAESENC_SET(144)                      \
+    "cmpl       $11, %[nr]\n\t"           \
+    "vmovdqa    160(%[KEY]), %%xmm12\n\t" \
+    "jl 1f\n\t"                           \
+    VAESENC()                             \
+    VAESENC_SET(176)                      \
+    "cmpl       $13, %[nr]\n\t"           \
+    "vmovdqa    192(%[KEY]), %%xmm12\n\t" \
+    "jl 1f\n\t"                           \
+    VAESENC()                             \
+    VAESENC_SET(208)                      \
+    "vmovdqa    224(%[KEY]), %%xmm12\n\t" \
+    "\n"                                  \
+"1:\n\t"                                  \
+    VAESENC_LAST(%[in], %[out])
+
+/* Encrypt and carry-less multiply for AVX1. */
+#define VAESENC_PCLMUL_1(src, o1, o2, o3)              \
+    "vmovdqu    " #o3 "(" VAR(HTR) "), %%xmm12\n\t"    \
+    "vmovdqu    " #o2 "(" #src "), %%xmm0\n\t"         \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm4, %%xmm4\n\t"   \
+    "vpshufb    %[BSWAP_MASK], %%xmm0, %%xmm0\n\t"     \
+    "vpxor      %%xmm2, %%xmm0, %%xmm0\n\t"            \
+    "vpshufd    $0x4e, %%xmm12, %%xmm1\n\t"            \
+    "vpshufd    $0x4e, %%xmm0, %%xmm14\n\t"            \
+    "vpxor      %%xmm12, %%xmm1, %%xmm1\n\t"           \
+    "vpxor      %%xmm0, %%xmm14, %%xmm14\n\t"          \
+    "vpclmulqdq $0x11, %%xmm12, %%xmm0, %%xmm3\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm5, %%xmm5\n\t"   \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm6, %%xmm6\n\t"   \
+    "vpclmulqdq $0x00, %%xmm12, %%xmm0, %%xmm2\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm7, %%xmm7\n\t"   \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm8, %%xmm8\n\t"   \
+    "vpclmulqdq $0x00, %%xmm14, %%xmm1, %%xmm1\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm9, %%xmm9\n\t"   \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm10, %%xmm10\n\t" \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm11, %%xmm11\n\t" \
+    "vpxor      %%xmm2, %%xmm1, %%xmm1\n\t"            \
+    "vpxor      %%xmm3, %%xmm1, %%xmm1\n\t"            \
+
+#define VAESENC_PCLMUL_N(src, o1, o2, o3)               \
+    "vmovdqu    " #o3 "(" VAR(HTR) "), %%xmm12\n\t"     \
+    "vmovdqu    " #o2 "(" #src "), %%xmm0\n\t"          \
+    "vpshufd    $0x4e, %%xmm12, %%xmm13\n\t"            \
+    "vpshufb    %[BSWAP_MASK], %%xmm0, %%xmm0\n\t"      \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpxor      %%xmm12, %%xmm13, %%xmm13\n\t"          \
+    "vpshufd    $0x4e, %%xmm0, %%xmm14\n\t"             \
+    "vpxor      %%xmm0, %%xmm14, %%xmm14\n\t"           \
+    "vpclmulqdq $0x11, %%xmm12, %%xmm0, %%xmm15\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm5, %%xmm5\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm6, %%xmm6\n\t"    \
+    "vpclmulqdq $0x00, %%xmm12, %%xmm0, %%xmm12\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm7, %%xmm7\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm8, %%xmm8\n\t"    \
+    "vpclmulqdq $0x00, %%xmm14, %%xmm13, %%xmm13\n\t"   \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm9, %%xmm9\n\t"    \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm10, %%xmm10\n\t"  \
+    "vaesenc    " #o1 "(%[KEY]), %%xmm11, %%xmm11\n\t"  \
+    "vpxor      %%xmm12, %%xmm1, %%xmm1\n\t"            \
+    "vpxor      %%xmm12, %%xmm2, %%xmm2\n\t"            \
+    "vpxor      %%xmm15, %%xmm1, %%xmm1\n\t"            \
+    "vpxor      %%xmm15, %%xmm3, %%xmm3\n\t"            \
+    "vpxor      %%xmm13, %%xmm1, %%xmm1\n\t"            \
+
+#define VAESENC_PCLMUL_L(o)                         \
+    "vpslldq    $8, %%xmm1, %%xmm14\n\t"            \
+    "vpsrldq    $8, %%xmm1, %%xmm1\n\t"             \
+    "vaesenc    "#o"(%[KEY]), %%xmm4, %%xmm4\n\t"   \
+    "vpxor      %%xmm14, %%xmm2, %%xmm2\n\t"        \
+    "vpxor      %%xmm1, %%xmm3, %%xmm3\n\t"         \
+    "vaesenc    "#o"(%[KEY]), %%xmm5, %%xmm5\n\t"   \
+    "vpslld     $31, %%xmm2, %%xmm12\n\t"           \
+    "vpslld     $30, %%xmm2, %%xmm13\n\t"           \
+    "vpslld     $25, %%xmm2, %%xmm14\n\t"           \
+    "vaesenc    "#o"(%[KEY]), %%xmm6, %%xmm6\n\t"   \
+    "vpxor      %%xmm13, %%xmm12, %%xmm12\n\t"      \
+    "vpxor      %%xmm14, %%xmm12, %%xmm12\n\t"      \
+    "vaesenc    "#o"(%[KEY]), %%xmm7, %%xmm7\n\t"   \
+    "vpsrldq    $4, %%xmm12, %%xmm13\n\t"           \
+    "vpslldq    $12, %%xmm12, %%xmm12\n\t"          \
+    "vaesenc    "#o"(%[KEY]), %%xmm8, %%xmm8\n\t"   \
+    "vpxor      %%xmm12, %%xmm2, %%xmm2\n\t"        \
+    "vpsrld     $1, %%xmm2, %%xmm14\n\t"            \
+    "vaesenc    "#o"(%[KEY]), %%xmm9, %%xmm9\n\t"   \
+    "vpsrld     $2, %%xmm2, %%xmm1\n\t"             \
+    "vpsrld     $7, %%xmm2, %%xmm0\n\t"             \
+    "vaesenc    "#o"(%[KEY]), %%xmm10, %%xmm10\n\t" \
+    "vpxor      %%xmm1, %%xmm14, %%xmm14\n\t"       \
+    "vpxor      %%xmm0, %%xmm14, %%xmm14\n\t"       \
+    "vaesenc    "#o"(%[KEY]), %%xmm11, %%xmm11\n\t" \
+    "vpxor      %%xmm13, %%xmm14, %%xmm14\n\t"      \
+    "vpxor      %%xmm14, %%xmm2, %%xmm2\n\t"        \
+    "vpxor      %%xmm3, %%xmm2, %%xmm2\n\t"         \
+
+
+/* Encrypt and carry-less multiply with last key. */
+#define VAESENC_LAST(in, out)                          \
+    "vaesenclast        %%xmm12, %%xmm4, %%xmm4\n\t"   \
+    "vaesenclast        %%xmm12, %%xmm5, %%xmm5\n\t"   \
+    "vmovdqu               (" #in "), %%xmm0\n\t"      \
+    "vmovdqu             16(" #in "), %%xmm1\n\t"      \
+    "vpxor              %%xmm0, %%xmm4, %%xmm4\n\t"    \
+    "vpxor              %%xmm1, %%xmm5, %%xmm5\n\t"    \
+    "vmovdqu            %%xmm4,    (" #out ")\n\t"     \
+    "vmovdqu            %%xmm5,  16(" #out ")\n\t"     \
+    "vaesenclast        %%xmm12, %%xmm6, %%xmm6\n\t"   \
+    "vaesenclast        %%xmm12, %%xmm7, %%xmm7\n\t"   \
+    "vmovdqu             32(" #in "), %%xmm0\n\t"      \
+    "vmovdqu             48(" #in "), %%xmm1\n\t"      \
+    "vpxor              %%xmm0, %%xmm6, %%xmm6\n\t"    \
+    "vpxor              %%xmm1, %%xmm7, %%xmm7\n\t"    \
+    "vmovdqu            %%xmm6,  32(" #out ")\n\t"     \
+    "vmovdqu            %%xmm7,  48(" #out ")\n\t"     \
+    "vaesenclast        %%xmm12, %%xmm8, %%xmm8\n\t"   \
+    "vaesenclast        %%xmm12, %%xmm9, %%xmm9\n\t"   \
+    "vmovdqu             64(" #in "), %%xmm0\n\t"      \
+    "vmovdqu             80(" #in "), %%xmm1\n\t"      \
+    "vpxor              %%xmm0, %%xmm8, %%xmm8\n\t"    \
+    "vpxor              %%xmm1, %%xmm9, %%xmm9\n\t"    \
+    "vmovdqu            %%xmm8,  64(" #out ")\n\t"     \
+    "vmovdqu            %%xmm9,  80(" #out ")\n\t"     \
+    "vaesenclast        %%xmm12, %%xmm10, %%xmm10\n\t" \
+    "vaesenclast        %%xmm12, %%xmm11, %%xmm11\n\t" \
+    "vmovdqu             96(" #in "), %%xmm0\n\t"      \
+    "vmovdqu            112(" #in "), %%xmm1\n\t"      \
+    "vpxor              %%xmm0, %%xmm10, %%xmm10\n\t"  \
+    "vpxor              %%xmm1, %%xmm11, %%xmm11\n\t"  \
+    "vmovdqu            %%xmm10,  96(" #out ")\n\t"    \
+    "vmovdqu            %%xmm11, 112(" #out ")\n\t"
+
+#define VAESENC_BLOCK()                                       \
+    "vmovdqu            " VAR(CTR1) ", %%xmm5\n\t"            \
+    "vpshufb            %[BSWAP_EPI64], %%xmm5, %%xmm4\n\t"   \
+    "vpaddd             %[ONE], %%xmm5, %%xmm5\n\t"           \
+    "vmovdqu            %%xmm5, " VAR(CTR1) "\n\t"            \
+    "vpxor              (%[KEY]), %%xmm4, %%xmm4\n\t"         \
+    "vaesenc            16(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            32(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            48(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            64(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            80(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            96(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            112(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc            128(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc            144(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "cmpl               $11, %[nr]\n\t"                       \
+    "vmovdqa            160(%[KEY]), %%xmm5\n\t"              \
+    "jl                 %=f\n\t"                              \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            176(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "cmpl               $13, %[nr]\n\t"                       \
+    "vmovdqa            192(%[KEY]), %%xmm5\n\t"              \
+    "jl                 %=f\n\t"                              \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            208(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vmovdqa            224(%[KEY]), %%xmm5\n\t"              \
+    "%=:\n\t"                                                 \
+    "vaesenclast        %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            (%[in]," VAR(KR64) ",1), %%xmm5\n\t"  \
+    "vpxor              %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            %%xmm4, (%[out]," VAR(KR64) ",1)\n\t" \
+    "vpshufb            %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"    \
+    "vpxor              %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"
+
+#define _VAESENC_GFMUL(in, H, X)                              \
+    "vmovdqu            " VAR(CTR1) ", %%xmm5\n\t"            \
+    "vpshufb            %[BSWAP_EPI64], %%xmm5, %%xmm4\n\t"   \
+    "vpaddd             %[ONE], %%xmm5, %%xmm5\n\t"           \
+    "vmovdqu            %%xmm5, " VAR(CTR1) "\n\t"            \
+    "vpxor              (%[KEY]), %%xmm4, %%xmm4\n\t"         \
+    "vpclmulqdq         $0x10, " #H ", " #X ", %%xmm6\n\t"    \
+    "vaesenc            16(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            32(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vpclmulqdq         $0x01, " #H ", " #X ", %%xmm7\n\t"    \
+    "vaesenc            48(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vaesenc            64(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vpclmulqdq         $0x00, " #H ", " #X ", %%xmm8\n\t"    \
+    "vaesenc            80(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vpclmulqdq         $0x11, " #H ", " #X ", %%xmm1\n\t"    \
+    "vaesenc            96(%[KEY]), %%xmm4, %%xmm4\n\t"       \
+    "vpxor              %%xmm7, %%xmm6, %%xmm6\n\t"           \
+    "vpslldq            $8, %%xmm6, %%xmm2\n\t"               \
+    "vpsrldq            $8, %%xmm6, %%xmm6\n\t"               \
+    "vaesenc            112(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vpxor              %%xmm8, %%xmm2, %%xmm2\n\t"           \
+    "vpxor              %%xmm6, %%xmm1, %%xmm3\n\t"           \
+    "vmovdqa            %[MOD2_128], %%xmm0\n\t"              \
+    "vpclmulqdq         $0x10, %%xmm0, %%xmm2, %%xmm7\n\t"    \
+    "vaesenc            128(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vpshufd            $0x4e, %%xmm2, %%xmm6\n\t"            \
+    "vpxor              %%xmm7, %%xmm6, %%xmm6\n\t"           \
+    "vpclmulqdq         $0x10, %%xmm0, %%xmm6, %%xmm7\n\t"    \
+    "vaesenc            144(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vpshufd            $0x4e, %%xmm6, %%xmm6\n\t"            \
+    "vpxor              %%xmm7, %%xmm6, %%xmm6\n\t"           \
+    "vpxor              %%xmm3, %%xmm6, " VAR(XR) "\n\t"      \
+    "cmpl               $11, %[nr]\n\t"                       \
+    "vmovdqa            160(%[KEY]), %%xmm5\n\t"              \
+    "jl                 1f\n\t"                               \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            176(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "cmpl               $13, %[nr]\n\t"                       \
+    "vmovdqa            192(%[KEY]), %%xmm5\n\t"              \
+    "jl                 1f\n\t"                               \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            208(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vmovdqa            224(%[KEY]), %%xmm5\n\t"              \
+    "1:\n\t"                                                  \
+    "vaesenclast        %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            " #in ", %%xmm0\n\t"                  \
+    "vpxor              %%xmm0, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            %%xmm4, (%[out]," VAR(KR64) ",1)\n\t"
+#define VAESENC_GFMUL(in, H, X)                               \
+       _VAESENC_GFMUL(in, H, X)
+
+
+#define _GHASH_GFMUL_AVX1(r, r2, a, b)             \
+    "vpshufd    $0x4e, "#a", %%xmm1\n\t"           \
+    "vpshufd    $0x4e, "#b", %%xmm2\n\t"           \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm3\n\t"     \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm0\n\t"     \
+    "vpxor      "#a", %%xmm1, %%xmm1\n\t"          \
+    "vpxor      "#b", %%xmm2, %%xmm2\n\t"          \
+    "vpclmulqdq $0x00, %%xmm2, %%xmm1, %%xmm1\n\t" \
+    "vpxor      %%xmm0, %%xmm1, %%xmm1\n\t"        \
+    "vpxor      %%xmm3, %%xmm1, %%xmm1\n\t"        \
+    "vmovdqa    %%xmm0, "#r2"\n\t"                 \
+    "vmovdqa    %%xmm3, " #r "\n\t"                \
+    "vpslldq    $8, %%xmm1, %%xmm2\n\t"            \
+    "vpsrldq    $8, %%xmm1, %%xmm1\n\t"            \
+    "vpxor      %%xmm2, "#r2", "#r2"\n\t"          \
+    "vpxor      %%xmm1, " #r ", " #r "\n\t"
+#define GHASH_GFMUL_AVX1(r, r2, a, b)              \
+       _GHASH_GFMUL_AVX1(r, r2, a, b)
+
+#define _GHASH_GFMUL_XOR_AVX1(r, r2, a, b)         \
+    "vpshufd    $0x4e, "#a", %%xmm1\n\t"           \
+    "vpshufd    $0x4e, "#b", %%xmm2\n\t"           \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm3\n\t"     \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm0\n\t"     \
+    "vpxor      "#a", %%xmm1, %%xmm1\n\t"          \
+    "vpxor      "#b", %%xmm2, %%xmm2\n\t"          \
+    "vpclmulqdq $0x00, %%xmm2, %%xmm1, %%xmm1\n\t" \
+    "vpxor      %%xmm0, %%xmm1, %%xmm1\n\t"        \
+    "vpxor      %%xmm3, %%xmm1, %%xmm1\n\t"        \
+    "vpxor      %%xmm0, "#r2", "#r2"\n\t"          \
+    "vpxor      %%xmm3, " #r ", " #r "\n\t"        \
+    "vpslldq    $8, %%xmm1, %%xmm2\n\t"            \
+    "vpsrldq    $8, %%xmm1, %%xmm1\n\t"            \
+    "vpxor      %%xmm2, "#r2", "#r2"\n\t"          \
+    "vpxor      %%xmm1, " #r ", " #r "\n\t"
+#define GHASH_GFMUL_XOR_AVX1(r, r2, a, b)          \
+       _GHASH_GFMUL_XOR_AVX1(r, r2, a, b)
+
+#define GHASH_MID_AVX1(r, r2)               \
+    "vpsrld     $31, "#r2", %%xmm0\n\t"     \
+    "vpsrld     $31, " #r ", %%xmm1\n\t"    \
+    "vpslld     $1, "#r2", "#r2"\n\t"       \
+    "vpslld     $1, " #r ", " #r "\n\t"     \
+    "vpsrldq    $12, %%xmm0, %%xmm2\n\t"    \
+    "vpslldq    $4, %%xmm0, %%xmm0\n\t"     \
+    "vpslldq    $4, %%xmm1, %%xmm1\n\t"     \
+    "vpor       %%xmm2, " #r ", " #r "\n\t" \
+    "vpor       %%xmm0, "#r2", "#r2"\n\t"   \
+    "vpor       %%xmm1, " #r ", " #r "\n\t"
+
+#define _GHASH_GFMUL_RED_AVX1(r, a, b)             \
+    "vpshufd    $0x4e, "#a", %%xmm5\n\t"           \
+    "vpshufd    $0x4e, "#b", %%xmm6\n\t"           \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm7\n\t"     \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm4\n\t"     \
+    "vpxor      "#a", %%xmm5, %%xmm5\n\t"          \
+    "vpxor      "#b", %%xmm6, %%xmm6\n\t"          \
+    "vpclmulqdq $0x00, %%xmm6, %%xmm5, %%xmm5\n\t" \
+    "vpxor      %%xmm4, %%xmm5, %%xmm5\n\t"        \
+    "vpxor      %%xmm7, %%xmm5, %%xmm5\n\t"        \
+    "vpslldq    $8, %%xmm5, %%xmm6\n\t"            \
+    "vpsrldq    $8, %%xmm5, %%xmm5\n\t"            \
+    "vpxor      %%xmm6, %%xmm4, %%xmm4\n\t"        \
+    "vpxor      %%xmm5, %%xmm7, " #r "\n\t"        \
+    "vpslld     $31, %%xmm4, %%xmm8\n\t"           \
+    "vpslld     $30, %%xmm4, %%xmm9\n\t"           \
+    "vpslld     $25, %%xmm4, %%xmm10\n\t"          \
+    "vpxor      %%xmm9, %%xmm8, %%xmm8\n\t"        \
+    "vpxor      %%xmm10, %%xmm8, %%xmm8\n\t"       \
+    "vpsrldq    $4, %%xmm8, %%xmm9\n\t"            \
+    "vpslldq    $12, %%xmm8, %%xmm8\n\t"           \
+    "vpxor      %%xmm8, %%xmm4, %%xmm4\n\t"        \
+    "vpsrld     $1, %%xmm4, %%xmm10\n\t"           \
+    "vpsrld     $2, %%xmm4, %%xmm6\n\t"            \
+    "vpsrld     $7, %%xmm4, %%xmm5\n\t"            \
+    "vpxor      %%xmm6, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm5, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm9, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm4, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm10, " #r ", " #r "\n\t"
+#define GHASH_GFMUL_RED_AVX1(r, a, b)              \
+       _GHASH_GFMUL_RED_AVX1(r, a, b)
+
+#define _GHASH_GFSQR_RED_AVX1(r, a)                \
+    "vpclmulqdq $0x00, "#a", "#a", %%xmm4\n\t"     \
+    "vpclmulqdq $0x11, "#a", "#a", " #r "\n\t"     \
+    "vpslld     $31, %%xmm4, %%xmm8\n\t"           \
+    "vpslld     $30, %%xmm4, %%xmm9\n\t"           \
+    "vpslld     $25, %%xmm4, %%xmm10\n\t"          \
+    "vpxor      %%xmm9, %%xmm8, %%xmm8\n\t"        \
+    "vpxor      %%xmm10, %%xmm8, %%xmm8\n\t"       \
+    "vpsrldq    $4, %%xmm8, %%xmm9\n\t"            \
+    "vpslldq    $12, %%xmm8, %%xmm8\n\t"           \
+    "vpxor      %%xmm8, %%xmm4, %%xmm4\n\t"        \
+    "vpsrld     $1, %%xmm4, %%xmm10\n\t"           \
+    "vpsrld     $2, %%xmm4, %%xmm6\n\t"            \
+    "vpsrld     $7, %%xmm4, %%xmm5\n\t"            \
+    "vpxor      %%xmm6, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm5, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm9, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm4, %%xmm10, %%xmm10\n\t"      \
+    "vpxor      %%xmm10, " #r ", " #r "\n\t"
+#define GHASH_GFSQR_RED_AVX1(r, a)                 \
+       _GHASH_GFSQR_RED_AVX1(r, a)
+
+#define GHASH_RED_AVX1(r, r2)                \
+    "vpslld     $31, "#r2", %%xmm0\n\t"      \
+    "vpslld     $30, "#r2", %%xmm1\n\t"      \
+    "vpslld     $25, "#r2", %%xmm2\n\t"      \
+    "vpxor      %%xmm1, %%xmm0, %%xmm0\n\t"  \
+    "vpxor      %%xmm2, %%xmm0, %%xmm0\n\t"  \
+    "vmovdqa    %%xmm0, %%xmm1\n\t"          \
+    "vpsrldq    $4, %%xmm1, %%xmm1\n\t"      \
+    "vpslldq    $12, %%xmm0, %%xmm0\n\t"     \
+    "vpxor      %%xmm0, "#r2", "#r2"\n\t"    \
+    "vpsrld     $1, "#r2", %%xmm2\n\t"       \
+    "vpsrld     $2, "#r2", %%xmm3\n\t"       \
+    "vpsrld     $7, "#r2", %%xmm0\n\t"       \
+    "vpxor      %%xmm3, %%xmm2, %%xmm2\n\t"  \
+    "vpxor      %%xmm0, %%xmm2, %%xmm2\n\t"  \
+    "vpxor      %%xmm1, %%xmm2, %%xmm2\n\t"  \
+    "vpxor      "#r2", %%xmm2, %%xmm2\n\t"   \
+    "vpxor      %%xmm2, " #r ", " #r "\n\t"
+
+#define GHASH_GFMUL_RED_XOR_AVX1(r, r2, a, b) \
+    GHASH_GFMUL_XOR_AVX1(r, r2, a, b)         \
+    GHASH_RED_AVX1(r, r2)
+
+#define GHASH_FULL_AVX1(r, r2, a, b) \
+    GHASH_GFMUL_AVX1(r, r2, a, b)    \
+    GHASH_MID_AVX1(r, r2)            \
+    GHASH_RED_AVX1(r, r2)
+
+#define CALC_IV_12_AVX1()                                            \
+    "# Calculate values when IV is 12 bytes\n\t"                     \
+    "# Set counter based on IV\n\t"                                  \
+    "movl               $0x01000000, %%ecx\n\t"                      \
+    "vpinsrq            $0, 0(%%rax), %%xmm13, %%xmm13\n\t"          \
+    "vpinsrd            $2, 8(%%rax), %%xmm13, %%xmm13\n\t"          \
+    "vpinsrd            $3, %%ecx, %%xmm13, %%xmm13\n\t"             \
+    "# H = Encrypt X(=0) and T = Encrypt counter\n\t"                \
+    "vmovdqa              0(%[KEY]), " VAR(HR) "\n\t"                \
+    "vpxor              " VAR(HR) ", %%xmm13, %%xmm1\n\t"            \
+    "vmovdqa             16(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             32(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             48(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             64(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             80(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             96(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            112(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            128(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            144(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "cmpl               $11, %[nr]\n\t"                              \
+    "vmovdqa            160(%[KEY]), %%xmm12\n\t"                    \
+    "jl 31f\n\t"                                                     \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            176(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "cmpl               $13, %[nr]\n\t"                              \
+    "vmovdqa            192(%[KEY]), %%xmm12\n\t"                    \
+    "jl 31f\n\t"                                                     \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            208(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqu            224(%[KEY]), %%xmm12\n\t"                    \
+    "31:\n\t"                                                        \
+    "vaesenclast        %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenclast        %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vpshufb            %[BSWAP_MASK], " VAR(HR) ", " VAR(HR) "\n\t" \
+    "vmovdqu            %%xmm1, " VAR(TR) "\n\t"                     \
+    "jmp                39f\n\t"
+
+#define CALC_IV_AVX1()                                       \
+    "# Calculate values when IV is not 12 bytes\n\t"         \
+    "# H = Encrypt X(=0)\n\t"                                \
+    "vmovdqa    0(%[KEY]), " VAR(HR) "\n\t"                  \
+    VAESENC_AVX(HR)                                          \
+    "vpshufb    %[BSWAP_MASK], " VAR(HR) ", " VAR(HR) "\n\t" \
+    "# Calc counter\n\t"                                     \
+    "# Initialization vector\n\t"                            \
+    "cmpl       $0, %%edx\n\t"                               \
+    "movq       $0, %%rcx\n\t"                               \
+    "je 45f\n\t"                                             \
+    "cmpl       $16, %%edx\n\t"                              \
+    "jl 44f\n\t"                                             \
+    "andl       $0xfffffff0, %%edx\n\t"                      \
+    "\n"                                                     \
+    "43:\n\t"                                                \
+    "vmovdqu    (%%rax,%%rcx,1), %%xmm4\n\t"                 \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"           \
+    "vpxor      %%xmm4, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX1(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "addl       $16, %%ecx\n\t"                              \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "jl 43b\n\t"                                             \
+    "movl       %[ibytes], %%edx\n\t"                        \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "je 45f\n\t"                                             \
+    "\n"                                                     \
+    "44:\n\t"                                                \
+    "subq       $16, %%rsp\n\t"                              \
+    "vpxor      %%xmm4, %%xmm4, %%xmm4\n\t"                  \
+    "xorl       %%ebx, %%ebx\n\t"                            \
+    "vmovdqu    %%xmm4, (%%rsp)\n\t"                         \
+    "42:\n\t"                                                \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t"                 \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t"                 \
+    "incl       %%ecx\n\t"                                   \
+    "incl       %%ebx\n\t"                                   \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "jl 42b\n\t"                                             \
+    "vmovdqu    (%%rsp), %%xmm4\n\t"                         \
+    "addq       $16, %%rsp\n\t"                              \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"           \
+    "vpxor      %%xmm4, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX1(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "\n"                                                     \
+    "45:\n\t"                                                \
+    "# T = Encrypt counter\n\t"                              \
+    "vpxor      %%xmm0, %%xmm0, %%xmm0\n\t"                  \
+    "shll       $3, %%edx\n\t"                               \
+    "vpinsrq    $0, %%rdx, %%xmm0, %%xmm0\n\t"               \
+    "vpxor      %%xmm0, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX1(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"         \
+    "#   Encrypt counter\n\t"                                \
+    "vmovdqa    0(%[KEY]), %%xmm4\n\t"                       \
+    "vpxor      %%xmm13, %%xmm4, %%xmm4\n\t"                 \
+    VAESENC_AVX(%%xmm4)                                      \
+    "vmovdqu    %%xmm4, " VAR(TR) "\n\t"
+
+#define CALC_AAD_AVX1()                                \
+    "# Additional authentication data\n\t"             \
+    "movl       %[abytes], %%edx\n\t"                  \
+    "cmpl       $0, %%edx\n\t"                         \
+    "je         25f\n\t"                               \
+    "movq       %[addt], %%rax\n\t"                    \
+    "xorl       %%ecx, %%ecx\n\t"                      \
+    "cmpl       $16, %%edx\n\t"                        \
+    "jl         24f\n\t"                               \
+    "andl       $0xfffffff0, %%edx\n\t"                \
+    "\n"                                               \
+    "23:\n\t"                                          \
+    "vmovdqu    (%%rax,%%rcx,1), %%xmm4\n\t"           \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"     \
+    "vpxor      %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_FULL_AVX1(XR, %%xmm12, XR, HR)               \
+    "addl       $16, %%ecx\n\t"                        \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "jl         23b\n\t"                               \
+    "movl       %[abytes], %%edx\n\t"                  \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "je         25f\n\t"                               \
+    "\n"                                               \
+    "24:\n\t"                                          \
+    "subq       $16, %%rsp\n\t"                        \
+    "vpxor      %%xmm4, %%xmm4, %%xmm4\n\t"            \
+    "xorl       %%ebx, %%ebx\n\t"                      \
+    "vmovdqu    %%xmm4, (%%rsp)\n\t"                   \
+    "22:\n\t"                                          \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t"           \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t"           \
+    "incl       %%ecx\n\t"                             \
+    "incl       %%ebx\n\t"                             \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "jl         22b\n\t"                               \
+    "vmovdqu    (%%rsp), %%xmm4\n\t"                   \
+    "addq       $16, %%rsp\n\t"                        \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"     \
+    "vpxor      %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_FULL_AVX1(XR, %%xmm12, XR, HR)               \
+    "\n"                                               \
+    "25:\n\t"
+
+#define CALC_HT_8_AVX1()                          \
+    "vmovdqa    " VAR(XR) ", %%xmm2\n\t"          \
+    "# H ^ 1\n\t"                                 \
+    "vmovdqu    " VAR(HR) ", 0(" VAR(HTR) ")\n\t" \
+    "# H ^ 2\n\t"                                 \
+    GHASH_GFSQR_RED_AVX1(%%xmm0, HR)              \
+    "vmovdqu    %%xmm0 ,  16(" VAR(HTR) ")\n\t"   \
+    "# H ^ 3\n\t"                                 \
+    GHASH_GFMUL_RED_AVX1(%%xmm1, HR, %%xmm0)      \
+    "vmovdqu    %%xmm1 ,  32(" VAR(HTR) ")\n\t"   \
+    "# H ^ 4\n\t"                                 \
+    GHASH_GFSQR_RED_AVX1(%%xmm3, %%xmm0)          \
+    "vmovdqu    %%xmm3 ,  48(" VAR(HTR) ")\n\t"   \
+    "# H ^ 5\n\t"                                 \
+    GHASH_GFMUL_RED_AVX1(%%xmm12, %%xmm0, %%xmm1) \
+    "vmovdqu    %%xmm12,  64(" VAR(HTR) ")\n\t"   \
+    "# H ^ 6\n\t"                                 \
+    GHASH_GFSQR_RED_AVX1(%%xmm12, %%xmm1)         \
+    "vmovdqu    %%xmm12,  80(" VAR(HTR) ")\n\t"   \
+    "# H ^ 7\n\t"                                 \
+    GHASH_GFMUL_RED_AVX1(%%xmm12, %%xmm1, %%xmm3) \
+    "vmovdqu    %%xmm12,  96(" VAR(HTR) ")\n\t"   \
+    "# H ^ 8\n\t"                                 \
+    GHASH_GFSQR_RED_AVX1(%%xmm12, %%xmm3)         \
+    "vmovdqu    %%xmm12, 112(" VAR(HTR) ")\n\t"
+
+#define VAESENC_128_GHASH_AVX1(src, o)               \
+    "leaq       (%[in]," VAR(KR64) ",1), %%rcx\n\t"  \
+    "leaq       (%[out]," VAR(KR64) ",1), %%rdx\n\t" \
+    /* src is either %%rcx or %%rdx */             \
+    VAESENC_CTR()                                  \
+    VAESENC_XOR()                                  \
+    VAESENC_PCLMUL_1(src,  16, (o-128), 112)       \
+    VAESENC_PCLMUL_N(src,  32, (o-112),  96)       \
+    VAESENC_PCLMUL_N(src,  48, (o- 96),  80)       \
+    VAESENC_PCLMUL_N(src,  64, (o- 80),  64)       \
+    VAESENC_PCLMUL_N(src,  80, (o- 64),  48)       \
+    VAESENC_PCLMUL_N(src,  96, (o- 48),  32)       \
+    VAESENC_PCLMUL_N(src, 112, (o- 32),  16)       \
+    VAESENC_PCLMUL_N(src, 128, (o- 16),   0)       \
+    VAESENC_PCLMUL_L(144)                          \
+    "cmpl       $11, %[nr]\n\t"                    \
+    "vmovdqa    160(%[KEY]), %%xmm12\n\t"          \
+    "jl         4f\n\t"                            \
+    VAESENC()                                      \
+    VAESENC_SET(176)                               \
+    "cmpl       $13, %[nr]\n\t"                    \
+    "vmovdqa    192(%[KEY]), %%xmm12\n\t"          \
+    "jl         4f\n\t"                            \
+    VAESENC()                                      \
+    VAESENC_SET(208)                               \
+    "vmovdqa    224(%[KEY]), %%xmm12\n\t"          \
+    "\n"                                           \
+"4:\n\t"                                           \
+    VAESENC_LAST(%%rcx, %%rdx)
+
+#define _VAESENC_AVX(r)                                  \
+    "vaesenc            16(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            32(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            48(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            64(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            80(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            96(%[KEY]), " #r ", " #r "\n\t"  \
+    "vaesenc            112(%[KEY]), " #r ", " #r "\n\t" \
+    "vaesenc            128(%[KEY]), " #r ", " #r "\n\t" \
+    "vaesenc            144(%[KEY]), " #r ", " #r "\n\t" \
+    "cmpl               $11, %[nr]\n\t"                  \
+    "vmovdqa            160(%[KEY]), %%xmm5\n\t"         \
+    "jl                 %=f\n\t"                         \
+    "vaesenc            %%xmm5, " #r ", " #r "\n\t"      \
+    "vaesenc            176(%[KEY]), " #r ", " #r "\n\t" \
+    "cmpl               $13, %[nr]\n\t"                  \
+    "vmovdqa            192(%[KEY]), %%xmm5\n\t"         \
+    "jl                 %=f\n\t"                         \
+    "vaesenc            %%xmm5, " #r ", " #r "\n\t"      \
+    "vaesenc            208(%[KEY]), " #r ", " #r "\n\t" \
+    "vmovdqa            224(%[KEY]), %%xmm5\n\t"         \
+    "%=:\n\t"                                            \
+    "vaesenclast        %%xmm5, " #r ", " #r "\n\t"
+#define VAESENC_AVX(r)                                   \
+        _VAESENC_AVX(r)
+
+#define AESENC_LAST15_ENC_AVX1()                        \
+    "movl       %[nbytes], %%ecx\n\t"                   \
+    "movl       %%ecx, %%edx\n\t"                       \
+    "andl       $0x0f, %%ecx\n\t"                       \
+    "jz         55f\n\t"                                \
+    "vmovdqu    " VAR(CTR1) ", %%xmm13\n\t"             \
+    "vpshufb    %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"   \
+    "vpxor      0(%[KEY]), %%xmm13, %%xmm13\n\t"        \
+    VAESENC_AVX(%%xmm13)                                \
+    "subq       $16, %%rsp\n\t"                         \
+    "xorl       %%ecx, %%ecx\n\t"                       \
+    "vmovdqu    %%xmm13, (%%rsp)\n\t"                   \
+    "\n"                                                \
+    "51:\n\t"                                           \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"    \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"            \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t"   \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"            \
+    "incl       " VAR(KR) "\n\t"                        \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       %%edx, " VAR(KR) "\n\t"                 \
+    "jl         51b\n\t"                                \
+    "xorq       %%r13, %%r13\n\t"                       \
+    "cmpl       $16, %%ecx\n\t"                         \
+    "je         53f\n\t"                                \
+    "\n"                                                \
+    "52:\n\t"                                           \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"            \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       $16, %%ecx\n\t"                         \
+    "jl         52b\n\t"                                \
+    "53:\n\t"                                           \
+    "vmovdqu    (%%rsp), %%xmm13\n\t"                   \
+    "addq       $16, %%rsp\n\t"                         \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"    \
+    "vpxor      %%xmm13, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_GFMUL_RED_AVX1(XR, HR, XR)                    \
+
+#define AESENC_LAST15_DEC_AVX1()                        \
+    "movl       %[nbytes], %%ecx\n\t"                   \
+    "movl       %%ecx, %%edx\n\t"                       \
+    "andl       $0x0f, %%ecx\n\t"                       \
+    "jz         55f\n\t"                                \
+    "vmovdqu    " VAR(CTR1) ", %%xmm13\n\t"             \
+    "vpshufb    %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"   \
+    "vpxor      0(%[KEY]), %%xmm13, %%xmm13\n\t"        \
+    VAESENC_AVX(%%xmm13)                                \
+    "subq       $32, %%rsp\n\t"                         \
+    "xorl       %%ecx, %%ecx\n\t"                       \
+    "vmovdqu    %%xmm13, (%%rsp)\n\t"                   \
+    "vpxor      %%xmm0, %%xmm0, %%xmm0\n\t"             \
+    "vmovdqu    %%xmm0, 16(%%rsp)\n\t"                  \
+    "\n"                                                \
+    "51:\n\t"                                           \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"    \
+    "movb       %%r13b, 16(%%rsp,%%rcx,1)\n\t"          \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"            \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t"   \
+    "incl       " VAR(KR) "\n\t"                        \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       %%edx, " VAR(KR) "\n\t"                 \
+    "jl         51b\n\t"                                \
+    "53:\n\t"                                           \
+    "vmovdqu    16(%%rsp), %%xmm13\n\t"                 \
+    "addq       $32, %%rsp\n\t"                         \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"    \
+    "vpxor      %%xmm13, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_GFMUL_RED_AVX1(XR, HR, XR)                    \
+
+#define CALC_TAG_AVX1()                                      \
+    "movl       %[nbytes], %%edx\n\t"                        \
+    "movl       %[abytes], %%ecx\n\t"                        \
+    "shlq       $3, %%rdx\n\t"                               \
+    "shlq       $3, %%rcx\n\t"                               \
+    "vpinsrq    $0, %%rdx, %%xmm0, %%xmm0\n\t"               \
+    "vpinsrq    $1, %%rcx, %%xmm0, %%xmm0\n\t"               \
+    "vpxor      %%xmm0, " VAR(XR) ", " VAR(XR) "\n\t"        \
+    GHASH_GFMUL_RED_AVX1(XR, HR, XR)                         \
+    "vpshufb    %[BSWAP_MASK], " VAR(XR) ", " VAR(XR) "\n\t" \
+    "vpxor      " VAR(TR) ", " VAR(XR) ", %%xmm0\n\t"        \
+
+#define STORE_TAG_AVX()                       \
+    "cmpl       $16, %[tbytes]\n\t"           \
+    "je         71f\n\t"                      \
+    "xorq       %%rcx, %%rcx\n\t"             \
+    "vmovdqu    %%xmm0, (%%rsp)\n\t"          \
+    "73:\n\t"                                 \
+    "movzbl     (%%rsp,%%rcx,1), %%r13d\n\t"  \
+    "movb       %%r13b, (%[tag],%%rcx,1)\n\t" \
+    "incl       %%ecx\n\t"                    \
+    "cmpl       %[tbytes], %%ecx\n\t"         \
+    "jne        73b\n\t"                      \
+    "jmp        72f\n\t"                      \
+    "\n"                                      \
+    "71:\n\t"                                 \
+    "vmovdqu    %%xmm0, (%[tag])\n\t"         \
+    "\n"                                      \
+    "72:\n\t"
+
+#define CMP_TAG_AVX()                                      \
+    "cmpl       $16, %[tbytes]\n\t"                        \
+    "je         71f\n\t"                                   \
+    "subq       $16, %%rsp\n\t"                            \
+    "xorq       %%rcx, %%rcx\n\t"                          \
+    "xorq       %%rax, %%rax\n\t"                          \
+    "vmovdqu    %%xmm0, (%%rsp)\n\t"                       \
+    "\n"                                                   \
+    "73:\n\t"                                              \
+    "movzbl     (%%rsp,%%rcx,1), %%r13d\n\t"               \
+    "xorb       (%[tag],%%rcx,1), %%r13b\n\t"              \
+    "orb        %%r13b, %%al\n\t"                          \
+    "incl       %%ecx\n\t"                                 \
+    "cmpl       %[tbytes], %%ecx\n\t"                      \
+    "jne        73b\n\t"                                   \
+    "cmpb       $0x00, %%al\n\t"                           \
+    "sete       %%al\n\t"                                  \
+    "addq       $16, %%rsp\n\t"                            \
+    "jmp        72f\n\t"                                   \
+    "\n"                                                   \
+    "71:\n\t"                                              \
+    "vmovdqu    (%[tag]), %%xmm1\n\t"                      \
+    "vpcmpeqb   %%xmm1, %%xmm0, %%xmm0\n\t"                \
+    "vpmovmskb  %%xmm0, %%edx\n\t"                         \
+    "# %%edx == 0xFFFF then return 1 else => return 0\n\t" \
+    "xorl       %%eax, %%eax\n\t"                          \
+    "cmpl       $0xffff, %%edx\n\t"                        \
+    "sete       %%al\n\t"                                  \
+    "\n"                                                   \
+    "72:\n\t"                                              \
+    "movl       %%eax, (%[res])\n\t"
+
+static void AES_GCM_encrypt_avx1(const unsigned char *in, unsigned char *out,
+                            const unsigned char* addt,
+                                 const unsigned char* ivec, unsigned char *tag,
+                                 unsigned int nbytes, unsigned int abytes,
+                                 unsigned int ibytes, unsigned int tbytes,
+                            const unsigned char* key, int nr)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register unsigned int ivLen asm("ebx") = ibytes;
+
+    __asm__ __volatile__ (
+        "subq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "vpxor          %%xmm13, %%xmm13, %%xmm13\n\t"
+        "vpxor          " VAR(XR) ", " VAR(XR) ", " VAR(XR) "\n\t"
+        "movl           %[ibytes], %%edx\n\t"
+        "cmpl           $12, %%edx\n\t"
+        "jne            35f\n\t"
+        CALC_IV_12_AVX1()
+        "\n"
+        "35:\n\t"
+        CALC_IV_AVX1()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD_AVX1()
+
+        "# Calculate counter and H\n\t"
+        "vpsrlq         $63, " VAR(HR) ", %%xmm5\n\t"
+        "vpsllq         $1, " VAR(HR) ", %%xmm4\n\t"
+        "vpslldq        $8, %%xmm5, %%xmm5\n\t"
+        "vpor           %%xmm5, %%xmm4, %%xmm4\n\t"
+        "vpshufd        $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpsrad         $31, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"
+        "vpand          %[MOD2_128], " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpaddd         %[ONE], %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm4, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vmovdqu        %%xmm13, " VAR(CTR1) "\n\t"
+
+        "xorl           " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+        "cmpl   $128, %[nbytes]\n\t"
+        "movl   %[nbytes], %%r13d\n\t"
+        "jl     5f\n\t"
+        "andl   $0xffffff80, %%r13d\n\t"
+
+        CALC_HT_8_AVX1()
+
+        "# First 128 bytes of input\n\t"
+        VAESENC_128()
+
+        "cmpl   $128, %%r13d\n\t"
+        "movl   $128, " VAR(KR) "\n\t"
+        "jle    2f\n\t"
+
+        "# More 128 bytes of input\n\t"
+        "\n"
+    "3:\n\t"
+        VAESENC_128_GHASH_AVX1(%%rdx, 0)
+        "addl   $128, " VAR(KR) "\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jl     3b\n\t"
+        "\n"
+    "2:\n\t"
+        "vmovdqa        %[BSWAP_MASK], %%xmm13\n\t"
+        "vpshufb        %%xmm13, %%xmm4, %%xmm4\n\t"
+        "vpshufb        %%xmm13, %%xmm5, %%xmm5\n\t"
+        "vpshufb        %%xmm13, %%xmm6, %%xmm6\n\t"
+        "vpshufb        %%xmm13, %%xmm7, %%xmm7\n\t"
+        "vpxor          %%xmm2, %%xmm4, %%xmm4\n\t"
+        "vpshufb        %%xmm13, %%xmm8, %%xmm8\n\t"
+        "vpshufb        %%xmm13, %%xmm9, %%xmm9\n\t"
+        "vpshufb        %%xmm13, %%xmm10, %%xmm10\n\t"
+        "vpshufb        %%xmm13, %%xmm11, %%xmm11\n\t"
+
+        "vmovdqu           (" VAR(HTR) "), %%xmm12\n\t"
+        "vmovdqu         16(" VAR(HTR) "), %%xmm14\n\t"
+        GHASH_GFMUL_AVX1(XR, %%xmm13, %%xmm11, %%xmm12)
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm10, %%xmm14)
+        "vmovdqu         32(" VAR(HTR) "), %%xmm12\n\t"
+        "vmovdqu         48(" VAR(HTR) "), %%xmm14\n\t"
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm9, %%xmm12)
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm8, %%xmm14)
+        "vmovdqu         64(" VAR(HTR) "), %%xmm12\n\t"
+        "vmovdqu         80(" VAR(HTR) "), %%xmm14\n\t"
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm7, %%xmm12)
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm6, %%xmm14)
+        "vmovdqu         96(" VAR(HTR) "), %%xmm12\n\t"
+        "vmovdqu        112(" VAR(HTR) "), %%xmm14\n\t"
+        GHASH_GFMUL_XOR_AVX1(XR, %%xmm13, %%xmm5, %%xmm12)
+        GHASH_GFMUL_RED_XOR_AVX1(XR, %%xmm13, %%xmm4, %%xmm14)
+
+        "vmovdqu        0(" VAR(HTR) "), " VAR(HR) "\n\t"
+        "\n"
+    "5:\n\t"
+        "movl           %[nbytes], %%edx\n\t"
+        "cmpl           %%edx, " VAR(KR) "\n\t"
+        "jge            55f\n\t"
+#endif
+
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xfffffff0, %%r13d\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            14f\n\t"
+
+        VAESENC_BLOCK()
+        "addl           $16, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            13f\n\t"
+        "\n"
+        "12:\n\t"
+        "vmovdqu        (%[in]," VAR(KR64) ",1), %%xmm9\n\t"
+        VAESENC_GFMUL(%%xmm9, HR, XR)
+        "vpshufb        %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"
+        "addl           $16, " VAR(KR) "\n\t"
+        "vpxor          %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             12b\n\t"
+        "\n"
+        "13:\n\t"
+        GHASH_GFMUL_RED_AVX1(XR, HR, XR)
+        "\n"
+        "14:\n\t"
+
+        AESENC_LAST15_ENC_AVX1()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG_AVX1()
+        STORE_TAG_AVX()
+        "addq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        "vzeroupper\n\t"
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tbytes),
+          [tag] "r" (tag),
+          [BSWAP_MASK] "m" (BSWAP_MASK),
+          [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+          [MOD2_128] "m" (MOD2_128)
+        : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "rdx", "r13"
+    );
+    }
+
+#ifdef HAVE_INTEL_AVX2
+/* Encrypt and carry-less multiply for AVX2. */
+#define VAESENC_PCLMUL_AVX2_1(src, o1, o2, o3)        \
+    "vmovdqu    " #o2 "(" #src "), %%xmm12\n\t"       \
+    "vmovdqa    " #o1 "(%[KEY]), %%xmm0\n\t"          \
+    "vpshufb    %[BSWAP_MASK], %%xmm12, %%xmm12\n\t"  \
+    "vmovdqu    " #o3 "(" VAR(HTR) "), %%xmm13\n\t"   \
+    "vpxor      %%xmm2, %%xmm12, %%xmm12\n\t"         \
+    "vpclmulqdq $0x10, %%xmm13, %%xmm12, %%xmm1\n\t"  \
+    "vpclmulqdq $0x01, %%xmm13, %%xmm12, %%xmm14\n\t" \
+    "vpclmulqdq $0x00, %%xmm13, %%xmm12, %%xmm2\n\t"  \
+    "vpclmulqdq $0x11, %%xmm13, %%xmm12, %%xmm3\n\t"  \
+    "vaesenc    %%xmm0, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc    %%xmm0, %%xmm5, %%xmm5\n\t"           \
+    "vaesenc    %%xmm0, %%xmm6, %%xmm6\n\t"           \
+    "vaesenc    %%xmm0, %%xmm7, %%xmm7\n\t"           \
+    "vaesenc    %%xmm0, %%xmm8, %%xmm8\n\t"           \
+    "vaesenc    %%xmm0, %%xmm9, %%xmm9\n\t"           \
+    "vaesenc    %%xmm0, %%xmm10, %%xmm10\n\t"         \
+    "vaesenc    %%xmm0, %%xmm11, %%xmm11\n\t"         \
+
+#define VAESENC_PCLMUL_AVX2_2(src, o1, o2, o3)        \
+    "vmovdqu    " #o2 "(" #src "), %%xmm12\n\t"       \
+    "vmovdqu    " #o3 "(" VAR(HTR) "), %%xmm0\n\t"    \
+    "vpshufb    %[BSWAP_MASK], %%xmm12, %%xmm12\n\t"  \
+    "vpxor      %%xmm14, %%xmm1, %%xmm1\n\t"          \
+    "vpclmulqdq $0x10, %%xmm0, %%xmm12, %%xmm13\n\t"  \
+    "vpclmulqdq $0x01, %%xmm0, %%xmm12, %%xmm14\n\t"  \
+    "vpclmulqdq $0x00, %%xmm0, %%xmm12, %%xmm15\n\t"  \
+    "vpclmulqdq $0x11, %%xmm0, %%xmm12, %%xmm12\n\t"  \
+    "vmovdqa    " #o1 "(%[KEY]), %%xmm0\n\t"          \
+    "vpxor      %%xmm13, %%xmm1, %%xmm1\n\t"          \
+    "vpxor      %%xmm12, %%xmm3, %%xmm3\n\t"          \
+    "vaesenc    %%xmm0, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc    %%xmm0, %%xmm5, %%xmm5\n\t"           \
+    "vaesenc    %%xmm0, %%xmm6, %%xmm6\n\t"           \
+    "vaesenc    %%xmm0, %%xmm7, %%xmm7\n\t"           \
+    "vaesenc    %%xmm0, %%xmm8, %%xmm8\n\t"           \
+    "vaesenc    %%xmm0, %%xmm9, %%xmm9\n\t"           \
+    "vaesenc    %%xmm0, %%xmm10, %%xmm10\n\t"         \
+    "vaesenc    %%xmm0, %%xmm11, %%xmm11\n\t"         \
+
+#define VAESENC_PCLMUL_AVX2_N(src, o1, o2, o3)        \
+    "vmovdqu    " #o2 "(" #src "), %%xmm12\n\t"       \
+    "vmovdqu    " #o3 "(" VAR(HTR) "), %%xmm0\n\t"    \
+    "vpshufb    %[BSWAP_MASK], %%xmm12, %%xmm12\n\t"  \
+    "vpxor      %%xmm14, %%xmm1, %%xmm1\n\t"          \
+    "vpxor      %%xmm15, %%xmm2, %%xmm2\n\t"          \
+    "vpclmulqdq $0x10, %%xmm0, %%xmm12, %%xmm13\n\t"  \
+    "vpclmulqdq $0x01, %%xmm0, %%xmm12, %%xmm14\n\t"  \
+    "vpclmulqdq $0x00, %%xmm0, %%xmm12, %%xmm15\n\t"  \
+    "vpclmulqdq $0x11, %%xmm0, %%xmm12, %%xmm12\n\t"  \
+    "vmovdqa    " #o1 "(%[KEY]), %%xmm0\n\t"          \
+    "vpxor      %%xmm13, %%xmm1, %%xmm1\n\t"          \
+    "vpxor      %%xmm12, %%xmm3, %%xmm3\n\t"          \
+    "vaesenc    %%xmm0, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc    %%xmm0, %%xmm5, %%xmm5\n\t"           \
+    "vaesenc    %%xmm0, %%xmm6, %%xmm6\n\t"           \
+    "vaesenc    %%xmm0, %%xmm7, %%xmm7\n\t"           \
+    "vaesenc    %%xmm0, %%xmm8, %%xmm8\n\t"           \
+    "vaesenc    %%xmm0, %%xmm9, %%xmm9\n\t"           \
+    "vaesenc    %%xmm0, %%xmm10, %%xmm10\n\t"         \
+    "vaesenc    %%xmm0, %%xmm11, %%xmm11\n\t"         \
+
+#define VAESENC_PCLMUL_AVX2_L(o)                      \
+    "vpxor      %%xmm14, %%xmm1, %%xmm1\n\t"          \
+    "vpxor      %%xmm15, %%xmm2, %%xmm2\n\t"          \
+    "vpslldq    $8, %%xmm1, %%xmm12\n\t"              \
+    "vpsrldq    $8, %%xmm1, %%xmm1\n\t"               \
+    "vmovdqa    "#o"(%[KEY]), %%xmm15\n\t"            \
+    "vmovdqa    %[MOD2_128], %%xmm0\n\t"              \
+    "vaesenc    %%xmm15, %%xmm4, %%xmm4\n\t"          \
+    "vpxor      %%xmm12, %%xmm2, %%xmm2\n\t"          \
+    "vpxor      %%xmm1, %%xmm3, %%xmm3\n\t"           \
+    "vpclmulqdq $0x10, %%xmm0, %%xmm2, %%xmm14\n\t"   \
+    "vaesenc    %%xmm15, %%xmm5, %%xmm5\n\t"          \
+    "vaesenc    %%xmm15, %%xmm6, %%xmm6\n\t"          \
+    "vaesenc    %%xmm15, %%xmm7, %%xmm7\n\t"          \
+    "vpshufd    $0x4e, %%xmm2, %%xmm2\n\t"            \
+    "vpxor      %%xmm14, %%xmm2, %%xmm2\n\t"          \
+    "vpclmulqdq $0x10, %%xmm0, %%xmm2, %%xmm14\n\t"   \
+    "vaesenc    %%xmm15, %%xmm8, %%xmm8\n\t"          \
+    "vaesenc    %%xmm15, %%xmm9, %%xmm9\n\t"          \
+    "vaesenc    %%xmm15, %%xmm10, %%xmm10\n\t"        \
+    "vpshufd    $0x4e, %%xmm2, %%xmm2\n\t"            \
+    "vpxor      %%xmm14, %%xmm2, %%xmm2\n\t"          \
+    "vpxor      %%xmm3, %%xmm2, %%xmm2\n\t"           \
+    "vaesenc    %%xmm15, %%xmm11, %%xmm11\n\t"
+
+#define VAESENC_BLOCK_AVX2()                                  \
+    "vmovdqu            " VAR(CTR1) ", %%xmm5\n\t"            \
+    "vpshufb            %[BSWAP_EPI64], %%xmm5, %%xmm4\n\t"   \
+    "vpaddd             %[ONE], %%xmm5, %%xmm5\n\t"           \
+    "vmovdqu            %%xmm5, " VAR(CTR1) "\n\t"            \
+    "vpxor                 (%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             16(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             32(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             48(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             64(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             80(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc             96(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc            112(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc            128(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vaesenc            144(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "cmpl               $11, %[nr]\n\t"                       \
+    "vmovdqa            160(%[KEY]), %%xmm5\n\t"              \
+    "jl                 %=f\n\t"                              \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            176(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "cmpl               $13, %[nr]\n\t"                       \
+    "vmovdqa            192(%[KEY]), %%xmm5\n\t"              \
+    "jl                 %=f\n\t"                              \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vaesenc            208(%[KEY]), %%xmm4, %%xmm4\n\t"      \
+    "vmovdqa            224(%[KEY]), %%xmm5\n\t"              \
+    "%=:\n\t"                                                 \
+    "vaesenclast        %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            (%[in]," VAR(KR64) ",1), %%xmm5\n\t"  \
+    "vpxor              %%xmm5, %%xmm4, %%xmm4\n\t"           \
+    "vmovdqu            %%xmm4, (%[out]," VAR(KR64) ",1)\n\t" \
+    "vpshufb            %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"    \
+    "vpxor              %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"
+
+/* Karatsuba multiplication - slower
+ * H01 = H[1] ^ H[0] (top and bottom 64-bits XORed)
+ */
+#define _VAESENC_GFMUL_AVX2(in, H, X, ctr1, H01)            \
+    "vpxor                 (%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             16(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             32(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             48(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             64(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             80(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             96(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc            112(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc            128(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc            144(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "cmpl               $11, %[nr]\n\t"                     \
+    "vmovdqa            160(%[KEY]), %%xmm5\n\t"            \
+    "jl                 %=f\n\t"                            \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"         \
+    "vaesenc            176(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "cmpl               $13, %[nr]\n\t"                     \
+    "vmovdqa            192(%[KEY]), %%xmm5\n\t"            \
+    "jl                 %=f\n\t"                            \
+    "vaesenc            %%xmm5, %%xmm4, %%xmm4\n\t"         \
+    "vaesenc            208(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vmovdqa            224(%[KEY]), %%xmm5\n\t"            \
+    "%=:\n\t"                                               \
+    "vaesenclast        %%xmm5, %%xmm4, %%xmm4\n\t"         \
+    "vmovdqu            " #in ", %%xmm0\n\t"                \
+    "vpxor              %%xmm0, %%xmm4, %%xmm4\n\t"         \
+                                                            \
+    "vpsrldq    $8, " #X ", %%xmm2\n\t"                     \
+    "vpxor      " #X ", %%xmm2, %%xmm2\n\t"                 \
+    "vpclmulqdq $0x00, " #H ", " #X ", %%xmm5\n\t"          \
+    "vpclmulqdq $0x11, " #H ", " #X ", %%xmm8\n\t"          \
+    "vpclmulqdq $0x00, "#H01", %%xmm2, %%xmm7\n\t"          \
+    "vpxor      %%xmm5, %%xmm7, %%xmm7\n\t"                 \
+    "vpxor      %%xmm8, %%xmm7, %%xmm7\n\t"                 \
+    "vpslldq    $8, %%xmm7, %%xmm6\n\t"                     \
+    "vpsrldq    $8, %%xmm7, %%xmm7\n\t"                     \
+    "vpxor      %%xmm7, %%xmm8, %%xmm8\n\t"                 \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"                 \
+                                                            \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t"     \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"                  \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"                 \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t"     \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"                  \
+    "vpxor      %%xmm8, %%xmm6, %%xmm6\n\t"                 \
+    "vpxor      %%xmm5, %%xmm6, " VAR(XR) "\n\t"
+#define VAESENC_GFMUL_AVX2(in, H, X, ctr1)                  \
+       _VAESENC_GFMUL_AVX2(in, H, X, ctr1)
+
+#define _VAESENC_GFMUL_SB_AVX2(in, H, X, ctr1)              \
+    "vpclmulqdq $0x10, " #H ", " #X ", %%xmm7\n\t"          \
+    "vpclmulqdq $0x01, " #H ", " #X ", %%xmm6\n\t"          \
+    "vpclmulqdq $0x00, " #H ", " #X ", %%xmm5\n\t"          \
+    "vpclmulqdq $0x11, " #H ", " #X ", %%xmm8\n\t"          \
+    "vpxor                 (%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             16(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpxor      %%xmm6, %%xmm7, %%xmm7\n\t"                 \
+    "vpslldq    $8, %%xmm7, %%xmm6\n\t"                     \
+    "vpsrldq    $8, %%xmm7, %%xmm7\n\t"                     \
+    "vaesenc             32(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"                 \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t"     \
+    "vaesenc             48(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             64(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc             80(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"                  \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"                 \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t"     \
+    "vaesenc             96(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc            112(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vaesenc            128(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"                  \
+    "vaesenc            144(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vpxor      %%xmm7, %%xmm8, %%xmm8\n\t"                 \
+    "vpxor      %%xmm8, %%xmm6, %%xmm6\n\t"                 \
+    "cmpl               $11, %[nr]\n\t"                     \
+    "vmovdqa            160(%[KEY]), %%xmm3\n\t"            \
+    "jl                 %=f\n\t"                            \
+    "vaesenc            %%xmm3, %%xmm4, %%xmm4\n\t"         \
+    "vaesenc            176(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "cmpl               $13, %[nr]\n\t"                     \
+    "vmovdqa            192(%[KEY]), %%xmm3\n\t"            \
+    "jl                 %=f\n\t"                            \
+    "vaesenc            %%xmm3, %%xmm4, %%xmm4\n\t"         \
+    "vaesenc            208(%[KEY]), %%xmm4, %%xmm4\n\t"    \
+    "vmovdqa            224(%[KEY]), %%xmm3\n\t"            \
+    "%=:\n\t"                                               \
+    "vaesenclast        %%xmm3, %%xmm4, %%xmm4\n\t"         \
+    "vpxor      %%xmm5, %%xmm6, " VAR(XR) "\n\t"            \
+    "vmovdqu            " #in ", %%xmm5\n\t"                \
+    "vpxor              %%xmm5, %%xmm4, %%xmm4\n\t"
+#define VAESENC_GFMUL_SB_AVX2(in, H, X, ctr1)               \
+       _VAESENC_GFMUL_SB_AVX2(in, H, X, ctr1)
+
+
+#define _GHASH_GFMUL_AVX2(r, r2, a, b)         \
+    "vpclmulqdq $0x10, "#a", "#b", %%xmm2\n\t" \
+    "vpclmulqdq $0x01, "#a", "#b", %%xmm1\n\t" \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm0\n\t" \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm3\n\t" \
+    "vpxor      %%xmm1, %%xmm2, %%xmm2\n\t"    \
+    "vpslldq    $8, %%xmm2, %%xmm1\n\t"        \
+    "vpsrldq    $8, %%xmm2, %%xmm2\n\t"        \
+    "vpxor      %%xmm1, %%xmm0, "#r2"\n\t"     \
+    "vpxor      %%xmm2, %%xmm3, " #r "\n\t"
+#define GHASH_GFMUL_AVX2(r, r2, a, b)          \
+       _GHASH_GFMUL_AVX2(r, r2, a, b)
+
+#define GHASH_MID_AVX2(r, r2)               \
+    "vpsrld     $31, "#r2", %%xmm0\n\t"     \
+    "vpsrld     $31, " #r ", %%xmm1\n\t"    \
+    "vpslld     $1, "#r2", "#r2"\n\t"       \
+    "vpslld     $1, " #r ", " #r "\n\t"     \
+    "vpsrldq    $12, %%xmm0, %%xmm2\n\t"    \
+    "vpslldq    $4, %%xmm0, %%xmm0\n\t"     \
+    "vpslldq    $4, %%xmm1, %%xmm1\n\t"     \
+    "vpor       %%xmm2, " #r ", " #r "\n\t" \
+    "vpor       %%xmm0, "#r2", "#r2"\n\t"   \
+    "vpor       %%xmm1, " #r ", " #r "\n\t"
+
+#define _GHASH_GFMUL_RED_AVX2(r, a, b)                  \
+    "vpclmulqdq $0x10, "#a", "#b", %%xmm7\n\t"          \
+    "vpclmulqdq $0x01, "#a", "#b", %%xmm6\n\t"          \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm5\n\t"          \
+    "vpxor      %%xmm6, %%xmm7, %%xmm7\n\t"             \
+    "vpslldq    $8, %%xmm7, %%xmm6\n\t"                 \
+    "vpsrldq    $8, %%xmm7, %%xmm7\n\t"                 \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"             \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm8\n\t"          \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t" \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"             \
+    "vpclmulqdq $0x10, %[MOD2_128], %%xmm6, %%xmm5\n\t" \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm7, %%xmm8, %%xmm8\n\t"             \
+    "vpxor      %%xmm8, %%xmm6, %%xmm6\n\t"             \
+    "vpxor      %%xmm5, %%xmm6, " #r "\n\t"
+#define GHASH_GFMUL_RED_AVX2(r, a, b)                   \
+       _GHASH_GFMUL_RED_AVX2(r, a, b)
+
+#define _GHASH_GFSQR_RED2_AVX2(r, a, mod128)            \
+    "vpclmulqdq $0x00, "#a", "#a", %%xmm6\n\t"          \
+    "vpclmulqdq $0x11, "#a", "#a", %%xmm8\n\t"          \
+    "vpclmulqdq $0x10, "#mod128", %%xmm6, %%xmm5\n\t"   \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"             \
+    "vpclmulqdq $0x10, "#mod128", %%xmm6, %%xmm5\n\t"   \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"             \
+    "vpxor      %%xmm6, %%xmm8, " #r "\n\t"
+#define GHASH_GFSQR_RED2_AVX2(r, a, mod128)             \
+       _GHASH_GFSQR_RED2_AVX2(r, a, mod128)
+
+#define _GHASH_GFMUL_SQR_RED2_AVX2(rm, rs, a, b, mod128) \
+    "vpclmulqdq $0x10, "#a", "#b", %%xmm7\n\t"           \
+    "vpclmulqdq $0x01, "#a", "#b", %%xmm6\n\t"           \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm5\n\t"           \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm8\n\t"           \
+    "vpclmulqdq $0x00, "#b", "#b", %%xmm9\n\t"           \
+    "vpclmulqdq $0x11, "#b", "#b", %%xmm10\n\t"          \
+    "vpxor      %%xmm6, %%xmm7, %%xmm7\n\t"              \
+    "vpslldq    $8, %%xmm7, %%xmm6\n\t"                  \
+    "vpsrldq    $8, %%xmm7, %%xmm7\n\t"                  \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"              \
+    "vpclmulqdq $0x10, "#mod128", %%xmm9, %%xmm4\n\t"    \
+    "vpclmulqdq $0x10, "#mod128", %%xmm6, %%xmm5\n\t"    \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"               \
+    "vpshufd    $0x4e, %%xmm9, %%xmm9\n\t"               \
+    "vpxor      %%xmm5, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm4, %%xmm9, %%xmm9\n\t"              \
+    "vpclmulqdq $0x10, "#mod128", %%xmm6, %%xmm5\n\t"    \
+    "vpclmulqdq $0x10, "#mod128", %%xmm9, %%xmm4\n\t"    \
+    "vpshufd    $0x4e, %%xmm6, %%xmm6\n\t"               \
+    "vpshufd    $0x4e, %%xmm9, %%xmm9\n\t"               \
+    "vpxor      %%xmm7, %%xmm8, %%xmm8\n\t"              \
+    "vpxor      %%xmm4, %%xmm9, %%xmm9\n\t"              \
+    "vpxor      %%xmm8, %%xmm6, %%xmm6\n\t"              \
+    "vpxor      %%xmm10, %%xmm9, "#rs"\n\t"              \
+    "vpxor      %%xmm5, %%xmm6, "#rm"\n\t"
+#define GHASH_GFMUL_SQR_RED2_AVX2(rm, rs, a, b, mod128)  \
+       _GHASH_GFMUL_SQR_RED2_AVX2(rm, rs, a, b, mod128)
+
+#define CALC_HT_8_AVX2()                                                \
+    "vmovdqa    %[MOD2_128], %%xmm11\n\t"                               \
+    "vmovdqa    " VAR(XR) ", %%xmm2\n\t"                                \
+    "# H ^ 1 and H ^ 2\n\t"                                             \
+    GHASH_GFSQR_RED2_AVX2(%%xmm0, HR, %%xmm11)                          \
+    "vmovdqu    " VAR(HR) ", 0(" VAR(HTR) ")\n\t"                       \
+    "vmovdqu    %%xmm0 ,  16(" VAR(HTR) ")\n\t"                         \
+    "# H ^ 3 and H ^ 4\n\t"                                             \
+    GHASH_GFMUL_SQR_RED2_AVX2(%%xmm1, %%xmm3, HR, %%xmm0, %%xmm11)      \
+    "vmovdqu    %%xmm1 ,  32(" VAR(HTR) ")\n\t"                         \
+    "vmovdqu    %%xmm3 ,  48(" VAR(HTR) ")\n\t"                         \
+    "# H ^ 5 and H ^ 6\n\t"                                             \
+    GHASH_GFMUL_SQR_RED2_AVX2(%%xmm12, %%xmm0, %%xmm0, %%xmm1, %%xmm11) \
+    "vmovdqu    %%xmm12,  64(" VAR(HTR) ")\n\t"                         \
+    "vmovdqu    %%xmm0 ,  80(" VAR(HTR) ")\n\t"                         \
+    "# H ^ 7 and H ^ 8\n\t"                                             \
+    GHASH_GFMUL_SQR_RED2_AVX2(%%xmm12, %%xmm0, %%xmm1, %%xmm3, %%xmm11) \
+    "vmovdqu    %%xmm12,  96(" VAR(HTR) ")\n\t"                         \
+    "vmovdqu    %%xmm0 , 112(" VAR(HTR) ")\n\t"
+
+#define _GHASH_RED_AVX2(r, r2)                     \
+    "vmovdqa    %[MOD2_128], %%xmm2\n\t"           \
+    "vpclmulqdq $0x10, %%xmm2, "#r2", %%xmm0\n\t"  \
+    "vpshufd    $0x4e, "#r2", %%xmm1\n\t"          \
+    "vpxor      %%xmm0, %%xmm1, %%xmm1\n\t"        \
+    "vpclmulqdq $0x10, %%xmm2, %%xmm1, %%xmm0\n\t" \
+    "vpshufd    $0x4e, %%xmm1, %%xmm1\n\t"         \
+    "vpxor      %%xmm0, %%xmm1, %%xmm1\n\t"        \
+    "vpxor      %%xmm1, " #r ", " #r "\n\t"
+#define GHASH_RED_AVX2(r, r2)                      \
+       _GHASH_RED_AVX2(r, r2)
+
+#define GHASH_FULL_AVX2(r, r2, a, b) \
+    GHASH_GFMUL_AVX2(r, r2, a, b)    \
+    GHASH_MID_AVX2(r, r2)            \
+    GHASH_RED_AVX2(r, r2)
+
+#define _GFMUL_3V_AVX2(r, r2, r3, a, b)        \
+    "vpclmulqdq $0x10, "#a", "#b", "#r3"\n\t"  \
+    "vpclmulqdq $0x01, "#a", "#b", %%xmm1\n\t" \
+    "vpclmulqdq $0x00, "#a", "#b", "#r2"\n\t"  \
+    "vpclmulqdq $0x11, "#a", "#b", " #r "\n\t" \
+    "vpxor      %%xmm1, "#r3", "#r3"\n\t"
+#define GFMUL_3V_AVX2(r, r2, r3, a, b)         \
+       _GFMUL_3V_AVX2(r, r2, r3, a, b)
+
+#define _GFMUL_XOR_3V_AVX2(r, r2, r3, a, b)    \
+    "vpclmulqdq $0x10, "#a", "#b", %%xmm2\n\t" \
+    "vpclmulqdq $0x01, "#a", "#b", %%xmm1\n\t" \
+    "vpclmulqdq $0x00, "#a", "#b", %%xmm0\n\t" \
+    "vpclmulqdq $0x11, "#a", "#b", %%xmm3\n\t" \
+    "vpxor      %%xmm1, %%xmm2, %%xmm2\n\t"    \
+    "vpxor      %%xmm3, " #r ", " #r "\n\t"    \
+    "vpxor      %%xmm2, "#r3", "#r3"\n\t"      \
+    "vpxor      %%xmm0, "#r2", "#r2"\n\t"
+#define GFMUL_XOR_3V_AVX2(r, r2, r3, a, b)     \
+       _GFMUL_XOR_3V_AVX2(r, r2, r3, a, b)
+
+#define GHASH_GFMUL_RED_8_AVX2()                              \
+    "vmovdqu       (" VAR(HTR) "), %%xmm12\n\t"               \
+    GFMUL_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm11, %%xmm12)     \
+    "vmovdqu     16(" VAR(HTR) "), %%xmm12\n\t"               \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm10, %%xmm12) \
+    "vmovdqu     32(" VAR(HTR) "), %%xmm11\n\t"               \
+    "vmovdqu     48(" VAR(HTR) "), %%xmm12\n\t"               \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm9, %%xmm11)  \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm8, %%xmm12)  \
+    "vmovdqu     64(" VAR(HTR) "), %%xmm11\n\t"               \
+    "vmovdqu     80(" VAR(HTR) "), %%xmm12\n\t"               \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm7, %%xmm11)  \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm6, %%xmm12)  \
+    "vmovdqu     96(" VAR(HTR) "), %%xmm11\n\t"               \
+    "vmovdqu    112(" VAR(HTR) "), %%xmm12\n\t"               \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm5, %%xmm11)  \
+    GFMUL_XOR_3V_AVX2(XR, %%xmm13, %%xmm14, %%xmm4, %%xmm12)  \
+    "vpslldq    $8, %%xmm14, %%xmm12\n\t"                     \
+    "vpsrldq    $8, %%xmm14, %%xmm14\n\t"                     \
+    "vpxor      %%xmm12, %%xmm13, %%xmm13\n\t"                \
+    "vpxor      %%xmm14, " VAR(XR) ", " VAR(XR) "\n\t"        \
+    GHASH_RED_AVX2(XR, %%xmm13)
+
+#define CALC_IV_12_AVX2()                                            \
+    "# Calculate values when IV is 12 bytes\n\t"                     \
+    "# Set counter based on IV\n\t"                                  \
+    "movl               $0x01000000, %%ecx\n\t"                      \
+    "vpinsrq            $0, 0(%%rax), %%xmm13, %%xmm13\n\t"          \
+    "vpinsrd            $2, 8(%%rax), %%xmm13, %%xmm13\n\t"          \
+    "vpinsrd            $3, %%ecx, %%xmm13, %%xmm13\n\t"             \
+    "# H = Encrypt X(=0) and T = Encrypt counter\n\t"                \
+    "vmovdqa              0(%[KEY]), " VAR(HR) "\n\t"                \
+    "vmovdqa             16(%[KEY]), %%xmm12\n\t"                    \
+    "vpxor              " VAR(HR) ", %%xmm13, %%xmm1\n\t"            \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             32(%[KEY]), %%xmm0\n\t"                     \
+    "vmovdqa             48(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             64(%[KEY]), %%xmm0\n\t"                     \
+    "vmovdqa             80(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa             96(%[KEY]), %%xmm0\n\t"                     \
+    "vmovdqa            112(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqa            128(%[KEY]), %%xmm0\n\t"                     \
+    "vmovdqa            144(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "cmpl               $11, %[nr]\n\t"                              \
+    "vmovdqa            160(%[KEY]), %%xmm0\n\t"                     \
+    "jl 31f\n\t"                                                     \
+    "vmovdqa            176(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "cmpl               $13, %[nr]\n\t"                              \
+    "vmovdqa            192(%[KEY]), %%xmm0\n\t"                     \
+    "jl 31f\n\t"                                                     \
+    "vmovdqa            208(%[KEY]), %%xmm12\n\t"                    \
+    "vaesenc            %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenc            %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vaesenc            %%xmm12, " VAR(HR) ", " VAR(HR) "\n\t"       \
+    "vaesenc            %%xmm12, %%xmm1, %%xmm1\n\t"                 \
+    "vmovdqu            224(%[KEY]), %%xmm0\n\t"                     \
+    "31:\n\t"                                                        \
+    "vaesenclast        %%xmm0, " VAR(HR) ", " VAR(HR) "\n\t"        \
+    "vaesenclast        %%xmm0, %%xmm1, %%xmm1\n\t"                  \
+    "vpshufb            %[BSWAP_MASK], " VAR(HR) ", " VAR(HR) "\n\t" \
+    "vmovdqu            %%xmm1, " VAR(TR) "\n\t"                     \
+
+#define CALC_IV_AVX2()                                       \
+    "# Calculate values when IV is not 12 bytes\n\t"         \
+    "# H = Encrypt X(=0)\n\t"                                \
+    "vmovdqa    0(%[KEY]), " VAR(HR) "\n\t"                  \
+    VAESENC_AVX(HR)                                          \
+    "vpshufb    %[BSWAP_MASK], " VAR(HR) ", " VAR(HR) "\n\t" \
+    "# Calc counter\n\t"                                     \
+    "# Initialization vector\n\t"                            \
+    "cmpl       $0, %%edx\n\t"                               \
+    "movq       $0, %%rcx\n\t"                               \
+    "je 45f\n\t"                                             \
+    "cmpl       $16, %%edx\n\t"                              \
+    "jl 44f\n\t"                                             \
+    "andl       $0xfffffff0, %%edx\n\t"                      \
+    "\n"                                                     \
+    "43:\n\t"                                                \
+    "vmovdqu    (%%rax,%%rcx,1), %%xmm4\n\t"                 \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"           \
+    "vpxor      %%xmm4, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX2(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "addl       $16, %%ecx\n\t"                              \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "jl 43b\n\t"                                             \
+    "movl       %[ibytes], %%edx\n\t"                        \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "je 45f\n\t"                                             \
+    "\n"                                                     \
+    "44:\n\t"                                                \
+    "subq       $16, %%rsp\n\t"                              \
+    "vpxor      %%xmm4, %%xmm4, %%xmm4\n\t"                  \
+    "xorl       %%ebx, %%ebx\n\t"                            \
+    "vmovdqu    %%xmm4, (%%rsp)\n\t"                         \
+    "42:\n\t"                                                \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t"                 \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t"                 \
+    "incl       %%ecx\n\t"                                   \
+    "incl       %%ebx\n\t"                                   \
+    "cmpl       %%edx, %%ecx\n\t"                            \
+    "jl 42b\n\t"                                             \
+    "vmovdqu    (%%rsp), %%xmm4\n\t"                         \
+    "addq       $16, %%rsp\n\t"                              \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"           \
+    "vpxor      %%xmm4, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX2(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "\n"                                                     \
+    "45:\n\t"                                                \
+    "# T = Encrypt counter\n\t"                              \
+    "vpxor      %%xmm0, %%xmm0, %%xmm0\n\t"                  \
+    "shll       $3, %%edx\n\t"                               \
+    "vpinsrq    $0, %%rdx, %%xmm0, %%xmm0\n\t"               \
+    "vpxor      %%xmm0, %%xmm13, %%xmm13\n\t"                \
+    GHASH_FULL_AVX2(%%xmm13, %%xmm12, %%xmm13, HR)           \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"         \
+    "#   Encrypt counter\n\t"                                \
+    "vmovdqa    0(%[KEY]), %%xmm4\n\t"                       \
+    "vpxor      %%xmm13, %%xmm4, %%xmm4\n\t"                 \
+    VAESENC_AVX(%%xmm4)                                      \
+    "vmovdqu    %%xmm4, " VAR(TR) "\n\t"
+
+#define CALC_AAD_AVX2()                                \
+    "# Additional authentication data\n\t"             \
+    "movl       %[abytes], %%edx\n\t"                  \
+    "cmpl       $0, %%edx\n\t"                         \
+    "je         25f\n\t"                               \
+    "movq       %[addt], %%rax\n\t"                    \
+    "xorl       %%ecx, %%ecx\n\t"                      \
+    "cmpl       $16, %%edx\n\t"                        \
+    "jl         24f\n\t"                               \
+    "andl       $0xfffffff0, %%edx\n\t"                \
+    "\n"                                               \
+    "23:\n\t"                                          \
+    "vmovdqu    (%%rax,%%rcx,1), %%xmm4\n\t"           \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"     \
+    "vpxor      %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_FULL_AVX2(XR, %%xmm12, XR, HR)               \
+    "addl       $16, %%ecx\n\t"                        \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "jl         23b\n\t"                               \
+    "movl       %[abytes], %%edx\n\t"                  \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "je         25f\n\t"                               \
+    "\n"                                               \
+    "24:\n\t"                                          \
+    "subq       $16, %%rsp\n\t"                        \
+    "vpxor      %%xmm4, %%xmm4, %%xmm4\n\t"            \
+    "xorl       %%ebx, %%ebx\n\t"                      \
+    "vmovdqu    %%xmm4, (%%rsp)\n\t"                   \
+    "22:\n\t"                                          \
+    "movzbl     (%%rax,%%rcx,1), %%r13d\n\t"           \
+    "movb       %%r13b, (%%rsp,%%rbx,1)\n\t"           \
+    "incl       %%ecx\n\t"                             \
+    "incl       %%ebx\n\t"                             \
+    "cmpl       %%edx, %%ecx\n\t"                      \
+    "jl         22b\n\t"                               \
+    "vmovdqu    (%%rsp), %%xmm4\n\t"                   \
+    "addq       $16, %%rsp\n\t"                        \
+    "vpshufb    %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"     \
+    "vpxor      %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_FULL_AVX2(XR, %%xmm12, XR, HR)               \
+    "\n"                                               \
+    "25:\n\t"
+
+#define VAESENC_128_GHASH_AVX2(src, o)               \
+    "leaq       (%[in]," VAR(KR64) ",1), %%rcx\n\t"  \
+    "leaq       (%[out]," VAR(KR64) ",1), %%rdx\n\t" \
+    /* src is either %%rcx or %%rdx */             \
+    VAESENC_CTR()                                  \
+    VAESENC_XOR()                                  \
+    VAESENC_PCLMUL_AVX2_1(src,  16, (o-128), 112)  \
+    VAESENC_PCLMUL_AVX2_2(src,  32, (o-112),  96)  \
+    VAESENC_PCLMUL_AVX2_N(src,  48, (o- 96),  80)  \
+    VAESENC_PCLMUL_AVX2_N(src,  64, (o- 80),  64)  \
+    VAESENC_PCLMUL_AVX2_N(src,  80, (o- 64),  48)  \
+    VAESENC_PCLMUL_AVX2_N(src,  96, (o- 48),  32)  \
+    VAESENC_PCLMUL_AVX2_N(src, 112, (o- 32),  16)  \
+    VAESENC_PCLMUL_AVX2_N(src, 128, (o- 16),   0)  \
+    VAESENC_PCLMUL_AVX2_L(144)                     \
+    "cmpl       $11, %[nr]\n\t"                    \
+    "vmovdqa    160(%[KEY]), %%xmm12\n\t"          \
+    "jl         4f\n\t"                            \
+    VAESENC()                                      \
+    VAESENC_SET(176)                               \
+    "cmpl       $13, %[nr]\n\t"                    \
+    "vmovdqa    192(%[KEY]), %%xmm12\n\t"          \
+    "jl         4f\n\t"                            \
+    VAESENC()                                      \
+    VAESENC_SET(208)                               \
+    "vmovdqa    224(%[KEY]), %%xmm12\n\t"          \
+    "\n"                                           \
+"4:\n\t"                                           \
+    VAESENC_LAST(%%rcx, %%rdx)
+
+#define AESENC_LAST15_ENC_AVX2()                        \
+    "movl       %[nbytes], %%ecx\n\t"                   \
+    "movl       %%ecx, %%edx\n\t"                       \
+    "andl       $0x0f, %%ecx\n\t"                       \
+    "jz         55f\n\t"                                \
+    "vmovdqu    " VAR(CTR1) ", %%xmm13\n\t"             \
+    "vpshufb    %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"   \
+    "vpxor      0(%[KEY]), %%xmm13, %%xmm13\n\t"        \
+    VAESENC_AVX(%%xmm13)                                \
+    "subq       $16, %%rsp\n\t"                         \
+    "xorl       %%ecx, %%ecx\n\t"                       \
+    "vmovdqu    %%xmm13, (%%rsp)\n\t"                   \
+    "\n"                                                \
+    "51:\n\t"                                           \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"    \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"            \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t"   \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"            \
+    "incl       " VAR(KR) "\n\t"                        \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       %%edx, " VAR(KR) "\n\t"                 \
+    "jl         51b\n\t"                                \
+    "xorq       %%r13, %%r13\n\t"                       \
+    "cmpl       $16, %%ecx\n\t"                         \
+    "je         53f\n\t"                                \
+    "\n"                                                \
+    "52:\n\t"                                           \
+    "movb       %%r13b, (%%rsp,%%rcx,1)\n\t"            \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       $16, %%ecx\n\t"                         \
+    "jl         52b\n\t"                                \
+    "53:\n\t"                                           \
+    "vmovdqu    (%%rsp), %%xmm13\n\t"                   \
+    "addq       $16, %%rsp\n\t"                         \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"    \
+    "vpxor      %%xmm13, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_GFMUL_RED_AVX2(XR, HR, XR)                    \
+
+#define AESENC_LAST15_DEC_AVX2()                        \
+    "movl       %[nbytes], %%ecx\n\t"                   \
+    "movl       %%ecx, %%edx\n\t"                       \
+    "andl       $0x0f, %%ecx\n\t"                       \
+    "jz         55f\n\t"                                \
+    "vmovdqu    " VAR(CTR1) ", %%xmm13\n\t"             \
+    "vpshufb    %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"   \
+    "vpxor      0(%[KEY]), %%xmm13, %%xmm13\n\t"        \
+    VAESENC_AVX(%%xmm13)                                \
+    "subq       $32, %%rsp\n\t"                         \
+    "xorl       %%ecx, %%ecx\n\t"                       \
+    "vmovdqu    %%xmm13, (%%rsp)\n\t"                   \
+    "vpxor      %%xmm0, %%xmm0, %%xmm0\n\t"             \
+    "vmovdqu    %%xmm0, 16(%%rsp)\n\t"                  \
+    "\n"                                                \
+    "51:\n\t"                                           \
+    "movzbl     (%[in]," VAR(KR64) ",1), %%r13d\n\t"    \
+    "movb       %%r13b, 16(%%rsp,%%rcx,1)\n\t"          \
+    "xorb       (%%rsp,%%rcx,1), %%r13b\n\t"            \
+    "movb       %%r13b, (%[out]," VAR(KR64) ",1)\n\t"   \
+    "incl       " VAR(KR) "\n\t"                        \
+    "incl       %%ecx\n\t"                              \
+    "cmpl       %%edx, " VAR(KR) "\n\t"                 \
+    "jl         51b\n\t"                                \
+    "53:\n\t"                                           \
+    "vmovdqu    16(%%rsp), %%xmm13\n\t"                 \
+    "addq       $32, %%rsp\n\t"                         \
+    "vpshufb    %[BSWAP_MASK], %%xmm13, %%xmm13\n\t"    \
+    "vpxor      %%xmm13, " VAR(XR) ", " VAR(XR) "\n\t"  \
+    GHASH_GFMUL_RED_AVX2(XR, HR, XR)                    \
+
+#define CALC_TAG_AVX2()                                      \
+    "movl       %[nbytes], %%edx\n\t"                        \
+    "movl       %[abytes], %%ecx\n\t"                        \
+    "shlq       $3, %%rdx\n\t"                               \
+    "shlq       $3, %%rcx\n\t"                               \
+    "vpinsrq    $0, %%rdx, %%xmm0, %%xmm0\n\t"               \
+    "vpinsrq    $1, %%rcx, %%xmm0, %%xmm0\n\t"               \
+    "vpxor      %%xmm0, " VAR(XR) ", " VAR(XR) "\n\t"        \
+    GHASH_GFMUL_RED_AVX2(XR, HR, XR)                         \
+    "vpshufb    %[BSWAP_MASK], " VAR(XR) ", " VAR(XR) "\n\t" \
+    "vpxor      " VAR(TR) ", " VAR(XR) ", %%xmm0\n\t"        \
+
+
+static void AES_GCM_encrypt_avx2(const unsigned char *in, unsigned char *out,
+                                 const unsigned char* addt,
+                                 const unsigned char* ivec, unsigned char *tag,
+                                 unsigned int nbytes, unsigned int abytes,
+                                 unsigned int ibytes, unsigned int tbytes,
+                                 const unsigned char* key, int nr)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register unsigned int ivLen asm("ebx") = ibytes;
+
+    __asm__ __volatile__ (
+        "subq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "vpxor          %%xmm13, %%xmm13, %%xmm13\n\t"
+        "vpxor          " VAR(XR) ", " VAR(XR) ", " VAR(XR) "\n\t"
+        "movl           %[ibytes], %%edx\n\t"
+        "cmpl           $12, %%edx\n\t"
+        "jne            35f\n\t"
+        CALC_IV_12_AVX2()
+        "jmp            39f\n\t"
+        "\n"
+        "35:\n\t"
+        CALC_IV_AVX2()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD_AVX2()
+
+        "# Calculate counter and H\n\t"
+        "vpsrlq         $63, " VAR(HR) ", %%xmm5\n\t"
+        "vpsllq         $1, " VAR(HR) ", %%xmm4\n\t"
+        "vpslldq        $8, %%xmm5, %%xmm5\n\t"
+        "vpor           %%xmm5, %%xmm4, %%xmm4\n\t"
+        "vpshufd        $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpsrad         $31, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"
+        "vpand          %[MOD2_128], " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpaddd         %[ONE], %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm4, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vmovdqu        %%xmm13, " VAR(CTR1) "\n\t"
+
+        "xorl           " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
+        "cmpl   $128, %[nbytes]\n\t"
+        "movl   %[nbytes], %%r13d\n\t"
+        "jl     5f\n\t"
+        "andl   $0xffffff80, %%r13d\n\t"
+
+        CALC_HT_8_AVX2()
+
+        "# First 128 bytes of input\n\t"
+        VAESENC_128()
+
+        "cmpl   $128, %%r13d\n\t"
+        "movl   $128, " VAR(KR) "\n\t"
+        "jle    2f\n\t"
+
+        "# More 128 bytes of input\n\t"
+            "\n"
+    "3:\n\t"
+        VAESENC_128_GHASH_AVX2(%%rdx, 0)
+        "addl   $128, " VAR(KR) "\n\t"
+        "cmpl   %%r13d, " VAR(KR) "\n\t"
+        "jl     3b\n\t"
+        "\n"
+    "2:\n\t"
+        "vmovdqa        %[BSWAP_MASK], %%xmm13\n\t"
+        "vpshufb        %%xmm13, %%xmm4, %%xmm4\n\t"
+        "vpshufb        %%xmm13, %%xmm5, %%xmm5\n\t"
+        "vpshufb        %%xmm13, %%xmm6, %%xmm6\n\t"
+        "vpshufb        %%xmm13, %%xmm7, %%xmm7\n\t"
+        "vpshufb        %%xmm13, %%xmm8, %%xmm8\n\t"
+        "vpshufb        %%xmm13, %%xmm9, %%xmm9\n\t"
+        "vpshufb        %%xmm13, %%xmm10, %%xmm10\n\t"
+        "vpshufb        %%xmm13, %%xmm11, %%xmm11\n\t"
+        "vpxor          %%xmm2, %%xmm4, %%xmm4\n\t"
+
+        GHASH_GFMUL_RED_8_AVX2()
+
+        "vmovdqu        0(" VAR(HTR) "), " VAR(HR) "\n\t"
+        "\n"
+    "5:\n\t"
+        "movl           %[nbytes], %%edx\n\t"
+        "cmpl           %%edx, " VAR(KR) "\n\t"
+        "jge            55f\n\t"
+#endif
+
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xfffffff0, %%r13d\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            14f\n\t"
+
+        VAESENC_BLOCK_AVX2()
+        "addl           $16, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            13f\n\t"
+                "vmovdqa        %[MOD2_128], %%xmm0\n\t"
+        "\n"
+        "12:\n\t"
+        "vmovdqu        (%[in]," VAR(KR64) ",1), %%xmm9\n\t"
+        "vmovdqu        " VAR(CTR1) ", %%xmm5\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm5, %%xmm4\n\t"
+        "vpaddd         %[ONE], %%xmm5, %%xmm5\n\t"
+        "vmovdqu        %%xmm5, " VAR(CTR1) "\n\t"
+        VAESENC_GFMUL_SB_AVX2(%%xmm9, HR, XR, CTR1)
+        "vmovdqu        %%xmm4, (%[out]," VAR(KR64) ",1)\n\t"
+        "vpshufb        %[BSWAP_MASK], %%xmm4, %%xmm4\n\t"
+        "addl           $16, " VAR(KR) "\n\t"
+        "vpxor          %%xmm4, " VAR(XR) ", " VAR(XR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             12b\n\t"
+        "\n"
+        "13:\n\t"
+        GHASH_GFMUL_RED_AVX2(XR, HR, XR)
+        "\n"
+        "14:\n\t"
+
+        AESENC_LAST15_ENC_AVX2()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG_AVX2()
+        STORE_TAG_AVX()
+        "addq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        "vzeroupper\n\t"
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tbytes),
+          [tag] "r" (tag),
+              [BSWAP_MASK] "m" (BSWAP_MASK),
+              [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+              [MOD2_128] "m" (MOD2_128)
+            : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "rdx", "r13"
+            );
+        }
+#endif /* HAVE_INTEL_AVX2 */
+#endif /* HAVE_INTEL_AVX1 */
+
+#ifdef HAVE_AES_DECRYPT
+/* Figure 10. AES-GCM – Decrypt With Single Block Ghash at a Time */
+
+static void AES_GCM_decrypt(const unsigned char *in, unsigned char *out,
+                            const unsigned char* addt,
+                            const unsigned char* ivec, const unsigned char *tag,
+                            int nbytes, int abytes, int ibytes, int tbytes,
+                            const unsigned char* key, int nr, int* res)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register int ivLen asm("ebx") = ibytes;
+    register int tagLen asm("edx") = tbytes;
+
+        __asm__ __volatile__ (
+        "pushq          %%rdx\n\t"
+        "subq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "pxor           %%xmm13, %%xmm13\n\t"
+        "pxor           %%xmm15, %%xmm15\n\t"
+        "movl           %[ibytes], %%edx\n\t"
+        "cmpl           $12, %%edx\n\t"
+        "jne            35f\n\t"
+        CALC_IV_12()
+        "\n"
+        "35:\n\t"
+        CALC_IV()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD()
+
+        "# Calculate counter and H\n\t"
+        "pshufb         %[BSWAP_EPI64], %%xmm13\n\t"
+        "movdqa         " VAR(HR) ", %%xmm5\n\t"
+        "paddd          %[ONE], %%xmm13\n\t"
+        "movdqa         " VAR(HR) ", %%xmm4\n\t"
+        "movdqu         %%xmm13, " VAR(CTR1) "\n\t"
+        "psrlq          $63, %%xmm5\n\t"
+        "psllq          $1, %%xmm4\n\t"
+        "pslldq         $8, %%xmm5\n\t"
+        "por            %%xmm5, %%xmm4\n\t"
+        "pshufd         $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "psrad          $31, " VAR(HR) "\n\t"
+        "pand           %[MOD2_128], " VAR(HR) "\n\t"
+        "pxor           %%xmm4, " VAR(HR) "\n\t"
+
+        "xorl           " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+        "cmpl           $128, %[nbytes]\n\t"
+        "jl             5f\n\t"
+
+        CALC_HT_8_AVX()
+
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xffffff80, %%r13d\n\t"
+        "\n"
+        "2:\n\t"
+        AESENC_128_GHASH_AVX(%%rcx, 128)
+        "addl           $128, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             2b\n\t"
+
+        "movdqa         %%xmm2, " VAR(XR) "\n\t"
+        "movdqu         (%%rsp), " VAR(HR) "\n\t"
+    "5:\n\t"
+        "movl           %[nbytes], %%edx\n\t"
+        "cmpl           %%edx, " VAR(KR) "\n\t"
+        "jge            55f\n\t"
+#endif
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xfffffff0, %%r13d\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            13f\n\t"
+
+        "\n"
+        "12:\n\t"
+        "leaq           (%[in]," VAR(KR64) ",1), %%rcx\n\t"
+        "leaq           (%[out]," VAR(KR64) ",1), %%rdx\n\t"
+        "movdqu         (%%rcx), %%xmm1\n\t"
+        "movdqa         " VAR(HR) ", %%xmm0\n\t"
+        "pshufb         %[BSWAP_MASK], %%xmm1\n\t"
+        "pxor           " VAR(XR) ", %%xmm1\n\t"
+        AESENC_GFMUL(%%rcx, %%rdx, %%xmm0, %%xmm1)
+        "addl           $16, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             12b\n\t"
+        "\n"
+        "13:\n\t"
+
+        AESENC_LAST15_DEC_AVX()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG()
+        "addq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        "popq           %%rdx\n\t"
+        CMP_TAG()
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tagLen),
+          [tag] "r" (tag), [res] "r" (res),
+          [BSWAP_MASK] "m" (BSWAP_MASK),
+          [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+          [MOD2_128] "m" (MOD2_128)
+        : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "r13"
+        );
+    }
+
+#ifdef HAVE_INTEL_AVX1
+static void AES_GCM_decrypt_avx1(const unsigned char *in, unsigned char *out,
+                                 const unsigned char* addt,
+                                 const unsigned char* ivec,
+                                 const unsigned char *tag, int nbytes,
+                                 int abytes, int ibytes, int tbytes,
+                                 const unsigned char* key, int nr, int* res)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register int ivLen asm("ebx") = ibytes;
+    register int tagLen asm("edx") = tbytes;
+
+        __asm__ __volatile__ (
+        "pushq          %%rdx\n\t"
+        "subq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "vpxor          %%xmm13, %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm15, %%xmm15, %%xmm15\n\t"
+        "movl           %[ibytes], %%edx\n\t"
+        "cmpl           $12, %%edx\n\t"
+        "jne            35f\n\t"
+        CALC_IV_12_AVX1()
+        "\n"
+        "35:\n\t"
+        CALC_IV_AVX1()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD_AVX1()
+
+        "# Calculate counter and H\n\t"
+        "vpsrlq         $63, " VAR(HR) ", %%xmm5\n\t"
+        "vpsllq         $1, " VAR(HR) ", %%xmm4\n\t"
+        "vpslldq        $8, %%xmm5, %%xmm5\n\t"
+        "vpor           %%xmm5, %%xmm4, %%xmm4\n\t"
+        "vpshufd        $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpsrad         $31, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"
+        "vpand          %[MOD2_128], " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpaddd         %[ONE], %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm4, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vmovdqu        %%xmm13, " VAR(CTR1) "\n\t"
+
+        "xorl           " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+        "cmpl           $128, %[nbytes]\n\t"
+        "jl             5f\n\t"
+
+        CALC_HT_8_AVX1()
+
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xffffff80, %%r13d\n\t"
+        "\n"
+        "2:\n\t"
+        VAESENC_128_GHASH_AVX1(%%rcx, 128)
+        "addl           $128, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             2b\n\t"
+
+        "vmovdqa        %%xmm2, " VAR(XR) "\n\t"
+        "vmovdqu        (%%rsp), " VAR(HR) "\n\t"
+    "5:\n\t"
+        "movl           %[nbytes], %%edx\n\t"
+        "cmpl           %%edx, " VAR(KR) "\n\t"
+        "jge            55f\n\t"
+#endif
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xfffffff0, %%r13d\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            13f\n\t"
+
+        "\n"
+        "12:\n\t"
+        "vmovdqu        (%[in]," VAR(KR64) ",1), %%xmm9\n\t"
+        "vmovdqa        " VAR(HR) ", %%xmm0\n\t"
+        "vpshufb        %[BSWAP_MASK], %%xmm9, %%xmm1\n\t"
+        "vpxor          " VAR(XR) ", %%xmm1, %%xmm1\n\t"
+        VAESENC_GFMUL(%%xmm9, %%xmm0, %%xmm1)
+        "addl           $16, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             12b\n\t"
+        "\n"
+        "13:\n\t"
+
+        AESENC_LAST15_DEC_AVX1()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG_AVX1()
+        "addq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        "popq           %%rdx\n\t"
+        CMP_TAG_AVX()
+        "vzeroupper\n\t"
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tagLen),
+          [tag] "r" (tag), [res] "r" (res),
+          [BSWAP_MASK] "m" (BSWAP_MASK),
+          [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX1_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+          [MOD2_128] "m" (MOD2_128)
+        : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "r13"
+        );
+    }
+
+#ifdef HAVE_INTEL_AVX2
+static void AES_GCM_decrypt_avx2(const unsigned char *in, unsigned char *out,
+                                 const unsigned char* addt,
+                                 const unsigned char* ivec,
+                                 const unsigned char *tag, int nbytes,
+                                 int abytes, int ibytes, int tbytes,
+                                 const unsigned char* key, int nr, int* res)
+{
+    register const unsigned char* iv asm("rax") = ivec;
+    register int ivLen asm("ebx") = ibytes;
+    register int tagLen asm("edx") = tbytes;
+
+        __asm__ __volatile__ (
+        "pushq          %%rdx\n\t"
+        "subq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        /* Counter is xmm13 */
+        "vpxor          %%xmm13, %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm15, %%xmm15, %%xmm15\n\t"
+        "movl           %[ibytes], %%edx\n\t"
+        "cmpl           $12, %%edx\n\t"
+        "jne            35f\n\t"
+        CALC_IV_12_AVX2()
+        "jmp            39f\n\t"
+        "\n"
+        "35:\n\t"
+        CALC_IV_AVX2()
+        "\n"
+        "39:\n\t"
+
+        CALC_AAD_AVX2()
+
+        "# Calculate counter and H\n\t"
+        "vpsrlq         $63, " VAR(HR) ", %%xmm5\n\t"
+        "vpsllq         $1, " VAR(HR) ", %%xmm4\n\t"
+        "vpslldq        $8, %%xmm5, %%xmm5\n\t"
+        "vpor           %%xmm5, %%xmm4, %%xmm4\n\t"
+        "vpshufd        $0xff, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpsrad         $31, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm13, %%xmm13\n\t"
+        "vpand          %[MOD2_128], " VAR(HR) ", " VAR(HR) "\n\t"
+        "vpaddd         %[ONE], %%xmm13, %%xmm13\n\t"
+        "vpxor          %%xmm4, " VAR(HR) ", " VAR(HR) "\n\t"
+        "vmovdqu        %%xmm13, " VAR(CTR1) "\n\t"
+
+        "xorl           " VAR(KR) ", " VAR(KR) "\n\t"
+
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
+        "cmpl           $128, %[nbytes]\n\t"
+        "jl             5f\n\t"
+
+        CALC_HT_8_AVX2()
+
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xffffff80, %%r13d\n\t"
+        "\n"
+        "2:\n\t"
+        VAESENC_128_GHASH_AVX2(%%rcx, 128)
+        "addl           $128, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             2b\n\t"
+
+        "vmovdqa        %%xmm2, " VAR(XR) "\n\t"
+        "vmovdqu        (%%rsp), " VAR(HR) "\n\t"
+    "5:\n\t"
+        "movl           %[nbytes], %%edx\n\t"
+        "cmpl           %%edx, " VAR(KR) "\n\t"
+        "jge            55f\n\t"
+#endif
+        "movl           %[nbytes], %%r13d\n\t"
+        "andl           $0xfffffff0, %%r13d\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jge            13f\n\t"
+
+            "vmovdqa            %[MOD2_128], %%xmm0\n\t"
+        "\n"
+        "12:\n\t"
+        "vmovdqu        (%[in]," VAR(KR64) ",1), %%xmm9\n\t"
+        "vmovdqu        " VAR(CTR1) ", %%xmm5\n\t"
+        "vpshufb        %[BSWAP_MASK], %%xmm9, %%xmm1\n\t"
+        "vpshufb        %[BSWAP_EPI64], %%xmm5, %%xmm4\n\t"
+        "vpaddd         %[ONE], %%xmm5, %%xmm5\n\t"
+        "vpxor          " VAR(XR) ", %%xmm1, %%xmm1\n\t"
+        "vmovdqu        %%xmm5, " VAR(CTR1) "\n\t"
+        VAESENC_GFMUL_SB_AVX2(%%xmm9, HR, %%xmm1, CTR1)
+        "vmovdqu        %%xmm4, (%[out]," VAR(KR64) ",1)\n\t"
+        "addl           $16, " VAR(KR) "\n\t"
+        "cmpl           %%r13d, " VAR(KR) "\n\t"
+        "jl             12b\n\t"
+        "\n"
+        "13:\n\t"
+
+        AESENC_LAST15_DEC_AVX2()
+        "\n"
+        "55:\n\t"
+
+        CALC_TAG_AVX2()
+        "addq           $" VAR(STACK_OFFSET) ", %%rsp\n\t"
+        "popq           %%rdx\n\t"
+        CMP_TAG_AVX()
+        "vzeroupper\n\t"
+
+        :
+        : [KEY] "r" (key),
+          [in] "r" (in), [out] "r" (out), [nr] "r" (nr),
+          [nbytes] "r" (nbytes), [abytes] "r" (abytes), [addt] "r" (addt),
+          [ivec] "r" (iv), [ibytes] "r" (ivLen), [tbytes] "r" (tagLen),
+          [tag] "r" (tag), [res] "r" (res),
+          [BSWAP_MASK] "m" (BSWAP_MASK),
+          [BSWAP_EPI64] "m" (BSWAP_EPI64),
+          [ONE] "m" (ONE),
+#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
+          [TWO] "m" (TWO), [THREE] "m" (THREE), [FOUR] "m" (FOUR),
+          [FIVE] "m" (FIVE), [SIX] "m" (SIX), [SEVEN] "m" (SEVEN),
+          [EIGHT] "m" (EIGHT),
+#endif
+          [MOD2_128] "m" (MOD2_128)
+        : "xmm15", "xmm14", "xmm13", "xmm12",
+          "xmm0", "xmm1", "xmm2", "xmm3", "memory",
+          "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11",
+          "rcx", "r13"
+        );
+    }
+#endif /* HAVE_INTEL_AVX2 */
+#endif /* HAVE_INTEL_AVX1 */
+#endif /* HAVE_AES_DECRYPT */
+
+#else /* _MSC_VER */
+/* The following are for MSC based builds which do not allow
+ * inline assembly. Intrinsic functions are used instead. */
+
+#define aes_gcm_calc_iv_12(KEY, ivec, nr, H, Y, T)         \
+do                                                         \
+{                                                          \
+    word32 iv12[4];                                        \
+    iv12[0] = *(word32*)&ivec[0];                          \
+    iv12[1] = *(word32*)&ivec[4];                          \
+    iv12[2] = *(word32*)&ivec[8];                          \
+    iv12[3] = 0x01000000;                                  \
+    Y = _mm_loadu_si128((__m128i*)iv12);                   \
+                                                           \
+    /* (Compute E[ZERO, KS] and E[Y0, KS] together */      \
+    tmp1 = _mm_load_si128(&KEY[0]);                        \
+    tmp2 = _mm_xor_si128(Y, KEY[0]);                       \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);                 \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);                 \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);                 \
+    lastKey = KEY[10];                                     \
+    if (nr > 10) {                                         \
+        tmp1 = _mm_aesenc_si128(tmp1, lastKey);            \
+        tmp2 = _mm_aesenc_si128(tmp2, lastKey);            \
+        tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);            \
+        tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);            \
+        lastKey = KEY[12];                                 \
+        if (nr > 12) {                                     \
+            tmp1 = _mm_aesenc_si128(tmp1, lastKey);        \
+            tmp2 = _mm_aesenc_si128(tmp2, lastKey);        \
+            tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);        \
+            tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);        \
+            lastKey = KEY[14];                             \
+        }                                                  \
+    }                                                      \
+    H = _mm_aesenclast_si128(tmp1, lastKey);               \
+    T = _mm_aesenclast_si128(tmp2, lastKey);               \
+    H = _mm_shuffle_epi8(H, BSWAP_MASK);                   \
+}                                                          \
+while (0)
+
+#define aes_gcm_calc_iv(KEY, ivec, ibytes, nr, H, Y, T)         \
+do                                                              \
+{                                                               \
+    if (ibytes % 16) {                                          \
+        i = ibytes / 16;                                        \
+        for (j=0; j < (int)(ibytes%16); j++)                    \
+            ((unsigned char*)&last_block)[j] = ivec[i*16+j];    \
+    }                                                           \
+    tmp1 = _mm_load_si128(&KEY[0]);                             \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);                      \
+    lastKey = KEY[10];                                          \
+    if (nr > 10) {                                              \
+        tmp1 = _mm_aesenc_si128(tmp1, lastKey);                 \
+        tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);                 \
+        lastKey = KEY[12];                                      \
+        if (nr > 12) {                                          \
+            tmp1 = _mm_aesenc_si128(tmp1, lastKey);             \
+            tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);             \
+            lastKey = KEY[14];                                  \
+        }                                                       \
+    }                                                           \
+    H = _mm_aesenclast_si128(tmp1, lastKey);                    \
+    H = _mm_shuffle_epi8(H, BSWAP_MASK);                        \
+    Y = _mm_setzero_si128();                                    \
+    for (i=0; i < (int)(ibytes/16); i++) {                      \
+        tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]);           \
+        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);              \
+        Y = _mm_xor_si128(Y, tmp1);                             \
+        Y = gfmul_sw(Y, H);                                     \
+    }                                                           \
+    if (ibytes % 16) {                                          \
+        tmp1 = last_block;                                      \
+        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);              \
+        Y = _mm_xor_si128(Y, tmp1);                             \
+        Y = gfmul_sw(Y, H);                                     \
+    }                                                           \
+    tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0);                 \
+    tmp1 = _mm_insert_epi64(tmp1, 0, 1);                        \
+    Y = _mm_xor_si128(Y, tmp1);                                 \
+    Y = gfmul_sw(Y, H);                                         \
+    Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */ \
+    tmp1 = _mm_xor_si128(Y, KEY[0]);                            \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);                      \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);                      \
+    lastKey = KEY[10];                                          \
+    if (nr > 10) {                                              \
+        tmp1 = _mm_aesenc_si128(tmp1, lastKey);                 \
+        tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);                 \
+        lastKey = KEY[12];                                      \
+        if (nr > 12) {                                          \
+            tmp1 = _mm_aesenc_si128(tmp1, lastKey);             \
+            tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);             \
+            lastKey = KEY[14];                                  \
+        }                                                       \
+    }                                                           \
+    T = _mm_aesenclast_si128(tmp1, lastKey);                    \
+}                                                               \
+while (0)
+
+#define AES_ENC_8(j)                       \
+    tmp1 = _mm_aesenc_si128(tmp1, KEY[j]); \
+    tmp2 = _mm_aesenc_si128(tmp2, KEY[j]); \
+    tmp3 = _mm_aesenc_si128(tmp3, KEY[j]); \
+    tmp4 = _mm_aesenc_si128(tmp4, KEY[j]); \
+    tmp5 = _mm_aesenc_si128(tmp5, KEY[j]); \
+    tmp6 = _mm_aesenc_si128(tmp6, KEY[j]); \
+    tmp7 = _mm_aesenc_si128(tmp7, KEY[j]); \
+    tmp8 = _mm_aesenc_si128(tmp8, KEY[j]);
+
+#define AES_ENC_LAST_8()                                                  \
+    tmp1 =_mm_aesenclast_si128(tmp1, lastKey);                            \
+    tmp2 =_mm_aesenclast_si128(tmp2, lastKey);                            \
+    tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[i*8+0]));  \
+    tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[i*8+1]));  \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+0], tmp1);                      \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+1], tmp2);                      \
+    tmp3 =_mm_aesenclast_si128(tmp3, lastKey);                            \
+    tmp4 =_mm_aesenclast_si128(tmp4, lastKey);                            \
+    tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[i*8+2]));  \
+    tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[i*8+3]));  \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+2], tmp3);                      \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+3], tmp4);                      \
+    tmp5 =_mm_aesenclast_si128(tmp5, lastKey);                            \
+    tmp6 =_mm_aesenclast_si128(tmp6, lastKey);                            \
+    tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[i*8+4]));  \
+    tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[i*8+5]));  \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+4], tmp5);                      \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+5], tmp6);                      \
+    tmp7 =_mm_aesenclast_si128(tmp7, lastKey);                            \
+    tmp8 =_mm_aesenclast_si128(tmp8, lastKey);                            \
+    tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[i*8+6]));  \
+    tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[i*8+7]));  \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+6], tmp7);                      \
+    _mm_storeu_si128(&((__m128i*)out)[i*8+7], tmp8);
+
 
 static __m128i gfmul_sw(__m128i a, __m128i b)
 {
     __m128i r, t1, t2, t3, t4, t5, t6, t7;
-#ifndef WOLFSSL_AES_GCM_SLOW_CLMUL
-    /* 128 x 128 Carryless Multiply */
-    t3 = _mm_clmulepi64_si128(a, b, 0x10);
-    t2 = _mm_clmulepi64_si128(a, b, 0x01);
-    t1 = _mm_clmulepi64_si128(a, b, 0x00);
-    t4 = _mm_clmulepi64_si128(a, b, 0x11);
-    t3 = _mm_xor_si128(t3, t2);
-    t2 = _mm_slli_si128(t3, 8);
-    t3 = _mm_srli_si128(t3, 8);
-    t1 = _mm_xor_si128(t1, t2);
-    t4 = _mm_xor_si128(t4, t3);
-
-    /* shift left 1 bit - bits reversed */
-    t5 = _mm_srli_epi32(t1, 31);
-    t6 = _mm_srli_epi32(t4, 31);
-    t1 = _mm_slli_epi32(t1, 1);
-    t4 = _mm_slli_epi32(t4, 1);
-    t7 = _mm_srli_si128(t5, 12);
-    t5 = _mm_slli_si128(t5, 4);
-    t6 = _mm_slli_si128(t6, 4);
-    t4 = _mm_or_si128(t4, t7);
-    t1 = _mm_or_si128(t1, t5);
-    t4 = _mm_or_si128(t4, t6);
-
-    /* Reduction */
-    t2 = _mm_clmulepi64_si128(t1, MOD2_128, 0x10);
-    t3 = _mm_shuffle_epi32(t1, 78);
-    t3 = _mm_xor_si128(t3, t2);
-    t2 = _mm_clmulepi64_si128(t3, MOD2_128, 0x10);
-    t3 = _mm_shuffle_epi32(t3, 78);
-    t3 = _mm_xor_si128(t3, t2);
-    r = _mm_xor_si128(t4, t3);
-#else
     t2 = _mm_shuffle_epi32(b, 78);
     t3 = _mm_shuffle_epi32(a, 78);
@@ -3497 +6768 @@
     t7 = _mm_xor_si128(t7, t1);
     r = _mm_xor_si128(t4, t7);
-#endif
 
     return r;
-}
+        }
 
 static void gfmul_only(__m128i a, __m128i b, __m128i* r0, __m128i* r1)
@@ -3507 +6777 @@
 
     /* 128 x 128 Carryless Multiply */
-#ifndef WOLFSSL_AES_GCM_SLOW_CLMUL
-    t3 = _mm_clmulepi64_si128(a, b, 0x10);
-    t2 = _mm_clmulepi64_si128(a, b, 0x01);
-    t1 = _mm_clmulepi64_si128(a, b, 0x00);
-    t4 = _mm_clmulepi64_si128(a, b, 0x11);
-    t3 = _mm_xor_si128(t3, t2);
-    t2 = _mm_slli_si128(t3, 8);
-    t3 = _mm_srli_si128(t3, 8);
-    t1 = _mm_xor_si128(t1, t2);
-    t4 = _mm_xor_si128(t4, t3);
-#else
     t2 = _mm_shuffle_epi32(b, 78);
     t3 = _mm_shuffle_epi32(a, 78);
@@ -3531 +6790 @@
     t1 = _mm_xor_si128(t1, t3);
     t4 = _mm_xor_si128(t4, t2);
-#endif
     *r0 = _mm_xor_si128(t1, *r0);
     *r1 = _mm_xor_si128(t4, *r1);
-}
+            }
 
 static __m128i gfmul_shl1(__m128i a)
@@ -3549 +6807 @@
     t1 = _mm_xor_si128(t1, a);
     return t1;
-}
+        }
 
 static __m128i ghash_red(__m128i r0, __m128i r1)
 {
     __m128i t2, t3;
-#ifndef WOLFSSL_AES_GCM_SLOW_CLMUL
-    t2 = _mm_clmulepi64_si128(r0, MOD2_128, 0x10);
-    t3 = _mm_shuffle_epi32(r0, 78);
-    t3 = _mm_xor_si128(t3, t2);
-    t2 = _mm_clmulepi64_si128(t3, MOD2_128, 0x10);
-    t3 = _mm_shuffle_epi32(t3, 78);
-    t3 = _mm_xor_si128(t3, t2);
-    return _mm_xor_si128(r1, t3);
-#else
     __m128i t5, t6, t7;
 
@@ -3583 +6832 @@
     t7 = _mm_xor_si128(t7, r0);
     return _mm_xor_si128(r1, t7);
-#endif
-}
+            }
 
 static __m128i gfmul_shifted(__m128i a, __m128i b)
@@ -3591 +6839 @@
     gfmul_only(a, b, &t0, &t1);
     return ghash_red(t0, t1);
-}
+        }
 
 #ifndef AES_GCM_AESNI_NO_UNROLL
@@ -3609 +6857 @@
     gfmul_only(a8, b1, &t0, &t1);
     return ghash_red(t0, t1);
-}
+    }
 #endif
 
-/* See Intel® Carry-Less Multiplication Instruction
- * and its Usage for Computing the GCM Mode White Paper
- * by Shay Gueron, Intel Mobility Group, Israel Development Center;
- * and Michael E. Kounavis, Intel Labs, Circuits and Systems Research */
-
-
-/* Figure 9. AES-GCM – Encrypt With Single Block Ghash at a Time */
-
-static const __m128i ONE   = M128_INIT(0x0, 0x1);
-#ifndef AES_GCM_AESNI_NO_UNROLL
-static const __m128i TWO   = M128_INIT(0x0, 0x2);
-static const __m128i THREE = M128_INIT(0x0, 0x3);
-static const __m128i FOUR  = M128_INIT(0x0, 0x4);
-static const __m128i FIVE  = M128_INIT(0x0, 0x5);
-static const __m128i SIX   = M128_INIT(0x0, 0x6);
-static const __m128i SEVEN = M128_INIT(0x0, 0x7);
-static const __m128i EIGHT = M128_INIT(0x0, 0x8);
-#endif
-static const __m128i BSWAP_EPI64 = M128_INIT(0x0001020304050607, 0x08090a0b0c0d0e0f);
-static const __m128i BSWAP_MASK  = M128_INIT(0x08090a0b0c0d0e0f, 0x0001020304050607);
-
-static void AES_GCM_encrypt(const unsigned char *in, unsigned char *out,
-                            const unsigned char* addt,
-                            const unsigned char* ivec,
-                            unsigned char *tag, unsigned int nbytes,
-                            unsigned int abytes, unsigned int ibytes,
-                            const unsigned char* key, int nr)
+
+static void AES_GCM_encrypt(const unsigned char *in,
+                              unsigned char *out,
+                              const unsigned char* addt,
+                              const unsigned char* ivec,
+                              unsigned char *tag, unsigned int nbytes,
+                              unsigned int abytes, unsigned int ibytes,
+                              unsigned int tbytes,
+                              const unsigned char* key, int nr)
 {
     int i, j ,k;
@@ -3654 +6884 @@
 #endif
 
-    if (ibytes == 12) {
-        Y = _mm_setzero_si128();
-        for (j=0; j < 12; j++)
-            ((unsigned char*)&Y)[j] = ivec[j];
-        Y = _mm_insert_epi32(Y, 0x1000000, 3);
-            /* (Compute E[ZERO, KS] and E[Y0, KS] together */
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp2 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        T = _mm_aesenclast_si128(tmp2, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-    }
-    else {
-        if (ibytes % 16) {
-            i = ibytes / 16;
-            for (j=0; j < (int)(ibytes%16); j++)
-                ((unsigned char*)&last_block)[j] = ivec[i*16+j];
-        }
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-        Y = _mm_setzero_si128();
-        for (i=0; i < (int)(ibytes/16); i++) {
-            tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]);
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        if (ibytes % 16) {
-            tmp1 = last_block;
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0);
-        tmp1 = _mm_insert_epi64(tmp1, 0, 1);
-        Y = _mm_xor_si128(Y, tmp1);
-        Y = gfmul_sw(Y, H);
-        Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */
-        tmp1 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        T = _mm_aesenclast_si128(tmp1, lastKey);
-    }
+    if (ibytes == 12)
+        aes_gcm_calc_iv_12(KEY, ivec, nr, H, Y, T);
+    else
+        aes_gcm_calc_iv(KEY, ivec, ibytes, nr, H, Y, T);
 
     for (i=0; i < (int)(abytes/16); i++) {
@@ -3785 +6904 @@
         X = gfmul_sw(X, H);
     }
-
     tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64);
     ctr1 = _mm_add_epi32(tmp1, ONE);
@@ -3826 +6944 @@
         tmp7 =_mm_xor_si128(tmp7, KEY[0]);
         tmp8 =_mm_xor_si128(tmp8, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[1]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[1]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[1]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[1]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[1]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[2]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[2]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[2]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[2]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[2]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[3]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[3]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[3]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[3]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[3]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[4]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[4]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[4]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[4]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[4]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[5]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[5]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[5]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[5]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[5]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[6]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[6]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[6]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[6]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[6]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[7]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[7]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[7]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[7]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[7]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[8]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[8]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[8]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[8]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[8]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);
-        tmp3 = _mm_aesenc_si128(tmp3, KEY[9]);
-        tmp4 = _mm_aesenc_si128(tmp4, KEY[9]);
-        tmp5 = _mm_aesenc_si128(tmp5, KEY[9]);
-        tmp6 = _mm_aesenc_si128(tmp6, KEY[9]);
-        tmp7 = _mm_aesenc_si128(tmp7, KEY[9]);
-        tmp8 = _mm_aesenc_si128(tmp8, KEY[9]);
+        AES_ENC_8(1);
+        AES_ENC_8(2);
+        AES_ENC_8(3);
+        AES_ENC_8(4);
+        AES_ENC_8(5);
+        AES_ENC_8(6);
+        AES_ENC_8(7);
+        AES_ENC_8(8);
+        AES_ENC_8(9);
         lastKey = KEY[10];
         if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[10]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[10]);
-            tmp3 = _mm_aesenc_si128(tmp3, KEY[10]);
-            tmp4 = _mm_aesenc_si128(tmp4, KEY[10]);
-            tmp5 = _mm_aesenc_si128(tmp5, KEY[10]);
-            tmp6 = _mm_aesenc_si128(tmp6, KEY[10]);
-            tmp7 = _mm_aesenc_si128(tmp7, KEY[10]);
-            tmp8 = _mm_aesenc_si128(tmp8, KEY[10]);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);
-            tmp3 = _mm_aesenc_si128(tmp3, KEY[11]);
-            tmp4 = _mm_aesenc_si128(tmp4, KEY[11]);
-            tmp5 = _mm_aesenc_si128(tmp5, KEY[11]);
-            tmp6 = _mm_aesenc_si128(tmp6, KEY[11]);
-            tmp7 = _mm_aesenc_si128(tmp7, KEY[11]);
-            tmp8 = _mm_aesenc_si128(tmp8, KEY[11]);
+            AES_ENC_8(10);
+            AES_ENC_8(11);
             lastKey = KEY[12];
             if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[12]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[12]);
-                tmp3 = _mm_aesenc_si128(tmp3, KEY[12]);
-                tmp4 = _mm_aesenc_si128(tmp4, KEY[12]);
-                tmp5 = _mm_aesenc_si128(tmp5, KEY[12]);
-                tmp6 = _mm_aesenc_si128(tmp6, KEY[12]);
-                tmp7 = _mm_aesenc_si128(tmp7, KEY[12]);
-                tmp8 = _mm_aesenc_si128(tmp8, KEY[12]);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);
-                tmp3 = _mm_aesenc_si128(tmp3, KEY[13]);
-                tmp4 = _mm_aesenc_si128(tmp4, KEY[13]);
-                tmp5 = _mm_aesenc_si128(tmp5, KEY[13]);
-                tmp6 = _mm_aesenc_si128(tmp6, KEY[13]);
-                tmp7 = _mm_aesenc_si128(tmp7, KEY[13]);
-                tmp8 = _mm_aesenc_si128(tmp8, KEY[13]);
+                AES_ENC_8(12);
+                AES_ENC_8(13);
                 lastKey = KEY[14];
             }
         }
-        tmp1 =_mm_aesenclast_si128(tmp1, lastKey);
-        tmp2 =_mm_aesenclast_si128(tmp2, lastKey);
-        tmp3 =_mm_aesenclast_si128(tmp3, lastKey);
-        tmp4 =_mm_aesenclast_si128(tmp4, lastKey);
-        tmp5 =_mm_aesenclast_si128(tmp5, lastKey);
-        tmp6 =_mm_aesenclast_si128(tmp6, lastKey);
-        tmp7 =_mm_aesenclast_si128(tmp7, lastKey);
-        tmp8 =_mm_aesenclast_si128(tmp8, lastKey);
-        tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[0]));
-        tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[1]));
-        tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[2]));
-        tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[3]));
-        tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[4]));
-        tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[5]));
-        tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[6]));
-        tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[7]));
-        _mm_storeu_si128(&((__m128i*)out)[0], tmp1);
-        _mm_storeu_si128(&((__m128i*)out)[1], tmp2);
-        _mm_storeu_si128(&((__m128i*)out)[2], tmp3);
-        _mm_storeu_si128(&((__m128i*)out)[3], tmp4);
-        _mm_storeu_si128(&((__m128i*)out)[4], tmp5);
-        _mm_storeu_si128(&((__m128i*)out)[5], tmp6);
-        _mm_storeu_si128(&((__m128i*)out)[6], tmp7);
-        _mm_storeu_si128(&((__m128i*)out)[7], tmp8);
+        AES_ENC_LAST_8();
 
         for (i=1; i < (int)(nbytes/16/8); i++) {
@@ -4135 +7139 @@
                 }
             }
-            tmp1 =_mm_aesenclast_si128(tmp1, lastKey);
-            tmp2 =_mm_aesenclast_si128(tmp2, lastKey);
-            tmp3 =_mm_aesenclast_si128(tmp3, lastKey);
-            tmp4 =_mm_aesenclast_si128(tmp4, lastKey);
-            tmp5 =_mm_aesenclast_si128(tmp5, lastKey);
-            tmp6 =_mm_aesenclast_si128(tmp6, lastKey);
-            tmp7 =_mm_aesenclast_si128(tmp7, lastKey);
-            tmp8 =_mm_aesenclast_si128(tmp8, lastKey);
-            tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[i*8+0]));
-            tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[i*8+1]));
-            tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[i*8+2]));
-            tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[i*8+3]));
-            tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[i*8+4]));
-            tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[i*8+5]));
-            tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[i*8+6]));
-            tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[i*8+7]));
-            _mm_storeu_si128(&((__m128i*)out)[i*8+0], tmp1);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+1], tmp2);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+2], tmp3);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+3], tmp4);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+4], tmp5);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+5], tmp6);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+6], tmp7);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+7], tmp8);
+            AES_ENC_LAST_8();
         }
 
@@ -4204 +7185 @@
         X = gfmul_shifted(X, H);
     }
-#else
+#else /* AES_GCM_AESNI_NO_UNROLL */
     for (k = 0; k < (int)(nbytes/16) && k < 1; k++) {
         tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64);
@@ -4233 +7214 @@
         _mm_storeu_si128(&((__m128i*)out)[k], tmp1);
         tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X =_mm_xor_si128(X, tmp1);
-    }
+    X = _mm_xor_si128(X, tmp1);
+        }
     for (; k < (int)(nbytes/16); k++) {
         tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64);
@@ -4263 +7244 @@
         tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[k]));
         _mm_storeu_si128(&((__m128i*)out)[k], tmp1);
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
+            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
         X =_mm_xor_si128(X, tmp1);
-    }
+        }
     if (k > 0) {
         X = gfmul_shifted(X, H);
-    }
-#endif
+        }
+#endif /* AES_GCM_AESNI_NO_UNROLL */
+
     /* If one partial block remains */
     if (nbytes % 16) {
@@ -4313 +7295 @@
     X = _mm_shuffle_epi8(X, BSWAP_MASK);
     T = _mm_xor_si128(X, T);
-    _mm_storeu_si128((__m128i*)tag, T);
-}
-
-#ifdef HAVE_INTEL_AVX2
-/* Encrypt with key in xmm12. */
-#define VAESENC()                                       \
-            "vaesenc    %%xmm12, %[tmp1], %[tmp1]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp2], %[tmp2]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp3], %[tmp3]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp4], %[tmp4]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp5], %[tmp5]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp6], %[tmp6]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp7], %[tmp7]\n\t"  \
-            "vaesenc    %%xmm12, %[tmp8], %[tmp8]\n\t"
-
-
-/* Encrypt and GCM mul with the nth round key. */
-#define VAESENC_PCLMUL_N(o1, o2, o3)                                \
-                "vmovaps        "#o1"(%[KEY]), %%xmm12\n\t"         \
-                "vmovdqu        "#o2"(%[out]), %%xmm1\n\t"          \
-                "vaesenc        %%xmm12, %[tmp1], %[tmp1]\n\t"      \
-                "vmovaps        "#o3"(%[HT]), %%xmm0\n\t"           \
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"  \
-                "vaesenc        %%xmm12, %[tmp2], %[tmp2]\n\t"      \
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"   \
-                "vaesenc        %%xmm12, %[tmp3], %[tmp3]\n\t"      \
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"    \
-                "vaesenc        %%xmm12, %[tmp4], %[tmp4]\n\t"      \
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"    \
-                "vaesenc        %%xmm12, %[tmp5], %[tmp5]\n\t"      \
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"    \
-                "vaesenc        %%xmm12, %[tmp6], %[tmp6]\n\t"      \
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"      \
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"           \
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"           \
-                "vaesenc        %%xmm12, %[tmp7], %[tmp7]\n\t"      \
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"        \
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"         \
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"        \
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"        \
-                "vaesenc        %%xmm12, %[tmp8], %[tmp8]\n\t"
-
-static void AES_GCM_encrypt_avx2(const unsigned char *in, unsigned char *out,
-                                 const unsigned char* addt,
-                                 const unsigned char* ivec,
-                                 unsigned char *tag, unsigned int nbytes,
-                                 unsigned int abytes, unsigned int ibytes,
-                                 const unsigned char* key, int nr)
-{
-    int i, j ,k;
-    __m128i ctr1;
-    __m128i H, Y, T;
-    __m128i X = _mm_setzero_si128();
-    __m128i *KEY = (__m128i*)key, lastKey;
-    __m128i last_block = _mm_setzero_si128();
-#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
-    __m128i HT[8];
-    register __m128i tmp1 asm("xmm4");
-    register __m128i tmp2 asm("xmm5");
-    register __m128i tmp3 asm("xmm6");
-    register __m128i tmp4 asm("xmm7");
-    register __m128i tmp5 asm("xmm8");
-    register __m128i tmp6 asm("xmm9");
-    register __m128i tmp7 asm("xmm10");
-    register __m128i tmp8 asm("xmm11");
-    __m128i pctr1[1];
-    register __m128i XV asm("xmm2");
-#else
-    __m128i tmp1, tmp2;
-#endif
-
-    if (ibytes == 12) {
-        Y = _mm_setzero_si128();
-        for (j=0; j < 12; j++)
-            ((unsigned char*)&Y)[j] = ivec[j];
-        Y = _mm_insert_epi32(Y, 0x1000000, 3);
-            /* (Compute E[ZERO, KS] and E[Y0, KS] together */
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp2 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        T = _mm_aesenclast_si128(tmp2, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-    }
-    else {
-        if (ibytes % 16) {
-            i = ibytes / 16;
-            for (j=0; j < (int)(ibytes%16); j++)
-                ((unsigned char*)&last_block)[j] = ivec[i*16+j];
-        }
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-        Y = _mm_setzero_si128();
-        for (i=0; i < (int)(ibytes/16); i++) {
-            tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]);
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        if (ibytes % 16) {
-            tmp1 = last_block;
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0);
-        tmp1 = _mm_insert_epi64(tmp1, 0, 1);
-        Y = _mm_xor_si128(Y, tmp1);
-        Y = gfmul_sw(Y, H);
-        Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */
-        tmp1 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        T = _mm_aesenclast_si128(tmp1, lastKey);
-    }
-
-    for (i=0; i < (int)(abytes/16); i++) {
-        tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]);
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X = _mm_xor_si128(X, tmp1);
-        X = gfmul_sw(X, H);
-    }
-    if (abytes%16) {
-        last_block = _mm_setzero_si128();
-        for (j=0; j < (int)(abytes%16); j++)
-            ((unsigned char*)&last_block)[j] = addt[i*16+j];
-        tmp1 = last_block;
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X = _mm_xor_si128(X, tmp1);
-        X = gfmul_sw(X, H);
-    }
-
-    tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64);
-    ctr1 = _mm_add_epi32(tmp1, ONE);
-    H = gfmul_shl1(H);
-
-#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
-    i = 0;
-    if (nbytes >= 16*8) {
-        HT[0] = H;
-        HT[1] = gfmul_shifted(H, H);
-        HT[2] = gfmul_shifted(H, HT[1]);
-        HT[3] = gfmul_shifted(HT[1], HT[1]);
-        HT[4] = gfmul_shifted(HT[1], HT[2]);
-        HT[5] = gfmul_shifted(HT[2], HT[2]);
-        HT[6] = gfmul_shifted(HT[2], HT[3]);
-        HT[7] = gfmul_shifted(HT[3], HT[3]);
-
-        pctr1[0] = ctr1;
-        __asm__ __volatile__ (
-            "vmovaps    (%[pctr1]), %%xmm0\n\t"
-            "vmovaps    %[BSWAP_EPI64], %%xmm1\n\t"
-            "vpshufb    %%xmm1, %%xmm0, %[tmp1]\n\t"
-            "vpaddd     %[ONE], %%xmm0, %[tmp2]\n\t"
-            "vpshufb    %%xmm1, %[tmp2], %[tmp2]\n\t"
-            "vpaddd     %[TWO], %%xmm0, %[tmp3]\n\t"
-            "vpshufb    %%xmm1, %[tmp3], %[tmp3]\n\t"
-            "vpaddd     %[THREE], %%xmm0, %[tmp4]\n\t"
-            "vpshufb    %%xmm1, %[tmp4], %[tmp4]\n\t"
-            "vpaddd     %[FOUR], %%xmm0, %[tmp5]\n\t"
-            "vpshufb    %%xmm1, %[tmp5], %[tmp5]\n\t"
-            "vpaddd     %[FIVE], %%xmm0, %[tmp6]\n\t"
-            "vpshufb    %%xmm1, %[tmp6], %[tmp6]\n\t"
-            "vpaddd     %[SIX], %%xmm0, %[tmp7]\n\t"
-            "vpshufb    %%xmm1, %[tmp7], %[tmp7]\n\t"
-            "vpaddd     %[SEVEN], %%xmm0, %[tmp8]\n\t"
-            "vpshufb    %%xmm1, %[tmp8], %[tmp8]\n\t"
-            "vpaddd     %[EIGHT], %%xmm0, %%xmm0\n\t"
-
-            "vmovaps    (%[KEY]), %%xmm1\n\t"
-            "vmovaps    %%xmm0, (%[pctr1])\n\t"
-            "vpxor      %%xmm1, %[tmp1], %[tmp1]\n\t"
-            "vpxor      %%xmm1, %[tmp2], %[tmp2]\n\t"
-            "vpxor      %%xmm1, %[tmp3], %[tmp3]\n\t"
-            "vpxor      %%xmm1, %[tmp4], %[tmp4]\n\t"
-            "vpxor      %%xmm1, %[tmp5], %[tmp5]\n\t"
-            "vpxor      %%xmm1, %[tmp6], %[tmp6]\n\t"
-            "vpxor      %%xmm1, %[tmp7], %[tmp7]\n\t"
-            "vpxor      %%xmm1, %[tmp8], %[tmp8]\n\t"
-
-            "vmovaps    16(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    32(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    48(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    64(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    80(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    96(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    112(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    128(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    144(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "cmpl       $11, %[nr]\n\t"
-            "vmovaps    160(%[KEY]), %%xmm12\n\t"
-            "jl         L_enc128_enclast\n\t"
-
-            VAESENC()
-            "vmovaps    176(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "cmpl       $13, %[nr]\n\t"
-            "vmovaps    192(%[KEY]), %%xmm12\n\t"
-            "jl         L_enc128_enclast\n\t"
-
-            VAESENC()
-            "vmovaps    208(%[KEY]), %%xmm12\n\t"
-            VAESENC()
-            "vmovaps    224(%[KEY]), %%xmm12\n\t"
-            "\n"
-        "L_enc128_enclast:\n\t"
-            "vaesenclast        %%xmm12, %[tmp1], %[tmp1]\n\t"
-            "vaesenclast        %%xmm12, %[tmp2], %[tmp2]\n\t"
-            "vpxor              (%[in]), %[tmp1], %[tmp1]\n\t"
-            "vpxor              16(%[in]), %[tmp2], %[tmp2]\n\t"
-            "vmovdqu    %[tmp1], (%[out])\n\t"
-            "vmovdqu    %[tmp2], 16(%[out])\n\t"
-            "vaesenclast        %%xmm12, %[tmp3], %[tmp3]\n\t"
-            "vaesenclast        %%xmm12, %[tmp4], %[tmp4]\n\t"
-            "vpxor              32(%[in]), %[tmp3], %[tmp3]\n\t"
-            "vpxor              48(%[in]), %[tmp4], %[tmp4]\n\t"
-            "vmovdqu    %[tmp3], 32(%[out])\n\t"
-            "vmovdqu    %[tmp4], 48(%[out])\n\t"
-            "vaesenclast        %%xmm12, %[tmp5], %[tmp5]\n\t"
-            "vaesenclast        %%xmm12, %[tmp6], %[tmp6]\n\t"
-            "vpxor              64(%[in]), %[tmp5], %[tmp5]\n\t"
-            "vpxor              80(%[in]), %[tmp6], %[tmp6]\n\t"
-            "vmovdqu    %[tmp5], 64(%[out])\n\t"
-            "vmovdqu    %[tmp6], 80(%[out])\n\t"
-            "vaesenclast        %%xmm12, %[tmp7], %[tmp7]\n\t"
-            "vaesenclast        %%xmm12, %[tmp8], %[tmp8]\n\t"
-            "vpxor              96(%[in]), %[tmp7], %[tmp7]\n\t"
-            "vpxor              112(%[in]), %[tmp8], %[tmp8]\n\t"
-            "vmovdqu    %[tmp7], 96(%[out])\n\t"
-            "vmovdqu    %[tmp8], 112(%[out])\n\t"
-
-        : [tmp1] "=xr" (tmp1), [tmp2] "=xr" (tmp2), [tmp3] "=xr" (tmp3),
-          [tmp4] "=xr" (tmp4), [tmp5] "=xr" (tmp5), [tmp6] "=xr" (tmp6),
-          [tmp7] "=xr" (tmp7), [tmp8] "=xr" (tmp8)
-        : [KEY] "r" (KEY), [pctr1] "r" (pctr1),
-          [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr),
-          [BSWAP_EPI64] "m" (BSWAP_EPI64),
-          [ONE] "m" (ONE), [TWO] "m" (TWO),
-          [THREE] "m" (THREE), [FOUR] "m" (FOUR),
-          [FIVE] "m" (FIVE), [SIX] "m" (SIX),
-          [SEVEN] "m" (SEVEN), [EIGHT] "m" (EIGHT)
-        : "xmm15", "xmm14", "xmm13", "xmm12",
-          "xmm0", "xmm1", "xmm3", "memory"
-        );
-
-        XV = X;
-        for (i=1; i < (int)(nbytes/16/8); i++) {
-            __asm__ __volatile__ (
-                "vmovaps        (%[pctr1]), %%xmm0\n\t"
-                "vmovaps        %[BSWAP_EPI64], %%xmm1\n\t"
-                "vpshufb        %%xmm1, %%xmm0, %[tmp1]\n\t"
-                "vpaddd         %[ONE], %%xmm0, %[tmp2]\n\t"
-                "vpshufb        %%xmm1, %[tmp2], %[tmp2]\n\t"
-                "vpaddd         %[TWO], %%xmm0, %[tmp3]\n\t"
-                "vpshufb        %%xmm1, %[tmp3], %[tmp3]\n\t"
-                "vpaddd         %[THREE], %%xmm0, %[tmp4]\n\t"
-                "vpshufb        %%xmm1, %[tmp4], %[tmp4]\n\t"
-                "vpaddd         %[FOUR], %%xmm0, %[tmp5]\n\t"
-                "vpshufb        %%xmm1, %[tmp5], %[tmp5]\n\t"
-                "vpaddd         %[FIVE], %%xmm0, %[tmp6]\n\t"
-                "vpshufb        %%xmm1, %[tmp6], %[tmp6]\n\t"
-                "vpaddd         %[SIX], %%xmm0, %[tmp7]\n\t"
-                "vpshufb        %%xmm1, %[tmp7], %[tmp7]\n\t"
-                "vpaddd         %[SEVEN], %%xmm0, %[tmp8]\n\t"
-                "vpshufb        %%xmm1, %[tmp8], %[tmp8]\n\t"
-                "vpaddd         %[EIGHT], %%xmm0, %%xmm0\n\t"
-
-                "vmovaps        (%[KEY]), %%xmm1\n\t"
-                "vmovaps        %%xmm0, (%[pctr1])\n\t"
-                "vpxor          %%xmm1, %[tmp1], %[tmp1]\n\t"
-                "vpxor          %%xmm1, %[tmp2], %[tmp2]\n\t"
-                "vpxor          %%xmm1, %[tmp3], %[tmp3]\n\t"
-                "vpxor          %%xmm1, %[tmp4], %[tmp4]\n\t"
-                "vpxor          %%xmm1, %[tmp5], %[tmp5]\n\t"
-                "vpxor          %%xmm1, %[tmp6], %[tmp6]\n\t"
-                "vpxor          %%xmm1, %[tmp7], %[tmp7]\n\t"
-                "vpxor          %%xmm1, %[tmp8], %[tmp8]\n\t"
-
-                "vmovaps        16(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        -128(%[out]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %[tmp1], %[tmp1]\n\t"
-                "vmovaps        112(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vpxor          %[XV], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %[tmp2], %[tmp2]\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %[tmp3], %[tmp3]\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %[tmp4], %[tmp4]\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %[tmp5], %[tmp5]\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %[tmp6], %[tmp6]\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm2\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %[tmp7], %[tmp7]\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm1, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %[tmp8], %[tmp8]\n\t"
-
-                VAESENC_PCLMUL_N( 32, -112, 96)
-                VAESENC_PCLMUL_N( 48,  -96, 80)
-                VAESENC_PCLMUL_N( 64,  -80, 64)
-                VAESENC_PCLMUL_N( 80,  -64, 48)
-                VAESENC_PCLMUL_N( 96,  -48, 32)
-                VAESENC_PCLMUL_N(112,  -32, 16)
-                VAESENC_PCLMUL_N(128,  -16,  0)
-
-                "vmovaps        144(%[KEY]), %%xmm12\n\t"
-                "vaesenc        %%xmm12, %[tmp1], %[tmp1]\n\t"
-                "vmovdqa        %[MOD2_128], %%xmm0\n\t"
-                "vaesenc        %%xmm12, %[tmp2], %[tmp2]\n\t"
-                "vpclmulqdq     $16, %%xmm0, %%xmm2, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %[tmp3], %[tmp3]\n\t"
-                "vpshufd        $78, %%xmm2, %%xmm13\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %[tmp4], %[tmp4]\n\t"
-                "vpclmulqdq     $16, %%xmm0, %%xmm13, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %[tmp5], %[tmp5]\n\t"
-                "vpshufd        $78, %%xmm13, %%xmm13\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpxor          %%xmm3, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %[tmp6], %[tmp6]\n\t"
-                "vmovdqa        %%xmm13, %%xmm2\n\t"
-                "vaesenc        %%xmm12, %[tmp7], %[tmp7]\n\t"
-                "vaesenc        %%xmm12, %[tmp8], %[tmp8]\n\t"
-                "cmpl           $11, %[nr]\n\t"
-                "vmovaps        160(%[KEY]), %%xmm12\n\t"
-                "jl             %=f\n\t"
-
-                VAESENC()
-                "vmovaps        176(%[KEY]), %%xmm12\n\t"
-                VAESENC()
-                "cmpl           $13, %[nr]\n\t"
-                "vmovaps        192(%[KEY]), %%xmm12\n\t"
-                "jl             %=f\n\t"
-
-                VAESENC()
-                "vmovaps        208(%[KEY]), %%xmm12\n\t"
-                VAESENC()
-                "vmovaps        224(%[KEY]), %%xmm12\n\t"
-
-                "%=:\n\t"
-                "vaesenclast    %%xmm12, %[tmp1], %[tmp1]\n\t"
-                "vaesenclast    %%xmm12, %[tmp2], %[tmp2]\n\t"
-                "vpxor          (%[in]), %[tmp1], %[tmp1]\n\t"
-                "vpxor          16(%[in]), %[tmp2], %[tmp2]\n\t"
-                "vmovdqu        %[tmp1], (%[out])\n\t"
-                "vmovdqu        %[tmp2], 16(%[out])\n\t"
-                "vaesenclast    %%xmm12, %[tmp3], %[tmp3]\n\t"
-                "vaesenclast    %%xmm12, %[tmp4], %[tmp4]\n\t"
-                "vpxor          32(%[in]), %[tmp3], %[tmp3]\n\t"
-                "vpxor          48(%[in]), %[tmp4], %[tmp4]\n\t"
-                "vmovdqu        %[tmp3], 32(%[out])\n\t"
-                "vmovdqu        %[tmp4], 48(%[out])\n\t"
-                "vaesenclast    %%xmm12, %[tmp5], %[tmp5]\n\t"
-                "vaesenclast    %%xmm12, %[tmp6], %[tmp6]\n\t"
-                "vpxor          64(%[in]), %[tmp5], %[tmp5]\n\t"
-                "vpxor          80(%[in]), %[tmp6], %[tmp6]\n\t"
-                "vmovdqu        %[tmp5], 64(%[out])\n\t"
-                "vmovdqu        %[tmp6], 80(%[out])\n\t"
-                "vaesenclast    %%xmm12, %[tmp7], %[tmp7]\n\t"
-                "vaesenclast    %%xmm12, %[tmp8], %[tmp8]\n\t"
-                "vpxor          96(%[in]), %[tmp7], %[tmp7]\n\t"
-                "vpxor          112(%[in]), %[tmp8], %[tmp8]\n\t"
-                "vmovdqu        %[tmp7], 96(%[out])\n\t"
-                "vmovdqu        %[tmp8], 112(%[out])\n\t"
-
-            : [tmp1] "=xr" (tmp1), [tmp2] "=xr" (tmp2), [tmp3] "=xr" (tmp3),
-              [tmp4] "=xr" (tmp4), [tmp5] "=xr" (tmp5), [tmp6] "=xr" (tmp6),
-              [tmp7] "=xr" (tmp7), [tmp8] "=xr" (tmp8),
-              [XV] "+xr" (XV)
-            : [KEY] "r" (KEY), [HT] "r" (HT), [pctr1] "r" (pctr1),
-              [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr),
-              [BSWAP_MASK] "m" (BSWAP_MASK),
-              [BSWAP_EPI64] "m" (BSWAP_EPI64),
-              [ONE] "m" (ONE), [TWO] "m" (TWO),
-              [THREE] "m" (THREE), [FOUR] "m" (FOUR),
-              [FIVE] "m" (FIVE), [SIX] "m" (SIX),
-              [SEVEN] "m" (SEVEN), [EIGHT] "m" (EIGHT),
-              [MOD2_128] "m" (MOD2_128)
-            : "xmm15", "xmm14", "xmm13", "xmm12",
-              "xmm0", "xmm1", "xmm3", "memory"
-            );
-        }
-        X = XV;
-        ctr1 = pctr1[0];
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_MASK);
-        tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_MASK);
-        tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_MASK);
-        tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_MASK);
-        tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_MASK);
-        tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_MASK);
-        tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_MASK);
-        tmp1 = _mm_xor_si128(X, tmp1);
-        X = gfmul8(tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7, tmp8,
-                   HT[0], HT[1], HT[2], HT[3], HT[4], HT[5], HT[6], HT[7]);
-    }
-    for (k = i*8; k < (int)(nbytes/16); k++) {
-        __asm__ __volatile__ (
-            "vpshufb            %[BSWAP_EPI64], %[ctr1], %[tmp1]\n\t"
-            "vpaddd             %[ONE], %[ctr1], %[ctr1]\n\t"
-            "vpxor              (%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            16(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            32(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            48(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            64(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            80(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            96(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            112(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            128(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            144(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "cmpl               $11, %[nr]\n\t"
-            "vmovaps            160(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            176(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "cmpl               $13, %[nr]\n\t"
-            "vmovaps            192(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            208(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vmovaps            224(%[KEY]), %[tmp2]\n\t"
-            "%=:\n\t"
-            "vaesenclast        %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vpxor              (%[in]), %[tmp1], %[tmp1]\n\t"
-            "vmovdqu            %[tmp1], (%[out])\n\t"
-            "vpshufb            %[BSWAP_MASK], %[tmp1], %[tmp1]\n\t"
-
-            "vpxor              %[tmp1], %[X], %[X]\n\t"
-            "# Carryless Multiply X by H (128 x 128)\n\t"
-            "vpclmulqdq         $16, %[H], %[X], %%xmm13\n\t"
-            "vpclmulqdq         $1, %[H], %[X], %%xmm14\n\t"
-            "vpclmulqdq         $0, %[H], %[X], %%xmm15\n\t"
-            "vpclmulqdq         $17, %[H], %[X], %%xmm1\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpslldq            $8, %%xmm13, %%xmm2\n\t"
-            "vpsrldq            $8, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm15, %%xmm2, %%xmm2\n\t"
-            "vpxor              %%xmm13, %%xmm1, %%xmm3\n\t"
-            "# Reduce\n\t"
-            "vmovdqa            %[MOD2_128], %%xmm0\n\t"
-            "vpclmulqdq         $16, %%xmm0, %%xmm2, %%xmm14\n\t"
-            "vpshufd            $78, %%xmm2, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpclmulqdq         $16, %%xmm0, %%xmm13, %%xmm14\n\t"
-            "vpshufd            $78, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm3, %%xmm13, %%xmm13\n\t"
-            "vmovdqa            %%xmm13, %[X]\n\t"
-            "# End Reduce\n\t"
-
-        : [tmp1] "+xr" (tmp1), [tmp2] "=xr" (tmp2),
-          [H] "+xr" (H), [X] "+xr" (X), [ctr1] "+xr" (ctr1)
-        : [KEY] "r" (KEY),
-          [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr),
-          [BSWAP_MASK] "m" (BSWAP_MASK),
-          [BSWAP_EPI64] "m" (BSWAP_EPI64),
-          [ONE] "m" (ONE),
-          [MOD2_128] "m" (MOD2_128)
-        : "xmm15", "xmm14", "xmm13",
-          "xmm0", "xmm1", "xmm2", "xmm3", "memory"
-        );
-    }
-#else
-    for (k = 0; k < (int)(nbytes/16) && k < 1; k++) {
-        __asm__ __volatile__ (
-            "vpshufb            %[BSWAP_EPI64], %[ctr1], %[tmp1]\n\t"
-            "vpaddd             %[ONE], %[ctr1], %[ctr1]\n\t"
-            "vpxor              (%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            16(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            32(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            48(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            64(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            80(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            96(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            112(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            128(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            144(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "cmpl               $11, %[nr]\n\t"
-            "vmovaps            160(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            176(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "cmpl               $13, %[nr]\n\t"
-            "vmovaps            192(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            208(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vmovaps            224(%[KEY]), %[tmp2]\n\t"
-            "%=:\n\t"
-            "vaesenclast        %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vpxor              (%[in]), %[tmp1], %[tmp1]\n\t"
-            "vmovdqu            %[tmp1], (%[out])\n\t"
-            "vpshufb            %[BSWAP_MASK], %[tmp1], %[tmp1]\n\t"
-            "vpxor              %[tmp1], %[X], %[X]\n\t"
-
-        : [tmp1] "+xr" (tmp1), [tmp2] "=xr" (tmp2),
-          [H] "+xr" (H), [X] "+xr" (X), [ctr1] "+xr" (ctr1)
-        : [KEY] "r" (KEY),
-          [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr),
-          [BSWAP_MASK] "m" (BSWAP_MASK),
-          [BSWAP_EPI64] "m" (BSWAP_EPI64),
-          [ONE] "m" (ONE),
-          [MOD2_128] "m" (MOD2_128)
-        : "memory"
-        );
-    }
-    for (; k < (int)(nbytes/16); k++) {
-        __asm__ __volatile__ (
-            "vpshufb            %[BSWAP_EPI64], %[ctr1], %[tmp1]\n\t"
-            "vpaddd             %[ONE], %[ctr1], %[ctr1]\n\t"
-            "vpxor              (%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vaesenc            16(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpclmulqdq         $16, %[H], %[X], %%xmm13\n\t"
-            "vaesenc            32(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpclmulqdq         $1, %[H], %[X], %%xmm14\n\t"
-            "vaesenc            48(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpclmulqdq         $0, %[H], %[X], %%xmm15\n\t"
-            "vaesenc            64(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpclmulqdq         $17, %[H], %[X], %%xmm1\n\t"
-            "vaesenc            80(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpslldq            $8, %%xmm13, %%xmm2\n\t"
-            "vpsrldq            $8, %%xmm13, %%xmm13\n\t"
-            "vaesenc            96(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpxor              %%xmm15, %%xmm2, %%xmm2\n\t"
-            "vpxor              %%xmm13, %%xmm1, %%xmm3\n\t"
-            "vmovdqa            %[MOD2_128], %%xmm0\n\t"
-            "vpclmulqdq         $16, %%xmm0, %%xmm2, %%xmm14\n\t"
-            "vaesenc            112(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpshufd            $78, %%xmm2, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpclmulqdq         $16, %%xmm0, %%xmm13, %%xmm14\n\t"
-            "vaesenc            128(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vpshufd            $78, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm3, %%xmm13, %%xmm13\n\t"
-            "vaesenc            144(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vmovdqa            %%xmm13, %[X]\n\t"
-            "cmpl               $11, %[nr]\n\t"
-            "vmovaps            160(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            176(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "cmpl               $13, %[nr]\n\t"
-            "vmovaps            192(%[KEY]), %[tmp2]\n\t"
-            "jl                 %=f\n\t"
-            "vaesenc            %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vaesenc            208(%[KEY]), %[tmp1], %[tmp1]\n\t"
-            "vmovaps            224(%[KEY]), %[tmp2]\n\t"
-            "%=:\n\t"
-            "vaesenclast        %[tmp2], %[tmp1], %[tmp1]\n\t"
-            "vpxor              (%[in]), %[tmp1], %[tmp1]\n\t"
-            "vmovdqu            %[tmp1], (%[out])\n\t"
-            "vpshufb            %[BSWAP_MASK], %[tmp1], %[tmp1]\n\t"
-            "vpxor              %[tmp1], %[X], %[X]\n\t"
-
-        : [tmp1] "+xr" (tmp1), [tmp2] "=xr" (tmp2),
-          [H] "+xr" (H), [X] "+xr" (X), [ctr1] "+xr" (ctr1)
-        : [KEY] "r" (KEY),
-          [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr),
-          [BSWAP_MASK] "m" (BSWAP_MASK),
-          [BSWAP_EPI64] "m" (BSWAP_EPI64),
-          [ONE] "m" (ONE),
-          [MOD2_128] "m" (MOD2_128)
-        : "xmm15", "xmm14", "xmm13",
-          "xmm0", "xmm1", "xmm2", "xmm3", "memory"
-        );
-    }
-    if (k > 0) {
-        X = gfmul_shifted(X, H);
-    }
-#endif
-    /* If one partial block remains */
-    if (nbytes % 16) {
-        tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64);
-        tmp1 = _mm_xor_si128(tmp1, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        tmp1 = _mm_aesenclast_si128(tmp1, lastKey);
-        last_block = tmp1;
-        for (j=0; j < (int)(nbytes%16); j++)
-            ((unsigned char*)&last_block)[j] = in[k*16+j];
-        tmp1 = _mm_xor_si128(tmp1, last_block);
-        last_block = tmp1;
-        for (j=0; j < (int)(nbytes%16); j++)
-            out[k*16+j] = ((unsigned char*)&last_block)[j];
-        tmp1 = last_block;
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X =_mm_xor_si128(X, tmp1);
-        X = gfmul_shifted(X, H);
-    }
-    tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0);
-    tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1);
-    X = _mm_xor_si128(X, tmp1);
-    X = gfmul_shifted(X, H);
-    X = _mm_shuffle_epi8(X, BSWAP_MASK);
-    T = _mm_xor_si128(X, T);
-    _mm_storeu_si128((__m128i*)tag, T);
-}
-#endif /* HAVE_INTEL_AVX2 */
+    /*_mm_storeu_si128((__m128i*)tag, T);*/
+    XMEMCPY(tag, &T, tbytes);
+    }
 
 #ifdef HAVE_AES_DECRYPT
-/* Figure 10. AES-GCM – Decrypt With Single Block Ghash at a Time */
-
-static int AES_GCM_decrypt(const unsigned char *in, unsigned char *out,
-                           const unsigned char* addt, const unsigned char* ivec,
+
+static void AES_GCM_decrypt(const unsigned char *in,
+                           unsigned char *out,
+                           const unsigned char* addt,
+                           const unsigned char* ivec,
                            const unsigned char *tag, int nbytes, int abytes,
-                           int ibytes, const unsigned char* key, int nr)
+                           int ibytes, word32 tbytes, const unsigned char* key,
+                           int nr, int* res)
 {
     int i, j ,k;
@@ -5035 +7320 @@
     __m128i r0, r1;
     __m128i tmp3, tmp4, tmp5, tmp6, tmp7, tmp8;
-#endif
-
-    if (ibytes == 12) {
-        Y = _mm_setzero_si128();
-        for (j=0; j < 12; j++)
-            ((unsigned char*)&Y)[j] = ivec[j];
-        Y = _mm_insert_epi32(Y, 0x1000000, 3);
-            /* (Compute E[ZERO, KS] and E[Y0, KS] together */
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp2 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        T = _mm_aesenclast_si128(tmp2, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-    }
-    else {
-        if (ibytes % 16) {
-            i = ibytes / 16;
-            for (j=0; j < ibytes%16; j++)
-                ((unsigned char*)&last_block)[j] = ivec[i*16+j];
-        }
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-
-        Y = _mm_setzero_si128();
-        for (i=0; i < ibytes/16; i++) {
-            tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]);
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        if (ibytes % 16) {
-            tmp1 = last_block;
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0);
-        tmp1 = _mm_insert_epi64(tmp1, 0, 1);
-        Y = _mm_xor_si128(Y, tmp1);
-        Y = gfmul_sw(Y, H);
-        Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */
-        tmp1 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        T = _mm_aesenclast_si128(tmp1, lastKey);
-    }
+#endif /* AES_GCM_AESNI_NO_UNROLL */
+
+    if (ibytes == 12)
+        aes_gcm_calc_iv_12(KEY, ivec, nr, H, Y, T);
+    else
+        aes_gcm_calc_iv(KEY, ivec, ibytes, nr, H, Y, T);
 
     for (i=0; i<abytes/16; i++) {
@@ -5359 +7532 @@
                     tmp8 = _mm_aesenc_si128(tmp8, KEY[13]);
                     lastKey = KEY[14];
-                }
-            }
-            tmp1 =_mm_aesenclast_si128(tmp1, lastKey);
-            tmp2 =_mm_aesenclast_si128(tmp2, lastKey);
-            tmp3 =_mm_aesenclast_si128(tmp3, lastKey);
-            tmp4 =_mm_aesenclast_si128(tmp4, lastKey);
-            tmp5 =_mm_aesenclast_si128(tmp5, lastKey);
-            tmp6 =_mm_aesenclast_si128(tmp6, lastKey);
-            tmp7 =_mm_aesenclast_si128(tmp7, lastKey);
-            tmp8 =_mm_aesenclast_si128(tmp8, lastKey);
-            tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[i*8+0]));
-            tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[i*8+1]));
-            tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[i*8+2]));
-            tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[i*8+3]));
-            tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[i*8+4]));
-            tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[i*8+5]));
-            tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[i*8+6]));
-            tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[i*8+7]));
-            _mm_storeu_si128(&((__m128i*)out)[i*8+0], tmp1);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+1], tmp2);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+2], tmp3);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+3], tmp4);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+4], tmp5);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+5], tmp6);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+6], tmp7);
-            _mm_storeu_si128(&((__m128i*)out)[i*8+7], tmp8);
-        }
-    }
-#endif
+        }
+    }
+            AES_ENC_LAST_8();
+        }
+    }
+
+#endif /* AES_GCM_AESNI_NO_UNROLL */
+
     for (k = i*8; k < nbytes/16; k++) {
         tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64);
@@ -5469 +7621 @@
     T = _mm_xor_si128(X, T);
 
-    if (0xffff !=
-           _mm_movemask_epi8(_mm_cmpeq_epi8(T, _mm_loadu_si128((__m128i*)tag))))
-        return 0; /* in case the authentication failed */
-
-    return 1; /* when successful returns 1 */
+/*    if (0xffff !=
+           _mm_movemask_epi8(_mm_cmpeq_epi8(T, _mm_loadu_si128((__m128i*)tag)))) */
+    if (XMEMCMP(tag, &T, tbytes) != 0)
+        *res = 0; /* in case the authentication failed */
+    else
+        *res = 1; /* when successful returns 1 */
 }
 
-#ifdef HAVE_INTEL_AVX2
-static int AES_GCM_decrypt_avx2(const unsigned char *in, unsigned char *out,
-                                const unsigned char* addt,
-                                const unsigned char* ivec,
-                                const unsigned char *tag, int nbytes,
-                                int abytes, int ibytes,
-                                const unsigned char* key, int nr)
-{
-    int i, j ,k;
-    __m128i H, Y, T;
-    __m128i *KEY = (__m128i*)key, lastKey;
-    __m128i ctr1;
-    __m128i last_block = _mm_setzero_si128();
-    __m128i X = _mm_setzero_si128();
-    __m128i tmp1, tmp2;
-#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
-    __m128i HT[8];
-    __m128i pctr1[1];
-    register __m128i XV asm("xmm2");
-#else
-    __m128i XV;
-#endif
-
-    if (ibytes == 12) {
-        Y = _mm_setzero_si128();
-        for (j=0; j < 12; j++)
-            ((unsigned char*)&Y)[j] = ivec[j];
-        Y = _mm_insert_epi32(Y, 0x1000000, 3);
-            /* (Compute E[ZERO, KS] and E[Y0, KS] together */
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp2 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        tmp2 = _mm_aesenc_si128(tmp2, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            tmp2 = _mm_aesenc_si128(tmp2, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp2 = _mm_aesenc_si128(tmp2, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                tmp2 = _mm_aesenc_si128(tmp2, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        T = _mm_aesenclast_si128(tmp2, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-    }
-    else {
-        if (ibytes % 16) {
-            i = ibytes / 16;
-            for (j=0; j < ibytes%16; j++)
-                ((unsigned char*)&last_block)[j] = ivec[i*16+j];
-        }
-        tmp1 = _mm_xor_si128(X, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        H = _mm_aesenclast_si128(tmp1, lastKey);
-        H = _mm_shuffle_epi8(H, BSWAP_MASK);
-
-        Y = _mm_setzero_si128();
-        for (i=0; i < ibytes/16; i++) {
-            tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]);
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        if (ibytes % 16) {
-            tmp1 = last_block;
-            tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-            Y = _mm_xor_si128(Y, tmp1);
-            Y = gfmul_sw(Y, H);
-        }
-        tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0);
-        tmp1 = _mm_insert_epi64(tmp1, 0, 1);
-        Y = _mm_xor_si128(Y, tmp1);
-        Y = gfmul_sw(Y, H);
-        Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */
-        tmp1 = _mm_xor_si128(Y, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        T = _mm_aesenclast_si128(tmp1, lastKey);
-    }
-
-    for (i=0; i<abytes/16; i++) {
-        tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]);
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X = _mm_xor_si128(X, tmp1);
-        X = gfmul_sw(X, H);
-    }
-    if (abytes%16) {
-        last_block = _mm_setzero_si128();
-        for (j=0; j<abytes%16; j++)
-            ((unsigned char*)&last_block)[j] = addt[i*16+j];
-        tmp1 = last_block;
-        tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK);
-        X = _mm_xor_si128(X, tmp1);
-        X = gfmul_sw(X, H);
-    }
-
-    tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64);
-    ctr1 = _mm_add_epi32(tmp1, ONE);
-    H = gfmul_shl1(H);
-    i = 0;
-
-#if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL)
-
-    if (0 < nbytes/16/8) {
-        HT[0] = H;
-        HT[1] = gfmul_shifted(H, H);
-        HT[2] = gfmul_shifted(H, HT[1]);
-        HT[3] = gfmul_shifted(HT[1], HT[1]);
-        HT[4] = gfmul_shifted(HT[1], HT[2]);
-        HT[5] = gfmul_shifted(HT[2], HT[2]);
-        HT[6] = gfmul_shifted(HT[2], HT[3]);
-        HT[7] = gfmul_shifted(HT[3], HT[3]);
-
-        pctr1[0] = ctr1;
-        XV = X;
-        for (; i < nbytes/16/8; i++) {
-            __asm__ __volatile__ (
-                "vmovaps        (%[pctr1]), %%xmm0\n\t"
-                "vmovaps        %[BSWAP_EPI64], %%xmm1\n\t"
-                "vpshufb        %%xmm1, %%xmm0, %%xmm4\n\t"
-                "vpaddd         %[ONE], %%xmm0, %%xmm5\n\t"
-                "vpshufb        %%xmm1, %%xmm5, %%xmm5\n\t"
-                "vpaddd         %[TWO], %%xmm0, %%xmm6\n\t"
-                "vpshufb        %%xmm1, %%xmm6, %%xmm6\n\t"
-                "vpaddd         %[THREE], %%xmm0, %%xmm7\n\t"
-                "vpshufb        %%xmm1, %%xmm7, %%xmm7\n\t"
-                "vpaddd         %[FOUR], %%xmm0, %%xmm8\n\t"
-                "vpshufb        %%xmm1, %%xmm8, %%xmm8\n\t"
-                "vpaddd         %[FIVE], %%xmm0, %%xmm9\n\t"
-                "vpshufb        %%xmm1, %%xmm9, %%xmm9\n\t"
-                "vpaddd         %[SIX], %%xmm0, %%xmm10\n\t"
-                "vpshufb        %%xmm1, %%xmm10, %%xmm10\n\t"
-                "vpaddd         %[SEVEN], %%xmm0, %%xmm11\n\t"
-                "vpshufb        %%xmm1, %%xmm11, %%xmm11\n\t"
-                "vpaddd         %[EIGHT], %%xmm0, %%xmm0\n\t"
-
-                "vmovaps        (%[KEY]), %%xmm1\n\t"
-                "vmovaps        %%xmm0, (%[pctr1])\n\t"
-                "vpxor          %%xmm1, %%xmm4, %%xmm4\n\t"
-                "vpxor          %%xmm1, %%xmm5, %%xmm5\n\t"
-                "vpxor          %%xmm1, %%xmm6, %%xmm6\n\t"
-                "vpxor          %%xmm1, %%xmm7, %%xmm7\n\t"
-                "vpxor          %%xmm1, %%xmm8, %%xmm8\n\t"
-                "vpxor          %%xmm1, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm1, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm1, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        16(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        (%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        112(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vpxor          %[XV], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm2\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm1, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        32(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        16(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        96(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        48(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        32(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        80(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        64(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        48(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        64(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        80(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        64(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        48(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        96(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        80(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        32(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        112(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        96(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        16(%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        128(%[KEY]), %%xmm12\n\t"
-                "vmovdqu        112(%[in]), %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovaps        (%[HT]), %%xmm0\n\t"
-                "vpshufb        %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpclmulqdq     $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpclmulqdq     $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpslldq        $8, %%xmm13, %%xmm14\n\t"
-                "vpsrldq        $8, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vpxor          %%xmm15, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm1, %%xmm3, %%xmm3\n\t"
-                "vpxor          %%xmm14, %%xmm2, %%xmm2\n\t"
-                "vpxor          %%xmm13, %%xmm3, %%xmm3\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-
-                "vmovaps        144(%[KEY]), %%xmm12\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vmovdqa        %[MOD2_128], %%xmm0\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpclmulqdq     $16, %%xmm0, %%xmm2, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vpshufd        $78, %%xmm2, %%xmm13\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpclmulqdq     $16, %%xmm0, %%xmm13, %%xmm14\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vpshufd        $78, %%xmm13, %%xmm13\n\t"
-                "vpxor          %%xmm14, %%xmm13, %%xmm13\n\t"
-                "vpxor          %%xmm3, %%xmm13, %%xmm13\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vmovdqa        %%xmm13, %%xmm2\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-                "cmpl           $11, %[nr]\n\t"
-                "vmovaps        160(%[KEY]), %%xmm12\n\t"
-                "jl             %=f\n\t"
-
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-                "vmovaps        176(%[KEY]), %%xmm12\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-                "cmpl           $13, %[nr]\n\t"
-                "vmovaps        192(%[KEY]), %%xmm12\n\t"
-                "jl             %=f\n\t"
-
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-                "vmovaps        208(%[KEY]), %%xmm12\n\t"
-                "vaesenc        %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vaesenc        %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vaesenc        %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vaesenc        %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vaesenc        %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vaesenc        %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vaesenc        %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenc        %%xmm12, %%xmm11, %%xmm11\n\t"
-                "vmovaps        224(%[KEY]), %%xmm12\n\t"
-
-                "%=:\n\t"
-                "vaesenclast    %%xmm12, %%xmm4, %%xmm4\n\t"
-                "vaesenclast    %%xmm12, %%xmm5, %%xmm5\n\t"
-                "vpxor          (%[in]), %%xmm4, %%xmm4\n\t"
-                "vpxor          16(%[in]), %%xmm5, %%xmm5\n\t"
-                "vmovdqu        %%xmm4, (%[out])\n\t"
-                "vmovdqu        %%xmm5, 16(%[out])\n\t"
-                "vaesenclast    %%xmm12, %%xmm6, %%xmm6\n\t"
-                "vaesenclast    %%xmm12, %%xmm7, %%xmm7\n\t"
-                "vpxor          32(%[in]), %%xmm6, %%xmm6\n\t"
-                "vpxor          48(%[in]), %%xmm7, %%xmm7\n\t"
-                "vmovdqu        %%xmm6, 32(%[out])\n\t"
-                "vmovdqu        %%xmm7, 48(%[out])\n\t"
-                "vaesenclast    %%xmm12, %%xmm8, %%xmm8\n\t"
-                "vaesenclast    %%xmm12, %%xmm9, %%xmm9\n\t"
-                "vpxor          64(%[in]), %%xmm8, %%xmm8\n\t"
-                "vpxor          80(%[in]), %%xmm9, %%xmm9\n\t"
-                "vmovdqu        %%xmm8, 64(%[out])\n\t"
-                "vmovdqu        %%xmm9, 80(%[out])\n\t"
-                "vaesenclast    %%xmm12, %%xmm10, %%xmm10\n\t"
-                "vaesenclast    %%xmm12, %%xmm11, %%xmm11\n\t"
-                "vpxor          96(%[in]), %%xmm10, %%xmm10\n\t"
-                "vpxor          112(%[in]), %%xmm11, %%xmm11\n\t"
-                "vmovdqu        %%xmm10, 96(%[out])\n\t"
-                "vmovdqu        %%xmm11, 112(%[out])\n\t"
-
-            : [XV] "+xr" (XV)
-            : [KEY] "r" (KEY), [HT] "r" (HT), [pctr1] "r" (pctr1),
-              [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr),
-              [BSWAP_MASK] "m" (BSWAP_MASK),
-              [BSWAP_EPI64] "m" (BSWAP_EPI64),
-              [ONE] "m" (ONE), [TWO] "m" (TWO),
-              [THREE] "m" (THREE), [FOUR] "m" (FOUR),
-              [FIVE] "m" (FIVE), [SIX] "m" (SIX),
-              [SEVEN] "m" (SEVEN), [EIGHT] "m" (EIGHT),
-              [MOD2_128] "m" (MOD2_128)
-            : "xmm15", "xmm14", "xmm13", "xmm12",
-              "xmm11", "xmm10", "xmm9", "xmm8",
-              "xmm7", "xmm6", "xmm5", "xmm4",
-              "xmm0", "xmm1", "xmm3", "memory"
-            );
-        }
-        X = XV;
-        ctr1 = pctr1[0];
-    }
-#endif
-    for (k = i*8; k < nbytes/16; k++) {
-        __asm__ __volatile__ (
-            "vpshufb    %[BSWAP_EPI64], %[ctr1], %%xmm4\n\t"
-            "vpaddd             %[ONE], %[ctr1], %[ctr1]\n\t"
-            "vpxor              (%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vaesenc    16(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vmovaps    %[H], %%xmm0\n\t"
-            "vmovdqu    (%[in]), %%xmm1\n\t"
-            "vaesenc    32(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpshufb    %[BSWAP_MASK], %%xmm1, %%xmm1\n\t"
-            "vpxor              %[X], %%xmm1, %%xmm1\n\t"
-            "vaesenc    48(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t"
-            "vaesenc    64(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t"
-            "vaesenc    80(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t"
-            "vaesenc    96(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t"
-            "vaesenc    112(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpslldq    $8, %%xmm13, %%xmm2\n\t"
-            "vpsrldq    $8, %%xmm13, %%xmm13\n\t"
-            "vaesenc    128(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vpxor              %%xmm15, %%xmm2, %%xmm2\n\t"
-            "vpxor              %%xmm13, %%xmm1, %%xmm3\n\t"
-            "vaesenc    144(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "# Reduce\n\t"
-            "vmovdqa    %[MOD2_128], %%xmm0\n\t"
-            "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t"
-            "vpshufd    $78, %%xmm2, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t"
-            "vpshufd    $78, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm14, %%xmm13, %%xmm13\n\t"
-            "vpxor              %%xmm3, %%xmm13, %%xmm13\n\t"
-            "vmovdqa    %%xmm13, %[X]\n\t"
-            "# End Reduce\n\t"
-            "cmpl               $11, %[nr]\n\t"
-            "vmovaps    160(%[KEY]), %%xmm5\n\t"
-            "jl             %=f\n\t"
-            "vaesenc    %%xmm5, %%xmm4, %%xmm4\n\t"
-            "vaesenc    176(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "cmpl               $13, %[nr]\n\t"
-            "vmovaps    192(%[KEY]), %%xmm5\n\t"
-            "jl             %=f\n\t"
-            "vaesenc    %%xmm5, %%xmm4, %%xmm4\n\t"
-            "vaesenc    208(%[KEY]), %%xmm4, %%xmm4\n\t"
-            "vmovaps    224(%[KEY]), %%xmm5\n\t"
-            "%=:\n\t"
-            "vaesenclast        %%xmm5, %%xmm4, %%xmm4\n\t"
-            "vpxor              (%[in]), %%xmm4, %%xmm4\n\t"
-            "vmovdqu    %%xmm4, (%[out])\n\t"
-
-        : [H] "+xr" (H), [X] "+xr" (X),
-          [ctr1] "+xr" (ctr1)
-        : [KEY] "r" (KEY),
-          [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr),
-          [BSWAP_MASK] "m" (BSWAP_MASK),
-          [BSWAP_EPI64] "m" (BSWAP_EPI64),
-          [ONE] "m" (ONE),
-          [MOD2_128] "m" (MOD2_128)
-        : "xmm15", "xmm14", "xmm13", "xmm4", "xmm5",
-          "xmm0", "xmm1", "xmm2", "xmm3", "memory"
-        );
-    }
-
-    /* If one partial block remains */
-    if (nbytes % 16) {
-        tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64);
-        tmp1 = _mm_xor_si128(tmp1, KEY[0]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[1]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[2]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[3]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[4]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[5]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[6]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[7]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[8]);
-        tmp1 = _mm_aesenc_si128(tmp1, KEY[9]);
-        lastKey = KEY[10];
-        if (nr > 10) {
-            tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-            tmp1 = _mm_aesenc_si128(tmp1, KEY[11]);
-            lastKey = KEY[12];
-            if (nr > 12) {
-                tmp1 = _mm_aesenc_si128(tmp1, lastKey);
-                tmp1 = _mm_aesenc_si128(tmp1, KEY[13]);
-                lastKey = KEY[14];
-            }
-        }
-        tmp1 = _mm_aesenclast_si128(tmp1, lastKey);
-        last_block = _mm_setzero_si128();
-        for (j=0; j < nbytes%16; j++)
-            ((unsigned char*)&last_block)[j] = in[k*16+j];
-        XV = last_block;
-        tmp1 = _mm_xor_si128(tmp1, last_block);
-        last_block = tmp1;
-        for (j=0; j < nbytes%16; j++)
-            out[k*16+j] = ((unsigned char*)&last_block)[j];
-        XV = _mm_shuffle_epi8(XV, BSWAP_MASK);
-        XV = _mm_xor_si128(XV, X);
-        X = gfmul_shifted(XV, H);
-    }
-
-    tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0);
-    tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1);
-    /* 128 x 128 Carryless Multiply */
-    X = _mm_xor_si128(X, tmp1);
-    X = gfmul_shifted(X, H);
-    X = _mm_shuffle_epi8(X, BSWAP_MASK);
-    T = _mm_xor_si128(X, T);
-
-    if (0xffff !=
-           _mm_movemask_epi8(_mm_cmpeq_epi8(T, _mm_loadu_si128((__m128i*)tag))))
-        return 0; /* in case the authentication failed */
-
-    return 1; /* when successful returns 1 */
-}
-#endif /* HAVE_INTEL_AVX2 */
 #endif /* HAVE_AES_DECRYPT */
+#endif /* _MSC_VER */
 #endif /* WOLFSSL_AESNI */
 
@@ -6483 +8011 @@
                 Z[2] ^= V[2];
                 Z[3] ^= V[3];
-            }
+        }
 
             if (V[3] & 0x00000001) {
@@ -6502 +8030 @@
                 V[1] |= ((V[0] & 0x00000001) ? 0x80000000 : 0);
                 V[0] >>= 1;
-            }
+    }
             y <<= 1;
         }
@@ -6613 +8141 @@
 
 #if !defined(WOLFSSL_XILINX_CRYPT)
+#ifdef FREESCALE_LTC_AES_GCM
 int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
                    const byte* iv, word32 ivSz,
                    byte* authTag, word32 authTagSz,
                    const byte* authIn, word32 authInSz)
+    {
+    status_t status;
+    word32 keySize;
+
+    /* argument checks */
+    if (aes == NULL || authTagSz > AES_BLOCK_SIZE) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) {
+        WOLFSSL_MSG("GcmEncrypt authTagSz too small error");
+        return BAD_FUNC_ARG;
+    }
+
+    status = wc_AesGetKeySize(aes, &keySize);
+    if (status)
+        return status;
+
+    status = LTC_AES_EncryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
+        authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
+
+    return (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
+}
+#else
+#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || \
+                              defined(WOLFSSL_STM32F7) || \
+                              defined(WOLFSSL_STM32L4))
+
+static WC_INLINE int wc_AesGcmEncrypt_STM32(Aes* aes, byte* out, const byte* in,
+                                         word32 sz, const byte* iv, word32 ivSz,
+                                         byte* authTag, word32 authTagSz,
+                                         const byte* authIn, word32 authInSz)
+        {
+    int ret;
+#ifdef WOLFSSL_STM32_CUBEMX
+    CRYP_HandleTypeDef hcryp;
+#else
+    word32 keyCopy[AES_256_KEY_SIZE/sizeof(word32)];
+#endif
+    word32 keySize;
+    int status = 0;
+    int outPadSz, authPadSz;
+    word32 tag[AES_BLOCK_SIZE/sizeof(word32)];
+    word32 initialCounter[AES_BLOCK_SIZE/sizeof(word32)];
+    byte* outPadded = NULL;
+    byte* authInPadded = NULL;
+
+    ret = wc_AesGetKeySize(aes, &keySize);
+    if (ret != 0)
+        return ret;
+
+#ifdef WOLFSSL_STM32_CUBEMX
+    ret = wc_Stm32_Aes_Init(aes, &hcryp);
+    if (ret != 0)
+        return ret;
+#endif
+
+    XMEMSET(initialCounter, 0, sizeof(initialCounter));
+    XMEMCPY(initialCounter, iv, ivSz);
+    *((byte*)initialCounter + (AES_BLOCK_SIZE - 1)) = STM32_GCM_IV_START;
+
+    /* Need to pad the AAD and input cipher text to a full block size since
+     * CRYP_AES_GCM will assume these are a multiple of AES_BLOCK_SIZE.
+     * It is okay to pad with zeros because GCM does this before GHASH already.
+     * See NIST SP 800-38D */
+    if ((sz % AES_BLOCK_SIZE) != 0 || sz == 0) {
+        outPadSz = ((sz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
+        outPadded = (byte*)XMALLOC(outPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (outPadded == NULL) {
+            return MEMORY_E;
+        }
+        XMEMSET(outPadded, 0, outPadSz);
+    }
+    else {
+        outPadSz = sz;
+        outPadded = out;
+    }
+    XMEMCPY(outPadded, in, sz);
+
+    if (authInSz == 0 || (authInSz % AES_BLOCK_SIZE) != 0) {
+        /* Need to pad the AAD to a full block with zeros. */
+        authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
+        authInPadded = (byte*)XMALLOC(authPadSz, aes->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (authInPadded == NULL) {
+            if (outPadded != out) {
+                XFREE(outPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            }
+            return MEMORY_E;
+            }
+        XMEMSET(authInPadded, 0, authPadSz);
+        XMEMCPY(authInPadded, authIn, authInSz);
+    } else {
+        authPadSz = authInSz;
+        authInPadded = (byte*)authIn;
+    }
+
+
+#ifdef WOLFSSL_STM32_CUBEMX
+    hcryp.Init.pInitVect = (uint8_t*)initialCounter;
+    hcryp.Init.Header = authInPadded;
+    hcryp.Init.HeaderSize = authInSz;
+
+#ifdef STM32_CRYPTO_AES_ONLY
+    /* Set the CRYP parameters */
+    hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_GCM_GMAC;
+    hcryp.Init.OperatingMode = CRYP_ALGOMODE_ENCRYPT;
+    hcryp.Init.GCMCMACPhase  = CRYP_INIT_PHASE;
+    HAL_CRYP_Init(&hcryp);
+
+    /* GCM init phase */
+    status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
+    if (status == HAL_OK) {
+        /* GCM header phase */
+        hcryp.Init.GCMCMACPhase  = CRYP_HEADER_PHASE;
+        status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
+        if (status == HAL_OK) {
+            /* GCM payload phase */
+            hcryp.Init.GCMCMACPhase  = CRYP_PAYLOAD_PHASE;
+            status = HAL_CRYPEx_AES_Auth(&hcryp, outPadded, sz, outPadded,
+                STM32_HAL_TIMEOUT);
+            if (status == HAL_OK) {
+                /* GCM final phase */
+                hcryp.Init.GCMCMACPhase  = CRYP_FINAL_PHASE;
+                status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, sz, (byte*)tag,
+                    STM32_HAL_TIMEOUT);
+            }
+        }
+    }
+#else
+    HAL_CRYP_Init(&hcryp);
+
+    status = HAL_CRYPEx_AESGCM_Encrypt(&hcryp, outPadded, sz,
+                                       outPadded, STM32_HAL_TIMEOUT);
+    /* Compute the authTag */
+    if (status == HAL_OK) {
+        status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, (byte*)tag,
+            STM32_HAL_TIMEOUT);
+    }
+#endif
+
+    if (status != HAL_OK)
+        ret = AES_GCM_AUTH_E;
+    HAL_CRYP_DeInit(&hcryp);
+
+#else /* STD_PERI_LIB */
+    ByteReverseWords(keyCopy, (word32*)aes->key, keySize);
+    status = CRYP_AES_GCM(MODE_ENCRYPT, (uint8_t*)initialCounter,
+                         (uint8_t*)keyCopy,     keySize * 8,
+                         (uint8_t*)outPadded,   sz,
+                         (uint8_t*)authInPadded,authInSz,
+                         (uint8_t*)outPadded,   (byte*)tag);
+    if (status != SUCCESS)
+        ret = AES_GCM_AUTH_E;
+#endif /* WOLFSSL_STM32_CUBEMX */
+
+    if (ret == 0) {
+        /* return authTag */
+        XMEMCPY(authTag, tag, authTagSz);
+
+        /* return output if allocated padded used */
+        if (outPadded != out) {
+            XMEMCPY(out, outPadded, sz);
+            }
+        }
+
+    /* Free memory if not a multiple of AES_BLOCK_SZ */
+    if (outPadded != out) {
+        XFREE(outPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+    if (authInPadded != authIn) {
+        XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+}
+
+    return ret;
+}
+#endif /* STM32_CRYPTO */
+
+#ifdef WOLFSSL_AESNI
+int AES_GCM_encrypt_C(Aes* aes, byte* out, const byte* in, word32 sz,
+                      const byte* iv, word32 ivSz,
+                      byte* authTag, word32 authTagSz,
+                      const byte* authIn, word32 authInSz);
+#else
+static
+#endif
+int AES_GCM_encrypt_C(Aes* aes, byte* out, const byte* in, word32 sz,
+                      const byte* iv, word32 ivSz,
+                      byte* authTag, word32 authTagSz,
+                      const byte* authIn, word32 authInSz)
 {
     int ret = 0;
-    word32 keySize;
-#ifdef FREESCALE_LTC_AES_GCM
-    status_t status;
-#else
     word32 blocks = sz / AES_BLOCK_SIZE;
     word32 partial = sz % AES_BLOCK_SIZE;
@@ -6631 +8346 @@
     byte *ctr;
     byte scratch[AES_BLOCK_SIZE];
-#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || defined(WOLFSSL_STM32F7))
-    #ifdef WOLFSSL_STM32_CUBEMX
-        CRYP_HandleTypeDef hcryp;
-    #else
-        byte keyCopy[AES_BLOCK_SIZE * 2];
-    #endif /* WOLFSSL_STM32_CUBEMX */
-    int status = 0;
-    byte* authInPadded = NULL;
-    byte tag[AES_BLOCK_SIZE];
-    int authPadSz;
-#endif /* STM32_CRYPTO */
-#endif /* FREESCALE_LTC_AES_GCM */
-
+
+    ctr = counter;
+    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
+    if (ivSz == GCM_NONCE_MID_SZ) {
+        XMEMCPY(initialCounter, iv, ivSz);
+        initialCounter[AES_BLOCK_SIZE - 1] = 1;
+    }
+    else {
+        GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE);
+    }
+    XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE);
+
+#ifdef WOLFSSL_PIC32MZ_CRYPT
+    if (blocks) {
+        /* use initial IV for PIC32 HW, but don't use it below */
+        XMEMCPY(aes->reg, ctr, AES_BLOCK_SIZE);
+
+        ret = wc_Pic32AesCrypt(
+            aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
+            out, in, (blocks * AES_BLOCK_SIZE),
+            PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
+        if (ret != 0)
+            return ret;
+        }
+    /* process remainder using partial handling */
+            #endif
+
+#if defined(HAVE_AES_ECB) && !defined(WOLFSSL_PIC32MZ_CRYPT)
+    /* some hardware acceleration can gain performance from doing AES encryption
+     * of the whole buffer at once */
+    if (c != p) { /* can not handle inline encryption */
+        while (blocks--) {
+            IncrementGcmCounter(ctr);
+            XMEMCPY(c, ctr, AES_BLOCK_SIZE);
+            c += AES_BLOCK_SIZE;
+        }
+
+        /* reset number of blocks and then do encryption */
+        blocks = sz / AES_BLOCK_SIZE;
+        wc_AesEcbEncrypt(aes, out, out, AES_BLOCK_SIZE * blocks);
+        xorbuf(out, p, AES_BLOCK_SIZE * blocks);
+        p += AES_BLOCK_SIZE * blocks;
+    }
+    else
+#endif /* HAVE_AES_ECB */
+
+        while (blocks--) {
+        IncrementGcmCounter(ctr);
+    #ifndef WOLFSSL_PIC32MZ_CRYPT
+        wc_AesEncrypt(aes, ctr, scratch);
+        xorbuf(scratch, p, AES_BLOCK_SIZE);
+        XMEMCPY(c, scratch, AES_BLOCK_SIZE);
+            #endif
+        p += AES_BLOCK_SIZE;
+            c += AES_BLOCK_SIZE;
+        }
+
+        if (partial != 0) {
+        IncrementGcmCounter(ctr);
+        wc_AesEncrypt(aes, ctr, scratch);
+        xorbuf(scratch, p, partial);
+        XMEMCPY(c, scratch, partial);
+    }
+
+    GHASH(aes, authIn, authInSz, out, sz, authTag, authTagSz);
+    wc_AesEncrypt(aes, initialCounter, scratch);
+    xorbuf(authTag, scratch, authTagSz);
+
+    return ret;
+}
+
+/* Software AES - GCM Encrypt */
+int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
+                   const byte* iv, word32 ivSz,
+                   byte* authTag, word32 authTagSz,
+                   const byte* authIn, word32 authInSz)
+        {
     /* argument checks */
     if (aes == NULL || authTagSz > AES_BLOCK_SIZE) {
         return BAD_FUNC_ARG;
-    }
+            }
 
     if (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) {
         WOLFSSL_MSG("GcmEncrypt authTagSz too small error");
         return BAD_FUNC_ARG;
-    }
-
-    ret = wc_AesGetKeySize(aes, &keySize);
-    if (ret != 0)
-        return ret;
-
-#ifdef FREESCALE_LTC_AES_GCM
-
-    status = LTC_AES_EncryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
-        authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
-
-    ret = (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
-
-#else
-
-#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || defined(WOLFSSL_STM32F7))
-
-    /* additional argument checks - STM32 HW only supports 12 byte IV */
-    if (ivSz != NONCE_SZ) {
-        return BAD_FUNC_ARG;
-    }
-
-    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
-    XMEMCPY(initialCounter, iv, ivSz);
-    initialCounter[AES_BLOCK_SIZE - 1] = STM32_GCM_IV_START;
-
-    /* STM32 HW AES-GCM requires / assumes inputs are a multiple of block size.
-     * We can avoid this by zero padding (authIn) AAD, but zero-padded plaintext
-     * will be encrypted and output incorrectly, causing a bad authTag.
-     * We will use HW accelerated AES-GCM if plain%AES_BLOCK_SZ==0.
-     * Otherwise, we will use accelerated AES_CTR for encrypt, and then
-     * perform GHASH in software.
-     * See NIST SP 800-38D */
-
-    /* Plain text is a multiple of block size, so use HW-Accelerated AES_GCM */
-    if (!partial) {
-        /* pad authIn if it is not a block multiple */
-        if ((authInSz % AES_BLOCK_SIZE) != 0) {
-            authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
-            /* Need to pad the AAD to a full block with zeros. */
-            authInPadded = XMALLOC(authPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-            if (authInPadded == NULL) {
-                return MEMORY_E;
-            }
-            XMEMSET(authInPadded, 0, authPadSz);
-            XMEMCPY(authInPadded, authIn, authInSz);
-        } else {
-            authPadSz = authInSz;
-            authInPadded = (byte*)authIn;
-        }
-
-
-    #ifdef WOLFSSL_STM32_CUBEMX
-        XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-        switch (keySize) {
-            case 16: /* 128-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-                break;
-            case 24: /* 192-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-                break;
-            case 32: /* 256-bit key */
-                hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-                break;
-            default:
-                break;
-        }
-        hcryp.Instance = CRYP;
-        hcryp.Init.DataType = CRYP_DATATYPE_8B;
-        hcryp.Init.pKey = (byte*)aes->key;
-        hcryp.Init.pInitVect = initialCounter;
-        hcryp.Init.Header = authInPadded;
-        hcryp.Init.HeaderSize = authInSz;
-
-        HAL_CRYP_Init(&hcryp);
-        status = HAL_CRYPEx_AESGCM_Encrypt(&hcryp, (byte*)in, sz,
-                                        out, STM32_HAL_TIMEOUT);
-        /* Compute the authTag */
-        if (status == HAL_OK)
-            status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, tag, STM32_HAL_TIMEOUT);
-
-        if (status != HAL_OK)
-            ret = AES_GCM_AUTH_E;
-        HAL_CRYP_DeInit(&hcryp);
-    #else
-        ByteReverseWords((word32*)keyCopy, (word32*)aes->key, keySize);
-        status = CRYP_AES_GCM(MODE_ENCRYPT, (uint8_t*)initialCounter,
-                             (uint8_t*)keyCopy,     keySize * 8,
-                             (uint8_t*)in,          sz,
-                             (uint8_t*)authInPadded,authInSz,
-                             (uint8_t*)out,         tag);
-        if (status != SUCCESS)
-            ret = AES_GCM_AUTH_E;
-    #endif /* WOLFSSL_STM32_CUBEMX */
-
-        /* authTag may be shorter than AES_BLOCK_SZ, store separately */
-        if (ret == 0)
-                XMEMCPY(authTag, tag, authTagSz);
-
-        /* We only allocate extra memory if authInPadded is not a multiple of AES_BLOCK_SZ */
-        if (authInPadded != NULL && authInSz != authPadSz) {
-            XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-        }
-
-        return ret;
-    }
-
+}
+
+#ifdef WOLF_CRYPTO_DEV
+    if (aes->devId != INVALID_DEVID) {
+        int ret = wc_CryptoDev_AesGcmEncrypt(aes, out, in, sz, iv, ivSz,
+            authTag, authTagSz, authIn, authInSz);
+        if (ret != NOT_COMPILED_IN)
+            return ret;
+        ret = 0; /* reset error code and try using software */
+    }
 #endif
 
-    /* Software AES-GCM */
+#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || \
+                              defined(WOLFSSL_STM32F7) || \
+                              defined(WOLFSSL_STM32L4))
+
+    /* STM32 HW only supports 12 byte IV and 16 byte auth */
+    if (ivSz == GCM_NONCE_MID_SZ && authInSz == AES_BLOCK_SIZE) {
+        return wc_AesGcmEncrypt_STM32(aes, out, in, sz, iv, ivSz,
+                                      authTag, authTagSz, authIn, authInSz);
+    }
+    #endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
     /* if async and byte count above threshold */
+    /* only 12-byte IV is supported in HW */
     if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
-                                                sz >= WC_ASYNC_THRESH_AES_GCM) {
+                    sz >= WC_ASYNC_THRESH_AES_GCM && ivSz == GCM_NONCE_MID_SZ) {
     #if defined(HAVE_CAVIUM)
-        /* Not yet supported, contact wolfSSL if interested in using */
+        #ifdef HAVE_CAVIUM_V
+        if (authInSz == 20) { /* Nitrox V GCM is only working with 20 byte AAD */
+            return NitroxAesGcmEncrypt(aes, out, in, sz,
+                (const byte*)aes->asyncKey, aes->keylen, iv, ivSz,
+                authTag, authTagSz, authIn, authInSz);
+        }
+            #endif
     #elif defined(HAVE_INTEL_QA)
         return IntelQaSymAesGcmEncrypt(&aes->asyncDev, out, in, sz,
@@ -6788 +8486 @@
             return WC_PENDING_E;
         }
+            #endif
+    }
+#endif /* WOLFSSL_ASYNC_CRYPT */
+
+#ifdef WOLFSSL_AESNI
+    #ifdef HAVE_INTEL_AVX2
+    if (IS_INTEL_AVX2(intel_flags)) {
+        AES_GCM_encrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (const byte*)aes->key, aes->rounds);
+        return 0;
+        }
+    else
+            #endif
+    #ifdef HAVE_INTEL_AVX1
+    if (IS_INTEL_AVX1(intel_flags)) {
+        AES_GCM_encrypt_avx1(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (const byte*)aes->key, aes->rounds);
+        return 0;
+        }
+    else
     #endif
-    }
-#endif /* WOLFSSL_ASYNC_CRYPT */
-
-#ifdef WOLFSSL_AESNI
     if (haveAESNI) {
-    #ifdef HAVE_INTEL_AVX2
-        if (IS_INTEL_AVX2(intel_flags)) {
-            AES_GCM_encrypt_avx2(in, out, authIn, iv, authTag,
-                        sz, authInSz, ivSz, (const byte*)aes->key, aes->rounds);
-        }
-        else
-    #endif
-            AES_GCM_encrypt(in, out, authIn, iv, authTag,
-                        sz, authInSz, ivSz, (const byte*)aes->key, aes->rounds);
+        AES_GCM_encrypt(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (const byte*)aes->key, aes->rounds);
         return 0;
     }
+    else
 #endif
-
-    ctr = counter;
-    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
-    if (ivSz == NONCE_SZ) {
-        XMEMCPY(initialCounter, iv, ivSz);
-        initialCounter[AES_BLOCK_SIZE - 1] = 1;
-    }
-    else {
-        GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE);
-    }
-    XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE);
-
-#ifdef WOLFSSL_PIC32MZ_CRYPT
-    if (blocks) {
-        /* use intitial IV for PIC32 HW, but don't use it below */
-        XMEMCPY(aes->reg, ctr, AES_BLOCK_SIZE);
-
-        ret = wc_Pic32AesCrypt(
-            aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
-            out, in, (blocks * AES_BLOCK_SIZE),
-            PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
-        if (ret != 0)
-            return ret;
-    }
-    /* process remainder using partial handling */
+    {
+        return AES_GCM_encrypt_C(aes, out, in, sz, iv, ivSz, authTag, authTagSz,
+                                                              authIn, authInSz);
+    }
+}
 #endif
-    while (blocks--) {
-        IncrementGcmCounter(ctr);
-    #ifndef WOLFSSL_PIC32MZ_CRYPT
-        wc_AesEncrypt(aes, ctr, scratch);
-        xorbuf(scratch, p, AES_BLOCK_SIZE);
-        XMEMCPY(c, scratch, AES_BLOCK_SIZE);
-    #endif
-        p += AES_BLOCK_SIZE;
-        c += AES_BLOCK_SIZE;
-    }
-
-    if (partial != 0) {
-        IncrementGcmCounter(ctr);
-        wc_AesEncrypt(aes, ctr, scratch);
-        xorbuf(scratch, p, partial);
-        XMEMCPY(c, scratch, partial);
-
-    }
-
-    GHASH(aes, authIn, authInSz, out, sz, authTag, authTagSz);
-    wc_AesEncrypt(aes, initialCounter, scratch);
-    xorbuf(authTag, scratch, authTagSz);
-
-#endif /* FREESCALE_LTC_AES_GCM */
-
-    return ret;
-}
-
-
+
+
+
+/* AES GCM Decrypt */
 #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT)
+#ifdef FREESCALE_LTC_AES_GCM
 int  wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
                    const byte* iv, word32 ivSz,
@@ -6867 +8531 @@
                    const byte* authIn, word32 authInSz)
 {
+    int ret;
+    word32 keySize;
+    status_t status;
+
+    /* argument checks */
+    /* If the sz is non-zero, both in and out must be set. If sz is 0,
+     * in and out are don't cares, as this is is the GMAC case. */
+    if (aes == NULL || iv == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
+        authTag == NULL || authTagSz > AES_BLOCK_SIZE || authTagSz == 0) {
+
+        return BAD_FUNC_ARG;
+    }
+
+    ret = wc_AesGetKeySize(aes, &keySize);
+    if (ret != 0) {
+        return ret;
+    }
+
+    status = LTC_AES_DecryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
+        authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
+
+    return (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
+}
+
+#else
+
+#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || \
+                              defined(WOLFSSL_STM32F7) || \
+                              defined(WOLFSSL_STM32L4))
+static WC_INLINE int wc_AesGcmDecrypt_STM32(Aes* aes, byte* out,
+                    const byte* in, word32 sz,
+                    const byte* iv, word32 ivSz,
+                    const byte* authTag, word32 authTagSz,
+                    const byte* authIn, word32 authInSz)
+{
+    int ret;
+#ifdef WOLFSSL_STM32_CUBEMX
+    CRYP_HandleTypeDef hcryp;
+#else
+    word32 keyCopy[AES_256_KEY_SIZE/sizeof(word32)];
+#endif
+    word32 keySize;
+    int status;
+    int outPadSz, authPadSz;
+    word32 tag[AES_BLOCK_SIZE/sizeof(word32)];
+    word32 initialCounter[AES_BLOCK_SIZE/sizeof(word32)];
+    byte* outPadded = NULL;
+    byte* authInPadded = NULL;
+
+    ret = wc_AesGetKeySize(aes, &keySize);
+    if (ret != 0)
+        return ret;
+
+#ifdef WOLFSSL_STM32_CUBEMX
+    ret = wc_Stm32_Aes_Init(aes, &hcryp);
+    if (ret != 0)
+        return ret;
+#endif
+
+    XMEMSET(initialCounter, 0, sizeof(initialCounter));
+    XMEMCPY(initialCounter, iv, ivSz);
+    *((byte*)initialCounter + (AES_BLOCK_SIZE - 1)) = STM32_GCM_IV_START;
+
+    /* Need to pad the AAD and input cipher text to a full block size since
+     * CRYP_AES_GCM will assume these are a multiple of AES_BLOCK_SIZE.
+     * It is okay to pad with zeros because GCM does this before GHASH already.
+     * See NIST SP 800-38D */
+    if ((sz % AES_BLOCK_SIZE) != 0 || sz == 0) {
+        outPadSz = ((sz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
+        outPadded = (byte*)XMALLOC(outPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (outPadded == NULL) {
+            return MEMORY_E;
+        }
+        XMEMSET(outPadded, 0, outPadSz);
+    }
+    else {
+        outPadSz = sz;
+        outPadded = out;
+    }
+    XMEMCPY(outPadded, in, sz);
+
+    if (authInSz == 0 || (authInSz % AES_BLOCK_SIZE) != 0) {
+            /* Need to pad the AAD to a full block with zeros. */
+        authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
+        authInPadded = (byte*)XMALLOC(authPadSz, aes->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+            if (authInPadded == NULL) {
+            if (outPadded != out) {
+                XFREE(outPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            }
+                return MEMORY_E;
+            }
+            XMEMSET(authInPadded, 0, authPadSz);
+            XMEMCPY(authInPadded, authIn, authInSz);
+        } else {
+            authPadSz = authInSz;
+            authInPadded = (byte*)authIn;
+        }
+
+    #ifdef WOLFSSL_STM32_CUBEMX
+    hcryp.Init.pInitVect = (uint8_t*)initialCounter;
+        hcryp.Init.Header = authInPadded;
+        hcryp.Init.HeaderSize = authInSz;
+
+#ifdef STM32_CRYPTO_AES_ONLY
+    /* Set the CRYP parameters */
+    hcryp.Init.ChainingMode  = CRYP_CHAINMODE_AES_GCM_GMAC;
+    hcryp.Init.OperatingMode = CRYP_ALGOMODE_DECRYPT;
+    hcryp.Init.GCMCMACPhase  = CRYP_INIT_PHASE;
+        HAL_CRYP_Init(&hcryp);
+
+    /* GCM init phase */
+    status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
+    if (status == HAL_OK) {
+        /* GCM header phase */
+        hcryp.Init.GCMCMACPhase = CRYP_HEADER_PHASE;
+        status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, 0, NULL, STM32_HAL_TIMEOUT);
+        if (status == HAL_OK) {
+            /* GCM payload phase */
+            hcryp.Init.GCMCMACPhase = CRYP_PAYLOAD_PHASE;
+            status = HAL_CRYPEx_AES_Auth(&hcryp, outPadded, sz, outPadded,
+                STM32_HAL_TIMEOUT);
+            if (status == HAL_OK) {
+                /* GCM final phase */
+                hcryp.Init.GCMCMACPhase = CRYP_FINAL_PHASE;
+                status = HAL_CRYPEx_AES_Auth(&hcryp, NULL, sz, (byte*)tag,
+                    STM32_HAL_TIMEOUT);
+            }
+        }
+    }
+#else
+    HAL_CRYP_Init(&hcryp);
+    /* Use outPadded for output buffer instead of out so that we don't overflow
+     * our size. */
+    status = HAL_CRYPEx_AESGCM_Decrypt(&hcryp, outPadded, sz, outPadded,
+        STM32_HAL_TIMEOUT);
+        /* Compute the authTag */
+    if (status == HAL_OK) {
+        status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, (byte*)tag,
+            STM32_HAL_TIMEOUT);
+    }
+#endif
+
+        if (status != HAL_OK)
+            ret = AES_GCM_AUTH_E;
+
+        HAL_CRYP_DeInit(&hcryp);
+
+#else /* STD_PERI_LIB */
+    ByteReverseWords(keyCopy, (word32*)aes->key, aes->keylen);
+
+    /* Input size and auth size need to be the actual sizes, even though
+     * they are not block aligned, because this length (in bits) is used
+     * in the final GHASH. Use outPadded for output buffer instead of
+     * out so that we don't overflow our size.                         */
+    status = CRYP_AES_GCM(MODE_DECRYPT, (uint8_t*)initialCounter,
+                             (uint8_t*)keyCopy,     keySize * 8,
+                         (uint8_t*)outPadded,   sz,
+                             (uint8_t*)authInPadded,authInSz,
+                         (uint8_t*)outPadded,   (byte*)tag);
+        if (status != SUCCESS)
+            ret = AES_GCM_AUTH_E;
+    #endif /* WOLFSSL_STM32_CUBEMX */
+
+    if (ConstantCompare(authTag, (byte*)tag, authTagSz) != 0) {
+        ret = AES_GCM_AUTH_E;
+        }
+
+    if (ret == 0) {
+        /* return output if allocated padded used */
+        if (outPadded != out) {
+            XMEMCPY(out, outPadded, sz);
+        }
+    }
+
+    /* Free memory if not a multiple of AES_BLOCK_SZ */
+    if (outPadded != out) {
+        XFREE(outPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+    if (authInPadded != authIn) {
+        XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    return ret;
+    }
+#endif /* STM32 */
+
+#ifdef WOLFSSL_AESNI
+int AES_GCM_decrypt_C(Aes* aes, byte* out, const byte* in, word32 sz,
+                      const byte* iv, word32 ivSz,
+                      const byte* authTag, word32 authTagSz,
+                      const byte* authIn, word32 authInSz);
+#else
+static
+#endif
+int AES_GCM_decrypt_C(Aes* aes, byte* out, const byte* in, word32 sz,
+                      const byte* iv, word32 ivSz,
+                      const byte* authTag, word32 authTagSz,
+                      const byte* authIn, word32 authInSz)
+{
     int ret = 0;
-    word32 keySize;
-#ifdef FREESCALE_LTC_AES_GCM
-    status_t status;
-#elif defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || defined(WOLFSSL_STM32F7))
-    #ifdef WOLFSSL_STM32_CUBEMX
-        CRYP_HandleTypeDef hcryp;
-    #else
-        byte keyCopy[AES_BLOCK_SIZE * 2];
-    #endif /* WOLFSSL_STM32_CUBEMX */
-    int  status;
-    int  inPadSz, authPadSz;
-    byte tag[AES_BLOCK_SIZE];
-    byte *inPadded = NULL;
-    byte *authInPadded = NULL;
-    byte initialCounter[AES_BLOCK_SIZE];
-#else /* software AES-GCM */
     word32 blocks = sz / AES_BLOCK_SIZE;
     word32 partial = sz % AES_BLOCK_SIZE;
@@ -6894 +8742 @@
     byte Tprime[AES_BLOCK_SIZE];
     byte EKY0[AES_BLOCK_SIZE];
+    ctr = counter;
+
+    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
+    if (ivSz == GCM_NONCE_MID_SZ) {
+        XMEMCPY(initialCounter, iv, ivSz);
+        initialCounter[AES_BLOCK_SIZE - 1] = 1;
+    }
+    else {
+        GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE);
+    }
+    XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE);
+
+    /* Calc the authTag again using the received auth data and the cipher text */
+    GHASH(aes, authIn, authInSz, in, sz, Tprime, sizeof(Tprime));
+    wc_AesEncrypt(aes, ctr, EKY0);
+    xorbuf(Tprime, EKY0, sizeof(Tprime));
+
+    if (ConstantCompare(authTag, Tprime, authTagSz) != 0) {
+        return AES_GCM_AUTH_E;
+    }
+
+#ifdef WOLFSSL_PIC32MZ_CRYPT
+    if (blocks) {
+        /* use initial IV for PIC32 HW, but don't use it below */
+        XMEMCPY(aes->reg, ctr, AES_BLOCK_SIZE);
+
+        ret = wc_Pic32AesCrypt(
+            aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
+            out, in, (blocks * AES_BLOCK_SIZE),
+            PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
+        if (ret != 0)
+            return ret;
+    }
+    /* process remainder using partial handling */
 #endif
 
+#if defined(HAVE_AES_ECB) && !defined(WOLFSSL_PIC32MZ_CRYPT)
+    /* some hardware acceleration can gain performance from doing AES encryption
+     * of the whole buffer at once */
+    if (c != p) { /* can not handle inline decryption */
+        while (blocks--) {
+            IncrementGcmCounter(ctr);
+            XMEMCPY(p, ctr, AES_BLOCK_SIZE);
+            p += AES_BLOCK_SIZE;
+        }
+
+        /* reset number of blocks and then do encryption */
+        blocks = sz / AES_BLOCK_SIZE;
+        wc_AesEcbEncrypt(aes, out, out, AES_BLOCK_SIZE * blocks);
+        xorbuf(out, c, AES_BLOCK_SIZE * blocks);
+        c += AES_BLOCK_SIZE * blocks;
+    }
+    else
+#endif /* HAVE_AES_ECB */
+    while (blocks--) {
+        IncrementGcmCounter(ctr);
+    #ifndef WOLFSSL_PIC32MZ_CRYPT
+        wc_AesEncrypt(aes, ctr, scratch);
+        xorbuf(scratch, c, AES_BLOCK_SIZE);
+        XMEMCPY(p, scratch, AES_BLOCK_SIZE);
+    #endif
+        p += AES_BLOCK_SIZE;
+        c += AES_BLOCK_SIZE;
+    }
+
+    if (partial != 0) {
+        IncrementGcmCounter(ctr);
+        wc_AesEncrypt(aes, ctr, scratch);
+        xorbuf(scratch, c, partial);
+        XMEMCPY(p, scratch, partial);
+    }
+
+    return ret;
+}
+
+/* Software AES - GCM Decrypt */
+int  wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
+                   const byte* iv, word32 ivSz,
+                   const byte* authTag, word32 authTagSz,
+                   const byte* authIn, word32 authInSz)
+{
+#ifdef WOLFSSL_AESNI
+    int res = AES_GCM_AUTH_E;
+#endif
+
     /* argument checks */
-    if (aes == NULL || out == NULL || in == NULL || iv == NULL ||
-        authTag == NULL || authTagSz > AES_BLOCK_SIZE) {
+    /* If the sz is non-zero, both in and out must be set. If sz is 0,
+     * in and out are don't cares, as this is is the GMAC case. */
+    if (aes == NULL || iv == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
+        authTag == NULL || authTagSz > AES_BLOCK_SIZE || authTagSz == 0) {
+
         return BAD_FUNC_ARG;
     }
 
-    ret = wc_AesGetKeySize(aes, &keySize);
-    if (ret != 0) {
-        return ret;
-    }
-
-#ifdef FREESCALE_LTC_AES_GCM
-
-    status = LTC_AES_DecryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz,
-        authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz);
-
-    ret = (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E;
-
-#elif defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || defined(WOLFSSL_STM32F7))
-
-    /* additional argument checks - STM32 HW only supports 12 byte IV */
-    if (ivSz != NONCE_SZ) {
-        return BAD_FUNC_ARG;
-    }
-
-    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
-    XMEMCPY(initialCounter, iv, ivSz);
-    initialCounter[AES_BLOCK_SIZE - 1] = STM32_GCM_IV_START;
-
-    /* Need to pad the AAD and input cipher text to a full block size since
-     * CRYP_AES_GCM will assume these are a multiple of AES_BLOCK_SIZE.
-     * It is okay to pad with zeros because GCM does this before GHASH already.
-     * See NIST SP 800-38D */
-
-    if ((sz % AES_BLOCK_SIZE) > 0) {
-        inPadSz = ((sz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
-        inPadded = XMALLOC(inPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-        if (inPadded == NULL) {
-            return MEMORY_E;
-        }
-        XMEMSET(inPadded, 0, inPadSz);
-        XMEMCPY(inPadded, in, sz);
-    } else {
-        inPadSz = sz;
-        inPadded = (byte*)in;
-    }
-
-    if ((authInSz % AES_BLOCK_SIZE) > 0) {
-        authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
-        authInPadded = XMALLOC(authPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-        if (authInPadded == NULL) {
-            if (inPadded != NULL && inPadSz != sz)
-                XFREE(inPadded , aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-            return MEMORY_E;
-        }
-        XMEMSET(authInPadded, 0, authPadSz);
-        XMEMCPY(authInPadded, authIn, authInSz);
-    } else {
-        authPadSz = authInSz;
-        authInPadded = (byte*)authIn;
-    }
-
-#ifdef WOLFSSL_STM32_CUBEMX
-    XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef));
-    switch(keySize) {
-        case 16: /* 128-bit key */
-            hcryp.Init.KeySize = CRYP_KEYSIZE_128B;
-            break;
-        case 24: /* 192-bit key */
-            hcryp.Init.KeySize = CRYP_KEYSIZE_192B;
-            break;
-        case 32: /* 256-bit key */
-            hcryp.Init.KeySize = CRYP_KEYSIZE_256B;
-            break;
-        default:
-            break;
-    }
-    hcryp.Instance = CRYP;
-    hcryp.Init.DataType = CRYP_DATATYPE_8B;
-    hcryp.Init.pKey = (byte*)aes->key;
-    hcryp.Init.pInitVect = initialCounter;
-    hcryp.Init.Header = authInPadded;
-    hcryp.Init.HeaderSize = authInSz;
-
-    HAL_CRYP_Init(&hcryp);
-    /* Use inPadded for output buffer instead of
-    * out so that we don't overflow our size. */
-    status = HAL_CRYPEx_AESGCM_Decrypt(&hcryp, (byte*)inPadded,
-                                    sz, inPadded, STM32_HAL_TIMEOUT);
-    /* Compute the authTag */
-    if (status == HAL_OK)
-        status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, tag, STM32_HAL_TIMEOUT);
-
-    if (status != HAL_OK)
-        ret = AES_GCM_AUTH_E;
-
-    HAL_CRYP_DeInit(&hcryp);
-#else
-    ByteReverseWords((word32*)keyCopy, (word32*)aes->key, keySize);
-
-    /* Input size and auth size need to be the actual sizes, even though
-     * they are not block aligned, because this length (in bits) is used
-     * in the final GHASH. Use inPadded for output buffer instead of
-     * out so that we don't overflow our size.                         */
-    status = CRYP_AES_GCM(MODE_DECRYPT, (uint8_t*)initialCounter,
-                         (uint8_t*)keyCopy,     keySize * 8,
-                         (uint8_t*)inPadded,    sz,
-                         (uint8_t*)authInPadded,authInSz,
-                         (uint8_t*)inPadded,    tag);
-    if (status != SUCCESS)
-        ret = AES_GCM_AUTH_E;
-#endif /* WOLFSSL_STM32_CUBEMX */
-
-    if (ret == 0 && ConstantCompare(authTag, tag, authTagSz) == 0) {
-        /* Only keep the decrypted data if authTag success. */
-        XMEMCPY(out, inPadded, sz);
-        ret = 0; /* success */
-    }
-
-    /* only allocate padding buffers if the inputs are not a multiple of block sz */
-    if (inPadded != NULL && inPadSz != sz)
-        XFREE(inPadded , aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-    if (authInPadded != NULL && authPadSz != authInSz)
-        XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER);
-
-#else
-
-    /* software AES GCM */
+#ifdef WOLF_CRYPTO_DEV
+    if (aes->devId != INVALID_DEVID) {
+        int ret = wc_CryptoDev_AesGcmDecrypt(aes, out, in, sz, iv, ivSz,
+            authTag, authTagSz, authIn, authInSz);
+        if (ret != NOT_COMPILED_IN)
+            return ret;
+    }
+#endif
+
+#if defined(STM32_CRYPTO) && (defined(WOLFSSL_STM32F4) || \
+                              defined(WOLFSSL_STM32F7) || \
+                              defined(WOLFSSL_STM32L4))
+
+    /* STM32 HW only supports 12 byte IV and 16 byte auth */
+    if (ivSz == GCM_NONCE_MID_SZ && authInSz == AES_BLOCK_SIZE) {
+        return wc_AesGcmDecrypt_STM32(aes, out, in, sz, iv, ivSz,
+                                      authTag, authTagSz, authIn, authInSz);
+    }
+#endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
     /* if async and byte count above threshold */
+    /* only 12-byte IV is supported in HW */
     if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES &&
-                                                sz >= WC_ASYNC_THRESH_AES_GCM) {
+                    sz >= WC_ASYNC_THRESH_AES_GCM && ivSz == GCM_NONCE_MID_SZ) {
     #if defined(HAVE_CAVIUM)
-        /* Not yet supported, contact wolfSSL if interested in using */
+        #ifdef HAVE_CAVIUM_V
+        if (authInSz == 20) { /* Nitrox V GCM is only working with 20 byte AAD */
+            return NitroxAesGcmDecrypt(aes, out, in, sz,
+                (const byte*)aes->asyncKey, aes->keylen, iv, ivSz,
+                authTag, authTagSz, authIn, authInSz);
+        }
+        #endif
     #elif defined(HAVE_INTEL_QA)
         return IntelQaSymAesGcmDecrypt(&aes->asyncDev, out, in, sz,
@@ -7055 +8893 @@
 
 #ifdef WOLFSSL_AESNI
-    if (haveAESNI) {
     #ifdef HAVE_INTEL_AVX2
         if (IS_INTEL_AVX2(intel_flags)) {
-            if (AES_GCM_decrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz,
-                                       ivSz, (byte*)aes->key, aes->rounds) == 0)
+        AES_GCM_decrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (byte*)aes->key, aes->rounds, &res);
+        if (res == 0)
             return AES_GCM_AUTH_E;
+        return 0;
+    }
+    else
+    #endif
+    #ifdef HAVE_INTEL_AVX1
+    if (IS_INTEL_AVX1(intel_flags)) {
+        AES_GCM_decrypt_avx1(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (byte*)aes->key, aes->rounds, &res);
+        if (res == 0)
+            return AES_GCM_AUTH_E;
+        return 0;
         }
         else
     #endif
-        if (AES_GCM_decrypt(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
-                                             (byte*)aes->key, aes->rounds) == 0)
+    if (haveAESNI) {
+        AES_GCM_decrypt(in, out, authIn, iv, authTag, sz, authInSz, ivSz,
+                                 authTagSz, (byte*)aes->key, aes->rounds, &res);
+        if (res == 0)
             return AES_GCM_AUTH_E;
         return 0;
     }
+    else
 #endif
-
-    ctr = counter;
-    XMEMSET(initialCounter, 0, AES_BLOCK_SIZE);
-    if (ivSz == NONCE_SZ) {
-        XMEMCPY(initialCounter, iv, ivSz);
-        initialCounter[AES_BLOCK_SIZE - 1] = 1;
-    }
-    else {
-        GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE);
-    }
-    XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE);
-
-    /* Calc the authTag again using the received auth data and the cipher text */
-    GHASH(aes, authIn, authInSz, in, sz, Tprime, sizeof(Tprime));
-    wc_AesEncrypt(aes, ctr, EKY0);
-    xorbuf(Tprime, EKY0, sizeof(Tprime));
-
-    if (ConstantCompare(authTag, Tprime, authTagSz) != 0) {
-        return AES_GCM_AUTH_E;
-    }
-
-#ifdef WOLFSSL_PIC32MZ_CRYPT
-    if (blocks) {
-        /* use intitial IV for PIC32 HW, but don't use it below */
-        XMEMCPY(aes->reg, ctr, AES_BLOCK_SIZE);
-
-        ret = wc_Pic32AesCrypt(
-            aes->key, aes->keylen, aes->reg, AES_BLOCK_SIZE,
-            out, in, (blocks * AES_BLOCK_SIZE),
-            PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM);
-        if (ret != 0)
-            return ret;
-    }
-    /* process remainder using partial handling */
+    {
+        return AES_GCM_decrypt_C(aes, out, in, sz, iv, ivSz, authTag, authTagSz,
+                                                              authIn, authInSz);
+    }
+}
 #endif
-
-    while (blocks--) {
-        IncrementGcmCounter(ctr);
-    #ifndef WOLFSSL_PIC32MZ_CRYPT
-        wc_AesEncrypt(aes, ctr, scratch);
-        xorbuf(scratch, c, AES_BLOCK_SIZE);
-        XMEMCPY(p, scratch, AES_BLOCK_SIZE);
-    #endif
-        p += AES_BLOCK_SIZE;
-        c += AES_BLOCK_SIZE;
-    }
-    if (partial != 0) {
-        IncrementGcmCounter(ctr);
-        wc_AesEncrypt(aes, ctr, scratch);
-        xorbuf(scratch, c, partial);
-        XMEMCPY(p, scratch, partial);
-    }
-
-#endif
+#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
+#endif /* WOLFSSL_XILINX_CRYPT */
+#endif /* end of block for AESGCM implementation selection */
+
+
+/* Common to all, abstract functions that build off of lower level AESGCM
+ * functions */
+#ifndef WC_NO_RNG
+
+int wc_AesGcmSetExtIV(Aes* aes, const byte* iv, word32 ivSz)
+{
+    int ret = 0;
+
+    if (aes == NULL || iv == NULL ||
+        (ivSz != GCM_NONCE_MIN_SZ && ivSz != GCM_NONCE_MID_SZ &&
+         ivSz != GCM_NONCE_MAX_SZ)) {
+
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        XMEMCPY((byte*)aes->reg, iv, ivSz);
+
+        /* If the IV is 96, allow for a 2^64 invocation counter.
+         * For any other size for the nonce, limit the invocation
+         * counter to 32-bits. (SP 800-38D 8.3) */
+        aes->invokeCtr[0] = 0;
+        aes->invokeCtr[1] = (ivSz == GCM_NONCE_MID_SZ) ? 0 : 0xFFFFFFFF;
+        aes->nonceSz = ivSz;
+    }
 
     return ret;
 }
 
-#endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
-#endif /* (WOLFSSL_XILINX_CRYPT) */
+
+int wc_AesGcmSetIV(Aes* aes, word32 ivSz,
+                   const byte* ivFixed, word32 ivFixedSz,
+                   WC_RNG* rng)
+{
+    int ret = 0;
+
+    if (aes == NULL || rng == NULL ||
+        (ivSz != GCM_NONCE_MIN_SZ && ivSz != GCM_NONCE_MID_SZ &&
+         ivSz != GCM_NONCE_MAX_SZ) ||
+        (ivFixed == NULL && ivFixedSz != 0) ||
+        (ivFixed != NULL && ivFixedSz != AES_IV_FIXED_SZ)) {
+
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        byte* iv = (byte*)aes->reg;
+
+        if (ivFixedSz)
+            XMEMCPY(iv, ivFixed, ivFixedSz);
+
+        ret = wc_RNG_GenerateBlock(rng, iv + ivFixedSz, ivSz - ivFixedSz);
+    }
+
+    if (ret == 0) {
+        /* If the IV is 96, allow for a 2^64 invocation counter.
+         * For any other size for the nonce, limit the invocation
+         * counter to 32-bits. (SP 800-38D 8.3) */
+        aes->invokeCtr[0] = 0;
+        aes->invokeCtr[1] = (ivSz == GCM_NONCE_MID_SZ) ? 0 : 0xFFFFFFFF;
+        aes->nonceSz = ivSz;
+    }
+
+            return ret;
+    }
+
+
+int wc_AesGcmEncrypt_ex(Aes* aes, byte* out, const byte* in, word32 sz,
+                        byte* ivOut, word32 ivOutSz,
+                        byte* authTag, word32 authTagSz,
+                        const byte* authIn, word32 authInSz)
+{
+    int ret = 0;
+
+    if (aes == NULL || (sz != 0 && (in == NULL || out == NULL)) ||
+        ivOut == NULL || ivOutSz != aes->nonceSz ||
+        (authIn == NULL && authInSz != 0)) {
+
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        aes->invokeCtr[0]++;
+        if (aes->invokeCtr[0] == 0) {
+            aes->invokeCtr[1]++;
+            if (aes->invokeCtr[1] == 0)
+                ret = AES_GCM_OVERFLOW_E;
+        }
+    }
+
+    if (ret == 0) {
+        XMEMCPY(ivOut, aes->reg, ivOutSz);
+        ret = wc_AesGcmEncrypt(aes, out, in, sz,
+                               (byte*)aes->reg, ivOutSz,
+                               authTag, authTagSz,
+                               authIn, authInSz);
+        IncCtr((byte*)aes->reg, ivOutSz);
+    }
+
+    return ret;
+}
+
+int wc_Gmac(const byte* key, word32 keySz, byte* iv, word32 ivSz,
+            const byte* authIn, word32 authInSz,
+            byte* authTag, word32 authTagSz, WC_RNG* rng)
+{
+    Aes aes;
+    int ret;
+
+    if (key == NULL || iv == NULL || (authIn == NULL && authInSz != 0) ||
+        authTag == NULL || authTagSz == 0 || rng == NULL) {
+
+        return BAD_FUNC_ARG;
+    }
+
+    ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
+    if (ret == 0) {
+        ret = wc_AesGcmSetKey(&aes, key, keySz);
+        if (ret == 0)
+            ret = wc_AesGcmSetIV(&aes, ivSz, NULL, 0, rng);
+        if (ret == 0)
+            ret = wc_AesGcmEncrypt_ex(&aes, NULL, NULL, 0, iv, ivSz,
+                                  authTag, authTagSz, authIn, authInSz);
+        wc_AesFree(&aes);
+    }
+    ForceZero(&aes, sizeof(aes));
+
+    return ret;
+}
+
+int wc_GmacVerify(const byte* key, word32 keySz,
+                  const byte* iv, word32 ivSz,
+                  const byte* authIn, word32 authInSz,
+                  const byte* authTag, word32 authTagSz)
+{
+    int ret;
+#ifndef NO_AES_DECRYPT
+    Aes aes;
+
+    if (key == NULL || iv == NULL || (authIn == NULL && authInSz != 0) ||
+        authTag == NULL || authTagSz == 0 || authTagSz > AES_BLOCK_SIZE) {
+
+        return BAD_FUNC_ARG;
+    }
+
+    ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
+    if (ret == 0) {
+        ret = wc_AesGcmSetKey(&aes, key, keySz);
+        if (ret == 0)
+            ret = wc_AesGcmDecrypt(&aes, NULL, NULL, 0, iv, ivSz,
+                                  authTag, authTagSz, authIn, authInSz);
+        wc_AesFree(&aes);
+    }
+    ForceZero(&aes, sizeof(aes));
+#else
+    (void)key;
+    (void)keySz;
+    (void)iv;
+    (void)ivSz;
+    (void)authIn;
+    (void)authInSz;
+    (void)authTag;
+    (void)authTagSz;
+    ret = NOT_COMPILED_IN;
+#endif
+    return ret;
+}
+
+#endif /* WC_NO_RNG */
+
 
 WOLFSSL_API int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len)
@@ -7155 +9128 @@
 int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz)
 {
+    if (!((keySz == 16) || (keySz == 24) || (keySz == 32)))
+        return BAD_FUNC_ARG;
+
     return wc_AesSetKey(aes, key, keySz, NULL, AES_ENCRYPTION);
 }
 
-#if defined(HAVE_COLDFIRE_SEC)
+#ifdef WOLFSSL_ARMASM
+    /* implementation located in wolfcrypt/src/port/arm/armv8-aes.c */
+
+#elif defined(HAVE_COLDFIRE_SEC)
     #error "Coldfire SEC doesn't currently support AES-CCM mode"
+
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+    /* implemented in wolfcrypt/src/port/caam_aes.c */
 
 #elif defined(FREESCALE_LTC)
@@ -7226 +9208 @@
 #endif /* HAVE_AES_DECRYPT */
 
-
-/* software AES CCM */
 #else
 
+/* Software CCM */
 static void roll_x(Aes* aes, const byte* in, word32 inSz, byte* out)
 {
@@ -7293 +9274 @@
 
 
-static INLINE void AesCcmCtrInc(byte* B, word32 lenSz)
+static WC_INLINE void AesCcmCtrInc(byte* B, word32 lenSz)
 {
     word32 i;
@@ -7302 +9283 @@
 }
 
+/* Software AES - CCM Encrypt */
 /* return 0 on success */
 int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
@@ -7317 +9299 @@
     /* sanity check on arguments */
     if (aes == NULL || out == NULL || in == NULL || nonce == NULL
-            || authTag == NULL || nonceSz < 7 || nonceSz > 13)
+            || authTag == NULL || nonceSz < 7 || nonceSz > 13 ||
+            authTagSz > AES_BLOCK_SIZE)
         return BAD_FUNC_ARG;
 
@@ -7369 +9352 @@
 
 #ifdef HAVE_AES_DECRYPT
+/* Software AES - CCM Decrypt */
 int  wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz,
                    const byte* nonce, word32 nonceSz,
@@ -7385 +9369 @@
     /* sanity check on arguments */
     if (aes == NULL || out == NULL || in == NULL || nonce == NULL
-            || authTag == NULL || nonceSz < 7 || nonceSz > 13)
+            || authTag == NULL || nonceSz < 7 || nonceSz > 13 ||
+            authTagSz > AES_BLOCK_SIZE)
         return BAD_FUNC_ARG;
 
@@ -7457 +9442 @@
     return result;
 }
+
 #endif /* HAVE_AES_DECRYPT */
-#endif /* software AES CCM */
+#endif /* software CCM */
+
+/* abstract functions that call lower level AESCCM functions */
+#ifndef WC_NO_RNG
+
+int wc_AesCcmSetNonce(Aes* aes, const byte* nonce, word32 nonceSz)
+{
+    int ret = 0;
+
+    if (aes == NULL || nonce == NULL ||
+        nonceSz < CCM_NONCE_MIN_SZ || nonceSz > CCM_NONCE_MAX_SZ) {
+
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        XMEMCPY(aes->reg, nonce, nonceSz);
+        aes->nonceSz = nonceSz;
+
+        /* Invocation counter should be 2^61 */
+        aes->invokeCtr[0] = 0;
+        aes->invokeCtr[1] = 0xE0000000;
+    }
+
+    return ret;
+}
+
+
+int wc_AesCcmEncrypt_ex(Aes* aes, byte* out, const byte* in, word32 sz,
+                        byte* ivOut, word32 ivOutSz,
+                        byte* authTag, word32 authTagSz,
+                        const byte* authIn, word32 authInSz)
+{
+    int ret = 0;
+
+    if (aes == NULL || out == NULL ||
+        (in == NULL && sz != 0) ||
+        ivOut == NULL ||
+        (authIn == NULL && authInSz != 0) ||
+        (ivOutSz != aes->nonceSz)) {
+
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        aes->invokeCtr[0]++;
+        if (aes->invokeCtr[0] == 0) {
+            aes->invokeCtr[1]++;
+            if (aes->invokeCtr[1] == 0)
+                ret = AES_CCM_OVERFLOW_E;
+        }
+    }
+
+    if (ret == 0) {
+        ret = wc_AesCcmEncrypt(aes, out, in, sz,
+                               (byte*)aes->reg, aes->nonceSz,
+                               authTag, authTagSz,
+                               authIn, authInSz);
+        XMEMCPY(ivOut, aes->reg, aes->nonceSz);
+        IncCtr((byte*)aes->reg, aes->nonceSz);
+    }
+
+    return ret;
+}
+
+#endif /* WC_NO_RNG */
 
 #endif /* HAVE_AESCCM */
@@ -7473 +9524 @@
     aes->heap = heap;
 
+#ifdef WOLF_CRYPTO_DEV
+    aes->devId = devId;
+#else
+    (void)devId;
+#endif
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)
     ret = wolfAsync_DevCtxInit(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES,
                                                         aes->heap, devId);
-#else
-    (void)devId;
 #endif /* WOLFSSL_ASYNC_CRYPT */
+
+#ifdef WOLFSSL_AFALG
+    aes->alFd = -1;
+    aes->rdFd = -1;
+#endif
+#if defined(WOLFSSL_DEVCRYPTO) && \
+   (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
+    aes->ctx.cfd = -1;
+#endif
 
     return ret;
 }
+
+#ifdef HAVE_PKCS11
+int  wc_AesInit_Id(Aes* aes, unsigned char* id, int len, void* heap, int devId)
+{
+    int ret = 0;
+
+    if (aes == NULL)
+        ret = BAD_FUNC_ARG;
+    if (ret == 0 && (len < 0 || len > AES_MAX_ID_LEN))
+        ret = BUFFER_E;
+
+    if (ret == 0)
+        ret  = wc_AesInit(aes, heap, devId);
+    if (ret == 0) {
+        XMEMCPY(aes->id, id, len);
+        aes->idLen = len;
+    }
+
+    return ret;
+}
+#endif
 
 /* Free Aes from use with async hardware */
@@ -7492 +9576 @@
     wolfAsync_DevCtxFree(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES);
 #endif /* WOLFSSL_ASYNC_CRYPT */
+#ifdef WOLFSSL_AFALG
+    if (aes->rdFd > 0) { /* negative is error case */
+        close(aes->rdFd);
+    }
+    if (aes->alFd > 0) {
+        close(aes->alFd);
+    }
+#endif /* WOLFSSL_AFALG */
+#if defined(WOLFSSL_DEVCRYPTO) && \
+    (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
+    wc_DevCryptoFree(&aes->ctx);
+    ForceZero((byte*)aes->devKey, AES_MAX_KEY_SIZE/WOLFSSL_BIT_SIZE);
+#endif
 }
 
@@ -7504 +9601 @@
 
     switch (aes->rounds) {
+#ifdef WOLFSSL_AES_128
     case 10:
         *keySize = 16;
         break;
+#endif
+#ifdef WOLFSSL_AES_192
     case 12:
         *keySize = 24;
         break;
+#endif
+#ifdef WOLFSSL_AES_256
     case 14:
         *keySize = 32;
         break;
+#endif
     default:
         *keySize = 0;
@@ -7521 +9624 @@
 }
 
-#endif /* !WOLFSSL_ARMASM */
 #endif /* !WOLFSSL_TI_CRYPT */
 
+#ifdef HAVE_AES_ECB
+#if defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_AES)
+    /* implemented in wolfcrypt/src/port/caam/caam_aes.c */
+
+#elif defined(WOLFSSL_AFALG)
+    /* implemented in wolfcrypt/src/port/af_alg/afalg_aes.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_AES)
+    /* implemented in wolfcrypt/src/port/devcrypt/devcrypto_aes.c */
+
+#else
+
+/* Software AES - ECB */
+int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    word32 blocks = sz / AES_BLOCK_SIZE;
+
+    if ((in == NULL) || (out == NULL) || (aes == NULL))
+      return BAD_FUNC_ARG;
+    while (blocks>0) {
+      wc_AesEncryptDirect(aes, out, in);
+      out += AES_BLOCK_SIZE;
+      in  += AES_BLOCK_SIZE;
+      sz  -= AES_BLOCK_SIZE;
+      blocks--;
+    }
+    return 0;
+}
+
+
+int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    word32 blocks = sz / AES_BLOCK_SIZE;
+
+    if ((in == NULL) || (out == NULL) || (aes == NULL))
+      return BAD_FUNC_ARG;
+    while (blocks>0) {
+      wc_AesDecryptDirect(aes, out, in);
+      out += AES_BLOCK_SIZE;
+      in  += AES_BLOCK_SIZE;
+      sz  -= AES_BLOCK_SIZE;
+      blocks--;
+    }
+    return 0;
+}
+#endif
+#endif /* HAVE_AES_ECB */
+
+#ifdef WOLFSSL_AES_CFB
+/* CFB 128
+ *
+ * aes structure holding key to use for encryption
+ * out buffer to hold result of encryption (must be at least as large as input
+ *     buffer)
+ * in  buffer to encrypt
+ * sz  size of input buffer
+ *
+ * returns 0 on success and negative error values on failure
+ */
+/* Software AES - CFB Encrypt */
+int wc_AesCfbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    byte*  tmp = NULL;
+    byte*  reg = NULL;
+
+    WOLFSSL_ENTER("wc_AesCfbEncrypt");
+
+    if (aes == NULL || out == NULL || in == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (aes->left && sz) {
+        reg = (byte*)aes->reg + AES_BLOCK_SIZE - aes->left;
+    }
+
+    /* consume any unused bytes left in aes->tmp */
+    tmp = (byte*)aes->tmp + AES_BLOCK_SIZE - aes->left;
+    while (aes->left && sz) {
+        *(out++) = *(reg++) = *(in++) ^ *(tmp++);
+        aes->left--;
+        sz--;
+    }
+
+    while (sz >= AES_BLOCK_SIZE) {
+        wc_AesEncryptDirect(aes, out, (byte*)aes->reg);
+        xorbuf(out, in, AES_BLOCK_SIZE);
+        XMEMCPY(aes->reg, out, AES_BLOCK_SIZE);
+        out += AES_BLOCK_SIZE;
+        in  += AES_BLOCK_SIZE;
+        sz  -= AES_BLOCK_SIZE;
+        aes->left = 0;
+    }
+
+    /* encrypt left over data */
+    if (sz) {
+        wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
+        aes->left = AES_BLOCK_SIZE;
+        tmp = (byte*)aes->tmp;
+        reg = (byte*)aes->reg;
+
+        while (sz--) {
+            *(out++) = *(reg++) = *(in++) ^ *(tmp++);
+            aes->left--;
+        }
+    }
+
+    return 0;
+}
+
+
+#ifdef HAVE_AES_DECRYPT
+/* CFB 128
+ *
+ * aes structure holding key to use for decryption
+ * out buffer to hold result of decryption (must be at least as large as input
+ *     buffer)
+ * in  buffer to decrypt
+ * sz  size of input buffer
+ *
+ * returns 0 on success and negative error values on failure
+ */
+/* Software AES - CFB Decrypt */
+int wc_AesCfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    byte*  tmp;
+
+    WOLFSSL_ENTER("wc_AesCfbDecrypt");
+
+    if (aes == NULL || out == NULL || in == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* check if more input needs copied over to aes->reg */
+    if (aes->left && sz) {
+        int size = min(aes->left, sz);
+        XMEMCPY((byte*)aes->reg + AES_BLOCK_SIZE - aes->left, in, size);
+    }
+
+    /* consume any unused bytes left in aes->tmp */
+    tmp = (byte*)aes->tmp + AES_BLOCK_SIZE - aes->left;
+    while (aes->left && sz) {
+        *(out++) = *(in++) ^ *(tmp++);
+        aes->left--;
+        sz--;
+    }
+
+    while (sz > AES_BLOCK_SIZE) {
+        wc_AesEncryptDirect(aes, out, (byte*)aes->reg);
+        xorbuf(out, in, AES_BLOCK_SIZE);
+        XMEMCPY(aes->reg, in, AES_BLOCK_SIZE);
+        out += AES_BLOCK_SIZE;
+        in  += AES_BLOCK_SIZE;
+        sz  -= AES_BLOCK_SIZE;
+        aes->left = 0;
+    }
+
+    /* decrypt left over data */
+    if (sz) {
+        wc_AesEncryptDirect(aes, (byte*)aes->tmp, (byte*)aes->reg);
+        XMEMCPY(aes->reg, in, sz);
+        aes->left = AES_BLOCK_SIZE;
+        tmp = (byte*)aes->tmp;
+
+        while (sz--) {
+            *(out++) = *(in++) ^ *(tmp++);
+            aes->left--;
+        }
+    }
+
+    return 0;
+}
+#endif /* HAVE_AES_DECRYPT */
+#endif /* WOLFSSL_AES_CFB */
+
 
 #ifdef HAVE_AES_KEYWRAP
 
 /* Initialize key wrap counter with value */
-static INLINE void InitKeyWrapCounter(byte* inOutCtr, word32 value)
+static WC_INLINE void InitKeyWrapCounter(byte* inOutCtr, word32 value)
 {
     int i;
@@ -7541 +9817 @@
 
 /* Increment key wrap counter */
-static INLINE void IncrementKeyWrapCounter(byte* inOutCtr)
+static WC_INLINE void IncrementKeyWrapCounter(byte* inOutCtr)
 {
     int i;
@@ -7553 +9829 @@
 
 /* Decrement key wrap counter */
-static INLINE void DecrementKeyWrapCounter(byte* inOutCtr)
+static WC_INLINE void DecrementKeyWrapCounter(byte* inOutCtr)
 {
     int i;
@@ -7836 +10112 @@
 }
 
+#ifdef HAVE_AES_ECB
+/* helper function for encrypting / decrypting full buffer at once */
+static int _AesXtsHelper(Aes* aes, byte* out, const byte* in, word32 sz, int dir)
+{
+    word32 outSz   = sz;
+    word32 totalSz = (sz / AES_BLOCK_SIZE) * AES_BLOCK_SIZE; /* total bytes */
+    byte*  pt      = out;
+
+    outSz -= AES_BLOCK_SIZE;
+
+    while (outSz > 0) {
+        word32 j;
+        byte carry = 0;
+
+        /* multiply by shift left and propagate carry */
+        for (j = 0; j < AES_BLOCK_SIZE && outSz > 0; j++, outSz--) {
+            byte tmpC;
+
+            tmpC   = (pt[j] >> 7) & 0x01;
+            pt[j+AES_BLOCK_SIZE] = ((pt[j] << 1) + carry) & 0xFF;
+            carry  = tmpC;
+        }
+        if (carry) {
+            pt[AES_BLOCK_SIZE] ^= GF_XTS;
+        }
+
+        pt += AES_BLOCK_SIZE;
+    }
+
+    xorbuf(out, in, totalSz);
+    if (dir == AES_ENCRYPTION) {
+        return wc_AesEcbEncrypt(aes, out, out, totalSz);
+    }
+    else {
+        return wc_AesEcbDecrypt(aes, out, out, totalSz);
+    }
+}
+#endif /* HAVE_AES_ECB */
+
 
 /* AES with XTS mode. (XTS) XEX encryption with Tweak and cipher text Stealing.
@@ -7849 +10164 @@
  * returns 0 on success
  */
+/* Software AES - XTS Encrypt  */
 int wc_AesXtsEncrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
         const byte* i, word32 iSz)
@@ -7856 +10172 @@
     Aes *aes, *tweak;
 
-    if (xaes == NULL || out == NULL) {
+    if (xaes == NULL || out == NULL || in == NULL) {
         return BAD_FUNC_ARG;
     }
@@ -7867 +10183 @@
     }
 
-    if (in == NULL && sz > 0) {
-        return BAD_FUNC_ARG;
-    }
-
     if (blocks > 0) {
         byte tmp[AES_BLOCK_SIZE];
 
+        XMEMSET(tmp, 0, AES_BLOCK_SIZE); /* set to 0's in case of improper AES
+                                          * key setup passed to encrypt direct*/
+
         wc_AesEncryptDirect(tweak, tmp, i);
+
+    #ifdef HAVE_AES_ECB
+        /* encrypt all of buffer at once when possible */
+        if (in != out) { /* can not handle inline */
+            XMEMCPY(out, tmp, AES_BLOCK_SIZE);
+            if ((ret = _AesXtsHelper(aes, out, in, sz, AES_ENCRYPTION)) != 0) {
+                return ret;
+            }
+        }
+    #endif
 
         while (blocks > 0) {
@@ -7881 +10206 @@
             byte buf[AES_BLOCK_SIZE];
 
+    #ifdef HAVE_AES_ECB
+            if (in == out) { /* check for if inline */
+    #endif
             XMEMCPY(buf, in, AES_BLOCK_SIZE);
             xorbuf(buf, tmp, AES_BLOCK_SIZE);
             wc_AesEncryptDirect(aes, out, buf);
+    #ifdef HAVE_AES_ECB
+            }
+    #endif
             xorbuf(out, tmp, AES_BLOCK_SIZE);
 
-            /* multiply by shift left and propogate carry */
+            /* multiply by shift left and propagate carry */
             for (j = 0; j < AES_BLOCK_SIZE; j++) {
                 byte tmpC;
@@ -7897 +10228 @@
                 tmp[0] ^= GF_XTS;
             }
-            carry = 0;
 
             in  += AES_BLOCK_SIZE;
@@ -7942 +10272 @@
  * returns 0 on success
  */
+/* Software AES - XTS Decrypt */
 int wc_AesXtsDecrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
         const byte* i, word32 iSz)
@@ -7949 +10280 @@
     Aes *aes, *tweak;
 
-    if (xaes == NULL || out == NULL) {
+    if (xaes == NULL || out == NULL || in == NULL) {
         return BAD_FUNC_ARG;
     }
@@ -7957 +10288 @@
 
     if (iSz < AES_BLOCK_SIZE) {
-        return BAD_FUNC_ARG;
-    }
-
-    if (in == NULL && sz > 0) {
         return BAD_FUNC_ARG;
     }
@@ -7970 +10297 @@
         byte stl = (sz % AES_BLOCK_SIZE);
 
+        XMEMSET(tmp, 0, AES_BLOCK_SIZE); /* set to 0's in case of improper AES
+                                          * key setup passed to decrypt direct*/
+
         wc_AesEncryptDirect(tweak, tmp, i);
 
@@ -7978 +10308 @@
         }
 
+    #ifdef HAVE_AES_ECB
+        /* decrypt all of buffer at once when possible */
+        if (in != out) { /* can not handle inline */
+            XMEMCPY(out, tmp, AES_BLOCK_SIZE);
+            if ((ret = _AesXtsHelper(aes, out, in, sz, AES_DECRYPTION)) != 0) {
+                return ret;
+            }
+        }
+    #endif
+
         while (blocks > 0) {
             byte buf[AES_BLOCK_SIZE];
 
+    #ifdef HAVE_AES_ECB
+            if (in == out) { /* check for if inline */
+    #endif
             XMEMCPY(buf, in, AES_BLOCK_SIZE);
             xorbuf(buf, tmp, AES_BLOCK_SIZE);
             wc_AesDecryptDirect(aes, out, buf);
+    #ifdef HAVE_AES_ECB
+            }
+    #endif
             xorbuf(out, tmp, AES_BLOCK_SIZE);
 
-            /* multiply by shift left and propogate carry */
+            /* multiply by shift left and propagate carry */
             for (j = 0; j < AES_BLOCK_SIZE; j++) {
                 byte tmpC;
@@ -8010 +10356 @@
             byte tmp2[AES_BLOCK_SIZE];
 
-            /* multiply by shift left and propogate carry */
+            /* multiply by shift left and propagate carry */
             for (j = 0; j < AES_BLOCK_SIZE; j++) {
                 byte tmpC;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/arc4.c

@@ -71 +71 @@
 
 
-static INLINE byte MakeByte(word32* x, word32* y, byte* s)
+static WC_INLINE byte MakeByte(word32* x, word32* y, byte* s)
 {
     word32 a = s[*x], b;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/asn.c

@@ -35 +35 @@
  * RSA_DECODE_EXTRA: Decodes extra information in RSA public key.
  * WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName.
+ * WOLFSSL_NO_ASN_STRICT: Disable strict RFC compliance checks to
+    restore 3.13.0 behavior.
  * WOLFSSL_NO_OCSP_OPTIONAL_CERTS: Skip optional OCSP certs (responder issuer
     must still be trusted)
@@ -45 +47 @@
  * WOLFSSL_ALT_CERT_CHAINS: Allows matching multiple CA's to validate
     chain based on issuer and public key (includes signature confirmation)
+ * WOLFSSL_SMALL_CERT_VERIFY: Verify the certificate signature without using
+    DecodedCert. Doubles up on some code but allows smaller dynamic memory
+    usage.
 */
 
 #ifndef NO_ASN
-
-#ifdef HAVE_RTP_SYS
-    #include "os.h"           /* dc_rtc_api needs    */
-    #include "dc_rtc_api.h"   /* to get current time */
-#endif
 
 #include <wolfssl/wolfcrypt/asn.h>
@@ -61 +61 @@
 #include <wolfssl/wolfcrypt/pwdbased.h>
 #include <wolfssl/wolfcrypt/des3.h>
+#include <wolfssl/wolfcrypt/aes.h>
+#include <wolfssl/wolfcrypt/wc_encrypt.h>
 #include <wolfssl/wolfcrypt/logging.h>
 
@@ -72 +74 @@
 #endif
 
+#ifndef NO_PWDBASED
+    #include <wolfssl/wolfcrypt/aes.h>
+#endif
 #ifndef NO_RC4
     #include <wolfssl/wolfcrypt/arc4.h>
@@ -112 +117 @@
 #endif
 
+
 #ifdef _MSC_VER
     /* 4996 warning to use MS extensions e.g., strcpy_s instead of XSTRNCPY */
@@ -119 +125 @@
 #define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
 
-#ifndef NO_ASN_TIME
-#if defined(USER_TIME)
-    /* Use our gmtime and time_t/struct tm types.
-       Only needs seconds since EPOCH using XTIME function.
-       time_t XTIME(time_t * timer) {}
-    */
-    #define WOLFSSL_GMTIME
-    #define USE_WOLF_TM
-    #define USE_WOLF_TIME_T
-
-#elif defined(TIME_OVERRIDES)
-    /* Override XTIME() and XGMTIME() functionality.
-       Requires user to provide these functions:
-        time_t XTIME(time_t * timer) {}
-        struct tm* XGMTIME(const time_t* timer, struct tm* tmp) {}
-    */
-    #ifndef HAVE_TIME_T_TYPE
-        #define USE_WOLF_TIME_T
-    #endif
-    #ifndef HAVE_TM_TYPE
-        #define USE_WOLF_TM
-    #endif
-    #define NEED_TMP_TIME
-
-#elif defined(HAVE_RTP_SYS)
-    /* uses parital <time.h> structures */
-    #define XTIME(tl)       (0)
-    #define XGMTIME(c, t)   rtpsys_gmtime((c))
-
-#elif defined(MICRIUM)
-    #include <clk.h>
-    #include <time.h>
-    #define XTIME(t1)       micrium_time((t1))
-    #define WOLFSSL_GMTIME
-
-#elif defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
-    #include <time.h>
-    #define XTIME(t1)       pic32_time((t1))
-    #define XGMTIME(c, t)   gmtime((c))
-
-#elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
-    #define XTIME(t1)       mqx_time((t1))
-    #define HAVE_GMTIME_R
-
-#elif defined(FREESCALE_KSDK_BM) || defined(FREESCALE_FREE_RTOS) || \
-        defined(FREESCALE_KSDK_FREERTOS)
-    #include <time.h>
-    #ifndef XTIME
-        /*extern time_t ksdk_time(time_t* timer);*/
-        #define XTIME(t1)   ksdk_time((t1))
-    #endif
-    #define XGMTIME(c, t)   gmtime((c))
-
-#elif defined(WOLFSSL_ATMEL)
-    #define XTIME(t1)       atmel_get_curr_time_and_date((t1))
-    #define WOLFSSL_GMTIME
-    #define USE_WOLF_TM
-    #define USE_WOLF_TIME_T
-
-#elif defined(IDIRECT_DEV_TIME)
-    /*Gets the timestamp from cloak software owned by VT iDirect
-    in place of time() from <time.h> */
-    #include <time.h>
-    #define XTIME(t1)       idirect_time((t1))
-    #define XGMTIME(c, t)   gmtime((c))
-
-#elif defined(_WIN32_WCE)
-    #include <windows.h>
-    #define XTIME(t1)       windows_time((t1))
-    #define WOLFSSL_GMTIME
-#else
-
-    /* default */
-    /* uses complete <time.h> facility */
-    #include <time.h>
-#endif
-
-
-/* Map default time functions */
-#if !defined(XTIME) && !defined(TIME_OVERRIDES) && !defined(USER_TIME)
-    #define XTIME(tl)       time((tl))
-#endif
-#if !defined(XGMTIME) && !defined(TIME_OVERRIDES)
-    #if defined(WOLFSSL_GMTIME) || !defined(HAVE_GMTIME_R)
-        #define XGMTIME(c, t)   gmtime((c))
-    #else
-        #define XGMTIME(c, t)   gmtime_r((c), (t))
-        #define NEED_TMP_TIME
-    #endif
-#endif
-#if !defined(XVALIDATE_DATE) && !defined(HAVE_VALIDATE_DATE)
-    #define USE_WOLF_VALIDDATE
-    #define XVALIDATE_DATE(d, f, t) ValidateDate((d), (f), (t))
-#endif
-
-/* wolf struct tm and time_t */
-#if defined(USE_WOLF_TM)
-    struct tm {
-        int  tm_sec;     /* seconds after the minute [0-60] */
-        int  tm_min;     /* minutes after the hour [0-59] */
-        int  tm_hour;    /* hours since midnight [0-23] */
-        int  tm_mday;    /* day of the month [1-31] */
-        int  tm_mon;     /* months since January [0-11] */
-        int  tm_year;    /* years since 1900 */
-        int  tm_wday;    /* days since Sunday [0-6] */
-        int  tm_yday;    /* days since January 1 [0-365] */
-        int  tm_isdst;   /* Daylight Savings Time flag */
-        long tm_gmtoff;  /* offset from CUT in seconds */
-        char *tm_zone;   /* timezone abbreviation */
+#ifdef HAVE_SELFTEST
+    #ifndef WOLFSSL_AES_KEY_SIZE_ENUM
+    enum Asn_Misc {
+        AES_IV_SIZE         = 16,
+        AES_128_KEY_SIZE    = 16,
+        AES_192_KEY_SIZE    = 24,
+        AES_256_KEY_SIZE    = 32
     };
-#endif /* USE_WOLF_TM */
-#if defined(USE_WOLF_TIME_T)
-    typedef long time_t;
-#endif
-
-/* forward declarations */
-#if defined(USER_TIME)
-    struct tm* gmtime(const time_t* timer);
-    extern time_t XTIME(time_t * timer);
-
-    #ifdef STACK_TRAP
-        /* for stack trap tracking, don't call os gmtime on OS X/linux,
-           uses a lot of stack spce */
-        extern time_t time(time_t * timer);
-        #define XTIME(tl)  time((tl))
-    #endif /* STACK_TRAP */
-
-#elif defined(TIME_OVERRIDES)
-    extern time_t XTIME(time_t * timer);
-    extern struct tm* XGMTIME(const time_t* timer, struct tm* tmp);
-#elif defined(WOLFSSL_GMTIME)
-    struct tm* gmtime(const time_t* timer);
-#endif
-
-
-#if defined(_WIN32_WCE)
-time_t windows_time(time_t* timer)
-{
-    SYSTEMTIME     sysTime;
-    FILETIME       fTime;
-    ULARGE_INTEGER intTime;
-    time_t         localTime;
-
-    if (timer == NULL)
-        timer = &localTime;
-
-    GetSystemTime(&sysTime);
-    SystemTimeToFileTime(&sysTime, &fTime);
-
-    XMEMCPY(&intTime, &fTime, sizeof(FILETIME));
-    /* subtract EPOCH */
-    intTime.QuadPart -= 0x19db1ded53e8000;
-    /* to secs */
-    intTime.QuadPart /= 10000000;
-    *timer = (time_t)intTime.QuadPart;
-
-    return *timer;
-}
-#endif /*  _WIN32_WCE */
-
-#if defined(WOLFSSL_GMTIME)
-struct tm* gmtime(const time_t* timer)
-{
-    #define YEAR0          1900
-    #define EPOCH_YEAR     1970
-    #define SECS_DAY       (24L * 60L * 60L)
-    #define LEAPYEAR(year) (!((year) % 4) && (((year) % 100) || !((year) %400)))
-    #define YEARSIZE(year) (LEAPYEAR(year) ? 366 : 365)
-
-    static const int _ytab[2][12] =
-    {
-        {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},
-        {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}
-    };
-
-    static struct tm st_time;
-    struct tm* ret = &st_time;
-    time_t secs = *timer;
-    unsigned long dayclock, dayno;
-    int year = EPOCH_YEAR;
-
-    dayclock = (unsigned long)secs % SECS_DAY;
-    dayno    = (unsigned long)secs / SECS_DAY;
-
-    ret->tm_sec  = (int) dayclock % 60;
-    ret->tm_min  = (int)(dayclock % 3600) / 60;
-    ret->tm_hour = (int) dayclock / 3600;
-    ret->tm_wday = (int) (dayno + 4) % 7;        /* day 0 a Thursday */
-
-    while(dayno >= (unsigned long)YEARSIZE(year)) {
-        dayno -= YEARSIZE(year);
-        year++;
-    }
-
-    ret->tm_year = year - YEAR0;
-    ret->tm_yday = (int)dayno;
-    ret->tm_mon  = 0;
-
-    while(dayno >= (unsigned long)_ytab[LEAPYEAR(year)][ret->tm_mon]) {
-        dayno -= _ytab[LEAPYEAR(year)][ret->tm_mon];
-        ret->tm_mon++;
-    }
-
-    ret->tm_mday  = (int)++dayno;
-    ret->tm_isdst = 0;
-
-    return ret;
-}
-#endif /* WOLFSSL_GMTIME */
-
-
-#if defined(HAVE_RTP_SYS)
-#define YEAR0          1900
-
-struct tm* rtpsys_gmtime(const time_t* timer)       /* has a gmtime() but hangs */
-{
-    static struct tm st_time;
-    struct tm* ret = &st_time;
-
-    DC_RTC_CALENDAR cal;
-    dc_rtc_time_get(&cal, TRUE);
-
-    ret->tm_year  = cal.year - YEAR0;       /* gm starts at 1900 */
-    ret->tm_mon   = cal.month - 1;          /* gm starts at 0 */
-    ret->tm_mday  = cal.day;
-    ret->tm_hour  = cal.hour;
-    ret->tm_min   = cal.minute;
-    ret->tm_sec   = cal.second;
-
-    return ret;
-}
-
-#endif /* HAVE_RTP_SYS */
-
-
-#if defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
-
-/*
- * time() is just a stub in Microchip libraries. We need our own
- * implementation. Use SNTP client to get seconds since epoch.
- */
-time_t pic32_time(time_t* timer)
-{
-#ifdef MICROCHIP_TCPIP_V5
-    DWORD sec = 0;
-#else
-    uint32_t sec = 0;
-#endif
-    time_t localTime;
-
-    if (timer == NULL)
-        timer = &localTime;
-
-#ifdef MICROCHIP_MPLAB_HARMONY
-    sec = TCPIP_SNTP_UTCSecondsGet();
-#else
-    sec = SNTPGetUTCSeconds();
-#endif
-    *timer = (time_t) sec;
-
-    return *timer;
-}
-
-#endif /* MICROCHIP_TCPIP || MICROCHIP_TCPIP_V5 */
-
-
-#if defined(MICRIUM)
-
-time_t micrium_time(time_t* timer)
-{
-    CLK_TS_SEC sec;
-
-    Clk_GetTS_Unix(&sec);
-
-    return (time_t) sec;
-}
-
-#endif /* MICRIUM */
-
-
-#if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
-
-time_t mqx_time(time_t* timer)
-{
-    time_t localTime;
-    TIME_STRUCT time_s;
-
-    if (timer == NULL)
-        timer = &localTime;
-
-    _time_get(&time_s);
-    *timer = (time_t) time_s.SECONDS;
-
-    return *timer;
-}
-
-#endif /* FREESCALE_MQX || FREESCALE_KSDK_MQX */
-
-
-#if defined(WOLFSSL_TIRTOS)
-
-time_t XTIME(time_t * timer)
-{
-    time_t sec = 0;
-
-    sec = (time_t) Seconds_get();
-
-    if (timer != NULL)
-        *timer = sec;
-
-    return sec;
-}
-
-#endif /* WOLFSSL_TIRTOS */
-
-
-#if defined(WOLFSSL_XILINX)
-#include "xrtcpsu.h"
-
-time_t XTIME(time_t * timer)
-{
-    time_t sec = 0;
-    XRtcPsu_Config* con;
-    XRtcPsu         rtc;
-
-    con = XRtcPsu_LookupConfig(XPAR_XRTCPSU_0_DEVICE_ID);
-    if (con != NULL) {
-        if (XRtcPsu_CfgInitialize(&rtc, con, con->BaseAddr) == XST_SUCCESS) {
-            sec = (time_t)XRtcPsu_GetCurrentTime(&rtc);
-        }
-        else {
-            WOLFSSL_MSG("Unable to initialize RTC");
-        }
-    }
-
-    if (timer != NULL)
-        *timer = sec;
-
-    return sec;
-}
-
-#endif /* WOLFSSL_TIRTOS */
-
-
-/* two byte date/time, add to value */
-static INLINE void GetTime(int* value, const byte* date, int* idx)
-{
-    int i = *idx;
-
-    *value += btoi(date[i++]) * 10;
-    *value += btoi(date[i++]);
-
-    *idx = i;
-}
-
-
-#if defined(IDIRECT_DEV_TIME)
-
-extern time_t getTimestamp();
-
-time_t idirect_time(time_t * timer)
-{
-    time_t sec = getTimestamp();
-
-    if (timer != NULL)
-        *timer = sec;
-
-    return sec;
-}
-
-#endif /* IDIRECT_DEV_TIME */
-
-#endif /* !NO_ASN_TIME */
-
+#endif
+#endif
 
 WOLFSSL_LOCAL int GetLength(const byte* input, word32* inOutIdx, int* len,
                            word32 maxIdx)
+{
+    return GetLength_ex(input, inOutIdx, len, maxIdx, 1);
+}
+
+
+/* give option to check length value found against index. 1 to check 0 to not */
+WOLFSSL_LOCAL int GetLength_ex(const byte* input, word32* inOutIdx, int* len,
+                           word32 maxIdx, int check)
 {
     int     length = 0;
@@ -525 +175 @@
         length = b;
 
-    if ((idx + length) > maxIdx) {   /* for user of length */
+    if (check && (idx + length) > maxIdx) {   /* for user of length */
         WOLFSSL_MSG("GetLength value exceeds buffer length");
         return BUFFER_E;
@@ -534 +184 @@
         *len = length;
 
+    return length;
+}
+
+
+static int GetASNHeader_ex(const byte* input, byte tag, word32* inOutIdx, int* len,
+                        word32 maxIdx, int check)
+{
+    word32 idx = *inOutIdx;
+    byte   b;
+    int    length;
+
+    if ((idx + 1) > maxIdx)
+        return BUFFER_E;
+
+    b = input[idx++];
+    if (b != tag)
+        return ASN_PARSE_E;
+
+    if (GetLength_ex(input, &idx, &length, maxIdx, check) < 0)
+        return ASN_PARSE_E;
+
+    *len      = length;
+    *inOutIdx = idx;
     return length;
 }
@@ -552 +225 @@
                         word32 maxIdx)
 {
-    word32 idx = *inOutIdx;
-    byte   b;
-    int    length;
-
-    if ((idx + 1) > maxIdx)
-        return BUFFER_E;
-
-    b = input[idx++];
-    if (b != tag)
-        return ASN_PARSE_E;
-
-    if (GetLength(input, &idx, &length, maxIdx) < 0)
-        return ASN_PARSE_E;
-
-    *len      = length;
-    *inOutIdx = idx;
-    return length;
-}
+    return GetASNHeader_ex(input, tag, inOutIdx, len, maxIdx, 1);
+}
+
 
 WOLFSSL_LOCAL int GetSequence(const byte* input, word32* inOutIdx, int* len,
@@ -576 +234 @@
     return GetASNHeader(input, ASN_SEQUENCE | ASN_CONSTRUCTED, inOutIdx, len,
                         maxIdx);
+}
+
+
+WOLFSSL_LOCAL int GetSequence_ex(const byte* input, word32* inOutIdx, int* len,
+                           word32 maxIdx, int check)
+{
+    return GetASNHeader_ex(input, ASN_SEQUENCE | ASN_CONSTRUCTED, inOutIdx, len,
+                        maxIdx, check);
 }
 
@@ -724 +390 @@
                 return ASN_PARSE_E;
         }
-        else if ((input[*inOutIdx] & 0x80) == 0x80)
-            return ASN_PARSE_E;
     }
 
@@ -759 +423 @@
 }
 
+
+#if !defined(NO_DSA) && !defined(NO_SHA)
+static char sigSha1wDsaName[] = "SHAwDSA";
+#endif /* NO_DSA */
+#ifndef NO_RSA
+#ifdef WOLFSSL_MD2
+    static char sigMd2wRsaName[] = "MD2wRSA";
+#endif
+#ifndef NO_MD5
+    static char sigMd5wRsaName[] = "MD5wRSA";
+#endif
+#ifndef NO_SHA
+    static char sigSha1wRsaName[] = "SHAwRSA";
+#endif
+#ifdef WOLFSSL_SHA224
+    static char sigSha224wRsaName[] = "SHA224wRSA";
+#endif
+#ifndef NO_SHA256
+    static char sigSha256wRsaName[] = "SHA256wRSA";
+#endif
+#ifdef WOLFSSL_SHA384
+    static char sigSha384wRsaName[] = "SHA384wRSA";
+#endif
+#ifdef WOLFSSL_SHA512
+    static char sigSha512wRsaName[] = "SHA512wRSA";
+#endif
+#endif /* NO_RSA */
+#ifdef HAVE_ECC
+#ifndef NO_SHA
+    static char sigSha1wEcdsaName[] = "SHAwECDSA";
+#endif
+#ifdef WOLFSSL_SHA224
+    static char sigSha224wEcdsaName[] = "SHA224wECDSA";
+#endif
+#ifndef NO_SHA256
+    static char sigSha256wEcdsaName[] = "SHA256wECDSA";
+#endif
+#ifdef WOLFSSL_SHA384
+    static char sigSha384wEcdsaName[] = "SHA384wECDSA";
+#endif
+#ifdef WOLFSSL_SHA512
+    static char sigSha512wEcdsaName[] = "SHA512wECDSA";
+#endif
+#endif /* HAVE_ECC */
+static char sigUnknownName[] = "Unknown";
+
+
+/* Get the human readable string for a signature type
+ *
+ * oid  Oid value for signature
+ */
+char* GetSigName(int oid) {
+    switch (oid) {
+    #if !defined(NO_DSA) && !defined(NO_SHA)
+        case CTC_SHAwDSA:
+            return sigSha1wDsaName;
+    #endif /* NO_DSA && NO_SHA */
+    #ifndef NO_RSA
+        #ifdef WOLFSSL_MD2
+        case CTC_MD2wRSA:
+            return sigMd2wRsaName;
+        #endif
+        #ifndef NO_MD5
+        case CTC_MD5wRSA:
+            return sigMd5wRsaName;
+        #endif
+        #ifndef NO_SHA
+        case CTC_SHAwRSA:
+            return sigSha1wRsaName;
+        #endif
+        #ifdef WOLFSSL_SHA224
+        case CTC_SHA224wRSA:
+            return sigSha224wRsaName;
+        #endif
+        #ifndef NO_SHA256
+        case CTC_SHA256wRSA:
+            return sigSha256wRsaName;
+        #endif
+        #ifdef WOLFSSL_SHA384
+        case CTC_SHA384wRSA:
+            return sigSha384wRsaName;
+        #endif
+        #ifdef WOLFSSL_SHA512
+        case CTC_SHA512wRSA:
+            return sigSha512wRsaName;
+        #endif
+    #endif /* NO_RSA */
+    #ifdef HAVE_ECC
+        #ifndef NO_SHA
+        case CTC_SHAwECDSA:
+            return sigSha1wEcdsaName;
+        #endif
+        #ifdef WOLFSSL_SHA224
+        case CTC_SHA224wECDSA:
+            return sigSha224wEcdsaName;
+        #endif
+        #ifndef NO_SHA256
+        case CTC_SHA256wECDSA:
+            return sigSha256wEcdsaName;
+        #endif
+        #ifdef WOLFSSL_SHA384
+        case CTC_SHA384wECDSA:
+            return sigSha384wEcdsaName;
+        #endif
+        #ifdef WOLFSSL_SHA512
+        case CTC_SHA512wECDSA:
+            return sigSha512wEcdsaName;
+        #endif
+    #endif /* HAVE_ECC */
+        default:
+            return sigUnknownName;
+    }
+}
+
+
 #if !defined(NO_DSA) || defined(HAVE_ECC) || \
    (!defined(NO_RSA) && \
         (defined(WOLFSSL_CERT_GEN) || \
-        (defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA))))
+        ((defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA)) && !defined(HAVE_USER_RSA))))
 /* Set the DER/BER encoding of the ASN.1 INTEGER header.
  *
@@ -786 +565 @@
 
 #if !defined(NO_DSA) || defined(HAVE_ECC) || defined(WOLFSSL_CERT_GEN) || \
-    (defined(WOLFSSL_KEY_GEN) && !defined(NO_RSA) && !defined(HAVE_USER_RSA))
+    ((defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA)) && !defined(NO_RSA) && !defined(HAVE_USER_RSA))
 /* Set the DER/BER encoding of the ASN.1 INTEGER element with an mp_int.
  * The number is assumed to be positive.
@@ -906 +685 @@
     return *number;
 }
+
+
+/* Set small integer, 32 bits or less. DER encoding with no leading 0s
+ * returns total amount written including ASN tag and length byte on success */
+static int SetShortInt(byte* input, word32* inOutIdx, word32 number,
+                              word32 maxIdx)
+{
+    word32 idx = *inOutIdx;
+    word32 len = 0;
+    int    i;
+    byte ar[MAX_LENGTH_SZ];
+
+    /* check for room for type and length bytes */
+    if ((idx + 2) > maxIdx)
+        return BUFFER_E;
+
+    input[idx++] = ASN_INTEGER;
+    idx++; /* place holder for length byte */
+    if (MAX_LENGTH_SZ + idx > maxIdx)
+        return ASN_PARSE_E;
+
+    /* find first non zero byte */
+    XMEMSET(ar, 0, MAX_LENGTH_SZ);
+    c32toa(number, ar);
+    for (i = 0; i < MAX_LENGTH_SZ; i++) {
+        if (ar[i] != 0) {
+            break;
+        }
+    }
+
+    /* handle case of 0 */
+    if (i == MAX_LENGTH_SZ) {
+        input[idx++] = 0; len++;
+    }
+
+    for (; i < MAX_LENGTH_SZ && idx < maxIdx; i++) {
+        input[idx++] = ar[i]; len++;
+    }
+
+    /* jump back to beginning of input buffer using unaltered inOutIdx value
+     * and set number of bytes for integer, then update the index value */
+    input[*inOutIdx + 1] = (byte)len;
+    *inOutIdx = idx;
+
+    return len + 2; /* size of integer bytes plus ASN TAG and length byte */
+}
 #endif /* !NO_PWDBASED */
 
@@ -959 +784 @@
     return 0;
 }
+
+#if (!defined(WOLFSSL_KEY_GEN) && !defined(OPENSSL_EXTRA) && defined(RSA_LOW_MEM)) \
+    || defined(WOLFSSL_RSA_PUBLIC_ONLY)
+#if !defined(NO_RSA) && !defined(HAVE_USER_RSA)
+static int SkipInt(const byte* input, word32* inOutIdx, word32 maxIdx)
+{
+    word32 idx = *inOutIdx;
+    int    ret;
+    int    length;
+
+    ret = GetASNInt(input, &idx, &length, maxIdx);
+    if (ret != 0)
+        return ret;
+
+    *inOutIdx = idx + length;
+
+    return 0;
+}
+#endif
+#endif
 
 static int CheckBitString(const byte* input, word32* inOutIdx, int* len,
@@ -1008 +853 @@
 }
 
-#if (!defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \
-                          (defined(WOLFSSL_KEY_GEN) && \
-                           !defined(HAVE_USER_RSA)))) || \
-    (defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || \
-                           defined(WOLFSSL_KEY_GEN)))
+/* RSA (with CertGen or KeyGen) OR ECC OR ED25519 (with CertGen or KeyGen) */
+#if (!defined(NO_RSA) && !defined(HAVE_USER_RSA) && \
+        (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA))) || \
+    (defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)) || \
+    (defined(HAVE_ED25519) && \
+        (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA)))
+
 /* Set the DER/BER encoding of the ASN.1 BIT_STRING header.
  *
@@ -1032 +879 @@
     return idx;
 }
+#endif /* !NO_RSA || HAVE_ECC || HAVE_ED25519 */
+
+#ifdef ASN_BER_TO_DER
+/* Convert a BER encoding with indefinite length items to DER.
+ *
+ * ber    BER encoded data.
+ * berSz  Length of BER encoded data.
+ * der    Buffer to hold DER encoded version of data.
+ *        NULL indicates only the length is required.
+ * derSz  The size of the buffer to hold the DER encoded data.
+ *        Will be set if der is NULL, otherwise the value is checked as der is
+ *        filled.
+ * returns ASN_PARSE_E if the BER data is invalid and BAD_FUNC_ARG if ber or
+ * derSz are NULL.
+ */
+int wc_BerToDer(const byte* ber, word32 berSz, byte* der, word32* derSz)
+{
+    int ret;
+    word32 i, j, k;
+    int len, l;
+    int indef;
+    int depth = 0;
+    byte type;
+    word32 cnt, sz;
+    word32 outSz = 0;
+    byte lenBytes[4];
+
+    if (ber == NULL || derSz == NULL)
+        return BAD_FUNC_ARG;
+
+    sz = 0;
+    outSz = *derSz;
+
+    for (i = 0, j = 0; i < berSz; ) {
+        /* Check that there is data for an ASN item to parse. */
+        if (i + 2 > berSz)
+            return ASN_PARSE_E;
+
+        /* End Of Content (EOC) mark end of indefinite length items.
+         * EOCs are not encoded in DER.
+         * Keep track of no. indefinite length items that have not been
+         * terminated in depth.
+         */
+        if (ber[i] == 0 && ber[i+1] == 0) {
+            if (depth == 0)
+                break;
+            if (--depth == 0)
+                break;
+
+            i += 2;
+            continue;
+        }
+
+        /* Indefinite length is encoded as: 0x80 */
+        type = ber[i];
+        indef = ber[i+1] == ASN_INDEF_LENGTH;
+        if (indef && (type & 0xC0) == 0 &&
+                                   ber[i] != (ASN_SEQUENCE | ASN_CONSTRUCTED) &&
+                                   ber[i] != (ASN_SET      | ASN_CONSTRUCTED)) {
+            /* Indefinite length OCTET STRING or other simple type.
+             * Put all the data into one entry.
+             */
+
+            /* Type no longer constructed. */
+            type &= ~ASN_CONSTRUCTED;
+            if (der != NULL) {
+                /* Ensure space for type. */
+                if (j + 1 >= outSz)
+                    return BUFFER_E;
+                der[j] = type;
+            }
+            i++; j++;
+            /* Skip indefinite length. */
+            i++;
+
+            /* There must be further ASN1 items to combine. */
+            if (i + 2 > berSz)
+                return ASN_PARSE_E;
+
+            /* Calculate length of combined data. */
+            len = 0;
+            k = i;
+            while (ber[k] != 0x00) {
+                /* Each ASN item must be the same type as the constructed. */
+                if (ber[k] != type)
+                    return ASN_PARSE_E;
+                k++;
+
+                ret = GetLength(ber, &k, &l, berSz);
+                if (ret < 0)
+                    return ASN_PARSE_E;
+                k += l;
+                len += l;
+
+                /* Must at least have terminating EOC. */
+                if (k + 2 > berSz)
+                    return ASN_PARSE_E;
+            }
+            /* Ensure a valid EOC ASN item. */
+            if (ber[k+1] != 0x00)
+                return ASN_PARSE_E;
+
+            if (der == NULL) {
+                /* Add length of ASN item length encoding and data. */
+                j += SetLength(len, lenBytes);
+                j += len;
+            }
+            else {
+                /* Check space for encoded length. */
+                if (SetLength(len, lenBytes) > outSz - j)
+                    return BUFFER_E;
+                /* Encode new length. */
+                j += SetLength(len, der + j);
+
+                /* Encode data in single item. */
+                k = i;
+                while (ber[k] != 0x00) {
+                    /* Skip ASN type. */
+                    k++;
+
+                    /* Find length of data in ASN item. */
+                    ret = GetLength(ber, &k, &l, berSz);
+                    if (ret < 0)
+                        return ASN_PARSE_E;
+
+                    /* Ensure space for data and copy in. */
+                    if (j + l > outSz)
+                        return BUFFER_E;
+                    XMEMCPY(der + j, ber + k, l);
+                    k += l; j += l;
+                }
+            }
+            /* Continue conversion after EOC. */
+            i = k + 2;
+
+            continue;
+        }
+
+        if (der != NULL) {
+            /* Ensure space for type and at least one byte of length. */
+            if (j + 1 >= outSz)
+                return BUFFER_E;
+            /* Put in type. */
+            der[j] = ber[i];
+        }
+        i++; j++;
+
+        if (indef) {
+            /* Skip indefinite length. */
+            i++;
+            /* Calculate the size of the data inside constructed. */
+            ret = wc_BerToDer(ber + i, berSz - i, NULL, &sz);
+            if (ret != LENGTH_ONLY_E)
+                return ret;
+
+            if (der != NULL) {
+                /* Ensure space for encoded length. */
+                if (SetLength(sz, lenBytes) > outSz - j)
+                    return BUFFER_E;
+                /* Encode real length. */
+                j += SetLength(sz, der + j);
+            }
+            else {
+                /* Add size of encoded length. */
+                j += SetLength(sz, lenBytes);
+            }
+
+            /* Another EOC to find. */
+            depth++;
+        }
+        else {
+            /* Get the size of the encode length and length value. */
+            cnt = i;
+            ret = GetLength(ber, &cnt, &len, berSz);
+            if (ret < 0)
+                return ASN_PARSE_E;
+            cnt -= i;
+
+            /* Check there is enough data to copy out. */
+            if (i + cnt + len > berSz)
+                return ASN_PARSE_E;
+
+            if (der != NULL) {
+                /* Ensure space in DER buffer. */
+                if (j + cnt + len > outSz)
+                    return BUFFER_E;
+                /* Copy length and data into DER buffer. */
+                XMEMCPY(der + j, ber + i, cnt + len);
+            }
+            /* Continue conversion after this ASN item. */
+            i += cnt + len;
+            j += cnt + len;
+        }
+    }
+
+    if (depth >= 1)
+        return ASN_PARSE_E;
+
+    /* Return length if no buffer to write to. */
+    if (der == NULL) {
+        *derSz = j;
+        return LENGTH_ONLY_E;
+    }
+
+    return 0;
+}
+#endif
+
+#if defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN)
+
+#if (!defined(NO_RSA) && !defined(HAVE_USER_RSA)) || \
+    defined(HAVE_ECC) || defined(HAVE_ED25519)
 
 #ifdef WOLFSSL_CERT_EXT
@@ -1067 +1126 @@
 }
 #endif /* WOLFSSL_CERT_EXT */
-#endif /* !NO_RSA && (WOLFSSL_CERT_GEN || (WOLFSSL_KEY_GEN &&
-                                           !HAVE_USER_RSA)) */
+#endif /* !NO_RSA || HAVE_ECC || HAVE_ED25519 */
+#endif /* WOLFSSL_CERT_GEN || WOLFSSL_KEY_GEN */
 
 
 
 /* hashType */
+#ifdef WOLFSSL_MD2
 static const byte hashMd2hOid[] = {42, 134, 72, 134, 247, 13, 2, 2};
+#endif
+#ifndef NO_MD5
 static const byte hashMd5hOid[] = {42, 134, 72, 134, 247, 13, 2, 5};
+#endif
+#ifndef NO_SHA
 static const byte hashSha1hOid[] = {43, 14, 3, 2, 26};
+#endif
+#ifdef WOLFSSL_SHA224
 static const byte hashSha224hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 4};
+#endif
+#ifndef NO_SHA256
 static const byte hashSha256hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 1};
+#endif
+#ifdef WOLFSSL_SHA384
 static const byte hashSha384hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 2};
+#endif
+#ifdef WOLFSSL_SHA512
 static const byte hashSha512hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 3};
+#endif
+
+/* hmacType */
+#ifndef NO_HMAC
+    #ifdef WOLFSSL_SHA224
+    static const byte hmacSha224Oid[] = {42, 134, 72, 134, 247, 13, 2, 8};
+    #endif
+    #ifndef NO_SHA256
+    static const byte hmacSha256Oid[] = {42, 134, 72, 134, 247, 13, 2, 9};
+    #endif
+    #ifdef WOLFSSL_SHA384
+    static const byte hmacSha384Oid[] = {42, 134, 72, 134, 247, 13, 2, 10};
+    #endif
+    #ifdef WOLFSSL_SHA512
+    static const byte hmacSha512Oid[] = {42, 134, 72, 134, 247, 13, 2, 11};
+    #endif
+#endif
 
 /* sigType */
-#ifndef NO_DSA
+#if !defined(NO_DSA) && !defined(NO_SHA)
     static const byte sigSha1wDsaOid[] = {42, 134, 72, 206, 56, 4, 3};
 #endif /* NO_DSA */
 #ifndef NO_RSA
+    #ifdef WOLFSSL_MD2
     static const byte sigMd2wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 2};
+    #endif
+    #ifndef NO_MD5
     static const byte sigMd5wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 4};
+    #endif
+    #ifndef NO_SHA
     static const byte sigSha1wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 5};
+    #endif
+    #ifdef WOLFSSL_SHA224
     static const byte sigSha224wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,14};
+    #endif
+    #ifndef NO_SHA256
     static const byte sigSha256wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,11};
+    #endif
+    #ifdef WOLFSSL_SHA384
     static const byte sigSha384wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,12};
+    #endif
+    #ifdef WOLFSSL_SHA512
     static const byte sigSha512wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,13};
+    #endif
 #endif /* NO_RSA */
 #ifdef HAVE_ECC
+    #ifndef NO_SHA
     static const byte sigSha1wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 1};
+    #endif
+    #ifdef WOLFSSL_SHA224
     static const byte sigSha224wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 1};
+    #endif
+    #ifndef NO_SHA256
     static const byte sigSha256wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 2};
+    #endif
+    #ifdef WOLFSSL_SHA384
     static const byte sigSha384wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 3};
+    #endif
+    #ifdef WOLFSSL_SHA512
     static const byte sigSha512wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 4};
+    #endif
 #endif /* HAVE_ECC */
 #ifdef HAVE_ED25519
@@ -1127 +1240 @@
 #endif /* HAVE_ECC */
 
+#ifdef HAVE_AES_CBC
 /* blkType */
+    #ifdef WOLFSSL_AES_128
 static const byte blkAes128CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 2};
+    #endif
+    #ifdef WOLFSSL_AES_192
 static const byte blkAes192CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 22};
+    #endif
+    #ifdef WOLFSSL_AES_256
 static const byte blkAes256CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 42};
+    #endif
+#endif /* HAVE_AES_CBC */
+#ifdef HAVE_AESGCM
+    #ifdef WOLFSSL_AES_128
+    static const byte blkAes128GcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 6};
+    #endif
+    #ifdef WOLFSSL_AES_192
+    static const byte blkAes192GcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 26};
+    #endif
+    #ifdef WOLFSSL_AES_256
+    static const byte blkAes256GcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 46};
+    #endif
+#endif /* HAVE_AESGCM */
+#ifdef HAVE_AESCCM
+    #ifdef WOLFSSL_AES_128
+    static const byte blkAes128CcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 7};
+    #endif
+    #ifdef WOLFSSL_AES_192
+    static const byte blkAes192CcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 27};
+    #endif
+    #ifdef WOLFSSL_AES_256
+    static const byte blkAes256CcmOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 47};
+    #endif
+#endif /* HAVE_AESCCM */
+
+#ifndef NO_DES3
 static const byte blkDesCbcOid[]  = {43, 14, 3, 2, 7};
 static const byte blkDes3CbcOid[] = {42, 134, 72, 134, 247, 13, 3, 7};
+#endif
 
 /* keyWrapType */
+#ifdef WOLFSSL_AES_128
 static const byte wrapAes128Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 5};
+#endif
+#ifdef WOLFSSL_AES_192
 static const byte wrapAes192Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 25};
+#endif
+#ifdef WOLFSSL_AES_256
 static const byte wrapAes256Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 45};
+#endif
+#ifdef HAVE_PKCS7
+/* From RFC 3211 */
+static const byte wrapPwriKekOid[] = {42, 134, 72, 134, 247, 13, 1, 9, 16, 3,9};
+#endif
 
 /* cmsKeyAgreeType */
+#ifndef NO_SHA
 static const byte dhSinglePass_stdDH_sha1kdf_Oid[]   =
                                           {43, 129, 5, 16, 134, 72, 63, 0, 2};
+#endif
+#ifdef WOLFSSL_SHA224
 static const byte dhSinglePass_stdDH_sha224kdf_Oid[] = {43, 129, 4, 1, 11, 0};
+#endif
+#ifndef NO_SHA256
 static const byte dhSinglePass_stdDH_sha256kdf_Oid[] = {43, 129, 4, 1, 11, 1};
+#endif
+#ifdef WOLFSSL_SHA384
 static const byte dhSinglePass_stdDH_sha384kdf_Oid[] = {43, 129, 4, 1, 11, 2};
+#endif
+#ifdef WOLFSSL_SHA512
 static const byte dhSinglePass_stdDH_sha512kdf_Oid[] = {43, 129, 4, 1, 11, 3};
+#endif
 
 /* ocspType */
@@ -1164 +1330 @@
 static const byte extInhibitAnyOid[] = {85, 29, 54};
 static const byte extExtKeyUsageOid[] = {85, 29, 37};
+#ifndef IGNORE_NAME_CONSTRAINTS
 static const byte extNameConsOid[] = {85, 29, 30};
+#endif
 
 /* certAuthInfoType */
+#ifdef HAVE_OCSP
 static const byte extAuthInfoOcspOid[] = {43, 6, 1, 5, 5, 7, 48, 1};
+#endif
 static const byte extAuthInfoCaIssuerOid[] = {43, 6, 1, 5, 5, 7, 48, 2};
 
@@ -1188 +1358 @@
 static const byte pbkdf2Oid[] = {42, 134, 72, 134, 247, 13, 1, 5, 12};
 
-static const byte* OidFromId(word32 id, word32 type, word32* oidSz)
+/* PKCS5 */
+#if !defined(NO_DES3) && !defined(NO_SHA)
+static const byte pbeSha1Des[] = {42, 134, 72, 134, 247, 13, 1, 5, 10};
+#endif
+static const byte pbes2[] = {42, 134, 72, 134, 247, 13, 1, 5, 13};
+
+/* PKCS12 */
+#if !defined(NO_RC4) && !defined(NO_SHA)
+static const byte pbeSha1RC4128[] = {42, 134, 72, 134, 247, 13, 1, 12, 1, 1};
+#endif
+#if !defined(NO_DES3) && !defined(NO_SHA)
+static const byte pbeSha1Des3[] = {42, 134, 72, 134, 247, 13, 1, 12, 1, 3};
+#endif
+
+#ifdef HAVE_LIBZ
+/* zlib compression */
+static const byte zlibCompress[] = {42, 134, 72, 134, 247, 13, 1, 9, 16, 3, 8};
+#endif
+
+
+/* returns a pointer to the OID string on success and NULL on fail */
+const byte* OidFromId(word32 id, word32 type, word32* oidSz)
 {
     const byte* oid = NULL;
@@ -1198 +1389 @@
         case oidHashType:
             switch (id) {
+            #ifdef WOLFSSL_MD2
                 case MD2h:
                     oid = hashMd2hOid;
                     *oidSz = sizeof(hashMd2hOid);
                     break;
+            #endif
+            #ifndef NO_MD5
                 case MD5h:
                     oid = hashMd5hOid;
                     *oidSz = sizeof(hashMd5hOid);
                     break;
+            #endif
+            #ifndef NO_SHA
                 case SHAh:
                     oid = hashSha1hOid;
                     *oidSz = sizeof(hashSha1hOid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA224
                 case SHA224h:
                     oid = hashSha224hOid;
                     *oidSz = sizeof(hashSha224hOid);
                     break;
+            #endif
+            #ifndef NO_SHA256
                 case SHA256h:
                     oid = hashSha256hOid;
                     *oidSz = sizeof(hashSha256hOid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA384
                 case SHA384h:
                     oid = hashSha384hOid;
                     *oidSz = sizeof(hashSha384hOid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA512
                 case SHA512h:
                     oid = hashSha512hOid;
                     *oidSz = sizeof(hashSha512hOid);
                     break;
+            #endif
             }
             break;
@@ -1231 +1436 @@
         case oidSigType:
             switch (id) {
-                #ifndef NO_DSA
+                #if !defined(NO_DSA) && !defined(NO_SHA)
                 case CTC_SHAwDSA:
                     oid = sigSha1wDsaOid;
@@ -1238 +1443 @@
                 #endif /* NO_DSA */
                 #ifndef NO_RSA
+                #ifdef WOLFSSL_MD2
                 case CTC_MD2wRSA:
                     oid = sigMd2wRsaOid;
                     *oidSz = sizeof(sigMd2wRsaOid);
                     break;
+                #endif
+                #ifndef NO_MD5
                 case CTC_MD5wRSA:
                     oid = sigMd5wRsaOid;
                     *oidSz = sizeof(sigMd5wRsaOid);
                     break;
+                #endif
+                #ifndef NO_SHA
                 case CTC_SHAwRSA:
                     oid = sigSha1wRsaOid;
                     *oidSz = sizeof(sigSha1wRsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA224
                 case CTC_SHA224wRSA:
                     oid = sigSha224wRsaOid;
                     *oidSz = sizeof(sigSha224wRsaOid);
                     break;
+                #endif
+                #ifndef NO_SHA256
                 case CTC_SHA256wRSA:
                     oid = sigSha256wRsaOid;
                     *oidSz = sizeof(sigSha256wRsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA384
                 case CTC_SHA384wRSA:
                     oid = sigSha384wRsaOid;
                     *oidSz = sizeof(sigSha384wRsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA512
                 case CTC_SHA512wRSA:
                     oid = sigSha512wRsaOid;
                     *oidSz = sizeof(sigSha512wRsaOid);
                     break;
+                #endif /* WOLFSSL_SHA512 */
                 #endif /* NO_RSA */
                 #ifdef HAVE_ECC
+                #ifndef NO_SHA
                 case CTC_SHAwECDSA:
                     oid = sigSha1wEcdsaOid;
                     *oidSz = sizeof(sigSha1wEcdsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA224
                 case CTC_SHA224wECDSA:
                     oid = sigSha224wEcdsaOid;
                     *oidSz = sizeof(sigSha224wEcdsaOid);
                     break;
+                #endif
+                #ifndef NO_SHA256
                 case CTC_SHA256wECDSA:
                     oid = sigSha256wEcdsaOid;
                     *oidSz = sizeof(sigSha256wEcdsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA384
                 case CTC_SHA384wECDSA:
                     oid = sigSha384wEcdsaOid;
                     *oidSz = sizeof(sigSha384wEcdsaOid);
                     break;
+                #endif
+                #ifdef WOLFSSL_SHA512
                 case CTC_SHA512wECDSA:
                     oid = sigSha512wEcdsaOid;
                     *oidSz = sizeof(sigSha512wEcdsaOid);
                     break;
+                #endif
                 #endif /* HAVE_ECC */
                 #ifdef HAVE_ED25519
@@ -1347 +1576 @@
         case oidBlkType:
             switch (id) {
+    #ifdef HAVE_AES_CBC
+        #ifdef WOLFSSL_AES_128
                 case AES128CBCb:
                     oid = blkAes128CbcOid;
                     *oidSz = sizeof(blkAes128CbcOid);
                     break;
+        #endif
+        #ifdef WOLFSSL_AES_192
                 case AES192CBCb:
                     oid = blkAes192CbcOid;
                     *oidSz = sizeof(blkAes192CbcOid);
                     break;
+        #endif
+        #ifdef WOLFSSL_AES_256
                 case AES256CBCb:
                     oid = blkAes256CbcOid;
                     *oidSz = sizeof(blkAes256CbcOid);
                     break;
+        #endif
+    #endif /* HAVE_AES_CBC */
+    #ifdef HAVE_AESGCM
+        #ifdef WOLFSSL_AES_128
+                case AES128GCMb:
+                    oid = blkAes128GcmOid;
+                    *oidSz = sizeof(blkAes128GcmOid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_AES_192
+                case AES192GCMb:
+                    oid = blkAes192GcmOid;
+                    *oidSz = sizeof(blkAes192GcmOid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_AES_256
+                case AES256GCMb:
+                    oid = blkAes256GcmOid;
+                    *oidSz = sizeof(blkAes256GcmOid);
+                    break;
+        #endif
+    #endif /* HAVE_AESGCM */
+    #ifdef HAVE_AESCCM
+        #ifdef WOLFSSL_AES_128
+                case AES128CCMb:
+                    oid = blkAes128CcmOid;
+                    *oidSz = sizeof(blkAes128CcmOid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_AES_192
+                case AES192CCMb:
+                    oid = blkAes192CcmOid;
+                    *oidSz = sizeof(blkAes192CcmOid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_AES_256
+                case AES256CCMb:
+                    oid = blkAes256CcmOid;
+                    *oidSz = sizeof(blkAes256CcmOid);
+                    break;
+        #endif
+    #endif /* HAVE_AESCCM */
+    #ifndef NO_DES3
                 case DESb:
                     oid = blkDesCbcOid;
@@ -1367 +1645 @@
                     *oidSz = sizeof(blkDes3CbcOid);
                     break;
+    #endif /* !NO_DES3 */
             }
             break;
@@ -1427 +1706 @@
                     *oidSz = sizeof(extExtKeyUsageOid);
                     break;
+            #ifndef IGNORE_NAME_CONSTRAINTS
                 case NAME_CONS_OID:
                     oid = extNameConsOid;
                     *oidSz = sizeof(extNameConsOid);
                     break;
+            #endif
             }
             break;
@@ -1436 +1717 @@
         case oidCertAuthInfoType:
             switch (id) {
+            #ifdef HAVE_OCSP
                 case AIA_OCSP_OID:
                     oid = extAuthInfoOcspOid;
                     *oidSz = sizeof(extAuthInfoOcspOid);
                     break;
+            #endif
                 case AIA_CA_ISSUER_OID:
                     oid = extAuthInfoCaIssuerOid;
@@ -1507 +1790 @@
             break;
 
+        case oidPBEType:
+            switch (id) {
+        #if !defined(NO_SHA) && !defined(NO_RC4)
+                case PBE_SHA1_RC4_128:
+                    oid = pbeSha1RC4128;
+                    *oidSz = sizeof(pbeSha1RC4128);
+                    break;
+        #endif
+        #if !defined(NO_SHA) && !defined(NO_DES3)
+                case PBE_SHA1_DES:
+                    oid = pbeSha1Des;
+                    *oidSz = sizeof(pbeSha1Des);
+                    break;
+
+        #endif
+        #if !defined(NO_SHA) && !defined(NO_DES3)
+                case PBE_SHA1_DES3:
+                    oid = pbeSha1Des3;
+                    *oidSz = sizeof(pbeSha1Des3);
+                    break;
+        #endif
+                case PBES2:
+                    oid = pbes2;
+                    *oidSz = sizeof(pbes2);
+                    break;
+            }
+            break;
+
         case oidKeyWrapType:
             switch (id) {
+            #ifdef WOLFSSL_AES_128
                 case AES128_WRAP:
                     oid = wrapAes128Oid;
                     *oidSz = sizeof(wrapAes128Oid);
                     break;
+            #endif
+            #ifdef WOLFSSL_AES_192
                 case AES192_WRAP:
                     oid = wrapAes192Oid;
                     *oidSz = sizeof(wrapAes192Oid);
                     break;
+            #endif
+            #ifdef WOLFSSL_AES_256
                 case AES256_WRAP:
                     oid = wrapAes256Oid;
                     *oidSz = sizeof(wrapAes256Oid);
                     break;
+            #endif
+            #ifdef HAVE_PKCS7
+                case PWRI_KEK_WRAP:
+                    oid = wrapPwriKekOid;
+                    *oidSz = sizeof(wrapPwriKekOid);
+                    break;
+            #endif
             }
             break;
@@ -1526 +1849 @@
         case oidCmsKeyAgreeType:
             switch (id) {
+            #ifndef NO_SHA
                 case dhSinglePass_stdDH_sha1kdf_scheme:
                     oid = dhSinglePass_stdDH_sha1kdf_Oid;
                     *oidSz = sizeof(dhSinglePass_stdDH_sha1kdf_Oid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA224
                 case dhSinglePass_stdDH_sha224kdf_scheme:
                     oid = dhSinglePass_stdDH_sha224kdf_Oid;
                     *oidSz = sizeof(dhSinglePass_stdDH_sha224kdf_Oid);
                     break;
+            #endif
+            #ifndef NO_SHA256
                 case dhSinglePass_stdDH_sha256kdf_scheme:
                     oid = dhSinglePass_stdDH_sha256kdf_Oid;
                     *oidSz = sizeof(dhSinglePass_stdDH_sha256kdf_Oid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA384
                 case dhSinglePass_stdDH_sha384kdf_scheme:
                     oid = dhSinglePass_stdDH_sha384kdf_Oid;
                     *oidSz = sizeof(dhSinglePass_stdDH_sha384kdf_Oid);
                     break;
+            #endif
+            #ifdef WOLFSSL_SHA512
                 case dhSinglePass_stdDH_sha512kdf_scheme:
                     oid = dhSinglePass_stdDH_sha512kdf_Oid;
                     *oidSz = sizeof(dhSinglePass_stdDH_sha512kdf_Oid);
                     break;
+            #endif
             }
             break;
+
+#ifndef NO_HMAC
+        case oidHmacType:
+            switch (id) {
+        #ifdef WOLFSSL_SHA224
+                case HMAC_SHA224_OID:
+                    oid = hmacSha224Oid;
+                    *oidSz = sizeof(hmacSha224Oid);
+                    break;
+        #endif
+        #ifndef NO_SHA256
+                case HMAC_SHA256_OID:
+                    oid = hmacSha256Oid;
+                    *oidSz = sizeof(hmacSha256Oid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_SHA384
+                case HMAC_SHA384_OID:
+                    oid = hmacSha384Oid;
+                    *oidSz = sizeof(hmacSha384Oid);
+                    break;
+        #endif
+        #ifdef WOLFSSL_SHA512
+                case HMAC_SHA512_OID:
+                    oid = hmacSha512Oid;
+                    *oidSz = sizeof(hmacSha512Oid);
+                    break;
+        #endif
+            }
+            break;
+#endif /* !NO_HMAC */
+
+#ifdef HAVE_LIBZ
+        case oidCompressType:
+            switch (id) {
+                case ZLIBc:
+                    oid = zlibCompress;
+                    *oidSz = sizeof(zlibCompress);
+                    break;
+            }
+            break;
+#endif /* HAVE_LIBZ */
 
         case oidIgnoreType:
@@ -1682 +2057 @@
  *         Otherwise, 0 to indicate success.
  */
-static int GetASNObjectId(const byte* input, word32* inOutIdx, int* len,
+int GetASNObjectId(const byte* input, word32* inOutIdx, int* len,
                           word32 maxIdx)
 {
@@ -1710 +2085 @@
  * returns the number of bytes added to the buffer.
  */
-static int SetObjectId(int len, byte* output)
+int SetObjectId(int len, byte* output)
 {
     int idx = 0;
@@ -1758 +2133 @@
         word32 checkOidSz;
     #ifdef ASN_DUMP_OID
-        int i;
+        word32 i;
     #endif
 
@@ -1836 +2211 @@
 
     /* could have NULL tag and 0 terminator, but may not */
-    if (input[idx] == ASN_TAG_NULL) {
+    if (idx < maxIdx && input[idx] == ASN_TAG_NULL) {
         ret = GetASNNull(input, &idx, maxIdx);
         if (ret != 0)
@@ -1868 +2243 @@
     if (GetInt(&key->n,  input, inOutIdx, inSz) < 0 ||
         GetInt(&key->e,  input, inOutIdx, inSz) < 0 ||
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
         GetInt(&key->d,  input, inOutIdx, inSz) < 0 ||
         GetInt(&key->p,  input, inOutIdx, inSz) < 0 ||
-        GetInt(&key->q,  input, inOutIdx, inSz) < 0 ||
-        GetInt(&key->dP, input, inOutIdx, inSz) < 0 ||
+        GetInt(&key->q,  input, inOutIdx, inSz) < 0)
+#else
+        SkipInt(input, inOutIdx, inSz) < 0 ||
+        SkipInt(input, inOutIdx, inSz) < 0 ||
+        SkipInt(input, inOutIdx, inSz) < 0 )
+
+#endif
+            return ASN_RSA_KEY_E;
+#if (defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || !defined(RSA_LOW_MEM)) \
+    && !defined(WOLFSSL_RSA_PUBLIC_ONLY)
+    if (GetInt(&key->dP, input, inOutIdx, inSz) < 0 ||
         GetInt(&key->dQ, input, inOutIdx, inSz) < 0 ||
         GetInt(&key->u,  input, inOutIdx, inSz) < 0 )  return ASN_RSA_KEY_E;
+#else
+    if (SkipInt(input, inOutIdx, inSz) < 0 ||
+        SkipInt(input, inOutIdx, inSz) < 0 ||
+        SkipInt(input, inOutIdx, inSz) < 0 )  return ASN_RSA_KEY_E;
+#endif
 
 #ifdef WOLFSSL_XILINX_CRYPT
@@ -1888 +2278 @@
 /* Remove PKCS8 header, place inOutIdx at beginning of traditional,
  * return traditional length on success, negative on error */
-int ToTraditionalInline(const byte* input, word32* inOutIdx, word32 sz)
-{
-    word32 idx, oid;
+int ToTraditionalInline_ex(const byte* input, word32* inOutIdx, word32 sz,
+                           word32* algId)
+{
+    word32 idx;
     int    version, length;
     int    ret;
@@ -1905 +2296 @@
         return ASN_PARSE_E;
 
-    if (GetAlgoId(input, &idx, &oid, oidKeyType, sz) < 0)
+    if (GetAlgoId(input, &idx, algId, oidKeyType, sz) < 0)
         return ASN_PARSE_E;
 
@@ -1922 +2313 @@
 }
 
+int ToTraditionalInline(const byte* input, word32* inOutIdx, word32 sz)
+{
+    word32 oid;
+
+    return ToTraditionalInline_ex(input, inOutIdx, sz, &oid);
+}
+
 /* Remove PKCS8 header, move beginning of traditional to beginning of input */
-int ToTraditional(byte* input, word32 sz)
+int ToTraditional_ex(byte* input, word32 sz, word32* algId)
 {
     word32 inOutIdx = 0;
@@ -1931 +2329 @@
         return BAD_FUNC_ARG;
 
-    length = ToTraditionalInline(input, &inOutIdx, sz);
+    length = ToTraditionalInline_ex(input, &inOutIdx, sz, algId);
     if (length < 0)
         return length;
@@ -1940 +2338 @@
 }
 
+int ToTraditional(byte* input, word32 sz)
+{
+    word32 oid;
+
+    return ToTraditional_ex(input, sz, &oid);
+}
 
 /* find beginning of traditional key inside PKCS#8 unencrypted buffer
@@ -1948 +2352 @@
 {
     int length;
+    word32 algId;
 
     if (input == NULL || inOutIdx == NULL || (*inOutIdx > sz))
         return BAD_FUNC_ARG;
 
-    length = ToTraditionalInline(input, inOutIdx, sz);
+    length = ToTraditionalInline_ex(input, inOutIdx, sz, &algId);
 
     return length;
@@ -2079 +2484 @@
 {
     int ret;
+    (void)keySz;
 
     if (key == NULL || der == NULL) {
@@ -2084 +2490 @@
     }
 
-    #if !defined(NO_RSA)
+    #if !defined(NO_RSA) && !defined(NO_ASN_CRYPT)
     /* test if RSA key */
     if (der->keyOID == RSAk) {
-        RsaKey a, b;
+    #ifdef WOLFSSL_SMALL_STACK
+        RsaKey* a = NULL;
+        RsaKey* b = NULL;
+    #else
+        RsaKey a[1], b[1];
+    #endif
         word32 keyIdx = 0;
 
-        if ((ret = wc_InitRsaKey(&a, NULL)) < 0)
+    #ifdef WOLFSSL_SMALL_STACK
+        a = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_RSA);
+        if (a == NULL)
+            return MEMORY_E;
+        b = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_RSA);
+        if (b == NULL) {
+            XFREE(a, NULL, DYNAMIC_TYPE_RSA);
+            return MEMORY_E;
+        }
+    #endif
+
+        if ((ret = wc_InitRsaKey(a, NULL)) < 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+            XFREE(b, NULL, DYNAMIC_TYPE_RSA);
+            XFREE(a, NULL, DYNAMIC_TYPE_RSA);
+    #endif
             return ret;
-        if ((ret = wc_InitRsaKey(&b, NULL)) < 0) {
-            wc_FreeRsaKey(&a);
+        }
+        if ((ret = wc_InitRsaKey(b, NULL)) < 0) {
+            wc_FreeRsaKey(a);
+    #ifdef WOLFSSL_SMALL_STACK
+            XFREE(b, NULL, DYNAMIC_TYPE_RSA);
+            XFREE(a, NULL, DYNAMIC_TYPE_RSA);
+    #endif
             return ret;
         }
-        if ((ret = wc_RsaPrivateKeyDecode(key, &keyIdx, &a, keySz)) == 0) {
+        if ((ret = wc_RsaPrivateKeyDecode(key, &keyIdx, a, keySz)) == 0) {
             WOLFSSL_MSG("Checking RSA key pair");
             keyIdx = 0; /* reset to 0 for parsing public key */
 
-            if ((ret = wc_RsaPublicKeyDecode(der->publicKey, &keyIdx, &b,
+            if ((ret = wc_RsaPublicKeyDecode(der->publicKey, &keyIdx, b,
                                                        der->pubKeySize)) == 0) {
                 /* limit for user RSA crypto because of RsaKey
@@ -2110 +2541 @@
                 /* both keys extracted successfully now check n and e
                  * values are the same. This is dereferencing RsaKey */
-                if (mp_cmp(&(a.n), &(b.n)) != MP_EQ ||
-                    mp_cmp(&(a.e), &(b.e)) != MP_EQ) {
+                if (mp_cmp(&(a->n), &(b->n)) != MP_EQ ||
+                    mp_cmp(&(a->e), &(b->e)) != MP_EQ) {
                     ret = MP_CMP_E;
                 }
@@ -2119 +2550 @@
             }
         }
-        wc_FreeRsaKey(&b);
-        wc_FreeRsaKey(&a);
+        wc_FreeRsaKey(b);
+        wc_FreeRsaKey(a);
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(b, NULL, DYNAMIC_TYPE_RSA);
+        XFREE(a, NULL, DYNAMIC_TYPE_RSA);
+    #endif
     }
     else
-    #endif /* NO_RSA */
-
-    #ifdef HAVE_ECC
+    #endif /* !NO_RSA && !NO_ASN_CRYPT */
+
+    #if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && !defined(NO_ASN_CRYPT)
     if (der->keyOID == ECDSAk) {
+    #ifdef WOLFSSL_SMALL_STACK
+        ecc_key* key_pair = NULL;
+        byte*    privDer;
+    #else
+        ecc_key  key_pair[1];
+        byte     privDer[MAX_ECC_BYTES];
+    #endif
+        word32   privSz = MAX_ECC_BYTES;
         word32  keyIdx = 0;
-        ecc_key key_pair;
-
-        if ((ret = wc_ecc_init(&key_pair)) < 0)
+
+    #ifdef WOLFSSL_SMALL_STACK
+        key_pair = (ecc_key*)XMALLOC(sizeof(ecc_key), NULL, DYNAMIC_TYPE_ECC);
+        if (key_pair == NULL)
+            return MEMORY_E;
+        privDer = (byte*)XMALLOC(MAX_ECC_BYTES, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        if (privDer == NULL) {
+            XFREE(key_pair, NULL, DYNAMIC_TYPE_ECC);
+            return MEMORY_E;
+        }
+    #endif
+
+        if ((ret = wc_ecc_init(key_pair)) < 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+            XFREE(privDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(key_pair, NULL, DYNAMIC_TYPE_ECC);
+    #endif
             return ret;
-        if ((ret = wc_EccPrivateKeyDecode(key, &keyIdx, &key_pair,
+        }
+
+        if ((ret = wc_EccPrivateKeyDecode(key, &keyIdx, key_pair,
                                                                  keySz)) == 0) {
             WOLFSSL_MSG("Checking ECC key pair");
-            keyIdx = 0;
-            if ((ret = wc_ecc_import_x963(der->publicKey, der->pubKeySize,
-                                                             &key_pair)) == 0) {
-                /* public and private extracted successfuly no check if is
+
+            if ((ret = wc_ecc_export_private_only(key_pair, privDer, &privSz))
+                                                                         == 0) {
+                wc_ecc_free(key_pair);
+                ret = wc_ecc_init(key_pair);
+                if (ret == 0) {
+                    ret = wc_ecc_import_private_key((const byte*)privDer,
+                                            privSz, (const byte*)der->publicKey,
+                                            der->pubKeySize, key_pair);
+                }
+
+                /* public and private extracted successfuly now check if is
                  * a pair and also do sanity checks on key. wc_ecc_check_key
                  * checks that private * base generator equals pubkey */
-                if ((ret = wc_ecc_check_key(&key_pair)) == 0)
+                if (ret == 0) {
+                    if ((ret = wc_ecc_check_key(key_pair)) == 0) {
                     ret = 1;
             }
         }
-        wc_ecc_free(&key_pair);
+                ForceZero(privDer, privSz);
+            }
+        }
+        wc_ecc_free(key_pair);
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(privDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(key_pair, NULL, DYNAMIC_TYPE_ECC);
+    #endif
     }
     else
-    #endif /* HAVE_ECC */
-
-    #ifdef HAVE_ED25519
+    #endif /* HAVE_ECC && HAVE_ECC_KEY_EXPORT && !NO_ASN_CRYPT */
+
+    #if defined(HAVE_ED25519) && !defined(NO_ASN_CRYPT)
     if (der->keyOID == ED25519k) {
+    #ifdef WOLFSSL_SMALL_STACK
+        ed25519_key* key_pair = NULL;
+    #else
+        ed25519_key  key_pair[1];
+    #endif
         word32  keyIdx = 0;
-        ed25519_key key_pair;
-
-        if ((ret = wc_ed25519_init(&key_pair)) < 0)
+
+    #ifdef WOLFSSL_SMALL_STACK
+        key_pair = (ed25519_key*)XMALLOC(sizeof(ed25519_key), NULL,
+                                                          DYNAMIC_TYPE_ED25519);
+        if (key_pair == NULL)
+            return MEMORY_E;
+    #endif
+
+        if ((ret = wc_ed25519_init(key_pair)) < 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+            XFREE(key_pair, NULL, DYNAMIC_TYPE_ED25519);
+    #endif
             return ret;
-        if ((ret = wc_Ed25519PrivateKeyDecode(key, &keyIdx, &key_pair,
+        }
+        if ((ret = wc_Ed25519PrivateKeyDecode(key, &keyIdx, key_pair,
                                                                  keySz)) == 0) {
             WOLFSSL_MSG("Checking ED25519 key pair");
             keyIdx = 0;
             if ((ret = wc_ed25519_import_public(der->publicKey, der->pubKeySize,
-                                                             &key_pair)) == 0) {
+                                                              key_pair)) == 0) {
                 /* public and private extracted successfuly no check if is
                  * a pair and also do sanity checks on key. wc_ecc_check_key
                  * checks that private * base generator equals pubkey */
-                if ((ret = wc_ed25519_check_key(&key_pair)) == 0)
+                if ((ret = wc_ed25519_check_key(key_pair)) == 0)
                     ret = 1;
             }
         }
-        wc_ed25519_free(&key_pair);
+        wc_ed25519_free(key_pair);
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(key_pair, NULL, DYNAMIC_TYPE_ED25519);
+    #endif
     }
     else
-    #endif
+    #endif /* HAVE_ED25519 && !NO_ASN_CRYPT */
     {
         ret = 0;
     }
 
+    (void)keySz;
+
     return ret;
 }
@@ -2185 +2680 @@
 /* Check To see if PKCS version algo is supported, set id if it is return 0
    < 0 on error */
-static int CheckAlgo(int first, int second, int* id, int* version)
+static int CheckAlgo(int first, int second, int* id, int* version, int* blockSz)
 {
     *id      = ALGO_ID_E;
     *version = PKCS5;   /* default */
+    if (blockSz) *blockSz = 8; /* default */
 
     if (first == 1) {
         switch (second) {
-        case 1:
+#if !defined(NO_SHA)
+    #ifndef NO_RC4
+        case PBE_SHA1_RC4_128:
             *id = PBE_SHA1_RC4_128;
             *version = PKCS12v1;
             return 0;
-        case 3:
+    #endif
+    #ifndef NO_DES3
+        case PBE_SHA1_DES3:
             *id = PBE_SHA1_DES3;
             *version = PKCS12v1;
+            if (blockSz) *blockSz = DES_BLOCK_SIZE;
             return 0;
+    #endif
+#endif /* !NO_SHA */
         default:
             return ALGO_ID_E;
@@ -2214 +2717 @@
 
     switch (second) {
+#ifndef NO_DES3
+    #ifndef NO_MD5
     case 3:                   /* see RFC 2898 for ids */
         *id = PBE_MD5_DES;
+        if (blockSz) *blockSz = DES_BLOCK_SIZE;
         return 0;
+    #endif
+    #ifndef NO_SHA
     case 10:
         *id = PBE_SHA1_DES;
+        if (blockSz) *blockSz = DES_BLOCK_SIZE;
         return 0;
+    #endif
+#endif /* !NO_DES3 */
     default:
         return ALGO_ID_E;
@@ -2229 +2740 @@
 /* Check To see if PKCS v2 algo is supported, set id if it is return 0
    < 0 on error */
-static int CheckAlgoV2(int oid, int* id)
-{
+static int CheckAlgoV2(int oid, int* id, int* blockSz)
+{
+    if (blockSz) *blockSz = 8; /* default */
+    (void)id; /* not used if AES and DES3 disabled */
     switch (oid) {
-    case 69:
+#if !defined(NO_DES3) && !defined(NO_SHA)
+    case DESb:
         *id = PBE_SHA1_DES;
+        if (blockSz) *blockSz = DES_BLOCK_SIZE;
         return 0;
-    case 652:
+    case DES3b:
         *id = PBE_SHA1_DES3;
+        if (blockSz) *blockSz = DES_BLOCK_SIZE;
         return 0;
+#endif
+#ifdef WOLFSSL_AES_256
+    case AES256CBCb:
+        *id = PBE_AES256_CBC;
+        if (blockSz) *blockSz = AES_BLOCK_SIZE;
+        return 0;
+#endif
     default:
         return ALGO_ID_E;
@@ -2245 +2768 @@
 
 
-/* Decrypt input in place from parameters based on id */
-static int DecryptKey(const char* password, int passwordSz, byte* salt,
-                      int saltSz, int iterations, int id, byte* input,
-                      int length, int version, byte* cbcIv)
-{
-    int typeH;
-    int derivedLen;
-    int decryptionType;
-    int ret = 0;
-#ifdef WOLFSSL_SMALL_STACK
-    byte* key;
-#else
-    byte key[MAX_KEY_SIZE];
-#endif
-
-    (void)input;
-    (void)length;
-
-    switch (id) {
-        case PBE_MD5_DES:
-            typeH = WC_MD5;
-            derivedLen = 16;           /* may need iv for v1.5 */
-            decryptionType = DES_TYPE;
-            break;
-
-        case PBE_SHA1_DES:
-            typeH = WC_SHA;
-            derivedLen = 16;           /* may need iv for v1.5 */
-            decryptionType = DES_TYPE;
-            break;
-
-        case PBE_SHA1_DES3:
-            typeH = WC_SHA;
-            derivedLen = 32;           /* may need iv for v1.5 */
-            decryptionType = DES3_TYPE;
-            break;
-
-        case PBE_SHA1_RC4_128:
-            typeH = WC_SHA;
-            derivedLen = 16;
-            decryptionType = RC4_TYPE;
-            break;
-
-        default:
-            return ALGO_ID_E;
-    }
-
-#ifdef WOLFSSL_SMALL_STACK
-    key = (byte*)XMALLOC(MAX_KEY_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    if (key == NULL)
-        return MEMORY_E;
-#endif
-
-    if (version == PKCS5v2)
-        ret = wc_PBKDF2(key, (byte*)password, passwordSz,
-                        salt, saltSz, iterations, derivedLen, typeH);
-#ifndef NO_SHA
-    else if (version == PKCS5)
-        ret = wc_PBKDF1(key, (byte*)password, passwordSz,
-                        salt, saltSz, iterations, derivedLen, typeH);
-#endif
-    else if (version == PKCS12v1) {
-        int  i, idx = 0;
-        byte unicodePasswd[MAX_UNICODE_SZ];
-
-        if ( (passwordSz * 2 + 2) > (int)sizeof(unicodePasswd)) {
-#ifdef WOLFSSL_SMALL_STACK
-            XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-            return UNICODE_SIZE_E;
-        }
-
-        for (i = 0; i < passwordSz; i++) {
-            unicodePasswd[idx++] = 0x00;
-            unicodePasswd[idx++] = (byte)password[i];
-        }
-        /* add trailing NULL */
-        unicodePasswd[idx++] = 0x00;
-        unicodePasswd[idx++] = 0x00;
-
-        ret =  wc_PKCS12_PBKDF(key, unicodePasswd, idx, salt, saltSz,
-                            iterations, derivedLen, typeH, 1);
-        if (decryptionType != RC4_TYPE)
-            ret += wc_PKCS12_PBKDF(cbcIv, unicodePasswd, idx, salt, saltSz,
-                                iterations, 8, typeH, 2);
-    }
-    else {
-#ifdef WOLFSSL_SMALL_STACK
-        XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-        return ALGO_ID_E;
-    }
-
-    if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-        XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-        return ret;
-    }
-
-    switch (decryptionType) {
-#ifndef NO_DES3
-        case DES_TYPE:
-        {
-            Des    dec;
-            byte*  desIv = key + 8;
-
-            if (version == PKCS5v2 || version == PKCS12v1)
-                desIv = cbcIv;
-
-            ret = wc_Des_SetKey(&dec, key, desIv, DES_DECRYPTION);
-            if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-                return ret;
-            }
-
-            wc_Des_CbcDecrypt(&dec, input, input, length);
-            break;
-        }
-
-        case DES3_TYPE:
-        {
-            Des3   dec;
-            byte*  desIv = key + 24;
-
-            if (version == PKCS5v2 || version == PKCS12v1)
-                desIv = cbcIv;
-
-            ret = wc_Des3Init(&dec, NULL, INVALID_DEVID);
-            if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-                return ret;
-            }
-            ret = wc_Des3_SetKey(&dec, key, desIv, DES_DECRYPTION);
-            if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-                return ret;
-            }
-            ret = wc_Des3_CbcDecrypt(&dec, input, input, length);
-            if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-                return ret;
-            }
-            break;
-        }
-#endif
-#ifndef NO_RC4
-        case RC4_TYPE:
-        {
-            Arc4    dec;
-
-            wc_Arc4SetKey(&dec, key, derivedLen);
-            wc_Arc4Process(&dec, input, input, length);
-            break;
-        }
-#endif
-
-        default:
-#ifdef WOLFSSL_SMALL_STACK
-            XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-            return ALGO_ID_E;
-    }
-
-#ifdef WOLFSSL_SMALL_STACK
-    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-
-    return 0;
-}
-
-
 int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
         int* algoID, void* heap)
 {
     word32 tmpIdx = 0;
-#ifdef HAVE_ECC
-    ecc_key ecc;
-#endif
-#ifndef NO_RSA
-    RsaKey rsa;
-#endif
-#ifdef HAVE_ED25519
-    ed25519_key ed25519;
-#endif
-
-    if (algoID == NULL) {
+
+    if (key == NULL || algoID == NULL)
         return BAD_FUNC_ARG;
-    }
+
     *algoID = 0;
 
-#ifndef NO_RSA
-    if (wc_InitRsaKey(&rsa, heap) == 0) {
+    #if !defined(NO_RSA) && !defined(NO_ASN_CRYPT)
+    {
+        RsaKey rsa;
+
+        wc_InitRsaKey(&rsa, heap);
         if (wc_RsaPrivateKeyDecode(key, &tmpIdx, &rsa, keySz) == 0) {
             *algoID = RSAk;
-        }
+    }
         else {
             WOLFSSL_MSG("Not RSA DER key");
@@ -2454 +2791 @@
         wc_FreeRsaKey(&rsa);
     }
-    else {
-        WOLFSSL_MSG("GetKeyOID wc_InitRsaKey failed");
-    }
-#endif /* NO_RSA */
-#ifdef HAVE_ECC
-    if (*algoID != RSAk) {
+    #endif /* !NO_RSA && !NO_ASN_CRYPT */
+    #if defined(HAVE_ECC) && !defined(NO_ASN_CRYPT)
+    if (*algoID == 0) {
+        ecc_key ecc;
+
         tmpIdx = 0;
-        if (wc_ecc_init_ex(&ecc, heap, INVALID_DEVID) == 0) {
-            if (wc_EccPrivateKeyDecode(key, &tmpIdx, &ecc, keySz) == 0) {
-                *algoID = ECDSAk;
-
-                /* sanity check on arguments */
-                if (curveOID == NULL || oidSz == NULL) {
-                    WOLFSSL_MSG("Error getting ECC curve OID");
-                    wc_ecc_free(&ecc);
-                    return BAD_FUNC_ARG;
-                }
-
-                /* now find oid */
-                if (wc_ecc_get_oid(ecc.dp->oidSum, curveOID, oidSz) < 0) {
-                    WOLFSSL_MSG("Error getting ECC curve OID");
-                    wc_ecc_free(&ecc);
-                    return BAD_FUNC_ARG;
-                }
-            }
-            else {
-                WOLFSSL_MSG("Not ECC DER key either");
-            }
-            wc_ecc_free(&ecc);
+        wc_ecc_init_ex(&ecc, heap, INVALID_DEVID);
+        if (wc_EccPrivateKeyDecode(key, &tmpIdx, &ecc, keySz) == 0) {
+            *algoID = ECDSAk;
+
+            /* now find oid */
+            if (wc_ecc_get_oid(ecc.dp->oidSum, curveOID, oidSz) < 0) {
+                WOLFSSL_MSG("Error getting ECC curve OID");
+                wc_ecc_free(&ecc);
+                return BAD_FUNC_ARG;
+        }
         }
         else {
-            WOLFSSL_MSG("GetKeyOID wc_ecc_init_ex failed");
-        }
-    }
-#endif /* HAVE_ECC */
-#ifdef HAVE_ED25519
+            WOLFSSL_MSG("Not ECC DER key either");
+        }
+        wc_ecc_free(&ecc);
+    }
+#endif /* HAVE_ECC && !NO_ASN_CRYPT */
+#if defined(HAVE_ED25519) && !defined(NO_ASN_CRYPT)
     if (*algoID != RSAk && *algoID != ECDSAk) {
+        ed25519_key ed25519;
+
+        tmpIdx = 0;
         if (wc_ed25519_init(&ed25519) == 0) {
             if (wc_Ed25519PrivateKeyDecode(key, &tmpIdx, &ed25519, keySz)
                                                                          == 0) {
                 *algoID = ED25519k;
-            }
-            else {
+    }
+    else {
                 WOLFSSL_MSG("Not ED25519 DER key");
-            }
+    }
             wc_ed25519_free(&ed25519);
-        }
+    }
         else {
             WOLFSSL_MSG("GetKeyOID wc_ed25519_init failed");
         }
     }
-#endif
+#endif /* HAVE_ED25519 && !NO_ASN_CRYPT */
 
     /* if flag is not set then is neither RSA or ECC key that could be
@@ -2514 +2842 @@
     }
 
+    (void)tmpIdx;
     (void)curveOID;
     (void)oidSz;
+    (void)keySz;
+    (void)heap;
 
     return 1;
 }
 
+#define PKCS8_MIN_BLOCK_SIZE 8
+static int Pkcs8Pad(byte* buf, int sz, int blockSz)
+        {
+    int i, padSz;
+
+    /* calculate pad size */
+    padSz = blockSz - (sz & (blockSz - 1));
+
+    /* pad with padSz value */
+    if (buf) {
+        for (i = 0; i < padSz; i++) {
+            buf[sz+i] = (byte)(padSz & 0xFF);
+        }
+            }
+
+    /* return adjusted length */
+    return sz + padSz;
+        }
+
+/*
+ * Used when creating PKCS12 shrouded key bags
+ * vPKCS is the version of PKCS to use
+ * vAlgo is the algorithm version to use
+ *
+ * if salt is NULL a random number is generated
+ *
+ * returns the size of encrypted data on success
+ */
+int UnTraditionalEnc(byte* key, word32 keySz, byte* out, word32* outSz,
+        const char* password, int passwordSz, int vPKCS, int vAlgo,
+        byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap)
+        {
+    int algoID = 0;
+    byte*  tmp;
+    word32 tmpSz = 0;
+    word32 sz;
+    word32 seqSz;
+    word32 inOutIdx = 0;
+    word32 totalSz = 0;
+    int    version, id;
+    int    ret;
+    int    blockSz = 0;
+
+    const byte* curveOID = NULL;
+    word32 oidSz   = 0;
+
+#ifdef WOLFSSL_SMALL_STACK
+    byte*  saltTmp = NULL;
+    byte*  cbcIv   = NULL;
+#else
+    byte   saltTmp[MAX_IV_SIZE];
+    byte   cbcIv[MAX_IV_SIZE];
+#endif
+
+    WOLFSSL_ENTER("UnTraditionalEnc()");
+
+    if (saltSz > MAX_SALT_SIZE)
+        return ASN_PARSE_E;
+
+
+    inOutIdx += MAX_SEQ_SZ; /* leave room for size of finished shroud */
+    if (CheckAlgo(vPKCS, vAlgo, &id, &version, &blockSz) < 0) {
+        WOLFSSL_MSG("Bad/Unsupported algorithm ID");
+        return ASN_INPUT_E;  /* Algo ID error */
+            }
+
+    if (out != NULL) {
+        if (*outSz < inOutIdx + MAX_ALGO_SZ + MAX_SALT_SIZE + MAX_SEQ_SZ + 1 +
+                MAX_LENGTH_SZ + MAX_SHORT_SZ + 1)
+                return BUFFER_E;
+
+        if (version == PKCS5v2) {
+            WOLFSSL_MSG("PKCS5v2 Not supported yet\n");
+            return ASN_VERSION_E;
+        }
+
+        if (salt == NULL || saltSz <= 0) {
+            saltSz = 8;
+        #ifdef WOLFSSL_SMALL_STACK
+            saltTmp = (byte*)XMALLOC(saltSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+            if (saltTmp == NULL)
+                return MEMORY_E;
+        #endif
+            salt = saltTmp;
+
+            if ((ret = wc_RNG_GenerateBlock(rng, saltTmp, saltSz)) != 0) {
+                WOLFSSL_MSG("Error generating random salt");
+#ifdef WOLFSSL_SMALL_STACK
+                if (saltTmp != NULL)
+                    XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+        }
+
+
+        /* leave room for a sequence (contains salt and iterations int) */
+        inOutIdx += MAX_SEQ_SZ; sz = 0;
+        inOutIdx += MAX_ALGO_SZ;
+
+        /* place salt in buffer */
+        out[inOutIdx++] = ASN_OCTET_STRING; sz++;
+        tmpSz = SetLength(saltSz, out + inOutIdx);
+        inOutIdx += tmpSz; sz += tmpSz;
+        XMEMCPY(out + inOutIdx, salt, saltSz);
+        inOutIdx += saltSz; sz += saltSz;
+
+        /* place iteration count in buffer */
+        ret = SetShortInt(out, &inOutIdx, itt, *outSz);
+        if (ret < 0) {
+            return ret;
+        }
+        sz += (word32)ret;
+
+        /* wind back index and set sequence then clean up buffer */
+        inOutIdx -= (sz + MAX_SEQ_SZ);
+        tmpSz = SetSequence(sz, out + inOutIdx);
+        XMEMMOVE(out + inOutIdx + tmpSz, out + inOutIdx + MAX_SEQ_SZ, sz);
+        totalSz += tmpSz + sz; sz += tmpSz;
+
+        /* add in algo ID */
+        inOutIdx -= MAX_ALGO_SZ;
+        tmpSz =  SetAlgoID(id, out + inOutIdx, oidPBEType, sz);
+        XMEMMOVE(out + inOutIdx + tmpSz, out + inOutIdx + MAX_ALGO_SZ, sz);
+        totalSz += tmpSz; inOutIdx += tmpSz + sz;
+
+        /* octet string containing encrypted key */
+        out[inOutIdx++] = ASN_OCTET_STRING; totalSz++;
+    }
+
+    /* check key type and get OID if ECC */
+    if ((ret = wc_GetKeyOID(key, keySz, &curveOID, &oidSz, &algoID, heap))< 0) {
+            return ret;
+    }
+
+    /* PKCS#8 wrapping around key */
+    if (wc_CreatePKCS8Key(NULL, &tmpSz, key, keySz, algoID, curveOID, oidSz)
+            != LENGTH_ONLY_E) {
+#ifdef WOLFSSL_SMALL_STACK
+        if (saltTmp != NULL)
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+        return MEMORY_E;
+            }
+
+    /* check if should return max size */
+    if (out == NULL) {
+        /* account for salt size */
+        if (salt == NULL || saltSz <= 0) {
+            tmpSz += MAX_SALT_SIZE;
+        }
+        else {
+            tmpSz += saltSz;
+        }
+
+        /* plus 3 for tags */
+        *outSz = tmpSz + MAX_ALGO_SZ + MAX_LENGTH_SZ +MAX_LENGTH_SZ + MAX_SEQ_SZ
+            + MAX_LENGTH_SZ + MAX_SEQ_SZ + 3;
+        return LENGTH_ONLY_E;
+        }
+
+    /* reserve buffer for crypto and make sure it supports full blocks */
+    tmp = (byte*)XMALLOC(tmpSz + (blockSz-1), heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (tmp == NULL) {
+    #ifdef WOLFSSL_SMALL_STACK
+        if (saltTmp != NULL)
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+        return MEMORY_E;
+    }
+
+    if ((ret = wc_CreatePKCS8Key(tmp, &tmpSz, key, keySz, algoID, curveOID,
+                    oidSz)) < 0) {
+        XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        WOLFSSL_MSG("Error wrapping key with PKCS#8");
+    #ifdef WOLFSSL_SMALL_STACK
+        if (saltTmp != NULL)
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    #endif
+        return ret;
+    }
+    tmpSz = ret;
+
+    /* adjust size to pad */
+    tmpSz = Pkcs8Pad(tmp, tmpSz, blockSz);
+
+#ifdef WOLFSSL_SMALL_STACK
+    cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (cbcIv == NULL) {
+        if (saltTmp != NULL)
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(salt, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return MEMORY_E;
+        }
+#endif
+
+    /* encrypt PKCS#8 wrapped key */
+    if ((ret = wc_CryptKey(password, passwordSz, salt, saltSz, itt, id,
+               tmp, tmpSz, version, cbcIv, 1)) < 0) {
+        XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        WOLFSSL_MSG("Error encrypting key");
+#ifdef WOLFSSL_SMALL_STACK
+        if (saltTmp != NULL)
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (cbcIv != NULL)
+            XFREE(cbcIv, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+        return ret;  /* encryption failure */
+    }
+    totalSz += tmpSz;
+
+#ifdef WOLFSSL_SMALL_STACK
+    if (saltTmp != NULL)
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (cbcIv != NULL)
+        XFREE(cbcIv, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    if (*outSz < inOutIdx + tmpSz + MAX_LENGTH_SZ) {
+        XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return BUFFER_E;
+}
+
+    /* set length of key and copy over encrypted key */
+    seqSz = SetLength(tmpSz, out + inOutIdx);
+    inOutIdx += seqSz; totalSz += seqSz;
+    XMEMCPY(out + inOutIdx, tmp, tmpSz);
+    XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+
+    /* set total size at beginning */
+    sz = SetSequence(totalSz, out);
+    XMEMMOVE(out + sz, out + MAX_SEQ_SZ, totalSz);
+
+    (void)rng;
+
+    return totalSz + sz;
+}
+
+static int GetAlgoV2(int encAlgId, const byte** oid, int *len, int* id,
+                     int *blkSz)
+{
+    int ret = 0;
+
+    switch (encAlgId) {
+#if !defined(NO_DES3) && !defined(NO_SHA)
+    case DESb:
+        *len = sizeof(blkDesCbcOid);
+        *oid = blkDesCbcOid;
+        *id = PBE_SHA1_DES;
+        *blkSz = 8;
+        break;
+    case DES3b:
+        *len = sizeof(blkDes3CbcOid);
+        *oid = blkDes3CbcOid;
+        *id = PBE_SHA1_DES3;
+        *blkSz = 8;
+        break;
+#endif
+#if defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC)
+    case AES256CBCb:
+        *len = sizeof(blkAes256CbcOid);
+        *oid = blkAes256CbcOid;
+        *id = PBE_AES256_CBC;
+        *blkSz = 16;
+        break;
+#endif
+    default:
+        (void)len;
+        (void)oid;
+        (void)id;
+        (void)blkSz;
+        ret = ALGO_ID_E;
+    }
+
+    return ret;
+        }
+
+/* Converts Encrypted PKCS#8 to 'traditional' (i.e. PKCS#8 removed from
+ * decrypted key.)
+ */
+int TraditionalEnc(byte* key, word32 keySz, byte* out, word32* outSz,
+        const char* password, int passwordSz, int vPKCS, int vAlgo,
+        int encAlgId, byte* salt, word32 saltSz, int itt, WC_RNG* rng,
+        void* heap)
+{
+    int ret = 0;
+    int version, blockSz, id;
+    word32 idx = 0, encIdx;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* saltTmp = NULL;
+#else
+    byte saltTmp[MAX_SALT_SIZE];
+#endif
+    byte cbcIv[MAX_IV_SIZE];
+    byte *pkcs8Key = NULL;
+    word32 pkcs8KeySz, padSz = 0;
+    int algId;
+    const byte* curveOid = NULL;
+    word32 curveOidSz = 0;
+    const byte* pbeOid = NULL;
+    word32 pbeOidSz;
+    const byte* encOid = NULL;
+    int encOidSz = 0;
+    word32 pbeLen = 0, kdfLen = 0, encLen = 0;
+    word32 innerLen = 0, outerLen;
+
+    ret = CheckAlgo(vPKCS, vAlgo, &id, &version, &blockSz);
+    /* create random salt if one not provided */
+    if (ret == 0 && (salt == NULL || saltSz <= 0)) {
+        saltSz = 8;
+    #ifdef WOLFSSL_SMALL_STACK
+        saltTmp = (byte*)XMALLOC(saltSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (saltTmp == NULL)
+            return MEMORY_E;
+    #endif
+        salt = saltTmp;
+
+        if ((ret = wc_RNG_GenerateBlock(rng, saltTmp, saltSz)) != 0) {
+            WOLFSSL_MSG("Error generating random salt");
+        #ifdef WOLFSSL_SMALL_STACK
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        #endif
+            return ret;
+    }
+    }
+
+    if (ret == 0) {
+        /* check key type and get OID if ECC */
+        ret = wc_GetKeyOID(key, keySz, &curveOid, &curveOidSz, &algId, heap);
+        if (ret == 1)
+            ret = 0;
+                }
+    if (ret == 0) {
+        ret = wc_CreatePKCS8Key(NULL, &pkcs8KeySz, key, keySz, algId, curveOid,
+                                                                    curveOidSz);
+        if (ret == LENGTH_ONLY_E)
+            ret = 0;
+                }
+    if (ret == 0) {
+        pkcs8Key = (byte*)XMALLOC(pkcs8KeySz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        if (pkcs8Key == NULL)
+            ret = MEMORY_E;
+            }
+    if (ret == 0) {
+        ret = wc_CreatePKCS8Key(pkcs8Key, &pkcs8KeySz, key, keySz, algId,
+                                                          curveOid, curveOidSz);
+        if (ret >= 0) {
+            pkcs8KeySz = ret;
+            ret = 0;
+            }
+        }
+
+    if (ret == 0 && version == PKCS5v2)
+        ret = GetAlgoV2(encAlgId, &encOid, &encOidSz, &id, &blockSz);
+
+    if (ret == 0) {
+        padSz = (blockSz - (pkcs8KeySz & (blockSz - 1))) & (blockSz - 1);
+        /* inner = OCT salt INT itt */
+        innerLen = 2 + saltSz + 2 + (itt < 256 ? 1 : 2);
+
+        if (version != PKCS5v2) {
+            pbeOid = OidFromId(id, oidPBEType, &pbeOidSz);
+            /* pbe = OBJ pbse1 SEQ [ inner ] */
+            pbeLen = 2 + pbeOidSz + 2 + innerLen;
+        }
+        else {
+            pbeOid = pbes2;
+            pbeOidSz = sizeof(pbes2);
+            /* kdf = OBJ pbkdf2 [ SEQ innerLen ] */
+            kdfLen = 2 + sizeof(pbkdf2Oid) + 2 + innerLen;
+            /* enc = OBJ enc_alg OCT iv */
+            encLen = 2 + encOidSz + 2 + blockSz;
+            /* pbe = OBJ pbse2 SEQ [ SEQ [ kdf ] SEQ [ enc ] ] */
+            pbeLen = 2 + sizeof(pbes2) + 2 + 2 + kdfLen + 2 + encLen;
+
+            ret = wc_RNG_GenerateBlock(rng, cbcIv, blockSz);
+        }
+    }
+    if (ret == 0) {
+        /* outer = SEQ [ pbe ] OCT encrypted_PKCS#8_key */
+        outerLen = 2 + pbeLen;
+        outerLen += SetOctetString(pkcs8KeySz + padSz, out);
+        outerLen += pkcs8KeySz + padSz;
+
+        idx += SetSequence(outerLen, out + idx);
+
+        encIdx = idx + outerLen - pkcs8KeySz - padSz;
+        /* Put Encrypted content in place. */
+        XMEMCPY(out + encIdx, pkcs8Key, pkcs8KeySz);
+        if (padSz > 0) {
+            XMEMSET(out + encIdx + pkcs8KeySz, padSz, padSz);
+            pkcs8KeySz += padSz;
+            }
+        ret = wc_CryptKey(password, passwordSz, salt, saltSz, itt, id,
+                                   out + encIdx, pkcs8KeySz, version, cbcIv, 1);
+            }
+    if (ret == 0) {
+        if (version != PKCS5v2) {
+            /* PBE algorithm */
+            idx += SetSequence(pbeLen, out + idx);
+            idx += SetObjectId(pbeOidSz, out + idx);
+            XMEMCPY(out + idx, pbeOid, pbeOidSz);
+            idx += pbeOidSz;
+        }
+        else {
+            /* PBES2 algorithm identifier */
+            idx += SetSequence(pbeLen, out + idx);
+            idx += SetObjectId(pbeOidSz, out + idx);
+            XMEMCPY(out + idx, pbeOid, pbeOidSz);
+            idx += pbeOidSz;
+            /* PBES2 Parameters: SEQ [ kdf ] SEQ [ enc ] */
+            idx += SetSequence(2 + kdfLen + 2 + encLen, out + idx);
+            /* KDF Algorithm Identifier */
+            idx += SetSequence(kdfLen, out + idx);
+            idx += SetObjectId(sizeof(pbkdf2Oid), out + idx);
+            XMEMCPY(out + idx, pbkdf2Oid, sizeof(pbkdf2Oid));
+            idx += sizeof(pbkdf2Oid);
+        }
+        idx += SetSequence(innerLen, out + idx);
+        idx += SetOctetString(saltSz, out + idx);
+        XMEMCPY(out + idx, salt, saltSz); idx += saltSz;
+        ret = SetShortInt(out, &idx, itt, *outSz);
+        if (ret > 0)
+            ret = 0;
+        }
+    if (ret == 0) {
+        if (version == PKCS5v2) {
+            /* Encryption Algorithm Identifier */
+            idx += SetSequence(encLen, out + idx);
+            idx += SetObjectId(encOidSz, out + idx);
+            XMEMCPY(out + idx, encOid, encOidSz);
+            idx += encOidSz;
+            /* Encryption Algorithm Parameter: CBC IV */
+            idx += SetOctetString(blockSz, out + idx);
+            XMEMCPY(out + idx, cbcIv, blockSz);
+            idx += blockSz;
+        }
+        idx += SetOctetString(pkcs8KeySz, out + idx);
+        /* Default PRF - no need to write out OID */
+        idx += pkcs8KeySz;
+
+        ret = idx;
+    }
+
+    if (pkcs8Key != NULL) {
+        ForceZero(pkcs8Key, pkcs8KeySz);
+        XFREE(pkcs8Key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+#ifdef WOLFSSL_SMALL_STACK
+    if (saltTmp != NULL) {
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+#endif
+
+    (void)rng;
+
+    return ret;
+}
 
 /* Remove Encrypted PKCS8 header, move beginning of traditional to beginning
    of input */
-int ToTraditionalEnc(byte* input, word32 sz,const char* password,int passwordSz)
-{
-    word32 inOutIdx = 0, oid;
+int ToTraditionalEnc(byte* input, word32 sz,const char* password,
+                     int passwordSz, word32* algId)
+{
+    word32 inOutIdx = 0, seqEnd, oid;
     int    ret = 0, first, second, length = 0, version, saltSz, id;
-    int    iterations = 0;
+    int    iterations = 0, keySz = 0;
 #ifdef WOLFSSL_SMALL_STACK
     byte*  salt = NULL;
@@ -2536 +3326 @@
 #endif
 
+    if (passwordSz < 0) {
+        WOLFSSL_MSG("Bad password size");
+        return BAD_FUNC_ARG;
+    }
+
     if (GetSequence(input, &inOutIdx, &length, sz) < 0) {
         ERROR_OUT(ASN_PARSE_E, exit_tte);
     }
 
-    if (GetAlgoId(input, &inOutIdx, &oid, oidSigType, sz) < 0) {
+    if (GetAlgoId(input, &inOutIdx, &oid, oidIgnoreType, sz) < 0) {
         ERROR_OUT(ASN_PARSE_E, exit_tte);
     }
@@ -2547 +3342 @@
     second = input[inOutIdx - 1];   /* version.algo, algo id last byte */
 
-    if (CheckAlgo(first, second, &id, &version) < 0) {
+    if (CheckAlgo(first, second, &id, &version, NULL) < 0) {
         ERROR_OUT(ASN_INPUT_E, exit_tte); /* Algo ID error */
     }
@@ -2568 +3363 @@
         ERROR_OUT(ASN_PARSE_E, exit_tte);
     }
+    /* Find the end of this SEQUENCE so we can check for the OPTIONAL and
+     * DEFAULT items. */
+    seqEnd = inOutIdx + length;
 
     ret = GetOctetString(input, &inOutIdx, &saltSz, sz);
@@ -2591 +3389 @@
     }
 
+    /* OPTIONAL key length */
+    if (seqEnd > inOutIdx && input[inOutIdx] == ASN_INTEGER) {
+        if (GetShortInt(input, &inOutIdx, &keySz, sz) < 0) {
+            ERROR_OUT(ASN_PARSE_E, exit_tte);
+        }
+    }
+
+    /* DEFAULT HMAC is SHA-1 */
+    if (seqEnd > inOutIdx) {
+        if (GetAlgoId(input, &inOutIdx, &oid, oidHmacType, sz) < 0) {
+            ERROR_OUT(ASN_PARSE_E, exit_tte);
+        }
+    }
+
 #ifdef WOLFSSL_SMALL_STACK
     cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -2600 +3412 @@
     if (version == PKCS5v2) {
         /* get encryption algo */
-        /* JOHN: New type. Need a little more research. */
         if (GetAlgoId(input, &inOutIdx, &oid, oidBlkType, sz) < 0) {
             ERROR_OUT(ASN_PARSE_E, exit_tte);
         }
 
-        if (CheckAlgoV2(oid, &id) < 0) {
+        if (CheckAlgoV2(oid, &id, NULL) < 0) {
             ERROR_OUT(ASN_PARSE_E, exit_tte); /* PKCS v2 algo id error */
         }
@@ -2625 +3436 @@
         goto exit_tte;
 
-    ret = DecryptKey(password, passwordSz, salt, saltSz, iterations, id,
-                                   input + inOutIdx, length, version, cbcIv);
+    ret = wc_CryptKey(password, passwordSz, salt, saltSz, iterations, id,
+                   input + inOutIdx, length, version, cbcIv, 0);
 
 exit_tte:
@@ -2636 +3447 @@
     if (ret == 0) {
         XMEMMOVE(input, input + inOutIdx, length);
-        ret = ToTraditional(input, length);
+        ret = ToTraditional_ex(input, length, algId);
     }
 
@@ -2642 +3453 @@
 }
 
-/* decrypt PKCS */
-int DecryptContent(byte* input, word32 sz,const char* password,int passwordSz)
-{
-    word32 inOutIdx = 0, oid;
+
+/* encrypt PKCS 12 content
+ *
+ * NOTE: if out is NULL then outSz is set with the total buffer size needed and
+ *       the error value LENGTH_ONLY_E is returned.
+ *
+ * input      data to encrypt
+ * inputSz    size of input buffer
+ * out        buffer to hold the result
+ * outSz      size of out buffer
+ * password   password if used. Can be NULL for no password
+ * passwordSz size of password buffer
+ * vPKCS      version of PKCS i.e. PKCS5v2
+ * vAlgo      algorithm version
+ * salt       buffer holding salt if used. If NULL then a random salt is created
+ * saltSz     size of salt buffer if it is not NULL
+ * itt        number of iterations used
+ * rng        random number generator to use
+ * heap       possible heap hint for mallocs/frees
+ *
+ * returns the total size of encrypted content on success.
+ */
+int EncryptContent(byte* input, word32 inputSz, byte* out, word32* outSz,
+        const char* password, int passwordSz, int vPKCS, int vAlgo,
+        byte* salt, word32 saltSz, int itt, WC_RNG* rng, void* heap)
+{
+    word32 sz;
+    word32 inOutIdx = 0;
+    word32 tmpIdx   = 0;
+    word32 totalSz  = 0;
+    word32 seqSz;
+    int    ret;
+    int    version, id, blockSz = 0;
+#ifdef WOLFSSL_SMALL_STACK
+    byte*  saltTmp = NULL;
+    byte*  cbcIv = NULL;
+#else
+    byte   saltTmp[MAX_SALT_SIZE];
+    byte   cbcIv[MAX_IV_SIZE];
+#endif
+
+    (void)heap;
+
+    WOLFSSL_ENTER("EncryptContent()");
+
+    if (CheckAlgo(vPKCS, vAlgo, &id, &version, &blockSz) < 0)
+        return ASN_INPUT_E;  /* Algo ID error */
+
+    if (version == PKCS5v2) {
+        WOLFSSL_MSG("PKCS#5 version 2 not supported yet");
+        return BAD_FUNC_ARG;
+        }
+
+    if (saltSz > MAX_SALT_SIZE)
+        return ASN_PARSE_E;
+
+    if (outSz == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (out == NULL) {
+        sz = inputSz;
+        switch (id) {
+        #if !defined(NO_DES3) && (!defined(NO_MD5) || !defined(NO_SHA))
+            case PBE_MD5_DES:
+            case PBE_SHA1_DES:
+            case PBE_SHA1_DES3:
+                /* set to block size of 8 for DES operations. This rounds up
+                 * to the nearest multiple of 8 */
+                sz &= 0xfffffff8;
+                sz += 8;
+                break;
+        #endif /* !NO_DES3 && (!NO_MD5 || !NO_SHA) */
+        #if !defined(NO_RC4) && !defined(NO_SHA)
+            case PBE_SHA1_RC4_128:
+                break;
+        #endif
+            case -1:
+                break;
+
+            default:
+                return ALGO_ID_E;
+        }
+
+        if (saltSz <= 0) {
+            sz += MAX_SALT_SIZE;
+        }
+        else {
+            sz += saltSz;
+        }
+
+        /* add 2 for tags */
+        totalSz = sz + MAX_ALGO_SZ + MAX_SEQ_SZ + MAX_LENGTH_SZ +
+            MAX_LENGTH_SZ + MAX_LENGTH_SZ + MAX_SHORT_SZ + 2;
+
+        /* adjust size to pad */
+        totalSz = Pkcs8Pad(NULL, totalSz, blockSz);
+
+        /* return result */
+        *outSz = totalSz;
+
+        return LENGTH_ONLY_E;
+    }
+
+    if (inOutIdx + MAX_ALGO_SZ + MAX_SEQ_SZ + 1 > *outSz)
+        return BUFFER_E;
+
+    sz = SetAlgoID(id, out + inOutIdx, oidPBEType, 0);
+    inOutIdx += sz; totalSz += sz;
+    tmpIdx = inOutIdx;
+    tmpIdx += MAX_SEQ_SZ; /* save room for salt and itter sequence */
+    out[tmpIdx++] = ASN_OCTET_STRING;
+
+    /* create random salt if one not provided */
+    if (salt == NULL || saltSz <= 0) {
+        saltSz = 8;
+    #ifdef WOLFSSL_SMALL_STACK
+        saltTmp = (byte*)XMALLOC(saltSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (saltTmp == NULL)
+            return MEMORY_E;
+    #endif
+        salt = saltTmp;
+
+        if ((ret = wc_RNG_GenerateBlock(rng, saltTmp, saltSz)) != 0) {
+            WOLFSSL_MSG("Error generating random salt");
+        #ifdef WOLFSSL_SMALL_STACK
+            XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        #endif
+            return ret;
+        }
+    }
+
+    if (tmpIdx + MAX_LENGTH_SZ + saltSz + MAX_SHORT_SZ > *outSz) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    #endif
+        return BUFFER_E;
+    }
+
+    sz = SetLength(saltSz, out + tmpIdx);
+    tmpIdx += sz;
+
+    XMEMCPY(out + tmpIdx, salt, saltSz);
+    tmpIdx += saltSz;
+
+    /* place iteration setting in buffer */
+    ret = SetShortInt(out, &tmpIdx, itt, *outSz);
+    if (ret < 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    #endif
+        return ret;
+    }
+
+    /* rewind and place sequence */
+    sz = tmpIdx - inOutIdx - MAX_SEQ_SZ;
+    seqSz = SetSequence(sz, out + inOutIdx);
+    XMEMMOVE(out + inOutIdx + seqSz, out + inOutIdx + MAX_SEQ_SZ, sz);
+    inOutIdx += seqSz; totalSz += seqSz;
+    inOutIdx += sz; totalSz += sz;
+
+#ifdef WOLFSSL_SMALL_STACK
+    cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (cbcIv == NULL) {
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return MEMORY_E;
+    }
+#endif
+
+    if (inOutIdx + 1 + MAX_LENGTH_SZ + inputSz > *outSz)
+        return BUFFER_E;
+
+    out[inOutIdx++] = ASN_CONTEXT_SPECIFIC | 0; totalSz++;
+    sz = SetLength(inputSz, out + inOutIdx);
+    inOutIdx += sz; totalSz += sz;
+
+    /* get pad size and verify buffer room */
+    sz = Pkcs8Pad(NULL, inputSz, blockSz);
+    if (sz + inOutIdx > *outSz)
+        return BUFFER_E;
+
+    /* copy input to output buffer and pad end */
+    XMEMCPY(out + inOutIdx, input, inputSz);
+    sz = Pkcs8Pad(out + inOutIdx, inputSz, blockSz);
+    totalSz += sz;
+
+    /* encrypt */
+    if ((ret = wc_CryptKey(password, passwordSz, salt, saltSz, itt, id,
+                   out + inOutIdx, sz, version, cbcIv, 1)) < 0) {
+
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(cbcIv,   heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    #endif
+        return ret;  /* encrypt failure */
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(cbcIv,   heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(saltTmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    (void)rng;
+
+    return totalSz;
+}
+
+
+/* decrypt PKCS
+ *
+ * NOTE: input buffer is overwritten with decrypted data!
+ *
+ * input[in/out] data to decrypt and results are written to
+ * sz            size of input buffer
+ * password      password if used. Can be NULL for no password
+ * passwordSz    size of password buffer
+ *
+ * returns the total size of decrypted content on success.
+ */
+int DecryptContent(byte* input, word32 sz,const char* password, int passwordSz)
+{
+    word32 inOutIdx = 0, seqEnd, oid;
     int    ret = 0;
     int    first, second, length = 0, version, saltSz, id;
-    int    iterations = 0;
+    int    iterations = 0, keySz = 0;
 #ifdef WOLFSSL_SMALL_STACK
     byte*  salt = NULL;
@@ -2657 +3686 @@
 #endif
 
-    if (GetAlgoId(input, &inOutIdx, &oid, oidSigType, sz) < 0) {
+    if (GetAlgoId(input, &inOutIdx, &oid, oidIgnoreType, sz) < 0) {
         ERROR_OUT(ASN_PARSE_E, exit_dc);
     }
@@ -2664 +3693 @@
     second = input[inOutIdx - 1];   /* version.algo, algo id last byte */
 
-    if (CheckAlgo(first, second, &id, &version) < 0) {
+    if (CheckAlgo(first, second, &id, &version, NULL) < 0) {
         ERROR_OUT(ASN_INPUT_E, exit_dc); /* Algo ID error */
     }
@@ -2685 +3714 @@
         ERROR_OUT(ASN_PARSE_E, exit_dc);
     }
+    /* Find the end of this SEQUENCE so we can check for the OPTIONAL and
+     * DEFAULT items. */
+    seqEnd = inOutIdx + length;
 
     ret = GetOctetString(input, &inOutIdx, &saltSz, sz);
@@ -2708 +3740 @@
     }
 
+    /* OPTIONAL key length */
+    if (seqEnd > inOutIdx && input[inOutIdx] == ASN_INTEGER) {
+        if (GetShortInt(input, &inOutIdx, &keySz, sz) < 0) {
+            ERROR_OUT(ASN_PARSE_E, exit_dc);
+        }
+    }
+
+    /* DEFAULT HMAC is SHA-1 */
+    if (seqEnd > inOutIdx) {
+        if (GetAlgoId(input, &inOutIdx, &oid, oidHmacType, sz) < 0) {
+            ERROR_OUT(ASN_PARSE_E, exit_dc);
+        }
+    }
+
 #ifdef WOLFSSL_SMALL_STACK
     cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -2717 +3763 @@
     if (version == PKCS5v2) {
         /* get encryption algo */
-        /* JOHN: New type. Need a little more research. */
         if (GetAlgoId(input, &inOutIdx, &oid, oidBlkType, sz) < 0) {
             ERROR_OUT(ASN_PARSE_E, exit_dc);
         }
 
-        if (CheckAlgoV2(oid, &id) < 0) {
+        if (CheckAlgoV2(oid, &id, NULL) < 0) {
             ERROR_OUT(ASN_PARSE_E, exit_dc); /* PKCS v2 algo id error */
         }
@@ -2730 +3775 @@
             goto exit_dc;
 
+        if (length > MAX_IV_SIZE) {
+            ERROR_OUT(ASN_PARSE_E, exit_dc);
+        }
+
         XMEMCPY(cbcIv, &input[inOutIdx], length);
         inOutIdx += length;
@@ -2742 +3791 @@
     }
 
-    ret = DecryptKey(password, passwordSz, salt, saltSz, iterations, id,
-                                   input + inOutIdx, length, version, cbcIv);
+    ret = wc_CryptKey(password, passwordSz, salt, saltSz, iterations, id,
+                   input + inOutIdx, length, version, cbcIv, 0);
 
 exit_dc:
@@ -2764 +3813 @@
 
 #ifndef HAVE_USER_RSA
-int wc_RsaPublicKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
-                       word32 inSz)
-{
+int wc_RsaPublicKeyDecode_ex(const byte* input, word32* inOutIdx, word32 inSz,
+    const byte** n, word32* nSz, const byte** e, word32* eSz)
+{
+    int ret = 0;
     int  length;
 #if defined(OPENSSL_EXTRA) || defined(RSA_DECODE_EXTRA)
     byte b;
 #endif
-    int ret;
-
-    if (input == NULL || inOutIdx == NULL || key == NULL)
+
+    if (input == NULL || inOutIdx == NULL)
         return BAD_FUNC_ARG;
 
     if (GetSequence(input, inOutIdx, &length, inSz) < 0)
         return ASN_PARSE_E;
-
-    key->type = RSA_PUBLIC;
 
 #if defined(OPENSSL_EXTRA) || defined(RSA_DECODE_EXTRA)
@@ -2795 +3842 @@
 
         /* Option NULL ASN.1 tag */
+        if (*inOutIdx  >= inSz) {
+            return BUFFER_E;
+        }
         if (input[*inOutIdx] == ASN_TAG_NULL) {
             ret = GetASNNull(input, inOutIdx, inSz);
@@ -2811 +3861 @@
 #endif /* OPENSSL_EXTRA */
 
-    if (GetInt(&key->n,  input, inOutIdx, inSz) < 0)
+    /* Get modulus */
+    ret = GetASNInt(input, inOutIdx, &length, inSz);
+    if (ret < 0) {
         return ASN_RSA_KEY_E;
-    if (GetInt(&key->e,  input, inOutIdx, inSz) < 0) {
-        mp_clear(&key->n);
+    }
+    if (nSz)
+        *nSz = length;
+    if (n)
+        *n = &input[*inOutIdx];
+    *inOutIdx += length;
+
+    /* Get exponent */
+    ret = GetASNInt(input, inOutIdx, &length, inSz);
+    if (ret < 0) {
         return ASN_RSA_KEY_E;
     }
-
-#ifdef WOLFSSL_XILINX_CRYPT
-    if (wc_InitRsaHw(key) != 0) {
-        return BAD_STATE_E;
-    }
-#endif
-
-    return 0;
+    if (eSz)
+        *eSz = length;
+    if (e)
+        *e = &input[*inOutIdx];
+    *inOutIdx += length;
+
+    return ret;
+    }
+
+int wc_RsaPublicKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
+                       word32 inSz)
+{
+    int ret;
+    const byte *n = NULL, *e = NULL;
+    word32 nSz = 0, eSz = 0;
+
+    if (key == NULL)
+        return BAD_FUNC_ARG;
+
+    ret = wc_RsaPublicKeyDecode_ex(input, inOutIdx, inSz, &n, &nSz, &e, &eSz);
+    if (ret == 0) {
+        ret = wc_RsaPublicKeyDecodeRaw(n, nSz, e, eSz, key);
+    }
+
+    return ret;
 }
 
@@ -2843 +3920 @@
         return ASN_GETINT_E;
     }
+#ifdef HAVE_WOLF_BIGINT
+    if ((int)nSz > 0 && wc_bigint_from_unsigned_bin(&key->n.raw, n, nSz) != 0) {
+        mp_clear(&key->n);
+        return ASN_GETINT_E;
+    }
+#endif /* HAVE_WOLF_BIGINT */
 
     if (mp_init(&key->e) != MP_OKAY) {
@@ -2854 +3937 @@
         return ASN_GETINT_E;
     }
+#ifdef HAVE_WOLF_BIGINT
+    if ((int)eSz > 0 && wc_bigint_from_unsigned_bin(&key->e.raw, e, eSz) != 0) {
+        mp_clear(&key->n);
+        mp_clear(&key->e);
+        return ASN_GETINT_E;
+    }
+#endif /* HAVE_WOLF_BIGINT */
 
 #ifdef WOLFSSL_XILINX_CRYPT
@@ -2864 +3954 @@
 }
 #endif /* HAVE_USER_RSA */
-#endif
+#endif /* !NO_RSA */
 
 #ifndef NO_DH
@@ -2994 +4084 @@
 
 /* Release Tmp DSA resources */
-static INLINE void FreeTmpDsas(byte** tmps, void* heap)
+static WC_INLINE void FreeTmpDsas(byte** tmps, void* heap)
 {
     int i;
@@ -3076 +4166 @@
 
 
-void InitDecodedCert(DecodedCert* cert, byte* source, word32 inSz, void* heap)
+void InitDecodedCert(DecodedCert* cert,
+                     const byte* source, word32 inSz, void* heap)
 {
     if (cert != NULL) {
@@ -3136 +4227 @@
         XFREE(cert->subjectCN, cert->heap, DYNAMIC_TYPE_SUBJECT_CN);
     if (cert->pubKeyStored == 1)
-        XFREE(cert->publicKey, cert->heap, DYNAMIC_TYPE_PUBLIC_KEY);
+        XFREE((void*)cert->publicKey, cert->heap, DYNAMIC_TYPE_PUBLIC_KEY);
     if (cert->weOwnAltNames && cert->altNames)
         FreeAltNames(cert->altNames, cert->heap);
@@ -3152 +4243 @@
     XFREE(cert->hwSerialNum, cert->heap, DYNAMIC_TYPE_X509_EXT);
 #endif /* WOLFSSL_SEP */
-#ifdef OPENSSL_EXTRA
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
     if (cert->issuerName.fullName != NULL)
         XFREE(cert->issuerName.fullName, cert->heap, DYNAMIC_TYPE_X509);
@@ -3231 +4322 @@
 {
     int length;
-#ifdef HAVE_NTRU
+#if defined(HAVE_ECC) || defined(HAVE_NTRU)
     int tmpIdx = cert->srcIdx;
 #endif
@@ -3264 +4355 @@
             word32      rc;
             word32      remaining = cert->maxIdx - cert->srcIdx;
+            byte*       publicKey;
 #ifdef WOLFSSL_SMALL_STACK
             byte*       keyBlob = NULL;
@@ -3277 +4369 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-            keyBlob = (byte*)XMALLOC(MAX_NTRU_KEY_SZ, NULL,
+            keyBlob = (byte*)XMALLOC(MAX_NTRU_KEY_SZ, cert->heap,
                                      DYNAMIC_TYPE_TMP_BUFFER);
             if (keyBlob == NULL)
@@ -3287 +4379 @@
             if (rc != NTRU_OK) {
 #ifdef WOLFSSL_SMALL_STACK
-                XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(keyBlob, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
                 return ASN_NTRU_KEY_E;
@@ -3294 +4386 @@
             if ( (next - key) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-                XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(keyBlob, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
                 return ASN_NTRU_KEY_E;
@@ -3301 +4393 @@
             cert->srcIdx = tmpIdx + (int)(next - key);
 
-            cert->publicKey = (byte*) XMALLOC(keyLen, cert->heap,
+            publicKey = (byte*)XMALLOC(keyLen, cert->heap,
                                               DYNAMIC_TYPE_PUBLIC_KEY);
-            if (cert->publicKey == NULL) {
+            if (publicKey == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-                XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(keyBlob, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
                 return MEMORY_E;
             }
-            XMEMCPY(cert->publicKey, keyBlob, keyLen);
+            XMEMCPY(publicKey, keyBlob, keyLen);
+            cert->publicKey = publicKey;
             cert->pubKeyStored = 1;
             cert->pubKeySize   = keyLen;
 
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(keyBlob, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -3324 +4417 @@
         {
             int ret;
-
+            byte seq[5];
+            int pubLen = length + 1 + SetLength(length, seq);
+            byte* publicKey;
+
+            if (cert->source[cert->srcIdx] !=
+                                             (ASN_SEQUENCE | ASN_CONSTRUCTED)) {
             if (GetObjectId(cert->source, &cert->srcIdx,
                             &cert->pkCurveOID, oidCurveType, cert->maxIdx) < 0)
@@ -3337 +4435 @@
             if (ret != 0)
                 return ret;
-
-            cert->publicKey = (byte*)XMALLOC(length, cert->heap,
+            }
+
+            publicKey = (byte*)XMALLOC(pubLen, cert->heap,
                                              DYNAMIC_TYPE_PUBLIC_KEY);
-            if (cert->publicKey == NULL)
+            if (publicKey == NULL)
                 return MEMORY_E;
-            XMEMCPY(cert->publicKey, &cert->source[cert->srcIdx], length);
+            XMEMCPY(publicKey, &cert->source[tmpIdx], pubLen);
+            cert->publicKey = publicKey;
             cert->pubKeyStored = 1;
-            cert->pubKeySize   = length;
-
-            cert->srcIdx += length;
+            cert->pubKeySize   = pubLen;
+
+            cert->srcIdx = tmpIdx + pubLen;
 
             return 0;
@@ -3354 +4454 @@
         case ED25519k:
         {
+            byte* publicKey;
             int ret;
 
@@ -3363 +4464 @@
                 return ret;
 
-            cert->publicKey = (byte*) XMALLOC(length, cert->heap,
+            publicKey = (byte*) XMALLOC(length, cert->heap,
                                               DYNAMIC_TYPE_PUBLIC_KEY);
-            if (cert->publicKey == NULL)
+            if (publicKey == NULL)
                 return MEMORY_E;
-            XMEMCPY(cert->publicKey, &cert->source[cert->srcIdx], length);
+            XMEMCPY(publicKey, &cert->source[cert->srcIdx], length);
+            cert->publicKey = publicKey;
             cert->pubKeyStored = 1;
             cert->pubKeySize   = length;
@@ -3380 +4482 @@
     }
 }
+
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+WOLFSSL_LOCAL int OBJ_sn2nid(const char *sn)
+{
+    static const struct {
+        const char *sn;
+        int  nid;
+    } sn2nid[] = {
+        {WOLFSSL_COMMON_NAME, NID_commonName},
+        {WOLFSSL_COUNTRY_NAME, NID_countryName},
+        {WOLFSSL_LOCALITY_NAME, NID_localityName},
+        {WOLFSSL_STATE_NAME, NID_stateOrProvinceName},
+        {WOLFSSL_ORG_NAME, NID_organizationName},
+        {WOLFSSL_ORGUNIT_NAME, NID_organizationalUnitName},
+        {WOLFSSL_EMAIL_ADDR, NID_emailAddress},
+        {NULL, -1}};
+
+    int i;
+    WOLFSSL_ENTER("OBJ_osn2nid");
+    #ifdef HAVE_ECC
+    /* Nginx uses this OpenSSL string. */
+    if (XSTRNCMP(sn, "prime256v1", 10) == 0)
+        sn = "SECP256R1";
+    if (XSTRNCMP(sn, "secp384r1", 10) == 0)
+        sn = "SECP384R1";
+    /* find based on name and return NID */
+    for (i = 0; i < ecc_sets[i].size; i++) {
+        if (XSTRNCMP(sn, ecc_sets[i].name, ECC_MAXNAME) == 0) {
+            return ecc_sets[i].id;
+        }
+    }
+    #endif
+
+    for(i=0; sn2nid[i].sn != NULL; i++) {
+        if(XSTRNCMP(sn, sn2nid[i].sn, XSTRLEN(sn2nid[i].sn)) == 0) {
+            return sn2nid[i].nid;
+        }
+    }
+
+    return NID_undef;
+}
+#endif
 
 /* process NAME, either issuer or subject */
@@ -3390 +4534 @@
     byte*  hash;
     word32 idx;
-    #ifdef OPENSSL_EXTRA
+    #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
         DecodedName* dName =
                   (nameType == ISSUER) ? &cert->issuerName : &cert->subjectName;
+        int dcnum = 0;
     #endif /* OPENSSL_EXTRA */
 
@@ -3404 +4549 @@
         full = cert->subject;
         hash = cert->subjectHash;
+    }
+
+    if (cert->srcIdx >= cert->maxIdx) {
+        return BUFFER_E;
     }
 
@@ -3421 +4570 @@
         return ASN_PARSE_E;
 
-#ifdef NO_SHA
-    ret = wc_Sha256Hash(&cert->source[idx], length + cert->srcIdx - idx, hash);
-#else
-    ret = wc_ShaHash(&cert->source[idx], length + cert->srcIdx - idx, hash);
-#endif
+    ret = CalcHashId(&cert->source[idx], length + cert->srcIdx - idx, hash);
     if (ret != 0)
         return ret;
@@ -3432 +4577 @@
     idx = 0;
 
-#ifdef HAVE_PKCS7
+#if defined(HAVE_PKCS7) || defined(WOLFSSL_CERT_EXT)
     /* store pointer to raw issuer */
     if (nameType == ISSUER) {
@@ -3471 +4616 @@
         /* v1 name types */
         if (joint[0] == 0x55 && joint[1] == 0x04) {
+            const char*  copy = NULL;
+            int    strLen;
             byte   id;
-            byte   copy = FALSE;
-            int    strLen;
 
             cert->srcIdx += 2;
@@ -3496 +4641 @@
                 }
 
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/CN=", 4);
-                    idx += 4;
-                    copy = TRUE;
-                }
-                #ifdef OPENSSL_EXTRA
+                copy = WOLFSSL_COMMON_NAME;
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->cnIdx = cert->srcIdx;
                     dName->cnLen = strLen;
@@ -3507 +4648 @@
             }
             else if (id == ASN_SUR_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/SN=", 4);
-                    idx += 4;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_SUR_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3519 +4656 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->snIdx = cert->srcIdx;
                     dName->snLen = strLen;
@@ -3525 +4662 @@
             }
             else if (id == ASN_COUNTRY_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/C=", 3);
-                    idx += 3;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_COUNTRY_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3537 +4670 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->cIdx = cert->srcIdx;
                     dName->cLen = strLen;
@@ -3543 +4676 @@
             }
             else if (id == ASN_LOCALITY_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/L=", 3);
-                    idx += 3;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_LOCALITY_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3555 +4684 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->lIdx = cert->srcIdx;
                     dName->lLen = strLen;
@@ -3561 +4690 @@
             }
             else if (id == ASN_STATE_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/ST=", 4);
-                    idx += 4;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_STATE_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3573 +4698 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->stIdx = cert->srcIdx;
                     dName->stLen = strLen;
@@ -3579 +4704 @@
             }
             else if (id == ASN_ORG_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/O=", 3);
-                    idx += 3;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_ORG_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3591 +4712 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->oIdx = cert->srcIdx;
                     dName->oLen = strLen;
@@ -3597 +4718 @@
             }
             else if (id == ASN_ORGUNIT_NAME) {
-                if (!tooBig) {
-                    XMEMCPY(&full[idx], "/OU=", 4);
-                    idx += 4;
-                    copy = TRUE;
-                }
+                copy = WOLFSSL_ORGUNIT_NAME;
                 #ifdef WOLFSSL_CERT_GEN
                     if (nameType == SUBJECT) {
@@ -3609 +4726 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->ouIdx = cert->srcIdx;
                     dName->ouLen = strLen;
@@ -3615 +4732 @@
             }
             else if (id == ASN_SERIAL_NUMBER) {
-                if (!tooBig) {
-                   XMEMCPY(&full[idx], "/serialNumber=", 14);
-                   idx += 14;
-                   copy = TRUE;
+                copy = WOLFSSL_SERIAL_NUMBER;
+                #ifdef WOLFSSL_CERT_GEN
+                    if (nameType == SUBJECT) {
+                        cert->subjectSND = (char*)&cert->source[cert->srcIdx];
+                        cert->subjectSNDLen = strLen;
+                        cert->subjectSNDEnc = b;
                 }
-                #ifdef OPENSSL_EXTRA
+                #endif /* WOLFSSL_CERT_GEN */
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->snIdx = cert->srcIdx;
                     dName->snLen = strLen;
                 #endif /* OPENSSL_EXTRA */
             }
-
+        #ifdef WOLFSSL_CERT_EXT
+            else if (id == ASN_BUS_CAT) {
+                copy = WOLFSSL_BUS_CAT;
+            #ifdef WOLFSSL_CERT_GEN
+                if (nameType == SUBJECT) {
+                    cert->subjectBC = (char*)&cert->source[cert->srcIdx];
+                    cert->subjectBCLen = strLen;
+                    cert->subjectBCEnc = b;
+                }
+            #endif /* WOLFSSL_CERT_GEN */
+            #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+                dName->bcIdx = cert->srcIdx;
+                dName->bcLen = strLen;
+            #endif /* OPENSSL_EXTRA */
+            }
+        #endif /* WOLFSSL_CERT_EXT */
             if (copy && !tooBig) {
+                XMEMCPY(&full[idx], copy, XSTRLEN(copy));
+                idx += (word32)XSTRLEN(copy);
+            #ifdef WOLFSSL_WPAS
+                full[idx] = '=';
+                idx++;
+            #endif
                 XMEMCPY(&full[idx], &cert->source[cert->srcIdx], strLen);
                 idx += strLen;
@@ -3633 +4774 @@
             cert->srcIdx += strLen;
         }
+    #ifdef WOLFSSL_CERT_EXT
+        else if ((0 == XMEMCMP(&cert->source[cert->srcIdx], ASN_JOI_PREFIX,
+                               XSTRLEN(ASN_JOI_PREFIX))) &&
+                 ((cert->source[cert->srcIdx + XSTRLEN(ASN_JOI_PREFIX)] ==
+                         ASN_JOI_C) ||
+                  (cert->source[cert->srcIdx + XSTRLEN(ASN_JOI_PREFIX)] ==
+                          ASN_JOI_ST)))
+        {
+            int strLen;
+            byte id;
+            const char* copy = NULL;
+
+            cert->srcIdx += 10;
+            id = cert->source[cert->srcIdx++];
+            b = cert->source[cert->srcIdx++]; /* encoding */
+
+            if (GetLength(cert->source, &cert->srcIdx, &strLen,
+                          cert->maxIdx) < 0)
+                return ASN_PARSE_E;
+
+            if ((strLen + strlen(WOLFSSL_JOI_ST)) > (ASN_NAME_MAX - idx)) {
+                WOLFSSL_MSG("ASN Name too big, skipping");
+                tooBig = TRUE;
+            }
+
+            /* Check for jurisdiction of incorporation country name */
+            if (id == ASN_JOI_C) {
+                copy = WOLFSSL_JOI_C;
+                #ifdef WOLFSSL_CERT_GEN
+                    if (nameType == SUBJECT) {
+                        cert->subjectJC = (char*)&cert->source[cert->srcIdx];
+                        cert->subjectJCLen = strLen;
+                        cert->subjectJCEnc = b;
+                    }
+                #endif /* WOLFSSL_CERT_GEN */
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+                    dName->jcIdx = cert->srcIdx;
+                    dName->jcLen = strLen;
+                #endif /* OPENSSL_EXTRA */
+            }
+
+            /* Check for jurisdiction of incorporation state name */
+            else if (id == ASN_JOI_ST) {
+                copy = WOLFSSL_JOI_ST;
+                #ifdef WOLFSSL_CERT_GEN
+                    if (nameType == SUBJECT) {
+                        cert->subjectJS = (char*)&cert->source[cert->srcIdx];
+                        cert->subjectJSLen = strLen;
+                        cert->subjectJSEnc = b;
+                    }
+                #endif /* WOLFSSL_CERT_GEN */
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+                    dName->jsIdx = cert->srcIdx;
+                    dName->jsLen = strLen;
+                #endif /* OPENSSL_EXTRA */
+            }
+
+            if ((copy != NULL) && (tooBig != 1)) {
+                XMEMCPY(&full[idx], copy, XSTRLEN(copy));
+                idx += (word32)XSTRLEN(copy);
+            #ifdef WOLFSSL_WPAS
+                full[idx] = '=';
+                idx++;
+            #endif
+                XMEMCPY(&full[idx], &cert->source[cert->srcIdx], strLen);
+                idx += strLen;
+            }
+
+            cert->srcIdx += strLen;
+        }
+    #endif /* WOLFSSL_CERT_EXT */
         else {
             /* skip */
             byte email = FALSE;
-            byte uid   = FALSE;
+            byte pilot = FALSE;
+            byte id    = 0;
             int  adv;
 
@@ -3642 +4855 @@
                 email = TRUE;
 
-            if (joint[0] == 0x9  && joint[1] == 0x92)  /* uid id hdr */
-                uid = TRUE;
+            if (joint[0] == 0x9  && joint[1] == 0x92) { /* uid id hdr */
+                /* last value of OID is the type of pilot attribute */
+                id    = cert->source[cert->srcIdx + oidSz - 1];
+                pilot = TRUE;
+            }
 
             cert->srcIdx += oidSz + 1;
@@ -3671 +4887 @@
                     }
                 #endif /* WOLFSSL_CERT_GEN */
-                #ifdef OPENSSL_EXTRA
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     dName->emailIdx = cert->srcIdx;
                     dName->emailLen = adv;
@@ -3685 +4901 @@
                             return MEMORY_E;
                         }
+                        emailName->type = 0;
                         emailName->name = (char*)XMALLOC(adv + 1,
                                               cert->heap, DYNAMIC_TYPE_ALTNAME);
@@ -3692 +4909 @@
                             return MEMORY_E;
                         }
+                        emailName->len = adv;
                         XMEMCPY(emailName->name,
                                               &cert->source[cert->srcIdx], adv);
-                        emailName->name[adv] = 0;
+                        emailName->name[adv] = '\0';
 
                         emailName->next = cert->altEmailNames;
@@ -3706 +4924 @@
             }
 
-            if (uid) {
+            if (pilot) {
                 if ( (5 + adv) > (int)(ASN_NAME_MAX - idx)) {
                     WOLFSSL_MSG("ASN name too big, skipping");
@@ -3712 +4930 @@
                 }
                 if (!tooBig) {
+                    switch (id) {
+                        case ASN_USER_ID:
                     XMEMCPY(&full[idx], "/UID=", 5);
                     idx += 5;
-
+                        #if defined(OPENSSL_EXTRA) || \
+                            defined(OPENSSL_EXTRA_X509_SMALL)
+                            dName->uidIdx = cert->srcIdx;
+                            dName->uidLen = adv;
+                        #endif /* OPENSSL_EXTRA */
+                            break;
+
+                        case ASN_DOMAIN_COMPONENT:
+                            XMEMCPY(&full[idx], "/DC=", 4);
+                            idx += 4;
+                        #if defined(OPENSSL_EXTRA) || \
+                            defined(OPENSSL_EXTRA_X509_SMALL)
+                            dName->dcIdx[dcnum] = cert->srcIdx;
+                            dName->dcLen[dcnum] = adv;
+                            dName->dcNum = dcnum + 1;
+                            dcnum++;
+                        #endif /* OPENSSL_EXTRA */
+                            break;
+
+                        default:
+                            WOLFSSL_MSG("Unknown pilot attribute type");
+                            return ASN_PARSE_E;
+                    }
                     XMEMCPY(&full[idx], &cert->source[cert->srcIdx], adv);
                     idx += adv;
                 }
-                #ifdef OPENSSL_EXTRA
-                    dName->uidIdx = cert->srcIdx;
-                    dName->uidLen = adv;
-                #endif /* OPENSSL_EXTRA */
             }
 
@@ -3729 +4967 @@
     full[idx++] = 0;
 
-    #ifdef OPENSSL_EXTRA
+    #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
     {
         int totalLen = 0;
+        int i = 0;
 
         if (dName->cnLen != 0)
@@ -3753 +4992 @@
         if (dName->serialLen != 0)
             totalLen += dName->serialLen + 14;
+        if (dName->dcNum != 0){
+            for (i = 0;i < dName->dcNum;i++)
+                totalLen += dName->dcLen[i] + 4;
+        }
 
         dName->fullName = (char*)XMALLOC(totalLen + 1, cert->heap,
@@ -3761 +5004 @@
             if (dName->cnLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/CN=", 4);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_COMMON_NAME, 4);
+                dName->cnNid = OBJ_sn2nid((const char *)WOLFSSL_COMMON_NAME);
                 idx += 4;
                 XMEMCPY(&dName->fullName[idx],
@@ -3770 +5014 @@
             if (dName->snLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/SN=", 4);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_SUR_NAME, 4);
+                dName->snNid = OBJ_sn2nid((const char *)WOLFSSL_SUR_NAME);
                 idx += 4;
                 XMEMCPY(&dName->fullName[idx],
@@ -3779 +5024 @@
             if (dName->cLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/C=", 3);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_COUNTRY_NAME, 3);
+                dName->cNid = OBJ_sn2nid((const char *)WOLFSSL_COUNTRY_NAME);
                 idx += 3;
                 XMEMCPY(&dName->fullName[idx],
@@ -3788 +5034 @@
             if (dName->lLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/L=", 3);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_LOCALITY_NAME, 3);
+                dName->lNid = OBJ_sn2nid((const char *)WOLFSSL_LOCALITY_NAME);
                 idx += 3;
                 XMEMCPY(&dName->fullName[idx],
@@ -3797 +5044 @@
             if (dName->stLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/ST=", 4);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_STATE_NAME, 4);
+                dName->stNid = OBJ_sn2nid((const char *)WOLFSSL_STATE_NAME);
                 idx += 4;
                 XMEMCPY(&dName->fullName[idx],
@@ -3806 +5054 @@
             if (dName->oLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/O=", 3);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_ORG_NAME, 3);
+                dName->oNid = OBJ_sn2nid((const char *)WOLFSSL_ORG_NAME);
                 idx += 3;
                 XMEMCPY(&dName->fullName[idx],
@@ -3815 +5064 @@
             if (dName->ouLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/OU=", 4);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_ORGUNIT_NAME, 4);
+                dName->ouNid = OBJ_sn2nid((const char *)WOLFSSL_ORGUNIT_NAME);
                 idx += 4;
                 XMEMCPY(&dName->fullName[idx],
@@ -3825 +5075 @@
                 dName->entryCount++;
                 XMEMCPY(&dName->fullName[idx], "/emailAddress=", 14);
+                dName->emailNid = OBJ_sn2nid((const char *)"/emailAddress=");
                 idx += 14;
                 XMEMCPY(&dName->fullName[idx],
@@ -3831 +5082 @@
                 idx += dName->emailLen;
             }
+            for (i = 0;i < dName->dcNum;i++){
+                if (dName->dcLen[i] != 0) {
+                    dName->entryCount++;
+                    XMEMCPY(&dName->fullName[idx], WOLFSSL_DOMAIN_COMPONENT, 4);
+                    idx += 4;
+                    XMEMCPY(&dName->fullName[idx],
+                                    &cert->source[dName->dcIdx[i]], dName->dcLen[i]);
+                    dName->dcIdx[i] = idx;
+                    idx += dName->dcLen[i];
+                }
+            }
             if (dName->uidLen != 0) {
                 dName->entryCount++;
                 XMEMCPY(&dName->fullName[idx], "/UID=", 5);
+                dName->uidNid = OBJ_sn2nid((const char *)"/UID=");
                 idx += 5;
                 XMEMCPY(&dName->fullName[idx],
@@ -3842 +5105 @@
             if (dName->serialLen != 0) {
                 dName->entryCount++;
-                XMEMCPY(&dName->fullName[idx], "/serialNumber=", 14);
+                XMEMCPY(&dName->fullName[idx], WOLFSSL_SERIAL_NUMBER, 14);
+                dName->serialNid = OBJ_sn2nid((const char *)WOLFSSL_SERIAL_NUMBER);
                 idx += 14;
                 XMEMCPY(&dName->fullName[idx],
@@ -3860 +5124 @@
 
 #ifndef NO_ASN_TIME
-#if !defined(NO_TIME_H) && defined(USE_WOLF_VALIDDATE)
-
-/* to the second */
-static int DateGreaterThan(const struct tm* a, const struct tm* b)
-{
-    if (a->tm_year > b->tm_year)
-        return 1;
-
-    if (a->tm_year == b->tm_year && a->tm_mon > b->tm_mon)
-        return 1;
-
-    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
-           a->tm_mday > b->tm_mday)
-        return 1;
-
-    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
-        a->tm_mday == b->tm_mday && a->tm_hour > b->tm_hour)
-        return 1;
-
-    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
-        a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
-        a->tm_min > b->tm_min)
-        return 1;
-
-    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
-        a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
-        a->tm_min  == b->tm_min  && a->tm_sec > b->tm_sec)
-        return 1;
-
-    return 0; /* false */
-}
-
-
-static INLINE int DateLessThan(const struct tm* a, const struct tm* b)
-{
-    return DateGreaterThan(b,a);
-}
-
-
-#if defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
-int GetTimeString(byte* date, int format, char* buf, int len)
-{
-    struct tm t;
-    int idx = 0;
-
-    if (!ExtractDate(date, format, &t, &idx)) {
-        return 0;
-    }
-
-    if (date[idx] != 'Z') {
-        WOLFSSL_MSG("UTCtime, not Zulu") ;
-        return 0;
-    }
-
-    /* place month in buffer */
-    buf[0] = '\0';
-    switch(t.tm_mon) {
-        case 0:  XSTRNCAT(buf, "Jan ", 4); break;
-        case 1:  XSTRNCAT(buf, "Feb ", 4); break;
-        case 2:  XSTRNCAT(buf, "Mar ", 4); break;
-        case 3:  XSTRNCAT(buf, "Apr ", 4); break;
-        case 4:  XSTRNCAT(buf, "May ", 4); break;
-        case 5:  XSTRNCAT(buf, "Jun ", 4); break;
-        case 6:  XSTRNCAT(buf, "Jul ", 4); break;
-        case 7:  XSTRNCAT(buf, "Aug ", 4); break;
-        case 8:  XSTRNCAT(buf, "Sep ", 4); break;
-        case 9:  XSTRNCAT(buf, "Oct ", 4); break;
-        case 10: XSTRNCAT(buf, "Nov ", 4); break;
-        case 11: XSTRNCAT(buf, "Dec ", 4); break;
-        default:
-            return 0;
-
-    }
-    idx = 4; /* use idx now for char buffer */
-    buf[idx] = ' ';
-
-    XSNPRINTF(buf + idx, len - idx, "%2d %02d:%02d:%02d %d GMT",
-              t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, t.tm_year + 1900);
-
-    return 1;
-}
-#endif /* WOLFSSL_MYSQL_COMPATIBLE */
+
+/* two byte date/time, add to value */
+static WC_INLINE void GetTime(int* value, const byte* date, int* idx)
+{
+    int i = *idx;
+
+    *value += btoi(date[i++]) * 10;
+    *value += btoi(date[i++]);
+
+    *idx = i;
+}
 
 int ExtractDate(const unsigned char* date, unsigned char format,
@@ -3957 +5150 @@
         certTime->tm_year += btoi(date[*idx]) * 1000; *idx = *idx + 1;
         certTime->tm_year += btoi(date[*idx]) * 100;  *idx = *idx + 1;
-    }
+}
 
     /* adjust tm_year, tm_mon */
@@ -3970 +5163 @@
 }
 
+
+#if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || \
+    defined(OPENSSL_EXTRA) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
+int GetTimeString(byte* date, int format, char* buf, int len)
+{
+    struct tm t;
+    int idx = 0;
+
+    if (!ExtractDate(date, (unsigned char)format, &t, &idx)) {
+        return 0;
+    }
+
+    if (date[idx] != 'Z') {
+        WOLFSSL_MSG("UTCtime, not Zulu") ;
+        return 0;
+    }
+
+    /* place month in buffer */
+    buf[0] = '\0';
+    switch(t.tm_mon) {
+        case 0:  XSTRNCAT(buf, "Jan ", 5); break;
+        case 1:  XSTRNCAT(buf, "Feb ", 5); break;
+        case 2:  XSTRNCAT(buf, "Mar ", 5); break;
+        case 3:  XSTRNCAT(buf, "Apr ", 5); break;
+        case 4:  XSTRNCAT(buf, "May ", 5); break;
+        case 5:  XSTRNCAT(buf, "Jun ", 5); break;
+        case 6:  XSTRNCAT(buf, "Jul ", 5); break;
+        case 7:  XSTRNCAT(buf, "Aug ", 5); break;
+        case 8:  XSTRNCAT(buf, "Sep ", 5); break;
+        case 9:  XSTRNCAT(buf, "Oct ", 5); break;
+        case 10: XSTRNCAT(buf, "Nov ", 5); break;
+        case 11: XSTRNCAT(buf, "Dec ", 5); break;
+        default:
+            return 0;
+
+    }
+    idx = 4; /* use idx now for char buffer */
+
+    XSNPRINTF(buf + idx, len - idx, "%2d %02d:%02d:%02d %d GMT",
+              t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, t.tm_year + 1900);
+
+    return 1;
+}
+#endif /* OPENSSL_ALL || WOLFSSL_MYSQL_COMPATIBLE || WOLFSSL_NGINX || WOLFSSL_HAPROXY */
+
+
+#if !defined(NO_ASN_TIME) && defined(HAVE_PKCS7)
+
+/* Set current time string, either UTC or GeneralizedTime.
+ * (void*) tm should be a pointer to time_t, output is placed in buf.
+ *
+ * Return time string length placed in buf on success, negative on error */
+int GetAsnTimeString(void* currTime, byte* buf, word32 len)
+{
+    struct tm* ts      = NULL;
+    struct tm* tmpTime = NULL;
+#if defined(NEED_TMP_TIME)
+    struct tm tmpTimeStorage;
+    tmpTime = &tmpTimeStorage;
+#else
+    (void)tmpTime;
+#endif
+    byte* data_ptr  = buf;
+    word32 data_len = 0;
+    int year, mon, day, hour, mini, sec;
+
+    WOLFSSL_ENTER("SetAsnTimeString");
+
+    if (buf == NULL || len == 0)
+        return BAD_FUNC_ARG;
+
+    ts = (struct tm *)XGMTIME((time_t*)currTime, tmpTime);
+    if (ts == NULL){
+        WOLFSSL_MSG("failed to get time data.");
+        return ASN_TIME_E;
+    }
+
+    /* Note ASN_UTC_TIME_SIZE and ASN_GENERALIZED_TIME_SIZE include space for
+     * the null terminator. ASN encoded values leave off the terminator. */
+
+    if (ts->tm_year >= 50 && ts->tm_year < 150) {
+        /* UTC Time */
+        char utc_str[ASN_UTC_TIME_SIZE];
+        data_len = ASN_UTC_TIME_SIZE - 1 + 2;
+
+        if (len < data_len)
+            return BUFFER_E;
+
+        if (ts->tm_year >= 50 && ts->tm_year < 100) {
+            year = ts->tm_year;
+        } else if (ts->tm_year >= 100 && ts->tm_year < 150) {
+            year = ts->tm_year - 100;
+        }
+        else {
+            WOLFSSL_MSG("unsupported year range");
+            return BAD_FUNC_ARG;
+    }
+        mon  = ts->tm_mon + 1;
+        day  = ts->tm_mday;
+        hour = ts->tm_hour;
+        mini = ts->tm_min;
+        sec  = ts->tm_sec;
+        XSNPRINTF((char *)utc_str, ASN_UTC_TIME_SIZE,
+                  "%02d%02d%02d%02d%02d%02dZ", year, mon, day, hour, mini, sec);
+        *data_ptr = (byte) ASN_UTC_TIME; data_ptr++;
+        /* -1 below excludes null terminator */
+        *data_ptr = (byte) ASN_UTC_TIME_SIZE - 1; data_ptr++;
+        XMEMCPY(data_ptr,(byte *)utc_str, ASN_UTC_TIME_SIZE - 1);
+
+    } else {
+        /* GeneralizedTime */
+        char gt_str[ASN_GENERALIZED_TIME_SIZE];
+        data_len = ASN_GENERALIZED_TIME_SIZE - 1 + 2;
+
+        if (len < data_len)
+            return BUFFER_E;
+
+        year = ts->tm_year + 1900;
+        mon  = ts->tm_mon + 1;
+        day  = ts->tm_mday;
+        hour = ts->tm_hour;
+        mini = ts->tm_min;
+        sec  = ts->tm_sec;
+        XSNPRINTF((char *)gt_str, ASN_GENERALIZED_TIME_SIZE,
+                  "%4d%02d%02d%02d%02d%02dZ", year, mon, day, hour, mini, sec);
+        *data_ptr = (byte) ASN_GENERALIZED_TIME; data_ptr++;
+        /* -1 below excludes null terminator */
+        *data_ptr = (byte) ASN_GENERALIZED_TIME_SIZE - 1; data_ptr++;
+        XMEMCPY(data_ptr,(byte *)gt_str, ASN_GENERALIZED_TIME_SIZE - 1);
+    }
+
+    return data_len;
+}
+
+#endif /* !NO_ASN_TIME && HAVE_PKCS7 */
+
+
+#if defined(USE_WOLF_VALIDDATE)
+
+/* to the second */
+static int DateGreaterThan(const struct tm* a, const struct tm* b)
+{
+    if (a->tm_year > b->tm_year)
+        return 1;
+
+    if (a->tm_year == b->tm_year && a->tm_mon > b->tm_mon)
+        return 1;
+
+    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
+           a->tm_mday > b->tm_mday)
+        return 1;
+
+    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
+        a->tm_mday == b->tm_mday && a->tm_hour > b->tm_hour)
+        return 1;
+
+    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
+        a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
+        a->tm_min > b->tm_min)
+        return 1;
+
+    if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
+        a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
+        a->tm_min  == b->tm_min  && a->tm_sec > b->tm_sec)
+    return 1;
+
+    return 0; /* false */
+}
+
+
+static WC_INLINE int DateLessThan(const struct tm* a, const struct tm* b)
+{
+    return DateGreaterThan(b,a);
+}
 
 /* like atoi but only use first byte */
@@ -4046 +5413 @@
     return 1;
 }
-#endif /* !NO_TIME_H && USE_WOLF_VALIDDATE */
+#endif /* USE_WOLF_VALIDDATE */
 
 int wc_GetTime(void* timePtr, word32 timeSize)
@@ -4067 +5434 @@
 #endif /* !NO_ASN_TIME */
 
-static int GetDate(DecodedCert* cert, int dateType)
+
+/* Get date buffer, format and length. Returns 0=success or error */
+static int GetDateInfo(const byte* source, word32* idx, const byte** pDate,
+                        byte* pFormat, int* pLength, word32 maxIdx)
 {
     int    length;
+    byte format;
+
+    if (source == NULL || idx == NULL)
+        return BAD_FUNC_ARG;
+
+    /* get ASN format header */
+    if (*idx+1 > maxIdx)
+        return BUFFER_E;
+    format = source[*idx];
+    *idx += 1;
+    if (format != ASN_UTC_TIME && format != ASN_GENERALIZED_TIME)
+        return ASN_TIME_E;
+
+    /* get length */
+    if (GetLength(source, idx, &length, maxIdx) < 0)
+        return ASN_PARSE_E;
+    if (length > MAX_DATE_SIZE || length < MIN_DATE_SIZE)
+        return ASN_DATE_SZ_E;
+
+    /* return format, date and length */
+    if (pFormat)
+        *pFormat = format;
+    if (pDate)
+        *pDate = &source[*idx];
+    if (pLength)
+        *pLength = length;
+
+    *idx += length;
+
+    return 0;
+}
+
+static int GetDate(DecodedCert* cert, int dateType, int verify)
+{
+    int    ret, length;
+    const byte *datePtr = NULL;
     byte   date[MAX_DATE_SIZE];
-    byte   b;
+    byte   format;
     word32 startIdx = 0;
-
-    XMEMSET(date, 0, MAX_DATE_SIZE);
 
     if (dateType == BEFORE)
@@ -4082 +5486 @@
     startIdx = cert->srcIdx;
 
-    b = cert->source[cert->srcIdx++];
-    if (b != ASN_UTC_TIME && b != ASN_GENERALIZED_TIME)
-        return ASN_TIME_E;
-
-    if (GetLength(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
-        return ASN_PARSE_E;
-
-    if (length > MAX_DATE_SIZE || length < MIN_DATE_SIZE)
-        return ASN_DATE_SZ_E;
-
-    XMEMCPY(date, &cert->source[cert->srcIdx], length);
-    cert->srcIdx += length;
+    ret = GetDateInfo(cert->source, &cert->srcIdx, &datePtr, &format,
+                      &length, cert->maxIdx);
+    if (ret < 0)
+        return ret;
+
+    XMEMSET(date, 0, MAX_DATE_SIZE);
+    XMEMCPY(date, datePtr, length);
 
     if (dateType == BEFORE)
@@ -4101 +5500 @@
 
 #ifndef NO_ASN_TIME
-    if (!XVALIDATE_DATE(date, b, dateType)) {
+    if (verify != NO_VERIFY && !XVALIDATE_DATE(date, format, dateType)) {
         if (dateType == BEFORE)
             return ASN_BEFORE_DATE_E;
@@ -4107 +5506 @@
             return ASN_AFTER_DATE_E;
     }
+#else
+    (void)verify;
 #endif
 
@@ -4120 +5521 @@
         return ASN_PARSE_E;
 
-    if (GetDate(cert, BEFORE) < 0 && verify != NO_VERIFY)
+    if (GetDate(cert, BEFORE, verify) < 0)
         badDate = ASN_BEFORE_DATE_E;           /* continue parsing */
 
-    if (GetDate(cert, AFTER) < 0 && verify != NO_VERIFY)
+    if (GetDate(cert, AFTER, verify) < 0)
         return ASN_AFTER_DATE_E;
 
@@ -4131 +5532 @@
     return 0;
 }
+
+
+int wc_GetDateInfo(const byte* certDate, int certDateSz, const byte** date,
+    byte* format, int* length)
+{
+    int ret;
+    word32 idx = 0;
+
+    ret = GetDateInfo(certDate, &idx, date, format, length, certDateSz);
+    if (ret < 0)
+        return ret;
+
+    return 0;
+}
+
+#ifndef NO_ASN_TIME
+int wc_GetDateAsCalendarTime(const byte* date, int length, byte format,
+    struct tm* timearg)
+{
+    int idx = 0;
+    (void)length;
+    if (!ExtractDate(date, format, timearg, &idx))
+        return ASN_TIME_E;
+    return 0;
+}
+
+#if defined(WOLFSSL_CERT_GEN) && defined(WOLFSSL_ALT_NAMES)
+int wc_GetCertDates(Cert* cert, struct tm* before, struct tm* after)
+{
+    int ret = 0;
+    const byte* date;
+    byte format;
+    int length;
+
+    if (cert == NULL)
+        return BAD_FUNC_ARG;
+
+    if (before && cert->beforeDateSz > 0) {
+        ret = wc_GetDateInfo(cert->beforeDate, cert->beforeDateSz, &date,
+                             &format, &length);
+        if (ret == 0)
+            ret = wc_GetDateAsCalendarTime(date, length, format, before);
+    }
+    if (after && cert->afterDateSz > 0) {
+        ret = wc_GetDateInfo(cert->afterDate, cert->afterDateSz, &date,
+                             &format, &length);
+        if (ret == 0)
+            ret = wc_GetDateAsCalendarTime(date, length, format, after);
+    }
+
+    return ret;
+}
+#endif /* WOLFSSL_CERT_GEN && WOLFSSL_ALT_NAMES */
+#endif /* !NO_ASN_TIME */
 
 
@@ -4267 +5722 @@
 
 
-#if defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
+#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)
 
 static int SetCurve(ecc_key* key, byte* output)
@@ -4306 +5761 @@
 }
 
-#endif /* HAVE_ECC && (WOLFSSL_CERT_GEN || WOLFSSL_KEY_GEN) */
-
-
-static INLINE int IsSigAlgoECDSA(int algoOID)
+#endif /* HAVE_ECC && HAVE_ECC_KEY_EXPORT */
+
+
+#ifdef HAVE_ECC
+static WC_INLINE int IsSigAlgoECDSA(int algoOID)
 {
     /* ECDSA sigAlgo must not have ASN1 NULL parameters */
@@ -4319 +5775 @@
     return 0;
 }
+#endif
 
 WOLFSSL_LOCAL word32 SetAlgoID(int algoOID, byte* output, int type, int curveSz)
@@ -4328 +5785 @@
 
     tagSz = (type == oidHashType ||
-             (type == oidSigType && !IsSigAlgoECDSA(algoOID) &&
-                                         algoOID != ED25519k) ||
+             (type == oidSigType
+        #ifdef HAVE_ECC
+              && !IsSigAlgoECDSA(algoOID)
+        #endif
+        #ifdef HAVE_ED25519
+              && algoOID != ED25519k
+        #endif
+              ) ||
              (type == oidKeyType && algoOID == RSAk)) ? 2 : 0;
 
@@ -4375 +5838 @@
 int wc_GetCTC_HashOID(int type)
 {
-    switch (type) {
-#ifdef WOLFSSL_MD2
-        case MD2:
-            return MD2h;
-#endif
-#ifndef NO_MD5
-        case WC_MD5:
-            return MD5h;
-#endif
-#ifndef NO_SHA
-        case WC_SHA:
-            return SHAh;
-#endif
-#ifdef WOLFSSL_SHA224
-        case WC_SHA224:
-            return SHA224h;
-#endif
-#ifndef NO_SHA256
-        case WC_SHA256:
-            return SHA256h;
-#endif
-#ifdef WOLFSSL_SHA384
-        case WC_SHA384:
-            return SHA384h;
-#endif
-#ifdef WOLFSSL_SHA512
-        case WC_SHA512:
-            return SHA512h;
-#endif
-        default:
-            return 0;
-    };
+    int ret;
+    enum wc_HashType hType;
+
+    hType = wc_HashTypeConvert(type);
+    ret = wc_HashGetOID(hType);
+    if (ret < 0)
+        ret = 0; /* backwards compatibility */
+
+    return ret;
 }
 
@@ -4433 +5873 @@
     }
 #endif
+#ifndef NO_ASN_CRYPT
     if (sigCtx->key.ptr) {
         switch (sigCtx->keyOID) {
@@ -4458 +5899 @@
         sigCtx->key.ptr = NULL;
     }
+#endif
 
     /* reset state, we are done */
@@ -4463 +5905 @@
 }
 
+#ifndef NO_ASN_CRYPT
 static int HashForSignature(const byte* buf, word32 bufSz, word32 sigOID,
                             byte* digest, int* typeH, int* digestSz, int verify)
@@ -4549 +5992 @@
     return ret;
 }
+#endif /* !NO_ASN_CRYPT */
 
 /* Return codes: 0=Success, Negative (see error-crypt.h), ASN_SIG_CONFIRM_E */
@@ -4570 +6014 @@
     WOLFSSL_ENTER("ConfirmSignature");
 
+#ifndef NO_ASN_CRYPT
     switch (sigCtx->state) {
         case SIG_STATE_BEGIN:
         {
+            sigCtx->keyOID = keyOID; /* must set early for cleanup */
+
             sigCtx->digest = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, sigCtx->heap,
                                                     DYNAMIC_TYPE_DIGEST);
@@ -4597 +6044 @@
         case SIG_STATE_KEY:
         {
-            sigCtx->keyOID = keyOID;
-
             switch (keyOID) {
             #ifndef NO_RSA
@@ -4637 +6082 @@
                 case ECDSAk:
                 {
+                    word32 idx = 0;
+
                     sigCtx->verify = 0;
                     sigCtx->key.ecc = (ecc_key*)XMALLOC(sizeof(ecc_key),
@@ -4647 +6094 @@
                         goto exit_cs;
                     }
-                    if ((ret = wc_ecc_import_x963(key, keySz,
-                                                        sigCtx->key.ecc)) < 0) {
+                    ret = wc_EccPublicKeyDecode(key, &idx, sigCtx->key.ecc,
+                                                                         keySz);
+                    if (ret < 0) {
                         WOLFSSL_MSG("ASN Key import error ECC");
                         goto exit_cs;
@@ -4696 +6144 @@
         #ifdef WOLFSSL_ASYNC_CRYPT
             if (sigCtx->devId != INVALID_DEVID && sigCtx->asyncDev && sigCtx->asyncCtx) {
-                /* make sure event is intialized */
+                /* make sure event is initialized */
                 WOLF_EVENT* event = &sigCtx->asyncDev->event;
                 ret = wolfAsync_EventInit(event, WOLF_EVENT_TYPE_ASYNC_WOLFSSL,
@@ -4711 +6159 @@
                 case RSAk:
                 {
+                #ifdef HAVE_PK_CALLBACKS
+                    if (sigCtx->pkCbRsa) {
+                        ret = sigCtx->pkCbRsa(
+                                sigCtx->plain, sigSz, &sigCtx->out,
+                                key, keySz,
+                                sigCtx->pkCtxRsa);
+                    }
+                    else
+                #endif /* HAVE_PK_CALLBACKS */
+                    {
                     ret = wc_RsaSSL_VerifyInline(sigCtx->plain, sigSz,
                                                 &sigCtx->out, sigCtx->key.rsa);
+                    }
                     break;
                 }
@@ -4719 +6178 @@
                 case ECDSAk:
                 {
+                #ifdef HAVE_PK_CALLBACKS
+                    if (sigCtx->pkCbEcc) {
+                        ret = sigCtx->pkCbEcc(
+                                sig, sigSz,
+                                sigCtx->digest, sigCtx->digestSz,
+                                key, keySz, &sigCtx->verify,
+                                sigCtx->pkCtxEcc);
+                    }
+                    else
+                #endif /* HAVE_PK_CALLBACKS */
+                    {
                     ret = wc_ecc_verify_hash(sig, sigSz, sigCtx->digest,
-                        sigCtx->digestSz, &sigCtx->verify, sigCtx->key.ecc);
+                                            sigCtx->digestSz, &sigCtx->verify,
+                                            sigCtx->key.ecc);
+                    }
                     break;
                 }
@@ -4769 +6241 @@
                     encodedSigSz = wc_EncodeSignature(encodedSig,
                             sigCtx->digest, sigCtx->digestSz, sigCtx->typeH);
-                    if (encodedSigSz == verifySz &&
+                    if (encodedSigSz == verifySz && sigCtx->out != NULL &&
                         XMEMCMP(sigCtx->out, encodedSig, encodedSigSz) == 0) {
                         ret = 0;
@@ -4820 +6292 @@
 exit_cs:
 
+#endif /* !NO_ASN_CRYPT */
+
+    (void)keyOID;
+    (void)sigOID;
+
     WOLFSSL_LEAVE("ConfirmSignature", ret);
 
@@ -4911 +6388 @@
                     while (name != NULL) {
                         if (MatchBaseName(ASN_DNS_TYPE,
-                                          name->name, (int)XSTRLEN(name->name),
+                                          name->name, name->len,
                                           base->name, base->nameSz)) {
                             return 0;
@@ -4924 +6401 @@
                     while (name != NULL) {
                         if (MatchBaseName(ASN_RFC822_TYPE,
-                                          name->name, (int)XSTRLEN(name->name),
+                                          name->name, name->len,
                                           base->name, base->nameSz)) {
                             return 0;
@@ -4968 +6445 @@
                     while (name != NULL) {
                         matchDns = MatchBaseName(ASN_DNS_TYPE,
-                                          name->name, (int)XSTRLEN(name->name),
+                                          name->name, name->len,
                                           base->name, base->nameSz);
                         name = name->next;
@@ -4983 +6460 @@
                     while (name != NULL) {
                         matchEmail = MatchBaseName(ASN_DNS_TYPE,
-                                          name->name, (int)XSTRLEN(name->name),
+                                          name->name, name->len,
                                           base->name, base->nameSz);
                         name = name->next;
@@ -5017 +6494 @@
 #endif /* IGNORE_NAME_CONSTRAINTS */
 
-static int DecodeAltNames(byte* input, int sz, DecodedCert* cert)
+static int DecodeAltNames(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5056 +6533 @@
             }
 
+            dnsEntry->type = ASN_DNS_TYPE;
             dnsEntry->name = (char*)XMALLOC(strLen + 1, cert->heap,
                                          DYNAMIC_TYPE_ALTNAME);
@@ -5063 +6541 @@
                 return MEMORY_E;
             }
-
+            dnsEntry->len = strLen;
             XMEMCPY(dnsEntry->name, &input[idx], strLen);
             dnsEntry->name[strLen] = '\0';
@@ -5092 +6570 @@
             }
 
+            emailEntry->type = ASN_RFC822_TYPE;
             emailEntry->name = (char*)XMALLOC(strLen + 1, cert->heap,
                                          DYNAMIC_TYPE_ALTNAME);
@@ -5099 +6578 @@
                 return MEMORY_E;
             }
-
+            emailEntry->len = strLen;
             XMEMCPY(emailEntry->name, &input[idx], strLen);
             emailEntry->name[strLen] = '\0';
@@ -5105 +6584 @@
             emailEntry->next = cert->altEmailNames;
             cert->altEmailNames = emailEntry;
+
+            length -= strLen;
+            idx    += strLen;
+        }
+        else if (b == (ASN_CONTEXT_SPECIFIC | ASN_URI_TYPE)) {
+            DNS_entry* uriEntry;
+            int strLen;
+            word32 lenStartIdx = idx;
+
+            WOLFSSL_MSG("\tPutting URI into list but not using");
+            if (GetLength(input, &idx, &strLen, sz) < 0) {
+                WOLFSSL_MSG("\tfail: str length");
+                return ASN_PARSE_E;
+            }
+            length -= (idx - lenStartIdx);
+
+            /* check that strLen at index is not past input buffer */
+            if (strLen + (int)idx > sz) {
+                return BUFFER_E;
+            }
+
+        #ifndef WOLFSSL_NO_ASN_STRICT
+            /* Verify RFC 5280 Sec 4.2.1.6 rule:
+                "The name MUST NOT be a relative URI" */
+
+            {
+                int i;
+
+                /* skip past scheme (i.e http,ftp,...) finding first ':' char */
+                for (i = 0; i < strLen; i++) {
+                    if (input[idx + i] == ':') {
+                        break;
+                    }
+                    if (input[idx + i] == '/') {
+                        i = strLen; /* error, found relative path since '/' was
+                                     * encountered before ':'. Returning error
+                                     * value in next if statement. */
+                    }
+                }
+
+                /* test if no ':' char was found and test that the next two
+                 * chars are // to match the pattern "://" */
+                if (i >= strLen - 2 || (input[idx + i + 1] != '/' ||
+                                        input[idx + i + 2] != '/')) {
+                    WOLFSSL_MSG("\tAlt Name must be absolute URI");
+                    return ASN_ALT_NAME_E;
+                }
+            }
+        #endif
+
+            uriEntry = (DNS_entry*)XMALLOC(sizeof(DNS_entry), cert->heap,
+                                        DYNAMIC_TYPE_ALTNAME);
+            if (uriEntry == NULL) {
+                WOLFSSL_MSG("\tOut of Memory");
+                return MEMORY_E;
+            }
+
+            uriEntry->type = ASN_URI_TYPE;
+            uriEntry->name = (char*)XMALLOC(strLen + 1, cert->heap,
+                                         DYNAMIC_TYPE_ALTNAME);
+            if (uriEntry->name == NULL) {
+                WOLFSSL_MSG("\tOut of Memory");
+                XFREE(uriEntry, cert->heap, DYNAMIC_TYPE_ALTNAME);
+                return MEMORY_E;
+            }
+            uriEntry->len = strLen;
+            XMEMCPY(uriEntry->name, &input[idx], strLen);
+            uriEntry->name[strLen] = '\0';
+
+            uriEntry->next = cert->altNames;
+            cert->altNames = uriEntry;
 
             length -= strLen;
@@ -5201 +6751 @@
 }
 
-static int DecodeBasicCaConstraint(byte* input, int sz, DecodedCert* cert)
+static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5248 +6798 @@
     /* From RFC3280 SS4.2.1.7, GeneralName */
 
-static int DecodeCrlDist(byte* input, int sz, DecodedCert* cert)
+static int DecodeCrlDist(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5329 +6879 @@
 
 
-static int DecodeAuthInfo(byte* input, int sz, DecodedCert* cert)
+static int DecodeAuthInfo(const byte* input, int sz, DecodedCert* cert)
 /*
  *  Read the first of the Authority Information Access records. If there are
@@ -5375 +6925 @@
 
 
-static int DecodeAuthKeyId(byte* input, int sz, DecodedCert* cert)
+static int DecodeAuthKeyId(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5397 +6947 @@
     }
 
-#ifdef OPENSSL_EXTRA
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
     cert->extAuthKeyIdSrc = &input[idx];
     cert->extAuthKeyIdSz = length;
@@ -5405 +6955 @@
         XMEMCPY(cert->extAuthKeyId, input + idx, length);
     }
-    else {
-    #ifdef NO_SHA
-        ret = wc_Sha256Hash(input + idx, length, cert->extAuthKeyId);
-    #else
-        ret = wc_ShaHash(input + idx, length, cert->extAuthKeyId);
-    #endif
-    }
+    else
+        ret = CalcHashId(input + idx, length, cert->extAuthKeyId);
 
     return ret;
@@ -5417 +6962 @@
 
 
-static int DecodeSubjKeyId(byte* input, int sz, DecodedCert* cert)
+static int DecodeSubjKeyId(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5431 +6976 @@
         return ret;
 
-    #ifdef OPENSSL_EXTRA
+    #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
         cert->extSubjKeyIdSrc = &input[idx];
         cert->extSubjKeyIdSz = length;
     #endif /* OPENSSL_EXTRA */
 
-    if (length == SIGNER_DIGEST_SIZE) {
+    if (length == KEYID_SIZE) {
         XMEMCPY(cert->extSubjKeyId, input + idx, length);
     }
-    else {
-    #ifdef NO_SHA
-        ret = wc_Sha256Hash(input + idx, length, cert->extSubjKeyId);
-    #else
-        ret = wc_ShaHash(input + idx, length, cert->extSubjKeyId);
-    #endif
-    }
+    else
+        ret = CalcHashId(input + idx, length, cert->extSubjKeyId);
 
     return ret;
@@ -5451 +6991 @@
 
 
-static int DecodeKeyUsage(byte* input, int sz, DecodedCert* cert)
+static int DecodeKeyUsage(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5470 +7010 @@
 
 
-static int DecodeExtKeyUsage(byte* input, int sz, DecodedCert* cert)
+static int DecodeExtKeyUsage(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0, oid;
-    int length;
-
-    WOLFSSL_ENTER("DecodeExtKeyUsage");
+    int length, ret;
+
+    WOLFSSL_MSG("DecodeExtKeyUsage");
 
     if (GetSequence(input, &idx, &length, sz) < 0) {
@@ -5482 +7022 @@
     }
 
-#ifdef OPENSSL_EXTRA
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
     cert->extExtKeyUsageSrc = input + idx;
     cert->extExtKeyUsageSz = length;
@@ -5488 +7028 @@
 
     while (idx < (word32)sz) {
-        if (GetObjectId(input, &idx, &oid, oidCertKeyUseType, sz) < 0)
-            return ASN_PARSE_E;
+        ret = GetObjectId(input, &idx, &oid, oidCertKeyUseType, sz);
+        if (ret == ASN_UNKNOWN_OID_E)
+            continue;
+        else if (ret < 0)
+            return ret;
 
         switch (oid) {
@@ -5515 +7058 @@
         }
 
-    #ifdef OPENSSL_EXTRA
+    #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
         cert->extExtKeyUsageCount++;
     #endif
@@ -5526 +7069 @@
 #ifndef IGNORE_NAME_CONSTRAINTS
 #define ASN_TYPE_MASK 0xF
-static int DecodeSubtree(byte* input, int sz, Base_entry** head, void* heap)
+static int DecodeSubtree(const byte* input, int sz,
+                         Base_entry** head, void* heap)
 {
     word32 idx = 0;
@@ -5593 +7137 @@
 
 
-static int DecodeNameConstraints(byte* input, int sz, DecodedCert* cert)
+static int DecodeNameConstraints(const byte* input, int sz, DecodedCert* cert)
 {
     word32 idx = 0;
@@ -5632 +7176 @@
 #endif /* IGNORE_NAME_CONSTRAINTS */
 
-
-#if defined(WOLFSSL_CERT_EXT) && !defined(WOLFSSL_SEP)
+#if (defined(WOLFSSL_CERT_EXT) && !defined(WOLFSSL_SEP)) || defined(OPENSSL_EXTRA)
 
 static int Word32ToString(char* d, word32 number)
@@ -5669 +7212 @@
 /* Decode ITU-T X.690 OID format to a string representation
  * return string length */
-static int DecodePolicyOID(char *out, word32 outSz, byte *in, word32 inSz)
+int DecodePolicyOID(char *out, word32 outSz, const byte *in, word32 inSz)
 {
     word32 val, idx = 0, nb_bytes;
@@ -5716 +7259 @@
     }
 
-    return 0;
+    return (int)w_bytes;
 }
 #endif /* WOLFSSL_CERT_EXT && !WOLFSSL_SEP */
@@ -5722 +7265 @@
 #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
     /* Reference: https://tools.ietf.org/html/rfc5280#section-4.2.1.4 */
-    static int DecodeCertPolicy(byte* input, int sz, DecodedCert* cert)
+    static int DecodeCertPolicy(const byte* input, int sz, DecodedCert* cert)
     {
         word32 idx = 0;
@@ -5778 +7321 @@
         #elif defined(WOLFSSL_CERT_EXT)
                 /* decode cert policy */
-                if (DecodePolicyOID(cert->extCertPolicies[cert->extCertPoliciesNb],
-                                    MAX_CERTPOL_SZ, input + idx, length) != 0) {
+                if (DecodePolicyOID(cert->extCertPolicies[cert->extCertPoliciesNb], MAX_CERTPOL_SZ,
+                                    input + idx, length) <= 0) {
                     WOLFSSL_MSG("\tCouldn't decode CertPolicy");
                     return ASN_PARSE_E;
@@ -5817 +7360 @@
 #endif /* WOLFSSL_SEP */
 
+/* Macro to check if bit is set, if not sets and return success.
+    Otherwise returns failure */
+/* Macro required here because bit-field operation */
+#ifndef WOLFSSL_NO_ASN_STRICT
+    #define VERIFY_AND_SET_OID(bit) \
+        if (bit == 0) \
+            bit = 1; \
+        else \
+            return ASN_OBJECT_ID_E;
+#else
+    /* With no strict defined, the verify is skipped */
+#define VERIFY_AND_SET_OID(bit) bit = 1;
+#endif
+
 static int DecodeCertExtensions(DecodedCert* cert)
 /*
@@ -5823 +7380 @@
  */
 {
-    int ret;
+    int ret = 0;
     word32 idx = 0;
     int sz = cert->extensionsSz;
-    byte* input = cert->extensions;
+    const byte* input = cert->extensions;
     int length;
     word32 oid;
@@ -5885 +7442 @@
         switch (oid) {
             case BASIC_CA_OID:
-                #ifdef OPENSSL_EXTRA
-                    cert->extBasicConstSet = 1;
+                VERIFY_AND_SET_OID(cert->extBasicConstSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extBasicConstCrit = critical;
                 #endif
@@ -5894 +7451 @@
 
             case CRL_DIST_OID:
-                #ifdef OPENSSL_EXTRA
-                    cert->extCRLdistSet  = 1;
+                VERIFY_AND_SET_OID(cert->extCRLdistSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extCRLdistCrit = critical;
                 #endif
@@ -5903 +7460 @@
 
             case AUTH_INFO_OID:
-                #ifdef OPENSSL_EXTRA
-                    cert->extAuthInfoSet  = 1;
+                VERIFY_AND_SET_OID(cert->extAuthInfoSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extAuthInfoCrit = critical;
                 #endif
@@ -5912 +7469 @@
 
             case ALT_NAMES_OID:
-                #ifdef OPENSSL_EXTRA
-                    cert->extSubjAltNameSet = 1;
+                VERIFY_AND_SET_OID(cert->extSubjAltNameSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extSubjAltNameCrit = critical;
                 #endif
-                if (DecodeAltNames(&input[idx], length, cert) < 0)
-                    return ASN_PARSE_E;
+                ret = DecodeAltNames(&input[idx], length, cert);
+                if (ret < 0)
+                    return ret;
                 break;
 
             case AUTH_KEY_OID:
-                cert->extAuthKeyIdSet = 1;
-                #ifdef OPENSSL_EXTRA
+                VERIFY_AND_SET_OID(cert->extAuthKeyIdSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extAuthKeyIdCrit = critical;
+                #endif
+                #ifndef WOLFSSL_ALLOW_CRIT_SKID
+                    /* This check is added due to RFC 5280 section 4.2.1.1
+                     * stating that conforming CA's must mark this extension
+                     * as non-critical. When parsing extensions check that
+                     * certificate was made in compliance with this. */
+                    if (critical) {
+                        WOLFSSL_MSG("Critical Auth Key ID is not allowed");
+                        WOLFSSL_MSG("Use macro WOLFSSL_ALLOW_CRIT_SKID if wanted");
+                        return ASN_CRIT_EXT_E;
+                    }
                 #endif
                 if (DecodeAuthKeyId(&input[idx], length, cert) < 0)
@@ -5930 +7499 @@
 
             case SUBJ_KEY_OID:
-                cert->extSubjKeyIdSet = 1;
-                #ifdef OPENSSL_EXTRA
+                VERIFY_AND_SET_OID(cert->extSubjKeyIdSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extSubjKeyIdCrit = critical;
                 #endif
@@ -5952 +7521 @@
             case CERT_POLICY_OID:
                 #ifdef WOLFSSL_SEP
-                    #ifdef OPENSSL_EXTRA
-                        cert->extCertPolicySet = 1;
+                    VERIFY_AND_SET_OID(cert->extCertPolicySet);
+                    #if defined(OPENSSL_EXTRA) || \
+                        defined(OPENSSL_EXTRA_X509_SMALL)
                         cert->extCertPolicyCrit = critical;
                     #endif
@@ -5967 +7537 @@
 
             case KEY_USAGE_OID:
-                cert->extKeyUsageSet = 1;
-                #ifdef OPENSSL_EXTRA
+                VERIFY_AND_SET_OID(cert->extKeyUsageSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extKeyUsageCrit = critical;
                 #endif
@@ -5976 +7546 @@
 
             case EXT_KEY_USAGE_OID:
-                cert->extExtKeyUsageSet = 1;
-                #ifdef OPENSSL_EXTRA
+                VERIFY_AND_SET_OID(cert->extExtKeyUsageSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extExtKeyUsageCrit = critical;
                 #endif
@@ -5986 +7556 @@
             #ifndef IGNORE_NAME_CONSTRAINTS
             case NAME_CONS_OID:
-                cert->extNameConstraintSet = 1;
-                #ifdef OPENSSL_EXTRA
+            #ifndef WOLFSSL_NO_ASN_STRICT
+                /* Verify RFC 5280 Sec 4.2.1.10 rule:
+                    "The name constraints extension,
+                    which MUST be used only in a CA certificate" */
+                if (!cert->isCA) {
+                    WOLFSSL_MSG("Name constraints allowed only for CA certs");
+                    return ASN_NAME_INVALID_E;
+                }
+            #endif
+                VERIFY_AND_SET_OID(cert->extNameConstraintSet);
+                #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
                     cert->extNameConstraintCrit = critical;
                 #endif
@@ -5996 +7575 @@
 
             case INHIBIT_ANY_OID:
+                VERIFY_AND_SET_OID(cert->inhibitAnyOidSet);
                 WOLFSSL_MSG("Inhibit anyPolicy extension not supported yet.");
                 break;
 
             default:
+            #ifndef WOLFSSL_NO_ASN_STRICT
                 /* While it is a failure to not support critical extensions,
                  * still parse the certificate ignoring the unsupported
@@ -6006 +7587 @@
                 if (critical)
                     criticalFail = 1;
+            #endif
                 break;
         }
@@ -6048 +7630 @@
 }
 
+
 /* from SSL proper, for locking can't do find here anymore */
 #ifdef __cplusplus
@@ -6101 +7684 @@
 #endif
 
+#ifdef WOLFSSL_SMALL_CERT_VERIFY
+/* Only quick step through the certificate to find fields that are then used
+ * in certificate signature verification.
+ * Must use the signature OID from the signed part of the certificate.
+ *
+ * This is only for minimizing dynamic memory usage during TLS certificate
+ * chain processing.
+ * Doesn't support:
+ *   OCSP Only: alt lookup using subject and pub key w/o sig check
+ */
+int CheckCertSignature(const byte* cert, word32 certSz, void* heap, void* cm)
+{
+#ifndef WOLFSSL_SMALL_STACK
+    SignatureCtx  sigCtx[1];
+#else
+    SignatureCtx* sigCtx;
+#endif
+    byte          hash[KEYID_SIZE];
+    Signer*       ca = NULL;
+    word32        idx = 0;
+    int           len;
+    word32        tbsCertIdx;
+    word32        sigIndex;
+    word32        signatureOID;
+    word32        oid;
+    word32        issuerIdx;
+    word32        issuerSz;
+#ifndef NO_SKID
+    int           extLen;
+    word32        extIdx;
+    word32        extEndIdx;
+    int           extAuthKeyIdSet = 0;
+#endif
+    int    ret = 0;
+
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    sigCtx = XMALLOC(sizeof(*sigCtx), heap, DYNAMIC_TYPE_SIGNATURE);
+    if (sigCtx == NULL)
+        return MEMORY_E;
+#endif
+    InitSignatureCtx(sigCtx, heap, INVALID_DEVID);
+
+    /* Certificate SEQUENCE */
+    if (GetSequence(cert, &idx, &len, certSz) < 0)
+        ret = ASN_PARSE_E;
+    if (ret == 0) {
+        tbsCertIdx = idx;
+
+        /* TBSCertificate SEQUENCE */
+        if (GetSequence(cert, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+            }
+    if (ret == 0) {
+        sigIndex = len + idx;
+
+        if ((idx + 1) > certSz)
+            ret = BUFFER_E;
+    }
+    if (ret == 0) {
+        /* version - optional */
+        if (cert[idx] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) {
+            idx++;
+            if (GetLength(cert, &idx, &len, certSz) < 0)
+                ret = ASN_PARSE_E;
+            idx += len;
+        }
+            }
+
+    if (ret == 0) {
+        /* serialNumber */
+        if (GetASNHeader(cert, ASN_INTEGER, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+        }
+    if (ret == 0) {
+        idx += len;
+
+        /* signature */
+        if (GetAlgoId(cert, &idx, &signatureOID, oidSigType, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+
+    if (ret == 0) {
+        issuerIdx = idx;
+        /* issuer */
+        if (GetSequence(cert, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+    if (ret == 0) {
+        issuerSz = len + idx - issuerIdx;
+    }
+#ifndef NO_SKID
+    if (ret == 0) {
+        idx += len;
+
+        /* validity */
+        if (GetSequence(cert, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+    if (ret == 0) {
+        idx += len;
+
+        /* subject */
+        if (GetSequence(cert, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+    if (ret == 0) {
+        idx += len;
+
+        /* subjectPublicKeyInfo */
+        if (GetSequence(cert, &idx, &len, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+    if (ret == 0) {
+        idx += len;
+
+        if ((idx + 1) > certSz)
+            ret = BUFFER_E;
+    }
+    if (ret == 0) {
+        /* issuerUniqueID - optional */
+        if (cert[idx] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 1)) {
+            idx++;
+            if (GetLength(cert, &idx, &len, certSz) < 0)
+                ret = ASN_PARSE_E;
+            idx += len;
+        }
+    }
+    if (ret == 0) {
+        if ((idx + 1) > certSz)
+            ret = BUFFER_E;
+    }
+    if (ret == 0) {
+        /* subjectUniqueID - optional */
+        if (cert[idx] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 2)) {
+            idx++;
+            if (GetLength(cert, &idx, &len, certSz) < 0)
+                ret = ASN_PARSE_E;
+            idx += len;
+        }
+    }
+
+    if (ret == 0) {
+        if ((idx + 1) > certSz)
+            ret = BUFFER_E;
+    }
+    /* extensions - optional */
+    if (ret == 0 && cert[idx] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 3)) {
+        idx++;
+        if (GetLength(cert, &idx, &extLen, certSz) < 0)
+            ret = ASN_PARSE_E;
+        if (ret == 0) {
+            if (GetSequence(cert, &idx, &extLen, certSz) < 0)
+                ret = ASN_PARSE_E;
+        }
+        if (ret == 0) {
+            extEndIdx = idx + extLen;
+
+            /* Check each extension for the ones we want. */
+            while (ret == 0 && idx < extEndIdx) {
+                if (GetSequence(cert, &idx, &len, certSz) < 0)
+                    ret = ASN_PARSE_E;
+                if (ret == 0) {
+                    extIdx = idx;
+                    if (GetObjectId(cert, &extIdx, &oid, oidCertExtType,
+                                                                  certSz) < 0) {
+                        ret = ASN_PARSE_E;
+                    }
+                }
+                if (ret == 0) {
+                    if (cert[extIdx] == ASN_BOOLEAN) {
+                        if (GetBoolean(cert, &extIdx, certSz) < 0)
+                            ret = ASN_PARSE_E;
+                    }
+                }
+                if (ret == 0) {
+                    if (GetOctetString(cert, &extIdx, &extLen, certSz) < 0)
+                        ret = ASN_PARSE_E;
+                }
+
+                if (ret == 0) {
+                    switch (oid) {
+                    case AUTH_KEY_OID:
+                        extAuthKeyIdSet = 1;
+                        if (GetSequence(cert, &extIdx, &extLen, certSz) < 0)
+                            ret = ASN_PARSE_E;
+
+                        if (ret == 0 &&
+                                 cert[extIdx++] == (ASN_CONTEXT_SPECIFIC | 0)) {
+                            if (GetLength(cert, &extIdx, &extLen, certSz) <= 0)
+                                ret = ASN_PARSE_E;
+                            if (ret == 0) {
+                                if (extLen == KEYID_SIZE)
+                                    XMEMCPY(hash, cert + extIdx, extLen);
+                                else {
+                                    ret = CalcHashId(cert + extIdx, extLen,
+                                                                          hash);
+                                }
+                            }
+                        }
+                        break;
+
+                    default:
+                        break;
+                    }
+                }
+                idx += len;
+            }
+        }
+    }
+
+    if (ret == 0) {
+        if (extAuthKeyIdSet)
+            ca = GetCA(cm, hash);
+        if (ca == NULL) {
+            ret = CalcHashId(cert + issuerIdx, issuerSz, hash);
+            if (ret == 0)
+                ca = GetCAByName(cm, hash);
+        }
+    }
+#else
+    if (ret == 0) {
+        ret = CalcHashId(cert + issuerIdx, issuerSz, hash);
+        if (ret == 0)
+            ca = GetCA(cm, hash);
+    }
+#endif /* !NO_SKID */
+    if (ca == NULL)
+        ret = ASN_NO_SIGNER_E;
+
+    if (ret == 0) {
+        idx = sigIndex;
+        /* signatureAlgorithm */
+        if (GetAlgoId(cert, &idx, &oid, oidSigType, certSz) < 0)
+            ret = ASN_PARSE_E;
+    }
+    if (ret == 0) {
+        if (oid != signatureOID)
+            ret = ASN_SIG_OID_E;
+    }
+    if (ret == 0) {
+        /* signatureValue */
+        if (CheckBitString(cert, &idx, &len, certSz, 1, NULL) < 0)
+            ret = ASN_PARSE_E;
+    }
+
+    if (ret == 0) {
+        ret = ConfirmSignature(sigCtx, cert + tbsCertIdx, sigIndex - tbsCertIdx,
+                               ca->publicKey, ca->pubKeySize, ca->keyOID,
+                               cert + idx, len, signatureOID);
+        if (ret != WC_PENDING_E) {
+            WOLFSSL_MSG("Confirm signature failed");
+        }
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    if (sigCtx != NULL)
+        XFREE(sigCtx, heap, DYNAMIC_TYPE_SIGNATURE);
+#endif
+    return ret;
+}
+#endif /* WOLFSSL_SMALL_CERT_VERIFY */
+
 int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
 {
@@ -6107 +7956 @@
     int    criticalExt = 0;
     word32 confirmOID;
+    int    selfSigned = 0;
 
     if (cert == NULL) {
@@ -6159 +8009 @@
         if (cert->extSubjKeyIdSet == 0 && cert->publicKey != NULL &&
                                                         cert->pubKeySize > 0) {
-        #ifdef NO_SHA
-            ret = wc_Sha256Hash(cert->publicKey, cert->pubKeySize,
+            ret = CalcHashId(cert->publicKey, cert->pubKeySize,
                                                             cert->extSubjKeyId);
-        #else
-            ret = wc_ShaHash(cert->publicKey, cert->pubKeySize,
-                                                            cert->extSubjKeyId);
-        #endif /* NO_SHA */
             if (ret != 0)
                 return ret;
@@ -6197 +8042 @@
     #else
             cert->ca = GetCA(cm, cert->issuerHash);
+            if (XMEMCMP(cert->issuerHash, cert->subjectHash, KEYID_SIZE) == 0)
+                selfSigned = 1;
     #endif /* !NO_SKID */
 
             WOLFSSL_MSG("About to verify certificate signature");
             if (cert->ca) {
-                if (cert->isCA) {
-                    if (cert->ca->pathLengthSet) {
+                if (cert->isCA && cert->ca->pathLengthSet) {
+                    if (selfSigned) {
+                        if (cert->ca->pathLength != 0) {
+                           WOLFSSL_MSG("Root CA with path length > 0");
+                           return ASN_PATHLEN_INV_E;
+                        }
+                    }
+                    else {
                         if (cert->ca->pathLength == 0) {
                             WOLFSSL_MSG("CA with path length 0 signing a CA");
                             return ASN_PATHLEN_INV_E;
                         }
-                        if (cert->pathLengthSet &&
-                            cert->pathLength >= cert->ca->pathLength) {
+                        else if (cert->pathLength >= cert->ca->pathLength) {
 
                             WOLFSSL_MSG("CA signing CA with longer path length");
@@ -6218 +8070 @@
         #ifdef HAVE_OCSP
                 /* Need the CA's public key hash for OCSP */
-            #ifdef NO_SHA
-                ret = wc_Sha256Hash(cert->ca->publicKey, cert->ca->pubKeySize,
+            ret = CalcHashId(cert->ca->publicKey, cert->ca->pubKeySize,
                                                            cert->issuerKeyHash);
-            #else
-                ret = wc_ShaHash(cert->ca->publicKey, cert->ca->pubKeySize,
-                                                           cert->issuerKeyHash);
-            #endif /* NO_SHA */
                 if (ret != 0)
                     return ret;
@@ -6247 +8094 @@
                     return ret;
                 }
+            }
             #ifndef IGNORE_NAME_CONSTRAINTS
+            if (verify == VERIFY || verify == VERIFY_OCSP ||
+                                                        verify == VERIFY_NAME) {
                 /* check that this cert's name is permitted by the signer's
                  * name constraints */
@@ -6254 +8104 @@
                     return ASN_NAME_INVALID_E;
                 }
-            #endif /* IGNORE_NAME_CONSTRAINTS */
-            }
+            }
+        #endif /* IGNORE_NAME_CONSTRAINTS */
         }
         else {
@@ -6294 +8144 @@
         signer->pathLengthSet = 0;
         signer->pathLength = 0;
+    #ifdef WOLFSSL_SIGNER_DER_CERT
+        signer->derCert    = NULL;
+    #endif
         signer->next       = NULL;
     }
@@ -6306 +8159 @@
 {
     XFREE(signer->name, heap, DYNAMIC_TYPE_SUBJECT_CN);
-    XFREE(signer->publicKey, heap, DYNAMIC_TYPE_PUBLIC_KEY);
+    XFREE((void*)signer->publicKey, heap, DYNAMIC_TYPE_PUBLIC_KEY);
 #ifndef IGNORE_NAME_CONSTRAINTS
     if (signer->permittedNames)
@@ -6312 +8165 @@
     if (signer->excludedNames)
         FreeNameSubtrees(signer->excludedNames, heap);
+#endif
+#ifdef WOLFSSL_SIGNER_DER_CERT
+    FreeDer(&signer->derCert);
 #endif
     XFREE(signer, heap, DYNAMIC_TYPE_SIGNER);
@@ -6476 +8332 @@
 
 
-
-const char* BEGIN_CERT         = "-----BEGIN CERTIFICATE-----";
-const char* END_CERT           = "-----END CERTIFICATE-----";
-const char* BEGIN_CERT_REQ     = "-----BEGIN CERTIFICATE REQUEST-----";
-const char* END_CERT_REQ       = "-----END CERTIFICATE REQUEST-----";
-const char* BEGIN_DH_PARAM     = "-----BEGIN DH PARAMETERS-----";
-const char* END_DH_PARAM       = "-----END DH PARAMETERS-----";
-const char* BEGIN_DSA_PARAM    = "-----BEGIN DSA PARAMETERS-----";
-const char* END_DSA_PARAM      = "-----END DSA PARAMETERS-----";
-const char* BEGIN_X509_CRL     = "-----BEGIN X509 CRL-----";
-const char* END_X509_CRL       = "-----END X509 CRL-----";
-const char* BEGIN_RSA_PRIV     = "-----BEGIN RSA PRIVATE KEY-----";
-const char* END_RSA_PRIV       = "-----END RSA PRIVATE KEY-----";
-const char* BEGIN_PRIV_KEY     = "-----BEGIN PRIVATE KEY-----";
-const char* END_PRIV_KEY       = "-----END PRIVATE KEY-----";
-const char* BEGIN_ENC_PRIV_KEY = "-----BEGIN ENCRYPTED PRIVATE KEY-----";
-const char* END_ENC_PRIV_KEY   = "-----END ENCRYPTED PRIVATE KEY-----";
-const char* BEGIN_EC_PRIV      = "-----BEGIN EC PRIVATE KEY-----";
-const char* END_EC_PRIV        = "-----END EC PRIVATE KEY-----";
-const char* BEGIN_DSA_PRIV     = "-----BEGIN DSA PRIVATE KEY-----";
-const char* END_DSA_PRIV       = "-----END DSA PRIVATE KEY-----";
-const char* BEGIN_PUB_KEY      = "-----BEGIN PUBLIC KEY-----";
-const char* END_PUB_KEY        = "-----END PUBLIC KEY-----";
-const char* BEGIN_EDDSA_PRIV   = "-----BEGIN EDDSA PRIVATE KEY-----";
-const char* END_EDDSA_PRIV     = "-----END EDDSA PRIVATE KEY-----";
-
-#if defined(WOLFSSL_KEY_GEN) || defined(WOLFSSL_CERT_GEN) || defined(OPENSSL_EXTRA)
+int AllocDer(DerBuffer** pDer, word32 length, int type, void* heap)
+{
+    int ret = BAD_FUNC_ARG;
+    if (pDer) {
+        int dynType = 0;
+        DerBuffer* der;
+
+        /* Determine dynamic type */
+        switch (type) {
+            case CA_TYPE:   dynType = DYNAMIC_TYPE_CA;   break;
+            case CERT_TYPE: dynType = DYNAMIC_TYPE_CERT; break;
+            case CRL_TYPE:  dynType = DYNAMIC_TYPE_CRL;  break;
+            case DSA_TYPE:  dynType = DYNAMIC_TYPE_DSA;  break;
+            case ECC_TYPE:  dynType = DYNAMIC_TYPE_ECC;  break;
+            case RSA_TYPE:  dynType = DYNAMIC_TYPE_RSA;  break;
+            default:        dynType = DYNAMIC_TYPE_KEY;  break;
+        }
+
+        /* Setup new buffer */
+        *pDer = (DerBuffer*)XMALLOC(sizeof(DerBuffer) + length, heap, dynType);
+        if (*pDer == NULL) {
+            return MEMORY_E;
+        }
+        XMEMSET(*pDer, 0, sizeof(DerBuffer) + length);
+
+        der = *pDer;
+        der->type = type;
+        der->dynType = dynType; /* Cache this for FreeDer */
+        der->heap = heap;
+        der->buffer = (byte*)der + sizeof(DerBuffer);
+        der->length = length;
+        ret = 0; /* Success */
+    }
+    return ret;
+}
+
+void FreeDer(DerBuffer** pDer)
+{
+    if (pDer && *pDer)
+    {
+        DerBuffer* der = (DerBuffer*)*pDer;
+
+        /* ForceZero private keys */
+        if (der->type == PRIVATEKEY_TYPE) {
+            ForceZero(der->buffer, der->length);
+}
+        der->buffer = NULL;
+        der->length = 0;
+        XFREE(der, der->heap, der->dynType);
+
+        *pDer = NULL;
+    }
+}
+
+int wc_AllocDer(DerBuffer** pDer, word32 length, int type, void* heap)
+{
+    return AllocDer(pDer, length, type, heap);
+}
+void wc_FreeDer(DerBuffer** pDer)
+{
+    FreeDer(pDer);
+}
+
+
+#if defined(WOLFSSL_PEM_TO_DER) || defined(WOLFSSL_DER_TO_PEM)
+
+/* Max X509 header length indicates the max length + 2 ('\n', '\0') */
+#define MAX_X509_HEADER_SZ  (37 + 2)
+
+const char* const BEGIN_CERT           = "-----BEGIN CERTIFICATE-----";
+const char* const END_CERT             = "-----END CERTIFICATE-----";
+#ifdef WOLFSSL_CERT_REQ
+    const char* const BEGIN_CERT_REQ   = "-----BEGIN CERTIFICATE REQUEST-----";
+    const char* const END_CERT_REQ     = "-----END CERTIFICATE REQUEST-----";
+#endif
+#ifndef NO_DH
+    const char* const BEGIN_DH_PARAM   = "-----BEGIN DH PARAMETERS-----";
+    const char* const END_DH_PARAM     = "-----END DH PARAMETERS-----";
+#endif
+#ifndef NO_DSA
+    const char* const BEGIN_DSA_PARAM  = "-----BEGIN DSA PARAMETERS-----";
+    const char* const END_DSA_PARAM    = "-----END DSA PARAMETERS-----";
+#endif
+const char* const BEGIN_X509_CRL       = "-----BEGIN X509 CRL-----";
+const char* const END_X509_CRL         = "-----END X509 CRL-----";
+const char* const BEGIN_RSA_PRIV       = "-----BEGIN RSA PRIVATE KEY-----";
+const char* const END_RSA_PRIV         = "-----END RSA PRIVATE KEY-----";
+const char* const BEGIN_PRIV_KEY       = "-----BEGIN PRIVATE KEY-----";
+const char* const END_PRIV_KEY         = "-----END PRIVATE KEY-----";
+const char* const BEGIN_ENC_PRIV_KEY   = "-----BEGIN ENCRYPTED PRIVATE KEY-----";
+const char* const END_ENC_PRIV_KEY     = "-----END ENCRYPTED PRIVATE KEY-----";
+#ifdef HAVE_ECC
+    const char* const BEGIN_EC_PRIV    = "-----BEGIN EC PRIVATE KEY-----";
+    const char* const END_EC_PRIV      = "-----END EC PRIVATE KEY-----";
+#endif
+#if defined(HAVE_ECC) || defined(HAVE_ED25519) || !defined(NO_DSA)
+    const char* const BEGIN_DSA_PRIV   = "-----BEGIN DSA PRIVATE KEY-----";
+    const char* const END_DSA_PRIV     = "-----END DSA PRIVATE KEY-----";
+#endif
+const char* const BEGIN_PUB_KEY        = "-----BEGIN PUBLIC KEY-----";
+const char* const END_PUB_KEY          = "-----END PUBLIC KEY-----";
+#ifdef HAVE_ED25519
+    const char* const BEGIN_EDDSA_PRIV = "-----BEGIN EDDSA PRIVATE KEY-----";
+    const char* const END_EDDSA_PRIV   = "-----END EDDSA PRIVATE KEY-----";
+#endif
+#ifdef HAVE_CRL
+    const char *const BEGIN_CRL = "-----BEGIN X509 CRL-----";
+    const char* const END_CRL   = "-----END X509 CRL-----";
+#endif
+
+
+static WC_INLINE char* SkipEndOfLineChars(char* line, const char* endOfLine)
+{
+    /* eat end of line characters */
+    while (line < endOfLine &&
+              (line[0] == '\r' || line[0] == '\n')) {
+        line++;
+    }
+    return line;
+    }
+
+int wc_PemGetHeaderFooter(int type, const char** header, const char** footer)
+{
+    int ret = BAD_FUNC_ARG;
+
+    switch (type) {
+        case CA_TYPE:       /* same as below */
+        case TRUSTED_PEER_TYPE:
+        case CERT_TYPE:
+            if (header) *header = BEGIN_CERT;
+            if (footer) *footer = END_CERT;
+            ret = 0;
+            break;
+
+        case CRL_TYPE:
+            if (header) *header = BEGIN_X509_CRL;
+            if (footer) *footer = END_X509_CRL;
+            ret = 0;
+            break;
+    #ifndef NO_DH
+        case DH_PARAM_TYPE:
+            if (header) *header = BEGIN_DH_PARAM;
+            if (footer) *footer = END_DH_PARAM;
+            ret = 0;
+            break;
+    #endif
+    #ifndef NO_DSA
+        case DSA_PARAM_TYPE:
+            if (header) *header = BEGIN_DSA_PARAM;
+            if (footer) *footer = END_DSA_PARAM;
+            ret = 0;
+            break;
+    #endif
+    #ifdef WOLFSSL_CERT_REQ
+        case CERTREQ_TYPE:
+            if (header) *header = BEGIN_CERT_REQ;
+            if (footer) *footer = END_CERT_REQ;
+            ret = 0;
+            break;
+    #endif
+    #ifndef NO_DSA
+        case DSA_TYPE:
+        case DSA_PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_DSA_PRIV;
+            if (footer) *footer = END_DSA_PRIV;
+            ret = 0;
+            break;
+    #endif
+    #ifdef HAVE_ECC
+        case ECC_TYPE:
+        case ECC_PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_EC_PRIV;
+            if (footer) *footer = END_EC_PRIV;
+            ret = 0;
+            break;
+    #endif
+        case RSA_TYPE:
+        case PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_RSA_PRIV;
+            if (footer) *footer = END_RSA_PRIV;
+            ret = 0;
+            break;
+    #ifdef HAVE_ED25519
+        case ED25519_TYPE:
+        case EDDSA_PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_EDDSA_PRIV;
+            if (footer) *footer = END_EDDSA_PRIV;
+            ret = 0;
+            break;
+    #endif
+        case PUBLICKEY_TYPE:
+            if (header) *header = BEGIN_PUB_KEY;
+            if (footer) *footer = END_PUB_KEY;
+            ret = 0;
+            break;
+        case PKCS8_PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_PRIV_KEY;
+            if (footer) *footer = END_PRIV_KEY;
+            ret = 0;
+            break;
+        case PKCS8_ENC_PRIVATEKEY_TYPE:
+            if (header) *header = BEGIN_ENC_PRIV_KEY;
+            if (footer) *footer = END_ENC_PRIV_KEY;
+            ret = 0;
+            break;
+        default:
+            break;
+    }
+    return ret;
+}
+
+#ifdef WOLFSSL_ENCRYPTED_KEYS
+
+static const char* const kProcTypeHeader = "Proc-Type";
+static const char* const kDecInfoHeader = "DEK-Info";
+
+#ifdef WOLFSSL_PEM_TO_DER
+#ifndef NO_DES3
+    static const char* const kEncTypeDes = "DES-CBC";
+    static const char* const kEncTypeDes3 = "DES-EDE3-CBC";
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128)
+    static const char* const kEncTypeAesCbc128 = "AES-128-CBC";
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_192)
+    static const char* const kEncTypeAesCbc192 = "AES-192-CBC";
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256)
+    static const char* const kEncTypeAesCbc256 = "AES-256-CBC";
+#endif
+
+int wc_EncryptedInfoGet(EncryptedInfo* info, const char* cipherInfo)
+{
+    int ret = 0;
+
+    if (info == NULL || cipherInfo == NULL)
+        return BAD_FUNC_ARG;
+
+    /* determine cipher information */
+#ifndef NO_DES3
+    if (XSTRNCMP(cipherInfo, kEncTypeDes, XSTRLEN(kEncTypeDes)) == 0) {
+        info->cipherType = WC_CIPHER_DES;
+        info->keySz = DES_KEY_SIZE;
+        if (info->ivSz == 0) info->ivSz  = DES_IV_SIZE;
+    }
+    else if (XSTRNCMP(cipherInfo, kEncTypeDes3, XSTRLEN(kEncTypeDes3)) == 0) {
+        info->cipherType = WC_CIPHER_DES3;
+        info->keySz = DES3_KEY_SIZE;
+        if (info->ivSz == 0) info->ivSz  = DES_IV_SIZE;
+    }
+    else
+#endif /* !NO_DES3 */
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_128)
+    if (XSTRNCMP(cipherInfo, kEncTypeAesCbc128, XSTRLEN(kEncTypeAesCbc128)) == 0) {
+        info->cipherType = WC_CIPHER_AES_CBC;
+        info->keySz = AES_128_KEY_SIZE;
+        if (info->ivSz == 0) info->ivSz  = AES_IV_SIZE;
+    }
+    else
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_192)
+    if (XSTRNCMP(cipherInfo, kEncTypeAesCbc192, XSTRLEN(kEncTypeAesCbc192)) == 0) {
+        info->cipherType = WC_CIPHER_AES_CBC;
+        info->keySz = AES_192_KEY_SIZE;
+        if (info->ivSz == 0) info->ivSz  = AES_IV_SIZE;
+    }
+    else
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256)
+    if (XSTRNCMP(cipherInfo, kEncTypeAesCbc256, XSTRLEN(kEncTypeAesCbc256)) == 0) {
+        info->cipherType = WC_CIPHER_AES_CBC;
+        info->keySz = AES_256_KEY_SIZE;
+        if (info->ivSz == 0) info->ivSz  = AES_IV_SIZE;
+    }
+    else
+#endif
+    {
+        ret = NOT_COMPILED_IN;
+    }
+    return ret;
+}
+
+int wc_EncryptedInfoParse(EncryptedInfo* info, char** pBuffer, size_t bufSz)
+{
+    int err = 0;
+    char*  bufferStart;
+    char*  bufferEnd;
+    char*  line;
+    word32 lineSz;
+    char*  finish;
+    word32 finishSz;
+    char*  start = NULL;
+    word32 startSz;
+    char*  newline = NULL;
+
+    if (info == NULL || pBuffer == NULL || bufSz == 0)
+        return BAD_FUNC_ARG;
+
+    bufferStart = *pBuffer;
+    bufferEnd = bufferStart + bufSz;
+
+    /* find encrypted info marker */
+    line = XSTRNSTR(bufferStart, kProcTypeHeader,
+                    min((word32)bufSz, PEM_LINE_LEN));
+    if (line != NULL) {
+        if (line >= bufferEnd) {
+            return BUFFER_E;
+        }
+
+        lineSz = (word32)(bufferEnd - line);
+
+        /* find DEC-Info marker */
+        start = XSTRNSTR(line, kDecInfoHeader, min(lineSz, PEM_LINE_LEN));
+
+        if (start == NULL)
+            return BUFFER_E;
+
+        /* skip dec-info and ": " */
+        start += XSTRLEN(kDecInfoHeader);
+        if (start >= bufferEnd)
+            return BUFFER_E;
+
+        if (start[0] == ':') {
+            start++;
+            if (start >= bufferEnd)
+                return BUFFER_E;
+        }
+        if (start[0] == ' ')
+            start++;
+
+        startSz = (word32)(bufferEnd - start);
+        finish = XSTRNSTR(start, ",", min(startSz, PEM_LINE_LEN));
+
+        if ((start != NULL) && (finish != NULL) && (start < finish)) {
+            if (finish >= bufferEnd) {
+                return BUFFER_E;
+            }
+
+            finishSz = (word32)(bufferEnd - finish);
+            newline = XSTRNSTR(finish, "\r", min(finishSz, PEM_LINE_LEN));
+
+            /* get cipher name */
+            if (NAME_SZ < (finish - start)) /* buffer size of info->name */
+                return BUFFER_E;
+            if (XMEMCPY(info->name, start, finish - start) == NULL)
+                return BUFFER_E;
+            info->name[finish - start] = '\0'; /* null term */
+
+            /* populate info */
+            err = wc_EncryptedInfoGet(info, info->name);
+            if (err != 0)
+                return err;
+
+            /* get IV */
+            if (finishSz < info->ivSz + 1)
+                return BUFFER_E;
+
+            if (newline == NULL) {
+                newline = XSTRNSTR(finish, "\n", min(finishSz,
+                                                     PEM_LINE_LEN));
+            }
+            if ((newline != NULL) && (newline > finish)) {
+                info->ivSz = (word32)(newline - (finish + 1));
+                if (XMEMCPY(info->iv, finish + 1, info->ivSz) == NULL)
+                    return BUFFER_E;
+                info->set = 1;
+            }
+            else
+                return BUFFER_E;
+        }
+        else
+            return BUFFER_E;
+
+        /* eat end of line characters */
+        newline = SkipEndOfLineChars(newline, bufferEnd);
+
+        /* return new headerEnd */
+        if (pBuffer)
+            *pBuffer = newline;
+    }
+
+    return err;
+}
+#endif /* WOLFSSL_PEM_TO_DER */
+
+#ifdef WOLFSSL_DER_TO_PEM
+static int wc_EncryptedInfoAppend(char* dest, int destSz, char* cipherInfo)
+{
+    if (cipherInfo != NULL) {
+        int cipherInfoStrLen = (int)XSTRLEN((char*)cipherInfo);
+
+        if (cipherInfoStrLen > HEADER_ENCRYPTED_KEY_SIZE - (9+14+10+3))
+            cipherInfoStrLen = HEADER_ENCRYPTED_KEY_SIZE - (9+14+10+3);
+
+        if (destSz - (int)XSTRLEN(dest) >= cipherInfoStrLen + (9+14+8+2+2+1)) {
+            /* strncat's src length needs to include the NULL */
+            XSTRNCAT(dest, kProcTypeHeader, 10);
+            XSTRNCAT(dest, ": 4,ENCRYPTED\n", 15);
+            XSTRNCAT(dest, kDecInfoHeader, 9);
+            XSTRNCAT(dest, ": ", 3);
+            XSTRNCAT(dest, cipherInfo, destSz - (int)XSTRLEN(dest) - 1);
+            XSTRNCAT(dest, "\n\n", 4);
+        }
+    }
+    return 0;
+}
+#endif /* WOLFSSL_DER_TO_PEM */
+#endif /* WOLFSSL_ENCRYPTED_KEYS */
+
+#ifdef WOLFSSL_DER_TO_PEM
 
 /* Used for compatibility API */
@@ -6516 +8755 @@
              byte *cipher_info, int type)
 {
+    const char* headerStr = NULL;
+    const char* footerStr = NULL;
 #ifdef WOLFSSL_SMALL_STACK
     char* header = NULL;
     char* footer = NULL;
 #else
-    char header[40 + HEADER_ENCRYPTED_KEY_SIZE];
-    char footer[40];
-#endif
-
-    int headerLen = 40 + HEADER_ENCRYPTED_KEY_SIZE;
-    int footerLen = 40;
+    char header[MAX_X509_HEADER_SZ + HEADER_ENCRYPTED_KEY_SIZE];
+    char footer[MAX_X509_HEADER_SZ];
+#endif
+    int headerLen = MAX_X509_HEADER_SZ + HEADER_ENCRYPTED_KEY_SIZE;
+    int footerLen = MAX_X509_HEADER_SZ;
     int i;
     int err;
     int outLen;   /* return length or error */
 
+    (void)cipher_info;
+
     if (der == output)      /* no in place conversion */
         return BAD_FUNC_ARG;
+
+    err = wc_PemGetHeaderFooter(type, &headerStr, &footerStr);
+    if (err != 0)
+        return err;
 
 #ifdef WOLFSSL_SMALL_STACK
@@ -6544 +8790 @@
     }
 #endif
-    if (type == CERT_TYPE) {
-        XSTRNCPY(header, BEGIN_CERT, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_CERT, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-    else if (type == PRIVATEKEY_TYPE) {
-        XSTRNCPY(header, BEGIN_RSA_PRIV, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_RSA_PRIV, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#ifndef NO_DSA
-    else if (type == DSA_PRIVATEKEY_TYPE) {
-        XSTRNCPY(header, BEGIN_DSA_PRIV, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_DSA_PRIV, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#endif
-#ifdef HAVE_ECC
-    else if (type == ECC_PRIVATEKEY_TYPE) {
-        XSTRNCPY(header, BEGIN_EC_PRIV, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_EC_PRIV, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#endif
-#ifdef HAVE_ED25519
-    else if (type == EDDSA_PRIVATEKEY_TYPE) {
-        XSTRNCPY(header, BEGIN_EDDSA_PRIV, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_EDDSA_PRIV, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#endif
-#ifdef WOLFSSL_CERT_REQ
-    else if (type == CERTREQ_TYPE)
-    {
-        XSTRNCPY(header, BEGIN_CERT_REQ, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_CERT_REQ, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#endif
-#ifdef HAVE_CRL
-    else if (type == CRL_TYPE)
-    {
-        XSTRNCPY(header, BEGIN_X509_CRL, headerLen);
-        XSTRNCAT(header, "\n", 1);
-
-        XSTRNCPY(footer, END_X509_CRL, footerLen);
-        XSTRNCAT(footer, "\n", 1);
-    }
-#endif
-    else {
-#ifdef WOLFSSL_SMALL_STACK
+
+    /* build header and footer based on type */
+    XSTRNCPY(header, headerStr, headerLen - 1);
+    header[headerLen - 1] = 0;
+    XSTRNCPY(footer, footerStr, footerLen - 1);
+    footer[footerLen - 1] = 0;
+
+    /* add new line to end */
+    XSTRNCAT(header, "\n", 2);
+    XSTRNCAT(footer, "\n", 2);
+
+#ifdef WOLFSSL_ENCRYPTED_KEYS
+    err = wc_EncryptedInfoAppend(header, headerLen, (char*)cipher_info);
+    if (err != 0) {
+    #ifdef WOLFSSL_SMALL_STACK
         XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
-        return BAD_FUNC_ARG;
-    }
-
-    /* extra header information for encrypted key */
-    if (cipher_info != NULL) {
-        size_t cipherInfoStrLen = XSTRLEN((char*)cipher_info);
-        if (cipherInfoStrLen > HEADER_ENCRYPTED_KEY_SIZE - (23+10+2))
-            cipherInfoStrLen = HEADER_ENCRYPTED_KEY_SIZE - (23+10+2);
-
-        XSTRNCAT(header, "Proc-Type: 4,ENCRYPTED\n", 23);
-        XSTRNCAT(header, "DEK-Info: ", 10);
-        XSTRNCAT(header, (char*)cipher_info, cipherInfoStrLen);
-        XSTRNCAT(header, "\n\n", 2);
-    }
+    #endif
+        return err;
+    }
+#endif
 
     headerLen = (int)XSTRLEN(header);
@@ -6693 +8880 @@
 }
 
-#endif /* WOLFSSL_KEY_GEN || WOLFSSL_CERT_GEN || OPENSSL_EXTRA */
+#endif /* WOLFSSL_DER_TO_PEM */
+
+#ifdef WOLFSSL_PEM_TO_DER
+
+/* Remove PEM header/footer, convert to ASN1, store any encrypted data
+   info->consumed tracks of PEM bytes consumed in case multiple parts */
+int PemToDer(const unsigned char* buff, long longSz, int type,
+              DerBuffer** pDer, void* heap, EncryptedInfo* info, int* eccKey)
+{
+    const char* header      = NULL;
+    const char* footer      = NULL;
+    char*       headerEnd;
+    char*       footerEnd;
+    char*       consumedEnd;
+    char*       bufferEnd   = (char*)(buff + longSz);
+    long        neededSz;
+    int         ret         = 0;
+    int         sz          = (int)longSz;
+    int         encrypted_key = 0;
+    DerBuffer*  der;
+    word32      algId = 0;
+
+    WOLFSSL_ENTER("PemToDer");
+
+    /* get PEM header and footer based on type */
+    ret = wc_PemGetHeaderFooter(type, &header, &footer);
+    if (ret != 0)
+        return ret;
+
+    /* map header if not found for type */
+    for (;;) {
+        headerEnd = XSTRNSTR((char*)buff, header, sz);
+
+        if (headerEnd || type != PRIVATEKEY_TYPE) {
+            break;
+        } else
+        if (header == BEGIN_RSA_PRIV) {
+            header =  BEGIN_PRIV_KEY;       footer = END_PRIV_KEY;
+        } else
+        if (header == BEGIN_PRIV_KEY) {
+            header =  BEGIN_ENC_PRIV_KEY;   footer = END_ENC_PRIV_KEY;
+        } else
+#ifdef HAVE_ECC
+        if (header == BEGIN_ENC_PRIV_KEY) {
+            header =  BEGIN_EC_PRIV;        footer = END_EC_PRIV;
+        } else
+        if (header == BEGIN_EC_PRIV) {
+            header =  BEGIN_DSA_PRIV;       footer = END_DSA_PRIV;
+        } else
+#endif
+#ifdef HAVE_ED25519
+    #ifdef HAVE_ECC
+        if (header == BEGIN_DSA_PRIV)
+    #else
+        if (header == BEGIN_ENC_PRIV_KEY)
+    #endif
+        {
+            header =  BEGIN_EDDSA_PRIV;     footer = END_EDDSA_PRIV;
+        } else
+#endif
+#ifdef HAVE_CRL
+        if (type == CRL_TYPE) {
+            header =  BEGIN_CRL;        footer = END_CRL;
+        } else
+#endif
+        {
+            break;
+        }
+    }
+
+    if (!headerEnd) {
+        WOLFSSL_MSG("Couldn't find PEM header");
+        return ASN_NO_PEM_HEADER;
+    }
+
+    headerEnd += XSTRLEN(header);
+
+    /* eat end of line characters */
+    headerEnd = SkipEndOfLineChars(headerEnd, bufferEnd);
+
+    if (type == PRIVATEKEY_TYPE) {
+        if (eccKey) {
+        #ifdef HAVE_ECC
+            *eccKey = (header == BEGIN_EC_PRIV) ? 1 : 0;
+        #else
+            *eccKey = 0;
+        #endif
+        }
+    }
+
+#ifdef WOLFSSL_ENCRYPTED_KEYS
+    if (info) {
+        ret = wc_EncryptedInfoParse(info, &headerEnd, bufferEnd - headerEnd);
+        if (ret < 0)
+            return ret;
+        if (info->set)
+            encrypted_key = 1;
+    }
+#endif /* WOLFSSL_ENCRYPTED_KEYS */
+
+    /* find footer */
+    footerEnd = XSTRNSTR((char*)buff, footer, sz);
+    if (!footerEnd) {
+        if (info)
+            info->consumed = longSz; /* No more certs if no footer */
+        return BUFFER_E;
+    }
+
+    consumedEnd = footerEnd + XSTRLEN(footer);
+
+    if (consumedEnd < bufferEnd) { /* handle no end of line on last line */
+        /* eat end of line characters */
+        consumedEnd = SkipEndOfLineChars(consumedEnd, bufferEnd);
+        /* skip possible null term */
+        if (consumedEnd < bufferEnd && consumedEnd[0] == '\0')
+            consumedEnd++;
+    }
+
+    if (info)
+        info->consumed = (long)(consumedEnd - (char*)buff);
+
+    /* set up der buffer */
+    neededSz = (long)(footerEnd - headerEnd);
+    if (neededSz > sz || neededSz <= 0)
+        return BUFFER_E;
+
+    ret = AllocDer(pDer, (word32)neededSz, type, heap);
+    if (ret < 0) {
+        return ret;
+    }
+    der = *pDer;
+
+    if (Base64_Decode((byte*)headerEnd, (word32)neededSz,
+                      der->buffer, &der->length) < 0)
+        return BUFFER_E;
+
+    if ((header == BEGIN_PRIV_KEY
+#ifdef HAVE_ECC
+         || header == BEGIN_EC_PRIV
+#endif
+        ) && !encrypted_key)
+    {
+        /* pkcs8 key, convert and adjust length */
+        if ((ret = ToTraditional_ex(der->buffer, der->length, &algId)) > 0) {
+            der->length = ret;
+        }
+        else {
+            /* ignore failure here and assume key is not pkcs8 wrapped */
+        }
+
+        return 0;
+    }
+
+#ifdef WOLFSSL_ENCRYPTED_KEYS
+    if (encrypted_key || header == BEGIN_ENC_PRIV_KEY) {
+        int   passwordSz = NAME_SZ;
+    #ifdef WOLFSSL_SMALL_STACK
+        char* password = NULL;
+    #else
+        char  password[NAME_SZ];
+    #endif
+
+        if (!info || !info->passwd_cb) {
+            WOLFSSL_MSG("No password callback set");
+            return NO_PASSWORD;
+        }
+
+    #ifdef WOLFSSL_SMALL_STACK
+        password = (char*)XMALLOC(passwordSz, heap, DYNAMIC_TYPE_STRING);
+        if (password == NULL)
+            return MEMORY_E;
+    #endif
+
+        /* get password */
+        ret = info->passwd_cb(password, passwordSz, PEM_PASS_READ,
+            info->passwd_userdata);
+        if (ret >= 0) {
+            passwordSz = ret;
+
+            /* convert and adjust length */
+            if (header == BEGIN_ENC_PRIV_KEY) {
+            #ifndef NO_PWDBASED
+                ret = ToTraditionalEnc(der->buffer, der->length,
+                                       password, passwordSz, &algId);
+
+                if (ret >= 0) {
+                    der->length = ret;
+                    if ((algId == ECDSAk) && (eccKey != NULL)) {
+                        *eccKey = 1;
+                    }
+                    ret = 0;
+                }
+            #else
+                ret = NOT_COMPILED_IN;
+            #endif
+            }
+            /* decrypt the key */
+            else {
+                ret = wc_BufferKeyDecrypt(info, der->buffer, der->length,
+                    (byte*)password, passwordSz, WC_MD5);
+            }
+            ForceZero(password, passwordSz);
+        }
+
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(password, heap, DYNAMIC_TYPE_STRING);
+    #endif
+    }
+#endif /* WOLFSSL_ENCRYPTED_KEYS */
+
+    return ret;
+}
+
+int wc_PemToDer(const unsigned char* buff, long longSz, int type,
+              DerBuffer** pDer, void* heap, EncryptedInfo* info, int* eccKey)
+{
+    return PemToDer(buff, longSz, type, pDer, heap, info, eccKey);
+}
+
+
+/* our KeyPemToDer password callback, password in userData */
+static WC_INLINE int OurPasswordCb(char* passwd, int sz, int rw, void* userdata)
+{
+    (void)rw;
+
+    if (userdata == NULL)
+        return 0;
+
+    XSTRNCPY(passwd, (char*)userdata, sz);
+    return min((word32)sz, (word32)XSTRLEN((char*)userdata));
+}
+
+/* Return bytes written to buff or < 0 for error */
+int wc_KeyPemToDer(const unsigned char* pem, int pemSz,
+                        unsigned char* buff, int buffSz, const char* pass)
+{
+    int            eccKey = 0;
+    int            ret;
+    DerBuffer*     der = NULL;
+#ifdef WOLFSSL_SMALL_STACK
+    EncryptedInfo* info = NULL;
+#else
+    EncryptedInfo  info[1];
+#endif
+
+    WOLFSSL_ENTER("wc_KeyPemToDer");
+
+    if (pem == NULL || buff == NULL || buffSz <= 0) {
+        WOLFSSL_MSG("Bad pem der args");
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    info = (EncryptedInfo*)XMALLOC(sizeof(EncryptedInfo), NULL,
+                                   DYNAMIC_TYPE_ENCRYPTEDINFO);
+    if (info == NULL)
+        return MEMORY_E;
+#endif
+
+    XMEMSET(info, 0, sizeof(EncryptedInfo));
+    info->passwd_cb = OurPasswordCb;
+    info->passwd_userdata = (void*)pass;
+
+    ret = PemToDer(pem, pemSz, PRIVATEKEY_TYPE, &der, NULL, info, &eccKey);
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(info, NULL, DYNAMIC_TYPE_ENCRYPTEDINFO);
+#endif
+
+    if (ret < 0) {
+        WOLFSSL_MSG("Bad Pem To Der");
+    }
+    else {
+        if (der->length <= (word32)buffSz) {
+            XMEMCPY(buff, der->buffer, der->length);
+            ret = der->length;
+        }
+        else {
+            WOLFSSL_MSG("Bad der length");
+            ret = BAD_FUNC_ARG;
+        }
+    }
+
+    FreeDer(&der);
+    return ret;
+}
+
+
+/* Return bytes written to buff or < 0 for error */
+int wc_CertPemToDer(const unsigned char* pem, int pemSz,
+                        unsigned char* buff, int buffSz, int type)
+{
+    int            eccKey = 0;
+    int            ret;
+    DerBuffer*     der = NULL;
+
+    WOLFSSL_ENTER("wc_CertPemToDer");
+
+    if (pem == NULL || buff == NULL || buffSz <= 0) {
+        WOLFSSL_MSG("Bad pem der args");
+        return BAD_FUNC_ARG;
+    }
+
+    if (type != CERT_TYPE && type != CA_TYPE && type != CERTREQ_TYPE) {
+        WOLFSSL_MSG("Bad cert type");
+        return BAD_FUNC_ARG;
+    }
+
+
+    ret = PemToDer(pem, pemSz, type, &der, NULL, NULL, &eccKey);
+    if (ret < 0) {
+        WOLFSSL_MSG("Bad Pem To Der");
+    }
+    else {
+        if (der->length <= (word32)buffSz) {
+            XMEMCPY(buff, der->buffer, der->length);
+            ret = der->length;
+        }
+        else {
+            WOLFSSL_MSG("Bad der length");
+            ret = BAD_FUNC_ARG;
+        }
+    }
+
+    FreeDer(&der);
+    return ret;
+}
+
+#endif /* WOLFSSL_PEM_TO_DER */
+#endif /* WOLFSSL_PEM_TO_DER || WOLFSSL_DER_TO_PEM */
+
+
+#ifdef WOLFSSL_PEM_TO_DER
+#if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)
+/* Return bytes written to buff or < 0 for error */
+int wc_PubKeyPemToDer(const unsigned char* pem, int pemSz,
+                           unsigned char* buff, int buffSz)
+{
+    int ret;
+    DerBuffer* der = NULL;
+
+    WOLFSSL_ENTER("wc_PubKeyPemToDer");
+
+    if (pem == NULL || buff == NULL || buffSz <= 0) {
+        WOLFSSL_MSG("Bad pem der args");
+        return BAD_FUNC_ARG;
+    }
+
+    ret = PemToDer(pem, pemSz, PUBLICKEY_TYPE, &der, NULL, NULL, NULL);
+    if (ret < 0) {
+        WOLFSSL_MSG("Bad Pem To Der");
+    }
+    else {
+        if (der->length <= (word32)buffSz) {
+            XMEMCPY(buff, der->buffer, der->length);
+            ret = der->length;
+        }
+        else {
+            WOLFSSL_MSG("Bad der length");
+            ret = BAD_FUNC_ARG;
+        }
+    }
+
+    FreeDer(&der);
+    return ret;
+}
+#endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */
+#endif /* WOLFSSL_PEM_TO_DER */
+
+#ifndef NO_FILESYSTEM
+
+#ifdef WOLFSSL_CERT_GEN
+/* load pem cert from file into der buffer, return der size or error */
+int wc_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
+{
+#ifdef WOLFSSL_SMALL_STACK
+    byte   staticBuffer[1]; /* force XMALLOC */
+#else
+    byte   staticBuffer[FILE_BUFFER_SIZE];
+#endif
+    byte*  fileBuf = staticBuffer;
+    int    dynamic = 0;
+    int    ret     = 0;
+    long   sz      = 0;
+    XFILE  file;
+    DerBuffer* converted = NULL;
+
+    WOLFSSL_ENTER("wc_PemCertToDer");
+
+    if (fileName == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        file = XFOPEN(fileName, "rb");
+        if (file == XBADFILE) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        if(XFSEEK(file, 0, XSEEK_END) != 0)
+            ret = BUFFER_E;
+        sz = XFTELL(file);
+        XREWIND(file);
+
+        if (sz <= 0) {
+            ret = BUFFER_E;
+        }
+        else if (sz > (long)sizeof(staticBuffer)) {
+        #ifdef WOLFSSL_STATIC_MEMORY
+            WOLFSSL_MSG("File was larger then static buffer");
+            return MEMORY_E;
+        #endif
+            fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE);
+            if (fileBuf == NULL)
+                ret = MEMORY_E;
+            else
+                dynamic = 1;
+        }
+
+        if (ret == 0) {
+            if ( (ret = (int)XFREAD(fileBuf, 1, sz, file)) != sz) {
+                ret = BUFFER_E;
+            }
+        #ifdef WOLFSSL_PEM_TO_DER
+            else {
+                ret = PemToDer(fileBuf, sz, CA_TYPE, &converted,  0, NULL,NULL);
+            }
+        #endif
+
+            if (ret == 0) {
+                if (converted->length < (word32)derSz) {
+                    XMEMCPY(derBuf, converted->buffer, converted->length);
+                    ret = converted->length;
+                }
+                else
+                    ret = BUFFER_E;
+            }
+
+            FreeDer(&converted);
+        }
+
+        XFCLOSE(file);
+        if (dynamic)
+            XFREE(fileBuf, NULL, DYNAMIC_TYPE_FILE);
+    }
+
+    return ret;
+}
+#endif /* WOLFSSL_CERT_GEN */
+
+#if defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)
+/* load pem public key from file into der buffer, return der size or error */
+int wc_PemPubKeyToDer(const char* fileName,
+                           unsigned char* derBuf, int derSz)
+{
+#ifdef WOLFSSL_SMALL_STACK
+    byte   staticBuffer[1]; /* force XMALLOC */
+#else
+    byte   staticBuffer[FILE_BUFFER_SIZE];
+#endif
+    byte*  fileBuf = staticBuffer;
+    int    dynamic = 0;
+    int    ret     = 0;
+    long   sz      = 0;
+    XFILE  file;
+    DerBuffer* converted = NULL;
+
+    WOLFSSL_ENTER("wc_PemPubKeyToDer");
+
+    if (fileName == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        file = XFOPEN(fileName, "rb");
+        if (file == XBADFILE) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        if(XFSEEK(file, 0, XSEEK_END) != 0)
+            ret = BUFFER_E;
+        sz = XFTELL(file);
+        XREWIND(file);
+
+        if (sz <= 0) {
+            ret = BUFFER_E;
+        }
+        else if (sz > (long)sizeof(staticBuffer)) {
+        #ifdef WOLFSSL_STATIC_MEMORY
+            WOLFSSL_MSG("File was larger then static buffer");
+            return MEMORY_E;
+        #endif
+            fileBuf = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_FILE);
+            if (fileBuf == NULL)
+                ret = MEMORY_E;
+            else
+                dynamic = 1;
+        }
+        if (ret == 0) {
+            if ( (ret = (int)XFREAD(fileBuf, 1, sz, file)) != sz) {
+                ret = BUFFER_E;
+            }
+        #ifdef WOLFSSL_PEM_TO_DER
+            else {
+                ret = PemToDer(fileBuf, sz, PUBLICKEY_TYPE, &converted,
+                               0, NULL, NULL);
+            }
+        #endif
+
+            if (ret == 0) {
+                if (converted->length < (word32)derSz) {
+                    XMEMCPY(derBuf, converted->buffer, converted->length);
+                    ret = converted->length;
+                }
+                else
+                    ret = BUFFER_E;
+    }
+
+            FreeDer(&converted);
+    }
+
+        XFCLOSE(file);
+        if (dynamic)
+            XFREE(fileBuf, NULL, DYNAMIC_TYPE_FILE);
+    }
+
+    return ret;
+}
+#endif /* WOLFSSL_CERT_EXT || WOLFSSL_PUB_PEM_TO_DER */
+
+#endif /* !NO_FILESYSTEM */
+
 
 #if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \
-        (defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA)))
+    ((defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA)) && !defined(HAVE_USER_RSA)))
 /* USER RSA ifdef portions used instead of refactor in consideration for
    possible fips build */
@@ -6723 +9443 @@
     /* n */
 #ifdef WOLFSSL_SMALL_STACK
-    n = (byte*)XMALLOC(MAX_RSA_INT_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    n = (byte*)XMALLOC(MAX_RSA_INT_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (n == NULL)
         return MEMORY_E;
@@ -6735 +9455 @@
     if (nSz < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(n, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return nSz;
@@ -6742 +9462 @@
     /* e */
 #ifdef WOLFSSL_SMALL_STACK
-    e = (byte*)XMALLOC(MAX_RSA_E_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    e = (byte*)XMALLOC(MAX_RSA_E_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (e == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(n, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return MEMORY_E;
@@ -6758 +9478 @@
     if (eSz < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(n, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(e, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return eSz;
@@ -6769 +9489 @@
     if ( (seqSz + nSz + eSz) > outLen) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(n,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(e,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(n,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(e,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BUFFER_E;
@@ -6781 +9501 @@
         byte* algo = NULL;
 
-        algo = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        algo = (byte*)XMALLOC(MAX_ALGO_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
         if (algo == NULL) {
-            XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(n, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(e, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return MEMORY_E;
         }
@@ -6798 +9518 @@
         if ( (idx + algoSz + bitStringSz + seqSz + nSz + eSz) > outLen) {
             #ifdef WOLFSSL_SMALL_STACK
-                XFREE(n,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
-                XFREE(e,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
-                XFREE(algo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(n,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(e,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(algo, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
             #endif
 
@@ -6813 +9533 @@
         idx += bitStringSz;
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(algo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(algo, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     }
@@ -6830 +9550 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(n,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(e,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
+    XFREE(n,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(e,    key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    return idx;
+}
+
+int RsaPublicKeyDerSize(RsaKey* key, int with_header)
+{
+    byte* dummy = NULL;
+    byte seq[MAX_SEQ_SZ];
+    byte bitString[1 + MAX_LENGTH_SZ + 1];
+    int  nSz;
+    int  eSz;
+    int  seqSz;
+    int  bitStringSz;
+    int  idx;
+
+    if (key == NULL)
+        return BAD_FUNC_ARG;
+
+    /* n */
+    dummy = (byte*)XMALLOC(MAX_RSA_INT_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (dummy == NULL)
+        return MEMORY_E;
+
+#ifdef HAVE_USER_RSA
+    nSz = SetASNIntRSA(key->n, dummy);
+#else
+    nSz = SetASNIntMP(&key->n, MAX_RSA_INT_SZ, dummy);
+#endif
+    XFREE(dummy, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (nSz < 0) {
+        return nSz;
+    }
+
+    /* e */
+    dummy = (byte*)XMALLOC(MAX_RSA_E_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (dummy == NULL) {
+        XFREE(dummy, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return MEMORY_E;
+    }
+
+#ifdef HAVE_USER_RSA
+    eSz = SetASNIntRSA(key->e, dummy);
+#else
+    eSz = SetASNIntMP(&key->e, MAX_RSA_INT_SZ, dummy);
+#endif
+    XFREE(dummy, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (eSz < 0) {
+        return eSz;
+    }
+
+    seqSz  = SetSequence(nSz + eSz, seq);
+
+    /* headers */
+    if (with_header) {
+        int  algoSz;
+        dummy = (byte*)XMALLOC(MAX_RSA_INT_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (dummy == NULL)
+            return MEMORY_E;
+
+        algoSz = SetAlgoID(RSAk, dummy, oidKeyType, 0);
+        bitStringSz  = SetBitString(seqSz + nSz + eSz, 0, bitString);
+
+        idx = SetSequence(nSz + eSz + seqSz + bitStringSz + algoSz, dummy);
+        XFREE(dummy, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+
+        /* algo */
+        idx += algoSz;
+        /* bit string */
+        idx += bitStringSz;
+    }
+    else
+        idx = 0;
+
+    /* seq */
+    idx += seqSz;
+    /* n */
+    idx += nSz;
+    /* e */
+    idx += eSz;
 
     return idx;
@@ -6841 +9640 @@
 
 #if defined(WOLFSSL_KEY_GEN) && !defined(NO_RSA) && !defined(HAVE_USER_RSA)
-
 
 static mp_int* GetRsaInt(RsaKey* key, int idx)
@@ -6867 +9665 @@
 
 /* Release Tmp RSA resources */
-static INLINE void FreeTmpRsas(byte** tmps, void* heap)
+static WC_INLINE void FreeTmpRsas(byte** tmps, void* heap)
 {
     int i;
@@ -6929 +9727 @@
 
     outLen = seqSz + verSz + intTotalLen;
-    if (outLen > (int)inLen)
+    if (outLen > (int)inLen) {
+        FreeTmpRsas(tmps, key->heap);
         return BAD_FUNC_ARG;
+    }
 
     /* write to output */
@@ -6946 +9746 @@
     return outLen;
 }
-
-
+#endif
+
+#if (defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA)) && !defined(NO_RSA) && !defined(HAVE_USER_RSA)
 /* Convert Rsa Public key to DER format, write to output (inLen), return bytes
    written */
@@ -6955 +9756 @@
 }
 
-#endif /* WOLFSSL_KEY_GEN && !NO_RSA && !HAVE_USER_RSA */
+#endif /* (WOLFSSL_KEY_GEN || OPENSSL_EXTRA) && !NO_RSA && !HAVE_USER_RSA */
 
 
@@ -6971 +9772 @@
 int wc_InitCert(Cert* cert)
 {
+#ifdef WOLFSSL_MULTI_ATTRIB
+    int i = 0;
+#endif
     if (cert == NULL) {
         return BAD_FUNC_ARG;
     }
 
+    XMEMSET(cert, 0, sizeof(Cert));
+
     cert->version    = 2;   /* version 3 is hex 2 */
+#ifndef NO_SHA
     cert->sigType    = CTC_SHAwRSA;
+#elif !defined(NO_SHA256)
+    cert->sigType    = CTC_SHA256wRSA;
+#else
+    cert->sigType    = 0;
+#endif
     cert->daysValid  = 500;
     cert->selfSigned = 1;
-    cert->isCA       = 0;
-    cert->bodySz     = 0;
-#ifdef WOLFSSL_ALT_NAMES
-    cert->altNamesSz   = 0;
-    cert->beforeDateSz = 0;
-    cert->afterDateSz  = 0;
-#endif
-#ifdef WOLFSSL_CERT_EXT
-    cert->skidSz = 0;
-    cert->akidSz = 0;
-    cert->keyUsage = 0;
-    cert->extKeyUsage = 0;
-    cert->certPoliciesNb = 0;
-    XMEMSET(cert->akid, 0, CTC_MAX_AKID_SIZE);
-    XMEMSET(cert->skid, 0, CTC_MAX_SKID_SIZE);
-    XMEMSET(cert->certPolicies, 0, CTC_MAX_CERTPOL_NB*CTC_MAX_CERTPOL_SZ);
-#endif
     cert->keyType    = RSA_KEY;
-    XMEMSET(cert->serial, 0, CTC_SERIAL_SIZE);
-    cert->serialSz = 0;
-
-    cert->issuer.country[0] = '\0';
+
     cert->issuer.countryEnc = CTC_PRINTABLE;
-    cert->issuer.state[0] = '\0';
     cert->issuer.stateEnc = CTC_UTF8;
-    cert->issuer.locality[0] = '\0';
     cert->issuer.localityEnc = CTC_UTF8;
-    cert->issuer.sur[0] = '\0';
     cert->issuer.surEnc = CTC_UTF8;
-    cert->issuer.org[0] = '\0';
     cert->issuer.orgEnc = CTC_UTF8;
-    cert->issuer.unit[0] = '\0';
     cert->issuer.unitEnc = CTC_UTF8;
-    cert->issuer.commonName[0] = '\0';
     cert->issuer.commonNameEnc = CTC_UTF8;
-    cert->issuer.email[0] = '\0';
-
-    cert->subject.country[0] = '\0';
+
     cert->subject.countryEnc = CTC_PRINTABLE;
-    cert->subject.state[0] = '\0';
     cert->subject.stateEnc = CTC_UTF8;
-    cert->subject.locality[0] = '\0';
     cert->subject.localityEnc = CTC_UTF8;
-    cert->subject.sur[0] = '\0';
     cert->subject.surEnc = CTC_UTF8;
-    cert->subject.org[0] = '\0';
     cert->subject.orgEnc = CTC_UTF8;
-    cert->subject.unit[0] = '\0';
     cert->subject.unitEnc = CTC_UTF8;
-    cert->subject.commonName[0] = '\0';
     cert->subject.commonNameEnc = CTC_UTF8;
-    cert->subject.email[0] = '\0';
-
-#ifdef WOLFSSL_CERT_REQ
-    cert->challengePw[0] ='\0';
-#endif
+
+#ifdef WOLFSSL_MULTI_ATTRIB
+    for (i = 0; i < CTC_MAX_ATTRIB; i++) {
+        cert->issuer.name[i].type   = CTC_UTF8;
+        cert->subject.name[i].type  = CTC_UTF8;
+    }
+#endif /* WOLFSSL_MULTI_ATTRIB */
+
 #ifdef WOLFSSL_HEAP_TEST
     cert->heap = (void*)WOLFSSL_HEAP_TEST;
-#else
-    cert->heap = NULL;
 #endif
 
@@ -7049 +9828 @@
     byte size[MAX_LENGTH_SZ];          /* length encoded */
     byte version[MAX_VERSION_SZ];      /* version encoded */
-    byte serial[CTC_SERIAL_SIZE + MAX_LENGTH_SZ]; /* serial number encoded */
+    byte serial[(int)CTC_SERIAL_SIZE + (int)MAX_LENGTH_SZ]; /* serial number encoded */
     byte sigAlgo[MAX_ALGO_SZ];         /* signature algo encoded */
     byte issuer[ASN_NAME_MAX];         /* issuer  encoded */
@@ -7110 +9889 @@
 #endif /*WOLFSSL_CERT_GEN */
 
-#if defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
+
+#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)
 
 /* Write a public ECC key to output */
@@ -7130 +9910 @@
     byte pub[ECC_BUFSIZE];
 #endif
+    int ret;
 
 #ifdef WOLFSSL_SMALL_STACK
-    pub = (byte*)XMALLOC(ECC_BUFSIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    pub = (byte*)XMALLOC(ECC_BUFSIZE, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (pub == NULL)
         return MEMORY_E;
 #endif
 
-    int ret = wc_ecc_export_x963(key, pub, &pubSz);
+    ret = wc_ecc_export_x963(key, pub, &pubSz);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
@@ -7148 +9929 @@
     if (with_header) {
 #ifdef WOLFSSL_SMALL_STACK
-        curve = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        curve = (byte*)XMALLOC(MAX_ALGO_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
         if (curve == NULL) {
-            XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return MEMORY_E;
         }
@@ -7157 +9938 @@
         if (curveSz <= 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            XFREE(pub,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(curve, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pub,   key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return curveSz;
@@ -7164 +9945 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-        algo = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        algo = (byte*)XMALLOC(MAX_ALGO_SZ, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
         if (algo == NULL) {
-            XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            XFREE(pub,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(curve, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pub,   key->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return MEMORY_E;
         }
@@ -7195 +9976 @@
 #ifdef WOLFSSL_SMALL_STACK
     if (with_header) {
-        XFREE(algo,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    }
-    XFREE(pub,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(algo,  key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(curve, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+    XFREE(pub,   key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -7241 +10022 @@
     return SetEccPublicKey(output, key, with_AlgCurve);
 }
-#endif /* HAVE_ECC && (WOLFSSL_CERT_GEN || WOLFSSL_KEY_GEN) */
+#endif /* HAVE_ECC && HAVE_ECC_KEY_EXPORT */
 
 #if defined(HAVE_ED25519) && (defined(WOLFSSL_CERT_GEN) || \
@@ -7271 +10052 @@
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
@@ -7281 +10062 @@
         algo = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (algo == NULL) {
-            XFREE(pub,   NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pub,   key->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return MEMORY_E;
         }
@@ -7351 +10132 @@
 #ifdef WOLFSSL_CERT_GEN
 
-static INLINE byte itob(int number)
+static WC_INLINE byte itob(int number)
 {
     return (byte)number + 0x30;
@@ -7406 +10187 @@
 
 
-/* for systems where mktime() doesn't normalize fully */
-static void RebuildTime(time_t* in, struct tm* out)
-{
-    #if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
-        out = localtime_r(in, out);
-    #else
-        (void)in;
-        (void)out;
-    #endif
-}
-
-
 /* Set Date validity from now until now + daysValid
  * return size in bytes written to output, 0 on error */
@@ -7429 +10198 @@
     int seqSz;
 
-    time_t     ticks;
-    time_t     normalTime;
-    struct tm* now;
+    time_t now;
+    time_t then;
     struct tm* tmpTime = NULL;
-    struct tm  local;
+    struct tm* expandedTime;
+    struct tm localTime;
 
 #if defined(NEED_TMP_TIME)
@@ -7443 +10212 @@
 #endif
 
-    ticks = XTIME(0);
-    now   = XGMTIME(&ticks, tmpTime);
-
-    if (now == NULL) {
+    now = XTIME(0);
+
+    /* before now */
+    before[0] = ASN_GENERALIZED_TIME;
+    beforeSz  = SetLength(ASN_GEN_TIME_SZ, before + 1) + 1;  /* gen tag */
+
+    /* subtract 1 day of seconds for more compliance */
+    then = now - 86400;
+    expandedTime = XGMTIME(&then, tmpTime);
+    if (expandedTime == NULL) {
         WOLFSSL_MSG("XGMTIME failed");
         return 0;   /* error */
     }
-
-    /* before now */
-    local = *now;
-    before[0] = ASN_GENERALIZED_TIME;
-    beforeSz  = SetLength(ASN_GEN_TIME_SZ, before + 1) + 1;  /* gen tag */
-
-    /* subtract 1 day for more compliance */
-    local.tm_mday -= 1;
-    normalTime = mktime(&local);
-    RebuildTime(&normalTime, &local);
+    localTime = *expandedTime;
 
     /* adjust */
-    local.tm_year += 1900;
-    local.tm_mon  +=    1;
-
-    SetTime(&local, before + beforeSz);
+    localTime.tm_year += 1900;
+    localTime.tm_mon +=    1;
+
+    SetTime(&localTime, before + beforeSz);
     beforeSz += ASN_GEN_TIME_SZ;
 
-    /* after now + daysValid */
-    local = *now;
     after[0] = ASN_GENERALIZED_TIME;
     afterSz  = SetLength(ASN_GEN_TIME_SZ, after + 1) + 1;  /* gen tag */
 
-    /* add daysValid */
-    local.tm_mday += daysValid;
-    normalTime = mktime(&local);
-    RebuildTime(&normalTime, &local);
+    /* add daysValid of seconds */
+    then = now + (daysValid * 86400);
+    expandedTime = XGMTIME(&then, tmpTime);
+    if (expandedTime == NULL) {
+        WOLFSSL_MSG("XGMTIME failed");
+        return 0;   /* error */
+    }
+    localTime = *expandedTime;
 
     /* adjust */
-    local.tm_year += 1900;
-    local.tm_mon  +=    1;
-
-    SetTime(&local, after + afterSz);
+    localTime.tm_year += 1900;
+    localTime.tm_mon  +=    1;
+
+    SetTime(&localTime, after + afterSz);
     afterSz += ASN_GEN_TIME_SZ;
 
@@ -7530 +10298 @@
 
     case 7:
+       return name->serialDev;
+
+#ifdef WOLFSSL_CERT_EXT
+    case 8:
+       return name->busCat;
+
+    case 9:
+#else
+    case 8:
+#endif
        return name->email;
 
@@ -7563 +10341 @@
        return name->commonNameEnc;
 
+    case 7:
+       return name->serialDevEnc;
+
+#ifdef WOLFSSL_CERT_EXT
+    case 8:
+       return name->busCatEnc;
+
+    case 9:
+#else
+    case 8:
+#endif
+        /* FALL THROUGH */
+        /* The last index, email name, does not have encoding type.
+           The empty case here is to keep track of it for future reference. */
     default:
        return 0;
@@ -7595 +10387 @@
 
     case 7:
-       /* email uses different id type */
-       return 0;
+       return ASN_SERIAL_NUMBER;
+
+#ifdef WOLFSSL_CERT_EXT
+    case 8:
+        return ASN_BUS_CAT;
+
+    case 9:
+#else
+    case 8:
+#endif
+        return ASN_EMAIL_NAME;
 
     default:
@@ -7814 +10615 @@
 
 /* encode Extended Key Usage (RFC 5280 4.2.1.12), return total bytes written */
-static int SetExtKeyUsage(byte* output, word32 outSz, byte input)
+static int SetExtKeyUsage(Cert* cert, byte* output, word32 outSz, byte input)
 {
     int idx = 0, oidListSz = 0, totalSz, ret = 0;
@@ -7851 +10652 @@
             ret |= SetOjectIdValue(output, outSz, &idx,
                 extExtKeyUsageOcspSignOid, sizeof(extExtKeyUsageOcspSignOid));
+    #ifdef WOLFSSL_EKU_OID
+        /* iterate through OID values */
+        if (input & EXTKEYUSE_USER) {
+            int i, sz;
+            for (i = 0; i < CTC_MAX_EKU_NB; i++) {
+                sz = cert->extKeyUsageOIDSz[i];
+                if (sz > 0) {
+                    ret |= SetOjectIdValue(output, outSz, &idx,
+                        cert->extKeyUsageOID[i], sz);
+                }
+            }
+        }
+    #endif /* WOLFSSL_EKU_OID */
     }
     if (ret != 0)
@@ -7875 +10689 @@
     idx += oidListSz;
 
+    (void)cert;
     return idx;
 }
@@ -7894 +10709 @@
         return MEMORY_E;
 
-    XSTRNCPY(str, in, len);
-    str[len] = 0x00;
+    XSTRNCPY(str, in, len+1);
 
     nb_val = 0;
@@ -8033 +10847 @@
 #endif /* WOLFSL_ALT_NAMES */
 
+/* Encodes one attribute of the name (issuer/subject)
+ *
+ * name     structure to hold result of encoding
+ * nameStr  value to be encoded
+ * nameType type of encoding i.e CTC_UTF8
+ * type     id of attribute i.e ASN_COMMON_NAME
+ *
+ * returns length on success
+ */
+static int wc_EncodeName(EncodedName* name, const char* nameStr, char nameType,
+        byte type)
+{
+    word32 idx = 0;
+
+    if (nameStr) {
+        /* bottom up */
+        byte firstLen[1 + MAX_LENGTH_SZ];
+        byte secondLen[MAX_LENGTH_SZ];
+        byte sequence[MAX_SEQ_SZ];
+        byte set[MAX_SET_SZ];
+
+        int strLen  = (int)XSTRLEN(nameStr);
+        int thisLen = strLen;
+        int firstSz, secondSz, seqSz, setSz;
+
+        if (strLen == 0) { /* no user data for this item */
+            name->used = 0;
+            return 0;
+        }
+
+        /* Restrict country code size */
+        if (ASN_COUNTRY_NAME == type && strLen != CTC_COUNTRY_SIZE) {
+            return ASN_COUNTRY_SIZE_E;
+        }
+
+        secondSz = SetLength(strLen, secondLen);
+        thisLen += secondSz;
+        switch (type) {
+            case ASN_EMAIL_NAME: /* email */
+                thisLen += EMAIL_JOINT_LEN;
+                firstSz  = EMAIL_JOINT_LEN;
+                break;
+
+            case ASN_DOMAIN_COMPONENT:
+                thisLen += PILOT_JOINT_LEN;
+                firstSz  = PILOT_JOINT_LEN;
+                break;
+
+            default:
+                thisLen++;                                 /* str type */
+                thisLen += JOINT_LEN;
+                firstSz  = JOINT_LEN + 1;
+        }
+        thisLen++; /* id  type */
+        firstSz  = SetObjectId(firstSz, firstLen);
+        thisLen += firstSz;
+
+        seqSz = SetSequence(thisLen, sequence);
+        thisLen += seqSz;
+        setSz = SetSet(thisLen, set);
+        thisLen += setSz;
+
+        if (thisLen > (int)sizeof(name->encoded)) {
+            return BUFFER_E;
+        }
+
+        /* store it */
+        idx = 0;
+        /* set */
+        XMEMCPY(name->encoded, set, setSz);
+        idx += setSz;
+        /* seq */
+        XMEMCPY(name->encoded + idx, sequence, seqSz);
+        idx += seqSz;
+        /* asn object id */
+        XMEMCPY(name->encoded + idx, firstLen, firstSz);
+        idx += firstSz;
+        switch (type) {
+            case ASN_EMAIL_NAME:
+                {
+                    const byte EMAIL_OID[] = { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+                                       0x01, 0x09, 0x01, 0x16 };
+                    /* email joint id */
+                    XMEMCPY(name->encoded + idx, EMAIL_OID, sizeof(EMAIL_OID));
+                    idx += (int)sizeof(EMAIL_OID);
+                }
+                break;
+
+            case ASN_DOMAIN_COMPONENT:
+                {
+                    const byte PILOT_OID[] = { 0x09, 0x92, 0x26, 0x89,
+                                    0x93, 0xF2, 0x2C, 0x64, 0x01
+                    };
+
+                    XMEMCPY(name->encoded + idx, PILOT_OID,
+                                                     sizeof(PILOT_OID));
+                    idx += (int)sizeof(PILOT_OID);
+                    /* id type */
+                    name->encoded[idx++] = type;
+                    /* str type */
+                    name->encoded[idx++] = nameType;
+                }
+                break;
+
+            default:
+                name->encoded[idx++] = 0x55;
+                name->encoded[idx++] = 0x04;
+                /* id type */
+                name->encoded[idx++] = type;
+                /* str type */
+                name->encoded[idx++] = nameType;
+        }
+        /* second length */
+        XMEMCPY(name->encoded + idx, secondLen, secondSz);
+        idx += secondSz;
+        /* str value */
+        XMEMCPY(name->encoded + idx, nameStr, strLen);
+        idx += strLen;
+
+        name->type = type;
+        name->totalLen = idx;
+        name->used = 1;
+    }
+    else
+        name->used = 0;
+
+    return idx;
+}
 
 /* encode CertName into output, return total bytes written */
@@ -8043 +10985 @@
     EncodedName  names[NAME_ENTRIES];
 #endif
+#ifdef WOLFSSL_MULTI_ATTRIB
+    EncodedName addNames[CTC_MAX_ATTRIB];
+    int j, type;
+#endif
 
     if (output == NULL || name == NULL)
@@ -8058 +11004 @@
 
     for (i = 0; i < NAME_ENTRIES; i++) {
+        int ret;
         const char* nameStr = GetOneName(name, i);
-        if (nameStr) {
-            /* bottom up */
-            byte firstLen[1 + MAX_LENGTH_SZ];
-            byte secondLen[MAX_LENGTH_SZ];
-            byte sequence[MAX_SEQ_SZ];
-            byte set[MAX_SET_SZ];
-
-            int email = i == (NAME_ENTRIES - 1) ? 1 : 0;
-            int strLen  = (int)XSTRLEN(nameStr);
-            int thisLen = strLen;
-            int firstSz, secondSz, seqSz, setSz;
-
-            if (strLen == 0) { /* no user data for this item */
-                names[i].used = 0;
-                continue;
-            }
-
-            /* Restrict country code size */
-            if (i == 0 && strLen != CTC_COUNTRY_SIZE) {
+
+        ret = wc_EncodeName(&names[i], nameStr, GetNameType(name, i),
+                          GetNameId(i));
+        if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
                 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
-                return ASN_COUNTRY_SIZE_E;
-            }
-
-            secondSz = SetLength(strLen, secondLen);
-            thisLen += secondSz;
-            if (email) {
-                thisLen += EMAIL_JOINT_LEN;
-                thisLen ++;                               /* id type */
-                firstSz  = SetObjectId(EMAIL_JOINT_LEN, firstLen);
-            }
-            else {
-                thisLen++;                                 /* str type */
-                thisLen++;                                 /* id  type */
-                thisLen += JOINT_LEN;
-                firstSz  = SetObjectId(JOINT_LEN + 1, firstLen);
-            }
-            thisLen += firstSz;
-
-            seqSz = SetSequence(thisLen, sequence);
-            thisLen += seqSz;
-            setSz = SetSet(thisLen, set);
-            thisLen += setSz;
-
-            if (thisLen > (int)sizeof(names[i].encoded)) {
+                return BUFFER_E;
+            }
+        totalBytes += ret;
+            }
+#ifdef WOLFSSL_MULTI_ATTRIB
+    for (i = 0; i < CTC_MAX_ATTRIB; i++) {
+        if (name->name[i].sz > 0) {
+            int ret;
+            ret = wc_EncodeName(&addNames[i], name->name[i].value,
+                        name->name[i].type, name->name[i].id);
+            if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
                 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -8110 +11029 @@
                 return BUFFER_E;
             }
-
-            /* store it */
-            idx = 0;
-            /* set */
-            XMEMCPY(names[i].encoded, set, setSz);
-            idx += setSz;
-            /* seq */
-            XMEMCPY(names[i].encoded + idx, sequence, seqSz);
-            idx += seqSz;
-            /* asn object id */
-            XMEMCPY(names[i].encoded + idx, firstLen, firstSz);
-            idx += firstSz;
-            if (email) {
-                const byte EMAIL_OID[] = { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-                                           0x01, 0x09, 0x01, 0x16 };
-                /* email joint id */
-                XMEMCPY(names[i].encoded + idx, EMAIL_OID, sizeof(EMAIL_OID));
-                idx += (int)sizeof(EMAIL_OID);
+            totalBytes += ret;
             }
             else {
-                /* joint id */
-                byte bType = GetNameId(i);
-                names[i].encoded[idx++] = 0x55;
-                names[i].encoded[idx++] = 0x04;
-                /* id type */
-                names[i].encoded[idx++] = bType;
-                /* str type */
-                names[i].encoded[idx++] = GetNameType(name, i);
-            }
-            /* second length */
-            XMEMCPY(names[i].encoded + idx, secondLen, secondSz);
-            idx += secondSz;
-            /* str value */
-            XMEMCPY(names[i].encoded + idx, nameStr, strLen);
-            idx += strLen;
-
-            totalBytes += idx;
-            names[i].totalLen = idx;
-            names[i].used = 1;
-        }
-        else
-            names[i].used = 0;
-    }
+            addNames[i].used = 0;
+        }
+    }
+#endif /* WOLFSSL_MULTI_ATTRIB */
 
     /* header */
@@ -8165 +11048 @@
 
     for (i = 0; i < NAME_ENTRIES; i++) {
+    #ifdef WOLFSSL_MULTI_ATTRIB
+        type = GetNameId(i);
+
+        /* list all DC values before OUs */
+        if (type == ASN_ORGUNIT_NAME) {
+            type = ASN_DOMAIN_COMPONENT;
+            for (j = 0; j < CTC_MAX_ATTRIB; j++) {
+                if (name->name[j].sz > 0 && type == name->name[j].id) {
+                    if (outputSz < (word32)(idx+addNames[j].totalLen)) {
+                    #ifdef WOLFSSL_SMALL_STACK
+                        XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                    #endif
+                        return BUFFER_E;
+                    }
+
+                    XMEMCPY(output + idx, addNames[j].encoded,
+                            addNames[j].totalLen);
+                    idx += addNames[j].totalLen;
+                }
+            }
+            type = ASN_ORGUNIT_NAME;
+        }
+
+        /* write all similar types to the buffer */
+        for (j = 0; j < CTC_MAX_ATTRIB; j++) {
+            if (name->name[j].sz > 0 && type == name->name[j].id) {
+                if (outputSz < (word32)(idx+addNames[j].totalLen)) {
+                #ifdef WOLFSSL_SMALL_STACK
+                    XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                #endif
+                    return BUFFER_E;
+                }
+
+                XMEMCPY(output + idx, addNames[j].encoded,
+                        addNames[j].totalLen);
+                idx += addNames[j].totalLen;
+            }
+        }
+    #endif /* WOLFSSL_MULTI_ATTRIB */
+
         if (names[i].used) {
             if (outputSz < (word32)(idx+names[i].totalLen)) {
@@ -8296 +11219 @@
 
     /* subject name */
-    der->subjectSz = SetName(der->subject, sizeof(der->subject), &cert->subject);
+#ifdef WOLFSSL_CERT_EXT
+    if (XSTRLEN((const char*)cert->sbjRaw) > 0) {
+        /* Use the raw subject */
+        int idx;
+
+        der->subjectSz = min(sizeof(der->subject),
+                (word32)XSTRLEN((const char*)cert->sbjRaw));
+        /* header */
+        idx = SetSequence(der->subjectSz, der->subject);
+        if (der->subjectSz + idx > (int)sizeof(der->subject)) {
+            return SUBJECT_E;
+        }
+
+        XMEMCPY((char*)der->subject + idx, (const char*)cert->sbjRaw,
+                der->subjectSz);
+        der->subjectSz += idx;
+    }
+    else
+#endif
+    {
+        /* Use the name structure */
+        der->subjectSz = SetName(der->subject, sizeof(der->subject),
+                &cert->subject);
+    }
     if (der->subjectSz <= 0)
         return SUBJECT_E;
 
     /* issuer name */
-    der->issuerSz = SetName(der->issuer, sizeof(der->issuer), cert->selfSigned ?
-             &cert->subject : &cert->issuer);
+#ifdef WOLFSSL_CERT_EXT
+    if (XSTRLEN((const char*)cert->issRaw) > 0) {
+        /* Use the raw issuer */
+        int idx;
+
+        der->issuerSz = min(sizeof(der->issuer),
+                (word32)XSTRLEN((const char*)cert->issRaw));
+        /* header */
+        idx = SetSequence(der->issuerSz, der->issuer);
+        if (der->issuerSz + idx > (int)sizeof(der->issuer)) {
+            return ISSUER_E;
+        }
+
+        XMEMCPY((char*)der->issuer + idx, (const char*)cert->issRaw,
+                der->issuerSz);
+        der->issuerSz += idx;
+    }
+    else
+#endif
+    {
+        /* Use the name structure */
+        der->issuerSz = SetName(der->issuer, sizeof(der->issuer),
+                cert->selfSigned ? &cert->subject : &cert->issuer);
+    }
     if (der->issuerSz <= 0)
         return ISSUER_E;
@@ -8338 +11306 @@
     if (cert->skidSz) {
         /* check the provided SKID size */
-        if (cert->skidSz > (int)sizeof(der->skid))
+        if (cert->skidSz > (int)min(CTC_MAX_SKID_SIZE, sizeof(der->skid)))
             return SKID_E;
 
@@ -8356 +11324 @@
     if (cert->akidSz) {
         /* check the provided AKID size */
-        if (cert->akidSz > (int)sizeof(der->akid))
+        if (cert->akidSz > (int)min(CTC_MAX_AKID_SIZE, sizeof(der->akid)))
             return AKID_E;
 
@@ -8383 +11351 @@
     /* Extended Key Usage */
     if (cert->extKeyUsage != 0){
-        der->extKeyUsageSz = SetExtKeyUsage(der->extKeyUsage,
+        der->extKeyUsageSz = SetExtKeyUsage(cert, der->extKeyUsage,
                                 sizeof(der->extKeyUsage), cert->extKeyUsage);
         if (der->extKeyUsageSz <= 0)
@@ -8687 +11655 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    der = (DerCert*)XMALLOC(sizeof(DerCert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    der = (DerCert*)XMALLOC(sizeof(DerCert), cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (der == NULL)
         return MEMORY_E;
@@ -8702 +11670 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -8741 +11709 @@
                   const byte* ntruKey, word16 keySz, WC_RNG* rng)
 {
-    return MakeAnyCert(cert, derBuffer, derSz, NULL, NULL, rng, ntruKey, keySz);
+    return MakeAnyCert(cert, derBuffer, derSz, NULL, NULL, rng, ntruKey, keySz, NULL);
 }
 
@@ -8889 +11857 @@
     if (cert->skidSz) {
         /* check the provided SKID size */
-        if (cert->skidSz > (int)sizeof(der->skid))
+        if (cert->skidSz > (int)min(CTC_MAX_SKID_SIZE, sizeof(der->skid)))
             return SKID_E;
 
@@ -8916 +11884 @@
     /* Extended Key Usage */
     if (cert->extKeyUsage != 0){
-        der->extKeyUsageSz = SetExtKeyUsage(der->extKeyUsage,
+        der->extKeyUsageSz = SetExtKeyUsage(cert, der->extKeyUsage,
                                 sizeof(der->extKeyUsage), cert->extKeyUsage);
         if (der->extKeyUsageSz <= 0)
@@ -9041 +12009 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    der = (DerCert*)XMALLOC(sizeof(DerCert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    der = (DerCert*)XMALLOC(sizeof(DerCert), cert->heap,
+                                                    DYNAMIC_TYPE_TMP_BUFFER);
     if (der == NULL)
         return MEMORY_E;
@@ -9056 +12025 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -9140 +12109 @@
     sigSz = MakeSignature(certSignCtx, buffer, requestSz, certSignCtx->sig,
         MAX_ENCODED_SIG_SZ, rsaKey, eccKey, ed25519Key, rng, sType, heap);
-    if (sigSz == WC_PENDING_E)
+    if (sigSz == WC_PENDING_E) {
+        /* Not free'ing certSignCtx->sig here because it could still be in use
+         * with async operations. */
         return sigSz;
+    }
 
     if (sigSz >= 0) {
@@ -9147 +12119 @@
             sigSz = BUFFER_E;
         else
-            sigSz = AddSignature(buffer, requestSz, certSignCtx->sig, sigSz, sType);
+            sigSz = AddSignature(buffer, requestSz, certSignCtx->sig, sigSz,
+                                 sType);
     }
 
@@ -9196 +12169 @@
 
 #ifdef WOLFSSL_CERT_EXT
+
+/* Get raw subject from cert, which may contain OIDs not parsed by Decode.
+   The raw subject pointer will only be valid while "cert" is valid. */
+int wc_GetSubjectRaw(byte **subjectRaw, Cert *cert)
+{
+    int rc = BAD_FUNC_ARG;
+    if ((subjectRaw != NULL) && (cert != NULL)) {
+        *subjectRaw = cert->sbjRaw;
+        rc = 0;
+    }
+    return rc;
+}
 
 /* Set KID from public key */
@@ -9252 +12237 @@
 
     /* Compute SKID by hashing public key */
-#ifdef NO_SHA
     if (kid_type == SKID_TYPE) {
-        ret = wc_Sha256Hash(buffer, bufferSz, cert->skid);
-        cert->skidSz = WC_SHA256_DIGEST_SIZE;
+        ret = CalcHashId(buffer, bufferSz, cert->skid);
+        cert->skidSz = KEYID_SIZE;
     }
     else if (kid_type == AKID_TYPE) {
-        ret = wc_Sha256Hash(buffer, bufferSz, cert->akid);
-        cert->akidSz = WC_SHA256_DIGEST_SIZE;
+        ret = CalcHashId(buffer, bufferSz, cert->akid);
+        cert->akidSz = KEYID_SIZE;
     }
     else
         ret = BAD_FUNC_ARG;
-#else /* NO_SHA */
-    if (kid_type == SKID_TYPE) {
-        ret = wc_ShaHash(buffer, bufferSz, cert->skid);
-        cert->skidSz = WC_SHA_DIGEST_SIZE;
-    }
-    else if (kid_type == AKID_TYPE) {
-        ret = wc_ShaHash(buffer, bufferSz, cert->akid);
-        cert->akidSz = WC_SHA_DIGEST_SIZE;
-    }
-    else
-        ret = BAD_FUNC_ARG;
-#endif /* NO_SHA */
 
     XFREE(buffer, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
@@ -9337 +12309 @@
 
 
-#ifndef NO_FILESYSTEM
+#if !defined(NO_FILESYSTEM) && !defined(NO_ASN_CRYPT)
 
 /* Set SKID from public key file in PEM */
@@ -9357 +12329 @@
     }
 
-    derSz = wolfSSL_PemPubKeyToDer(file, der, MAX_PUBLIC_KEY_SZ);
+    derSz = wc_PemPubKeyToDer(file, der, MAX_PUBLIC_KEY_SZ);
     if (derSz <= 0)
     {
@@ -9413 +12385 @@
             XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
             wc_ecc_free(eckey);
+            XFREE(eckey, cert->heap, DYNAMIC_TYPE_ECC);
             return PUBLIC_KEY_E;
         }
@@ -9436 +12409 @@
 }
 
-#endif /* NO_FILESYSTEM */
+#endif /* !NO_FILESYSTEM && !NO_ASN_CRYPT */
 
 /* Set AKID from certificate contains in buffer (DER encoded) */
@@ -9454 +12427 @@
 #ifdef WOLFSSL_SMALL_STACK
     decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert),
-                                    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                                    cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (decoded == NULL)
         return MEMORY_E;
@@ -9460 +12433 @@
 
     /* decode certificate and get SKID that will be AKID of current cert */
-    InitDecodedCert(decoded, (byte*)der, derSz, NULL);
+    InitDecodedCert(decoded, der, derSz, NULL);
     ret = ParseCert(decoded, CERT_TYPE, NO_VERIFY, 0);
     if (ret != 0) {
         FreeDecodedCert(decoded);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
         #endif
         return ret;
@@ -9474 +12447 @@
         FreeDecodedCert(decoded);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
         #endif
         return ASN_NO_SKID;
@@ -9483 +12456 @@
         FreeDecodedCert(decoded);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
         #endif
         return MEMORY_E;
@@ -9494 +12467 @@
     FreeDecodedCert(decoded);
     #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     #endif
 
@@ -9519 +12492 @@
     }
 
-    derSz = wolfSSL_PemCertToDer(file, der, EIGHTK_BUF);
+    derSz = wc_PemCertToDer(file, der, EIGHTK_BUF);
     if (derSz <= 0)
     {
@@ -9532 +12505 @@
 }
 
-#endif /* NO_FILESYSTEM */
+#endif /* !NO_FILESYSTEM */
 
 /* Set KeyUsage from human readable string */
@@ -9546 +12519 @@
     cert->keyUsage = 0;
 
-    str = (char*)XMALLOC(XSTRLEN(value)+1, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    len = (word32)XSTRLEN(value);
+    str = (char*)XMALLOC(len+1, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (str == NULL)
         return MEMORY_E;
 
-    XMEMSET(str, 0, XSTRLEN(value)+1);
-    XSTRNCPY(str, value, XSTRLEN(value));
+    XSTRNCPY(str, value, len+1);
 
     /* parse value, and set corresponding Key Usage value */
@@ -9605 +12578 @@
     cert->extKeyUsage = 0;
 
-    str = (char*)XMALLOC(XSTRLEN(value)+1, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    len = (word32)XSTRLEN(value);
+    str = (char*)XMALLOC(len+1, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (str == NULL)
         return MEMORY_E;
 
-    XMEMSET(str, 0, XSTRLEN(value)+1);
-    XSTRNCPY(str, value, XSTRLEN(value));
+    XSTRNCPY(str, value, len+1);
 
     /* parse value, and set corresponding Key Usage value */
@@ -9647 +12620 @@
     return ret;
 }
+
+#ifdef WOLFSSL_EKU_OID
+/*
+ * cert structure to set EKU oid in
+ * oid  the oid in byte representation
+ * sz   size of oid buffer
+ * idx  index of array to place oid
+ *
+ * returns 0 on success
+ */
+int wc_SetExtKeyUsageOID(Cert *cert, const char *in, word32 sz, byte idx,
+        void* heap)
+{
+    byte oid[MAX_OID_SZ];
+    word32 oidSz = MAX_OID_SZ;
+
+    if (idx >= CTC_MAX_EKU_NB || sz >= CTC_MAX_EKU_OID_SZ) {
+        WOLFSSL_MSG("Either idx or sz was too large");
+        return BAD_FUNC_ARG;
+    }
+
+    if (EncodePolicyOID(oid, &oidSz, in, heap) != 0) {
+        return BUFFER_E;
+    }
+
+    XMEMCPY(cert->extKeyUsageOID[idx], oid, oidSz);
+    cert->extKeyUsageOIDSz[idx] = oidSz;
+    cert->extKeyUsage |= EXTKEYUSE_USER;
+
+    return 0;
+}
+#endif /* WOLFSSL_EKU_OID */
 #endif /* WOLFSSL_CERT_EXT */
 
@@ -9666 +12671 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
+    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), cert->heap,
                                                        DYNAMIC_TYPE_TMP_BUFFER);
     if (decoded == NULL)
@@ -9672 +12677 @@
 #endif
 
-    InitDecodedCert(decoded, (byte*)der, derSz, NULL);
+    InitDecodedCert(decoded, der, derSz, NULL);
     ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
 
@@ -9740 +12745 @@
     FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -9762 +12767 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
+    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), cert->heap,
                                                        DYNAMIC_TYPE_TMP_BUFFER);
     if (decoded == NULL)
@@ -9768 +12773 @@
 #endif
 
-    InitDecodedCert(decoded, (byte*)der, derSz, NULL);
+    InitDecodedCert(decoded, der, derSz, NULL);
     ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
 
@@ -9794 +12799 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(decoded, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -9822 +12827 @@
 #endif
 
-    InitDecodedCert(decoded, (byte*)der, derSz, NULL);
+    InitDecodedCert(decoded, der, derSz, NULL);
     ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
 
@@ -9833 +12838 @@
                                                          : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->commonName, decoded->subjectCN, CTC_NAME_SIZE);
-            cn->commonName[sz] = 0;
+            cn->commonName[sz] = '\0';
             cn->commonNameEnc = decoded->subjectCNEnc;
         }
@@ -9840 +12845 @@
                                                         : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->country, decoded->subjectC, CTC_NAME_SIZE);
-            cn->country[sz] = 0;
+            cn->country[sz] = '\0';
             cn->countryEnc = decoded->subjectCEnc;
         }
@@ -9847 +12852 @@
                                                          : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->state, decoded->subjectST, CTC_NAME_SIZE);
-            cn->state[sz] = 0;
+            cn->state[sz] = '\0';
             cn->stateEnc = decoded->subjectSTEnc;
         }
@@ -9854 +12859 @@
                                                         : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->locality, decoded->subjectL, CTC_NAME_SIZE);
-            cn->locality[sz] = 0;
+            cn->locality[sz] = '\0';
             cn->localityEnc = decoded->subjectLEnc;
         }
@@ -9861 +12866 @@
                                                         : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->org, decoded->subjectO, CTC_NAME_SIZE);
-            cn->org[sz] = 0;
+            cn->org[sz] = '\0';
             cn->orgEnc = decoded->subjectOEnc;
         }
@@ -9868 +12873 @@
                                                          : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->unit, decoded->subjectOU, CTC_NAME_SIZE);
-            cn->unit[sz] = 0;
+            cn->unit[sz] = '\0';
             cn->unitEnc = decoded->subjectOUEnc;
         }
@@ -9875 +12880 @@
                                                          : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->sur, decoded->subjectSN, CTC_NAME_SIZE);
-            cn->sur[sz] = 0;
+            cn->sur[sz] = '\0';
             cn->surEnc = decoded->subjectSNEnc;
         }
+        if (decoded->subjectSND) {
+            sz = (decoded->subjectSNDLen < CTC_NAME_SIZE) ? decoded->subjectSNDLen
+                                                         : CTC_NAME_SIZE - 1;
+            XSTRNCPY(cn->serialDev, decoded->subjectSND, CTC_NAME_SIZE);
+            cn->serialDev[sz] = '\0';
+            cn->serialDevEnc = decoded->subjectSNDEnc;
+        }
+    #ifdef WOLFSSL_CERT_EXT
+        if (decoded->subjectBC) {
+            sz = (decoded->subjectBCLen < CTC_NAME_SIZE) ? decoded->subjectBCLen
+                                                         : CTC_NAME_SIZE - 1;
+            XSTRNCPY(cn->busCat, decoded->subjectBC, CTC_NAME_SIZE);
+            cn->busCat[sz] = '\0';
+            cn->busCatEnc = decoded->subjectBCEnc;
+        }
+        if (decoded->subjectJC) {
+            sz = (decoded->subjectJCLen < CTC_NAME_SIZE) ? decoded->subjectJCLen
+                                                         : CTC_NAME_SIZE - 1;
+            XSTRNCPY(cn->joiC, decoded->subjectJC, CTC_NAME_SIZE);
+            cn->joiC[sz] = '\0';
+            cn->joiCEnc = decoded->subjectJCEnc;
+        }
+        if (decoded->subjectJS) {
+            sz = (decoded->subjectJSLen < CTC_NAME_SIZE) ? decoded->subjectJSLen
+                                                         : CTC_NAME_SIZE - 1;
+            XSTRNCPY(cn->joiSt, decoded->subjectJS, CTC_NAME_SIZE);
+            cn->joiSt[sz] = '\0';
+            cn->joiStEnc = decoded->subjectJSEnc;
+        }
+    #endif
         if (decoded->subjectEmail) {
             sz = (decoded->subjectEmailLen < CTC_NAME_SIZE)
                ?  decoded->subjectEmailLen : CTC_NAME_SIZE - 1;
             XSTRNCPY(cn->email, decoded->subjectEmail, CTC_NAME_SIZE);
-            cn->email[sz] = 0;
+            cn->email[sz] = '\0';
         }
     }
@@ -9895 +12930 @@
 }
 
+#ifdef WOLFSSL_CERT_EXT
+/* Set raw subject from der buffer, return 0 on success */
+static int SetSubjectRawFromCert(byte* sbjRaw, const byte* der, int derSz)
+{
+    int ret;
+#ifdef WOLFSSL_SMALL_STACK
+    DecodedCert* decoded;
+#else
+    DecodedCert decoded[1];
+#endif
+
+    if ((derSz < 0) || (sbjRaw == NULL)) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
+                                                       DYNAMIC_TYPE_TMP_BUFFER);
+    if (decoded == NULL) {
+        return MEMORY_E;
+    }
+#endif
+
+    InitDecodedCert(decoded, der, derSz, NULL);
+    ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
+
+    if (ret < 0) {
+        WOLFSSL_MSG("ParseCertRelative error");
+    }
+#ifndef IGNORE_NAME_CONSTRAINT
+    else {
+        if ((decoded->subjectRaw) &&
+            (decoded->subjectRawLen <= (int)sizeof(CertName))) {
+            XMEMCPY(sbjRaw, decoded->subjectRaw, decoded->subjectRawLen);
+        }
+        }
+#else
+    else {
+        /* Fields are not accessible */
+        ret = -1;
+        WOLFSSL_MSG("IGNORE_NAME_CONSTRAINT excludes raw subject");
+    }
+#endif
+
+    FreeDecodedCert(decoded);
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    return ret < 0 ? ret : 0;
+}
+
+/* Set raw issuer from der buffer, return 0 on success */
+static int SetIssuerRawFromCert(byte* issuerRaw, const byte* der, int derSz)
+{
+    int ret;
+#ifdef WOLFSSL_SMALL_STACK
+    DecodedCert* decoded;
+#else
+    DecodedCert decoded[1];
+#endif
+
+    if ((derSz < 0) || (issuerRaw == NULL)) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
+                                                       DYNAMIC_TYPE_TMP_BUFFER);
+    if (decoded == NULL) {
+        return MEMORY_E;
+    }
+#endif
+
+    InitDecodedCert(decoded, der, derSz, NULL);
+    ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
+
+    if (ret < 0) {
+        WOLFSSL_MSG("ParseCertRelative error");
+    }
+#ifndef IGNORE_NAME_CONSTRAINT
+    else {
+        if ((decoded->issuerRaw) &&
+            (decoded->issuerRawLen <= (int)sizeof(CertName))) {
+            XMEMCPY(issuerRaw, decoded->issuerRaw, decoded->issuerRawLen);
+        }
+    }
+#else
+    else {
+        /* Fields are not accessible */
+        ret = -1;
+        WOLFSSL_MSG("IGNORE_NAME_CONSTRAINT excludes raw issuer");
+    }
+#endif
+
+    FreeDecodedCert(decoded);
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    return ret < 0 ? ret : 0;
+}
+#endif /* WOLFSSL_CERT_EXT */
 
 #ifndef NO_FILESYSTEM
@@ -9903 +13043 @@
     int         ret;
     int         derSz;
-    byte*       der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
-
+    byte*       der;
+
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
     if (der == NULL) {
         WOLFSSL_MSG("wc_SetIssuer OOF Problem");
         return MEMORY_E;
     }
-    derSz = wolfSSL_PemCertToDer(issuerFile, der, EIGHTK_BUF);
+    derSz = wc_PemCertToDer(issuerFile, der, EIGHTK_BUF);
     cert->selfSigned = 0;
     ret = SetNameFromCert(&cert->issuer, der, derSz);
@@ -9923 +13068 @@
     int         ret;
     int         derSz;
-    byte*       der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
-
+    byte*       der;
+
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
     if (der == NULL) {
         WOLFSSL_MSG("wc_SetSubject OOF Problem");
         return MEMORY_E;
     }
-    derSz = wolfSSL_PemCertToDer(subjectFile, der, EIGHTK_BUF);
+
+    derSz = wc_PemCertToDer(subjectFile, der, EIGHTK_BUF);
     ret = SetNameFromCert(&cert->subject, der, derSz);
     XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
@@ -9936 +13087 @@
 }
 
-
 #ifdef WOLFSSL_ALT_NAMES
 
-/* Set atl names from file in PEM */
+/* Set alt names from file in PEM */
 int wc_SetAltNames(Cert* cert, const char* file)
 {
     int         ret;
     int         derSz;
-    byte*       der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
-
+    byte*       der;
+
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
     if (der == NULL) {
         WOLFSSL_MSG("wc_SetAltNames OOF Problem");
         return MEMORY_E;
     }
-    derSz = wolfSSL_PemCertToDer(file, der, EIGHTK_BUF);
+    derSz = wc_PemCertToDer(file, der, EIGHTK_BUF);
     ret = SetAltNamesFromCert(cert, der, derSz);
     XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
@@ -9959 +13114 @@
 #endif /* WOLFSSL_ALT_NAMES */
 
-#endif /* NO_FILESYSTEM */
+#endif /* !NO_FILESYSTEM */
 
 /* Set cert issuer from DER buffer */
 int wc_SetIssuerBuffer(Cert* cert, const byte* der, int derSz)
 {
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
     cert->selfSigned = 0;
     return SetNameFromCert(&cert->issuer, der, derSz);
 }
 
-
 /* Set cert subject from DER buffer */
 int wc_SetSubjectBuffer(Cert* cert, const byte* der, int derSz)
 {
+    if (cert == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
     return SetNameFromCert(&cert->subject, der, derSz);
 }
-
+#ifdef WOLFSSL_CERT_EXT
+/* Set cert raw subject from DER buffer */
+int wc_SetSubjectRaw(Cert* cert, const byte* der, int derSz)
+{
+    int ret;
+
+    if (cert == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        ret = SetSubjectRawFromCert(cert->sbjRaw, der, derSz);
+    }
+    return ret;
+}
+
+/* Set cert raw issuer from DER buffer */
+int wc_SetIssuerRaw(Cert* cert, const byte* der, int derSz)
+{
+    int ret;
+
+    if (cert == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        ret = SetIssuerRawFromCert(cert->issRaw, der, derSz);
+    }
+    return ret;
+}
+#endif
 
 #ifdef WOLFSSL_ALT_NAMES
@@ -10088 +13278 @@
         return ASN_PARSE_E;
 
+    if (*inOutIdx >= inSz)
+        return ASN_PARSE_E;
+
     b = input[*inOutIdx];
     *inOutIdx += 1;
@@ -10102 +13295 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    priv = (byte*)XMALLOC(ECC_MAXSIZE+1, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    priv = (byte*)XMALLOC(ECC_MAXSIZE+1, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (priv == NULL)
         return MEMORY_E;
 
-    pub = (byte*)XMALLOC(2*(ECC_MAXSIZE+1), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    pub = (byte*)XMALLOC(2*(ECC_MAXSIZE+1), key->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (pub == NULL) {
-        XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
@@ -10175 +13368 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(pub,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pub,  key->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -10182 +13375 @@
 }
 
+
+#ifdef WOLFSSL_CUSTOM_CURVES
+static void ByteToHex(byte n, char* str)
+{
+    static const char hexChar[] = { '0', '1', '2', '3', '4', '5', '6', '7',
+                                    '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
+
+    str[0] = hexChar[n >> 4];
+    str[1] = hexChar[n & 0xf];
+}
+
+/* returns 0 on success */
+static int ASNToHexString(const byte* input, word32* inOutIdx, char** out,
+                          word32 inSz, void* heap, int heapType)
+{
+    int len;
+    int i;
+    char* str;
+
+    if (*inOutIdx >= inSz) {
+        return BUFFER_E;
+    }
+
+    if (input[*inOutIdx] == ASN_INTEGER) {
+        if (GetASNInt(input, inOutIdx, &len, inSz) < 0)
+            return ASN_PARSE_E;
+    }
+    else {
+        if (GetOctetString(input, inOutIdx, &len, inSz) < 0)
+            return ASN_PARSE_E;
+    }
+
+    str = (char*)XMALLOC(len * 2 + 1, heap, heapType);
+    for (i=0; i<len; i++)
+        ByteToHex(input[*inOutIdx + i], str + i*2);
+    str[len*2] = '\0';
+
+    *inOutIdx += len;
+    *out = str;
+
+    return 0;
+}
+#endif /* WOLFSSL_CUSTOM_CURVES */
 
 int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx,
@@ -10188 +13424 @@
     int    length;
     int    ret;
-#ifdef ECC_CHECK_PUBLIC_KEY_OID
+    int    curve_id = ECC_CURVE_DEF;
     word32 oidSum;
-#endif
 
     if (input == NULL || inOutIdx == NULL || key == NULL || inSz == 0)
@@ -10205 +13440 @@
         return ret;
 
+    if (*inOutIdx >= inSz) {
+        return BUFFER_E;
+    }
+
+    if (input[*inOutIdx] == (ASN_SEQUENCE | ASN_CONSTRUCTED)) {
+#ifdef WOLFSSL_CUSTOM_CURVES
+        ecc_set_type* curve;
+        int len;
+        char* point;
+
+        ret = 0;
+
+        curve = (ecc_set_type*)XMALLOC(sizeof(*curve), key->heap,
+                                                       DYNAMIC_TYPE_ECC_BUFFER);
+        if (curve == NULL)
+            ret = MEMORY_E;
+
+        if (ret == 0) {
+            XMEMSET(curve, 0, sizeof(*curve));
+            curve->name = "Custom";
+            curve->id = ECC_CURVE_CUSTOM;
+
+            if (GetSequence(input, inOutIdx, &length, inSz) < 0)
+                ret = ASN_PARSE_E;
+        }
+
+        if (ret == 0) {
+            GetInteger7Bit(input, inOutIdx, inSz);
+            if (GetSequence(input, inOutIdx, &length, inSz) < 0)
+                ret = ASN_PARSE_E;
+        }
+        if (ret == 0) {
+            SkipObjectId(input, inOutIdx, inSz);
+            ret = ASNToHexString(input, inOutIdx, (char**)&curve->prime, inSz,
+                                            key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+        }
+        if (ret == 0) {
+            curve->size = (int)XSTRLEN(curve->prime) / 2;
+
+            if (GetSequence(input, inOutIdx, &length, inSz) < 0)
+                ret = ASN_PARSE_E;
+        }
+        if (ret == 0) {
+            ret = ASNToHexString(input, inOutIdx, (char**)&curve->Af, inSz,
+                                            key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+        }
+        if (ret == 0) {
+            ret = ASNToHexString(input, inOutIdx, (char**)&curve->Bf, inSz,
+                                            key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+        }
+        if (ret == 0) {
+            if (*inOutIdx < inSz && input[*inOutIdx] == ASN_BIT_STRING) {
+                len = 0;
+                ret = GetASNHeader(input, ASN_BIT_STRING, inOutIdx, &len, inSz);
+                *inOutIdx += len;
+            }
+        }
+        if (ret == 0) {
+            ret = ASNToHexString(input, inOutIdx, (char**)&point, inSz,
+                                            key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+
+            /* sanity check that point buffer is not smaller than the expected
+             * size to hold ( 0 4 || Gx || Gy )
+             * where Gx and Gy are each the size of curve->size * 2 */
+            if (ret == 0 && (int)XSTRLEN(point) < (curve->size * 4) + 2) {
+                XFREE(point, key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+                ret = BUFFER_E;
+            }
+        }
+        if (ret == 0) {
+            curve->Gx = (const char*)XMALLOC(curve->size * 2 + 2, key->heap,
+                                                       DYNAMIC_TYPE_ECC_BUFFER);
+            curve->Gy = (const char*)XMALLOC(curve->size * 2 + 2, key->heap,
+                                                       DYNAMIC_TYPE_ECC_BUFFER);
+            if (curve->Gx == NULL || curve->Gy == NULL) {
+                XFREE(point, key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+                ret = MEMORY_E;
+            }
+        }
+        if (ret == 0) {
+            XMEMCPY((char*)curve->Gx, point + 2, curve->size * 2);
+            XMEMCPY((char*)curve->Gy, point + curve->size * 2 + 2,
+                                                               curve->size * 2);
+            ((char*)curve->Gx)[curve->size * 2] = '\0';
+            ((char*)curve->Gy)[curve->size * 2] = '\0';
+            XFREE(point, key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+            ret = ASNToHexString(input, inOutIdx, (char**)&curve->order, inSz,
+                                            key->heap, DYNAMIC_TYPE_ECC_BUFFER);
+        }
+        if (ret == 0) {
+            curve->cofactor = GetInteger7Bit(input, inOutIdx, inSz);
+
+            curve->oid = NULL;
+            curve->oidSz = 0;
+            curve->oidSum = 0;
+
+            if (wc_ecc_set_custom_curve(key, curve) < 0) {
+                ret = ASN_PARSE_E;
+            }
+            key->deallocSet = 1;
+            curve = NULL;
+        }
+        if (curve != NULL)
+            wc_ecc_free_curve(curve, key->heap);
+
+        if (ret < 0)
+            return ret;
+#else
+        return ASN_PARSE_E;
+#endif /* WOLFSSL_CUSTOM_CURVES */
+    }
+    else {
     /* ecc params information */
-#ifdef ECC_CHECK_PUBLIC_KEY_OID
     ret = GetObjectId(input, inOutIdx, &oidSum, oidIgnoreType, inSz);
     if (ret != 0)
         return ret;
-    if (CheckCurve(oidSum) < 0)
+
+        /* get curve id */
+        curve_id = wc_ecc_get_oid(oidSum, NULL, 0);
+        if (curve_id < 0)
         return ECC_CURVE_OID_E;
-#else
-    ret = SkipObjectId(input, inOutIdx, inSz);
+    }
+
+    /* key header */
+    ret = CheckBitString(input, inOutIdx, &length, inSz, 1, NULL);
     if (ret != 0)
         return ret;
-#endif
-
-    /* key header */
-    ret = CheckBitString(input, inOutIdx, NULL, inSz, 1, NULL);
-    if (ret != 0)
-        return ret;
 
     /* This is the raw point data compressed or uncompressed. */
-    if (wc_ecc_import_x963(input + *inOutIdx, inSz - *inOutIdx, key) != 0)
+    if (wc_ecc_import_x963_ex(input + *inOutIdx, inSz - *inOutIdx, key,
+                                                            curve_id) != 0) {
         return ASN_ECC_KEY_E;
+}
+
+    *inOutIdx += length;
 
     return 0;
 }
 
-
-#ifdef WOLFSSL_KEY_GEN
-
+#if defined(HAVE_ECC_KEY_EXPORT) && !defined(NO_ASN_CRYPT)
 /* build DER formatted ECC key, include optional public key if requested,
  * return length on success, negative on error */
@@ -10350 +13697 @@
 }
 
-
 /* Write a Private ecc key, including public to DER format,
  * length on success else < 0 */
@@ -10366 +13712 @@
 }
 
-#endif /* WOLFSSL_KEY_GEN */
-
+/* Write only private ecc key to unencrypted PKCS#8 format.
+ *
+ * If output is NULL, places required PKCS#8 buffer size in outLen and
+ * returns LENGTH_ONLY_E.
+ *
+ * return length on success else < 0 */
+int wc_EccPrivateKeyToPKCS8(ecc_key* key, byte* output, word32* outLen)
+{
+    int ret, tmpDerSz;
+    int algoID = 0;
+    word32 oidSz = 0;
+    word32 pkcs8Sz = 0;
+    const byte* curveOID = NULL;
+    byte* tmpDer = NULL;
+
+    if (key == NULL || outLen == NULL)
+        return BAD_FUNC_ARG;
+
+    /* set algoID, get curve OID */
+    algoID = ECDSAk;
+    ret = wc_ecc_get_oid(key->dp->oidSum, &curveOID, &oidSz);
+    if (ret < 0)
+        return ret;
+
+    /* temp buffer for plain DER key */
+    tmpDer = (byte*)XMALLOC(ECC_BUFSIZE, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (tmpDer == NULL)
+        return MEMORY_E;
+
+    XMEMSET(tmpDer, 0, ECC_BUFSIZE);
+
+    tmpDerSz = wc_BuildEccKeyDer(key, tmpDer, ECC_BUFSIZE, 0);
+    if (tmpDerSz < 0) {
+        XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return tmpDerSz;
+    }
+
+    /* get pkcs8 expected output size */
+    ret = wc_CreatePKCS8Key(NULL, &pkcs8Sz, tmpDer, tmpDerSz, algoID,
+                            curveOID, oidSz);
+    if (ret != LENGTH_ONLY_E) {
+        XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return ret;
+    }
+
+    if (output == NULL) {
+        XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        *outLen = pkcs8Sz;
+        return LENGTH_ONLY_E;
+
+    } else if (*outLen < pkcs8Sz) {
+        XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        WOLFSSL_MSG("Input buffer too small for ECC PKCS#8 key");
+        return BUFFER_E;
+    }
+
+    ret = wc_CreatePKCS8Key(output, &pkcs8Sz, tmpDer, tmpDerSz,
+                            algoID, curveOID, oidSz);
+    if (ret < 0) {
+        XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return ret;
+    }
+
+    XFREE(tmpDer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+
+    *outLen = ret;
+    return ret;
+}
+
+#endif /* HAVE_ECC_KEY_EXPORT && !NO_ASN_CRYPT */
 #endif  /* HAVE_ECC */
 
@@ -10384 +13798 @@
         return BAD_FUNC_ARG;
 
-    if (GetSequence(input, inOutIdx, &length, inSz) < 0)
-        return ASN_PARSE_E;
+    if (GetSequence(input, inOutIdx, &length, inSz) >= 0) {
     endKeyIdx = *inOutIdx + length;
 
@@ -10405 +13818 @@
     if (GetOctetString(input, inOutIdx, &privSz, inSz) < 0)
         return ASN_PARSE_E;
+
+        priv = input + *inOutIdx;
+        *inOutIdx += privSz;
+    }
+    else {
+        if (GetOctetString(input, inOutIdx, &privSz, inSz) < 0)
+            return ASN_PARSE_E;
+
     priv = input + *inOutIdx;
     *inOutIdx += privSz;
+        endKeyIdx = *inOutIdx;
+    }
 
     if (endKeyIdx == (int)*inOutIdx) {
@@ -10435 +13858 @@
     int    length;
     int    ret;
-#ifdef ECC_CHECK_PUBLIC_KEY_OID
-    word32 oidSum;
-#endif
 
     if (input == NULL || inOutIdx == NULL || key == NULL || inSz == 0)
@@ -10548 +13968 @@
                         byte* format, int maxIdx)
 {
-    int    length;
+    int    ret, length;
+    const byte *datePtr = NULL;
 
     WOLFSSL_ENTER("GetBasicDate");
 
-    *format = source[*idx];
-    *idx += 1;
-    if (*format != ASN_UTC_TIME && *format != ASN_GENERALIZED_TIME)
-        return ASN_TIME_E;
-
-    if (GetLength(source, idx, &length, maxIdx) < 0)
-        return ASN_PARSE_E;
-
-    if (length > MAX_DATE_SIZE || length < MIN_DATE_SIZE)
-        return ASN_DATE_SZ_E;
-
-    XMEMCPY(date, &source[*idx], length);
-    *idx += length;
+    ret = GetDateInfo(source, idx, &datePtr, format, &length, maxIdx);
+    if (ret < 0)
+        return ret;
+
+    XMEMCPY(date, datePtr, length);
 
     return 0;
 }
 
-#endif
+#endif /* HAVE_OCSP || HAVE_CRL */
 
 
@@ -10667 +14080 @@
     }
 
-#if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
+#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
     cs->thisDateAsn = source + idx;
 #endif
@@ -10688 +14101 @@
         if (GetLength(source, &idx, &length, size) < 0)
             return ASN_PARSE_E;
-#if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
+#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
         cs->nextDateAsn = source + idx;
 #endif
@@ -10937 +14350 @@
             else {
                 WOLFSSL_MSG("\tOCSP Responder key usage check failed");
-
+    #ifdef OPENSSL_EXTRA
+                resp->verifyError = OCSP_BAD_ISSUER;
+    #else
                 FreeDecodedCert(&cert);
                 return BAD_OCSP_RESPONDER;
+    #endif
             }
         }
@@ -11207 +14623 @@
 
         if (cert->extAuthInfoSz != 0 && cert->extAuthInfo != NULL) {
-            req->url = (byte*)XMALLOC(cert->extAuthInfoSz, req->heap,
+            req->url = (byte*)XMALLOC(cert->extAuthInfoSz + 1, req->heap,
                                                      DYNAMIC_TYPE_OCSP_REQUEST);
             if (req->url == NULL) {
@@ -11216 +14632 @@
             XMEMCPY(req->url, cert->extAuthInfo, cert->extAuthInfoSz);
             req->urlSz = cert->extAuthInfoSz;
+            req->url[req->urlSz] = 0;
         }
     }
@@ -11249 +14666 @@
         if (req->serial)
             XFREE(req->serial, req->heap, DYNAMIC_TYPE_OCSP_REQUEST);
+        req->serial = NULL;
 
         if (req->url)
             XFREE(req->url, req->heap, DYNAMIC_TYPE_OCSP_REQUEST);
+        req->url = NULL;
     }
 }
@@ -11323 +14742 @@
 }
 
-#endif
+#endif /* HAVE_OCSP */
 
 
@@ -11353 +14772 @@
         return ASN_PARSE_E;
 
-#ifdef NO_SHA
-    ret = wc_Sha256Hash(source + dummy, length + *idx - dummy, hash);
-#else
-    ret = wc_ShaHash(source + dummy, length + *idx - dummy, hash);
-#endif
+    ret = CalcHashId(source + dummy, length + *idx - dummy, hash);
 
     *idx += length;
@@ -11404 +14819 @@
                       int maxIdx)
 {
-    int    len;
+    int    ret, len;
     word32 end;
     byte   b;
@@ -11434 +14849 @@
     dcrl->totalCerts++;
 
-
     /* get date */
-    b = buff[*idx];
-    *idx += 1;
-
-    if (b != ASN_UTC_TIME && b != ASN_GENERALIZED_TIME) {
+    ret = GetDateInfo(buff, idx, NULL, &b, NULL, maxIdx);
+    if (ret < 0) {
         WOLFSSL_MSG("Expecting Date");
-        return ASN_PARSE_E;
-    }
-
-    if (GetLength(buff, idx, &len, maxIdx) < 0)
-        return ASN_PARSE_E;
-
-    /* skip for now */
-    *idx += len;
+        return ret;
+    }
 
     if (*idx != end)  /* skip extensions */
@@ -11610 +15016 @@
 #endif /* HAVE_CRL */
 
+
+
+#ifdef WOLFSSL_CERT_PIV
+
+int wc_ParseCertPIV(wc_CertPIV* piv, const byte* buf, word32 totalSz)
+{
+    int length = 0;
+    word32 idx = 0;
+
+    WOLFSSL_ENTER("wc_ParseCertPIV");
+
+    if (piv == NULL || buf == NULL || totalSz == 0)
+        return BAD_FUNC_ARG;
+
+    XMEMSET(piv, 0, sizeof(wc_CertPIV));
+
+    /* Detect Identiv PIV (with 0x0A, 0x0B and 0x0C sections) */
+    /* Certificate (0A 82 05FA) */
+    if (GetASNHeader(buf, ASN_PIV_CERT, &idx, &length, totalSz) >= 0) {
+        /* Identiv Type PIV card */
+        piv->isIdentiv = 1;
+
+        piv->cert =   &buf[idx];
+        piv->certSz = length;
+        idx += length;
+
+        /* Nonce (0B 14) */
+        if (GetASNHeader(buf, ASN_PIV_NONCE, &idx, &length, totalSz) >= 0) {
+            piv->nonce =   &buf[idx];
+            piv->nonceSz = length;
+            idx += length;
+        }
+
+        /* Signed Nonce (0C 82 0100) */
+        if (GetASNHeader(buf, ASN_PIV_SIGNED_NONCE, &idx, &length, totalSz) >= 0) {
+            piv->signedNonce =   &buf[idx];
+            piv->signedNonceSz = length;
+            idx += length;
+        }
+
+        idx = 0;
+        buf = piv->cert;
+        totalSz = piv->certSz;
+    }
+
+    /* Certificate Buffer Total Size (53 82 05F6) */
+    if (GetASNHeader(buf, ASN_APPLICATION | ASN_PRINTABLE_STRING, &idx,
+                                                   &length, totalSz) < 0) {
+        return ASN_PARSE_E;
+    }
+    /* PIV Certificate (70 82 05ED) */
+    if (GetASNHeader(buf, ASN_PIV_TAG_CERT, &idx, &length,
+                                                         totalSz) < 0) {
+        return ASN_PARSE_E;
+    }
+
+    /* Capture certificate buffer pointer and length */
+    piv->cert =   &buf[idx];
+    piv->certSz = length;
+    idx += length;
+
+    /* PIV Certificate Info (71 01 00) */
+    if (GetASNHeader(buf, ASN_PIV_TAG_CERT_INFO, &idx, &length,
+                                                        totalSz) >= 0) {
+        if (length >= 1) {
+            piv->compression = (buf[idx] & ASN_PIV_CERT_INFO_COMPRESSED);
+            piv->isX509 =      (buf[idx] & ASN_PIV_CERT_INFO_ISX509);
+        }
+        idx += length;
+    }
+
+    /* PIV Error Detection (FE 00) */
+    if (GetASNHeader(buf, ASN_PIV_TAG_ERR_DET, &idx, &length,
+                                                        totalSz) >= 0) {
+        piv->certErrDet =   &buf[idx];
+        piv->certErrDetSz = length;
+        idx += length;
+    }
+
+    return 0;
+}
+
+#endif /* WOLFSSL_CERT_PIV */
+
+
 #undef ERROR_OUT
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/blake2b.c

@@ -71 +71 @@
 
 
-static INLINE int blake2b_set_lastnode( blake2b_state *S )
+static WC_INLINE int blake2b_set_lastnode( blake2b_state *S )
 {
   S->f[1] = ~0ULL;
@@ -78 +78 @@
 
 /* Some helper functions, not necessarily useful */
-static INLINE int blake2b_set_lastblock( blake2b_state *S )
+static WC_INLINE int blake2b_set_lastblock( blake2b_state *S )
 {
   if( S->last_node ) blake2b_set_lastnode( S );
@@ -86 +86 @@
 }
 
-static INLINE int blake2b_increment_counter( blake2b_state *S, const word64
+static WC_INLINE int blake2b_increment_counter( blake2b_state *S, const word64
                                              inc )
 {
@@ -94 +94 @@
 }
 
-static INLINE int blake2b_init0( blake2b_state *S )
+static WC_INLINE int blake2b_init0( blake2b_state *S )
 {
   int i;
@@ -423 +423 @@
 int wc_InitBlake2b(Blake2b* b2b, word32 digestSz)
 {
+    if (b2b == NULL){
+        return -1;
+    }
     b2b->digestSz = digestSz;
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/camellia.c

@@ -1599 +1599 @@
 int wc_CamelliaCbcEncrypt(Camellia* cam, byte* out, const byte* in, word32 sz)
 {
+    word32 blocks;
     if (cam == NULL || out == NULL || in == NULL) {
         return BAD_FUNC_ARG;
     }
-    word32 blocks = sz / CAMELLIA_BLOCK_SIZE;
+    blocks = sz / CAMELLIA_BLOCK_SIZE;
 
     while (blocks--) {
@@ -1620 +1621 @@
 int wc_CamelliaCbcDecrypt(Camellia* cam, byte* out, const byte* in, word32 sz)
 {
+    word32 blocks;
     if (cam == NULL || out == NULL || in == NULL) {
         return BAD_FUNC_ARG;
     }
-    word32 blocks = sz / CAMELLIA_BLOCK_SIZE;
+    blocks = sz / CAMELLIA_BLOCK_SIZE;
 
     while (blocks--) {

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/coding.c

@@ -37 +37 @@
     BAD         = 0xFF,  /* invalid encoding */
     PAD         = '=',
-    PEM_LINE_SZ = 64
+    PEM_LINE_SZ = 64,
+    BASE64_MIN  = 0x2B,
+    BASE16_MIN  = 0x30,
 };
 
@@ -60 +62 @@
     word32 j = 0;
     word32 plainSz = inLen - ((inLen + (PEM_LINE_SZ - 1)) / PEM_LINE_SZ );
-    const byte maxIdx = (byte)sizeof(base64Decode) + 0x2B - 1;
+    const byte maxIdx = (byte)sizeof(base64Decode) + BASE64_MIN - 1;
 
     plainSz = (plainSz * 3 + 3) / 4;
@@ -82 +84 @@
             pad4 = 1;
 
-        if (e1 < 0x2B || e2 < 0x2B || e3 < 0x2B || e4 < 0x2B) {
+        if (e1 < BASE64_MIN || e2 < BASE64_MIN || e3 < BASE64_MIN || e4 < BASE64_MIN) {
             WOLFSSL_MSG("Bad Base64 Decode data, too small");
             return ASN_INPUT_E;
@@ -92 +94 @@
         }
 
-        e1 = base64Decode[e1 - 0x2B];
-        e2 = base64Decode[e2 - 0x2B];
-        e3 = (e3 == PAD) ? 0 : base64Decode[e3 - 0x2B];
-        e4 = (e4 == PAD) ? 0 : base64Decode[e4 - 0x2B];
+        e1 = base64Decode[e1 - BASE64_MIN];
+        e2 = base64Decode[e2 - BASE64_MIN];
+        e3 = (e3 == PAD) ? 0 : base64Decode[e3 - BASE64_MIN];
+        e4 = (e4 == PAD) ? 0 : base64Decode[e4 - BASE64_MIN];
 
         b1 = (byte)((e1 << 2) | (e2 >> 4));
@@ -345 +347 @@
 }
 
-#endif  /* defined(WOLFSSL_BASE64_ENCODE) */
-
-
-#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(HAVE_FIPS) \
-                           || defined(HAVE_ECC_CDH)
+#endif /* WOLFSSL_BASE64_ENCODE */
+
+
+#ifdef WOLFSSL_BASE16
 
 static
@@ -371 +372 @@
 
     if (inLen == 1 && *outLen && in) {
-        byte b = in[inIdx++] - 0x30;  /* 0 starts at 0x30 */
+        byte b = in[inIdx++] - BASE16_MIN;  /* 0 starts at 0x30 */
 
         /* sanity check */
@@ -395 +396 @@
 
     while (inLen) {
-        byte b  = in[inIdx++] - 0x30;  /* 0 starts at 0x30 */
-        byte b2 = in[inIdx++] - 0x30;
+        byte b  = in[inIdx++] - BASE16_MIN;  /* 0 starts at 0x30 */
+        byte b2 = in[inIdx++] - BASE16_MIN;
 
         /* sanity checks */
@@ -455 +456 @@
 }
 
-#endif /* (OPENSSL_EXTRA) || (HAVE_WEBSERVER) || (HAVE_FIPS) */
-
-#endif /* NO_CODING */
+#endif /* WOLFSSL_BASE16 */
+
+#endif /* !NO_CODING */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/des3.c

@@ -32 +32 @@
 #ifndef NO_DES3
 
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$i")
+        #pragma const_seg(".fipsB$i")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/des3.h>
 
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
     int wc_Des_SetKey(Des* des, const byte* key, const byte* iv, int dir)
     {
@@ -108 +122 @@
     }
 
-#else /* build without fips */
+#else /* else build without fips, or for FIPS v2 */
 
 
@@ -1287 +1301 @@
     };
 
-    static INLINE void IPERM(word32* left, word32* right)
+    static WC_INLINE void IPERM(word32* left, word32* right)
     {
         word32 work;
@@ -1313 +1327 @@
     }
 
-    static INLINE void FPERM(word32* left, word32* right)
+    static WC_INLINE void FPERM(word32* left, word32* right)
     {
         word32 work;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/dh.c

@@ -29 +29 @@
 #ifndef NO_DH
 
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$m")
+        #pragma const_seg(".fipsB$m")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/dh.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
@@ -43 +55 @@
     #include <wolfcrypt/src/misc.c>
 #endif
+
+
+/*
+Possible DH enable options:
+ * NO_RSA:              Overall control of DH                 default: on (not defined)
+ * WOLFSSL_OLD_PRIME_CHECK: Disables the new prime number check. It does not
+                        directly effect this file, but it does speed up DH
+                        removing the testing. It is not recommended to
+                        disable the prime checking.           default: off
+
+*/
 
 
@@ -89 +112 @@
 };
 static const byte dh_ffdhe2048_g[] = { 0x02 };
+#ifdef HAVE_FFDHE_Q
+static const byte dh_ffdhe2048_q[] = {
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
+    0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
+    0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
+    0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
+    0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
+    0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
+    0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
+    0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
+    0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
+    0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
+    0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
+    0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
+    0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
+    0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
+    0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
+    0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
+    0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
+    0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
+    0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
+    0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
+    0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
+    0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
+    0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
+    0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
+    0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
+    0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
+    0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
+    0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
+    0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
+    0x44, 0x35, 0xA1, 0x1C, 0x30, 0x94, 0x2E, 0x4B,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+#endif /* HAVE_FFDHE_Q */
 
 const DhParams* wc_Dh_ffdhe2048_Get(void)
 {
     static const DhParams ffdhe2048 = {
+        #ifdef HAVE_FFDHE_Q
+            dh_ffdhe2048_q, sizeof(dh_ffdhe2048_q),
+        #endif /* HAVE_FFDHE_Q */
         dh_ffdhe2048_p, sizeof(dh_ffdhe2048_p),
         dh_ffdhe2048_g, sizeof(dh_ffdhe2048_g)
@@ -152 +214 @@
 };
 static const byte dh_ffdhe3072_g[] = { 0x02 };
+#ifdef HAVE_FFDHE_Q
+static const byte dh_ffdhe3072_q[] = {
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
+    0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
+    0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
+    0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
+    0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
+    0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
+    0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
+    0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
+    0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
+    0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
+    0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
+    0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
+    0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
+    0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
+    0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
+    0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
+    0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
+    0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
+    0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
+    0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
+    0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
+    0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
+    0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
+    0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
+    0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
+    0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
+    0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
+    0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
+    0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
+    0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
+    0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
+    0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
+    0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
+    0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
+    0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
+    0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
+    0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
+    0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
+    0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
+    0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
+    0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
+    0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
+    0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
+    0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
+    0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
+    0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x63, 0x17, 0x1B,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+#endif /* HAVE_FFDHE_Q */
 
 const DhParams* wc_Dh_ffdhe3072_Get(void)
 {
     static const DhParams ffdhe3072 = {
+        #ifdef HAVE_FFDHE_Q
+            dh_ffdhe3072_q, sizeof(dh_ffdhe3072_q),
+        #endif /* HAVE_FFDHE_Q */
         dh_ffdhe3072_p, sizeof(dh_ffdhe3072_p),
         dh_ffdhe3072_g, sizeof(dh_ffdhe3072_g)
@@ -231 +348 @@
 };
 static const byte dh_ffdhe4096_g[] = { 0x02 };
+#ifdef HAVE_FFDHE_Q
+static const byte dh_ffdhe4096_q[] = {
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
+    0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
+    0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
+    0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
+    0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
+    0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
+    0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
+    0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
+    0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
+    0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
+    0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
+    0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
+    0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
+    0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
+    0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
+    0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
+    0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
+    0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
+    0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
+    0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
+    0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
+    0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
+    0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
+    0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
+    0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
+    0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
+    0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
+    0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
+    0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
+    0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
+    0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
+    0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
+    0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
+    0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
+    0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
+    0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
+    0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
+    0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
+    0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
+    0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
+    0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
+    0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
+    0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
+    0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
+    0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
+    0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
+    0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
+    0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
+    0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
+    0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
+    0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
+    0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
+    0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
+    0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
+    0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
+    0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
+    0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
+    0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
+    0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
+    0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
+    0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
+    0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x32, 0xAF, 0xB5,
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+#endif /* HAVE_FFDHE_Q */
 
 const DhParams* wc_Dh_ffdhe4096_Get(void)
 {
     static const DhParams ffdhe4096 = {
+        #ifdef HAVE_FFDHE_Q
+            dh_ffdhe4096_q, sizeof(dh_ffdhe4096_q),
+        #endif /* HAVE_FFDHE_Q */
         dh_ffdhe4096_p, sizeof(dh_ffdhe4096_p),
         dh_ffdhe4096_g, sizeof(dh_ffdhe4096_g)
@@ -342 +530 @@
 };
 static const byte dh_ffdhe6144_g[] = { 0x02 };
+#ifdef HAVE_FFDHE_Q
+static const byte dh_ffdhe6144_q[] = {
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
+    0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
+    0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
+    0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
+    0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
+    0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
+    0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
+    0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
+    0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
+    0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
+    0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
+    0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
+    0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
+    0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
+    0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
+    0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
+    0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
+    0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
+    0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
+    0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
+    0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
+    0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
+    0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
+    0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
+    0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
+    0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
+    0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
+    0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
+    0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
+    0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
+    0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
+    0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
+    0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
+    0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
+    0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
+    0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
+    0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
+    0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
+    0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
+    0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
+    0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
+    0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
+    0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
+    0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
+    0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
+    0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
+    0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
+    0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
+    0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
+    0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
+    0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
+    0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
+    0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
+    0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
+    0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
+    0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
+    0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
+    0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
+    0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
+    0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
+    0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
+    0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x06, 0xEC, 0x81,
+    0x05, 0xFE, 0xB2, 0x5B, 0x22, 0x81, 0xB6, 0x3D,
+    0x27, 0x33, 0xBE, 0x96, 0x1C, 0x29, 0x95, 0x1D,
+    0x11, 0xDD, 0x22, 0x21, 0x65, 0x7A, 0x9F, 0x53,
+    0x1D, 0xDA, 0x2A, 0x19, 0x4D, 0xBB, 0x12, 0x64,
+    0x48, 0xBD, 0xEE, 0xB2, 0x58, 0xE0, 0x7E, 0xA6,
+    0x59, 0xC7, 0x46, 0x19, 0xA6, 0x38, 0x0E, 0x1D,
+    0x66, 0xD6, 0x83, 0x2B, 0xFE, 0x67, 0xF6, 0x38,
+    0xCD, 0x8F, 0xAE, 0x1F, 0x27, 0x23, 0x02, 0x0F,
+    0x9C, 0x40, 0xA3, 0xFD, 0xA6, 0x7E, 0xDA, 0x3B,
+    0xD2, 0x92, 0x38, 0xFB, 0xD4, 0xD4, 0xB4, 0x88,
+    0x5C, 0x2A, 0x99, 0x17, 0x6D, 0xB1, 0xA0, 0x6C,
+    0x50, 0x07, 0x78, 0x49, 0x1A, 0x82, 0x88, 0xF1,
+    0x85, 0x5F, 0x60, 0xFF, 0xFC, 0xF1, 0xD1, 0x37,
+    0x3F, 0xD9, 0x4F, 0xC6, 0x0C, 0x18, 0x11, 0xE1,
+    0xAC, 0x3F, 0x1C, 0x6D, 0x00, 0x3B, 0xEC, 0xDA,
+    0x3B, 0x1F, 0x27, 0x25, 0xCA, 0x59, 0x5D, 0xE0,
+    0xCA, 0x63, 0x32, 0x8F, 0x3B, 0xE5, 0x7C, 0xC9,
+    0x77, 0x55, 0x60, 0x11, 0x95, 0x14, 0x0D, 0xFB,
+    0x59, 0xD3, 0x9C, 0xE0, 0x91, 0x30, 0x8B, 0x41,
+    0x05, 0x74, 0x6D, 0xAC, 0x23, 0xD3, 0x3E, 0x5F,
+    0x7C, 0xE4, 0x84, 0x8D, 0xA3, 0x16, 0xA9, 0xC6,
+    0x6B, 0x95, 0x81, 0xBA, 0x35, 0x73, 0xBF, 0xAF,
+    0x31, 0x14, 0x96, 0x18, 0x8A, 0xB1, 0x54, 0x23,
+    0x28, 0x2E, 0xE4, 0x16, 0xDC, 0x2A, 0x19, 0xC5,
+    0x72, 0x4F, 0xA9, 0x1A, 0xE4, 0xAD, 0xC8, 0x8B,
+    0xC6, 0x67, 0x96, 0xEA, 0xE5, 0x67, 0x7A, 0x01,
+    0xF6, 0x4E, 0x8C, 0x08, 0x63, 0x13, 0x95, 0x82,
+    0x2D, 0x9D, 0xB8, 0xFC, 0xEE, 0x35, 0xC0, 0x6B,
+    0x1F, 0xEE, 0xA5, 0x47, 0x4D, 0x6D, 0x8F, 0x34,
+    0xB1, 0x53, 0x4A, 0x93, 0x6A, 0x18, 0xB0, 0xE0,
+    0xD2, 0x0E, 0xAB, 0x86, 0xBC, 0x9C, 0x6D, 0x6A,
+    0x52, 0x07, 0x19, 0x4E, 0x68, 0x72, 0x07, 0x32,
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+#endif /* HAVE_FFDHE_Q */
 
 const DhParams* wc_Dh_ffdhe6144_Get(void)
 {
     static const DhParams ffdhe6144 = {
+        #ifdef HAVE_FFDHE_Q
+            dh_ffdhe6144_q, sizeof(dh_ffdhe6144_q),
+        #endif /* HAVE_FFDHE_Q */
         dh_ffdhe6144_p, sizeof(dh_ffdhe6144_p),
         dh_ffdhe6144_g, sizeof(dh_ffdhe6144_g)
@@ -485 +776 @@
 };
 static const byte dh_ffdhe8192_g[] = { 0x02 };
+#ifdef HAVE_FFDHE_Q
+static const byte dh_ffdhe8192_q[] = {
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+    0xD6, 0xFC, 0x2A, 0x2C, 0x51, 0x5D, 0xA5, 0x4D,
+    0x57, 0xEE, 0x2B, 0x10, 0x13, 0x9E, 0x9E, 0x78,
+    0xEC, 0x5C, 0xE2, 0xC1, 0xE7, 0x16, 0x9B, 0x4A,
+    0xD4, 0xF0, 0x9B, 0x20, 0x8A, 0x32, 0x19, 0xFD,
+    0xE6, 0x49, 0xCE, 0xE7, 0x12, 0x4D, 0x9F, 0x7C,
+    0xBE, 0x97, 0xF1, 0xB1, 0xB1, 0x86, 0x3A, 0xEC,
+    0x7B, 0x40, 0xD9, 0x01, 0x57, 0x62, 0x30, 0xBD,
+    0x69, 0xEF, 0x8F, 0x6A, 0xEA, 0xFE, 0xB2, 0xB0,
+    0x92, 0x19, 0xFA, 0x8F, 0xAF, 0x83, 0x37, 0x68,
+    0x42, 0xB1, 0xB2, 0xAA, 0x9E, 0xF6, 0x8D, 0x79,
+    0xDA, 0xAB, 0x89, 0xAF, 0x3F, 0xAB, 0xE4, 0x9A,
+    0xCC, 0x27, 0x86, 0x38, 0x70, 0x73, 0x45, 0xBB,
+    0xF1, 0x53, 0x44, 0xED, 0x79, 0xF7, 0xF4, 0x39,
+    0x0E, 0xF8, 0xAC, 0x50, 0x9B, 0x56, 0xF3, 0x9A,
+    0x98, 0x56, 0x65, 0x27, 0xA4, 0x1D, 0x3C, 0xBD,
+    0x5E, 0x05, 0x58, 0xC1, 0x59, 0x92, 0x7D, 0xB0,
+    0xE8, 0x84, 0x54, 0xA5, 0xD9, 0x64, 0x71, 0xFD,
+    0xDC, 0xB5, 0x6D, 0x5B, 0xB0, 0x6B, 0xFA, 0x34,
+    0x0E, 0xA7, 0xA1, 0x51, 0xEF, 0x1C, 0xA6, 0xFA,
+    0x57, 0x2B, 0x76, 0xF3, 0xB1, 0xB9, 0x5D, 0x8C,
+    0x85, 0x83, 0xD3, 0xE4, 0x77, 0x05, 0x36, 0xB8,
+    0x4F, 0x01, 0x7E, 0x70, 0xE6, 0xFB, 0xF1, 0x76,
+    0x60, 0x1A, 0x02, 0x66, 0x94, 0x1A, 0x17, 0xB0,
+    0xC8, 0xB9, 0x7F, 0x4E, 0x74, 0xC2, 0xC1, 0xFF,
+    0xC7, 0x27, 0x89, 0x19, 0x77, 0x79, 0x40, 0xC1,
+    0xE1, 0xFF, 0x1D, 0x8D, 0xA6, 0x37, 0xD6, 0xB9,
+    0x9D, 0xDA, 0xFE, 0x5E, 0x17, 0x61, 0x10, 0x02,
+    0xE2, 0xC7, 0x78, 0xC1, 0xBE, 0x8B, 0x41, 0xD9,
+    0x63, 0x79, 0xA5, 0x13, 0x60, 0xD9, 0x77, 0xFD,
+    0x44, 0x35, 0xA1, 0x1C, 0x30, 0x8F, 0xE7, 0xEE,
+    0x6F, 0x1A, 0xAD, 0x9D, 0xB2, 0x8C, 0x81, 0xAD,
+    0xDE, 0x1A, 0x7A, 0x6F, 0x7C, 0xCE, 0x01, 0x1C,
+    0x30, 0xDA, 0x37, 0xE4, 0xEB, 0x73, 0x64, 0x83,
+    0xBD, 0x6C, 0x8E, 0x93, 0x48, 0xFB, 0xFB, 0xF7,
+    0x2C, 0xC6, 0x58, 0x7D, 0x60, 0xC3, 0x6C, 0x8E,
+    0x57, 0x7F, 0x09, 0x84, 0xC2, 0x89, 0xC9, 0x38,
+    0x5A, 0x09, 0x86, 0x49, 0xDE, 0x21, 0xBC, 0xA2,
+    0x7A, 0x7E, 0xA2, 0x29, 0x71, 0x6B, 0xA6, 0xE9,
+    0xB2, 0x79, 0x71, 0x0F, 0x38, 0xFA, 0xA5, 0xFF,
+    0xAE, 0x57, 0x41, 0x55, 0xCE, 0x4E, 0xFB, 0x4F,
+    0x74, 0x36, 0x95, 0xE2, 0x91, 0x1B, 0x1D, 0x06,
+    0xD5, 0xE2, 0x90, 0xCB, 0xCD, 0x86, 0xF5, 0x6D,
+    0x0E, 0xDF, 0xCD, 0x21, 0x6A, 0xE2, 0x24, 0x27,
+    0x05, 0x5E, 0x68, 0x35, 0xFD, 0x29, 0xEE, 0xF7,
+    0x9E, 0x0D, 0x90, 0x77, 0x1F, 0xEA, 0xCE, 0xBE,
+    0x12, 0xF2, 0x0E, 0x95, 0xB3, 0x4F, 0x0F, 0x78,
+    0xB7, 0x37, 0xA9, 0x61, 0x8B, 0x26, 0xFA, 0x7D,
+    0xBC, 0x98, 0x74, 0xF2, 0x72, 0xC4, 0x2B, 0xDB,
+    0x56, 0x3E, 0xAF, 0xA1, 0x6B, 0x4F, 0xB6, 0x8C,
+    0x3B, 0xB1, 0xE7, 0x8E, 0xAA, 0x81, 0xA0, 0x02,
+    0x43, 0xFA, 0xAD, 0xD2, 0xBF, 0x18, 0xE6, 0x3D,
+    0x38, 0x9A, 0xE4, 0x43, 0x77, 0xDA, 0x18, 0xC5,
+    0x76, 0xB5, 0x0F, 0x00, 0x96, 0xCF, 0x34, 0x19,
+    0x54, 0x83, 0xB0, 0x05, 0x48, 0xC0, 0x98, 0x62,
+    0x36, 0xE3, 0xBC, 0x7C, 0xB8, 0xD6, 0x80, 0x1C,
+    0x04, 0x94, 0xCC, 0xD1, 0x99, 0xE5, 0xC5, 0xBD,
+    0x0D, 0x0E, 0xDC, 0x9E, 0xB8, 0xA0, 0x00, 0x1E,
+    0x15, 0x27, 0x67, 0x54, 0xFC, 0xC6, 0x85, 0x66,
+    0x05, 0x41, 0x48, 0xE6, 0xE7, 0x64, 0xBE, 0xE7,
+    0xC7, 0x64, 0xDA, 0xAD, 0x3F, 0xC4, 0x52, 0x35,
+    0xA6, 0xDA, 0xD4, 0x28, 0xFA, 0x20, 0xC1, 0x70,
+    0xE3, 0x45, 0x00, 0x3F, 0x2F, 0x06, 0xEC, 0x81,
+    0x05, 0xFE, 0xB2, 0x5B, 0x22, 0x81, 0xB6, 0x3D,
+    0x27, 0x33, 0xBE, 0x96, 0x1C, 0x29, 0x95, 0x1D,
+    0x11, 0xDD, 0x22, 0x21, 0x65, 0x7A, 0x9F, 0x53,
+    0x1D, 0xDA, 0x2A, 0x19, 0x4D, 0xBB, 0x12, 0x64,
+    0x48, 0xBD, 0xEE, 0xB2, 0x58, 0xE0, 0x7E, 0xA6,
+    0x59, 0xC7, 0x46, 0x19, 0xA6, 0x38, 0x0E, 0x1D,
+    0x66, 0xD6, 0x83, 0x2B, 0xFE, 0x67, 0xF6, 0x38,
+    0xCD, 0x8F, 0xAE, 0x1F, 0x27, 0x23, 0x02, 0x0F,
+    0x9C, 0x40, 0xA3, 0xFD, 0xA6, 0x7E, 0xDA, 0x3B,
+    0xD2, 0x92, 0x38, 0xFB, 0xD4, 0xD4, 0xB4, 0x88,
+    0x5C, 0x2A, 0x99, 0x17, 0x6D, 0xB1, 0xA0, 0x6C,
+    0x50, 0x07, 0x78, 0x49, 0x1A, 0x82, 0x88, 0xF1,
+    0x85, 0x5F, 0x60, 0xFF, 0xFC, 0xF1, 0xD1, 0x37,
+    0x3F, 0xD9, 0x4F, 0xC6, 0x0C, 0x18, 0x11, 0xE1,
+    0xAC, 0x3F, 0x1C, 0x6D, 0x00, 0x3B, 0xEC, 0xDA,
+    0x3B, 0x1F, 0x27, 0x25, 0xCA, 0x59, 0x5D, 0xE0,
+    0xCA, 0x63, 0x32, 0x8F, 0x3B, 0xE5, 0x7C, 0xC9,
+    0x77, 0x55, 0x60, 0x11, 0x95, 0x14, 0x0D, 0xFB,
+    0x59, 0xD3, 0x9C, 0xE0, 0x91, 0x30, 0x8B, 0x41,
+    0x05, 0x74, 0x6D, 0xAC, 0x23, 0xD3, 0x3E, 0x5F,
+    0x7C, 0xE4, 0x84, 0x8D, 0xA3, 0x16, 0xA9, 0xC6,
+    0x6B, 0x95, 0x81, 0xBA, 0x35, 0x73, 0xBF, 0xAF,
+    0x31, 0x14, 0x96, 0x18, 0x8A, 0xB1, 0x54, 0x23,
+    0x28, 0x2E, 0xE4, 0x16, 0xDC, 0x2A, 0x19, 0xC5,
+    0x72, 0x4F, 0xA9, 0x1A, 0xE4, 0xAD, 0xC8, 0x8B,
+    0xC6, 0x67, 0x96, 0xEA, 0xE5, 0x67, 0x7A, 0x01,
+    0xF6, 0x4E, 0x8C, 0x08, 0x63, 0x13, 0x95, 0x82,
+    0x2D, 0x9D, 0xB8, 0xFC, 0xEE, 0x35, 0xC0, 0x6B,
+    0x1F, 0xEE, 0xA5, 0x47, 0x4D, 0x6D, 0x8F, 0x34,
+    0xB1, 0x53, 0x4A, 0x93, 0x6A, 0x18, 0xB0, 0xE0,
+    0xD2, 0x0E, 0xAB, 0x86, 0xBC, 0x9C, 0x6D, 0x6A,
+    0x52, 0x07, 0x19, 0x4E, 0x67, 0xFA, 0x35, 0x55,
+    0x1B, 0x56, 0x80, 0x26, 0x7B, 0x00, 0x64, 0x1C,
+    0x0F, 0x21, 0x2D, 0x18, 0xEC, 0xA8, 0xD7, 0x32,
+    0x7E, 0xD9, 0x1F, 0xE7, 0x64, 0xA8, 0x4E, 0xA1,
+    0xB4, 0x3F, 0xF5, 0xB4, 0xF6, 0xE8, 0xE6, 0x2F,
+    0x05, 0xC6, 0x61, 0xDE, 0xFB, 0x25, 0x88, 0x77,
+    0xC3, 0x5B, 0x18, 0xA1, 0x51, 0xD5, 0xC4, 0x14,
+    0xAA, 0xAD, 0x97, 0xBA, 0x3E, 0x49, 0x93, 0x32,
+    0xE5, 0x96, 0x07, 0x8E, 0x60, 0x0D, 0xEB, 0x81,
+    0x14, 0x9C, 0x44, 0x1C, 0xE9, 0x57, 0x82, 0xF2,
+    0x2A, 0x28, 0x25, 0x63, 0xC5, 0xBA, 0xC1, 0x41,
+    0x14, 0x23, 0x60, 0x5D, 0x1A, 0xE1, 0xAF, 0xAE,
+    0x2C, 0x8B, 0x06, 0x60, 0x23, 0x7E, 0xC1, 0x28,
+    0xAA, 0x0F, 0xE3, 0x46, 0x4E, 0x43, 0x58, 0x11,
+    0x5D, 0xB8, 0x4C, 0xC3, 0xB5, 0x23, 0x07, 0x3A,
+    0x28, 0xD4, 0x54, 0x98, 0x84, 0xB8, 0x1F, 0xF7,
+    0x0E, 0x10, 0xBF, 0x36, 0x1C, 0x13, 0x72, 0x96,
+    0x28, 0xD5, 0x34, 0x8F, 0x07, 0x21, 0x1E, 0x7E,
+    0x4C, 0xF4, 0xF1, 0x8B, 0x28, 0x60, 0x90, 0xBD,
+    0xB1, 0x24, 0x0B, 0x66, 0xD6, 0xCD, 0x4A, 0xFC,
+    0xEA, 0xDC, 0x00, 0xCA, 0x44, 0x6C, 0xE0, 0x50,
+    0x50, 0xFF, 0x18, 0x3A, 0xD2, 0xBB, 0xF1, 0x18,
+    0xC1, 0xFC, 0x0E, 0xA5, 0x1F, 0x97, 0xD2, 0x2B,
+    0x8F, 0x7E, 0x46, 0x70, 0x5D, 0x45, 0x27, 0xF4,
+    0x5B, 0x42, 0xAE, 0xFF, 0x39, 0x58, 0x53, 0x37,
+    0x6F, 0x69, 0x7D, 0xD5, 0xFD, 0xF2, 0xC5, 0x18,
+    0x7D, 0x7D, 0x5F, 0x0E, 0x2E, 0xB8, 0xD4, 0x3F,
+    0x17, 0xBA, 0x0F, 0x7C, 0x60, 0xFF, 0x43, 0x7F,
+    0x53, 0x5D, 0xFE, 0xF2, 0x98, 0x33, 0xBF, 0x86,
+    0xCB, 0xE8, 0x8E, 0xA4, 0xFB, 0xD4, 0x22, 0x1E,
+    0x84, 0x11, 0x72, 0x83, 0x54, 0xFA, 0x30, 0xA7,
+    0x00, 0x8F, 0x15, 0x4A, 0x41, 0xC7, 0xFC, 0x46,
+    0x6B, 0x46, 0x45, 0xDB, 0xE2, 0xE3, 0x21, 0x26,
+    0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+#endif /* HAVE_FFDHE_Q */
 
 const DhParams* wc_Dh_ffdhe8192_Get(void)
 {
     static const DhParams ffdhe8192 = {
+        #ifdef HAVE_FFDHE_Q
+            dh_ffdhe8192_q, sizeof(dh_ffdhe8192_q),
+        #endif /* HAVE_FFDHE_Q */
         dh_ffdhe8192_p, sizeof(dh_ffdhe8192_p),
         dh_ffdhe8192_g, sizeof(dh_ffdhe8192_g)
@@ -505 +931 @@
     key->heap = heap; /* for XMALLOC/XFREE in future */
 
-    if (mp_init_multi(&key->p, &key->g, NULL, NULL, NULL, NULL) != MP_OKAY)
+    if (mp_init_multi(&key->p, &key->g, &key->q, NULL, NULL, NULL) != MP_OKAY)
         return MEMORY_E;
 
@@ -525 +951 @@
 
 
-void wc_FreeDhKey(DhKey* key)
+int wc_FreeDhKey(DhKey* key)
 {
     if (key) {
         mp_clear(&key->p);
         mp_clear(&key->g);
+        mp_clear(&key->q);
 
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_DH)
@@ -535 +962 @@
     #endif
     }
-}
-
-
+    return 0;
+}
+
+
+#ifndef WC_NO_RNG
 /* if defined to not use floating point values do not compile in */
 #ifndef WOLFSSL_DH_CONST
@@ -568 +997 @@
 
 
-static int GeneratePrivateDh(DhKey* key, WC_RNG* rng, byte* priv, word32* privSz)
-{
+#ifndef WOLFSSL_NO_DH186
+/* validate that (L,N) match allowed sizes from SP 800-56A, Section 5.5.1.1.
+ * modLen - represents L, the size of p in bits
+ * divLen - represents N, the size of q in bits
+ * return 0 on success, -1 on error */
+static int CheckDhLN(int modLen, int divLen)
+{
+    int ret = -1;
+
+    switch (modLen) {
+        /* FA */
+        case 1024:
+            if (divLen == 160)
+                ret = 0;
+            break;
+        /* FB, FC */
+        case 2048:
+            if (divLen == 224 || divLen == 256)
+                ret = 0;
+            break;
+        default:
+            break;
+    }
+
+    return ret;
+}
+
+
+/* Create DH private key
+ *
+ * Based on NIST FIPS 186-4,
+ * "B.1.1 Key Pair Generation Using Extra Random Bits"
+ *
+ * dh     - pointer to initialized DhKey structure, needs to have dh->q
+ * rng    - pointer to initialized WC_RNG structure
+ * priv   - output location for generated private key
+ * privSz - IN/OUT, size of priv buffer, size of generated private key
+ *
+ * return 0 on success, negative on error */
+static int GeneratePrivateDh186(DhKey* key, WC_RNG* rng, byte* priv,
+                                word32* privSz)
+{
+    byte* cBuf;
+    int qSz, pSz, cSz, err;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* tmpQ = NULL;
+    mp_int* tmpX = NULL;
+#else
+    mp_int tmpQ[1], tmpX[1];
+#endif
+
+    /* Parameters validated in calling functions. */
+
+    if (mp_iszero(&key->q) == MP_YES) {
+        WOLFSSL_MSG("DH q parameter needed for FIPS 186-4 key generation");
+        return BAD_FUNC_ARG;
+    }
+
+    qSz = mp_unsigned_bin_size(&key->q);
+    pSz = mp_unsigned_bin_size(&key->p);
+
+    /* verify (L,N) pair bit lengths */
+    if (CheckDhLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) {
+        WOLFSSL_MSG("DH param sizes do not match SP 800-56A requirements");
+        return BAD_FUNC_ARG;
+    }
+
+    /* generate extra 64 bits so that bias from mod function is negligible */
+    cSz = qSz + (64 / WOLFSSL_BIT_SIZE);
+    cBuf = (byte*)XMALLOC(cSz, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (cBuf == NULL) {
+        return MEMORY_E;
+    }
+#ifdef WOLFSSL_SMALL_STACK
+    tmpQ = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (tmpQ == NULL) {
+        XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return MEMORY_E;
+    }
+    tmpX = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (tmpX == NULL) {
+        XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+
+
+    if ((err = mp_init_multi(tmpX, tmpQ, NULL, NULL, NULL, NULL))
+                   != MP_OKAY) {
+        XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
+#endif
+        return err;
+    }
+
+    do {
+        /* generate N+64 bits (c) from RBG into tmpX, making sure positive.
+         * Hash_DRBG uses SHA-256 which matches maximum
+         * requested_security_strength of (L,N) */
+        err = wc_RNG_GenerateBlock(rng, cBuf, cSz);
+        if (err == MP_OKAY)
+            err = mp_read_unsigned_bin(tmpX, cBuf, cSz);
+        if (err != MP_OKAY) {
+            mp_clear(tmpX);
+            mp_clear(tmpQ);
+            XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+#ifdef WOLFSSL_SMALL_STACK
+            XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
+            XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
+#endif
+            return err;
+        }
+    } while (mp_cmp_d(tmpX, 1) != MP_GT);
+
+    ForceZero(cBuf, cSz);
+    XFREE(cBuf, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+
+    /* tmpQ = q - 1 */
+    if (err == MP_OKAY)
+        err = mp_copy(&key->q, tmpQ);
+
+    if (err == MP_OKAY)
+        err = mp_sub_d(tmpQ, 1, tmpQ);
+
+    /* x = c mod (q-1), tmpX holds c */
+    if (err == MP_OKAY)
+        err = mp_mod(tmpX, tmpQ, tmpX);
+
+    /* x = c mod (q-1) + 1 */
+    if (err == MP_OKAY)
+        err = mp_add_d(tmpX, 1, tmpX);
+
+    /* copy tmpX into priv */
+    if (err == MP_OKAY) {
+        pSz = mp_unsigned_bin_size(tmpX);
+        if (pSz > (int)*privSz) {
+            WOLFSSL_MSG("DH private key output buffer too small");
+            err = BAD_FUNC_ARG;
+        } else {
+            *privSz = pSz;
+            err = mp_to_unsigned_bin(tmpX, priv);
+        }
+    }
+
+    mp_forcezero(tmpX);
+    mp_clear(tmpX);
+    mp_clear(tmpQ);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(tmpQ, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(tmpX, key->heap, DYNAMIC_TYPE_DH);
+#endif
+
+    return err;
+}
+#endif /* WOLFSSL_NO_DH186 */
+#endif /* !WC_NO_RNG */
+
+static int GeneratePrivateDh(DhKey* key, WC_RNG* rng, byte* priv,
+                             word32* privSz)
+{
+#ifndef WC_NO_RNG
     int ret = 0;
-    word32 sz = mp_unsigned_bin_size(&key->p);
+    word32 sz = 0;
+
+#ifndef WOLFSSL_NO_DH186
+    if (mp_iszero(&key->q) == MP_NO) {
+
+        /* q param available, use NIST FIPS 186-4, "B.1.1 Key Pair
+         * Generation Using Extra Random Bits" */
+        ret = GeneratePrivateDh186(key, rng, priv, privSz);
+
+    } else
+#endif
+    {
+
+        sz = mp_unsigned_bin_size(&key->p);
 
     /* Table of predetermined values from the operation
-       2 * DiscreteLogWorkFactor(sz * WOLFSSL_BIT_SIZE) / WOLFSSL_BIT_SIZE + 1
+           2 * DiscreteLogWorkFactor(sz * WOLFSSL_BIT_SIZE) /
+           WOLFSSL_BIT_SIZE + 1
        Sizes in table checked against RFC 3526
      */
@@ -604 +1209 @@
         *privSz = sz;
     }
+    }
 
     return ret;
+#else
+    (void)key;
+    (void)rng;
+    (void)priv;
+    (void)privSz;
+    return NOT_COMPILED_IN;
+#endif /* WC_NO_RNG */
 }
 
@@ -613 +1226 @@
 {
     int ret = 0;
-    mp_int x;
-    mp_int y;
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* x = NULL;
+    mp_int* y = NULL;
+#else
+    mp_int x[1];
+    mp_int y[1];
+#endif
+#endif
 
 #ifdef WOLFSSL_HAVE_SP_DH
@@ -627 +1247 @@
 #endif
 
-    if (mp_init_multi(&x, &y, 0, 0, 0, 0) != MP_OKAY)
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+    x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (x == NULL)
+        return MEMORY_E;
+    y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (y == NULL) {
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+    if (mp_init_multi(x, y, 0, 0, 0, 0) != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+    #endif
         return MP_INIT_E;
-
-    if (mp_read_unsigned_bin(&x, priv, privSz) != MP_OKAY)
+    }
+
+    if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY)
         ret = MP_READ_E;
 
-    if (ret == 0 && mp_exptmod(&key->g, &x, &key->p, &y) != MP_OKAY)
+    if (ret == 0 && mp_exptmod(&key->g, x, &key->p, y) != MP_OKAY)
         ret = MP_EXPTMOD_E;
 
-    if (ret == 0 && mp_to_unsigned_bin(&y, pub) != MP_OKAY)
+    if (ret == 0 && mp_to_unsigned_bin(y, pub) != MP_OKAY)
         ret = MP_TO_E;
 
     if (ret == 0)
-        *pubSz = mp_unsigned_bin_size(&y);
-
-    mp_clear(&y);
-    mp_clear(&x);
+        *pubSz = mp_unsigned_bin_size(y);
+
+    mp_clear(y);
+    mp_clear(x);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+#endif
+#else
+    ret = WC_KEY_SIZE_E;
+#endif
 
     return ret;
@@ -723 +1366 @@
 
 
+/* Check DH Public Key for invalid numbers, optionally allowing
+ * the public key to be checked against the large prime (q).
+ * Check per process in SP 800-56Ar3, section 5.6.2.3.1.
+ *
+ * key     DH key group parameters.
+ * pub     Public Key.
+ * pubSz   Public Key size.
+ * prime   Large prime (q), optionally NULL to skip check
+ * primeSz Size of large prime
+ *
+ *  returns 0 on success or error code
+ */
+int wc_DhCheckPubKey_ex(DhKey* key, const byte* pub, word32 pubSz,
+                        const byte* prime, word32 primeSz)
+{
+    int ret = 0;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* y = NULL;
+    mp_int* p = NULL;
+    mp_int* q = NULL;
+#else
+    mp_int y[1];
+    mp_int p[1];
+    mp_int q[1];
+#endif
+
+    if (key == NULL || pub == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (y == NULL)
+        return MEMORY_E;
+    p = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (p == NULL) {
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+    q = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (q == NULL) {
+        XFREE(p, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+
+    if (mp_init_multi(y, p, q, NULL, NULL, NULL) != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(q, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(p, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        return MP_INIT_E;
+    }
+
+    if (mp_read_unsigned_bin(y, pub, pubSz) != MP_OKAY) {
+        ret = MP_READ_E;
+    }
+
+    if (ret == 0 && prime != NULL) {
+        if (mp_read_unsigned_bin(q, prime, primeSz) != MP_OKAY)
+            ret = MP_READ_E;
+
+    } else if (mp_iszero(&key->q) == MP_NO) {
+        /* use q available in DhKey */
+        if (mp_copy(&key->q, q) != MP_OKAY)
+            ret = MP_INIT_E;
+    }
+
+    /* SP 800-56Ar3, section 5.6.2.3.1, process step 1 */
+    /* pub (y) should not be 0 or 1 */
+    if (ret == 0 && mp_cmp_d(y, 2) == MP_LT) {
+        ret = MP_CMP_E;
+    }
+
+    /* pub (y) shouldn't be greater than or equal to p - 1 */
+    if (ret == 0 && mp_copy(&key->p, p) != MP_OKAY) {
+        ret = MP_INIT_E;
+    }
+    if (ret == 0 && mp_sub_d(p, 2, p) != MP_OKAY) {
+        ret = MP_SUB_E;
+    }
+    if (ret == 0 && mp_cmp(y, p) == MP_GT) {
+        ret = MP_CMP_E;
+    }
+
+    if (ret == 0 && (prime != NULL || (mp_iszero(&key->q) == MP_NO) )) {
+
+        /* restore key->p into p */
+        if (mp_copy(&key->p, p) != MP_OKAY)
+            ret = MP_INIT_E;
+    }
+
+    if (ret == 0 && prime != NULL) {
+#ifdef WOLFSSL_HAVE_SP_DH
+#ifndef WOLFSSL_SP_NO_2048
+        if (mp_count_bits(&key->p) == 2048) {
+            ret = sp_ModExp_2048(y, q, p, y);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
+#ifndef WOLFSSL_SP_NO_3072
+        if (mp_count_bits(&key->p) == 3072) {
+            ret = sp_ModExp_3072(y, q, p, y);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
+#endif
+
+        {
+    /* SP 800-56Ar3, section 5.6.2.3.1, process step 2 */
+#ifndef WOLFSSL_SP_MATH
+            /* calculate (y^q) mod(p), store back into y */
+            if (ret == 0 && mp_exptmod(y, q, p, y) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+#else
+            ret = WC_KEY_SIZE_E;
+#endif
+        }
+
+        /* verify above == 1 */
+        if (ret == 0 && mp_cmp_d(y, 1) != MP_EQ)
+            ret = MP_CMP_E;
+    }
+
+    mp_clear(y);
+    mp_clear(p);
+    mp_clear(q);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(q, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(p, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+#endif
+
+    return ret;
+}
+
+
 /* Check DH Public Key for invalid numbers
  *
@@ -733 +1519 @@
 int wc_DhCheckPubKey(DhKey* key, const byte* pub, word32 pubSz)
 {
+    return wc_DhCheckPubKey_ex(key, pub, pubSz, NULL, 0);
+}
+
+
+/* Check DH Private Key for invalid numbers, optionally allowing
+ * the private key to be checked against the large prime (q).
+ * Check per process in SP 800-56Ar3, section 5.6.2.1.2.
+ *
+ * key     DH key group parameters.
+ * priv    Private Key.
+ * privSz  Private Key size.
+ * prime   Large prime (q), optionally NULL to skip check
+ * primeSz Size of large prime
+ *
+ *  returns 0 on success or error code
+ */
+int wc_DhCheckPrivKey_ex(DhKey* key, const byte* priv, word32 privSz,
+                         const byte* prime, word32 primeSz)
+{
     int ret = 0;
-
-    mp_int x;
-    mp_int y;
-
-    if (key == NULL || pub == NULL) {
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* x = NULL;
+    mp_int* q = NULL;
+#else
+    mp_int x[1];
+    mp_int q[1];
+#endif
+
+    if (key == NULL || priv == NULL) {
         return BAD_FUNC_ARG;
     }
 
-    if (mp_init_multi(&x, &y, NULL, NULL, NULL, NULL) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+    x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (x == NULL)
+        return MEMORY_E;
+    q = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (q == NULL) {
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+
+    if (mp_init_multi(x, q, NULL, NULL, NULL, NULL) != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(q, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+    #endif
         return MP_INIT_E;
     }
 
-    if (mp_read_unsigned_bin(&x, pub, pubSz) != MP_OKAY) {
+    if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY) {
         ret = MP_READ_E;
     }
 
-    /* pub should not be 0 or 1 */
-    if (ret == 0 && mp_cmp_d(&x, 2) == MP_LT) {
+    if (ret == 0) {
+        if (prime != NULL) {
+            if (mp_read_unsigned_bin(q, prime, primeSz) != MP_OKAY)
+                ret = MP_READ_E;
+        }
+        else if (mp_iszero(&key->q) == MP_NO) {
+            /* use q available in DhKey */
+            if (mp_copy(&key->q, q) != MP_OKAY)
+                ret = MP_INIT_E;
+        }
+    }
+
+    /* priv (x) should not be 0 */
+    if (ret == 0) {
+        if (mp_cmp_d(x, 0) == MP_EQ)
         ret = MP_CMP_E;
     }
 
-    /* pub shouldn't be greater than or equal to p - 1 */
-    if (ret == 0 && mp_copy(&key->p, &y) != MP_OKAY) {
+    if (ret == 0) {
+        if (mp_iszero(q) == MP_NO) {
+            /* priv (x) shouldn't be greater than q - 1 */
+            if (ret == 0) {
+                if (mp_copy(&key->q, q) != MP_OKAY)
         ret = MP_INIT_E;
     }
-    if (ret == 0 && mp_sub_d(&y, 2, &y) != MP_OKAY) {
+            if (ret == 0) {
+                if (mp_sub_d(q, 1, q) != MP_OKAY)
         ret = MP_SUB_E;
     }
-    if (ret == 0 && mp_cmp(&x, &y) == MP_GT) {
+            if (ret == 0) {
+                if (mp_cmp(x, q) == MP_GT)
+                    ret = DH_CHECK_PRIV_E;
+            }
+        }
+    }
+
+    mp_clear(x);
+    mp_clear(q);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(q, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+#endif
+
+    return ret;
+}
+
+
+/* Check DH Private Key for invalid numbers
+ *
+ * key    DH key group parameters.
+ * priv   Private Key.
+ * privSz Private Key size.
+ *
+ *  returns 0 on success or error code
+ */
+int wc_DhCheckPrivKey(DhKey* key, const byte* priv, word32 privSz)
+{
+    return wc_DhCheckPrivKey_ex(key, priv, privSz, NULL, 0);
+}
+
+
+/* Check DH Keys for pair-wise consistency per process in
+ * SP 800-56Ar3, section 5.6.2.1.4, method (b) for FFC.
+ *
+ * key    DH key group parameters.
+ * pub    Public Key.
+ * pubSz  Public Key size.
+ * priv   Private Key.
+ * privSz Private Key size.
+ *
+ *  returns 0 on success or error code
+ */
+int wc_DhCheckKeyPair(DhKey* key, const byte* pub, word32 pubSz,
+                      const byte* priv, word32 privSz)
+{
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* publicKey = NULL;
+    mp_int* privateKey = NULL;
+    mp_int* checkKey = NULL;
+#else
+    mp_int publicKey[1];
+    mp_int privateKey[1];
+    mp_int checkKey[1];
+#endif
+    int ret = 0;
+
+    if (key == NULL || pub == NULL || priv == NULL)
+        return BAD_FUNC_ARG;
+
+#ifdef WOLFSSL_SMALL_STACK
+    publicKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (publicKey == NULL)
+        return MEMORY_E;
+    privateKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (privateKey == NULL) {
+        XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+    checkKey = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (checkKey == NULL) {
+        XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+
+    if (mp_init_multi(publicKey, privateKey, checkKey,
+                      NULL, NULL, NULL) != MP_OKAY) {
+
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(checkKey, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        return MP_INIT_E;
+    }
+
+    /* Load the private and public keys into big integers. */
+    if (mp_read_unsigned_bin(publicKey, pub, pubSz) != MP_OKAY ||
+        mp_read_unsigned_bin(privateKey, priv, privSz) != MP_OKAY) {
+
+        ret = MP_READ_E;
+    }
+
+    /* Calculate checkKey = g^privateKey mod p */
+    if (ret == 0) {
+#ifdef WOLFSSL_HAVE_SP_DH
+#ifndef WOLFSSL_SP_NO_2048
+        if (mp_count_bits(&key->p) == 2048) {
+            ret = sp_ModExp_2048(&key->g, privateKey, &key->p, checkKey);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
+#ifndef WOLFSSL_SP_NO_3072
+        if (mp_count_bits(&key->p) == 3072) {
+            ret = sp_ModExp_3072(&key->g, privateKey, &key->p, checkKey);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
+#endif
+        {
+#ifndef WOLFSSL_SP_MATH
+            if (mp_exptmod(&key->g, privateKey, &key->p, checkKey) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+#else
+            ret = WC_KEY_SIZE_E;
+#endif
+        }
+    }
+
+    /* Compare the calculated public key to the supplied check value. */
+    if (ret == 0) {
+        if (mp_cmp(checkKey, publicKey) != MP_EQ)
         ret = MP_CMP_E;
     }
 
-    mp_clear(&y);
-    mp_clear(&x);
+    mp_forcezero(privateKey);
+    mp_clear(privateKey);
+    mp_clear(publicKey);
+    mp_clear(checkKey);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(checkKey, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(privateKey, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(publicKey, key->heap, DYNAMIC_TYPE_DH);
+#endif
 
     return ret;
@@ -801 +1776 @@
 {
     int ret = 0;
-    mp_int x;
-    mp_int y;
-    mp_int z;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* y = NULL;
+#ifndef WOLFSSL_SP_MATH
+    mp_int* x = NULL;
+    mp_int* z = NULL;
+#endif
+#else
+    mp_int y[1];
+#ifndef WOLFSSL_SP_MATH
+    mp_int x[1];
+    mp_int z[1];
+#endif
+#endif
+
+#ifdef WOLFSSL_VALIDATE_FFC_IMPORT
+    if (wc_DhCheckPrivKey(key, priv, privSz) != 0) {
+        WOLFSSL_MSG("wc_DhAgree wc_DhCheckPrivKey failed");
+        return DH_CHECK_PRIV_E;
+    }
 
     if (wc_DhCheckPubKey(key, otherPub, pubSz) != 0) {
@@ -809 +1800 @@
         return DH_CHECK_PUB_E;
     }
+#endif
+
+#ifdef WOLFSSL_SMALL_STACK
+    y = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (y == NULL)
+        return MEMORY_E;
+#ifndef WOLFSSL_SP_MATH
+    x = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (x == NULL) {
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+    z = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_DH);
+    if (z == NULL) {
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+        return MEMORY_E;
+    }
+#endif
+#endif
 
 #ifdef WOLFSSL_HAVE_SP_DH
 #ifndef WOLFSSL_SP_NO_2048
     if (mp_count_bits(&key->p) == 2048) {
-        if (mp_init(&y) != MP_OKAY)
+        if (mp_init(y) != MP_OKAY)
             return MP_INIT_E;
 
-        if (ret == 0 && mp_read_unsigned_bin(&y, otherPub, pubSz) != MP_OKAY)
+        if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
             ret = MP_READ_E;
 
         if (ret == 0)
-            ret = sp_DhExp_2048(&y, priv, privSz, &key->p, agree, agreeSz);
-
-        mp_clear(&y);
+            ret = sp_DhExp_2048(y, priv, privSz, &key->p, agree, agreeSz);
+
+        mp_clear(y);
+    #ifdef WOLFSSL_SMALL_STACK
+    #ifndef WOLFSSL_SP_MATH
+        XFREE(z, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    #endif
         return ret;
     }
@@ -828 +1846 @@
 #ifndef WOLFSSL_SP_NO_3072
     if (mp_count_bits(&key->p) == 3072) {
-        if (mp_init(&y) != MP_OKAY)
+        if (mp_init(y) != MP_OKAY)
             return MP_INIT_E;
 
-        if (ret == 0 && mp_read_unsigned_bin(&y, otherPub, pubSz) != MP_OKAY)
+        if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
             ret = MP_READ_E;
 
         if (ret == 0)
-            ret = sp_DhExp_3072(&y, priv, privSz, &key->p, agree, agreeSz);
-
-        mp_clear(&y);
+            ret = sp_DhExp_3072(y, priv, privSz, &key->p, agree, agreeSz);
+
+        mp_clear(y);
+    #ifdef WOLFSSL_SMALL_STACK
+    #ifndef WOLFSSL_SP_MATH
+        XFREE(z, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    #endif
         return ret;
     }
@@ -843 +1868 @@
 #endif
 
-    if (mp_init_multi(&x, &y, &z, 0, 0, 0) != MP_OKAY)
+#ifndef WOLFSSL_SP_MATH
+    if (mp_init_multi(x, y, z, 0, 0, 0) != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(z, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    #endif
         return MP_INIT_E;
-
-    if (mp_read_unsigned_bin(&x, priv, privSz) != MP_OKAY)
+    }
+
+    if (mp_read_unsigned_bin(x, priv, privSz) != MP_OKAY)
         ret = MP_READ_E;
 
-    if (ret == 0 && mp_read_unsigned_bin(&y, otherPub, pubSz) != MP_OKAY)
+    if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
         ret = MP_READ_E;
 
-    if (ret == 0 && mp_exptmod(&y, &x, &key->p, &z) != MP_OKAY)
+    if (ret == 0 && mp_exptmod(y, x, &key->p, z) != MP_OKAY)
         ret = MP_EXPTMOD_E;
 
-    if (ret == 0 && mp_to_unsigned_bin(&z, agree) != MP_OKAY)
+    /* make sure z is not one (SP800-56A, 5.7.1.1) */
+    if (ret == 0 && (mp_cmp_d(z, 1) == MP_EQ))
+        ret = MP_VAL;
+
+    if (ret == 0 && mp_to_unsigned_bin(z, agree) != MP_OKAY)
         ret = MP_TO_E;
 
     if (ret == 0)
-        *agreeSz = mp_unsigned_bin_size(&z);
-
-    mp_clear(&z);
-    mp_clear(&y);
-    mp_forcezero(&x);
+        *agreeSz = mp_unsigned_bin_size(z);
+
+    mp_clear(z);
+    mp_clear(y);
+    mp_forcezero(x);
+#endif
+
+#ifdef WOLFSSL_SMALL_STACK
+#ifndef WOLFSSL_SP_MATH
+    XFREE(z, key->heap, DYNAMIC_TYPE_DH);
+    XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+#endif
+    XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+#endif
 
     return ret;
@@ -926 +1971 @@
 
 
+static int _DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
+                   word32 gSz, const byte* q, word32 qSz, int trusted,
+                   WC_RNG* rng)
+{
+    int ret = 0;
+    mp_int* keyP = NULL;
+    mp_int* keyG = NULL;
+    mp_int* keyQ = NULL;
+
+    if (key == NULL || p == NULL || g == NULL || pSz == 0 || gSz == 0) {
+        ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+    /* may have leading 0 */
+    if (p[0] == 0) {
+        pSz--; p++;
+    }
+
+    if (g[0] == 0) {
+        gSz--; g++;
+    }
+
+        if (q != NULL) {
+            if (q[0] == 0) {
+                qSz--; q++;
+            }
+        }
+
+    if (mp_init(&key->p) != MP_OKAY)
+            ret = MP_INIT_E;
+    }
+
+    if (ret == 0) {
+        if (mp_read_unsigned_bin(&key->p, p, pSz) != MP_OKAY)
+            ret = ASN_DH_KEY_E;
+        else
+            keyP = &key->p;
+    }
+
+#ifndef WOLFSSL_SP_MATH
+    if (ret == 0 && !trusted) {
+        int isPrime = 0;
+        if (rng != NULL)
+            ret = mp_prime_is_prime_ex(keyP, 8, &isPrime, rng);
+        else
+            ret = mp_prime_is_prime(keyP, 8, &isPrime);
+
+        if (ret == 0 && isPrime == 0)
+            ret = DH_CHECK_PUB_E;
+    }
+#else
+    (void)trusted;
+    (void)rng;
+#endif
+
+    if (ret == 0 && mp_init(&key->g) != MP_OKAY)
+        ret = MP_INIT_E;
+    if (ret == 0) {
+        if (mp_read_unsigned_bin(&key->g, g, gSz) != MP_OKAY)
+            ret = ASN_DH_KEY_E;
+        else
+            keyG = &key->g;
+    }
+
+    if (ret == 0 && q != NULL) {
+        if (mp_init(&key->q) != MP_OKAY)
+            ret = MP_INIT_E;
+    }
+    if (ret == 0 && q != NULL) {
+        if (mp_read_unsigned_bin(&key->q, q, qSz) != MP_OKAY)
+            ret = MP_INIT_E;
+        else
+            keyQ = &key->q;
+}
+
+    if (ret != 0 && key != NULL) {
+        if (keyQ)
+            mp_clear(keyQ);
+        if (keyG)
+            mp_clear(keyG);
+        if (keyP)
+            mp_clear(keyP);
+    }
+
+    return ret;
+}
+
+
+int wc_DhSetCheckKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
+                   word32 gSz, const byte* q, word32 qSz, int trusted,
+                   WC_RNG* rng)
+{
+    return _DhSetKey(key, p, pSz, g, gSz, q, qSz, trusted, rng);
+}
+
+
+int wc_DhSetKey_ex(DhKey* key, const byte* p, word32 pSz, const byte* g,
+                   word32 gSz, const byte* q, word32 qSz)
+{
+    return _DhSetKey(key, p, pSz, g, gSz, q, qSz, 1, NULL);
+}
+
+
 /* not in asn anymore since no actual asn types used */
 int wc_DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
                 word32 gSz)
 {
-    if (key == NULL || p == NULL || g == NULL || pSz == 0 || gSz == 0) {
-        return BAD_FUNC_ARG;
-    }
-
-    /* may have leading 0 */
-    if (p[0] == 0) {
-        pSz--; p++;
-    }
-
-    if (g[0] == 0) {
-        gSz--; g++;
-    }
-
-    if (mp_init(&key->p) != MP_OKAY)
-        return MP_INIT_E;
-    if (mp_read_unsigned_bin(&key->p, p, pSz) != 0) {
-        mp_clear(&key->p);
-        return ASN_DH_KEY_E;
-    }
-
-    if (mp_init(&key->g) != MP_OKAY) {
-        mp_clear(&key->p);
-        return MP_INIT_E;
-    }
-    if (mp_read_unsigned_bin(&key->g, g, gSz) != 0) {
-        mp_clear(&key->g);
-        mp_clear(&key->p);
-        return ASN_DH_KEY_E;
-    }
-
-    return 0;
-}
+    return _DhSetKey(key, p, pSz, g, gSz, NULL, 0, 1, NULL);
+}
+
+
+#ifdef WOLFSSL_KEY_GEN
+
+/* modulus_size in bits */
+int wc_DhGenerateParams(WC_RNG *rng, int modSz, DhKey *dh)
+{
+    mp_int  tmp, tmp2;
+    int     groupSz = 0, bufSz = 0,
+            primeCheckCount = 0,
+            primeCheck = MP_NO,
+            ret = 0;
+    unsigned char *buf = NULL;
+
+    if (rng == NULL || dh == NULL)
+        ret = BAD_FUNC_ARG;
+
+    /* set group size in bytes from modulus size
+     * FIPS 186-4 defines valid values (1024, 160) (2048, 256) (3072, 256)
+     */
+    if (ret == 0) {
+        switch (modSz) {
+            case 1024:
+                groupSz = 20;
+                break;
+            case 2048:
+            case 3072:
+                groupSz = 32;
+                break;
+            default:
+                ret = BAD_FUNC_ARG;
+                break;
+        }
+    }
+
+    if (ret == 0) {
+        /* modulus size in bytes */
+        modSz /= WOLFSSL_BIT_SIZE;
+        bufSz = modSz - groupSz;
+
+        /* allocate ram */
+        buf = (unsigned char *)XMALLOC(bufSz,
+                                       dh->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (buf == NULL)
+            ret = MEMORY_E;
+    }
+
+    /* make a random string that will be multplied against q */
+    if (ret == 0)
+        ret = wc_RNG_GenerateBlock(rng, buf, bufSz);
+
+    if (ret == 0) {
+        /* force magnitude */
+        buf[0] |= 0xC0;
+        /* force even */
+        buf[bufSz - 1] &= ~1;
+
+        if (mp_init_multi(&tmp, &tmp2, &dh->p, &dh->q, &dh->g, 0)
+                != MP_OKAY) {
+            ret = MP_INIT_E;
+        }
+    }
+
+    if (ret == 0) {
+        if (mp_read_unsigned_bin(&tmp2, buf, bufSz) != MP_OKAY)
+            ret = MP_READ_E;
+    }
+
+    /* make our prime q */
+    if (ret == 0) {
+        if (mp_rand_prime(&dh->q, groupSz, rng, NULL) != MP_OKAY)
+            ret = PRIME_GEN_E;
+    }
+
+    /* p = random * q */
+    if (ret == 0) {
+        if (mp_mul(&dh->q, &tmp2, &dh->p) != MP_OKAY)
+            ret = MP_MUL_E;
+    }
+
+    /* p = random * q + 1, so q is a prime divisor of p-1 */
+    if (ret == 0) {
+        if (mp_add_d(&dh->p, 1, &dh->p) != MP_OKAY)
+            ret = MP_ADD_E;
+    }
+
+    /* tmp = 2q  */
+    if (ret == 0) {
+        if (mp_add(&dh->q, &dh->q, &tmp) != MP_OKAY)
+            ret = MP_ADD_E;
+    }
+
+    /* loop until p is prime */
+    if (ret == 0) {
+        do {
+            if (mp_prime_is_prime_ex(&dh->p, 8, &primeCheck, rng) != MP_OKAY)
+                ret = PRIME_GEN_E;
+
+            if (primeCheck != MP_YES) {
+                /* p += 2q */
+                if (mp_add(&tmp, &dh->p, &dh->p) != MP_OKAY)
+                    ret = MP_ADD_E;
+                else
+                    primeCheckCount++;
+            }
+        } while (ret == 0 && primeCheck == MP_NO);
+    }
+
+    /* tmp2 += (2*loop_check_prime)
+     * to have p = (q * tmp2) + 1 prime
+     */
+    if (primeCheckCount) {
+        if (mp_add_d(&tmp2, 2 * primeCheckCount, &tmp2) != MP_OKAY)
+            ret = MP_ADD_E;
+    }
+
+    /* find a value g for which g^tmp2 != 1 */
+    if (mp_set(&dh->g, 1) != MP_OKAY)
+        ret = MP_ZERO_E;
+
+    if (ret == 0) {
+        do {
+            if (mp_add_d(&dh->g, 1, &dh->g) != MP_OKAY)
+                ret = MP_ADD_E;
+            else if (mp_exptmod(&dh->g, &tmp2, &dh->p, &tmp) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+        } while (ret == 0 && mp_cmp_d(&tmp, 1) == MP_EQ);
+    }
+
+    /* at this point tmp generates a group of order q mod p */
+    mp_exch(&tmp, &dh->g);
+
+    /* clear the parameters if there was an error */
+    if (ret != 0) {
+        mp_clear(&dh->q);
+        mp_clear(&dh->p);
+        mp_clear(&dh->g);
+    }
+
+    ForceZero(buf, bufSz);
+    XFREE(buf, dh->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    mp_clear(&tmp);
+    mp_clear(&tmp2);
+
+    return ret;
+}
+
+
+/* Export raw DH parameters from DhKey structure
+ *
+ * dh   - pointer to initialized DhKey structure
+ * p    - output location for DH (p) parameter
+ * pSz  - [IN/OUT] size of output buffer for p, size of p
+ * q    - output location for DH (q) parameter
+ * qSz  - [IN/OUT] size of output buffer for q, size of q
+ * g    - output location for DH (g) parameter
+ * gSz  - [IN/OUT] size of output buffer for g, size of g
+ *
+ * If p, q, and g pointers are all passed in as NULL, the function
+ * will set pSz, qSz, and gSz to the required output buffer sizes for p,
+ * q, and g. In this case, the function will return LENGTH_ONLY_E.
+ *
+ * returns 0 on success, negative upon failure
+ */
+int wc_DhExportParamsRaw(DhKey* dh, byte* p, word32* pSz,
+                         byte* q, word32* qSz, byte* g, word32* gSz)
+{
+    int ret = 0;
+    word32 pLen = 0, qLen = 0, gLen = 0;
+
+    if (dh == NULL || pSz == NULL || qSz == NULL || gSz == NULL)
+        ret = BAD_FUNC_ARG;
+
+    /* get required output buffer sizes */
+    if (ret == 0) {
+        pLen = mp_unsigned_bin_size(&dh->p);
+        qLen = mp_unsigned_bin_size(&dh->q);
+        gLen = mp_unsigned_bin_size(&dh->g);
+
+        /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */
+        if (p == NULL && q == NULL && g == NULL) {
+            *pSz = pLen;
+            *qSz = qLen;
+            *gSz = gLen;
+            ret = LENGTH_ONLY_E;
+        }
+    }
+
+    if (ret == 0) {
+        if (p == NULL || q == NULL || g == NULL)
+            ret = BAD_FUNC_ARG;
+    }
+
+    /* export p */
+    if (ret == 0) {
+        if (*pSz < pLen) {
+            WOLFSSL_MSG("Output buffer for DH p parameter too small, "
+                        "required size placed into pSz");
+            *pSz = pLen;
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        *pSz = pLen;
+        if (mp_to_unsigned_bin(&dh->p, p) != MP_OKAY)
+            ret = MP_TO_E;
+    }
+
+    /* export q */
+    if (ret == 0) {
+        if (*qSz < qLen) {
+            WOLFSSL_MSG("Output buffer for DH q parameter too small, "
+                        "required size placed into qSz");
+            *qSz = qLen;
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        *qSz = qLen;
+        if (mp_to_unsigned_bin(&dh->q, q) != MP_OKAY)
+            ret = MP_TO_E;
+    }
+
+    /* export g */
+    if (ret == 0) {
+        if (*gSz < gLen) {
+            WOLFSSL_MSG("Output buffer for DH g parameter too small, "
+                        "required size placed into gSz");
+            *gSz = gLen;
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        *gSz = gLen;
+        if (mp_to_unsigned_bin(&dh->g, g) != MP_OKAY)
+            ret = MP_TO_E;
+    }
+
+    return ret;
+}
+
+#endif /* WOLFSSL_KEY_GEN */
 
 #endif /* NO_DH */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/dsa.c

@@ -98 +98 @@
 }
 
+
+/* validate that (L,N) match allowed sizes from FIPS 186-4, Section 4.2.
+ * modLen - represents L, the size of p (prime modulus) in bits
+ * divLen - represents N, the size of q (prime divisor) in bits
+ * return 0 on success, -1 on error */
+static int CheckDsaLN(int modLen, int divLen)
+{
+    int ret = -1;
+
+    switch (modLen) {
+        case 1024:
+            if (divLen == 160)
+                ret = 0;
+            break;
+        case 2048:
+            if (divLen == 224 || divLen == 256)
+                ret = 0;
+            break;
+        case 3072:
+            if (divLen == 256)
+                ret = 0;
+            break;
+        default:
+            break;
+    }
+
+    return ret;
+}
+
+
 #ifdef WOLFSSL_KEY_GEN
 
+/* Create DSA key pair (&dsa->x, &dsa->y)
+ *
+ * Based on NIST FIPS 186-4,
+ * "B.1.1 Key Pair Generation Using Extra Random Bits"
+ *
+ * rng - pointer to initialized WC_RNG structure
+ * dsa - pointer to initialized DsaKey structure, will hold generated key
+ *
+ * return 0 on success, negative on error */
 int wc_MakeDsaKey(WC_RNG *rng, DsaKey *dsa)
 {
-    unsigned char *buf;
-    int qsize, err;
+    byte* cBuf;
+    int qSz, pSz, cSz, err;
+    mp_int tmpQ;
 
     if (rng == NULL || dsa == NULL)
         return BAD_FUNC_ARG;
 
-    qsize = mp_unsigned_bin_size(&dsa->q);
-    if (qsize == 0)
-        return BAD_FUNC_ARG;
-
-    /* allocate ram */
-    buf = (unsigned char *)XMALLOC(qsize, dsa->heap,
-                                   DYNAMIC_TYPE_TMP_BUFFER);
-    if (buf == NULL)
+    qSz = mp_unsigned_bin_size(&dsa->q);
+    pSz = mp_unsigned_bin_size(&dsa->p);
+
+    /* verify (L,N) pair bit lengths */
+    if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0)
+        return BAD_FUNC_ARG;
+
+    /* generate extra 64 bits so that bias from mod function is negligible */
+    cSz = qSz + (64 / WOLFSSL_BIT_SIZE);
+    cBuf = (byte*)XMALLOC(cSz, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (cBuf == NULL) {
         return MEMORY_E;
-
-    if (mp_init(&dsa->x) != MP_OKAY) {
-        XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
-        return MP_INIT_E;
+    }
+
+    if ((err = mp_init_multi(&dsa->x, &dsa->y, &tmpQ, NULL, NULL, NULL))
+                   != MP_OKAY) {
+        XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        return err;
     }
 
     do {
-        /* make a random exponent mod q */
-        err = wc_RNG_GenerateBlock(rng, buf, qsize);
+        /* generate N+64 bits (c) from RBG into &dsa->x, making sure positive.
+         * Hash_DRBG uses SHA-256 which matches maximum
+         * requested_security_strength of (L,N) */
+        err = wc_RNG_GenerateBlock(rng, cBuf, cSz);
         if (err != MP_OKAY) {
             mp_clear(&dsa->x);
-            XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            mp_clear(&dsa->y);
+            mp_clear(&tmpQ);
+            XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return err;
         }
 
-        err = mp_read_unsigned_bin(&dsa->x, buf, qsize);
+        err = mp_read_unsigned_bin(&dsa->x, cBuf, cSz);
         if (err != MP_OKAY) {
             mp_clear(&dsa->x);
-            XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            mp_clear(&dsa->y);
+            mp_clear(&tmpQ);
+            XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return err;
         }
     } while (mp_cmp_d(&dsa->x, 1) != MP_GT);
 
-    XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
-
-    if (mp_init(&dsa->y) != MP_OKAY) {
-        mp_clear(&dsa->x);
-        return MP_INIT_E;
-    }
+    XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER);
+
+    /* tmpQ = q - 1 */
+    if (err == MP_OKAY)
+        err = mp_copy(&dsa->q, &tmpQ);
+
+    if (err == MP_OKAY)
+        err = mp_sub_d(&tmpQ, 1, &tmpQ);
+
+    /* x = c mod (q-1), &dsa->x holds c */
+    if (err == MP_OKAY)
+        err = mp_mod(&dsa->x, &tmpQ, &dsa->x);
+
+    /* x = c mod (q-1) + 1 */
+    if (err == MP_OKAY)
+        err = mp_add_d(&dsa->x, 1, &dsa->x);
 
     /* public key : y = g^x mod p */
+    if (err == MP_OKAY)
     err = mp_exptmod(&dsa->g, &dsa->x, &dsa->p, &dsa->y);
+
+    if (err == MP_OKAY)
+        dsa->type = DSA_PRIVATE;
+
     if (err != MP_OKAY) {
         mp_clear(&dsa->x);
         mp_clear(&dsa->y);
-        return err;
-    }
-
-    dsa->type = DSA_PRIVATE;
-
-    return MP_OKAY;
-}
+    }
+    mp_clear(&tmpQ);
+
+    return err;
+}
+
 
 /* modulus_size in bits */
@@ -185 +250 @@
         default:
             return BAD_FUNC_ARG;
-            break;
     }
 
     /* modulus size in bytes */
-    msize = modulus_size / 8;
+    msize = modulus_size / WOLFSSL_BIT_SIZE;
 
     /* allocate ram */
@@ -273 +337 @@
     /* loop until p is prime */
     while (check_prime == MP_NO) {
-        err = mp_prime_is_prime(&dsa->p, 8, &check_prime);
+        err = mp_prime_is_prime_ex(&dsa->p, 8, &check_prime, rng);
         if (err != MP_OKAY) {
             mp_clear(&dsa->q);
@@ -362 +426 @@
 
 
+static int _DsaImportParamsRaw(DsaKey* dsa, const char* p, const char* q,
+                          const char* g, int trusted, WC_RNG* rng)
+{
+    int err;
+    word32 pSz, qSz;
+
+    if (dsa == NULL || p == NULL || q == NULL || g == NULL)
+        return BAD_FUNC_ARG;
+
+    /* read p */
+    err = mp_read_radix(&dsa->p, p, MP_RADIX_HEX);
+    if (err == MP_OKAY && !trusted) {
+        int isPrime = 1;
+        if (rng == NULL)
+            err = mp_prime_is_prime(&dsa->p, 8, &isPrime);
+        else
+            err = mp_prime_is_prime_ex(&dsa->p, 8, &isPrime, rng);
+
+        if (err == MP_OKAY) {
+            if (!isPrime)
+                err = DH_CHECK_PUB_E;
+        }
+    }
+
+    /* read q */
+    if (err == MP_OKAY)
+        err = mp_read_radix(&dsa->q, q, MP_RADIX_HEX);
+
+    /* read g */
+    if (err == MP_OKAY)
+        err = mp_read_radix(&dsa->g, g, MP_RADIX_HEX);
+
+    /* verify (L,N) pair bit lengths */
+    pSz = mp_unsigned_bin_size(&dsa->p);
+    qSz = mp_unsigned_bin_size(&dsa->q);
+
+    if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) {
+        WOLFSSL_MSG("Invalid DSA p or q parameter size");
+        err = BAD_FUNC_ARG;
+    }
+
+    if (err != MP_OKAY) {
+        mp_clear(&dsa->p);
+        mp_clear(&dsa->q);
+        mp_clear(&dsa->g);
+    }
+
+    return err;
+}
+
+
+/* Import raw DSA parameters into DsaKey structure for use with wc_MakeDsaKey(),
+ * input parameters (p,q,g) should be represented as ASCII hex values.
+ *
+ * dsa  - pointer to initialized DsaKey structure
+ * p    - DSA (p) parameter, ASCII hex string
+ * pSz  - length of p
+ * q    - DSA (q) parameter, ASCII hex string
+ * qSz  - length of q
+ * g    - DSA (g) parameter, ASCII hex string
+ * gSz  - length of g
+ *
+ * returns 0 on success, negative upon failure
+ */
+int wc_DsaImportParamsRaw(DsaKey* dsa, const char* p, const char* q,
+                          const char* g)
+{
+    return _DsaImportParamsRaw(dsa, p, q, g, 1, NULL);
+}
+
+
+/* Import raw DSA parameters into DsaKey structure for use with wc_MakeDsaKey(),
+ * input parameters (p,q,g) should be represented as ASCII hex values. Check
+ * that the p value is probably prime.
+ *
+ * dsa  - pointer to initialized DsaKey structure
+ * p    - DSA (p) parameter, ASCII hex string
+ * pSz  - length of p
+ * q    - DSA (q) parameter, ASCII hex string
+ * qSz  - length of q
+ * g    - DSA (g) parameter, ASCII hex string
+ * gSz  - length of g
+ * trusted - trust that p is OK
+ * rng  - random number generator for the prime test
+ *
+ * returns 0 on success, negative upon failure
+ */
+int wc_DsaImportParamsRawCheck(DsaKey* dsa, const char* p, const char* q,
+                          const char* g, int trusted, WC_RNG* rng)
+{
+    return _DsaImportParamsRaw(dsa, p, q, g, trusted, rng);
+}
+
+
+/* Export raw DSA parameters from DsaKey structure
+ *
+ * dsa  - pointer to initialized DsaKey structure
+ * p    - output location for DSA (p) parameter
+ * pSz  - [IN/OUT] size of output buffer for p, size of p
+ * q    - output location for DSA (q) parameter
+ * qSz  - [IN/OUT] size of output buffer for q, size of q
+ * g    - output location for DSA (g) parameter
+ * gSz  - [IN/OUT] size of output buffer for g, size of g
+ *
+ * If p, q, and g pointers are all passed in as NULL, the function
+ * will set pSz, qSz, and gSz to the required output buffer sizes for p,
+ * q, and g. In this case, the function will return LENGTH_ONLY_E.
+ *
+ * returns 0 on success, negative upon failure
+ */
+int wc_DsaExportParamsRaw(DsaKey* dsa, byte* p, word32* pSz,
+                          byte* q, word32* qSz, byte* g, word32* gSz)
+{
+    int err;
+    word32 pLen, qLen, gLen;
+
+    if (dsa == NULL || pSz == NULL || qSz == NULL || gSz == NULL)
+        return BAD_FUNC_ARG;
+
+    /* get required output buffer sizes */
+    pLen = mp_unsigned_bin_size(&dsa->p);
+    qLen = mp_unsigned_bin_size(&dsa->q);
+    gLen = mp_unsigned_bin_size(&dsa->g);
+
+    /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */
+    if (p == NULL && q == NULL && g == NULL) {
+        *pSz = pLen;
+        *qSz = qLen;
+        *gSz = gLen;
+        return LENGTH_ONLY_E;
+    }
+
+    if (p == NULL || q == NULL || g == NULL)
+        return BAD_FUNC_ARG;
+
+    /* export p */
+    if (*pSz < pLen) {
+        WOLFSSL_MSG("Output buffer for DSA p parameter too small, "
+                    "required size placed into pSz");
+        *pSz = pLen;
+        return BUFFER_E;
+    }
+    *pSz = pLen;
+    err = mp_to_unsigned_bin(&dsa->p, p);
+
+    /* export q */
+    if (err == MP_OKAY) {
+        if (*qSz < qLen) {
+            WOLFSSL_MSG("Output buffer for DSA q parameter too small, "
+                        "required size placed into qSz");
+            *qSz = qLen;
+            return BUFFER_E;
+        }
+        *qSz = qLen;
+        err = mp_to_unsigned_bin(&dsa->q, q);
+    }
+
+    /* export g */
+    if (err == MP_OKAY) {
+        if (*gSz < gLen) {
+            WOLFSSL_MSG("Output buffer for DSA g parameter too small, "
+                        "required size placed into gSz");
+            *gSz = gLen;
+            return BUFFER_E;
+        }
+        *gSz = gLen;
+        err = mp_to_unsigned_bin(&dsa->g, g);
+    }
+
+    return err;
+}
+
+
+/* Export raw DSA key (x, y) from DsaKey structure
+ *
+ * dsa  - pointer to initialized DsaKey structure
+ * x    - output location for private key
+ * xSz  - [IN/OUT] size of output buffer for x, size of x
+ * y    - output location for public key
+ * ySz  - [IN/OUT] size of output buffer for y, size of y
+ *
+ * If x and y pointers are all passed in as NULL, the function
+ * will set xSz and ySz to the required output buffer sizes for x
+ * and y. In this case, the function will return LENGTH_ONLY_E.
+ *
+ * returns 0 on success, negative upon failure
+ */
+int wc_DsaExportKeyRaw(DsaKey* dsa, byte* x, word32* xSz, byte* y, word32* ySz)
+{
+    int err;
+    word32 xLen, yLen;
+
+    if (dsa == NULL || xSz == NULL || ySz == NULL)
+        return BAD_FUNC_ARG;
+
+    /* get required output buffer sizes */
+    xLen = mp_unsigned_bin_size(&dsa->x);
+    yLen = mp_unsigned_bin_size(&dsa->y);
+
+    /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */
+    if (x == NULL && y == NULL) {
+        *xSz = xLen;
+        *ySz = yLen;
+        return LENGTH_ONLY_E;
+    }
+
+    if (x == NULL || y == NULL)
+        return BAD_FUNC_ARG;
+
+    /* export x */
+    if (*xSz < xLen) {
+        WOLFSSL_MSG("Output buffer for DSA private key (x) too small, "
+                    "required size placed into xSz");
+        *xSz = xLen;
+        return BUFFER_E;
+    }
+    *xSz = xLen;
+    err = mp_to_unsigned_bin(&dsa->x, x);
+
+    /* export y */
+    if (err == MP_OKAY) {
+        if (*ySz < yLen) {
+            WOLFSSL_MSG("Output buffer to DSA public key (y) too small, "
+                        "required size placed into ySz");
+            *ySz = yLen;
+            return BUFFER_E;
+        }
+        *ySz = yLen;
+        err = mp_to_unsigned_bin(&dsa->y, y);
+    }
+
+    return err;
+}
+
+
 int wc_DsaSign(const byte* digest, byte* out, DsaKey* key, WC_RNG* rng)
 {

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/ecc.c

@@ -94 +94 @@
 
 
+#if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+        #ifdef USE_WINDOWS_API
+                #pragma code_seg(".fipsA$f")
+                #pragma const_seg(".fipsB$f")
+        #endif
+#endif
+
 #include <wolfssl/wolfcrypt/ecc.h>
 #include <wolfssl/wolfcrypt/asn.h>
@@ -113 +123 @@
 #endif
 
+#ifdef WOLF_CRYPTO_DEV
+    #include <wolfssl/wolfcrypt/cryptodev.h>
+#endif
+
 #ifdef NO_INLINE
     #include <wolfssl/wolfcrypt/misc.h>
@@ -124 +138 @@
 #endif
 
-#ifdef USE_FAST_MATH
+#ifdef WOLFSSL_SP_MATH
+    #define GEN_MEM_ERR MP_MEM
+#elif defined(USE_FAST_MATH)
     #define GEN_MEM_ERR FP_MEM
 #else
@@ -186 +202 @@
 #endif
 
-
 /* The encoded OID's for ECC curves */
 #ifdef ECC112
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp112r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,6
+            #define CODED_SECP112R1    {1,3,132,0,6}
+            #define CODED_SECP112R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x06
+            #define CODED_SECP112R1    {0x2B,0x81,0x04,0x00,0x06}
+            #define CODED_SECP112R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp112r1[] = CODED_SECP112R1;
+        #else
+            #define ecc_oid_secp112r1 CODED_SECP112R1
+        #endif
+        #define ecc_oid_secp112r1_sz CODED_SECP112R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_SECPR2
-        static const ecc_oid_t ecc_oid_secp112r2[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,7
+            #define CODED_SECP112R2    {1,3,132,0,7}
+            #define CODED_SECP112R2_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x07
+            #define CODED_SECP112R2    {0x2B,0x81,0x04,0x00,0x07}
+            #define CODED_SECP112R2_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp112r2[] = CODED_SECP112R2;
+        #else
+            #define ecc_oid_secp112r2 CODED_SECP112R2
+        #endif
+        #define ecc_oid_secp112r2_sz CODED_SECP112R2_SZ
     #endif /* HAVE_ECC_SECPR2 */
 #endif /* ECC112 */
 #ifdef ECC128
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp128r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,28
+            #define CODED_SECP128R1    {1,3,132,0,28}
+            #define CODED_SECP128R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x1C
+            #define CODED_SECP128R1    {0x2B,0x81,0x04,0x00,0x1C}
+            #define CODED_SECP128R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp128r1[] = CODED_SECP128R1;
+        #else
+            #define ecc_oid_secp128r1 CODED_SECP128R1
+        #endif
+        #define ecc_oid_secp128r1_sz CODED_SECP128R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_SECPR2
-        static const ecc_oid_t ecc_oid_secp128r2[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,29
+            #define CODED_SECP128R2    {1,3,132,0,29}
+            #define CODED_SECP128R2_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x1D
+            #define CODED_SECP128R2    {0x2B,0x81,0x04,0x00,0x1D}
+            #define CODED_SECP128R2_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp128r2[] = CODED_SECP128R2;
+        #else
+            #define ecc_oid_secp128r2 CODED_SECP128R2
+        #endif
+        #define ecc_oid_secp128r2_sz CODED_SECP128R2_SZ
     #endif /* HAVE_ECC_SECPR2 */
 #endif /* ECC128 */
 #ifdef ECC160
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp160r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,8
+            #define CODED_SECP160R1    {1,3,132,0,8}
+            #define CODED_SECP160R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x08
+            #define CODED_SECP160R1    {0x2B,0x81,0x04,0x00,0x08}
+            #define CODED_SECP160R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp160r1[] = CODED_SECP160R1;
+        #else
+            #define ecc_oid_secp160r1 CODED_SECP160R1
+        #endif
+        #define ecc_oid_secp160r1_sz CODED_SECP160R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_SECPR2
-        static const ecc_oid_t ecc_oid_secp160r2[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,30
+            #define CODED_SECP160R2    {1,3,132,0,30}
+            #define CODED_SECP160R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x1E
+            #define CODED_SECP160R2    {0x2B,0x81,0x04,0x00,0x1E}
+            #define CODED_SECP160R2_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp160r2[] = CODED_SECP160R2;
+        #else
+            #define ecc_oid_secp160r2 CODED_SECP160R2
+        #endif
+        #define ecc_oid_secp160r2_sz CODED_SECP160R2_SZ
     #endif /* HAVE_ECC_SECPR2 */
     #ifdef HAVE_ECC_KOBLITZ
-        static const ecc_oid_t ecc_oid_secp160k1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,9
+            #define CODED_SECP160K1    {1,3,132,0,9}
+            #define CODED_SECP160K1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x09
+            #define CODED_SECP160K1    {0x2B,0x81,0x04,0x00,0x09}
+            #define CODED_SECP160K1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp160k1[] = CODED_SECP160K1;
+        #else
+            #define ecc_oid_secp160k1 CODED_SECP160K1
+        #endif
+        #define ecc_oid_secp160k1_sz CODED_SECP160K1_SZ
     #endif /* HAVE_ECC_KOBLITZ */
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp160r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,1
+            #define CODED_BRAINPOOLP160R1    {1,3,36,3,3,2,8,1,1,1}
+            #define CODED_BRAINPOOLP160R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x01
+            #define CODED_BRAINPOOLP160R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x01}
+            #define CODED_BRAINPOOLP160R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp160r1[] = CODED_BRAINPOOLP160R1;
+        #else
+            #define ecc_oid_brainpoolp160r1 CODED_BRAINPOOLP160R1
+        #endif
+        #define ecc_oid_brainpoolp160r1_sz CODED_BRAINPOOLP160R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC160 */
 #ifdef ECC192
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp192r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,1
+            #define CODED_SECP192R1    {1,2,840,10045,3,1,1}
+            #define CODED_SECP192R1_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x01
+            #define CODED_SECP192R1    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x01}
+            #define CODED_SECP192R1_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp192r1[] = CODED_SECP192R1;
+        #else
+            #define ecc_oid_secp192r1 CODED_SECP192R1
+        #endif
+        #define ecc_oid_secp192r1_sz CODED_SECP192R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_SECPR2
-        static const ecc_oid_t ecc_oid_prime192v2[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,2
+            #define CODED_PRIME192V2    {1,2,840,10045,3,1,2}
+            #define CODED_PRIME192V2_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x02
+            #define CODED_PRIME192V2    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x02}
+            #define CODED_PRIME192V2_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_prime192v2[] = CODED_PRIME192V2;
+        #else
+            #define ecc_oid_prime192v2 CODED_PRIME192V2
+        #endif
+        #define ecc_oid_prime192v2_sz CODED_PRIME192V2_SZ
     #endif /* HAVE_ECC_SECPR2 */
     #ifdef HAVE_ECC_SECPR3
-        static const ecc_oid_t ecc_oid_prime192v3[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,3
+            #define CODED_PRIME192V3    {1,2,840,10045,3,1,3}
+            #define CODED_PRIME192V3_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x03
+            #define CODED_PRIME192V3    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x03}
+            #define CODED_PRIME192V3_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_prime192v3[] = CODED_PRIME192V3;
+        #else
+            #define ecc_oid_prime192v3 CODED_PRIME192V3
+        #endif
+        #define ecc_oid_prime192v3_sz CODED_PRIME192V3_SZ
     #endif /* HAVE_ECC_SECPR3 */
     #ifdef HAVE_ECC_KOBLITZ
-        static const ecc_oid_t ecc_oid_secp192k1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,31
+            #define CODED_SECP192K1    {1,3,132,0,31}
+            #define CODED_SECP192K1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x1F
+            #define CODED_SECP192K1    {0x2B,0x81,0x04,0x00,0x1F}
+            #define CODED_SECP192K1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp192k1[] = CODED_SECP192K1;
+        #else
+            #define ecc_oid_secp192k1 CODED_SECP192K1
+        #endif
+        #define ecc_oid_secp192k1_sz CODED_SECP192K1_SZ
     #endif /* HAVE_ECC_KOBLITZ */
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp192r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,3
+            #define CODED_BRAINPOOLP192R1    {1,3,36,3,3,2,8,1,1,3}
+            #define CODED_BRAINPOOLP192R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x03
+            #define CODED_BRAINPOOLP192R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x03}
+            #define CODED_BRAINPOOLP192R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp192r1[] = CODED_BRAINPOOLP192R1;
+        #else
+            #define ecc_oid_brainpoolp192r1 CODED_BRAINPOOLP192R1
+        #endif
+        #define ecc_oid_brainpoolp192r1_sz CODED_BRAINPOOLP192R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC192 */
 #ifdef ECC224
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp224r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,33
+            #define CODED_SECP224R1    {1,3,132,0,33}
+            #define CODED_SECP224R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x21
+            #define CODED_SECP224R1    {0x2B,0x81,0x04,0x00,0x21}
+            #define CODED_SECP224R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp224r1[] = CODED_SECP224R1;
+        #else
+            #define ecc_oid_secp224r1 CODED_SECP224R1
+        #endif
+        #define ecc_oid_secp224r1_sz CODED_SECP224R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_KOBLITZ
-        static const ecc_oid_t ecc_oid_secp224k1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,32
+            #define CODED_SECP224K1    {1,3,132,0,32}
+            #define CODED_SECP224K1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x20
+            #define CODED_SECP224K1    {0x2B,0x81,0x04,0x00,0x20}
+            #define CODED_SECP224K1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp224k1[] = CODED_SECP224K1;
+        #else
+            #define ecc_oid_secp224k1 CODED_SECP224K1
+        #endif
+        #define ecc_oid_secp224k1_sz CODED_SECP224K1_SZ
     #endif /* HAVE_ECC_KOBLITZ */
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp224r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,5
+            #define CODED_BRAINPOOLP224R1    {1,3,36,3,3,2,8,1,1,5}
+            #define CODED_BRAINPOOLP224R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x05
+            #define CODED_BRAINPOOLP224R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x05}
+            #define CODED_BRAINPOOLP224R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp224r1[] = CODED_BRAINPOOLP224R1;
+        #else
+            #define ecc_oid_brainpoolp224r1 CODED_BRAINPOOLP224R1
+        #endif
+        #define ecc_oid_brainpoolp224r1_sz CODED_BRAINPOOLP224R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC224 */
 #ifdef ECC239
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_prime239v1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,4
+            #define CODED_PRIME239V1    {1,2,840,10045,3,1,4}
+            #define CODED_PRIME239V1_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x04
+            #define CODED_PRIME239V1    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x04}
+            #define CODED_PRIME239V1_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_prime239v1[] = CODED_PRIME239V1;
+        #else
+            #define ecc_oid_prime239v1 CODED_PRIME239V1
+        #endif
+        #define ecc_oid_prime239v1_sz CODED_PRIME239V1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_SECPR2
-        static const ecc_oid_t ecc_oid_prime239v2[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,5
+            #define CODED_PRIME239V2    {1,2,840,10045,3,1,5}
+            #define CODED_PRIME239V2_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x05
+            #define CODED_PRIME239V2    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x05}
+            #define CODED_PRIME239V2_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_prime239v2[] = CODED_PRIME239V2;
+        #else
+            #define ecc_oid_prime239v2 CODED_PRIME239V2
+        #endif
+        #define ecc_oid_prime239v2_sz CODED_PRIME239V2_SZ
     #endif /* HAVE_ECC_SECPR2 */
     #ifdef HAVE_ECC_SECPR3
-        static const ecc_oid_t ecc_oid_prime239v3[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,6
+            #define CODED_PRIME239V3    {1,2,840,10045,3,1,6}
+            #define CODED_PRIME239V3_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x06
+            #define CODED_PRIME239V3    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x06}
+            #define CODED_PRIME239V3_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_prime239v3[] = CODED_PRIME239V3;
+        #else
+            #define ecc_oid_prime239v3 CODED_PRIME239V3
+        #endif
+        #define ecc_oid_prime239v3_sz CODED_PRIME239V3_SZ
     #endif /* HAVE_ECC_SECPR3 */
 #endif /* ECC239 */
 #ifdef ECC256
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp256r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,2,840,10045,3,1,7
+            #define CODED_SECP256R1    {1,2,840,10045,3,1,7}
+            #define CODED_SECP256R1_SZ 7
         #else
-            0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x07
+            #define CODED_SECP256R1    {0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x07}
+            #define CODED_SECP256R1_SZ 8
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp256r1[] = CODED_SECP256R1;
+        #else
+            #define ecc_oid_secp256r1 CODED_SECP256R1
+        #endif
+        #define ecc_oid_secp256r1_sz CODED_SECP256R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_KOBLITZ
-        static const ecc_oid_t ecc_oid_secp256k1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,10
+            #define CODED_SECP256K1    {1,3,132,0,10}
+            #define CODED_SECP256K1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x0A
+            #define CODED_SECP256K1    {0x2B,0x81,0x04,0x00,0x0A}
+            #define CODED_SECP256K1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp256k1[] = CODED_SECP256K1;
+        #else
+            #define ecc_oid_secp256k1 CODED_SECP256K1
+        #endif
+        #define ecc_oid_secp256k1_sz CODED_SECP256K1_SZ
     #endif /* HAVE_ECC_KOBLITZ */
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp256r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,7
+            #define CODED_BRAINPOOLP256R1    {1,3,36,3,3,2,8,1,1,7}
+            #define CODED_BRAINPOOLP256R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x07
+            #define CODED_BRAINPOOLP256R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x07}
+            #define CODED_BRAINPOOLP256R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp256r1[] = CODED_BRAINPOOLP256R1;
+        #else
+            #define ecc_oid_brainpoolp256r1 CODED_BRAINPOOLP256R1
+        #endif
+        #define ecc_oid_brainpoolp256r1_sz CODED_BRAINPOOLP256R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC256 */
 #ifdef ECC320
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp320r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,9
+            #define CODED_BRAINPOOLP320R1    {1,3,36,3,3,2,8,1,1,9}
+            #define CODED_BRAINPOOLP320R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x09
+            #define CODED_BRAINPOOLP320R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x09}
+            #define CODED_BRAINPOOLP320R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp320r1[] = CODED_BRAINPOOLP320R1;
+        #else
+            #define ecc_oid_brainpoolp320r1 CODED_BRAINPOOLP320R1
+        #endif
+        #define ecc_oid_brainpoolp320r1_sz CODED_BRAINPOOLP320R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC320 */
 #ifdef ECC384
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp384r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,34
+            #define CODED_SECP384R1    {1,3,132,0,34}
+            #define CODED_SECP384R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x22
+            #define CODED_SECP384R1    {0x2B,0x81,0x04,0x00,0x22}
+            #define CODED_SECP384R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp384r1[] = CODED_SECP384R1;
+            #define CODED_SECP384R1_OID ecc_oid_secp384r1
+        #else
+                        #define ecc_oid_secp384r1 CODED_SECP384R1
+        #endif
+        #define ecc_oid_secp384r1_sz CODED_SECP384R1_SZ
     #endif /* !NO_ECC_SECP */
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp384r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,11
+            #define CODED_BRAINPOOLP384R1    {1,3,36,3,3,2,8,1,1,11}
+            #define CODED_BRAINPOOLP384R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x0B
+            #define CODED_BRAINPOOLP384R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x0B}
+            #define CODED_BRAINPOOLP384R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp384r1[] = CODED_BRAINPOOLP384R1;
+        #else
+            #define ecc_oid_brainpoolp384r1 CODED_BRAINPOOLP384R1
+        #endif
+        #define ecc_oid_brainpoolp384r1_sz CODED_BRAINPOOLP384R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC384 */
 #ifdef ECC512
     #ifdef HAVE_ECC_BRAINPOOL
-        static const ecc_oid_t ecc_oid_brainpoolp512r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,36,3,3,2,8,1,1,13
+            #define CODED_BRAINPOOLP512R1    {1,3,36,3,3,2,8,1,1,13}
+            #define CODED_BRAINPOOLP512R1_SZ 10
         #else
-            0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x0D
+            #define CODED_BRAINPOOLP512R1    {0x2B,0x24,0x03,0x03,0x02,0x08,0x01,0x01,0x0D}
+            #define CODED_BRAINPOOLP512R1_SZ 9
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_brainpoolp512r1[] = CODED_BRAINPOOLP512R1;
+        #else
+            #define ecc_oid_brainpoolp512r1 CODED_BRAINPOOLP512R1
+        #endif
+        #define ecc_oid_brainpoolp512r1_sz CODED_BRAINPOOLP512R1_SZ
     #endif /* HAVE_ECC_BRAINPOOL */
 #endif /* ECC512 */
 #ifdef ECC521
     #ifndef NO_ECC_SECP
-        static const ecc_oid_t ecc_oid_secp521r1[] = {
         #ifdef HAVE_OID_ENCODING
-            1,3,132,0,35
+            #define CODED_SECP521R1     {1,3,132,0,35}
+            #define CODED_SECP521R1_SZ 5
         #else
-            0x2B,0x81,0x04,0x00,0x23
+            #define CODED_SECP521R1     {0x2B,0x81,0x04,0x00,0x23}
+            #define CODED_SECP521R1_SZ 5
         #endif
-        };
+        #ifndef USE_WINDOWS_API
+            static const ecc_oid_t ecc_oid_secp521r1[] = CODED_SECP521R1;
+        #else
+            #define ecc_oid_secp521r1 CODED_SECP521R1
+        #endif
+        #define ecc_oid_secp521r1_sz CODED_SECP521R1_SZ
     #endif /* !NO_ECC_SECP */
 #endif /* ECC521 */
@@ -472 +650 @@
         "A89CE5AF8724C0A23E0E0FF77500", /* Gy         */
         ecc_oid_secp112r1,              /* oid/oidSz  */
-        sizeof(ecc_oid_secp112r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp112r1_sz,
         ECC_SECP112R1_OID,              /* oid sum    */
         1,                              /* cofactor   */
@@ -489 +667 @@
         "ADCD46F5882E3747DEF36E956E97", /* Gy         */
         ecc_oid_secp112r2,              /* oid/oidSz  */
-        sizeof(ecc_oid_secp112r2) / sizeof(ecc_oid_t),
+        ecc_oid_secp112r2_sz,
         ECC_SECP112R2_OID,              /* oid sum    */
         4,                              /* cofactor   */
@@ -508 +686 @@
         "CF5AC8395BAFEB13C02DA292DDED7A83", /* Gy         */
         ecc_oid_secp128r1,                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp128r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp128r1_sz,
         ECC_SECP128R1_OID,                  /* oid sum    */
         1,                                  /* cofactor   */
@@ -525 +703 @@
         "27B6916A894D3AEE7106FE805FC34B44", /* Gy         */
         ecc_oid_secp128r2,                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp128r2) / sizeof(ecc_oid_t),
+        ecc_oid_secp128r2_sz,
         ECC_SECP128R2_OID,                  /* oid sum    */
         4,                                  /* cofactor   */
@@ -544 +722 @@
         "23A628553168947D59DCC912042351377AC5FB32", /* Gy         */
         ecc_oid_secp160r1,                          /* oid/oidSz  */
-        sizeof(ecc_oid_secp160r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp160r1_sz,
         ECC_SECP160R1_OID,                          /* oid sum    */
         1,                                          /* cofactor   */
@@ -561 +739 @@
         "FEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E", /* Gy         */
         ecc_oid_secp160r2,                          /* oid/oidSz  */
-        sizeof(ecc_oid_secp160r2) / sizeof(ecc_oid_t),
+        ecc_oid_secp160r2_sz,
         ECC_SECP160R2_OID,                          /* oid sum    */
         1,                                          /* cofactor   */
@@ -578 +756 @@
         "938CF935318FDCED6BC28286531733C3F03C4FEE", /* Gy         */
         ecc_oid_secp160k1,                          /* oid/oidSz  */
-        sizeof(ecc_oid_secp160k1) / sizeof(ecc_oid_t),
+        ecc_oid_secp160k1_sz,
         ECC_SECP160K1_OID,                          /* oid sum    */
         1,                                          /* cofactor   */
@@ -595 +773 @@
         "1667CB477A1A8EC338F94741669C976316DA6321", /* Gy         */
         ecc_oid_brainpoolp160r1,                    /* oid/oidSz  */
-        sizeof(ecc_oid_brainpoolp160r1) / sizeof(ecc_oid_t),
+        ecc_oid_brainpoolp160r1_sz,
         ECC_BRAINPOOLP160R1_OID,                    /* oid sum    */
         1,                                          /* cofactor   */
@@ -614 +792 @@
         "7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",  /* Gy         */
         ecc_oid_secp192r1,                                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp192r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp192r1_sz,
         ECC_SECP192R1_OID,                                  /* oid sum    */
         1,                                                  /* cofactor   */
@@ -631 +809 @@
         "6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15", /* Gy         */
         ecc_oid_prime192v2,                                 /* oid/oidSz  */
-        sizeof(ecc_oid_prime192v2) / sizeof(ecc_oid_t),
+        ecc_oid_prime192v2_sz,
         ECC_PRIME192V2_OID,                                 /* oid sum    */
         1,                                                  /* cofactor   */
@@ -648 +826 @@
         "38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0", /* Gy         */
         ecc_oid_prime192v3,                                 /* oid/oidSz  */
-        sizeof(ecc_oid_prime192v3) / sizeof(ecc_oid_t),
+        ecc_oid_prime192v3_sz,
         ECC_PRIME192V3_OID,                                 /* oid sum    */
         1,                                                  /* cofactor   */
@@ -665 +843 @@
         "9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", /* Gy         */
         ecc_oid_secp192k1,                                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp192k1) / sizeof(ecc_oid_t),
+        ecc_oid_secp192k1_sz,
         ECC_SECP192K1_OID,                                  /* oid sum    */
         1,                                                  /* cofactor   */
@@ -682 +860 @@
         "14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F", /* Gy         */
         ecc_oid_brainpoolp192r1,                            /* oid/oidSz  */
-        sizeof(ecc_oid_brainpoolp192r1) / sizeof(ecc_oid_t),
+        ecc_oid_brainpoolp192r1_sz,
         ECC_BRAINPOOLP192R1_OID,                            /* oid sum    */
         1,                                                  /* cofactor   */
@@ -701 +879 @@
         "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", /* Gy         */
         ecc_oid_secp224r1,                                          /* oid/oidSz  */
-        sizeof(ecc_oid_secp224r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp224r1_sz,
         ECC_SECP224R1_OID,                                          /* oid sum    */
         1,                                                          /* cofactor   */
@@ -718 +896 @@
         "7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", /* Gy         */
         ecc_oid_secp224k1,                                          /* oid/oidSz  */
-        sizeof(ecc_oid_secp224k1) / sizeof(ecc_oid_t),
+        ecc_oid_secp224k1_sz,
         ECC_SECP224K1_OID,                                          /* oid sum    */
         1,                                                          /* cofactor   */
@@ -735 +913 @@
         "58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD", /* Gy         */
         ecc_oid_brainpoolp224r1,                                    /* oid/oidSz  */
-        sizeof(ecc_oid_brainpoolp224r1) / sizeof(ecc_oid_t),
+        ecc_oid_brainpoolp224r1_sz,
         ECC_BRAINPOOLP224R1_OID,                                    /* oid sum    */
         1,                                                          /* cofactor   */
@@ -754 +932 @@
         "7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE", /* Gy         */
         ecc_oid_prime239v1,                                             /* oid/oidSz  */
-        sizeof(ecc_oid_prime239v1) / sizeof(ecc_oid_t),
+        ecc_oid_prime239v1_sz,
         ECC_PRIME239V1_OID,                                             /* oid sum    */
         1,                                                              /* cofactor   */
@@ -771 +949 @@
         "5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA", /* Gy         */
         ecc_oid_prime239v2,                                             /* oid/oidSz  */
-        sizeof(ecc_oid_prime239v2) / sizeof(ecc_oid_t),
+        ecc_oid_prime239v2_sz,
         ECC_PRIME239V2_OID,                                             /* oid sum    */
         1,                                                              /* cofactor   */
@@ -788 +966 @@
         "1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3", /* Gy         */
         ecc_oid_prime239v3,                                             /* oid/oidSz  */
-        sizeof(ecc_oid_prime239v3) / sizeof(ecc_oid_t),
+        ecc_oid_prime239v3_sz,
         ECC_PRIME239V3_OID,                                             /* oid sum    */
         1,                                                              /* cofactor   */
@@ -807 +985 @@
         "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", /* Gy         */
         ecc_oid_secp256r1,                                                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp256r1) / sizeof(ecc_oid_t),
+        ecc_oid_secp256r1_sz,
         ECC_SECP256R1_OID,                                                  /* oid sum    */
         1,                                                                  /* cofactor   */
@@ -824 +1002 @@
         "483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", /* Gy         */
         ecc_oid_secp256k1,                                                  /* oid/oidSz  */
-        sizeof(ecc_oid_secp256k1) / sizeof(ecc_oid_t),
+        ecc_oid_secp256k1_sz,
         ECC_SECP256K1_OID,                                                  /* oid sum    */
         1,                                                                  /* cofactor   */
@@ -841 +1019 @@
         "547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", /* Gy         */
         ecc_oid_brainpoolp256r1,                                            /* oid/oidSz  */
-        sizeof(ecc_oid_brainpoolp256r1) / sizeof(ecc_oid_t),
+        ecc_oid_brainpoolp256r1_sz,
         ECC_BRAINPOOLP256R1_OID,                                            /* oid sum    */
         1,                                                                  /* cofactor   */
@@ -859 +1037 @@
         "43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611", /* Gx         */
         "14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1", /* Gy         */
-        ecc_oid_brainpoolp320r1, sizeof(ecc_oid_brainpoolp320r1) / sizeof(ecc_oid_t),       /* oid/oidSz  */
+        ecc_oid_brainpoolp320r1, ecc_oid_brainpoolp320r1_sz,                                /* oid/oidSz  */
         ECC_BRAINPOOLP320R1_OID,                                                            /* oid sum    */
         1,                                                                                  /* cofactor   */
@@ -877 +1055 @@
         "AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", /* Gx         */
         "3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F", /* Gy         */
-        ecc_oid_secp384r1, sizeof(ecc_oid_secp384r1) / sizeof(ecc_oid_t),                                   /* oid/oidSz  */
+        ecc_oid_secp384r1, ecc_oid_secp384r1_sz,                                                            /* oid/oidSz  */
         ECC_SECP384R1_OID,                                                                                  /* oid sum    */
         1,                                                                                                  /* cofactor   */
@@ -893 +1071 @@
         "1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", /* Gx         */
         "8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", /* Gy         */
-        ecc_oid_brainpoolp384r1, sizeof(ecc_oid_brainpoolp384r1) / sizeof(ecc_oid_t),                       /* oid/oidSz  */
+        ecc_oid_brainpoolp384r1, ecc_oid_brainpoolp384r1_sz,                                                /* oid/oidSz  */
         ECC_BRAINPOOLP384R1_OID,                                                                            /* oid sum    */
         1,                                                                                                  /* cofactor   */
@@ -911 +1089 @@
         "81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", /* Gx         */
         "7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", /* Gy         */
-        ecc_oid_brainpoolp512r1, sizeof(ecc_oid_brainpoolp512r1) / sizeof(ecc_oid_t),                                                       /* oid/oidSz  */
+        ecc_oid_brainpoolp512r1, ecc_oid_brainpoolp512r1_sz,                                                                                /* oid/oidSz  */
         ECC_BRAINPOOLP512R1_OID,                                                                                                            /* oid sum    */
         1,                                                                                                                                  /* cofactor   */
@@ -929 +1107 @@
         "C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",  /* Gx         */
         "11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650", /* Gy         */
-        ecc_oid_secp521r1, sizeof(ecc_oid_secp521r1) / sizeof(ecc_oid_t),                                                                      /* oid/oidSz  */
+        ecc_oid_secp521r1, ecc_oid_secp521r1_sz,                                                                                               /* oid/oidSz  */
         ECC_SECP521R1_OID,                                                                                                                     /* oid sum    */
         1,                                                                                                                                     /* cofactor   */
@@ -940 +1118 @@
         1, /* non-zero */
         ECC_CURVE_CUSTOM,
-        NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-        NULL, 0, 0, 0
+        #ifndef USE_WINDOWS_API
+            NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+        #else
+            {0},{0},{0},{0},{0},{0},{0},{0},
+        #endif
+        0, 0, 0
     },
 #endif
 {
-   0, -1,
-   NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-   NULL, 0, 0, 0
+        0,
+        ECC_CURVE_INVALID,
+        #ifndef USE_WINDOWS_API
+            NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+        #else
+            {0},{0},{0},{0},{0},{0},{0},{0},
+        #endif
+        0, 0, 0
 }
 };
 #define ECC_SET_COUNT   (sizeof(ecc_sets)/sizeof(ecc_set_type))
+
 
 #ifdef HAVE_OID_ENCODING
@@ -970 +1158 @@
 #else
 
+#if defined(WOLFSSL_VALIDATE_ECC_KEYGEN) || !defined(WOLFSSL_SP_MATH)
 static int ecc_check_pubkey_order(ecc_key* key, ecc_point* pubkey, mp_int* a,
         mp_int* prime, mp_int* order);
-#ifdef ECC_SHAMIR
-static int ecc_mul2add(ecc_point* A, mp_int* kA, ecc_point* B, mp_int* kB,
-                       ecc_point* C, mp_int* a, mp_int* modulus, void* heap);
 #endif
 
@@ -1038 +1224 @@
     #endif
 
-    #define DECLARE_CURVE_SPECS(intcount) ecc_curve_spec* curve = NULL;
+    #define DECLARE_CURVE_SPECS(curve, intcount) ecc_curve_spec* curve = NULL
+    #define ALLOC_CURVE_SPECS(intcount)
+    #define FREE_CURVE_SPECS()
+#elif defined(WOLFSSL_SMALL_STACK)
+    #define DECLARE_CURVE_SPECS(curve, intcount)                        \
+        mp_int* spec_ints = NULL;                                       \
+        ecc_curve_spec curve_lcl;                                       \
+        ecc_curve_spec* curve = &curve_lcl;                             \
+        XMEMSET(curve, 0, sizeof(ecc_curve_spec));                      \
+        curve->spec_count = intcount
+
+    #define ALLOC_CURVE_SPECS(intcount)                                 \
+        spec_ints = (mp_int*)XMALLOC(sizeof(mp_int) * (intcount), NULL, \
+                            DYNAMIC_TYPE_ECC);                          \
+        if (spec_ints == NULL)                                          \
+            return MEMORY_E;                                            \
+        curve->spec_ints = spec_ints
+    #define FREE_CURVE_SPECS()                                          \
+        XFREE(spec_ints, NULL, DYNAMIC_TYPE_ECC)
 #else
-    #define DECLARE_CURVE_SPECS(intcount) \
+    #define DECLARE_CURVE_SPECS(curve, intcount) \
         mp_int spec_ints[(intcount)]; \
         ecc_curve_spec curve_lcl; \
@@ -1046 +1250 @@
         XMEMSET(curve, 0, sizeof(ecc_curve_spec)); \
         curve->spec_ints = spec_ints; \
-        curve->spec_count = intcount;
+        curve->spec_count = intcount
+    #define ALLOC_CURVE_SPECS(intcount)
+    #define FREE_CURVE_SPECS()
 #endif /* ECC_CACHE_CURVE */
 
@@ -1100 +1306 @@
         curve->load_mask |= mask;
 
-        err = mp_read_radix(*dst, src, 16);
+        err = mp_read_radix(*dst, src, MP_RADIX_HEX);
 
     #ifdef HAVE_WOLF_BIGINT
@@ -1169 +1375 @@
 
     /* determine items to load */
-    load_items = (~curve->load_mask & load_mask);
+    load_items = (((byte)~(word32)curve->load_mask) & load_mask);
     curve->load_mask |= load_items;
 
@@ -1293 +1499 @@
 }
 
+
+#ifdef ALT_ECC_SIZE
+static void alt_fp_init(mp_int* a)
+{
+    a->size = FP_SIZE_ECC;
+    mp_zero(a);
+}
+#endif /* ALT_ECC_SIZE */
+
+
 #ifndef WOLFSSL_ATECC508A
+
+#if !defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_PUBLIC_ECC_ADD_DBL)
 
 /**
@@ -1308 +1526 @@
                              mp_int* a, mp_int* modulus, mp_digit mp)
 {
-   mp_int t1, t2;
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int* t1 = NULL;
+   mp_int* t2 = NULL;
 #ifdef ALT_ECC_SIZE
-   mp_int rx, ry, rz;
+   mp_int* rx = NULL;
+   mp_int* ry = NULL;
+   mp_int* rz = NULL;
+#endif
+#else
+   mp_int  t1[1], t2[1];
+#ifdef ALT_ECC_SIZE
+   mp_int  rx[1], ry[1], rz[1];
+#endif
 #endif
    mp_int *x, *y, *z;
@@ -1326 +1555 @@
    }
 
-   if ((err = mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (R->key != NULL) {
+       t1 = R->key->t1;
+       t2 = R->key->t2;
+#ifdef ALT_ECC_SIZE
+       rx = R->key->x;
+       ry = R->key->y;
+       rz = R->key->z;
+#endif
+   }
+   else
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+   {
+       t1 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       t2 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (t1 == NULL || t2 == NULL) {
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+#ifdef ALT_ECC_SIZE
+       rx = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       ry = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       rz = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (rx == NULL || ry == NULL || rz == NULL) {
+           XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+#endif
+   }
+#endif /* WOLFSSL_SMALL_STACK */
+
+   if ((err = mp_init_multi(t1, t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+   #ifdef WOLFSSL_SMALL_STACK_CACHE
+       if (R->key == NULL)
+   #endif
+       {
+       #ifdef ALT_ECC_SIZE
+          XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+       #endif
+          XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+       }
+#endif
       return err;
    }
@@ -1332 +1612 @@
    /* should we dbl instead? */
    if (err == MP_OKAY)
-       err = mp_sub(modulus, Q->y, &t1);
+       err = mp_sub(modulus, Q->y, t1);
    if (err == MP_OKAY) {
        if ( (mp_cmp(P->x, Q->x) == MP_EQ) &&
             (get_digit_count(Q->z) && mp_cmp(P->z, Q->z) == MP_EQ) &&
-            (mp_cmp(P->y, Q->y) == MP_EQ || mp_cmp(P->y, &t1) == MP_EQ)) {
-           mp_clear(&t1);
-           mp_clear(&t2);
+            (mp_cmp(P->y, Q->y) == MP_EQ || mp_cmp(P->y, t1) == MP_EQ)) {
+           mp_clear(t1);
+           mp_clear(t2);
+    #ifdef WOLFSSL_SMALL_STACK
+       #ifdef WOLFSSL_SMALL_STACK_CACHE
+           if (R->key == NULL)
+       #endif
+           {
+            #ifdef ALT_ECC_SIZE
+               XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+               XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+               XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+            #endif
+               XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+               XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           }
+        #endif
           return ecc_projective_dbl_point(P, R, a, modulus, mp);
        }
@@ -1351 +1645 @@
 #ifdef ALT_ECC_SIZE
    /* Use local stack variable */
-   x = &rx;
-   y = &ry;
-   z = &rz;
+   x = rx;
+   y = ry;
+   z = rz;
 
    if ((err = mp_init_multi(x, y, z, NULL, NULL, NULL)) != MP_OKAY) {
@@ -1376 +1670 @@
        if (!mp_iszero(Q->z)) {
            /* T1 = Z' * Z' */
-           err = mp_sqr(Q->z, &t1);
+           err = mp_sqr(Q->z, t1);
            if (err == MP_OKAY)
-               err = mp_montgomery_reduce(&t1, modulus, mp);
+               err = mp_montgomery_reduce(t1, modulus, mp);
 
            /* X = X * T1 */
            if (err == MP_OKAY)
-               err = mp_mul(&t1, x, x);
+               err = mp_mul(t1, x, x);
            if (err == MP_OKAY)
                err = mp_montgomery_reduce(x, modulus, mp);
@@ -1388 +1682 @@
            /* T1 = Z' * T1 */
            if (err == MP_OKAY)
-               err = mp_mul(Q->z, &t1, &t1);
+               err = mp_mul(Q->z, t1, t1);
            if (err == MP_OKAY)
-               err = mp_montgomery_reduce(&t1, modulus, mp);
+               err = mp_montgomery_reduce(t1, modulus, mp);
 
            /* Y = Y * T1 */
            if (err == MP_OKAY)
-               err = mp_mul(&t1, y, y);
+               err = mp_mul(t1, y, y);
            if (err == MP_OKAY)
                err = mp_montgomery_reduce(y, modulus, mp);
@@ -1402 +1696 @@
    /* T1 = Z*Z */
    if (err == MP_OKAY)
-       err = mp_sqr(z, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_sqr(z, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* T2 = X' * T1 */
    if (err == MP_OKAY)
-       err = mp_mul(Q->x, &t1, &t2);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t2, modulus, mp);
+       err = mp_mul(Q->x, t1, t2);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t2, modulus, mp);
 
    /* T1 = Z * T1 */
    if (err == MP_OKAY)
-       err = mp_mul(z, &t1, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_mul(z, t1, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* T1 = Y' * T1 */
    if (err == MP_OKAY)
-       err = mp_mul(Q->y, &t1, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_mul(Q->y, t1, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* Y = Y - T1 */
    if (err == MP_OKAY)
-       err = mp_sub(y, &t1, y);
+       err = mp_sub(y, t1, y);
    if (err == MP_OKAY) {
        if (mp_isneg(y))
@@ -1433 +1727 @@
    /* T1 = 2T1 */
    if (err == MP_OKAY)
-       err = mp_add(&t1, &t1, &t1);
+       err = mp_add(t1, t1, t1);
    if (err == MP_OKAY) {
-       if (mp_cmp(&t1, modulus) != MP_LT)
-           err = mp_sub(&t1, modulus, &t1);
+       if (mp_cmp(t1, modulus) != MP_LT)
+           err = mp_sub(t1, modulus, t1);
    }
    /* T1 = Y + T1 */
    if (err == MP_OKAY)
-       err = mp_add(&t1, y, &t1);
+       err = mp_add(t1, y, t1);
    if (err == MP_OKAY) {
-       if (mp_cmp(&t1, modulus) != MP_LT)
-           err = mp_sub(&t1, modulus, &t1);
+       if (mp_cmp(t1, modulus) != MP_LT)
+           err = mp_sub(t1, modulus, t1);
    }
    /* X = X - T2 */
    if (err == MP_OKAY)
-       err = mp_sub(x, &t2, x);
+       err = mp_sub(x, t2, x);
    if (err == MP_OKAY) {
        if (mp_isneg(x))
@@ -1454 +1748 @@
    /* T2 = 2T2 */
    if (err == MP_OKAY)
-       err = mp_add(&t2, &t2, &t2);
+       err = mp_add(t2, t2, t2);
    if (err == MP_OKAY) {
-       if (mp_cmp(&t2, modulus) != MP_LT)
-           err = mp_sub(&t2, modulus, &t2);
+       if (mp_cmp(t2, modulus) != MP_LT)
+           err = mp_sub(t2, modulus, t2);
    }
    /* T2 = X + T2 */
    if (err == MP_OKAY)
-       err = mp_add(&t2, x, &t2);
+       err = mp_add(t2, x, t2);
    if (err == MP_OKAY) {
-       if (mp_cmp(&t2, modulus) != MP_LT)
-           err = mp_sub(&t2, modulus, &t2);
+       if (mp_cmp(t2, modulus) != MP_LT)
+           err = mp_sub(t2, modulus, t2);
    }
 
@@ -1484 +1778 @@
    /* T1 = T1 * X  */
    if (err == MP_OKAY)
-       err = mp_mul(&t1, x, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_mul(t1, x, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* X = X * X */
@@ -1496 +1790 @@
    /* T2 = T2 * x */
    if (err == MP_OKAY)
-       err = mp_mul(&t2, x, &t2);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t2, modulus, mp);
+       err = mp_mul(t2, x, t2);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t2, modulus, mp);
 
    /* T1 = T1 * X  */
    if (err == MP_OKAY)
-       err = mp_mul(&t1, x, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_mul(t1, x, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* X = Y*Y */
@@ -1514 +1808 @@
    /* X = X - T2 */
    if (err == MP_OKAY)
-       err = mp_sub(x, &t2, x);
+       err = mp_sub(x, t2, x);
    if (err == MP_OKAY) {
        if (mp_isneg(x))
@@ -1521 +1815 @@
    /* T2 = T2 - X */
    if (err == MP_OKAY)
-       err = mp_sub(&t2, x, &t2);
+       err = mp_sub(t2, x, t2);
    if (err == MP_OKAY) {
-       if (mp_isneg(&t2))
-           err = mp_add(&t2, modulus, &t2);
+       if (mp_isneg(t2))
+           err = mp_add(t2, modulus, t2);
    }
    /* T2 = T2 - X */
    if (err == MP_OKAY)
-       err = mp_sub(&t2, x, &t2);
+       err = mp_sub(t2, x, t2);
    if (err == MP_OKAY) {
-       if (mp_isneg(&t2))
-           err = mp_add(&t2, modulus, &t2);
+       if (mp_isneg(t2))
+           err = mp_add(t2, modulus, t2);
    }
    /* T2 = T2 * Y */
    if (err == MP_OKAY)
-       err = mp_mul(&t2, y, &t2);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t2, modulus, mp);
+       err = mp_mul(t2, y, t2);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t2, modulus, mp);
 
    /* Y = T2 - T1 */
    if (err == MP_OKAY)
-       err = mp_sub(&t2, &t1, y);
+       err = mp_sub(t2, t1, y);
    if (err == MP_OKAY) {
        if (mp_isneg(y))
@@ -1566 +1860 @@
 
    /* clean up */
-   mp_clear(&t1);
-   mp_clear(&t2);
+   mp_clear(t1);
+   mp_clear(t2);
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (R->key == NULL)
+#endif
+   {
+   #ifdef ALT_ECC_SIZE
+      XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+   #endif
+      XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+   }
+#endif
 
    return err;
+#else
+    if (P == NULL || Q == NULL || R == NULL || modulus == NULL) {
+        return ECC_BAD_ARG_E;
+    }
+
+    (void)a;
+    (void)mp;
+
+    return sp_ecc_proj_add_point_256(P->x, P->y, P->z, Q->x, Q->y, Q->z,
+                                     R->x, R->y, R->z);
+#endif
 }
 
@@ -1602 +1921 @@
                                        mp_int* modulus, mp_digit mp)
 {
-   mp_int t1, t2;
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int* t1 = NULL;
+   mp_int* t2 = NULL;
 #ifdef ALT_ECC_SIZE
-   mp_int rx, ry, rz;
+   mp_int* rx = NULL;
+   mp_int* ry = NULL;
+   mp_int* rz = NULL;
+#endif
+#else
+   mp_int  t1[1], t2[1];
+#ifdef ALT_ECC_SIZE
+   mp_int  rx[1], ry[1], rz[1];
+#endif
 #endif
    mp_int *x, *y, *z;
@@ -1612 +1942 @@
        return ECC_BAD_ARG_E;
 
-   if ((err = mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (R->key != NULL) {
+       t1 = R->key->t1;
+       t2 = R->key->t2;
+   #ifdef ALT_ECC_SIZE
+       rx = R->key->x;
+       ry = R->key->y;
+       rz = R->key->z;
+   #endif
+   }
+   else
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+   {
+       t1 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       t2 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (t1 == NULL || t2 == NULL) {
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+    #ifdef ALT_ECC_SIZE
+       rx = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       ry = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       rz = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (rx == NULL || ry == NULL || rz == NULL) {
+           XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+    #endif
+    }
+#endif
+
+   if ((err = mp_init_multi(t1, t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    if (R->key == NULL)
+#endif
+    {
+    #ifdef ALT_ECC_SIZE
+       XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+    #endif
+       XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+     }
+#endif
       return err;
    }
@@ -1620 +2001 @@
 #ifdef ALT_ECC_SIZE
    /* Use local stack variable */
-   x = &rx;
-   y = &ry;
-   z = &rz;
+   x = rx;
+   y = ry;
+   z = rz;
 
    if ((err = mp_init_multi(x, y, z, NULL, NULL, NULL)) != MP_OKAY) {
-       mp_clear(&t1);
-       mp_clear(&t2);
+       mp_clear(t1);
+       mp_clear(t2);
+    #ifdef WOLFSSL_SMALL_STACK
+    #ifdef WOLFSSL_SMALL_STACK_CACHE
+       if (R->key == NULL)
+    #endif
+       {
+       #ifdef ALT_ECC_SIZE
+          XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+       #endif
+          XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+          XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+       }
+    #endif
        return err;
    }
@@ -1645 +2040 @@
    /* T1 = Z * Z */
    if (err == MP_OKAY)
-       err = mp_sqr(z, &t1);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t1, modulus, mp);
+       err = mp_sqr(z, t1);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t1, modulus, mp);
 
    /* Z = Y * Z */
@@ -1667 +2062 @@
    if (err == MP_OKAY) {
       /* Use a and prime to determine if a == 3 */
-      err = mp_submod(modulus, a, modulus, &t2);
-   }
-   if (err == MP_OKAY && mp_cmp_d(&t2, 3) != MP_EQ) {
+      err = mp_submod(modulus, a, modulus, t2);
+   }
+   if (err == MP_OKAY && mp_cmp_d(t2, 3) != MP_EQ) {
       /* use "a" in calc */
 
       /* T2 = T1 * T1 */
       if (err == MP_OKAY)
-          err = mp_sqr(&t1, &t2);
+          err = mp_sqr(t1, t2);
       if (err == MP_OKAY)
-          err = mp_montgomery_reduce(&t2, modulus, mp);
+          err = mp_montgomery_reduce(t2, modulus, mp);
       /* T1 = T2 * a */
       if (err == MP_OKAY)
-          err = mp_mulmod(&t2, a, modulus, &t1);
+          err = mp_mulmod(t2, a, modulus, t1);
       /* T2 = X * X */
       if (err == MP_OKAY)
-          err = mp_sqr(x, &t2);
+          err = mp_sqr(x, t2);
       if (err == MP_OKAY)
-          err = mp_montgomery_reduce(&t2, modulus, mp);
+          err = mp_montgomery_reduce(t2, modulus, mp);
       /* T1 = T2 + T1 */
       if (err == MP_OKAY)
-          err = mp_add(&t1, &t2, &t1);
+          err = mp_add(t1, t2, t1);
       if (err == MP_OKAY) {
-         if (mp_cmp(&t1, modulus) != MP_LT)
-            err = mp_sub(&t1, modulus, &t1);
+         if (mp_cmp(t1, modulus) != MP_LT)
+            err = mp_sub(t1, modulus, t1);
       }
       /* T1 = T2 + T1 */
       if (err == MP_OKAY)
-          err = mp_add(&t1, &t2, &t1);
+          err = mp_add(t1, t2, t1);
       if (err == MP_OKAY) {
-          if (mp_cmp(&t1, modulus) != MP_LT)
-              err = mp_sub(&t1, modulus, &t1);
+          if (mp_cmp(t1, modulus) != MP_LT)
+              err = mp_sub(t1, modulus, t1);
       }
       /* T1 = T2 + T1 */
       if (err == MP_OKAY)
-          err = mp_add(&t1, &t2, &t1);
+          err = mp_add(t1, t2, t1);
       if (err == MP_OKAY) {
-         if (mp_cmp(&t1, modulus) != MP_LT)
-            err = mp_sub(&t1, modulus, &t1);
+         if (mp_cmp(t1, modulus) != MP_LT)
+            err = mp_sub(t1, modulus, t1);
       }
    }
@@ -1715 +2110 @@
       /* T2 = X - T1 */
       if (err == MP_OKAY)
-          err = mp_sub(x, &t1, &t2);
+          err = mp_sub(x, t1, t2);
       if (err == MP_OKAY) {
-          if (mp_isneg(&t2))
-              err = mp_add(&t2, modulus, &t2);
+          if (mp_isneg(t2))
+              err = mp_add(t2, modulus, t2);
       }
       /* T1 = X + T1 */
       if (err == MP_OKAY)
-          err = mp_add(&t1, x, &t1);
+          err = mp_add(t1, x, t1);
       if (err == MP_OKAY) {
-          if (mp_cmp(&t1, modulus) != MP_LT)
-              err = mp_sub(&t1, modulus, &t1);
+          if (mp_cmp(t1, modulus) != MP_LT)
+              err = mp_sub(t1, modulus, t1);
       }
       /* T2 = T1 * T2 */
       if (err == MP_OKAY)
-          err = mp_mul(&t1, &t2, &t2);
+          err = mp_mul(t1, t2, t2);
       if (err == MP_OKAY)
-          err = mp_montgomery_reduce(&t2, modulus, mp);
+          err = mp_montgomery_reduce(t2, modulus, mp);
 
       /* T1 = 2T2 */
       if (err == MP_OKAY)
-          err = mp_add(&t2, &t2, &t1);
+          err = mp_add(t2, t2, t1);
       if (err == MP_OKAY) {
-          if (mp_cmp(&t1, modulus) != MP_LT)
-              err = mp_sub(&t1, modulus, &t1);
+          if (mp_cmp(t1, modulus) != MP_LT)
+              err = mp_sub(t1, modulus, t1);
       }
       /* T1 = T1 + T2 */
       if (err == MP_OKAY)
-          err = mp_add(&t1, &t2, &t1);
+          err = mp_add(t1, t2, t1);
       if (err == MP_OKAY) {
-          if (mp_cmp(&t1, modulus) != MP_LT)
-              err = mp_sub(&t1, modulus, &t1);
+          if (mp_cmp(t1, modulus) != MP_LT)
+              err = mp_sub(t1, modulus, t1);
       }
    }
@@ -1764 +2159 @@
    /* T2 = Y * Y */
    if (err == MP_OKAY)
-       err = mp_sqr(y, &t2);
-   if (err == MP_OKAY)
-       err = mp_montgomery_reduce(&t2, modulus, mp);
+       err = mp_sqr(y, t2);
+   if (err == MP_OKAY)
+       err = mp_montgomery_reduce(t2, modulus, mp);
 
    /* T2 = T2/2 */
    if (err == MP_OKAY) {
-       if (mp_isodd(&t2) == MP_YES)
-           err = mp_add(&t2, modulus, &t2);
-   }
-   if (err == MP_OKAY)
-       err = mp_div_2(&t2, &t2);
+       if (mp_isodd(t2) == MP_YES)
+           err = mp_add(t2, modulus, t2);
+   }
+   if (err == MP_OKAY)
+       err = mp_div_2(t2, t2);
 
    /* Y = Y * X */
@@ -1784 +2179 @@
    /* X = T1 * T1 */
    if (err == MP_OKAY)
-       err = mp_sqr(&t1, x);
+       err = mp_sqr(t1, x);
    if (err == MP_OKAY)
        err = mp_montgomery_reduce(x, modulus, mp);
@@ -1812 +2207 @@
    /* Y = Y * T1 */
    if (err == MP_OKAY)
-       err = mp_mul(y, &t1, y);
+       err = mp_mul(y, t1, y);
    if (err == MP_OKAY)
        err = mp_montgomery_reduce(y, modulus, mp);
@@ -1818 +2213 @@
    /* Y = Y - T2 */
    if (err == MP_OKAY)
-       err = mp_sub(y, &t2, y);
+       err = mp_sub(y, t2, y);
    if (err == MP_OKAY) {
        if (mp_isneg(y))
@@ -1834 +2229 @@
 
    /* clean up */
-   mp_clear(&t1);
-   mp_clear(&t2);
+   mp_clear(t1);
+   mp_clear(t2);
+
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (R->key == NULL)
+#endif
+   {
+    #ifdef ALT_ECC_SIZE
+       XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+    #endif
+       XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+       XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+    }
+#endif
 
    return err;
+#else
+    if (P == NULL || R == NULL || modulus == NULL)
+        return ECC_BAD_ARG_E;
+
+    (void)a;
+    (void)mp;
+
+    return sp_ecc_proj_dbl_point_256(P->x, P->y, P->z, R->x, R->y, R->z);
+#endif
 }
 
@@ -1850 +2269 @@
 int ecc_map(ecc_point* P, mp_int* modulus, mp_digit mp)
 {
-   mp_int t1, t2;
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int* t1 = NULL;
+   mp_int* t2 = NULL;
 #ifdef ALT_ECC_SIZE
-   mp_int rx, ry, rz;
-#endif
+   mp_int* rx = NULL;
+   mp_int* ry = NULL;
+   mp_int* rz = NULL;
+#endif
+#else
+   mp_int  t1[1], t2[1];
+#ifdef ALT_ECC_SIZE
+   mp_int  rx[1], ry[1], rz[1];
+#endif
+#endif /* WOLFSSL_SMALL_STACK */
    mp_int *x, *y, *z;
    int    err;
@@ -1870 +2300 @@
    }
 
-   if ((err = mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (P->key != NULL) {
+       t1 = P->key->t1;
+       t2 = P->key->t2;
+   #ifdef ALT_ECC_SIZE
+       rx = P->key->x;
+       ry = P->key->y;
+       rz = P->key->z;
+   #endif
+   }
+   else
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+   {
+       t1 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       t2 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (t1 == NULL || t2 == NULL) {
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+#ifdef ALT_ECC_SIZE
+       rx = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       ry = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       rz = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+       if (rx == NULL || ry == NULL || rz == NULL) {
+           XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+           XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+           return MEMORY_E;
+       }
+#endif
+   }
+#endif /* WOLFSSL_SMALL_STACK */
+
+   if ((err = mp_init_multi(t1, t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+      if (P->key == NULL)
+#endif
+      {
+      #ifdef ALT_ECC_SIZE
+         XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+         XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+         XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+      #endif
+         XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+         XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+      }
+#endif
       return MEMORY_E;
    }
@@ -1876 +2357 @@
 #ifdef ALT_ECC_SIZE
    /* Use local stack variable */
-   x = &rx;
-   y = &ry;
-   z = &rz;
+   x = rx;
+   y = ry;
+   z = rz;
 
    if ((err = mp_init_multi(x, y, z, NULL, NULL, NULL)) != MP_OKAY) {
@@ -1906 +2387 @@
    /* get 1/z */
    if (err == MP_OKAY)
-       err = mp_invmod(z, modulus, &t1);
+       err = mp_invmod(z, modulus, t1);
 
    /* get 1/z^2 and 1/z^3 */
    if (err == MP_OKAY)
-       err = mp_sqr(&t1, &t2);
-   if (err == MP_OKAY)
-       err = mp_mod(&t2, modulus, &t2);
-   if (err == MP_OKAY)
-       err = mp_mul(&t1, &t2, &t1);
-   if (err == MP_OKAY)
-       err = mp_mod(&t1, modulus, &t1);
+       err = mp_sqr(t1, t2);
+   if (err == MP_OKAY)
+       err = mp_mod(t2, modulus, t2);
+   if (err == MP_OKAY)
+       err = mp_mul(t1, t2, t1);
+   if (err == MP_OKAY)
+       err = mp_mod(t1, modulus, t1);
 
    /* multiply against x/y */
    if (err == MP_OKAY)
-       err = mp_mul(x, &t2, x);
+       err = mp_mul(x, t2, x);
    if (err == MP_OKAY)
        err = mp_montgomery_reduce(x, modulus, mp);
    if (err == MP_OKAY)
-       err = mp_mul(y, &t1, y);
+       err = mp_mul(y, t1, y);
    if (err == MP_OKAY)
        err = mp_montgomery_reduce(y, modulus, mp);
@@ -1944 +2425 @@
 
    /* clean up */
-   mp_clear(&t1);
-   mp_clear(&t2);
+   mp_clear(t1);
+   mp_clear(t2);
+
+#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   if (P->key == NULL)
+#endif
+   {
+   #ifdef ALT_ECC_SIZE
+      XFREE(rz, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(ry, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(rx, NULL, DYNAMIC_TYPE_ECC);
+   #endif
+      XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+}
+#endif
 
    return err;
-}
+#else
+    if (P == NULL || modulus == NULL)
+        return ECC_BAD_ARG_E;
+
+    (void)mp;
+
+    return sp_ecc_map_256(P->x, P->y, P->z);
+#endif
+}
+
+#endif /* !WOLFSSL_SP_MATH || WOLFSSL_PUBLIC_ECC_ADD_DBL */
 
 #if !defined(FREESCALE_LTC_ECC)
 
+#if !defined(FP_ECC) || !defined(WOLFSSL_SP_MATH)
 /**
    Perform a point multiplication
@@ -1973 +2480 @@
 #endif
 {
+#ifndef WOLFSSL_SP_MATH
 #ifndef ECC_TIMING_RESISTANT
    /* size of sliding window, don't change this! */
@@ -1984 +2492 @@
    ecc_point     *tG, *M[M_POINTS];
    int           i, err;
-   mp_int        mu;
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int*       mu = NULL;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   ecc_key       key;
+#endif
+#else
+   mp_int        mu[1];
+#endif
    mp_digit      mp;
    mp_digit      buf;
@@ -1996 +2511 @@
    tG = NULL;
    XMEMSET(M, 0, sizeof(M));
+#ifdef WOLFSSL_SMALL_STACK
+   mu = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+   if (mu == NULL)
+       return MEMORY_E;
+#endif
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   key.t1 = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+   key.t2 = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+#ifdef ALT_ECC_SIZE
+   key.x = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+   key.y = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+   key.z = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+#endif
+   if (key.t1 == NULL || key.t2 == NULL
+#ifdef ALT_ECC_SIZE
+      || key.x == NULL || key.y == NULL || key.z == NULL
+#endif
+   ) {
+#ifdef ALT_ECC_SIZE
+       XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+       XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+       XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+       return MEMORY_E;
+   }
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
 
    /* init montgomery reduction */
    if ((err = mp_montgomery_setup(modulus, &mp)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+#ifdef ALT_ECC_SIZE
+       XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+       XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+#ifdef WOLFSSL_SMALL_STACK
+       XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+#endif
        return err;
    }
 
-   if ((err = mp_init(&mu)) != MP_OKAY) {
+   if ((err = mp_init(mu)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+#ifdef ALT_ECC_SIZE
+       XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+       XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+#ifdef WOLFSSL_SMALL_STACK
+       XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+#endif
        return err;
    }
-   if ((err = mp_montgomery_calc_normalization(&mu, modulus)) != MP_OKAY) {
-       mp_clear(&mu);
+   if ((err = mp_montgomery_calc_normalization(mu, modulus)) != MP_OKAY) {
+       mp_clear(mu);
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+#ifdef ALT_ECC_SIZE
+       XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+       XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+       XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+#ifdef WOLFSSL_SMALL_STACK
+       XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+#endif
        return err;
    }
@@ -2014 +2594 @@
       M[i] = wc_ecc_new_point_h(heap);
       if (M[i] == NULL) {
-         mp_clear(&mu);
+         mp_clear(mu);
          err = MEMORY_E; goto exit;
       }
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+      M[i]->key = &key;
+#endif
   }
 
@@ -2026 +2609 @@
    /* tG = G  and convert to montgomery */
    if (err == MP_OKAY) {
-       if (mp_cmp_d(&mu, 1) == MP_EQ) {
+       if (mp_cmp_d(mu, 1) == MP_EQ) {
            err = mp_copy(G->x, tG->x);
            if (err == MP_OKAY)
@@ -2033 +2616 @@
                err = mp_copy(G->z, tG->z);
        } else {
-           err = mp_mulmod(G->x, &mu, modulus, tG->x);
+           err = mp_mulmod(G->x, mu, modulus, tG->x);
            if (err == MP_OKAY)
-               err = mp_mulmod(G->y, &mu, modulus, tG->y);
+               err = mp_mulmod(G->y, mu, modulus, tG->y);
            if (err == MP_OKAY)
-               err = mp_mulmod(G->z, &mu, modulus, tG->z);
+               err = mp_mulmod(G->z, mu, modulus, tG->z);
        }
    }
 
    /* done with mu */
-   mp_clear(&mu);
-
+   mp_clear(mu);
+
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   R->key = &key;
+#endif
 #ifndef ECC_TIMING_RESISTANT
 
@@ -2305 +2891 @@
        wc_ecc_del_point_h(M[i], heap);
    }
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+   R->key = NULL;
+#ifdef ALT_ECC_SIZE
+   XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+   XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+   XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+   XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+   XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
+#ifdef WOLFSSL_SMALL_STACK
+   XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+#endif
 
    return err;
-}
+#else
+   if (k == NULL || G == NULL || R == NULL || modulus == NULL) {
+       return ECC_BAD_ARG_E;
+}
+
+   (void)a;
+
+   return sp_ecc_mulmod_256(k, G, R, map, heap);
+#endif
+}
+
+#endif /* !FP_ECC || !WOLFSSL_SP_MATH */
 
 #endif /* !FREESCALE_LTC_ECC */
@@ -2327 +2937 @@
 }
 
-
-#ifdef ALT_ECC_SIZE
-
-static void alt_fp_init(fp_int* a)
-{
-    a->size = FP_SIZE_ECC;
-    fp_zero(a);
-}
-
-#endif /* ALT_ECC_SIZE */
-
+#endif /* !WOLFSSL_ATECC508A */
 
 /**
@@ -2346 +2946 @@
 {
    ecc_point* p;
+
+   (void)heap;
 
    p = (ecc_point*)XMALLOC(sizeof(ecc_point), heap, DYNAMIC_TYPE_ECC);
@@ -2455 +3057 @@
 }
 
-#endif /* !WOLFSSL_ATECC508A */
-
 
 /** Returns whether an ECC idx is valid or not
@@ -2588 +3188 @@
 {
     int err = MP_OKAY;
-    mp_int a, b;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* a = NULL;
+    mp_int* b = NULL;
+#else
+    mp_int  a[1], b[1];
+#endif
 
     if (param == NULL || curveParam == NULL)
         return BAD_FUNC_ARG;
 
-    if ((err = mp_init_multi(&a, &b, NULL, NULL, NULL, NULL)) != MP_OKAY)
+#ifdef WOLFSSL_SMALL_STACK
+    a = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (a == NULL)
+        return MEMORY_E;
+    b = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (b == NULL) {
+        XFREE(a, NULL, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+#endif
+
+    if ((err = mp_init_multi(a, b, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(a, NULL, DYNAMIC_TYPE_ECC);
+        XFREE(b, NULL, DYNAMIC_TYPE_ECC);
+    #endif
         return err;
+    }
 
     if (err == MP_OKAY)
-        err = mp_read_unsigned_bin(&a, param, paramSz);
+        err = mp_read_unsigned_bin(a, param, paramSz);
 
     if (err == MP_OKAY)
-        err = mp_read_radix(&b, curveParam, 16);
+        err = mp_read_radix(b, curveParam, MP_RADIX_HEX);
 
     if (err == MP_OKAY) {
-        if (mp_cmp(&a, &b) != MP_EQ) {
+        if (mp_cmp(a, b) != MP_EQ) {
             err = -1;
         } else {
@@ -2610 +3231 @@
     }
 
-    mp_clear(&a);
-    mp_clear(&b);
+    mp_clear(a);
+    mp_clear(b);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(b, NULL, DYNAMIC_TYPE_ECC);
+    XFREE(a, NULL, DYNAMIC_TYPE_ECC);
+#endif
 
     return err;
@@ -2672 +3297 @@
 }
 
+/* Returns the curve id that corresponds to a given OID,
+ * as listed in ecc_sets[] of ecc.c.
+ *
+ * oid   OID, from ecc_sets[].name in ecc.c
+ * len   OID len, from ecc_sets[].name in ecc.c
+ * return curve id, from ecc_sets[] on success, negative on error
+ */
+int wc_ecc_get_curve_id_from_oid(const byte* oid, word32 len)
+{
+    int curve_idx;
+
+    if (oid == NULL)
+        return BAD_FUNC_ARG;
+
+    for (curve_idx = 0; ecc_sets[curve_idx].size != 0; curve_idx++) {
+        if (ecc_sets[curve_idx].oid && ecc_sets[curve_idx].oidSz == len &&
+                              XMEMCMP(ecc_sets[curve_idx].oid, oid, len) == 0) {
+            break;
+        }
+    }
+    if (ecc_sets[curve_idx].size == 0) {
+        WOLFSSL_MSG("ecc_set curve name not found");
+        return ECC_CURVE_INVALID;
+    }
+
+    return ecc_sets[curve_idx].id;
+}
+
+
+#ifdef WOLFSSL_ASYNC_CRYPT
+static WC_INLINE int wc_ecc_alloc_mpint(ecc_key* key, mp_int** mp)
+{
+   if (key == NULL || mp == NULL)
+      return BAD_FUNC_ARG;
+   if (*mp == NULL) {
+      *mp = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_BIGINT);
+      if (*mp == NULL) {
+         return MEMORY_E;
+      }
+      XMEMSET(*mp, 0, sizeof(mp_int));
+   }
+   return 0;
+}
+static WC_INLINE void wc_ecc_free_mpint(ecc_key* key, mp_int** mp)
+{
+   if (key && mp && *mp) {
+      mp_clear(*mp);
+      XFREE(*mp, key->heap, DYNAMIC_TYPE_BIGINT);
+      *mp = NULL;
+   }
+}
+
+static int wc_ecc_alloc_async(ecc_key* key)
+{
+    int err = wc_ecc_alloc_mpint(key, &key->r);
+    if (err == 0)
+        err = wc_ecc_alloc_mpint(key, &key->s);
+    return err;
+}
+
+static void wc_ecc_free_async(ecc_key* key)
+{
+    wc_ecc_free_mpint(key, &key->r);
+    wc_ecc_free_mpint(key, &key->s);
+#ifdef HAVE_CAVIUM_V
+    wc_ecc_free_mpint(key, &key->e);
+    wc_ecc_free_mpint(key, &key->signK);
+#endif /* HAVE_CAVIUM_V */
+}
+#endif /* WOLFSSL_ASYNC_CRYPT */
+
 
 #ifdef HAVE_ECC_DHE
@@ -2693 +3389 @@
    }
 
+#ifdef WOLF_CRYPTO_DEV
+    if (private_key->devId != INVALID_DEVID) {
+        err = wc_CryptoDev_Ecdh(private_key, public_key, out, outlen);
+        if (err != NOT_COMPILED_IN)
+            return err;
+    }
+#endif
+
    /* type valid? */
    if (private_key->type != ECC_PRIVATEKEY &&
@@ -2711 +3415 @@
 
 #ifdef WOLFSSL_ATECC508A
-   err = atcatls_ecdh(private_key->slot, public_key->pubkey, out);
-   if (err != ATCA_SUCCESS) {
-      err = BAD_COND_E;
-   }
+   /* For SECP256R1 use hardware */
+   if (private_key->dp->id == ECC_SECP256R1) {
+       err = atmel_ecc_create_pms(private_key->slot, public_key->pubkey_raw, out);
    *outlen = private_key->dp->size;
+   }
+   else {
+      err = NOT_COMPILED_IN;
+   }
+
 #else
+
    err = wc_ecc_shared_secret_ex(private_key, &public_key->pubkey, out, outlen);
 #endif /* WOLFSSL_ATECC508A */
@@ -2730 +3439 @@
 {
     int err;
+#ifndef WOLFSSL_SP_MATH
     ecc_point* result = NULL;
     word32 x = 0;
+#endif
     mp_int* k = &private_key->k;
 #ifdef HAVE_ECC_CDH
@@ -2763 +3474 @@
 #endif
 #endif
+#ifdef WOLFSSL_SP_MATH
+    {
+        err = WC_KEY_SIZE_E;
+
+        (void)curve;
+    }
+#else
     {
         /* make new point */
@@ -2792 +3510 @@
         wc_ecc_del_point_h(result, private_key->heap);
     }
+#endif
 #ifdef HAVE_ECC_CDH
     if (k == &k_lcl)
@@ -2807 +3526 @@
     int err;
 
-#ifdef HAVE_CAVIUM
-    /* TODO: Not implemented - use software for now */
-    err = wc_ecc_shared_secret_gen_sync(private_key, point, out, outlen, curve);
-
-#elif defined(HAVE_INTEL_QA)
+#if defined(HAVE_CAVIUM_V) || defined(HAVE_INTEL_QA)
+#ifdef HAVE_CAVIUM_V
+    /* verify the curve is supported by hardware */
+    if (NitroxEccIsCurveSupported(private_key))
+#endif
+    {
+        word32 keySz = private_key->dp->size;
+
     /* sync public key x/y */
-    err = wc_ecc_curve_load(private_key->dp, &curve, ECC_CURVE_FIELD_BF);
+        err = wc_mp_to_bigint_sz(&private_key->k, &private_key->k.raw, keySz);
+        if (err == MP_OKAY)
+            err = wc_mp_to_bigint_sz(point->x, &point->x->raw, keySz);
+        if (err == MP_OKAY)
+            err = wc_mp_to_bigint_sz(point->y, &point->y->raw, keySz);
+    #ifdef HAVE_CAVIUM_V
+        /* allocate buffer for output */
     if (err == MP_OKAY)
-        err = wc_mp_to_bigint(&private_key->k, &private_key->k.raw);
+            err = wc_ecc_alloc_mpint(private_key, &private_key->e);
     if (err == MP_OKAY)
-        err = wc_mp_to_bigint(point->x, &point->x->raw);
+            err = wc_bigint_alloc(&private_key->e->raw,
+                NitroxEccGetSize(private_key)*2);
     if (err == MP_OKAY)
-        err = wc_mp_to_bigint(point->y, &point->y->raw);
+            err = NitroxEcdh(private_key,
+                &private_key->k.raw, &point->x->raw, &point->y->raw,
+                private_key->e->raw.buf, &private_key->e->raw.len,
+                &curve->prime->raw);
+    #else
+        if (err == MP_OKAY)
+            err = wc_ecc_curve_load(private_key->dp, &curve, ECC_CURVE_FIELD_BF);
     if (err == MP_OKAY)
         err = IntelQaEcdh(&private_key->asyncDev,
@@ -2826 +3561 @@
             &curve->Af->raw, &curve->Bf->raw, &curve->prime->raw,
             private_key->dp->cofactor);
-#else /* WOLFSSL_ASYNC_CRYPT_TEST */
+    #endif
+        return err;
+    }
+#elif defined(WOLFSSL_ASYNC_CRYPT_TEST)
     if (wc_AsyncTestInit(&private_key->asyncDev, ASYNC_TEST_ECC_SHARED_SEC)) {
         WC_ASYNC_TEST* testDev = &private_key->asyncDev.test;
@@ -2835 +3573 @@
         return WC_PENDING_E;
     }
+#endif
+
+    /* use sync in other cases */
     err = wc_ecc_shared_secret_gen_sync(private_key, point, out, outlen, curve);
-#endif
 
     return err;
@@ -2846 +3586 @@
 {
     int err;
-    DECLARE_CURVE_SPECS(2)
+    DECLARE_CURVE_SPECS(curve, 2);
 
     if (private_key == NULL || point == NULL || out == NULL ||
@@ -2853 +3593 @@
     }
 
+    ALLOC_CURVE_SPECS(2);
+
     /* load curve info */
     err = wc_ecc_curve_load(private_key->dp, &curve,
         (ECC_CURVE_FIELD_PRIME | ECC_CURVE_FIELD_AF));
-    if (err != MP_OKAY)
+    if (err != MP_OKAY) {
+        FREE_CURVE_SPECS();
         return err;
+    }
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
@@ -2872 +3616 @@
 
     wc_ecc_curve_free(curve);
+    FREE_CURVE_SPECS();
 
     return err;
@@ -2918 +3663 @@
         case ECC_STATE_SHARED_SEC_RES:
             private_key->state = ECC_STATE_SHARED_SEC_RES;
+        #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
+            if (private_key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ECC) {
+            #ifdef HAVE_CAVIUM_V
+                /* verify the curve is supported by hardware */
+                if (NitroxEccIsCurveSupported(private_key)) {
+                    /* copy output */
+                    *outlen = private_key->dp->size;
+                    XMEMCPY(out, private_key->e->raw.buf, *outlen);
+                }
+            #endif /* HAVE_CAVIUM_V */
+            }
+        #endif /* WOLFSSL_ASYNC_CRYPT */
             err = 0;
             break;
@@ -2931 +3688 @@
     }
 
+    /* cleanup */
+#ifdef WOLFSSL_ASYNC_CRYPT
+    wc_ecc_free_async(private_key);
+#endif
     private_key->state = ECC_STATE_NONE;
 
@@ -2952 +3713 @@
 }
 
+#ifndef WOLFSSL_SP_MATH
 /* generate random and ensure its greater than 0 and less than order */
 static int wc_ecc_gen_k(WC_RNG* rng, int size, mp_int* k, mp_int* order)
 {
+#ifndef WC_NO_RNG
     int err;
-#ifdef WOLFSSL_SMALL_STACK
-    byte* buf;
+#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
+    DECLARE_VAR(buf, byte, ECC_MAXSIZE_GEN, rng->heap);
 #else
     byte  buf[ECC_MAXSIZE_GEN];
-#endif
-
-#ifdef WOLFSSL_SMALL_STACK
-    buf = (byte*)XMALLOC(ECC_MAXSIZE_GEN, NULL, DYNAMIC_TYPE_ECC_BUFFER);
-    if (buf == NULL)
-        return MEMORY_E;
 #endif
 
@@ -2978 +3735 @@
     if (err == 0)
         err = mp_read_unsigned_bin(k, (byte*)buf, size);
-
-    /* quick sanity check to make sure we're not dealing with a 0 key */
-    if (err == MP_OKAY) {
-        if (mp_iszero(k) == MP_YES)
-          err = MP_ZERO_E;
-    }
 
     /* the key should be smaller than the order of base point */
@@ -2992 +3743 @@
     }
 
+    /* quick sanity check to make sure we're not dealing with a 0 key */
+    if (err == MP_OKAY) {
+        if (mp_iszero(k) == MP_YES)
+          err = MP_ZERO_E;
+    }
+
     ForceZero(buf, ECC_MAXSIZE);
-#ifdef WOLFSSL_SMALL_STACK
-    XFREE(buf, NULL, DYNAMIC_TYPE_ECC_BUFFER);
+#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
+    FREE_VAR(buf, rng->heap);
 #endif
 
     return err;
-}
+#else
+    (void)rng;
+    (void)size;
+    (void)k;
+    (void)order;
+    return NOT_COMPILED_IN;
+#endif /* !WC_NO_RNG */
+}
+#endif /* WOLFSSL_SP_MATH */
 #endif /* !WOLFSSL_ATECC508A */
 
-static INLINE void wc_ecc_reset(ecc_key* key)
+static WC_INLINE void wc_ecc_reset(ecc_key* key)
 {
     /* make sure required key variables are reset */
@@ -3026 +3791 @@
     int err = MP_OKAY;
 #ifndef WOLFSSL_ATECC508A
+#ifndef WOLFSSL_SP_MATH
     ecc_point* base = NULL;
+#endif
     ecc_point* pub;
-    DECLARE_CURVE_SPECS(ECC_CURVE_FIELD_COUNT)
-#endif
+    DECLARE_CURVE_SPECS(curve, ECC_CURVE_FIELD_COUNT);
+#endif /* !WOLFSSL_ATECC508A */
 
     if (key == NULL) {
@@ -3036 +3803 @@
 
 #ifndef WOLFSSL_ATECC508A
+
     /* if ecc_point passed in then use it as output for public key point */
     if (pubOut != NULL) {
@@ -3052 +3820 @@
     }
     else {
+        ALLOC_CURVE_SPECS(ECC_CURVE_FIELD_COUNT);
+
         /* load curve info */
         if (err == MP_OKAY)
@@ -3080 +3850 @@
 #endif
 #endif
+#ifdef WOLFSSL_SP_MATH
+        err = WC_KEY_SIZE_E;
+#else
     {
         if (err == MP_OKAY) {
@@ -3102 +3875 @@
         wc_ecc_del_point_h(base, key->heap);
     }
+#endif
 
 #ifdef WOLFSSL_VALIDATE_ECC_KEYGEN
@@ -3122 +3896 @@
     if (curveIn == NULL) {
         wc_ecc_curve_free(curve);
-    }
-
+        FREE_CURVE_SPECS();
+    }
+
+#else
+    (void)curveIn;
 #endif /* WOLFSSL_ATECC508A */
 
@@ -3156 +3933 @@
     int            err;
 #ifndef WOLFSSL_ATECC508A
-    DECLARE_CURVE_SPECS(ECC_CURVE_FIELD_COUNT)
-#endif
+#ifndef WOLFSSL_SP_MATH
+    DECLARE_CURVE_SPECS(curve, ECC_CURVE_FIELD_COUNT);
+#endif
+#endif /* !WOLFSSL_ATECC508A */
 
     if (key == NULL || rng == NULL) {
@@ -3170 +3949 @@
         return err;
     }
+
+#ifdef WOLF_CRYPTO_DEV
+    if (key->devId != INVALID_DEVID) {
+        err = wc_CryptoDev_MakeEccKey(rng, keysize, key, curve_id);
+        if (err != NOT_COMPILED_IN)
+            return err;
+    }
+#endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
@@ -3188 +3975 @@
     #endif
     }
-#endif /* WOLFSSL_ASYNC_CRYPT */
+#endif /* WOLFSSL_ASYNC_CRYPT && WC_ASYNC_ENABLE_ECC */
 
 #ifdef WOLFSSL_ATECC508A
     key->type = ECC_PRIVATEKEY;
-    err = atcatls_create_key(key->slot, key->pubkey);
-    if (err != ATCA_SUCCESS)
-        err = BAD_COND_E;
+   key->slot = atmel_ecc_alloc(ATMEL_SLOT_ECDHE);
+   err = atmel_ecc_create_key(key->slot, key->pubkey_raw);
+
+   /* populate key->pubkey */
+   if (err == 0 && key->pubkey.x) {
+       err = mp_read_unsigned_bin(key->pubkey.x, key->pubkey_raw,
+                                  ECC_MAX_CRYPTO_HW_SIZE);
+   }
+   if (err == 0 && key->pubkey.y) {
+       err = mp_read_unsigned_bin(key->pubkey.y,
+                                  key->pubkey_raw + ECC_MAX_CRYPTO_HW_SIZE,
+                                  ECC_MAX_CRYPTO_HW_SIZE);
+   }
 #else
 
@@ -3206 +4003 @@
     else
 #endif
-#endif
-    {
+#endif /* WOLFSSL_HAVE_SP_ECC */
+
+   { /* software key gen */
+#ifdef WOLFSSL_SP_MATH
+        err = WC_KEY_SIZE_E;
+#else
+        ALLOC_CURVE_SPECS(ECC_CURVE_FIELD_COUNT);
+
         /* setup the key variables */
         err = mp_init(&key->k);
@@ -3234 +4037 @@
         /* cleanup allocations */
         wc_ecc_curve_free(curve);
-    }
+        FREE_CURVE_SPECS();
+#endif /* WOLFSSL_SP_MATH */
+    }
+
+#ifdef HAVE_WOLF_BIGINT
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->k, &key->k.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(key->pubkey.x, &key->pubkey.x->raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(key->pubkey.y, &key->pubkey.y->raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(key->pubkey.z, &key->pubkey.z->raw);
+#endif
 
 #endif /* WOLFSSL_ATECC508A */
@@ -3311 +4127 @@
 }
 
-static INLINE int wc_ecc_alloc_rs(ecc_key* key, mp_int** r, mp_int** s)
-{
-    int err = 0;
-
-#ifndef WOLFSSL_ASYNC_CRYPT
-    (void)key;
-#endif
-
-    if (*r == NULL) {
-    #ifdef WOLFSSL_ASYNC_CRYPT
-        *r = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_BIGINT);
-        if (*r == NULL) {
-            return MEMORY_E;
-        }
-        key->r = *r;
-    #endif
-    }
-    if (*s == NULL) {
-    #ifdef WOLFSSL_ASYNC_CRYPT
-        *s = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_BIGINT);
-        if (*s == NULL) {
-            XFREE(*r, key->heap, DYNAMIC_TYPE_BIGINT);
-            return MEMORY_E;
-        }
-        key->s = *s;
-    #endif
-    }
-
-    /* initialize mp_int */
-    if (*r)
-        XMEMSET(*r, 0, sizeof(mp_int));
-    if (*s)
-        XMEMSET(*s, 0, sizeof(mp_int));
-
-    return err;
-}
-
-static INLINE void wc_ecc_free_rs(ecc_key* key, mp_int** r, mp_int** s)
-{
-    if (*r) {
-        mp_clear(*r);
-
-    #ifdef WOLFSSL_ASYNC_CRYPT
-        XFREE(*r, key->heap, DYNAMIC_TYPE_BIGINT);
-        key->r = NULL;
-    #endif
-        *r = NULL;
-    }
-    if (*s) {
-        mp_clear(*s);
-
-    #ifdef WOLFSSL_ASYNC_CRYPT
-        XFREE(*s, key->heap, DYNAMIC_TYPE_BIGINT);
-        key->s = NULL;
-    #endif
-        *s = NULL;
-    }
-    (void)key;
-}
-
 /* Setup dynamic pointers if using normal math for proper freeing */
 int wc_ecc_init_ex(ecc_key* key, void* heap, int devId)
@@ -3387 +4143 @@
     key->state = ECC_STATE_NONE;
 
+#if defined(PLUTON_CRYPTO_ECC) || defined(WOLF_CRYPTO_DEV)
+    key->devId = devId;
+#else
+    (void)devId;
+#endif
+
 #ifdef WOLFSSL_ATECC508A
-    key->slot = atmel_ecc_alloc();
-    if (key->slot == ATECC_INVALID_SLOT) {
-        return ECC_BAD_ARG_E;
-    }
+    key->slot = ATECC_INVALID_SLOT;
 #else
 #ifdef ALT_ECC_SIZE
@@ -3420 +4179 @@
     ret = wolfAsync_DevCtxInit(&key->asyncDev, WOLFSSL_ASYNC_MARKER_ECC,
                                                             key->heap, devId);
-#else
-    (void)devId;
 #endif
 
@@ -3431 +4188 @@
     return wc_ecc_init_ex(key, NULL, INVALID_DEVID);
 }
+
+#ifdef HAVE_PKCS11
+int wc_ecc_init_id(ecc_key* key, unsigned char* id, int len, void* heap,
+                   int devId)
+{
+    int ret = 0;
+
+    if (key == NULL)
+        ret = BAD_FUNC_ARG;
+    if (ret == 0 && (len < 0 || len > ECC_MAX_ID_LEN))
+        ret = BUFFER_E;
+
+    if (ret == 0)
+        ret = wc_ecc_init_ex(key, heap, devId);
+
+    if (ret == 0 && id != NULL && len != 0) {
+        XMEMCPY(key->id, id, len);
+        key->idLen = len;
+    }
+
+    return ret;
+}
+#endif
 
 int wc_ecc_set_flags(ecc_key* key, word32 flags)
@@ -3444 +4224 @@
 
 #ifndef NO_ASN
+
+#if defined(WOLFSSL_ATECC508A) || defined(PLUTON_CRYPTO_ECC)
+static int wc_ecc_sign_hash_hw(const byte* in, word32 inlen,
+    mp_int* r, mp_int* s, byte* out, word32 *outlen, WC_RNG* rng,
+    ecc_key* key)
+{
+    int err;
+
+#ifdef PLUTON_CRYPTO_ECC
+    if (key->devId != INVALID_DEVID) /* use hardware */
+#endif
+    {
+        word32 keysize = (word32)key->dp->size;
+
+        /* Check args */
+        if (keysize > ECC_MAX_CRYPTO_HW_SIZE || inlen != keysize ||
+                                                *outlen < keysize*2) {
+            return ECC_BAD_ARG_E;
+        }
+
+    #if defined(WOLFSSL_ATECC508A)
+        key->slot = atmel_ecc_alloc(ATMEL_SLOT_DEVICE);
+        if (key->slot == ATECC_INVALID_SLOT) {
+            return ECC_BAD_ARG_E;
+        }
+
+        /* Sign: Result is 32-bytes of R then 32-bytes of S */
+        err = atmel_ecc_sign(key->slot, in, out);
+        if (err != 0) {
+           return err;
+        }
+    #elif defined(PLUTON_CRYPTO_ECC)
+        {
+            /* perform ECC sign */
+            word32 raw_sig_size = *outlen;
+            err = Crypto_EccSign(in, inlen, out, &raw_sig_size);
+            if (err != CRYPTO_RES_SUCCESS || raw_sig_size != keysize*2){
+               return BAD_COND_E;
+            }
+        }
+    #endif
+
+        /* Load R and S */
+        err = mp_read_unsigned_bin(r, &out[0], keysize);
+        if (err != MP_OKAY) {
+            return err;
+        }
+        err = mp_read_unsigned_bin(s, &out[keysize], keysize);
+        if (err != MP_OKAY) {
+            return err;
+        }
+
+        /* Check for zeros */
+        if (mp_iszero(r) || mp_iszero(s)) {
+            return MP_ZERO_E;
+        }
+    }
+#ifdef PLUTON_CRYPTO_ECC
+    else {
+        err = wc_ecc_sign_hash_ex(in, inlen, rng, key, r, s);
+    }
+#endif
+    (void)rng;
+
+    return err;
+}
+#endif /* WOLFSSL_ATECC508A || PLUTON_CRYPTO_ECC */
+
 /**
  Sign a message digest
@@ -3458 +4306 @@
     int err;
     mp_int *r = NULL, *s = NULL;
-#ifndef WOLFSSL_ASYNC_CRYPT
+#if !defined(WOLFSSL_ASYNC_CRYPT) && !defined(WOLFSSL_SMALL_STACK)
     mp_int r_lcl, s_lcl;
-    r = &r_lcl;
-    s = &s_lcl;
 #endif
 
@@ -3468 +4314 @@
         return ECC_BAD_ARG_E;
     }
+
+#ifdef WOLF_CRYPTO_DEV
+    if (key->devId != INVALID_DEVID) {
+        err = wc_CryptoDev_EccSign(in, inlen, out, outlen, rng, key);
+        if (err != NOT_COMPILED_IN)
+            return err;
+    }
+#endif
+
+#ifdef WOLFSSL_ASYNC_CRYPT
+    err = wc_ecc_alloc_async(key);
+    if (err != 0)
+        return err;
+    r = key->r;
+    s = key->s;
+#elif !defined(WOLFSSL_SMALL_STACK)
+    r = &r_lcl;
+    s = &s_lcl;
+#else
+    r = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+    if (r == NULL)
+        return MEMORY_E;
+    s = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+    if (s == NULL) {
+        XFREE(r, key->heap, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+#endif
 
     switch(key->state) {
@@ -3474 +4348 @@
             key->state = ECC_STATE_SIGN_DO;
 
-            err = wc_ecc_alloc_rs(key, &r, &s);
-            if (err != 0)
-                break;
-
             if ((err = mp_init_multi(r, s, NULL, NULL, NULL, NULL)) != MP_OKAY){
                 break;
             }
 
-        #ifdef WOLFSSL_ATECC508A
-            /* Check args */
-            if (inlen != ATECC_KEY_SIZE || *outlen < SIGN_RSP_SIZE) {
-                return ECC_BAD_ARG_E;
-            }
-
-            /* Sign: Result is 32-bytes of R then 32-bytes of S */
-            err = atcatls_sign(key->slot, in, out);
-            if (err != ATCA_SUCCESS) {
-               return BAD_COND_E;
-           }
-
-            /* Load R and S */
-            err = mp_read_unsigned_bin(r, &out[0], ATECC_KEY_SIZE);
-            if (err != MP_OKAY) {
-                return err;
-            }
-            err = mp_read_unsigned_bin(s, &out[ATECC_KEY_SIZE], ATECC_KEY_SIZE);
-            if (err != MP_OKAY) {
-                return err;
-            }
-
-            /* Check for zeros */
-            if (mp_iszero(r) || mp_iszero(s)) {
-                return MP_ZERO_E;
-            }
-
+        /* hardware crypto */
+        #if defined(WOLFSSL_ATECC508A) || defined(PLUTON_CRYPTO_ECC)
+            err = wc_ecc_sign_hash_hw(in, inlen, r, s, out, outlen, rng, key);
         #else
-
             err = wc_ecc_sign_hash_ex(in, inlen, rng, key, r, s);
+        #endif
             if (err < 0) {
                 break;
             }
 
-        #endif /* WOLFSSL_ATECC508A */
             FALL_THROUGH;
 
@@ -3523 +4368 @@
 
         #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
-            /* restore r/s */
-            r = key->r;
-            s = key->s;
-
             if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ECC) {
-                /* only do this if not simulator, since it overwrites result */
+                #ifdef HAVE_CAVIUM_V
+                    /* Nitrox requires r and s in sep buffer, so split it */
+                    NitroxEccRsSplit(key, &r->raw, &s->raw);
+                #endif
                 #ifndef WOLFSSL_ASYNC_CRYPT_TEST
+                    /* only do this if not simulator, since it overwrites result */
                     wc_bigint_to_mp(&r->raw, r);
                     wc_bigint_to_mp(&s->raw, s);
@@ -3539 +4384 @@
             err = StoreECC_DSA_Sig(out, outlen, r, s);
 
-            /* always free r/s */
+            /* done with R/S */
             mp_clear(r);
             mp_clear(s);
+        #if !defined(WOLFSSL_ASYNC_CRYPT) && defined(WOLFSSL_SMALL_STACK)
+            XFREE(s, key->heap, DYNAMIC_TYPE_ECC);
+            XFREE(r, key->heap, DYNAMIC_TYPE_ECC);
+        #endif
             break;
 
         default:
             err = BAD_STATE_E;
+            break;
     }
 
@@ -3555 +4405 @@
 
     /* cleanup */
-    wc_ecc_free_rs(key, &r, &s);
+#ifdef WOLFSSL_ASYNC_CRYPT
+    wc_ecc_free_async(key);
+#endif
     key->state = ECC_STATE_NONE;
 
@@ -3576 +4428 @@
 {
    int    err;
-   mp_int e;
-   DECLARE_CURVE_SPECS(1)
+#ifndef WOLFSSL_SP_MATH
+   mp_int* e;
+#if (!defined(WOLFSSL_ASYNC_CRYPT) || !defined(HAVE_CAVIUM_V)) && \
+                                                   !defined(WOLFSSL_SMALL_STACK)
+   mp_int  e_lcl;
+#endif
+   DECLARE_CURVE_SPECS(curve, 1);
+#endif /* !WOLFSSL_SP_MATH */
 
    if (in == NULL || r == NULL || s == NULL || key == NULL || rng == NULL)
@@ -3592 +4450 @@
    }
 
+#ifdef WOLFSSL_SP_MATH
+    if (key->idx != ECC_CUSTOM_IDX && ecc_sets[key->idx].id == ECC_SECP256R1)
+        return sp_ecc_sign_256(in, inlen, rng, &key->k, r, s, key->heap);
+    else
+        return WC_KEY_SIZE_E;
+#else
 #ifdef WOLFSSL_HAVE_SP_ECC
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC) && \
@@ -3603 +4467 @@
 #endif
     }
-#endif
+#endif /* WOLFSSL_HAVE_SP_ECC */
+
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC) && \
@@ -3621 +4486 @@
 #endif
 
+   ALLOC_CURVE_SPECS(1);
+
+#if defined(WOLFSSL_ASYNC_CRYPT) && defined(HAVE_CAVIUM_V)
+   err = wc_ecc_alloc_mpint(key, &key->e);
+   if (err != 0) {
+      FREE_CURVE_SPECS();
+      return err;
+   }
+   e = key->e;
+#elif !defined(WOLFSSL_SMALL_STACK)
+   e = &e_lcl;
+#else
+   e = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+   if (e == NULL) {
+      FREE_CURVE_SPECS();
+      return MEMORY_E;
+   }
+#endif
+
    /* get the hash and load it as a bignum into 'e' */
    /* init the bignums */
-   if ((err = mp_init(&e)) != MP_OKAY) {
+   if ((err = mp_init(e)) != MP_OKAY) {
+   #ifdef WOLFSSL_SMALL_STACK
+      XFREE(e, key->heap, DYNAMIC_TYPE_ECC);
+   #endif
+      FREE_CURVE_SPECS();
       return err;
    }
@@ -3638 +4526 @@
        if ((WOLFSSL_BIT_SIZE * inlen) > orderBits)
            inlen = (orderBits + WOLFSSL_BIT_SIZE - 1) / WOLFSSL_BIT_SIZE;
-       err = mp_read_unsigned_bin(&e, (byte*)in, inlen);
+       err = mp_read_unsigned_bin(e, (byte*)in, inlen);
 
        /* may still need bit truncation too */
        if (err == MP_OKAY && (WOLFSSL_BIT_SIZE * inlen) > orderBits)
-           mp_rshb(&e, WOLFSSL_BIT_SIZE - (orderBits & 0x7));
+           mp_rshb(e, WOLFSSL_BIT_SIZE - (orderBits & 0x7));
    }
 
@@ -3648 +4536 @@
    if (err == MP_OKAY) {
        int loop_check = 0;
-       ecc_key pubkey;
+   #ifdef WOLFSSL_SMALL_STACK
+       ecc_key* pubkey = NULL;
+   #else
+       ecc_key  pubkey[1];
+   #endif
 
    #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
         if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ECC) {
-        #ifdef HAVE_CAVIUM
-            /* TODO: Not implemented */
-        #elif defined(HAVE_INTEL_QA)
-           mp_int k;
-
-           err = mp_init(&k);
+        #if defined(HAVE_CAVIUM_V) || defined(HAVE_INTEL_QA)
+        #ifdef HAVE_CAVIUM_V
+            if (NitroxEccIsCurveSupported(key))
+        #endif
+            {
+               word32 keySz = key->dp->size;
+               mp_int* k;
+            #ifdef HAVE_CAVIUM_V
+               err = wc_ecc_alloc_mpint(key, &key->signK);
+               if (err != 0)
+                  return err;
+               k = key->signK;
+            #else
+               mp_int k_lcl;
+               k = &k_lcl;
+            #endif
+
+               err = mp_init(k);
+
            /* make sure r and s are allocated */
+           #ifdef HAVE_CAVIUM_V
+               /* Nitrox V needs single buffer for R and S */
+               if (err == MP_OKAY)
+                   err = wc_bigint_alloc(&key->r->raw, NitroxEccGetSize(key)*2);
+               /* Nitrox V only needs Prime and Order */
+               if (err == MP_OKAY)
+                   err = wc_ecc_curve_load(key->dp, &curve,
+                        (ECC_CURVE_FIELD_PRIME | ECC_CURVE_FIELD_ORDER));
+           #else
            if (err == MP_OKAY)
                err = wc_bigint_alloc(&key->r->raw, key->dp->size);
            if (err == MP_OKAY)
+                   err = wc_ecc_curve_load(key->dp, &curve, ECC_CURVE_FIELD_ALL);
+           #endif
+               if (err == MP_OKAY)
                err = wc_bigint_alloc(&key->s->raw, key->dp->size);
+
            /* load e and k */
            if (err == MP_OKAY)
-               err = wc_mp_to_bigint(&e, &e.raw);
+                   err = wc_mp_to_bigint_sz(e, &e->raw, keySz);
            if (err == MP_OKAY)
-               err = wc_mp_to_bigint(&key->k, &key->k.raw);
+                   err = wc_mp_to_bigint_sz(&key->k, &key->k.raw, keySz);
            if (err == MP_OKAY)
-               err = wc_ecc_curve_load(key->dp, &curve, ECC_CURVE_FIELD_ALL);
+                   err = wc_ecc_gen_k(rng, key->dp->size, k, curve->order);
            if (err == MP_OKAY)
-               err = wc_ecc_gen_k(rng, key->dp->size, &k, curve->order);
+                   err = wc_mp_to_bigint_sz(k, &k->raw, keySz);
+
+           #ifdef HAVE_CAVIUM_V
            if (err == MP_OKAY)
-               err = wc_mp_to_bigint(&k, &k.raw);
+                   err = NitroxEcdsaSign(key, &e->raw, &key->k.raw, &k->raw,
+                    &r->raw, &s->raw, &curve->prime->raw, &curve->order->raw);
+           #else
            if (err == MP_OKAY)
-               err = IntelQaEcdsaSign(&key->asyncDev, &e.raw, &key->k.raw,
-                  &k.raw, &r->raw, &s->raw, &curve->Af->raw, &curve->Bf->raw,
+                   err = IntelQaEcdsaSign(&key->asyncDev, &e->raw, &key->k.raw,
+                      &k->raw, &r->raw, &s->raw, &curve->Af->raw, &curve->Bf->raw,
                   &curve->prime->raw, &curve->order->raw, &curve->Gx->raw,
                   &curve->Gy->raw);
-
-           mp_clear(&e);
-           mp_clear(&k);
+           #endif
+
+           #ifndef HAVE_CAVIUM_V
+               mp_clear(e);
+               mp_clear(k);
+           #endif
            wc_ecc_curve_free(curve);
+               FREE_CURVE_SPECS();
 
            return err;
-       #endif
+           }
+       #endif /* HAVE_CAVIUM_V || HAVE_INTEL_QA */
        }
    #endif /* WOLFSSL_ASYNC_CRYPT */
 
+   #ifdef WOLFSSL_SMALL_STACK
+       pubkey = (ecc_key*)XMALLOC(sizeof(ecc_key), key->heap, DYNAMIC_TYPE_ECC);
+       if (pubkey == NULL)
+           err = MEMORY_E;
+   #endif
+
        /* don't use async for key, since we don't support async return here */
-       if (wc_ecc_init_ex(&pubkey, key->heap, INVALID_DEVID) == MP_OKAY) {
+       if (err == MP_OKAY && (err = wc_ecc_init_ex(pubkey, key->heap,
+                                                   INVALID_DEVID)) == MP_OKAY) {
+       #ifdef WOLFSSL_SMALL_STACK
+           mp_int* b = NULL;
+       #else
+           mp_int  b[1];
+       #endif
+
+       #ifdef WOLFSSL_SMALL_STACK
+           if (err == MP_OKAY) {
+               b = (mp_int*)XMALLOC(sizeof(mp_int), key->heap,
+                                                              DYNAMIC_TYPE_ECC);
+               if (b == NULL)
+                   err = MEMORY_E;
+           }
+       #endif
+
+           if (err == MP_OKAY) {
+               err = mp_init(b);
+           }
+
        #ifdef WOLFSSL_CUSTOM_CURVES
            /* if custom curve, apply params to pubkey */
-           if (key->idx == ECC_CUSTOM_IDX) {
-               wc_ecc_set_custom_curve(&pubkey, key->dp);
+           if (err == MP_OKAY && key->idx == ECC_CUSTOM_IDX) {
+               err = wc_ecc_set_custom_curve(pubkey, key->dp);
            }
        #endif
 
-           for (;;) {
+           if (err == MP_OKAY) {
+               /* Generate blinding value - non-zero value. */
+               do {
+                   if (++loop_check > 64) {
+                        err = RNG_FAILURE_E;
+                        break;
+                   }
+
+                   err = wc_ecc_gen_k(rng, key->dp->size, b, curve->order);
+               }
+               while (err == MP_ZERO_E);
+               loop_check = 0;
+           }
+
+           for (; err == MP_OKAY;) {
                if (++loop_check > 64) {
                     err = RNG_FAILURE_E;
                     break;
                }
-               err = wc_ecc_make_key_ex(rng, key->dp->size, &pubkey,
+               err = wc_ecc_make_key_ex(rng, key->dp->size, pubkey,
                                                               key->dp->id);
                if (err != MP_OKAY) break;
 
                /* find r = x1 mod n */
-               err = mp_mod(pubkey.pubkey.x, curve->order, r);
+               err = mp_mod(pubkey->pubkey.x, curve->order, r);
                if (err != MP_OKAY) break;
 
                if (mp_iszero(r) == MP_YES) {
                 #ifndef ALT_ECC_SIZE
-                   mp_clear(pubkey.pubkey.x);
-                   mp_clear(pubkey.pubkey.y);
-                   mp_clear(pubkey.pubkey.z);
+                   mp_clear(pubkey->pubkey.x);
+                   mp_clear(pubkey->pubkey.y);
+                   mp_clear(pubkey->pubkey.z);
                 #endif
-                   mp_forcezero(&pubkey.k);
+                   mp_forcezero(&pubkey->k);
                }
                else {
-                   /* find s = (e + xr)/k */
-                   err = mp_invmod(&pubkey.k, curve->order, &pubkey.k);
+                   /* find s = (e + xr)/k
+                             = b.(e/k.b + x.r/k.b) */
+
+                   /* k = k.b */
+                   err = mp_mulmod(&pubkey->k, b, curve->order, &pubkey->k);
                    if (err != MP_OKAY) break;
 
-                   /* s = xr */
+                   /* k = 1/k.b */
+                   err = mp_invmod(&pubkey->k, curve->order, &pubkey->k);
+                   if (err != MP_OKAY) break;
+
+                   /* s = x.r */
                    err = mp_mulmod(&key->k, r, curve->order, s);
                    if (err != MP_OKAY) break;
 
-                   /* s = e +  xr */
-                   err = mp_add(&e, s, s);
+                   /* s = x.r/k.b */
+                   err = mp_mulmod(&pubkey->k, s, curve->order, s);
                    if (err != MP_OKAY) break;
 
-                   /* s = e +  xr */
+                   /* e = e/k.b */
+                   err = mp_mulmod(&pubkey->k, e, curve->order, e);
+                   if (err != MP_OKAY) break;
+
+                   /* s = e/k.b + x.r/k.b
+                        = (e + x.r)/k.b */
+                   err = mp_add(e, s, s);
+                   if (err != MP_OKAY) break;
+
+                   /* s = b.(e + x.r)/k.b
+                        = (e + x.r)/k */
+                   err = mp_mulmod(s, b, curve->order, s);
+                   if (err != MP_OKAY) break;
+
+                   /* s = (e + xr)/k */
                    err = mp_mod(s, curve->order, s);
                    if (err != MP_OKAY) break;
-
-                   /* s = (e + xr)/k */
-                   err = mp_mulmod(s, &pubkey.k, curve->order, s);
 
                    if (mp_iszero(s) == MP_NO)
@@ -3743 +4728 @@
                 }
            }
-           wc_ecc_free(&pubkey);
+           mp_clear(b);
+           mp_free(b);
+       #ifdef WOLFSSL_SMALL_STACK
+           XFREE(b, key->heap, DYNAMIC_TYPE_ECC);
+       #endif
+           wc_ecc_free(pubkey);
+       #ifdef WOLFSSL_SMALL_STACK
+           XFREE(pubkey, key->heap, DYNAMIC_TYPE_ECC);
+       #endif
        }
    }
 
-   mp_clear(&e);
+   mp_clear(e);
    wc_ecc_curve_free(curve);
+#ifdef WOLFSSL_SMALL_STACK
+   XFREE(e, key->heap, DYNAMIC_TYPE_ECC);
+#endif
+   FREE_CURVE_SPECS();
+#endif /* WOLFSSL_SP_MATH */
 
    return err;
@@ -3754 +4752 @@
 #endif /* WOLFSSL_ATECC508A */
 #endif /* HAVE_ECC_SIGN */
+
+#ifdef WOLFSSL_CUSTOM_CURVES
+void wc_ecc_free_curve(const ecc_set_type* curve, void* heap)
+{
+    if (curve->prime != NULL)
+        XFREE((void*)curve->prime, heap, DYNAMIC_TYPE_ECC_BUFFER);
+    if (curve->Af != NULL)
+        XFREE((void*)curve->Af, heap, DYNAMIC_TYPE_ECC_BUFFER);
+    if (curve->Bf != NULL)
+        XFREE((void*)curve->Bf, heap, DYNAMIC_TYPE_ECC_BUFFER);
+    if (curve->order != NULL)
+        XFREE((void*)curve->order, heap, DYNAMIC_TYPE_ECC_BUFFER);
+    if (curve->Gx != NULL)
+        XFREE((void*)curve->Gx, heap, DYNAMIC_TYPE_ECC_BUFFER);
+    if (curve->Gy != NULL)
+        XFREE((void*)curve->Gy, heap, DYNAMIC_TYPE_ECC_BUFFER);
+
+    XFREE((void*)curve, heap, DYNAMIC_TYPE_ECC_BUFFER);
+
+    (void)heap;
+}
+#endif /* WOLFSSL_CUSTOM_CURVES */
 
 /**
@@ -3759 +4779 @@
   key   The key you wish to free
 */
-void wc_ecc_free(ecc_key* key)
+int wc_ecc_free(ecc_key* key)
 {
     if (key == NULL) {
-        return;
-    }
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
+        return 0;
+    }
+
+#ifdef WOLFSSL_ASYNC_CRYPT
+    #ifdef WC_ASYNC_ENABLE_ECC
     wolfAsync_DevCtxFree(&key->asyncDev, WOLFSSL_ASYNC_MARKER_ECC);
-    wc_ecc_free_rs(key, &key->r, &key->s);
+    #endif
+    wc_ecc_free_async(key);
 #endif
 
 #ifdef WOLFSSL_ATECC508A
    atmel_ecc_free(key->slot);
-   key->slot = -1;
+    key->slot = ATECC_INVALID_SLOT;
 #else
 
@@ -3781 +4803 @@
     mp_forcezero(&key->k);
 #endif /* WOLFSSL_ATECC508A */
-}
-
+
+#ifdef WOLFSSL_CUSTOM_CURVES
+    if (key->deallocSet && key->dp != NULL)
+        wc_ecc_free_curve(key->dp, key->heap);
+#endif
+
+    return 0;
+}
+
+#if !defined(WOLFSSL_SP_MATH) && !defined(WOLFSSL_ATECC508A)
 #ifdef ECC_SHAMIR
 
@@ -3801 +4831 @@
                              void* heap)
 #else
-static int ecc_mul2add(ecc_point* A, mp_int* kA,
+int ecc_mul2add(ecc_point* A, mp_int* kA,
                     ecc_point* B, mp_int* kB,
                     ecc_point* C, mp_int* a, mp_int* modulus,
@@ -3807 +4837 @@
 #endif
 {
-  ecc_point*     precomp[16];
+#ifdef WOLFSSL_SMALL_STACK
+  ecc_point**    precomp = NULL;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+  ecc_key        key;
+#endif
+#else
+  ecc_point*     precomp[SHAMIR_PRECOMP_SZ];
+#endif
   unsigned       bitbufA, bitbufB, lenA, lenB, len, nA, nB, nibble;
   unsigned char* tA;
   unsigned char* tB;
   int            err = MP_OKAY, first, x, y;
-  mp_digit mp;
+  mp_digit       mp = 0;
 
   /* argchks */
@@ -3830 +4867 @@
      return GEN_MEM_ERR;
   }
+#ifdef WOLFSSL_SMALL_STACK
+  precomp = (ecc_point**)XMALLOC(sizeof(ecc_point*) * SHAMIR_PRECOMP_SZ, heap,
+                                                       DYNAMIC_TYPE_ECC_BUFFER);
+  if (precomp == NULL) {
+     XFREE(tB, heap, DYNAMIC_TYPE_ECC_BUFFER);
+     XFREE(tA, heap, DYNAMIC_TYPE_ECC_BUFFER);
+     return GEN_MEM_ERR;
+  }
+#endif
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+  key.t1 = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+  key.t2 = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+#ifdef ALT_ECC_SIZE
+  key.x = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+  key.y = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+  key.z = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+#endif
+  if (key.t1 == NULL || key.t2 == NULL
+#ifdef ALT_ECC_SIZE
+     || key.x == NULL || key.y == NULL || key.z == NULL
+#endif
+  ) {
+#ifdef ALT_ECC_SIZE
+      XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+      XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+      XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+      XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+      XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+      XFREE(precomp, heap, DYNAMIC_TYPE_ECC_BUFFER);
+      XFREE(tB, heap, DYNAMIC_TYPE_ECC_BUFFER);
+      XFREE(tA, heap, DYNAMIC_TYPE_ECC_BUFFER);
+      return MEMORY_E;
+  }
+  C->key = &key;
+#endif /* WOLFSSL_SMALL_STACK_CACHE */
 
   /* init variables */
   XMEMSET(tA, 0, ECC_BUFSIZE);
   XMEMSET(tB, 0, ECC_BUFSIZE);
+#ifndef WOLFSSL_SMALL_STACK
   XMEMSET(precomp, 0, sizeof(precomp));
+#else
+  XMEMSET(precomp, 0, sizeof(ecc_point*) * SHAMIR_PRECOMP_SZ);
+#endif
 
   /* get sizes */
@@ -3856 +4933 @@
     /* allocate the table */
     if (err == MP_OKAY) {
-        for (x = 0; x < 16; x++) {
+        for (x = 0; x < SHAMIR_PRECOMP_SZ; x++) {
             precomp[x] = wc_ecc_new_point_h(heap);
             if (precomp[x] == NULL) {
@@ -3862 +4939 @@
                 break;
             }
+        #ifdef WOLFSSL_SMALL_STACK_CACHE
+            precomp[x]->key = &key;
+        #endif
         }
     }
@@ -3871 +4951 @@
 
   if (err == MP_OKAY) {
-    mp_int mu;
-    err = mp_init(&mu);
+  #ifdef WOLFSSL_SMALL_STACK
+    mp_int* mu = NULL;
+  #else
+    mp_int  mu[1];
+  #endif
+  #ifdef WOLFSSL_SMALL_STACK
+    mu = (mp_int*)XMALLOC(sizeof(mp_int), heap, DYNAMIC_TYPE_ECC);
+    if (mu == NULL)
+        err = MEMORY_E;
+  #endif
     if (err == MP_OKAY) {
-      err = mp_montgomery_calc_normalization(&mu, modulus);
+        err = mp_init(mu);
+    }
+    if (err == MP_OKAY) {
+      err = mp_montgomery_calc_normalization(mu, modulus);
 
       if (err == MP_OKAY)
         /* copy ones ... */
-        err = mp_mulmod(A->x, &mu, modulus, precomp[1]->x);
+        err = mp_mulmod(A->x, mu, modulus, precomp[1]->x);
 
       if (err == MP_OKAY)
-        err = mp_mulmod(A->y, &mu, modulus, precomp[1]->y);
+        err = mp_mulmod(A->y, mu, modulus, precomp[1]->y);
       if (err == MP_OKAY)
-        err = mp_mulmod(A->z, &mu, modulus, precomp[1]->z);
+        err = mp_mulmod(A->z, mu, modulus, precomp[1]->z);
 
       if (err == MP_OKAY)
-        err = mp_mulmod(B->x, &mu, modulus, precomp[1<<2]->x);
+        err = mp_mulmod(B->x, mu, modulus, precomp[1<<2]->x);
       if (err == MP_OKAY)
-        err = mp_mulmod(B->y, &mu, modulus, precomp[1<<2]->y);
+        err = mp_mulmod(B->y, mu, modulus, precomp[1<<2]->y);
       if (err == MP_OKAY)
-        err = mp_mulmod(B->z, &mu, modulus, precomp[1<<2]->z);
+        err = mp_mulmod(B->z, mu, modulus, precomp[1<<2]->z);
 
       /* done with mu */
-      mp_clear(&mu);
+      mp_clear(mu);
+  #ifdef WOLFSSL_SMALL_STACK
+      XFREE(mu, heap, DYNAMIC_TYPE_ECC);
+  #endif
     }
   }
@@ -3916 +5010 @@
     for (x = 1; x < 4; x++) {
         for (y = 1; y < 4; y++) {
-            if (err == MP_OKAY)
+        if (err == MP_OKAY) {
                 err = ecc_projective_add_point(precomp[x], precomp[(y<<2)],
                                                precomp[x+(y<<2)], a, modulus, mp);
         }
     }
+  }
   }
 
@@ -3994 +5089 @@
 
   /* clean up */
-  for (x = 0; x < 16; x++) {
+  for (x = 0; x < SHAMIR_PRECOMP_SZ; x++) {
      wc_ecc_del_point_h(precomp[x], heap);
   }
@@ -4000 +5095 @@
   ForceZero(tA, ECC_BUFSIZE);
   ForceZero(tB, ECC_BUFSIZE);
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+#ifdef ALT_ECC_SIZE
+  XFREE(key.z, heap, DYNAMIC_TYPE_ECC);
+  XFREE(key.y, heap, DYNAMIC_TYPE_ECC);
+  XFREE(key.x, heap, DYNAMIC_TYPE_ECC);
+#endif
+  XFREE(key.t2, heap, DYNAMIC_TYPE_ECC);
+  XFREE(key.t1, heap, DYNAMIC_TYPE_ECC);
+  C->key = NULL;
+#endif
+#ifdef WOLFSSL_SMALL_STACK
+  XFREE(precomp, heap, DYNAMIC_TYPE_ECC_BUFFER);
+#endif
+  XFREE(tB, heap, DYNAMIC_TYPE_ECC_BUFFER);
   XFREE(tA, heap, DYNAMIC_TYPE_ECC_BUFFER);
-  XFREE(tB, heap, DYNAMIC_TYPE_ECC_BUFFER);
 
   return err;
@@ -4007 +5115 @@
 
 #endif /* ECC_SHAMIR */
+#endif /* !WOLFSSL_SP_MATH && !WOLFSSL_ATECC508A */
 
 
@@ -4037 +5146 @@
     mp_int *r = NULL, *s = NULL;
 #ifndef WOLFSSL_ASYNC_CRYPT
-    mp_int r_lcl, s_lcl;
-    r = &r_lcl;
-    s = &s_lcl;
+#ifndef WOLFSSL_SMALL_STACK
+    mp_int r_lcl[1], s_lcl[1];
+#endif
 #endif
 
@@ -4045 +5154 @@
         return ECC_BAD_ARG_E;
     }
+
+#ifdef WOLF_CRYPTO_DEV
+    if (key->devId != INVALID_DEVID) {
+        err = wc_CryptoDev_EccVerify(sig, siglen, hash, hashlen, res, key);
+        if (err != NOT_COMPILED_IN)
+            return err;
+    }
+#endif
+
+#ifdef WOLFSSL_ASYNC_CRYPT
+    err = wc_ecc_alloc_async(key);
+    if (err != 0)
+        return err;
+    r = key->r;
+    s = key->s;
+#else
+    #ifndef WOLFSSL_SMALL_STACK
+    r = r_lcl;
+    s = s_lcl;
+    #else
+    r = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+    if (r == NULL)
+        return MEMORY_E;
+    s = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+    if (s == NULL) {
+        XFREE(r, key->heap, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+    #endif
+    XMEMSET(r, 0, sizeof(mp_int));
+    XMEMSET(s, 0, sizeof(mp_int));
+#endif /* WOLFSSL_ASYNC_CRYPT */
 
     switch(key->state) {
@@ -4058 +5199 @@
              * the rest of this function will execute, and everything
              * gets cleaned up at the end. */
-            err = wc_ecc_alloc_rs(key, &r, &s);
-            if (err != 0)
-                break;
-
             /* decode DSA header */
             err = DecodeECC_DSA_Sig(sig, siglen, r, s);
@@ -4073 +5210 @@
 
             err = wc_ecc_verify_hash_ex(r, s, hash, hashlen, res, key);
+
+        #ifndef WOLFSSL_ASYNC_CRYPT
+            /* done with R/S */
+            mp_clear(r);
+            mp_clear(s);
+        #ifdef WOLFSSL_SMALL_STACK
+            XFREE(s, key->heap, DYNAMIC_TYPE_ECC);
+            XFREE(r, key->heap, DYNAMIC_TYPE_ECC);
+            r = NULL;
+            s = NULL;
+        #endif
+        #endif
+
             if (err < 0) {
                 break;
@@ -4081 +5231 @@
             key->state = ECC_STATE_VERIFY_RES;
             err = 0;
-
-        #ifdef WOLFSSL_ASYNC_CRYPT
-            /* restore r/s */
-            r = key->r;
-            s = key->s;
-        #endif
-
-            /* done with R/S */
-            mp_clear(r);
-            mp_clear(s);
             break;
 
@@ -4104 +5244 @@
 
     /* cleanup */
-    wc_ecc_free_rs(key, &r, &s);
+#ifdef WOLFSSL_ASYNC_CRYPT
+    wc_ecc_free_async(key);
+#endif
     key->state = ECC_STATE_NONE;
+
+#ifdef WOLFSSL_SMALL_STACK
+    if (err != WC_PENDING_E) {
+            XFREE(s, key->heap, DYNAMIC_TYPE_ECC);
+            XFREE(r, key->heap, DYNAMIC_TYPE_ECC);
+            r = NULL;
+            s = NULL;
+    }
+#endif
 
     return err;
@@ -4126 +5277 @@
 {
    int           err;
-#ifndef WOLFSSL_ATECC508A
+   word32        keySz;
+#ifdef WOLFSSL_ATECC508A
+   byte sigRS[ATECC_KEY_SIZE*2];
+#elif !defined(WOLFSSL_SP_MATH)
    int          did_init = 0;
    ecc_point    *mG = NULL, *mQ = NULL;
-   mp_int        v;
-   mp_int        w;
-   mp_int        u1;
-   mp_int        u2;
-   mp_int        e;
-   DECLARE_CURVE_SPECS(ECC_CURVE_FIELD_COUNT)
-#else
-   byte sigRS[ATECC_KEY_SIZE*2];
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int*       v = NULL;
+   mp_int*       w = NULL;
+   mp_int*       u1 = NULL;
+   mp_int*       u2 = NULL;
+#if !defined(WOLFSSL_ASYNC_CRYPT) || !defined(HAVE_CAVIUM_V)
+   mp_int*       e_lcl = NULL;
+#endif
+#else /* WOLFSSL_SMALL_STACK */
+   mp_int        v[1];
+   mp_int        w[1];
+   mp_int        u1[1];
+   mp_int        u2[1];
+#if !defined(WOLFSSL_ASYNC_CRYPT) || !defined(HAVE_CAVIUM_V)
+   mp_int        e_lcl[1];
+#endif
+#endif /* WOLFSSL_SMALL_STACK */
+   mp_int*       e;
+   DECLARE_CURVE_SPECS(curve, ECC_CURVE_FIELD_COUNT);
 #endif
 
@@ -4149 +5314 @@
       return ECC_BAD_ARG_E;
    }
+
+   keySz = key->dp->size;
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC) && \
@@ -4172 +5339 @@
         return err;
     }
-    err = mp_to_unsigned_bin(s, &sigRS[ATECC_KEY_SIZE]);
+    err = mp_to_unsigned_bin(s, &sigRS[keySz]);
     if (err != MP_OKAY) {
         return err;
     }
 
-    err = atcatls_verify(hash, sigRS, key->pubkey, (bool*)res);
-    if (err != ATCA_SUCCESS) {
-       return BAD_COND_E;
-   }
+    err = atmel_ecc_verify(hash, sigRS, key->pubkey_raw, res);
+    if (err != 0) {
+       return err;
+   }
+    (void)hashlen;
 
 #else
-
   /* checking if private key with no public part */
   if (key->type == ECC_PRIVATEKEY_ONLY) {
@@ -4194 +5361 @@
   }
 
+#ifdef WOLFSSL_SP_MATH
+  if (key->idx != ECC_CUSTOM_IDX && ecc_sets[key->idx].id == ECC_SECP256R1) {
+      return sp_ecc_verify_256(hash, hashlen, key->pubkey.x, key->pubkey.y,
+                                           key->pubkey.z, r, s, res, key->heap);
+  }
+  else
+      return WC_KEY_SIZE_E;
+#else
 #ifdef WOLFSSL_HAVE_SP_ECC
 #ifndef WOLFSSL_SP_NO_256
@@ -4205 +5380 @@
                                      key->pubkey.z,r, s, res, key->heap);
     }
-#endif
-#endif
-
-   err = mp_init(&e);
+#endif /* WOLFSSL_SP_NO_256 */
+#endif /* WOLFSSL_HAVE_SP_ECC */
+
+   ALLOC_CURVE_SPECS(ECC_CURVE_FIELD_COUNT);
+
+#if defined(WOLFSSL_ASYNC_CRYPT) && defined(HAVE_CAVIUM_V)
+   err = wc_ecc_alloc_mpint(key, &key->e);
+   if (err != 0) {
+      FREE_CURVE_SPECS();
+      return err;
+   }
+   e = key->e;
+#else
+#ifdef WOLFSSL_SMALL_STACK
+   e_lcl = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+   if (e_lcl == NULL) {
+       FREE_CURVE_SPECS();
+       return MEMORY_E;
+   }
+#endif
+   e = e_lcl;
+#endif
+
+   err = mp_init(e);
    if (err != MP_OKAY)
       return MEMORY_E;
@@ -4232 +5427 @@
        if ( (WOLFSSL_BIT_SIZE * hashlen) > orderBits)
            hashlen = (orderBits + WOLFSSL_BIT_SIZE - 1) / WOLFSSL_BIT_SIZE;
-       err = mp_read_unsigned_bin(&e, hash, hashlen);
+       err = mp_read_unsigned_bin(e, hash, hashlen);
 
        /* may still need bit truncation too */
        if (err == MP_OKAY && (WOLFSSL_BIT_SIZE * hashlen) > orderBits)
-           mp_rshb(&e, WOLFSSL_BIT_SIZE - (orderBits & 0x7));
+           mp_rshb(e, WOLFSSL_BIT_SIZE - (orderBits & 0x7));
    }
 
@@ -4242 +5437 @@
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_ECC)
    if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_ECC) {
-   #ifdef HAVE_CAVIUM
-      /* TODO: Not implemented */
-   #elif defined(HAVE_INTEL_QA)
-      err = wc_mp_to_bigint(&e, &e.raw);
+   #if defined(HAVE_CAVIUM_V) || defined(HAVE_INTEL_QA)
+   #ifdef HAVE_CAVIUM_V
+      if (NitroxEccIsCurveSupported(key))
+   #endif
+      {
+          err = wc_mp_to_bigint_sz(e, &e->raw, keySz);
       if (err == MP_OKAY)
-          err = wc_mp_to_bigint(key->pubkey.x, &key->pubkey.x->raw);
+              err = wc_mp_to_bigint_sz(key->pubkey.x, &key->pubkey.x->raw, keySz);
       if (err == MP_OKAY)
-          err = wc_mp_to_bigint(key->pubkey.y, &key->pubkey.y->raw);
+              err = wc_mp_to_bigint_sz(key->pubkey.y, &key->pubkey.y->raw, keySz);
       if (err == MP_OKAY)
-          err = IntelQaEcdsaVerify(&key->asyncDev, &e.raw, &key->pubkey.x->raw,
+          #ifdef HAVE_CAVIUM_V
+              err = NitroxEcdsaVerify(key, &e->raw, &key->pubkey.x->raw,
+                    &key->pubkey.y->raw, &r->raw, &s->raw,
+                    &curve->prime->raw, &curve->order->raw, res);
+          #else
+              err = IntelQaEcdsaVerify(&key->asyncDev, &e->raw, &key->pubkey.x->raw,
                 &key->pubkey.y->raw, &r->raw, &s->raw, &curve->Af->raw,
                 &curve->Bf->raw, &curve->prime->raw, &curve->order->raw,
                 &curve->Gx->raw, &curve->Gy->raw, res);
-
-      mp_clear(&e);
-
+          #endif
+
+      #ifndef HAVE_CAVIUM_V
+          mp_clear(e);
+      #endif
       wc_ecc_curve_free(curve);
+          FREE_CURVE_SPECS();
 
       return err;
-   #endif
+      }
+   #endif /* HAVE_CAVIUM_V || HAVE_INTEL_QA */
    }
 #endif /* WOLFSSL_ASYNC_CRYPT */
+
+#ifdef WOLFSSL_SMALL_STACK
+   if (err == MP_OKAY) {
+       v = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+       if (v == NULL)
+           err = MEMORY_E;
+   }
+   if (err == MP_OKAY) {
+       w = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+       if (w == NULL)
+           err = MEMORY_E;
+   }
+   if (err == MP_OKAY) {
+       u1 = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+       if (u1 == NULL)
+           err = MEMORY_E;
+   }
+   if (err == MP_OKAY) {
+       u2 = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+       if (u2 == NULL)
+           err = MEMORY_E;
+   }
+#endif
 
    /* allocate ints */
    if (err == MP_OKAY) {
-       if ((err = mp_init_multi(&v, &w, &u1, &u2, NULL, NULL)) != MP_OKAY) {
+       if ((err = mp_init_multi(v, w, u1, u2, NULL, NULL)) != MP_OKAY) {
           err = MEMORY_E;
        }
@@ -4283 +5512 @@
    /*  w  = s^-1 mod n */
    if (err == MP_OKAY)
-       err = mp_invmod(s, curve->order, &w);
+       err = mp_invmod(s, curve->order, w);
 
    /* u1 = ew */
    if (err == MP_OKAY)
-       err = mp_mulmod(&e, &w, curve->order, &u1);
+       err = mp_mulmod(e, w, curve->order, u1);
 
    /* u2 = rw */
    if (err == MP_OKAY)
-       err = mp_mulmod(r, &w, curve->order, &u2);
+       err = mp_mulmod(r, w, curve->order, u2);
 
    /* find mG and mQ */
@@ -4311 +5540 @@
    /* use PKHA to compute u1*mG + u2*mQ */
    if (err == MP_OKAY)
-       err = wc_ecc_mulmod_ex(&u1, mG, mG, curve->Af, curve->prime, 0, key->heap);
-   if (err == MP_OKAY)
-       err = wc_ecc_mulmod_ex(&u2, mQ, mQ, curve->Af, curve->prime, 0, key->heap);
+       err = wc_ecc_mulmod_ex(u1, mG, mG, curve->Af, curve->prime, 0, key->heap);
+   if (err == MP_OKAY)
+       err = wc_ecc_mulmod_ex(u2, mQ, mQ, curve->Af, curve->prime, 0, key->heap);
    if (err == MP_OKAY)
        err = wc_ecc_point_add(mG, mQ, mG, curve->prime);
-#else /* FREESCALE_LTC_ECC */
+#else
 #ifndef ECC_SHAMIR
     {
-        mp_digit      mp;
+        mp_digit mp = 0;
 
         /* compute u1*mG + u2*mQ = mG */
         if (err == MP_OKAY) {
-            err = wc_ecc_mulmod_ex(&u1, mG, mG, curve->Af, curve->prime, 0,
+            err = wc_ecc_mulmod_ex(u1, mG, mG, curve->Af, curve->prime, 0,
                                                                      key->heap);
         }
         if (err == MP_OKAY) {
-            err = wc_ecc_mulmod_ex(&u2, mQ, mQ, curve->Af, curve->prime, 0,
+            err = wc_ecc_mulmod_ex(u2, mQ, mQ, curve->Af, curve->prime, 0,
                                                                      key->heap);
         }
@@ -4347 +5576 @@
        /* use Shamir's trick to compute u1*mG + u2*mQ using half the doubles */
         if (err == MP_OKAY) {
-            err = ecc_mul2add(mG, &u1, mQ, &u2, mG, curve->Af, curve->prime,
+            err = ecc_mul2add(mG, u1, mQ, u2, mG, curve->Af, curve->prime,
                                                                     key->heap);
         }
@@ -4354 +5583 @@
    /* v = X_x1 mod n */
    if (err == MP_OKAY)
-       err = mp_mod(mG->x, curve->order, &v);
+       err = mp_mod(mG->x, curve->order, v);
 
    /* does v == r */
    if (err == MP_OKAY) {
-       if (mp_cmp(&v, r) == MP_EQ)
+       if (mp_cmp(v, r) == MP_EQ)
            *res = 1;
    }
@@ -4366 +5595 @@
    wc_ecc_del_point_h(mQ, key->heap);
 
-   mp_clear(&e);
+   mp_clear(e);
    if (did_init) {
-       mp_clear(&v);
-       mp_clear(&w);
-       mp_clear(&u1);
-       mp_clear(&u2);
-   }
+       mp_clear(v);
+       mp_clear(w);
+       mp_clear(u1);
+       mp_clear(u2);
+   }
+#ifdef WOLFSSL_SMALL_STACK
+   XFREE(u2, key->heap, DYNAMIC_TYPE_ECC);
+   XFREE(u1, key->heap, DYNAMIC_TYPE_ECC);
+   XFREE(w, key->heap, DYNAMIC_TYPE_ECC);
+   XFREE(v, key->heap, DYNAMIC_TYPE_ECC);
+#if !defined(WOLFSSL_ASYNC_CRYPT) || !defined(HAVE_CAVIUM_V)
+   XFREE(e_lcl, key->heap, DYNAMIC_TYPE_ECC);
+#endif
+#endif
 
    wc_ecc_curve_free(curve);
-
+   FREE_CURVE_SPECS();
+
+#endif /* WOLFSSL_SP_MATH */
 #endif /* WOLFSSL_ATECC508A */
 
+   (void)keySz;
+   (void)hashlen;
+
    return err;
 }
@@ -4383 +5626 @@
 
 #ifdef HAVE_ECC_KEY_IMPORT
-#ifndef WOLFSSL_ATECC508A
 /* import point from der */
 int wc_ecc_import_point_der(byte* in, word32 inLen, const int curve_idx,
@@ -4390 +5632 @@
     int err = 0;
     int compressed = 0;
+    int keysize;
+    byte pointType;
 
     if (in == NULL || point == NULL || (curve_idx < 0) ||
@@ -4414 +5658 @@
         return MEMORY_E;
 
-    /* check for 4, 2, or 3 */
-    if (in[0] != 0x04 && in[0] != 0x02 && in[0] != 0x03) {
+    /* check for point type (4, 2, or 3) */
+    pointType = in[0];
+    if (pointType != ECC_POINT_UNCOMP && pointType != ECC_POINT_COMP_EVEN &&
+                                         pointType != ECC_POINT_COMP_ODD) {
         err = ASN_PARSE_E;
     }
 
-    if (in[0] == 0x02 || in[0] == 0x03) {
+    if (pointType == ECC_POINT_COMP_EVEN || pointType == ECC_POINT_COMP_ODD) {
 #ifdef HAVE_COMP_KEY
         compressed = 1;
@@ -4427 +5673 @@
     }
 
+    /* adjust to skip first byte */
+    inLen -= 1;
+    in += 1;
+
+    /* calculate key size based on inLen / 2 */
+    keysize = inLen>>1;
+
     /* read data */
     if (err == MP_OKAY)
-        err = mp_read_unsigned_bin(point->x, (byte*)in+1, (inLen-1)>>1);
+        err = mp_read_unsigned_bin(point->x, (byte*)in, keysize);
 
 #ifdef HAVE_COMP_KEY
     if (err == MP_OKAY && compressed == 1) {   /* build y */
+#ifndef WOLFSSL_SP_MATH
         int did_init = 0;
         mp_int t1, t2;
-        DECLARE_CURVE_SPECS(3)
+        DECLARE_CURVE_SPECS(curve, 3);
+
+        ALLOC_CURVE_SPECS(3);
 
         if (mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL) != MP_OKAY)
@@ -4470 +5726 @@
         /* adjust y */
         if (err == MP_OKAY) {
-            if ((mp_isodd(&t2) == MP_YES && in[0] == 0x03) ||
-                (mp_isodd(&t2) == MP_NO && in[0] == 0x02)) {
+            if ((mp_isodd(&t2) == MP_YES && pointType == ECC_POINT_COMP_ODD) ||
+                (mp_isodd(&t2) == MP_NO &&  pointType == ECC_POINT_COMP_EVEN)) {
                 err = mp_mod(&t2, curve->prime, point->y);
             }
@@ -4485 +5741 @@
 
         wc_ecc_curve_free(curve);
+        FREE_CURVE_SPECS();
+#else
+        sp_ecc_uncompress_256(point->x, pointType, point->y);
+#endif
     }
 #endif
 
     if (err == MP_OKAY && compressed == 0)
-        err = mp_read_unsigned_bin(point->y,
-                                   (byte*)in+1+((inLen-1)>>1), (inLen-1)>>1);
+        err = mp_read_unsigned_bin(point->y, (byte*)in + keysize, keysize);
     if (err == MP_OKAY)
         err = mp_set(point->z, 1);
@@ -4502 +5761 @@
     return err;
 }
-#endif /* !WOLFSSL_ATECC508A */
 #endif /* HAVE_ECC_KEY_IMPORT */
 
@@ -4512 +5770 @@
     int    ret = MP_OKAY;
     word32 numlen;
-#ifndef WOLFSSL_ATECC508A
 #ifdef WOLFSSL_SMALL_STACK
     byte*  buf;
@@ -4518 +5775 @@
     byte   buf[ECC_BUFSIZE];
 #endif
-#endif /* !WOLFSSL_ATECC508A */
 
     if ((curve_idx < 0) || (wc_ecc_is_valid_idx(curve_idx) == 0))
@@ -4540 +5796 @@
     }
 
-#ifdef WOLFSSL_ATECC508A
-   /* TODO: Implement equiv call to ATECC508A */
-   ret = BAD_COND_E;
-
-#else
-
-    /* store byte 0x04 */
-    out[0] = 0x04;
+    /* store byte point type */
+    out[0] = ECC_POINT_UNCOMP;
 
 #ifdef WOLFSSL_SMALL_STACK
@@ -4577 +5827 @@
     XFREE(buf, NULL, DYNAMIC_TYPE_ECC_BUFFER);
 #endif
-#endif /* WOLFSSL_ATECC508A */
 
     return ret;
@@ -4588 +5837 @@
    int    ret = MP_OKAY;
    word32 numlen;
-#ifndef WOLFSSL_ATECC508A
 #ifdef WOLFSSL_SMALL_STACK
    byte*  buf;
@@ -4595 +5843 @@
 #endif
    word32 pubxlen, pubylen;
-#endif /* WOLFSSL_ATECC508A */
 
    /* return length needed only */
@@ -4620 +5867 @@
       return BUFFER_E;
    }
-
-#ifdef WOLFSSL_ATECC508A
-   /* TODO: Implement equiv call to ATECC508A */
-   ret = BAD_COND_E;
-
-#else
 
    /* verify public key length is less than key size */
@@ -4635 +5876 @@
    }
 
-   /* store byte 0x04 */
-   out[0] = 0x04;
+   /* store byte point type */
+   out[0] = ECC_POINT_UNCOMP;
 
 #ifdef WOLFSSL_SMALL_STACK
@@ -4664 +5905 @@
    XFREE(buf, NULL, DYNAMIC_TYPE_ECC_BUFFER);
 #endif
-#endif /* WOLFSSL_ATECC508A */
 
    return ret;
@@ -4692 +5932 @@
 int wc_ecc_is_point(ecc_point* ecp, mp_int* a, mp_int* b, mp_int* prime)
 {
+#ifndef WOLFSSL_SP_MATH
    int err;
-   mp_int t1, t2;
-
-   if ((err = mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+#ifdef WOLFSSL_SMALL_STACK
+   mp_int* t1 = NULL;
+   mp_int* t2 = NULL;
+#else
+   mp_int  t1[1], t2[1];
+#endif
+
+#ifdef WOLFSSL_SMALL_STACK
+   t1 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+   if (t1 == NULL)
+       return MEMORY_E;
+   t2 = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+   if (t2 == NULL) {
+       XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+       return MEMORY_E;
+   }
+#endif
+
+   if ((err = mp_init_multi(t1, t2, NULL, NULL, NULL, NULL)) != MP_OKAY) {
+   #ifdef WOLFSSL_SMALL_STACK
+      XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+      XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+   #endif
       return err;
    }
@@ -4701 +5962 @@
    /* compute y^2 */
    if (err == MP_OKAY)
-       err = mp_sqr(ecp->y, &t1);
+       err = mp_sqr(ecp->y, t1);
 
    /* compute x^3 */
    if (err == MP_OKAY)
-       err = mp_sqr(ecp->x, &t2);
-   if (err == MP_OKAY)
-       err = mp_mod(&t2, prime, &t2);
-   if (err == MP_OKAY)
-       err = mp_mul(ecp->x, &t2, &t2);
+       err = mp_sqr(ecp->x, t2);
+   if (err == MP_OKAY)
+       err = mp_mod(t2, prime, t2);
+   if (err == MP_OKAY)
+       err = mp_mul(ecp->x, t2, t2);
 
    /* compute y^2 - x^3 */
    if (err == MP_OKAY)
-       err = mp_sub(&t1, &t2, &t1);
+       err = mp_sub(t1, t2, t1);
 
    /* Determine if curve "a" should be used in calc */
@@ -4719 +5980 @@
    if (err == MP_OKAY) {
       /* Use a and prime to determine if a == 3 */
-      err = mp_set(&t2, 0);
+      err = mp_set(t2, 0);
       if (err == MP_OKAY)
-          err = mp_submod(prime, a, prime, &t2);
-   }
-   if (err == MP_OKAY && mp_cmp_d(&t2, 3) != MP_EQ) {
+          err = mp_submod(prime, a, prime, t2);
+   }
+   if (err == MP_OKAY && mp_cmp_d(t2, 3) != MP_EQ) {
       /* compute y^2 - x^3 + a*x */
       if (err == MP_OKAY)
-          err = mp_mulmod(&t2, ecp->x, prime, &t2);
+          err = mp_mulmod(t2, ecp->x, prime, t2);
       if (err == MP_OKAY)
-          err = mp_addmod(&t1, &t2, prime, &t1);
+          err = mp_addmod(t1, t2, prime, t1);
    }
    else
@@ -4738 +5999 @@
       /* compute y^2 - x^3 + 3x */
       if (err == MP_OKAY)
-          err = mp_add(&t1, ecp->x, &t1);
+          err = mp_add(t1, ecp->x, t1);
       if (err == MP_OKAY)
-          err = mp_add(&t1, ecp->x, &t1);
+          err = mp_add(t1, ecp->x, t1);
       if (err == MP_OKAY)
-          err = mp_add(&t1, ecp->x, &t1);
+          err = mp_add(t1, ecp->x, t1);
       if (err == MP_OKAY)
-          err = mp_mod(&t1, prime, &t1);
+          err = mp_mod(t1, prime, t1);
   }
 
    /* adjust range (0, prime) */
-   while (err == MP_OKAY && mp_isneg(&t1)) {
-      err = mp_add(&t1, prime, &t1);
-   }
-   while (err == MP_OKAY && mp_cmp(&t1, prime) != MP_LT) {
-      err = mp_sub(&t1, prime, &t1);
+   while (err == MP_OKAY && mp_isneg(t1)) {
+      err = mp_add(t1, prime, t1);
+   }
+   while (err == MP_OKAY && mp_cmp(t1, prime) != MP_LT) {
+      err = mp_sub(t1, prime, t1);
    }
 
    /* compare to b */
    if (err == MP_OKAY) {
-       if (mp_cmp(&t1, b) != MP_EQ) {
+       if (mp_cmp(t1, b) != MP_EQ) {
           err = MP_VAL;
        } else {
@@ -4764 +6025 @@
    }
 
-   mp_clear(&t1);
-   mp_clear(&t2);
+   mp_clear(t1);
+   mp_clear(t2);
+#ifdef WOLFSSL_SMALL_STACK
+   XFREE(t2, NULL, DYNAMIC_TYPE_ECC);
+   XFREE(t1, NULL, DYNAMIC_TYPE_ECC);
+#endif
 
    return err;
-}
-
-
+#else
+   (void)a;
+   (void)b;
+   (void)prime;
+
+   return sp_ecc_is_point_256(ecp->x, ecp->y);
+#endif
+}
+
+#ifndef WOLFSSL_SP_MATH
 /* validate privkey * generator == pubkey, 0 on success */
 static int ecc_check_privkey_gen(ecc_key* key, mp_int* a, mp_int* prime)
@@ -4777 +6049 @@
     ecc_point* base = NULL;
     ecc_point* res  = NULL;
-    DECLARE_CURVE_SPECS(2)
+    DECLARE_CURVE_SPECS(curve, 2);
 
     if (key == NULL)
         return BAD_FUNC_ARG;
+
+    ALLOC_CURVE_SPECS(2);
 
     res = wc_ecc_new_point_h(key->heap);
@@ -4831 +6105 @@
     wc_ecc_del_point_h(res, key->heap);
     wc_ecc_del_point_h(base, key->heap);
+    FREE_CURVE_SPECS();
 
     return err;
 }
+#endif
 
 #ifdef WOLFSSL_VALIDATE_ECC_IMPORT
@@ -4842 +6118 @@
     int    err;
 #ifndef WOLFSSL_ATECC508A
-    DECLARE_CURVE_SPECS(2)
+    DECLARE_CURVE_SPECS(curve, 2);
 #endif
 
@@ -4849 +6125 @@
 
 #ifdef WOLFSSL_ATECC508A
-    /* TODO: Implement equiv call to ATECC508A */
-    err = BAD_COND_E;
+    /* Hardware based private key, so this operation is not supported */
+    err = MP_OKAY; /* just report success */
 
 #else
+    ALLOC_CURVE_SPECS(2);
 
     /* load curve info */
@@ -4862 +6139 @@
 
     wc_ecc_curve_free(curve);
+    FREE_CURVE_SPECS();
 
 #endif /* WOLFSSL_ATECC508A */
@@ -4871 +6149 @@
 
 
+#if defined(WOLFSSL_VALIDATE_ECC_KEYGEN) || !defined(WOLFSSL_SP_MATH)
 /* validate order * pubkey = point at infinity, 0 on success */
 static int ecc_check_pubkey_order(ecc_key* key, ecc_point* pubkey, mp_int* a,
@@ -4894 +6173 @@
 #endif
 #endif
+#ifndef WOLFSSL_SP_MATH
             err = wc_ecc_mulmod_ex(order, pubkey, inf, a, prime, 1, key->heap);
         if (err == MP_OKAY && !wc_ecc_point_is_at_infinity(inf))
             err = ECC_INF_E;
+#else
+            (void)a;
+            (void)prime;
+
+            err = WC_KEY_SIZE_E;
+#endif
     }
 
@@ -4903 +6189 @@
     return err;
 }
-
+#endif
 #endif /* !WOLFSSL_ATECC508A */
 
@@ -4911 +6197 @@
 {
     int    err;
+#ifndef WOLFSSL_SP_MATH
 #ifndef WOLFSSL_ATECC508A
-    mp_int* b;
+    mp_int* b = NULL;
 #ifdef USE_ECC_B_PARAM
-    DECLARE_CURVE_SPECS(4)
+    DECLARE_CURVE_SPECS(curve, 4);
 #else
+#ifndef WOLFSSL_SMALL_STACK
     mp_int b_lcl;
-    DECLARE_CURVE_SPECS(3)
-    b = &b_lcl;
-    XMEMSET(b, 0, sizeof(mp_int));
-#endif
+#endif
+    DECLARE_CURVE_SPECS(curve, 3);
+#endif /* USE_ECC_B_PARAM */
 #endif /* WOLFSSL_ATECC508A */
 
@@ -4928 +6215 @@
 #ifdef WOLFSSL_ATECC508A
 
-    if (key->slot == ATECC_INVALID_SLOT)
-        return ECC_BAD_ARG_E;
-
-    err = 0; /* consider key check success on ECC508A */
+    err = 0; /* consider key check success on ATECC508A */
 
 #else
-
+    #ifdef USE_ECC_B_PARAM
+        ALLOC_CURVE_SPECS(4);
+    #else
+        ALLOC_CURVE_SPECS(3);
+        #ifndef WOLFSSL_SMALL_STACK
+            b = &b_lcl;
+        #else
+            b = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_ECC);
+            if (b == NULL) {
+                FREE_CURVE_SPECS();
+                return MEMORY_E;
+            }
+        #endif
+        XMEMSET(b, 0, sizeof(mp_int));
+    #endif
+
+    /* SP 800-56Ar3, section 5.6.2.3.3, process step 1 */
     /* pubkey point cannot be at infinity */
-    if (wc_ecc_point_is_at_infinity(&key->pubkey))
+    if (wc_ecc_point_is_at_infinity(&key->pubkey)) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(b, key->heap, DYNAMIC_TYPE_ECC);
+    #endif
+        FREE_CURVE_SPECS();
         return ECC_INF_E;
+    }
 
     /* load curve info */
@@ -4952 +6257 @@
         err = mp_init(b);
     if (err == MP_OKAY)
-        err = mp_read_radix(b, key->dp->Bf, 16);
+        err = mp_read_radix(b, key->dp->Bf, MP_RADIX_HEX);
 #else
     b = curve->Bf;
 #endif
 
+    /* SP 800-56Ar3, section 5.6.2.3.3, process step 2 */
     /* Qx must be in the range [0, p-1] */
     if (mp_cmp(key->pubkey.x, curve->prime) != MP_LT)
@@ -4965 +6271 @@
         err = ECC_OUT_OF_RANGE_E;
 
+    /* SP 800-56Ar3, section 5.6.2.3.3, process steps 3 */
     /* make sure point is actually on curve */
     if (err == MP_OKAY)
         err = wc_ecc_is_point(&key->pubkey, curve->Af, b, curve->prime);
 
+    /* SP 800-56Ar3, section 5.6.2.3.3, process steps 4 */
     /* pubkey * order must be at infinity */
     if (err == MP_OKAY)
@@ -4974 +6282 @@
                 curve->order);
 
+    /* SP 800-56Ar3, section 5.6.2.1.4, method (b) for ECC */
     /* private * base generator must equal pubkey */
     if (err == MP_OKAY && key->type == ECC_PRIVATEKEY)
@@ -4982 +6291 @@
 #ifndef USE_ECC_B_PARAM
     mp_clear(b);
-#endif
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(b, key->heap, DYNAMIC_TYPE_ECC);
+#endif
+#endif
+
+    FREE_CURVE_SPECS();
 
 #endif /* WOLFSSL_ATECC508A */
+#else
+    if (key == NULL)
+        return BAD_FUNC_ARG;
+
+    /* pubkey point cannot be at infinity */
+    if (key->idx != ECC_CUSTOM_IDX && ecc_sets[key->idx].id == ECC_SECP256R1) {
+        err = sp_ecc_check_key_256(key->pubkey.x, key->pubkey.y, &key->k,
+                                                                     key->heap);
+    }
+    else
+        err = WC_KEY_SIZE_E;
+#endif
 
     return err;
@@ -4995 +6321 @@
 {
     int err = MP_OKAY;
-#ifndef WOLFSSL_ATECC508A
     int compressed = 0;
-#endif /* !WOLFSSL_ATECC508A */
+    int keysize = 0;
+    byte pointType;
 
     if (in == NULL || key == NULL)
@@ -5009 +6335 @@
     /* make sure required variables are reset */
     wc_ecc_reset(key);
-
-#ifdef WOLFSSL_ATECC508A
-    /* TODO: Implement equiv call to ATECC508A */
-    err = BAD_COND_E;
-
-#else
 
     /* init key */
@@ -5032 +6352 @@
         return MEMORY_E;
 
-    /* check for 4, 2, or 3 */
-    if (in[0] != 0x04 && in[0] != 0x02 && in[0] != 0x03) {
+    /* check for point type (4, 2, or 3) */
+    pointType = in[0];
+    if (pointType != ECC_POINT_UNCOMP && pointType != ECC_POINT_COMP_EVEN &&
+                                         pointType != ECC_POINT_COMP_ODD) {
         err = ASN_PARSE_E;
     }
 
-    if (in[0] == 0x02 || in[0] == 0x03) {
+    if (pointType == ECC_POINT_COMP_EVEN || pointType == ECC_POINT_COMP_ODD) {
     #ifdef HAVE_COMP_KEY
         compressed = 1;
@@ -5045 +6367 @@
     }
 
+    /* adjust to skip first byte */
+    inLen -= 1;
+    in += 1;
+
+#ifdef WOLFSSL_ATECC508A
+    /* For SECP256R1 only save raw public key for hardware */
+    if (curve_id == ECC_SECP256R1 && !compressed &&
+                                            inLen <= sizeof(key->pubkey_raw)) {
+        XMEMCPY(key->pubkey_raw, (byte*)in, inLen);
+    }
+#endif
+
     if (err == MP_OKAY) {
-        int keysize;
     #ifdef HAVE_COMP_KEY
         /* adjust inLen if compressed */
         if (compressed)
-            inLen = (inLen-1)*2 + 1;  /* used uncompressed len */
+            inLen = inLen*2 + 1;  /* used uncompressed len */
     #endif
 
         /* determine key size */
-        keysize = ((inLen-1)>>1);
+        keysize = (inLen>>1);
         err = wc_ecc_set_curve(key, keysize, curve_id);
         key->type = ECC_PUBLICKEY;
@@ -5061 +6394 @@
     /* read data */
     if (err == MP_OKAY)
-        err = mp_read_unsigned_bin(key->pubkey.x, (byte*)in+1, (inLen-1)>>1);
+        err = mp_read_unsigned_bin(key->pubkey.x, (byte*)in, keysize);
 
 #ifdef HAVE_COMP_KEY
     if (err == MP_OKAY && compressed == 1) {   /* build y */
+#ifndef WOLFSSL_SP_MATH
         mp_int t1, t2;
         int did_init = 0;
 
-        DECLARE_CURVE_SPECS(3)
+        DECLARE_CURVE_SPECS(curve, 3);
+        ALLOC_CURVE_SPECS(3);
 
         if (mp_init_multi(&t1, &t2, NULL, NULL, NULL, NULL) != MP_OKAY)
@@ -5103 +6438 @@
         /* adjust y */
         if (err == MP_OKAY) {
-            if ((mp_isodd(&t2) == MP_YES && in[0] == 0x03) ||
-                (mp_isodd(&t2) == MP_NO && in[0] == 0x02)) {
+            if ((mp_isodd(&t2) == MP_YES && pointType == ECC_POINT_COMP_ODD) ||
+                (mp_isodd(&t2) == MP_NO &&  pointType == ECC_POINT_COMP_EVEN)) {
                 err = mp_mod(&t2, curve->prime, &t2);
             }
@@ -5120 +6455 @@
 
         wc_ecc_curve_free(curve);
+        FREE_CURVE_SPECS();
+#else
+        sp_ecc_uncompress_256(key->pubkey.x, pointType, key->pubkey.y);
+#endif
     }
 #endif /* HAVE_COMP_KEY */
 
     if (err == MP_OKAY && compressed == 0)
-        err = mp_read_unsigned_bin(key->pubkey.y, (byte*)in+1+((inLen-1)>>1),
-                                                                (inLen-1)>>1);
+        err = mp_read_unsigned_bin(key->pubkey.y, (byte*)in + keysize, keysize);
     if (err == MP_OKAY)
         err = mp_set(key->pubkey.z, 1);
@@ -5140 +6478 @@
         mp_clear(&key->k);
     }
-#endif /* WOLFSSL_ATECC508A */
 
     return err;
-}
+    }
 
 int wc_ecc_import_x963(const byte* in, word32 inLen, ecc_key* key)
@@ -5152 +6489 @@
 
 #ifdef HAVE_ECC_KEY_EXPORT
-/* export ecc private key only raw, outLen is in/out size
+
+/* export ecc key to component form, d is optional if only exporting public
+ * encType is WC_TYPE_UNSIGNED_BIN or WC_TYPE_HEX_STR
+ * return MP_OKAY on success */
+int wc_ecc_export_ex(ecc_key* key, byte* qx, word32* qxLen,
+                 byte* qy, word32* qyLen, byte* d, word32* dLen, int encType)
+{
+    int err = 0;
+    word32 keySz;
+
+    if (key == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (wc_ecc_is_valid_idx(key->idx) == 0) {
+        return ECC_BAD_ARG_E;
+    }
+    keySz = key->dp->size;
+
+    /* private key, d */
+    if (d != NULL) {
+        if (dLen == NULL ||
+            (key->type != ECC_PRIVATEKEY && key->type != ECC_PRIVATEKEY_ONLY))
+            return BAD_FUNC_ARG;
+
+    #ifdef WOLFSSL_ATECC508A
+        /* Hardware cannot export private portion */
+        return NOT_COMPILED_IN;
+    #else
+        err = wc_export_int(&key->k, d, dLen, keySz, encType);
+        if (err != MP_OKAY)
+            return err;
+    #endif
+    }
+
+    /* public x component */
+    if (qx != NULL) {
+        if (qxLen == NULL || key->type == ECC_PRIVATEKEY_ONLY)
+            return BAD_FUNC_ARG;
+
+        err = wc_export_int(key->pubkey.x, qx, qxLen, keySz, encType);
+    if (err != MP_OKAY)
+        return err;
+    }
+
+    /* public y component */
+    if (qy != NULL) {
+        if (qyLen == NULL || key->type == ECC_PRIVATEKEY_ONLY)
+            return BAD_FUNC_ARG;
+
+        err = wc_export_int(key->pubkey.y, qy, qyLen, keySz, encType);
+    if (err != MP_OKAY)
+        return err;
+    }
+
+    return err;
+}
+
+
+/* export ecc private key only raw, outLen is in/out size as unsigned bin
    return MP_OKAY on success */
 int wc_ecc_export_private_only(ecc_key* key, byte* out, word32* outLen)
 {
-    word32 numlen;
-
-    if (key == NULL || out == NULL || outLen == NULL) {
+    if (out == NULL || outLen == NULL) {
         return BAD_FUNC_ARG;
-    }
-
-    if (wc_ecc_is_valid_idx(key->idx) == 0) {
-        return ECC_BAD_ARG_E;
-    }
-    numlen = key->dp->size;
-
-    if (*outLen < numlen) {
-        *outLen = numlen;
-        return BUFFER_E;
-    }
-    *outLen = numlen;
-    XMEMSET(out, 0, *outLen);
-
-#ifdef WOLFSSL_ATECC508A
-   /* TODO: Implement equiv call to ATECC508A */
-   return BAD_COND_E;
-
-#else
-
-    return mp_to_unsigned_bin(&key->k, out + (numlen -
-                                           mp_unsigned_bin_size(&key->k)));
-#endif /* WOLFSSL_ATECC508A */
-}
-
-
-/* export ecc key to component form, d is optional if only exporting public
- * return MP_OKAY on success */
-static int wc_ecc_export_raw(ecc_key* key, byte* qx, word32* qxLen,
-                             byte* qy, word32* qyLen, byte* d, word32* dLen)
-{
-    int  err;
-    byte exportPriv = 0;
-    word32 numLen;
-
-    if (key == NULL || qx == NULL || qxLen == NULL || qy == NULL ||
-        qyLen == NULL) {
-        return BAD_FUNC_ARG;
-    }
-
-    if (key->type == ECC_PRIVATEKEY_ONLY) {
-        return ECC_PRIVATEONLY_E;
-    }
-
-    if (wc_ecc_is_valid_idx(key->idx) == 0) {
-        return ECC_BAD_ARG_E;
-    }
-    numLen = key->dp->size;
-
-    if (d != NULL) {
-        if (dLen == NULL || key->type != ECC_PRIVATEKEY)
-            return BAD_FUNC_ARG;
-        exportPriv = 1;
-    }
-
-    /* check public buffer sizes */
-    if ((*qxLen < numLen) || (*qyLen < numLen)) {
-        *qxLen = numLen;
-        *qyLen = numLen;
-        return BUFFER_E;
-    }
-
-    *qxLen = numLen;
-    *qyLen = numLen;
-
-    XMEMSET(qx, 0, *qxLen);
-    XMEMSET(qy, 0, *qyLen);
-
-    /* private d component */
-    if (exportPriv == 1) {
-
-        /* check private buffer size */
-        if (*dLen < numLen) {
-            *dLen = numLen;
-            return BUFFER_E;
-        }
-
-        *dLen = numLen;
-        XMEMSET(d, 0, *dLen);
-
-    #ifdef WOLFSSL_ATECC508A
-       /* TODO: Implement equiv call to ATECC508A */
-       return BAD_COND_E;
-
-    #else
-
-        /* private key, d */
-        err = mp_to_unsigned_bin(&key->k, d +
-                            (numLen - mp_unsigned_bin_size(&key->k)));
-        if (err != MP_OKAY)
-            return err;
-    #endif /* WOLFSSL_ATECC508A */
-    }
-
-#ifdef WOLFSSL_ATECC508A
-    /* TODO: Implement equiv call to ATECC508A */
-    return BAD_COND_E;
-
-#else
-
-    /* public x component */
-    err = mp_to_unsigned_bin(key->pubkey.x, qx +
-                            (numLen - mp_unsigned_bin_size(key->pubkey.x)));
-    if (err != MP_OKAY)
-        return err;
-
-    /* public y component */
-    err = mp_to_unsigned_bin(key->pubkey.y, qy +
-                            (numLen - mp_unsigned_bin_size(key->pubkey.y)));
-    if (err != MP_OKAY)
-        return err;
-
-    return 0;
-#endif /* WOLFSSL_ATECC508A */
-}
-
-
-/* export public key to raw elements including public (Qx,Qy)
+}
+
+    return wc_ecc_export_ex(key, NULL, NULL, NULL, NULL, out, outLen,
+        WC_TYPE_UNSIGNED_BIN);
+}
+
+/* export public key to raw elements including public (Qx,Qy) as unsigned bin
  * return MP_OKAY on success, negative on error */
 int wc_ecc_export_public_raw(ecc_key* key, byte* qx, word32* qxLen,
                              byte* qy, word32* qyLen)
 {
-    return wc_ecc_export_raw(key, qx, qxLen, qy, qyLen, NULL, NULL);
-}
-
-
-/* export ecc key to raw elements including public (Qx,Qy) and private (d)
+    if (qx == NULL || qxLen == NULL || qy == NULL || qyLen == NULL) {
+        return BAD_FUNC_ARG;
+}
+
+    return wc_ecc_export_ex(key, qx, qxLen, qy, qyLen, NULL, NULL,
+        WC_TYPE_UNSIGNED_BIN);
+}
+
+/* export ecc key to raw elements including public (Qx,Qy) and
+ *   private (d) as unsigned bin
  * return MP_OKAY on success, negative on error */
 int wc_ecc_export_private_raw(ecc_key* key, byte* qx, word32* qxLen,
                               byte* qy, word32* qyLen, byte* d, word32* dLen)
 {
-    /* sanitize d and dLen, other args are checked later */
-    if (d == NULL || dLen == NULL)
-        return BAD_FUNC_ARG;
-
-    return wc_ecc_export_raw(key, qx, qxLen, qy, qyLen, d, dLen);
+    return wc_ecc_export_ex(key, qx, qxLen, qy, qyLen, d, dLen,
+        WC_TYPE_UNSIGNED_BIN);
 }
 
@@ -5307 +6592 @@
 {
     int ret;
+    word32 idx = 0;
+
+    if (key == NULL || priv == NULL)
+        return BAD_FUNC_ARG;
 
     /* public optional, NULL if only importing private */
     if (pub != NULL) {
         ret = wc_ecc_import_x963_ex(pub, pubSz, key, curve_id);
+        if (ret < 0)
+            ret = wc_EccPublicKeyDecode(pub, &idx, key, pubSz);
         key->type = ECC_PRIVATEKEY;
     }
     else {
-        if (key == NULL || priv == NULL)
-            return BAD_FUNC_ARG;
-
         /* make sure required variables are reset */
         wc_ecc_reset(key);
@@ -5328 +6616 @@
         return ret;
 
-
 #ifdef WOLFSSL_ATECC508A
-    /* TODO: Implement equiv call to ATECC508A */
-    return BAD_COND_E;
+    /* Hardware does not support loading private keys */
+    return NOT_COMPILED_IN;
 
 #else
 
     ret = mp_read_unsigned_bin(&key->k, priv, privSz);
+#ifdef HAVE_WOLF_BIGINT
+    if (ret == 0 &&
+                  wc_bigint_from_unsigned_bin(&key->k.raw, priv, privSz) != 0) {
+        mp_clear(&key->k);
+        ret = ASN_GETINT_E;
+    }
+#endif /* HAVE_WOLF_BIGINT */
+
 
 #endif /* WOLFSSL_ATECC508A */
@@ -5369 +6664 @@
 {
     int err;
-    mp_int rtmp;
-    mp_int stmp;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* rtmp = NULL;
+    mp_int* stmp = NULL;
+#else
+    mp_int  rtmp[1];
+    mp_int  stmp[1];
+#endif
 
     if (r == NULL || s == NULL || out == NULL || outlen == NULL)
         return ECC_BAD_ARG_E;
 
-    err = mp_init_multi(&rtmp, &stmp, NULL, NULL, NULL, NULL);
-    if (err != MP_OKAY)
+#ifdef WOLFSSL_SMALL_STACK
+    rtmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (rtmp == NULL)
+        return MEMORY_E;
+    stmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (stmp == NULL) {
+        XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+#endif
+
+    err = mp_init_multi(rtmp, stmp, NULL, NULL, NULL, NULL);
+    if (err != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(stmp, NULL, DYNAMIC_TYPE_ECC);
+        XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+    #endif
         return err;
-
-    err = mp_read_radix(&rtmp, r, 16);
+    }
+
+    err = mp_read_radix(rtmp, r, MP_RADIX_HEX);
     if (err == MP_OKAY)
-        err = mp_read_radix(&stmp, s, 16);
+        err = mp_read_radix(stmp, s, MP_RADIX_HEX);
 
     /* convert mp_ints to ECDSA sig, initializes rtmp and stmp internally */
     if (err == MP_OKAY)
-        err = StoreECC_DSA_Sig(out, outlen, &rtmp, &stmp);
+        err = StoreECC_DSA_Sig(out, outlen, rtmp, stmp);
 
     if (err == MP_OKAY) {
-        if (mp_iszero(&rtmp) == MP_YES || mp_iszero(&stmp) == MP_YES)
+        if (mp_iszero(rtmp) == MP_YES || mp_iszero(stmp) == MP_YES)
             err = MP_ZERO_E;
     }
 
-    mp_clear(&rtmp);
-    mp_clear(&stmp);
+    mp_clear(rtmp);
+    mp_clear(stmp);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(stmp, NULL, DYNAMIC_TYPE_ECC);
+    XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+#endif
 
     return err;
 }
 
+/**
+   Convert ECC R,S raw unsigned bin to signature
+   r       R component of signature
+   rSz     R size
+   s       S component of signature
+   sSz     S size
+   out     DER-encoded ECDSA signature
+   outlen  [in/out] output buffer size, output signature size
+   return  MP_OKAY on success
+*/
+int wc_ecc_rs_raw_to_sig(const byte* r, word32 rSz, const byte* s, word32 sSz,
+    byte* out, word32* outlen)
+{
+    int err;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* rtmp = NULL;
+    mp_int* stmp = NULL;
+#else
+    mp_int  rtmp[1];
+    mp_int  stmp[1];
+#endif
+
+    if (r == NULL || s == NULL || out == NULL || outlen == NULL)
+        return ECC_BAD_ARG_E;
+
+#ifdef WOLFSSL_SMALL_STACK
+    rtmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (rtmp == NULL)
+        return MEMORY_E;
+    stmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (stmp == NULL) {
+        XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+#endif
+
+    err = mp_init_multi(rtmp, stmp, NULL, NULL, NULL, NULL);
+    if (err != MP_OKAY) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(stmp, NULL, DYNAMIC_TYPE_ECC);
+        XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+    #endif
+    return err;
+}
+
+    err = mp_read_unsigned_bin(rtmp, r, rSz);
+    if (err == MP_OKAY)
+        err = mp_read_unsigned_bin(stmp, s, sSz);
+
+    /* convert mp_ints to ECDSA sig, initializes rtmp and stmp internally */
+    if (err == MP_OKAY)
+        err = StoreECC_DSA_Sig(out, outlen, rtmp, stmp);
+
+    if (err == MP_OKAY) {
+        if (mp_iszero(rtmp) == MP_YES || mp_iszero(stmp) == MP_YES)
+            err = MP_ZERO_E;
+    }
+
+    mp_clear(rtmp);
+    mp_clear(stmp);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(stmp, NULL, DYNAMIC_TYPE_ECC);
+    XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+#endif
+
+    return err;
+}
 
 /**
@@ -5414 +6801 @@
     int err;
     word32 x = 0;
-    mp_int rtmp;
-    mp_int stmp;
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* rtmp = NULL;
+    mp_int* stmp = NULL;
+#else
+    mp_int  rtmp[1];
+    mp_int  stmp[1];
+#endif
 
     if (sig == NULL || r == NULL || rLen == NULL || s == NULL || sLen == NULL)
         return ECC_BAD_ARG_E;
 
-    err = DecodeECC_DSA_Sig(sig, sigLen, &rtmp, &stmp);
+#ifdef WOLFSSL_SMALL_STACK
+    rtmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (rtmp == NULL)
+        return MEMORY_E;
+    stmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
+    if (stmp == NULL) {
+        XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+        return MEMORY_E;
+    }
+#endif
+
+    err = DecodeECC_DSA_Sig(sig, sigLen, rtmp, stmp);
 
     /* extract r */
     if (err == MP_OKAY) {
-        x = mp_unsigned_bin_size(&rtmp);
+        x = mp_unsigned_bin_size(rtmp);
         if (*rLen < x)
             err = BUFFER_E;
@@ -5430 +6833 @@
         if (err == MP_OKAY) {
             *rLen = x;
-            err = mp_to_unsigned_bin(&rtmp, r);
+            err = mp_to_unsigned_bin(rtmp, r);
         }
     }
@@ -5436 +6839 @@
     /* extract s */
     if (err == MP_OKAY) {
-        x = mp_unsigned_bin_size(&stmp);
+        x = mp_unsigned_bin_size(stmp);
         if (*sLen < x)
             err = BUFFER_E;
@@ -5442 +6845 @@
         if (err == MP_OKAY) {
             *sLen = x;
-            err = mp_to_unsigned_bin(&stmp, s);
+            err = mp_to_unsigned_bin(stmp, s);
         }
     }
 
-    mp_clear(&rtmp);
-    mp_clear(&stmp);
+    mp_clear(rtmp);
+    mp_clear(stmp);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(stmp, NULL, DYNAMIC_TYPE_ECC);
+    XFREE(rtmp, NULL, DYNAMIC_TYPE_ECC);
+#endif
 
     return err;
@@ -5455 +6862 @@
 #ifdef HAVE_ECC_KEY_IMPORT
 static int wc_ecc_import_raw_private(ecc_key* key, const char* qx,
-          const char* qy, const char* d, int curve_id)
+          const char* qy, const char* d, int curve_id, int encType)
 {
     int err = MP_OKAY;
@@ -5472 +6879 @@
         return err;
     }
-
-#ifdef WOLFSSL_ATECC508A
-    /* TODO: Implement equiv call to ATECC508A */
-    err = BAD_COND_E;
-
-#else
 
     /* init key */
@@ -5496 +6897 @@
 
     /* read Qx */
-    if (err == MP_OKAY)
-        err = mp_read_radix(key->pubkey.x, qx, 16);
+    if (err == MP_OKAY) {
+        if (encType == WC_TYPE_HEX_STR)
+            err = mp_read_radix(key->pubkey.x, qx, MP_RADIX_HEX);
+        else
+            err = mp_read_unsigned_bin(key->pubkey.x, (const byte*)qx,
+                key->dp->size);
+    }
 
     /* read Qy */
-    if (err == MP_OKAY)
-        err = mp_read_radix(key->pubkey.y, qy, 16);
+    if (err == MP_OKAY) {
+        if (encType == WC_TYPE_HEX_STR)
+            err = mp_read_radix(key->pubkey.y, qy, MP_RADIX_HEX);
+        else
+            err = mp_read_unsigned_bin(key->pubkey.y, (const byte*)qy,
+                key->dp->size);
+
+    }
 
     if (err == MP_OKAY)
         err = mp_set(key->pubkey.z, 1);
+
+#ifdef WOLFSSL_ATECC508A
+    /* For SECP256R1 only save raw public key for hardware */
+    if (err == MP_OKAY && curve_id == ECC_SECP256R1) {
+        word32 keySz = key->dp->size;
+        err = wc_export_int(key->pubkey.x, key->pubkey_raw,
+            &keySz, keySz, WC_TYPE_UNSIGNED_BIN);
+        if (err == MP_OKAY)
+            err = wc_export_int(key->pubkey.y, &key->pubkey_raw[keySz],
+                &keySz, keySz, WC_TYPE_UNSIGNED_BIN);
+    }
+#endif
 
     /* import private key */
     if (err == MP_OKAY) {
         if (d != NULL) {
+        #ifdef WOLFSSL_ATECC508A
+            /* Hardware doesn't support loading private key */
+            err = NOT_COMPILED_IN;
+        #else
             key->type = ECC_PRIVATEKEY;
-            err = mp_read_radix(&key->k, d, 16);
+
+            if (encType == WC_TYPE_HEX_STR)
+                err = mp_read_radix(&key->k, d, MP_RADIX_HEX);
+            else
+                err = mp_read_unsigned_bin(&key->k, (const byte*)d,
+                    key->dp->size);
+        #endif /* WOLFSSL_ATECC508A */
         } else {
             key->type = ECC_PUBLICKEY;
@@ -5527 +6961 @@
         mp_clear(&key->k);
     }
-#endif /* WOLFSSL_ATECC508A */
 
     return err;
@@ -5545 +6978 @@
                    const char* d, int curve_id)
 {
-    return wc_ecc_import_raw_private(key, qx, qy, d, curve_id);
-
+    return wc_ecc_import_raw_private(key, qx, qy, d, curve_id,
+        WC_TYPE_HEX_STR);
+
+}
+
+/* Import x, y and optional private (d) as unsigned binary */
+int wc_ecc_import_unsigned(ecc_key* key, byte* qx, byte* qy,
+                   byte* d, int curve_id)
+{
+    return wc_ecc_import_raw_private(key, (const char*)qx, (const char*)qy,
+        (const char*)d, curve_id, WC_TYPE_UNSIGNED_BIN);
 }
 
@@ -5581 +7023 @@
         err = ASN_PARSE_E;
     } else {
-        return wc_ecc_import_raw_private(key, qx, qy, d, ecc_sets[x].id);
+        return wc_ecc_import_raw_private(key, qx, qy, d, ecc_sets[x].id,
+            WC_TYPE_HEX_STR);
     }
 
@@ -5596 +7039 @@
 }
 
+int wc_ecc_sig_size_calc(int sz)
+{
+    return (sz * 2) + SIG_HEADER_SZ + ECC_MAX_PAD_SZ;
+}
 
 /* worst case estimate, check actual return from wc_ecc_sign_hash for actual
@@ -5605 +7052 @@
         return sz;
 
-    return (sz * 2) + SIG_HEADER_SZ + ECC_MAX_PAD_SZ;
+    return wc_ecc_sig_size_calc(sz);
 }
 
@@ -5633 +7080 @@
 #endif
 
+
+#ifndef WOLFSSL_SP_MATH
 
 /** Our FP cache */
@@ -6182 +7631 @@
 };
 
+
 /* find a hole and free as required, return -1 if no hole found */
 static int find_hole(void)
@@ -6271 +7721 @@
    return MP_OKAY;
 }
-
+#endif
+
+#ifndef WOLFSSL_SP_MATH
 /* build the LUT by spacing the bits of the input by #modulus/FP_LUT bits apart
  *
@@ -6441 +7893 @@
       if (y == 66) --x;
 
-      if ((err = mp_read_radix(&order, ecc_sets[x].order, 16)) != MP_OKAY) {
+      if ((err = mp_read_radix(&order, ecc_sets[x].order,
+                                                MP_RADIX_HEX)) != MP_OKAY) {
          goto done;
       }
@@ -6492 +7945 @@
 
       while ((unsigned)x < y) {
-         z = kb[x]; kb[x] = kb[y]; kb[y] = z;
+         z = kb[x]; kb[x] = kb[y]; kb[y] = (byte)z;
          ++x; --y;
       }
@@ -6559 +8012 @@
    return err;
 }
+#endif
 
 #ifdef ECC_SHAMIR
+#ifndef WOLFSSL_SP_MATH
 /* perform a fixed point ECC mulmod */
 static int accel_fp_mul2add(int idx1, int idx2,
@@ -6592 +8047 @@
       if (y == 66) --x;
 
-      if ((err = mp_read_radix(&order, ecc_sets[x].order, 16)) != MP_OKAY) {
+      if ((err = mp_read_radix(&order, ecc_sets[x].order,
+                                                MP_RADIX_HEX)) != MP_OKAY) {
          goto done;
       }
@@ -6623 +8079 @@
       if (y == 66) --x;
 
-      if ((err = mp_read_radix(&order, ecc_sets[x].order, 16)) != MP_OKAY) {
+      if ((err = mp_read_radix(&order, ecc_sets[x].order,
+                                                MP_RADIX_HEX)) != MP_OKAY) {
          goto done;
       }
@@ -6678 +8135 @@
    mp_clear(&tka);
    while ((unsigned)x < y) {
-      z = kb[0][x]; kb[0][x] = kb[0][y]; kb[0][y] = z;
+      z = kb[0][x]; kb[0][x] = kb[0][y]; kb[0][y] = (byte)z;
       ++x; --y;
    }
@@ -6699 +8156 @@
 
       while ((unsigned)x < y) {
-         z = kb[1][x]; kb[1][x] = kb[1][y]; kb[1][y] = z;
+         z = kb[1][x]; kb[1][x] = kb[1][y]; kb[1][y] = (byte)z;
          ++x; --y;
       }
@@ -6919 +8376 @@
     return err;
 }
+#endif
 #endif /* ECC_SHAMIR */
 
@@ -6934 +8392 @@
     mp_int* modulus, int map, void* heap)
 {
+#ifndef WOLFSSL_SP_MATH
    int   idx, err = MP_OKAY;
    mp_digit mp;
    mp_int   mu;
    int      mpSetup = 0;
+
+   if (k == NULL || G == NULL || R == NULL || a == NULL || modulus == NULL) {
+       return ECC_BAD_ARG_E;
+   }
 
    if (mp_init(&mu) != MP_OKAY)
@@ -7006 +8469 @@
 
     return err;
-}
-
+#else
+    if (k == NULL || G == NULL || R == NULL || a == NULL || modulus == NULL) {
+        return ECC_BAD_ARG_E;
+    }
+
+    return sp_ecc_mulmod_256(k, G, R, map, heap);
+#endif
+}
+
+#ifndef WOLFSSL_SP_MATH
 /* helper function for freeing the cache ...
    must be called with the cache mutex locked */
@@ -7027 +8498 @@
    }
 }
+#endif
 
 /** Free the Fixed Point cache */
 void wc_ecc_fp_free(void)
 {
+#ifndef WOLFSSL_SP_MATH
 #ifndef HAVE_THREAD_LS
    if (initMutex == 0) {
@@ -7048 +8521 @@
    }
 #endif /* HAVE_THREAD_LS */
+#endif
 }
 
@@ -7407 +8881 @@
                {
                    Aes aes;
+                   ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
+                   if (ret == 0) {
                    ret = wc_AesSetKey(&aes, encKey, KEY_SIZE_128, encIv,
                                                                 AES_ENCRYPTION);
-                   if (ret != 0)
-                       break;
+                       if (ret == 0) {
                    ret = wc_AesCbcEncrypt(&aes, out, msg, msgSz);
                 #if defined(WOLFSSL_ASYNC_CRYPT)
-                   ret = wc_AsyncWait(ret, &aes.asyncDev, WC_ASYNC_FLAG_NONE);
+                           ret = wc_AsyncWait(ret, &aes.asyncDev,
+                                              WC_ASYNC_FLAG_NONE);
                 #endif
+               }
+                       wc_AesFree(&aes);
+                   }
+                   if (ret != 0)
+                      break;
                }
                break;
@@ -7637 +9118 @@
 #ifndef WOLFSSL_ATECC508A
 
+#ifndef WOLFSSL_SP_MATH
 int do_mp_jacobi(mp_int* a, mp_int* n, int* c);
 
@@ -7760 +9242 @@
 int mp_sqrtmod_prime(mp_int* n, mp_int* prime, mp_int* ret)
 {
+#ifdef SQRTMOD_USE_MOD_EXP
+  int res;
+
+  mp_int e;
+
+  res = mp_init(&e);
+  if (res == MP_OKAY)
+      res = mp_add_d(prime, 1, &e);
+  if (res == MP_OKAY)
+      res = mp_div_2d(&e, 2, &e, NULL);
+  if (res == MP_OKAY)
+      res = mp_exptmod(n, &e, prime, ret);
+
+  mp_clear(&e);
+
+  return res;
+#else
   int res, legendre, done = 0;
   mp_int t1, C, Q, S, Z, M, T, R, two;
@@ -7938 +9437 @@
 
   return res;
-}
+#endif
+}
+#endif
 #endif /* !WOLFSSL_ATECC508A */
 
@@ -7961 +9462 @@
    }
 
-#ifdef WOLFSSL_ATECC508A
-   /* TODO: Implement equiv call to ATECC508A */
-   ret = BAD_COND_E;
-
-#else
-
    /* store first byte */
-   out[0] = mp_isodd(key->pubkey.y) == MP_YES ? 0x03 : 0x02;
+   out[0] = mp_isodd(key->pubkey.y) == MP_YES ? ECC_POINT_COMP_ODD : ECC_POINT_COMP_EVEN;
 
    /* pad and store x */
@@ -7975 +9470 @@
                        out+1 + (numlen - mp_unsigned_bin_size(key->pubkey.x)));
    *outLen = 1 + numlen;
-
-#endif /* WOLFSSL_ATECC508A */
 
    return ret;
@@ -8045 +9538 @@
 #ifdef HAVE_X963_KDF
 
-static INLINE void IncrementX963KdfCounter(byte* inOutCtr)
+static WC_INLINE void IncrementX963KdfCounter(byte* inOutCtr)
 {
     int i;
@@ -8110 +9603 @@
         ret = wc_HashUpdate(hash, type, secret, secretSz);
         if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-            XFREE(hash, NULL, DYNAMIC_TYPE_HASHES);
-#endif
-            return ret;
+            break;
         }
 
         ret = wc_HashUpdate(hash, type, counter, sizeof(counter));
         if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-            XFREE(hash, NULL, DYNAMIC_TYPE_HASHES);
-#endif
-            return ret;
+            break;
         }
 
@@ -8127 +9614 @@
             ret = wc_HashUpdate(hash, type, sinfo, sinfoSz);
             if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-                XFREE(hash, NULL, DYNAMIC_TYPE_HASHES);
-#endif
-                return ret;
+                break;
             }
         }
@@ -8136 +9620 @@
         ret = wc_HashFinal(hash, type, tmp);
         if (ret != 0) {
-#ifdef WOLFSSL_SMALL_STACK
-            XFREE(hash, NULL, DYNAMIC_TYPE_HASHES);
-#endif
-            return ret;
+            break;
         }
 
@@ -8149 +9630 @@
     }
 
+    wc_HashFree(hash, type);
+
 #ifdef WOLFSSL_SMALL_STACK
      XFREE(hash, NULL, DYNAMIC_TYPE_HASHES);
 #endif
 
-    return 0;
+    return ret;
 }
 #endif /* HAVE_X963_KDF */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/error.c

@@ -34 +34 @@
 #endif
 
+#ifndef NO_ERROR_STRINGS
 const char* wc_GetErrorString(int error)
 {
-#ifdef NO_ERROR_STRINGS
-
-    (void)error;
-    return "no support for error strings built in";
-
-#else
-
     switch (error) {
 
@@ -207 +201 @@
         return "X.509 Critical extension ignored or invalid";
 
+    case ASN_ALT_NAME_E:
+        return "ASN alternate name error";
+
     case ECC_BAD_ARG_E :
         return "ECC input argument wrong type, invalid input";
@@ -267 +264 @@
         return "ASN OCSP sig error, confirm failure";
 
+    case ASN_NO_PEM_HEADER:
+        return "ASN no PEM Header Error";
+
     case BAD_STATE_E:
         return "Bad state operation";
@@ -282 +282 @@
         return "PKCS#7 error: no matching recipient found";
 
+    case WC_PKCS7_WANT_READ_E:
+        return "PKCS#7 operations wants more input, call again";
+
     case FIPS_NOT_ALLOWED_E:
         return "FIPS mode not allowed error";
@@ -435 +438 @@
         return "Invalid use of private only ECC key";
 
+    case WC_HW_E:
+        return "Error with hardware crypto use";
+
+    case WC_HW_WAIT_E:
+        return "Hardware waiting on resource";
+
+    case PSS_SALTLEN_E:
+        return "PSS - Length of salt is too big for hash algorithm";
+
+    case PRIME_GEN_E:
+        return "Unable to find a prime for RSA key";
+
+    case BER_INDEF_E:
+        return "Unable to decode an indefinite length encoded message";
+
+    case RSA_OUT_OF_RANGE_E:
+        return "Ciphertext to decrypt is out of range";
+
+    case RSAPSS_PAT_FIPS_E:
+        return "wolfcrypt FIPS RSA-PSS Pairwise Agreement Test Failure";
+
+    case ECDSA_PAT_FIPS_E:
+        return "wolfcrypt FIPS ECDSA Pairwise Agreement Test Failure";
+
+    case DH_KAT_FIPS_E:
+        return "wolfcrypt FIPS DH Known Answer Test Failure";
+
+    case AESCCM_KAT_FIPS_E:
+        return "AESCCM Known Answer Test check FIPS error";
+
+    case SHA3_KAT_FIPS_E:
+        return "SHA-3 Known Answer Test check FIPS error";
+
+    case ECDHE_KAT_FIPS_E:
+        return "wolfcrypt FIPS ECDHE Known Answer Test Failure";
+
+    case AES_GCM_OVERFLOW_E:
+        return "AES-GCM invocation counter overflow";
+
+    case AES_CCM_OVERFLOW_E:
+        return "AES-CCM invocation counter overflow";
+
+    case RSA_KEY_PAIR_E:
+        return "RSA Key Pair-Wise Consistency check fail";
+
+    case DH_CHECK_PRIV_E:
+        return "DH Check Private Key failure";
+
+    case WC_AFALG_SOCK_E:
+        return "AF_ALG socket error";
+
+    case WC_DEVCRYPTO_E:
+        return "Error with /dev/crypto";
+
+    case ZLIB_INIT_ERROR:
+        return "zlib init error";
+
+    case ZLIB_COMPRESS_ERROR:
+        return "zlib compress error";
+
+    case ZLIB_DECOMPRESS_ERROR:
+        return "zlib decompress error";
+
+    case PKCS7_NO_SIGNER_E:
+        return "No signer in PKCS#7 signed data";
+
     default:
         return "unknown error number";
 
     }
-
-#endif /* NO_ERROR_STRINGS */
-
 }
 
@@ -448 +514 @@
     XSTRNCPY(buffer, wc_GetErrorString(error), WOLFSSL_MAX_ERROR_SZ);
 }
+#endif /* !NO_ERROR_STRINGS */
+

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/hash.c

@@ -47 +47 @@
     SHA512h = 416
 };
-#endif
+#endif /* !NO_ASN */
+
+#ifdef HAVE_SELFTEST
+enum {
+    /* CAVP selftest includes these in hmac.h instead of sha3.h,
+       copied here for that build */
+    WC_SHA3_224_BLOCK_SIZE = 144,
+    WC_SHA3_256_BLOCK_SIZE = 136,
+    WC_SHA3_384_BLOCK_SIZE = 104,
+    WC_SHA3_512_BLOCK_SIZE = 72,
+};
+#endif
+
+
+/* function converts int hash type to enum */
+enum wc_HashType wc_HashTypeConvert(int hashType)
+{
+    /* Default to hash type none as error */
+    enum wc_HashType eHashType = WC_HASH_TYPE_NONE;
+#if defined(HAVE_FIPS) || defined(HAVE_SELFTEST)
+    /* original FIPSv1  and CAVP selftest require a mapping for unique hash
+       type to wc_HashType */
+    switch (hashType) {
+    #ifndef NO_MD5
+        case WC_MD5:
+            eHashType = WC_HASH_TYPE_MD5;
+            break;
+    #endif /* !NO_MD5 */
+    #ifndef NO_SHA
+        case WC_SHA:
+            eHashType = WC_HASH_TYPE_SHA;
+            break;
+    #endif /* !NO_SHA */
+
+    #ifdef WOLFSSL_SHA224
+        case WC_SHA224:
+            eHashType = WC_HASH_TYPE_SHA224;
+            break;
+    #endif /* WOLFSSL_SHA224 */
+
+    #ifndef NO_SHA256
+        case WC_SHA256:
+            eHashType = WC_HASH_TYPE_SHA256;
+            break;
+    #endif /* !NO_SHA256 */
+
+    #ifdef WOLFSSL_SHA384
+        case WC_SHA384:
+            eHashType = WC_HASH_TYPE_SHA384;
+            break;
+    #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
+        case WC_SHA512:
+            eHashType = WC_HASH_TYPE_SHA512;
+            break;
+    #endif /* WOLFSSL_SHA512 */
+        default:
+            eHashType = WC_HASH_TYPE_NONE;
+            break;
+    }
+#else
+    /* current master uses same unique types as wc_HashType */
+    if (hashType > 0 && hashType <= WC_HASH_TYPE_MAX) {
+        eHashType = (enum wc_HashType)hashType;
+    }
+#endif
+    return eHashType;
+}
+
 
 int wc_HashGetOID(enum wc_HashType hash_type)
@@ -71 +139 @@
             break;
         case WC_HASH_TYPE_SHA224:
-        #if defined(WOLFSSL_SHA224)
+        #ifdef WOLFSSL_SHA224
             oid = SHA224h;
         #endif
@@ -81 +149 @@
             break;
         case WC_HASH_TYPE_SHA384:
-        #if defined(WOLFSSL_SHA512) && defined(WOLFSSL_SHA384)
+        #ifdef WOLFSSL_SHA384
             oid = SHA384h;
         #endif
@@ -93 +161 @@
         /* Not Supported */
         case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -100 +173 @@
     return oid;
 }
-#endif
+
+enum wc_HashType wc_OidGetHash(int oid)
+{
+    enum wc_HashType hash_type = WC_HASH_TYPE_NONE;
+    switch (oid)
+    {
+    #ifdef WOLFSSL_MD2
+        case MD2h:
+            hash_type = WC_HASH_TYPE_MD2;
+            break;
+    #endif
+        case MD5h:
+        #ifndef NO_MD5
+            hash_type = WC_HASH_TYPE_MD5;
+#endif
+            break;
+        case SHAh:
+        #ifndef NO_SHA
+            hash_type = WC_HASH_TYPE_SHA;
+        #endif
+            break;
+        case SHA224h:
+        #ifdef WOLFSSL_SHA224
+            hash_type = WC_HASH_TYPE_SHA224;
+        #endif
+            break;
+        case SHA256h:
+        #ifndef NO_SHA256
+            hash_type = WC_HASH_TYPE_SHA256;
+        #endif
+            break;
+        case SHA384h:
+        #ifdef WOLFSSL_SHA384
+            hash_type = WC_HASH_TYPE_SHA384;
+        #endif
+            break;
+        case SHA512h:
+        #ifdef WOLFSSL_SHA512
+            hash_type = WC_HASH_TYPE_SHA512;
+        #endif
+            break;
+        default:
+            break;
+    }
+    return hash_type;
+}
+#endif /* !NO_ASN || !NO_DH || HAVE_ECC */
+
+
 
 /* Get Hash digest size */
@@ -108 +229 @@
     switch(hash_type)
     {
+        case WC_HASH_TYPE_MD2:
+        #ifdef WOLFSSL_MD2
+            dig_size = MD2_DIGEST_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_MD4:
+        #ifndef NO_MD4
+            dig_size = MD4_DIGEST_SIZE;
+        #endif
+            break;
         case WC_HASH_TYPE_MD5:
 #ifndef NO_MD5
@@ -129 +260 @@
             break;
         case WC_HASH_TYPE_SHA384:
-#if defined(WOLFSSL_SHA512) && defined(WOLFSSL_SHA384)
+        #ifdef WOLFSSL_SHA384
             dig_size = WC_SHA384_DIGEST_SIZE;
 #endif
@@ -138 +269 @@
 #endif
             break;
-        case WC_HASH_TYPE_MD5_SHA:
+        case WC_HASH_TYPE_MD5_SHA: /* Old TLS Specific */
 #if !defined(NO_MD5) && !defined(NO_SHA)
-            dig_size = WC_MD5_DIGEST_SIZE + WC_SHA_DIGEST_SIZE;
+            dig_size = (int)WC_MD5_DIGEST_SIZE + (int)WC_SHA_DIGEST_SIZE;
+        #endif
+            break;
+
+        case WC_HASH_TYPE_SHA3_224:
+        #ifdef WOLFSSL_SHA3
+            dig_size = WC_SHA3_224_DIGEST_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_256:
+        #ifdef WOLFSSL_SHA3
+            dig_size = WC_SHA3_256_DIGEST_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_384:
+        #ifdef WOLFSSL_SHA3
+            dig_size = WC_SHA3_384_DIGEST_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_512:
+        #ifdef WOLFSSL_SHA3
+            dig_size = WC_SHA3_512_DIGEST_SIZE;
 #endif
             break;
 
         /* Not Supported */
-        case WC_HASH_TYPE_MD2:
-        case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -153 +304 @@
     }
     return dig_size;
+}
+
+
+/* Get Hash block size */
+int wc_HashGetBlockSize(enum wc_HashType hash_type)
+{
+    int block_size = HASH_TYPE_E; /* Default to hash type error */
+    switch (hash_type)
+    {
+        case WC_HASH_TYPE_MD2:
+        #ifdef WOLFSSL_MD2
+            block_size = MD2_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_MD4:
+        #ifndef NO_MD4
+            block_size = MD4_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_MD5:
+        #ifndef NO_MD5
+            block_size = WC_MD5_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA:
+        #ifndef NO_SHA
+            block_size = WC_SHA_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA224:
+        #ifdef WOLFSSL_SHA224
+            block_size = WC_SHA224_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA256:
+        #ifndef NO_SHA256
+            block_size = WC_SHA256_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA384:
+        #ifdef WOLFSSL_SHA384
+            block_size = WC_SHA384_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA512:
+        #ifdef WOLFSSL_SHA512
+            block_size = WC_SHA512_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_MD5_SHA: /* Old TLS Specific */
+        #if !defined(NO_MD5) && !defined(NO_SHA)
+            block_size = (int)WC_MD5_BLOCK_SIZE + (int)WC_SHA_BLOCK_SIZE;
+        #endif
+            break;
+
+        case WC_HASH_TYPE_SHA3_224:
+        #ifdef WOLFSSL_SHA3
+            block_size = WC_SHA3_224_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_256:
+        #ifdef WOLFSSL_SHA3
+            block_size = WC_SHA3_256_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_384:
+        #ifdef WOLFSSL_SHA3
+            block_size = WC_SHA3_384_BLOCK_SIZE;
+        #endif
+            break;
+        case WC_HASH_TYPE_SHA3_512:
+        #ifdef WOLFSSL_SHA3
+            block_size = WC_SHA3_512_BLOCK_SIZE;
+        #endif
+            break;
+
+        /* Not Supported */
+        case WC_HASH_TYPE_BLAKE2B:
+        case WC_HASH_TYPE_NONE:
+        default:
+            block_size = BAD_FUNC_ARG;
+            break;
+    }
+    return block_size;
 }
 
@@ -197 +432 @@
             break;
         case WC_HASH_TYPE_SHA384:
-#if defined(WOLFSSL_SHA512) && defined(WOLFSSL_SHA384)
+#ifdef WOLFSSL_SHA384
             ret = wc_Sha384Hash(data, data_len, hash);
 #endif
@@ -218 +453 @@
         case WC_HASH_TYPE_MD2:
         case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -236 +476 @@
         case WC_HASH_TYPE_MD5:
 #ifndef NO_MD5
-            wc_InitMd5(&hash->md5);
-            ret = 0;
+            ret = wc_InitMd5(&hash->md5);
 #endif
             break;
@@ -270 +509 @@
         case WC_HASH_TYPE_MD2:
         case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -289 +533 @@
         case WC_HASH_TYPE_MD5:
 #ifndef NO_MD5
-            wc_Md5Update(&hash->md5, data, dataSz);
-            ret = 0;
+            ret = wc_Md5Update(&hash->md5, data, dataSz);
 #endif
             break;
@@ -296 +539 @@
 #ifndef NO_SHA
             ret = wc_ShaUpdate(&hash->sha, data, dataSz);
-            if (ret != 0)
-                return ret;
 #endif
             break;
@@ -325 +566 @@
         case WC_HASH_TYPE_MD2:
         case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -343 +589 @@
         case WC_HASH_TYPE_MD5:
 #ifndef NO_MD5
-            wc_Md5Final(&hash->md5, out);
-            ret = 0;
+            ret = wc_Md5Final(&hash->md5, out);
 #endif
             break;
@@ -377 +622 @@
         case WC_HASH_TYPE_MD2:
         case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
         case WC_HASH_TYPE_NONE:
         default:
@@ -385 +635 @@
 }
 
+int wc_HashFree(wc_HashAlg* hash, enum wc_HashType type)
+{
+    int ret = HASH_TYPE_E; /* Default to hash type error */
+
+    if (hash == NULL)
+        return BAD_FUNC_ARG;
+
+    switch (type) {
+        case WC_HASH_TYPE_MD5:
+#ifndef NO_MD5
+            wc_Md5Free(&hash->md5);
+            ret = 0;
+#endif
+            break;
+        case WC_HASH_TYPE_SHA:
+#ifndef NO_SHA
+            wc_ShaFree(&hash->sha);
+            ret = 0;
+#endif
+            break;
+        case WC_HASH_TYPE_SHA224:
+#ifdef WOLFSSL_SHA224
+            wc_Sha224Free(&hash->sha224);
+            ret = 0;
+#endif
+            break;
+        case WC_HASH_TYPE_SHA256:
+#ifndef NO_SHA256
+            wc_Sha256Free(&hash->sha256);
+            ret = 0;
+#endif
+            break;
+        case WC_HASH_TYPE_SHA384:
+#ifdef WOLFSSL_SHA384
+            wc_Sha384Free(&hash->sha384);
+            ret = 0;
+#endif
+            break;
+        case WC_HASH_TYPE_SHA512:
+#ifdef WOLFSSL_SHA512
+            wc_Sha512Free(&hash->sha512);
+            ret = 0;
+#endif
+            break;
+
+        /* not supported */
+        case WC_HASH_TYPE_MD5_SHA:
+        case WC_HASH_TYPE_MD2:
+        case WC_HASH_TYPE_MD4:
+        case WC_HASH_TYPE_SHA3_224:
+        case WC_HASH_TYPE_SHA3_256:
+        case WC_HASH_TYPE_SHA3_384:
+        case WC_HASH_TYPE_SHA3_512:
+        case WC_HASH_TYPE_BLAKE2B:
+        case WC_HASH_TYPE_NONE:
+        default:
+            ret = BAD_FUNC_ARG;
+    };
+
+    return ret;
+}
+
 
 #if !defined(WOLFSSL_TI_HASH)
@@ -404 +716 @@
     #endif
 
-        ret = wc_InitMd5(md5);
-        if (ret == 0) {
-            ret = wc_Md5Update(md5, data, len);
-            if (ret == 0) {
-                ret = wc_Md5Final(md5, hash);
+        if ((ret = wc_InitMd5(md5)) != 0) {
+            WOLFSSL_MSG("InitMd5 failed");
+        }
+        else {
+            if ((ret = wc_Md5Update(md5, data, len)) != 0) {
+                WOLFSSL_MSG("Md5Update failed");
             }
+            else if ((ret = wc_Md5Final(md5, hash)) != 0) {
+                WOLFSSL_MSG("Md5Final failed");
+            }
+            wc_Md5Free(md5);
         }
 
@@ -437 +754 @@
 
         if ((ret = wc_InitSha(sha)) != 0) {
-            WOLFSSL_MSG("wc_InitSha failed");
+            WOLFSSL_MSG("InitSha failed");
         }
         else {
-            wc_ShaUpdate(sha, data, len);
-            wc_ShaFinal(sha, hash);
+            if ((ret = wc_ShaUpdate(sha, data, len)) != 0) {
+                WOLFSSL_MSG("ShaUpdate failed");
+            }
+            else if ((ret = wc_ShaFinal(sha, hash)) != 0) {
+                WOLFSSL_MSG("ShaFinal failed");
+            }
+            wc_ShaFree(sha);
         }
 
@@ -472 +794 @@
         WOLFSSL_MSG("InitSha224 failed");
     }
-    else if ((ret = wc_Sha224Update(sha224, data, len)) != 0) {
+        else {
+            if ((ret = wc_Sha224Update(sha224, data, len)) != 0) {
         WOLFSSL_MSG("Sha224Update failed");
     }
@@ -478 +801 @@
         WOLFSSL_MSG("Sha224Final failed");
     }
+            wc_Sha224Free(sha224);
+        }
 
 #ifdef WOLFSSL_SMALL_STACK
@@ -507 +832 @@
             WOLFSSL_MSG("InitSha256 failed");
         }
-        else if ((ret = wc_Sha256Update(sha256, data, len)) != 0) {
+        else {
+            if ((ret = wc_Sha256Update(sha256, data, len)) != 0) {
             WOLFSSL_MSG("Sha256Update failed");
         }
@@ -513 +839 @@
             WOLFSSL_MSG("Sha256Final failed");
         }
+            wc_Sha256Free(sha256);
+        }
+
 
     #ifdef WOLFSSL_SMALL_STACK
@@ -545 +874 @@
             WOLFSSL_MSG("InitSha512 failed");
         }
-        else if ((ret = wc_Sha512Update(sha512, data, len)) != 0) {
+        else {
+            if ((ret = wc_Sha512Update(sha512, data, len)) != 0) {
             WOLFSSL_MSG("Sha512Update failed");
         }
@@ -551 +881 @@
             WOLFSSL_MSG("Sha512Final failed");
         }
+            wc_Sha512Free(sha512);
+        }
 
     #ifdef WOLFSSL_SMALL_STACK
@@ -558 +890 @@
         return ret;
     }
+#endif /* WOLFSSL_SHA512 */
 
     #if defined(WOLFSSL_SHA384)
@@ -579 +912 @@
                 WOLFSSL_MSG("InitSha384 failed");
             }
-            else if ((ret = wc_Sha384Update(sha384, data, len)) != 0) {
+        else {
+            if ((ret = wc_Sha384Update(sha384, data, len)) != 0) {
                 WOLFSSL_MSG("Sha384Update failed");
             }
@@ -585 +919 @@
                 WOLFSSL_MSG("Sha384Final failed");
             }
+            wc_Sha384Free(sha384);
+        }
 
         #ifdef WOLFSSL_SMALL_STACK
@@ -593 +929 @@
         }
     #endif /* WOLFSSL_SHA384 */
-#endif /* WOLFSSL_SHA512 */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/hc128.c

@@ -273 +273 @@
 
 
-static INLINE int DoKey(HC128* ctx, const byte* key, const byte* iv)
+static WC_INLINE int DoKey(HC128* ctx, const byte* key, const byte* iv)
 {
   word32 i;
@@ -336 +336 @@
 
 /* The following defines the encryption of data stream */
-static INLINE int DoProcess(HC128* ctx, byte* output, const byte* input,
+static WC_INLINE int DoProcess(HC128* ctx, byte* output, const byte* input,
                             word32 msglen)
 {

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/hmac.c

@@ -1 @@
-/* hmac.h
+/* hmac.c
  *
  * Copyright (C) 2006-2017 wolfSSL Inc.
@@ -30 +30 @@
 #ifndef NO_HMAC
 
+#if defined(HAVE_FIPS) && \
+    defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$b")
+        #pragma const_seg(".fipsB$b")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/hmac.h>
 
@@ -41 +53 @@
 
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+/* If building for old FIPS. */
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
     /* does init */
     int wc_HmacSetKey(Hmac* hmac, int type, const byte* key, word32 keySz)
@@ -47 +62 @@
         if (hmac == NULL || (key == NULL && keySz != 0) ||
            !(type == WC_MD5 || type == WC_SHA || type == WC_SHA256 ||
-                type == WC_SHA384 || type == WC_SHA512 || type == BLAKE2B_ID)) {
+                type == WC_SHA384 || type == WC_SHA512 ||
+                type == BLAKE2B_ID)) {
             return BAD_FUNC_ARG;
         }
@@ -101 +117 @@
     #endif /* HAVE_HKDF */
 
-#else /* else build without fips */
-
-
-#include <wolfssl/wolfcrypt/error-crypt.h>
+#else /* else build without fips, or for new fips */
 
 
@@ -111 +124 @@
     int ret;
 
-    if (!(type == WC_MD5 || type == WC_SHA || type == WC_SHA224 ||
-            type == WC_SHA256 || type == WC_SHA384 || type == WC_SHA512 ||
+    if (!(type == WC_MD5 || type == WC_SHA ||
+            type == WC_SHA224 || type == WC_SHA256 ||
+            type == WC_SHA384 || type == WC_SHA512 ||
+            type == WC_SHA3_224 || type == WC_SHA3_256 ||
+            type == WC_SHA3_384 || type == WC_SHA3_512 ||
             type == BLAKE2B_ID)) {
         return BAD_FUNC_ARG;
@@ -142 +158 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -148 +163 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = WC_SHA512_DIGEST_SIZE;
@@ -159 +175 @@
     #endif /* HAVE_BLAKE2 */
 
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            ret = WC_SHA3_224_DIGEST_SIZE;
+            break;
+
+        case WC_SHA3_256:
+            ret = WC_SHA3_256_DIGEST_SIZE;
+            break;
+
+        case WC_SHA3_384:
+            ret = WC_SHA3_384_DIGEST_SIZE;
+            break;
+
+        case WC_SHA3_512:
+            ret = WC_SHA3_512_DIGEST_SIZE;
+            break;
+
+    #endif
+
         default:
             ret = BAD_FUNC_ARG;
@@ -167 +202 @@
 }
 
-static int _InitHmac(Hmac* hmac, int type, void* heap)
+int _InitHmac(Hmac* hmac, int type, void* heap)
 {
     int ret = 0;
@@ -196 +231 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -202 +236 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = wc_InitSha512(&hmac->hash.sha512);
@@ -212 +247 @@
             break;
     #endif /* HAVE_BLAKE2 */
+
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            ret = wc_InitSha3_224(&hmac->hash.sha3, heap, INVALID_DEVID);
+            break;
+        case WC_SHA3_256:
+            ret = wc_InitSha3_256(&hmac->hash.sha3, heap, INVALID_DEVID);
+            break;
+        case WC_SHA3_384:
+            ret = wc_InitSha3_384(&hmac->hash.sha3, heap, INVALID_DEVID);
+            break;
+        case WC_SHA3_512:
+            ret = wc_InitSha3_512(&hmac->hash.sha3, heap, INVALID_DEVID);
+            break;
+    #endif
 
         default:
@@ -238 +288 @@
 
     if (hmac == NULL || (key == NULL && length != 0) ||
-        !(type == WC_MD5 || type == WC_SHA || type == WC_SHA224 ||
-            type == WC_SHA256 || type == WC_SHA384 || type == WC_SHA512 ||
+       !(type == WC_MD5 || type == WC_SHA ||
+            type == WC_SHA224 || type == WC_SHA256 ||
+            type == WC_SHA384 || type == WC_SHA512 ||
+            type == WC_SHA3_224 || type == WC_SHA3_256 ||
+            type == WC_SHA3_384 || type == WC_SHA3_512 ||
             type == BLAKE2B_ID)) {
         return BAD_FUNC_ARG;
     }
 
+    /* if set key has already been run then make sure and free existing */
+    if (hmac->macType != 0) {
+        wc_HmacFree(hmac);
+        }
+
     hmac->innerHashKeyed = 0;
     hmac->macType = (byte)type;
-
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)
-    if (hmac->asyncDev.marker == WOLFSSL_ASYNC_MARKER_HMAC) {
-    #if defined(HAVE_CAVIUM)
-        if (length > HMAC_BLOCK_SIZE) {
-            return WC_KEY_SIZE_E;
-        }
-
-        if (key != NULL) {
-            XMEMCPY(hmac->ipad, key, length);
-        }
-        hmac->keyLen = (word16)length;
-
-        return 0; /* nothing to do here */
-    #endif /* HAVE_CAVIUM */
-    }
-#endif /* WOLFSSL_ASYNC_CRYPT */
 
     ret = _InitHmac(hmac, type, heap);
@@ -362 +403 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -383 +423 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             hmac_block_size = WC_SHA512_BLOCK_SIZE;
@@ -424 +465 @@
     #endif /* HAVE_BLAKE2 */
 
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            hmac_block_size = WC_SHA3_224_BLOCK_SIZE;
+            if (length <= WC_SHA3_224_BLOCK_SIZE) {
+                if (key != NULL) {
+                    XMEMCPY(ip, key, length);
+                }
+            }
+            else {
+                ret = wc_Sha3_224_Update(&hmac->hash.sha3, key, length);
+                if (ret != 0)
+                    break;
+                ret = wc_Sha3_224_Final(&hmac->hash.sha3, ip);
+                if (ret != 0)
+                    break;
+
+                length = WC_SHA3_224_DIGEST_SIZE;
+            }
+            break;
+        case WC_SHA3_256:
+            hmac_block_size = WC_SHA3_256_BLOCK_SIZE;
+            if (length <= WC_SHA3_256_BLOCK_SIZE) {
+                if (key != NULL) {
+                    XMEMCPY(ip, key, length);
+                }
+            }
+            else {
+                ret = wc_Sha3_256_Update(&hmac->hash.sha3, key, length);
+                if (ret != 0)
+                    break;
+                ret = wc_Sha3_256_Final(&hmac->hash.sha3, ip);
+                if (ret != 0)
+                    break;
+
+                length = WC_SHA3_256_DIGEST_SIZE;
+            }
+            break;
+        case WC_SHA3_384:
+            hmac_block_size = WC_SHA3_384_BLOCK_SIZE;
+            if (length <= WC_SHA3_384_BLOCK_SIZE) {
+                if (key != NULL) {
+                    XMEMCPY(ip, key, length);
+                }
+            }
+            else {
+                ret = wc_Sha3_384_Update(&hmac->hash.sha3, key, length);
+                if (ret != 0)
+                    break;
+                ret = wc_Sha3_384_Final(&hmac->hash.sha3, ip);
+                if (ret != 0)
+                    break;
+
+                length = WC_SHA3_384_DIGEST_SIZE;
+            }
+            break;
+        case WC_SHA3_512:
+            hmac_block_size = WC_SHA3_512_BLOCK_SIZE;
+            if (length <= WC_SHA3_512_BLOCK_SIZE) {
+                if (key != NULL) {
+                    XMEMCPY(ip, key, length);
+                }
+            }
+            else {
+                ret = wc_Sha3_512_Update(&hmac->hash.sha3, key, length);
+                if (ret != 0)
+                    break;
+                ret = wc_Sha3_512_Final(&hmac->hash.sha3, ip);
+                if (ret != 0)
+                    break;
+
+                length = WC_SHA3_512_DIGEST_SIZE;
+            }
+            break;
+    #endif /* WOLFSSL_SHA3 */
+
         default:
             return BAD_FUNC_ARG;
@@ -430 +546 @@
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)
     if (hmac->asyncDev.marker == WOLFSSL_ASYNC_MARKER_HMAC) {
-    #if defined(HAVE_INTEL_QA)
+    #if defined(HAVE_INTEL_QA) || defined(HAVE_CAVIUM)
+        #ifdef HAVE_INTEL_QA
+        if (IntelQaHmacGetType(hmac->macType, NULL) == 0)
+        #endif
+        {
         if (length > hmac_block_size)
             length = hmac_block_size;
@@ -437 +557 @@
 
         return ret;
+        }
         /* no need to pad below */
     #endif
@@ -489 +610 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -496 +616 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = wc_Sha512Update(&hmac->hash.sha512, (byte*)hmac->ipad,
@@ -508 +629 @@
             break;
     #endif /* HAVE_BLAKE2 */
+
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            ret = wc_Sha3_224_Update(&hmac->hash.sha3, (byte*)hmac->ipad,
+                                                       WC_SHA3_224_BLOCK_SIZE);
+            break;
+        case WC_SHA3_256:
+            ret = wc_Sha3_256_Update(&hmac->hash.sha3, (byte*)hmac->ipad,
+                                                       WC_SHA3_256_BLOCK_SIZE);
+            break;
+        case WC_SHA3_384:
+            ret = wc_Sha3_384_Update(&hmac->hash.sha3, (byte*)hmac->ipad,
+                                                       WC_SHA3_384_BLOCK_SIZE);
+            break;
+        case WC_SHA3_512:
+            ret = wc_Sha3_512_Update(&hmac->hash.sha3, (byte*)hmac->ipad,
+                                                       WC_SHA3_512_BLOCK_SIZE);
+            break;
+    #endif /* WOLFSSL_SHA3 */
 
         default:
@@ -533 +673 @@
         return NitroxHmacUpdate(hmac, msg, length);
     #elif defined(HAVE_INTEL_QA)
+        if (IntelQaHmacGetType(hmac->macType, NULL) == 0) {
         return IntelQaHmac(&hmac->asyncDev, hmac->macType,
             (byte*)hmac->ipad, hmac->keyLen, NULL, msg, length);
+        }
     #endif
     }
@@ -570 +712 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -576 +717 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = wc_Sha512Update(&hmac->hash.sha512, msg, length);
@@ -586 +728 @@
             break;
     #endif /* HAVE_BLAKE2 */
+
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            ret = wc_Sha3_224_Update(&hmac->hash.sha3, msg, length);
+            break;
+        case WC_SHA3_256:
+            ret = wc_Sha3_256_Update(&hmac->hash.sha3, msg, length);
+            break;
+        case WC_SHA3_384:
+            ret = wc_Sha3_384_Update(&hmac->hash.sha3, msg, length);
+            break;
+        case WC_SHA3_512:
+            ret = wc_Sha3_512_Update(&hmac->hash.sha3, msg, length);
+            break;
+    #endif /* WOLFSSL_SHA3 */
 
         default:
@@ -610 +767 @@
 
     #if defined(HAVE_CAVIUM)
-        return NitroxHmacFinal(hmac, hmac->macType, hash, hashLen);
+        return NitroxHmacFinal(hmac, hash, hashLen);
     #elif defined(HAVE_INTEL_QA)
+        if (IntelQaHmacGetType(hmac->macType, NULL) == 0) {
         return IntelQaHmac(&hmac->asyncDev, hmac->macType,
             (byte*)hmac->ipad, hmac->keyLen, hash, NULL, hashLen);
+        }
     #endif
     }
@@ -697 +856 @@
     #endif /* !NO_SHA256 */
 
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
@@ -714 +872 @@
             break;
     #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = wc_Sha512Final(&hmac->hash.sha512, (byte*)hmac->innerHash);
@@ -748 +907 @@
     #endif /* HAVE_BLAKE2 */
 
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            ret = wc_Sha3_224_Final(&hmac->hash.sha3, (byte*)hmac->innerHash);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_224_Update(&hmac->hash.sha3, (byte*)hmac->opad,
+                                                       WC_SHA3_224_BLOCK_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_224_Update(&hmac->hash.sha3, (byte*)hmac->innerHash,
+                                                          WC_SHA3_224_DIGEST_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_224_Final(&hmac->hash.sha3, hash);
+            break;
+        case WC_SHA3_256:
+            ret = wc_Sha3_256_Final(&hmac->hash.sha3, (byte*)hmac->innerHash);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_256_Update(&hmac->hash.sha3, (byte*)hmac->opad,
+                                                       WC_SHA3_256_BLOCK_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_256_Update(&hmac->hash.sha3, (byte*)hmac->innerHash,
+                                                          WC_SHA3_256_DIGEST_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_256_Final(&hmac->hash.sha3, hash);
+            break;
+        case WC_SHA3_384:
+            ret = wc_Sha3_384_Final(&hmac->hash.sha3, (byte*)hmac->innerHash);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_384_Update(&hmac->hash.sha3, (byte*)hmac->opad,
+                                                       WC_SHA3_384_BLOCK_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_384_Update(&hmac->hash.sha3, (byte*)hmac->innerHash,
+                                                          WC_SHA3_384_DIGEST_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_384_Final(&hmac->hash.sha3, hash);
+            break;
+        case WC_SHA3_512:
+            ret = wc_Sha3_512_Final(&hmac->hash.sha3, (byte*)hmac->innerHash);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_512_Update(&hmac->hash.sha3, (byte*)hmac->opad,
+                                                       WC_SHA3_512_BLOCK_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_512_Update(&hmac->hash.sha3, (byte*)hmac->innerHash,
+                                                          WC_SHA3_512_DIGEST_SIZE);
+            if (ret != 0)
+                break;
+            ret = wc_Sha3_512_Final(&hmac->hash.sha3, hash);
+            break;
+    #endif /* WOLFSSL_SHA3 */
+
         default:
             ret = BAD_FUNC_ARG;
@@ -774 +992 @@
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)
     hmac->keyLen = 0;
-    #ifdef HAVE_CAVIUM
-        hmac->dataLen = 0;
-        hmac->data    = NULL;        /* buffered input data */
-    #endif /* HAVE_CAVIUM */
 
     ret = wolfAsync_DevCtxInit(&hmac->asyncDev, WOLFSSL_ASYNC_MARKER_HMAC,
@@ -794 +1008 @@
         return;
 
+    switch (hmac->macType) {
+    #ifndef NO_MD5
+        case WC_MD5:
+            wc_Md5Free(&hmac->hash.md5);
+            break;
+    #endif /* !NO_MD5 */
+
+    #ifndef NO_SHA
+        case WC_SHA:
+            wc_ShaFree(&hmac->hash.sha);
+            break;
+    #endif /* !NO_SHA */
+
+    #ifdef WOLFSSL_SHA224
+        case WC_SHA224:
+            wc_Sha224Free(&hmac->hash.sha224);
+            break;
+    #endif /* WOLFSSL_SHA224 */
+
+    #ifndef NO_SHA256
+        case WC_SHA256:
+            wc_Sha256Free(&hmac->hash.sha256);
+            break;
+    #endif /* !NO_SHA256 */
+
+    #ifdef WOLFSSL_SHA384
+        case WC_SHA384:
+            wc_Sha384Free(&hmac->hash.sha384);
+            break;
+    #endif /* WOLFSSL_SHA384 */
+    #ifdef WOLFSSL_SHA512
+        case WC_SHA512:
+            wc_Sha512Free(&hmac->hash.sha512);
+            break;
+    #endif /* WOLFSSL_SHA512 */
+
+    #ifdef HAVE_BLAKE2
+        case BLAKE2B_ID:
+            break;
+    #endif /* HAVE_BLAKE2 */
+
+    #ifdef WOLFSSL_SHA3
+        case WC_SHA3_224:
+            wc_Sha3_224_Free(&hmac->hash.sha3);
+            break;
+        case WC_SHA3_256:
+            wc_Sha3_256_Free(&hmac->hash.sha3);
+            break;
+        case WC_SHA3_384:
+            wc_Sha3_384_Free(&hmac->hash.sha3);
+            break;
+        case WC_SHA3_512:
+            wc_Sha3_512_Free(&hmac->hash.sha3);
+            break;
+    #endif /* WOLFSSL_SHA3 */
+
+        default:
+            break;
+    }
+
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)
     wolfAsync_DevCtxFree(&hmac->asyncDev, WOLFSSL_ASYNC_MARKER_HMAC);
-
-#ifdef HAVE_CAVIUM
-    XFREE(hmac->data, hmac->heap, DYNAMIC_TYPE_HMAC);
-    hmac->data = NULL;
-#endif /* HAVE_CAVIUM */
 #endif /* WOLFSSL_ASYNC_CRYPT */
+
+    switch (hmac->macType) {
+    #ifndef NO_MD5
+        case WC_MD5:
+            wc_Md5Free(&hmac->hash.md5);
+            break;
+    #endif /* !NO_MD5 */
+
+    #ifndef NO_SHA
+        case WC_SHA:
+            wc_ShaFree(&hmac->hash.sha);
+            break;
+    #endif /* !NO_SHA */
+
+    #ifdef WOLFSSL_SHA224
+        case WC_SHA224:
+            wc_Sha224Free(&hmac->hash.sha224);
+            break;
+    #endif /* WOLFSSL_SHA224 */
+
+    #ifndef NO_SHA256
+        case WC_SHA256:
+            wc_Sha256Free(&hmac->hash.sha256);
+            break;
+    #endif /* !NO_SHA256 */
+
+    #ifdef WOLFSSL_SHA512
+    #ifdef WOLFSSL_SHA384
+        case WC_SHA384:
+            wc_Sha384Free(&hmac->hash.sha384);
+            break;
+    #endif /* WOLFSSL_SHA384 */
+        case WC_SHA512:
+            wc_Sha512Free(&hmac->hash.sha512);
+            break;
+    #endif /* WOLFSSL_SHA512 */
+    }
 }
 
 int wolfSSL_GetHmacMaxSize(void)
 {
-    return MAX_DIGEST_SIZE;
+    return WC_MAX_DIGEST_SIZE;
 }
 
@@ -824 +1130 @@
                         const byte* inKey, word32 inKeySz, byte* out)
     {
-        byte   tmp[MAX_DIGEST_SIZE]; /* localSalt helper */
+        byte   tmp[WC_MAX_DIGEST_SIZE]; /* localSalt helper */
         Hmac   myHmac;
         int    ret;
@@ -869 +1175 @@
                        const byte* info, word32 infoSz, byte* out, word32 outSz)
     {
-        byte   tmp[MAX_DIGEST_SIZE];
+        byte   tmp[WC_MAX_DIGEST_SIZE];
         Hmac   myHmac;
         int    ret = 0;
@@ -930 +1236 @@
                        byte* out,         word32 outSz)
     {
-        byte   prk[MAX_DIGEST_SIZE];
+        byte   prk[WC_MAX_DIGEST_SIZE];
         int    hashSz = wc_HmacSizeByType(type);
         int    ret;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/integer.c

@@ -46 +46 @@
 #ifndef USE_FAST_MATH
 
+#ifndef WOLFSSL_SP_MATH
+
 #include <wolfssl/wolfcrypt/integer.h>
 
@@ -320 +322 @@
 }
 
+int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c)
+{
+    int i, len;
+
+    len = mp_unsigned_bin_size(a);
+
+    /* pad front w/ zeros to match length */
+    for (i = 0; i < c - len; i++)
+        b[i] = 0x00;
+    return mp_to_unsigned_bin(a, b + i);
+}
 
 /* creates "a" then copies b into it */
@@ -3977 +3990 @@
 
 
-#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_ECC)
+#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_ECC) || !defined(NO_RSA) || \
+    !defined(NO_DSA) | !defined(NO_DH)
 
 /* c = a * a (mod b) */
@@ -4003 +4017 @@
 #if defined(HAVE_ECC) || !defined(NO_PWDBASED) || defined(WOLFSSL_SNIFFER) || \
     defined(WOLFSSL_HAVE_WOLFSCEP) || defined(WOLFSSL_KEY_GEN) || \
-    defined(OPENSSL_EXTRA) || defined(WC_RSA_BLINDING)
+    defined(OPENSSL_EXTRA) || defined(WC_RSA_BLINDING) || \
+    (!defined(NO_RSA) && !defined(NO_RSA_BOUNDS_CHECK))
 
 /* single digit addition */
@@ -4170 +4185 @@
 
 
-#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) || defined(HAVE_ECC)
+#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) || defined(HAVE_ECC) || \
+    defined(DEBUG_WOLFSSL) || !defined(NO_RSA) || !defined(NO_DSA) || \
+    !defined(NO_DH)
 
 static const int lnz[16] = {
@@ -4316 +4333 @@
 }
 
-#endif /* defined(WOLFSSL_KEY_GEN)||defined(HAVE_COMP_KEY)||defined(HAVE_ECC) */
-
-#ifdef WOLFSSL_KEY_GEN
+#endif /* WOLFSSL_KEY_GEN || HAVE_COMP_KEY || HAVE_ECC || DEBUG_WOLFSSL */
+
+#if defined(WOLFSSL_KEY_GEN) || !defined(NO_DH) || !defined(NO_DSA) || !defined(NO_RSA)
 
 const mp_digit ltm_prime_tab[PRIME_SIZE] = {
@@ -4474 +4491 @@
 }
 
+/*
+ * Sets result to 1 if probably prime, 0 otherwise
+ */
+int mp_prime_is_prime (mp_int * a, int t, int *result)
+{
+  mp_int  b;
+  int     ix, err, res;
+
+  /* default to no */
+  *result = MP_NO;
+
+  /* valid value of t? */
+  if (t <= 0 || t > PRIME_SIZE) {
+        return MP_VAL;
+    }
+
+  /* is the input equal to one of the primes in the table? */
+  for (ix = 0; ix < PRIME_SIZE; ix++) {
+      if (mp_cmp_d(a, ltm_prime_tab[ix]) == MP_EQ) {
+         *result = 1;
+         return MP_OKAY;
+      }
+    }
+
+  /* first perform trial division */
+  if ((err = mp_prime_is_divisible (a, &res)) != MP_OKAY) {
+            return err;
+        }
+
+  /* return if it was trivially divisible */
+  if (res == MP_YES) {
+    return MP_OKAY;
+  }
+
+  /* now perform the miller-rabin rounds */
+  if ((err = mp_init (&b)) != MP_OKAY) {
+            return err;
+        }
+
+  for (ix = 0; ix < t; ix++) {
+    /* set the prime */
+    if ((err = mp_set (&b, ltm_prime_tab[ix])) != MP_OKAY) {
+        goto LBL_B;
+        }
+
+    if ((err = mp_prime_miller_rabin (a, &b, &res)) != MP_OKAY) {
+      goto LBL_B;
+    }
+
+    if (res == MP_NO) {
+      goto LBL_B;
+    }
+  }
+
+  /* passed the test */
+  *result = MP_YES;
+LBL_B:mp_clear (&b);
+  return err;
+}
+
+
+/*
+ * Sets result to 1 if probably prime, 0 otherwise
+ */
+int mp_prime_is_prime_ex (mp_int * a, int t, int *result, WC_RNG *rng)
+{
+  mp_int  b, c;
+  int     ix, err, res;
+  byte*   base = NULL;
+  word32  baseSz = 0;
+
+  /* default to no */
+  *result = MP_NO;
+
+  /* valid value of t? */
+  if (t <= 0 || t > PRIME_SIZE) {
+    return MP_VAL;
+  }
+
+  /* is the input equal to one of the primes in the table? */
+  for (ix = 0; ix < PRIME_SIZE; ix++) {
+      if (mp_cmp_d(a, ltm_prime_tab[ix]) == MP_EQ) {
+         *result = MP_YES;
+         return MP_OKAY;
+      }
+  }
+
+  /* first perform trial division */
+  if ((err = mp_prime_is_divisible (a, &res)) != MP_OKAY) {
+    return err;
+  }
+
+  /* return if it was trivially divisible */
+  if (res == MP_YES) {
+    return MP_OKAY;
+  }
+
+  /* now perform the miller-rabin rounds */
+  if ((err = mp_init (&b)) != MP_OKAY) {
+    return err;
+  }
+  if ((err = mp_init (&c)) != MP_OKAY) {
+      mp_clear(&b);
+    return err;
+  }
+
+  baseSz = mp_count_bits(a);
+  baseSz = (baseSz / 8) + ((baseSz % 8) ? 1 : 0);
+
+  base = (byte*)XMALLOC(baseSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+  if (base == NULL) {
+      err = MP_MEM;
+      goto LBL_B;
+  }
+
+  if ((err = mp_sub_d(a, 2, &c)) != MP_OKAY) {
+      goto LBL_B;
+  }
+
+ /* now do a miller rabin with up to t random numbers, this should
+  * give a (1/4)^t chance of a false prime. */
+  for (ix = 0; ix < t; ix++) {
+    /* Set a test candidate. */
+    if ((err = wc_RNG_GenerateBlock(rng, base, baseSz)) != 0) {
+        goto LBL_B;
+    }
+
+    if ((err = mp_read_unsigned_bin(&b, base, baseSz)) != MP_OKAY) {
+        goto LBL_B;
+    }
+
+    if (mp_cmp_d(&b, 2) != MP_GT || mp_cmp(&b, &c) != MP_LT)
+        continue;
+
+    if ((err = mp_prime_miller_rabin (a, &b, &res)) != MP_OKAY) {
+      goto LBL_B;
+    }
+
+    if (res == MP_NO) {
+      goto LBL_B;
+    }
+  }
+
+  /* passed the test */
+  *result = MP_YES;
+LBL_B:mp_clear (&b);
+      mp_clear (&c);
+      XFREE(base, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+  return err;
+}
+
+#endif /* WOLFSSL_KEY_GEN NO_DH NO_DSA NO_RSA */
+
+#ifdef WOLFSSL_KEY_GEN
+
 static const int USE_BBS = 1;
 
@@ -4527 +4699 @@
 
         /* test */
-        if ((err = mp_prime_is_prime(N, 8, &res)) != MP_OKAY) {
+        /* Running Miller-Rabin up to 3 times gives us a 2^{-80} chance
+         * of a 1024-bit candidate being a false positive, when it is our
+         * prime candidate. (Note 4.49 of Handbook of Applied Cryptography.)
+         * Using 8 because we've always used 8. */
+        if ((err = mp_prime_is_prime_ex(N, 8, &res, rng)) != MP_OKAY) {
             XFREE(buf, heap, DYNAMIC_TYPE_RSA);
             return err;
@@ -4537 +4713 @@
 
     return MP_OKAY;
-}
-
-/*
- * Sets result to 1 if probably prime, 0 otherwise
- */
-int mp_prime_is_prime (mp_int * a, int t, int *result)
-{
-  mp_int  b;
-  int     ix, err, res;
-
-  /* default to no */
-  *result = MP_NO;
-
-  /* valid value of t? */
-  if (t <= 0 || t > PRIME_SIZE) {
-    return MP_VAL;
-  }
-
-  /* is the input equal to one of the primes in the table? */
-  for (ix = 0; ix < PRIME_SIZE; ix++) {
-      if (mp_cmp_d(a, ltm_prime_tab[ix]) == MP_EQ) {
-         *result = 1;
-         return MP_OKAY;
-      }
-  }
-
-  /* first perform trial division */
-  if ((err = mp_prime_is_divisible (a, &res)) != MP_OKAY) {
-    return err;
-  }
-
-  /* return if it was trivially divisible */
-  if (res == MP_YES) {
-    return MP_OKAY;
-  }
-
-  /* now perform the miller-rabin rounds */
-  if ((err = mp_init (&b)) != MP_OKAY) {
-    return err;
-  }
-
-  for (ix = 0; ix < t; ix++) {
-    /* set the prime */
-    if ((err = mp_set (&b, ltm_prime_tab[ix])) != MP_OKAY) {
-        goto LBL_B;
-    }
-
-    if ((err = mp_prime_miller_rabin (a, &b, &res)) != MP_OKAY) {
-      goto LBL_B;
-    }
-
-    if (res == MP_NO) {
-      goto LBL_B;
-    }
-  }
-
-  /* passed the test */
-  *result = MP_YES;
-LBL_B:mp_clear (&b);
-  return err;
 }
 
@@ -4729 +4845 @@
 
 
-#if defined(HAVE_ECC) || defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY)
+#if !defined(NO_DSA) || defined(HAVE_ECC) || defined(WOLFSSL_KEY_GEN) || \
+    defined(HAVE_COMP_KEY) || defined(WOLFSSL_DEBUG_MATH) || \
+    defined(DEBUG_WOLFSSL) || defined(OPENSSL_EXTRA)
 
 /* chars used in radix conversions */
@@ -4736 +4854 @@
 #endif
 
-#ifdef HAVE_ECC
+#if !defined(NO_DSA) || defined(HAVE_ECC)
 /* read a string [ASCII] in a given radix */
 int mp_read_radix (mp_int * a, const char *str, int radix)
@@ -4747 +4865 @@
 
   /* make sure the radix is ok */
-  if (radix < 2 || radix > 64) {
+  if (radix < MP_RADIX_BIN || radix > MP_RADIX_MAX) {
     return MP_VAL;
   }
@@ -4806 +4924 @@
   return MP_OKAY;
 }
-#endif /* HAVE_ECC */
-
-#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) || \
-    defined(WOLFSSL_DEBUG_MATH)
+#endif /* !defined(NO_DSA) || defined(HAVE_ECC) */
+
+#ifdef WC_MP_TO_RADIX
 
 /* returns size of ASCII representation */
@@ -4821 +4938 @@
 
     /* special case for binary */
-    if (radix == 2) {
+    if (radix == MP_RADIX_BIN) {
         *size = mp_count_bits (a) + (a->sign == MP_NEG ? 1 : 0) + 1;
         return MP_OKAY;
@@ -4827 +4944 @@
 
     /* make sure the radix is in range */
-    if (radix < 2 || radix > 64) {
+    if (radix < MP_RADIX_BIN || radix > MP_RADIX_MAX) {
         return MP_VAL;
     }
@@ -4876 +4993 @@
 
     /* check range of the radix */
-    if (radix < 2 || radix > 64) {
+    if (radix < MP_RADIX_BIN || radix > MP_RADIX_MAX) {
         return MP_VAL;
     }
@@ -4934 +5051 @@
     desc, a, a->used, a->sign, size, (int)sizeof(mp_digit));
 
-  mp_toradix(a, buffer, 16);
+  mp_tohex(a, buffer);
   printf("  %s\n  ", buffer);
 
@@ -4949 +5066 @@
 #endif /* WOLFSSL_DEBUG_MATH */
 
-#endif /* defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) || defined(WOLFSSL_DEBUG_MATH) */
+#endif /* WC_MP_TO_RADIX */
+
+#endif /* WOLFSSL_SP_MATH */
 
 #endif /* USE_FAST_MATH */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/logging.c

@@ -31 +31 @@
 #include <wolfssl/wolfcrypt/logging.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
-
-
-#ifdef __cplusplus
-    extern "C" {
-#endif
-    WOLFSSL_API int  wolfSSL_Debugging_ON(void);
-    WOLFSSL_API void wolfSSL_Debugging_OFF(void);
-#ifdef __cplusplus
-    }
+#if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY)
+/* avoid adding WANT_READ and WANT_WRITE to error queue */
+#include <wolfssl/error-ssl.h>
 #endif
 
@@ -58 +52 @@
 };
 volatile struct wc_error_queue* wc_errors;
+static struct wc_error_queue* wc_current_node;
 static struct wc_error_queue* wc_last_node;
 /* pointer to last node in queue to make insertion O(1) */
 #endif
 
-
-
-#if defined(DEBUG_WOLFSSL)
+#ifdef WOLFSSL_FUNC_TIME
+/* WARNING: This code is only to be used for debugging performance.
+ *          The code is not thread-safe.
+ *          Do not use WOLFSSL_FUNC_TIME in production code.
+ */
+static double wc_func_start[WC_FUNC_COUNT];
+static double wc_func_time[WC_FUNC_COUNT] = { 0, };
+static const char* wc_func_name[WC_FUNC_COUNT] = {
+    "SendHelloRequest",
+    "DoHelloRequest",
+    "SendClientHello",
+    "DoClientHello",
+    "SendServerHello",
+    "DoServerHello",
+    "SendEncryptedExtensions",
+    "DoEncryptedExtensions",
+    "SendCertificateRequest",
+    "DoCertificateRequest",
+    "SendCertificate",
+    "DoCertificate",
+    "SendCertificateVerify",
+    "DoCertificateVerify",
+    "SendFinished",
+    "DoFinished",
+    "SendKeyUpdate",
+    "DoKeyUpdate",
+    "SendEarlyData",
+    "DoEarlyData",
+    "SendNewSessionTicket",
+    "DoNewSessionTicket",
+    "SendServerHelloDone",
+    "DoServerHelloDone",
+    "SendTicket",
+    "DoTicket",
+    "SendClientKeyExchange",
+    "DoClientKeyExchange",
+    "SendCertificateStatus",
+    "DoCertificateStatus",
+    "SendServerKeyExchange",
+    "DoServerKeyExchange",
+    "SendEarlyData",
+    "DoEarlyData",
+};
+
+#include <sys/time.h>
+
+/* WARNING: This function is not portable. */
+static WC_INLINE double current_time(int reset)
+{
+    struct timeval tv;
+    gettimeofday(&tv, 0);
+    (void)reset;
+
+    return (double)tv.tv_sec + (double)tv.tv_usec / 1000000;
+}
+#endif /* WOLFSSL_FUNC_TIME */
+
+#ifdef DEBUG_WOLFSSL
 
 /* Set these to default values initially. */
@@ -70 +120 @@
 static int loggingEnabled = 0;
 
+#if defined(WOLFSSL_APACHE_MYNEWT)
+#include "log/log.h"
+static struct log mynewt_log;
+#endif /* WOLFSSL_APACHE_MYNEWT */
+
 #endif /* DEBUG_WOLFSSL */
 
 
+/* allow this to be set to NULL, so logs can be redirected to default output */
 int wolfSSL_SetLoggingCb(wolfSSL_Logging_cb f)
 {
 #ifdef DEBUG_WOLFSSL
-    int res = 0;
-
-    if (f)
         log_function = f;
-    else
-        res = BAD_FUNC_ARG;
-
-    return res;
+    return 0;
 #else
     (void)f;
@@ -95 +145 @@
 #ifdef DEBUG_WOLFSSL
     loggingEnabled = 1;
+#if defined(WOLFSSL_APACHE_MYNEWT)
+    log_register("wolfcrypt", &mynewt_log, &log_console_handler, NULL, LOG_SYSLEVEL);
+#endif /* WOLFSSL_APACHE_MYNEWT */
     return 0;
 #else
@@ -109 +162 @@
 }
 
+#ifdef WOLFSSL_FUNC_TIME
+/* WARNING: This code is only to be used for debugging performance.
+ *          The code is not thread-safe.
+ *          Do not use WOLFSSL_FUNC_TIME in production code.
+ */
+void WOLFSSL_START(int funcNum)
+{
+    double now = current_time(0) * 1000.0;
+#ifdef WOLFSSL_FUNC_TIME_LOG
+    fprintf(stderr, "%17.3f: START - %s\n", now, wc_func_name[funcNum]);
+#endif
+    wc_func_start[funcNum] = now;
+}
+
+void WOLFSSL_END(int funcNum)
+{
+    double now = current_time(0) * 1000.0;
+    wc_func_time[funcNum] += now - wc_func_start[funcNum];
+#ifdef WOLFSSL_FUNC_TIME_LOG
+    fprintf(stderr, "%17.3f: END   - %s\n", now, wc_func_name[funcNum]);
+#endif
+}
+
+void WOLFSSL_TIME(int count)
+{
+    int i;
+    double avg, total = 0;
+
+    for (i = 0; i < WC_FUNC_COUNT; i++) {
+        if (wc_func_time[i] > 0) {
+            avg = wc_func_time[i] / count;
+            fprintf(stderr, "%8.3f ms: %s\n", avg, wc_func_name[i]);
+            total += avg;
+        }
+    }
+    fprintf(stderr, "%8.3f ms\n", total);
+}
+#endif
 
 #ifdef DEBUG_WOLFSSL
@@ -122 +213 @@
     int sprintf(char* buf, const char *fmt, ...);
 #elif defined(MICRIUM)
+    #if (BSP_SER_COMM_EN  == DEF_ENABLED)
     #include <bsp_ser.h>
+    #endif
+#elif defined(WOLFSSL_USER_LOG)
+    /* user includes their own headers */
+#elif defined(WOLFSSL_ESPIDF)
+    #include "esp_types.h"
+    #include "esp_log.h"
 #else
     #include <stdio.h>   /* for default printf stuff */
@@ -136 +234 @@
         log_function(logLevel, logMessage);
     else {
-        if (loggingEnabled) {
-#if defined(THREADX) && !defined(THREADX_NO_DC_PRINTF)
+#if defined(WOLFSSL_USER_LOG)
+        WOLFSSL_USER_LOG(logMessage);
+#elif defined(WOLFSSL_LOG_PRINTF)
+        printf("%s\n", logMessage);
+
+#elif defined(THREADX) && !defined(THREADX_NO_DC_PRINTF)
             dc_log_printf("%s\n", logMessage);
 #elif defined(MICRIUM)
@@ -145 +247 @@
             printf("%s\n", logMessage);
             fflush(stdout) ;
-#elif defined(WOLFSSL_LOG_PRINTF)
-            printf("%s\n", logMessage);
 #elif defined(WOLFSSL_UTASKER)
             fnDebugMsg((char*)logMessage);
@@ -152 +252 @@
 #elif defined(MQX_USE_IO_OLD)
             fprintf(_mqxio_stderr, "%s\n", logMessage);
+
+#elif defined(WOLFSSL_APACHE_MYNEWT)
+        LOG_DEBUG(&mynewt_log, LOG_MODULE_DEFAULT, "%s\n", logMessage);
+#elif defined(WOLFSSL_ESPIDF)
+        extern char* TAG;
+        ESP_LOGI(TAG, "%s", logMessage);
 #else
             fprintf(stderr, "%s\n", logMessage);
@@ -157 +263 @@
         }
     }
-}
-
-
+
+#ifndef WOLFSSL_DEBUG_ERRORS_ONLY
 void WOLFSSL_MSG(const char* msg)
 {
@@ -208 +313 @@
 {
     if (loggingEnabled) {
-        char buffer[80];
-        sprintf(buffer, "wolfSSL Entering %s", msg);
+        char buffer[WOLFSSL_MAX_ERROR_SZ];
+        XSNPRINTF(buffer, sizeof(buffer), "wolfSSL Entering %s", msg);
         wolfssl_log(ENTER_LOG , buffer);
     }
@@ -218 +323 @@
 {
     if (loggingEnabled) {
-        char buffer[80];
-        sprintf(buffer, "wolfSSL Leaving %s, return %d", msg, ret);
+        char buffer[WOLFSSL_MAX_ERROR_SZ];
+        XSNPRINTF(buffer, sizeof(buffer), "wolfSSL Leaving %s, return %d",
+                msg, ret);
         wolfssl_log(LEAVE_LOG , buffer);
     }
 }
+#endif /* !WOLFSSL_DEBUG_ERRORS_ONLY */
 #endif  /* DEBUG_WOLFSSL */
 
@@ -230 +337 @@
  * name where WOLFSSL_ERROR is called at.
  */
-#if (defined(DEBUG_WOLFSSL) || defined(WOLFSSL_NGINX)) || defined(WOLFSSL_HAPROXY)
-    #if (defined(OPENSSL_EXTRA) || defined(DEBUG_WOLFSSL_VERBOSE))
+#if defined(DEBUG_WOLFSSL) || defined(OPENSSL_ALL) || \
+    defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
+
+#if defined(OPENSSL_EXTRA) || defined(DEBUG_WOLFSSL_VERBOSE)
 void WOLFSSL_ERROR_LINE(int error, const char* func, unsigned int line,
             const char* file, void* usrCtx)
@@ -238 +347 @@
     #endif
 {
-    #if defined(DEBUG_WOLFSSL) && !defined(WOLFSSL_NGINX)
-    if (loggingEnabled && error != WC_PENDING_E)
+#ifdef WOLFSSL_ASYNC_CRYPT
+    if (error != WC_PENDING_E)
     #endif
     {
-        char buffer[80];
+        char buffer[WOLFSSL_MAX_ERROR_SZ];
+
         #if defined(OPENSSL_EXTRA) || defined(DEBUG_WOLFSSL_VERBOSE)
             (void)usrCtx; /* a user ctx for future flexibility */
@@ -249 +359 @@
             if (wc_LockMutex(&debug_mutex) != 0) {
                 WOLFSSL_MSG("Lock debug mutex failed");
-                sprintf(buffer, "wolfSSL error occurred, error = %d", error);
+            XSNPRINTF(buffer, sizeof(buffer),
+                    "wolfSSL error occurred, error = %d", error);
             }
             else {
-                if (error < 0) error = error - (2*error); /*get absolute value*/
-                sprintf(buffer, "wolfSSL error occurred, error = %d line:%d file:%s",
+            #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY)
+            /* If running in compatibility mode do not add want read and
+               want right to error queue */
+            if (error != WANT_READ && error != WANT_WRITE) {
+            #endif
+            if (error < 0)
+                error = error - (2 * error); /* get absolute value */
+            XSNPRINTF(buffer, sizeof(buffer),
+                    "wolfSSL error occurred, error = %d line:%d file:%s",
                     error, line, file);
                 if (wc_AddErrorNode(error, line, buffer, (char*)file) != 0) {
@@ -260 +378 @@
                      * to unlock mutex and log what buffer was created. */
                 }
+            #if defined(OPENSSL_EXTRA) && !defined(WOLFCRYPT_ONLY)
+            }
+            else {
+                XSNPRINTF(buffer, sizeof(buffer),
+                    "wolfSSL error occurred, error = %d", error);
+
+            }
+            #endif
 
                 wc_UnLockMutex(&debug_mutex);
             }
         #else
-            sprintf(buffer, "wolfSSL error occurred, error = %d", error);
+        XSNPRINTF(buffer, sizeof(buffer),
+                "wolfSSL error occurred, error = %d", error);
         #endif
+
         #ifdef DEBUG_WOLFSSL
+        if (loggingEnabled)
         wolfssl_log(ERROR_LOG , buffer);
         #endif
     }
+}
+
+void WOLFSSL_ERROR_MSG(const char* msg)
+{
+#ifdef DEBUG_WOLFSSL
+    if (loggingEnabled)
+        wolfssl_log(ERROR_LOG , msg);
+#else
+    (void)msg;
+#endif
 }
 
@@ -283 +422 @@
     }
     wc_errors          = NULL;
+    wc_current_node    = NULL;
     wc_last_node       = NULL;
 
@@ -304 +444 @@
 
 
-#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_NGINX) || \
-    defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_MYSQL_COMPATIBLE)
 /* peek at an error node
  *
@@ -367 +505 @@
 
 
+/* Pulls the current node from error queue and increments current state.
+ * Note: this does not delete nodes because input arguments are pointing to
+ *       node buffers.
+ *
+ * file   pointer to file that error was in. Can be NULL to return no file.
+ * reason error string giving reason for error. Can be NULL to return no reason.
+ * line   return line number of where error happened.
+ *
+ * returns the error value on success and BAD_MUTEX_E or BAD_STATE_E on failure
+ */
+int wc_PullErrorNode(const char **file, const char **reason, int *line)
+{
+    struct wc_error_queue* err;
+    int value;
+
+    if (wc_LockMutex(&debug_mutex) != 0) {
+        WOLFSSL_MSG("Lock debug mutex failed");
+        return BAD_MUTEX_E;
+    }
+
+    err = wc_current_node;
+    if (err == NULL) {
+        WOLFSSL_MSG("No Errors in queue");
+        wc_UnLockMutex(&debug_mutex);
+        return BAD_STATE_E;
+    }
+
+    if (file != NULL) {
+        *file = err->file;
+    }
+
+    if (reason != NULL) {
+        *reason = err->error;
+    }
+
+    if (line != NULL) {
+        *line = err->line;
+    }
+
+    value = err->value;
+    wc_current_node = err->next;
+    wc_UnLockMutex(&debug_mutex);
+
+    return value;
+}
+
+
 /* create new error node and add it to the queue
  * buffers are assumed to be of size WOLFSSL_MAX_ERROR_SZ for this internal
@@ -416 +601 @@
                 /* check for unexpected case before over writing wc_errors */
                 WOLFSSL_MSG("ERROR in adding new node to logging queue!!\n");
+                /* In the event both wc_last_node and wc_errors are NULL, err
+                 * goes unassigned to external wc_errors, wc_last_node. Free
+                 * err in this instance since wc_ClearErrorNodes will not
+                 */
+                XFREE(err, wc_error_heap, DYNAMIC_TYPE_LOG);
             }
             else {
                 wc_errors    = err;
                 wc_last_node = err;
+                wc_current_node = err;
             }
         }
@@ -426 +617 @@
             err->prev = wc_last_node;
             wc_last_node = err;
+
+            /* check the case where have read to the end of the queue and the
+             * current node to read needs updated */
+            if (wc_current_node == NULL) {
+                wc_current_node = err;
+            }
         }
     }
@@ -465 +662 @@
 }
 
-#endif /* DEBUG_WOLFSSL || WOLFSSL_NGINX */
 
 /* Clears out the list of error nodes.
@@ -471 +667 @@
 void wc_ClearErrorNodes(void)
 {
+#if defined(DEBUG_WOLFSSL) || defined(WOLFSSL_NGINX) || \
+    defined(OPENSSL_EXTRA) || defined(DEBUG_WOLFSSL_VERBOSE)
+
     if (wc_LockMutex(&debug_mutex) != 0) {
         WOLFSSL_MSG("Lock debug mutex failed");
@@ -491 +690 @@
     wc_errors    = NULL;
     wc_last_node = NULL;
+    wc_current_node = NULL;
     wc_UnLockMutex(&debug_mutex);
+#endif /* DEBUG_WOLFSSL || WOLFSSL_NGINX */
 }
 
@@ -505 +706 @@
 }
 
+
+/* frees all nodes in the queue
+ *
+ * id  this is the thread id
+ */
+int wc_ERR_remove_state(void)
+{
+    struct wc_error_queue* current;
+    struct wc_error_queue* next;
+
+    if (wc_LockMutex(&debug_mutex) != 0) {
+        WOLFSSL_MSG("Lock debug mutex failed");
+        return BAD_MUTEX_E;
+    }
+
+    /* free all nodes from error queue */
+    current = (struct wc_error_queue*)wc_errors;
+    while (current != NULL) {
+        next = current->next;
+        XFREE(current, current->heap, DYNAMIC_TYPE_LOG);
+        current = next;
+    }
+
+    wc_errors          = NULL;
+    wc_last_node       = NULL;
+
+    wc_UnLockMutex(&debug_mutex);
+
+    return 0;
+}
+
+
 #if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM)
 /* empties out the error queue into the file */
-void wc_ERR_print_errors_fp(FILE* fp)
+void wc_ERR_print_errors_fp(XFILE fp)
 {
     WOLFSSL_ENTER("wc_ERR_print_errors_fp");
 
-    if (wc_LockMutex(&debug_mutex) != 0) {
+        if (wc_LockMutex(&debug_mutex) != 0)
+        {
         WOLFSSL_MSG("Lock debug mutex failed");
     }
-    else {
+        else
+        {
         /* free all nodes from error queue and print them to file */
         {
@@ -521 +756 @@
 
             current = (struct wc_error_queue*)wc_errors;
-            while (current != NULL) {
+                while (current != NULL)
+                {
                 next = current->next;
                 fprintf(fp, "%s\n", current->error);

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/md4.c

@@ -131 +131 @@
 
 
-static INLINE void AddLength(Md4* md4, word32 len)
+static WC_INLINE void AddLength(Md4* md4, word32 len)
 {
     word32 tmp = md4->loLen;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/md5.c

@@ -47 +47 @@
 
 
-static INLINE void AddLength(wc_Md5* md5, word32 len);
-
 /* Hardware Acceleration */
 #if defined(STM32_HASH)
 
-    /*
-     * STM32F2/F4/F7 hardware MD5 support through the HASH_* API's from the
-     * Standard Peripheral Library or CubeMX (See note in README).
-     */
-
+    /* Supports CubeMX HAL or Standard Peripheral Library */
         #define HAVE_MD5_CUST_API
-
-    /* STM32 register size, bytes */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        #define MD5_REG_SIZE  WC_MD5_BLOCK_SIZE
-    #else
-        #define MD5_REG_SIZE  4
-        /* STM32 struct notes:
-         * md5->buffer  = first 4 bytes used to hold partial block if needed
-         * md5->buffLen = num bytes currently stored in md5->buffer
-         * md5->loLen   = num bytes that have been written to STM32 FIFO
-         */
-    #endif
-    #define MD5_HW_TIMEOUT 0xFF
 
     int wc_InitMd5_ex(wc_Md5* md5, void* heap, int devId)
     {
-        if (md5 == NULL)
+        if (md5 == NULL) {
             return BAD_FUNC_ARG;
-
+        }
+
+        (void)devId;
         (void)heap;
-        (void)devId;
-
-        md5->heap = heap;
-        XMEMSET(md5->buffer, 0, sizeof(md5->buffer));
-        md5->buffLen = 0;
-        md5->loLen = 0;
-        md5->hiLen = 0;
-
-        /* initialize HASH peripheral */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        HAL_HASH_DeInit(&md5->hashHandle);
-        md5->hashHandle.Init.DataType = HASH_DATATYPE_8B;
-        if (HAL_HASH_Init(&md5->hashHandle) != HAL_OK) {
-            return ASYNC_INIT_E;
-        }
-        /* reset the hash control register */
-        /* required because Cube MX is not clearing algo bits */
-        HASH->CR &= ~HASH_CR_ALGO;
-    #else
-                HASH_DeInit();
-
-        /* reset the control register */
-        HASH->CR &= ~ (HASH_CR_ALGO | HASH_CR_DATATYPE | HASH_CR_MODE);
-
-                /* configure algo used, algo mode, datatype */
-                HASH->CR |= (HASH_AlgoSelection_MD5 | HASH_AlgoMode_HASH
-                                   | HASH_DataType_8b);
-
-                /* reset HASH processor */
-                HASH->CR |= HASH_CR_INIT;
-    #endif
+
+        wc_Stm32_Hash_Init(&md5->stmCtx);
 
         return 0;
@@ -115 +69 @@
     int wc_Md5Update(wc_Md5* md5, const byte* data, word32 len)
     {
-        int ret = 0;
-        byte* local;
+        int ret;
 
         if (md5 == NULL || (data == NULL && len > 0)) {
@@ -122 +75 @@
         }
 
-        /* do block size increments */
-        local = (byte*)md5->buffer;
-
-        /* check that internal buffLen is valid */
-        if (md5->buffLen >= MD5_REG_SIZE)
-            return BUFFER_E;
-
-        while (len) {
-            word32 add = min(len, MD5_REG_SIZE - md5->buffLen);
-            XMEMCPY(&local[md5->buffLen], data, add);
-
-            md5->buffLen += add;
-            data         += add;
-            len          -= add;
-
-            if (md5->buffLen == MD5_REG_SIZE) {
-            #ifdef WOLFSSL_STM32_CUBEMX
-                if (HAL_HASH_MD5_Accumulate(
-                        &md5->hashHandle, local, MD5_REG_SIZE) != HAL_OK) {
-                    ret = ASYNC_OP_E;
-                }
-            #else
-                HASH_DataIn(*(uint32_t*)local);
-            #endif
-
-                AddLength(md5, MD5_REG_SIZE);
-                md5->buffLen = 0;
-            }
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Update(&md5->stmCtx, HASH_AlgoSelection_MD5,
+                data, len);
+            wolfSSL_CryptHwMutexUnLock();
         }
         return ret;
@@ -156 +86 @@
     int wc_Md5Final(wc_Md5* md5, byte* hash)
     {
-        int ret = 0;
-
-        if (md5 == NULL || hash == NULL)
+        int ret;
+
+        if (md5 == NULL || hash == NULL) {
             return BAD_FUNC_ARG;
-
-    #ifdef WOLFSSL_STM32_CUBEMX
-        if (HAL_HASH_MD5_Start(&md5->hashHandle,
-                (byte*)md5->buffer, md5->buffLen,
-                (byte*)md5->digest, MD5_HW_TIMEOUT) != HAL_OK) {
-            ret = ASYNC_OP_E;
-        }
-    #else
-        __IO uint16_t nbvalidbitsdata = 0;
-
-        /* finish reading any trailing bytes into FIFO */
-        if (md5->buffLen > 0) {
-                        HASH_DataIn(*(uint32_t*)md5->buffer);
-            AddLength(md5, md5->buffLen);
-        }
-
-        /* calculate number of valid bits in last word of input data */
-        nbvalidbitsdata = 8 * (md5->loLen % MD5_REG_SIZE);
-
-        /* configure number of valid bits in last word of the data */
-        HASH_SetLastWordValidBitsNbr(nbvalidbitsdata);
-
-        /* start HASH processor */
-        HASH_StartDigest();
-
-        /* wait until Busy flag == RESET */
-        while (HASH_GetFlagStatus(HASH_FLAG_BUSY) != RESET) {}
-
-        /* read message digest */
-        md5->digest[0] = HASH->HR[0];
-        md5->digest[1] = HASH->HR[1];
-        md5->digest[2] = HASH->HR[2];
-        md5->digest[3] = HASH->HR[3];
-
-        ByteReverseWords(md5->digest, md5->digest, WC_MD5_DIGEST_SIZE);
-    #endif /* WOLFSSL_STM32_CUBEMX */
-
-        XMEMCPY(hash, md5->digest, WC_MD5_DIGEST_SIZE);
+        }
+
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Final(&md5->stmCtx, HASH_AlgoSelection_MD5,
+                hash, WC_MD5_DIGEST_SIZE);
+            wolfSSL_CryptHwMutexUnLock();
+        }
 
         (void)wc_InitMd5(md5);  /* reset state */
@@ -226 +126 @@
     #define HAVE_MD5_CUST_API
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* functions implemented in wolfcrypt/src/port/caam/caam_sha.c */
+    #define HAVE_MD5_CUST_API
 #else
     #define NEED_SOFT_MD5
@@ -330 +233 @@
 #endif /* NEED_SOFT_MD5 */
 
-#if !defined(HAVE_MD5_CUST_API) || defined(STM32_HASH)
-static INLINE void AddLength(wc_Md5* md5, word32 len)
+#ifndef HAVE_MD5_CUST_API
+
+static WC_INLINE void AddLength(wc_Md5* md5, word32 len)
 {
     word32 tmp = md5->loLen;
@@ -338 +242 @@
     }
 }
-#endif
-
-#ifndef HAVE_MD5_CUST_API
+
 static int _InitMd5(wc_Md5* md5)
 {
@@ -498 +400 @@
     wolfAsync_DevCtxFree(&md5->asyncDev, WOLFSSL_ASYNC_MARKER_MD5);
 #endif /* WOLFSSL_ASYNC_CRYPT */
+
+#ifdef WOLFSSL_PIC32MZ_HASH
+    wc_Md5Pic32Free(md5);
+#endif
 }
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/memory.c

@@ -35 +35 @@
 #endif
 
+
+/*
+Possible memory options:
+ * NO_WOLFSSL_MEMORY:               Disables wolf memory callback support. When not defined settings.h defines USE_WOLFSSL_MEMORY.
+ * WOLFSSL_STATIC_MEMORY:           Turns on the use of static memory buffers and functions.
+                                        This allows for using static memory instead of dynamic.
+ * WOLFSSL_STATIC_ALIGN:            Define defaults to 16 to indicate static memory alignment.
+ * HAVE_IO_POOL:                    Enables use of static thread safe memory pool for input/output buffers.
+ * XMALLOC_OVERRIDE:                Allows override of the XMALLOC, XFREE and XREALLOC macros.
+ * XMALLOC_USER:                    Allows custom XMALLOC, XFREE and XREALLOC functions to be defined.
+ * WOLFSSL_NO_MALLOC:               Disables the fall-back case to use STDIO malloc/free when no callbacks are set.
+ * WOLFSSL_TRACK_MEMORY:            Enables memory tracking for total stats and list of allocated memory.
+ * WOLFSSL_DEBUG_MEMORY:            Enables extra function and line number args for memory callbacks.
+ * WOLFSSL_DEBUG_MEMORY_PRINT:      Enables printing of each malloc/free.
+ * WOLFSSL_MALLOC_CHECK:            Reports malloc or alignment failure using WOLFSSL_STATIC_ALIGN
+ * WOLFSSL_FORCE_MALLOC_FAIL_TEST:  Used for internal testing to induce random malloc failures.
+ * WOLFSSL_HEAP_TEST:               Used for internal testing of heap hint
+ */
+
+
 #ifdef USE_WOLFSSL_MEMORY
 
@@ -41 +61 @@
 #include <wolfssl/wolfcrypt/logging.h>
 
-#if defined(WOLFSSL_MALLOC_CHECK) || defined(WOLFSSL_TRACK_MEMORY_FULL)
+#if defined(WOLFSSL_DEBUG_MEMORY) && defined(WOLFSSL_DEBUG_MEMORY_PRINT)
+#include <stdio.h>
+#endif
+
+#ifdef WOLFSSL_FORCE_MALLOC_FAIL_TEST
+    static int gMemFailCountSeed;
+    static int gMemFailCount;
+    void wolfSSL_SetMemFailCount(int memFailCount)
+    {
+        if (gMemFailCountSeed == 0) {
+            gMemFailCountSeed = memFailCount;
+            gMemFailCount = memFailCount;
+        }
+    }
+#endif
+#if defined(WOLFSSL_MALLOC_CHECK) || defined(WOLFSSL_TRACK_MEMORY_FULL) || \
+                                                     defined(WOLFSSL_MEMORY_LOG)
     #include <stdio.h>
 #endif
@@ -47 +83 @@
 
 /* Set these to default values initially. */
-static wolfSSL_Malloc_cb  malloc_function = 0;
-static wolfSSL_Free_cb    free_function = 0;
-static wolfSSL_Realloc_cb realloc_function = 0;
+static wolfSSL_Malloc_cb  malloc_function = NULL;
+static wolfSSL_Free_cb    free_function = NULL;
+static wolfSSL_Realloc_cb realloc_function = NULL;
 
 int wolfSSL_SetAllocators(wolfSSL_Malloc_cb  mf,
@@ -55 +91 @@
                           wolfSSL_Realloc_cb rf)
 {
-    int res = 0;
-
-    if (mf)
         malloc_function = mf;
-    else
-        res = BAD_FUNC_ARG;
-
-    if (ff)
         free_function = ff;
-    else
-        res = BAD_FUNC_ARG;
-
-    if (rf)
         realloc_function = rf;
-    else
-        res = BAD_FUNC_ARG;
-
-    return res;
+    return 0;
 }
 
@@ -102 +124 @@
     }
     else {
+    #ifndef WOLFSSL_NO_MALLOC
         res = malloc(size);
-    }
+    #else
+        WOLFSSL_MSG("No malloc available");
+    #endif
+    }
+
+#ifdef WOLFSSL_DEBUG_MEMORY
+#if defined(WOLFSSL_DEBUG_MEMORY_PRINT) && !defined(WOLFSSL_TRACK_MEMORY)
+    printf("Alloc: %p -> %u at %s:%d\n", res, (word32)size, func, line);
+#else
+    (void)func;
+    (void)line;
+#endif
+#endif
 
     #ifdef WOLFSSL_MALLOC_CHECK
         if (res == NULL)
-            puts("wolfSSL_malloc failed");
+        WOLFSSL_MSG("wolfSSL_malloc failed");
+#endif
+
+#ifdef WOLFSSL_FORCE_MALLOC_FAIL_TEST
+    if (res && --gMemFailCount == 0) {
+        printf("\n---FORCED MEM FAIL TEST---\n");
+        if (free_function) {
+        #ifdef WOLFSSL_DEBUG_MEMORY
+            free_function(res, func, line);
+        #else
+            free_function(res);
+        #endif
+        }
+        else {
+            free(res); /* clear */
+        }
+        gMemFailCount = gMemFailCountSeed; /* reset */
+        return NULL;
+    }
     #endif
 
@@ -119 +172 @@
 #endif
 {
+#ifdef WOLFSSL_DEBUG_MEMORY
+#if defined(WOLFSSL_DEBUG_MEMORY_PRINT) && !defined(WOLFSSL_TRACK_MEMORY)
+    printf("Free: %p at %s:%d\n", ptr, func, line);
+#else
+    (void)func;
+    (void)line;
+#endif
+#endif
+
     if (free_function) {
     #ifdef WOLFSSL_DEBUG_MEMORY
@@ -127 +189 @@
     }
     else {
+    #ifndef WOLFSSL_NO_MALLOC
         free(ptr);
+    #else
+        WOLFSSL_MSG("No free available");
+    #endif
     }
 }
@@ -147 +213 @@
     }
     else {
+    #ifndef WOLFSSL_NO_MALLOC
         res = realloc(ptr, size);
+    #else
+        WOLFSSL_MSG("No realloc available");
+    #endif
     }
 
@@ -534 +604 @@
         #else
         #ifndef WOLFSSL_NO_MALLOC
+            #ifdef FREERTOS
+                res = pvPortMalloc(size);
+            #else
             res = malloc(size);
+            #endif
         #else
             WOLFSSL_MSG("No heap hint found to use and no malloc");
@@ -668 +742 @@
         #endif
         #ifndef WOLFSSL_NO_MALLOC
+            #ifdef FREERTOS
+                vPortFree(ptr);
+            #else
             free(ptr);
+            #endif
         #else
             WOLFSSL_MSG("Error trying to call free when turned off");
@@ -923 +1001 @@
 #endif /* HAVE_IO_POOL */
 
+#ifdef WOLFSSL_MEMORY_LOG
+void *xmalloc(size_t n, void* heap, int type, const char* func,
+              const char* file, unsigned int line)
+{
+    void*   p;
+    word32* p32;
+
+    if (malloc_function)
+        p32 = malloc_function(n + sizeof(word32) * 4);
+    else
+        p32 = malloc(n + sizeof(word32) * 4);
+
+    p32[0] = n;
+    p = (void*)(p32 + 4);
+
+    fprintf(stderr, "Alloc: %p -> %u (%d) at %s:%s:%d\n", p, (word32)n, type,
+                                                              func, file, line);
+
+    (void)heap;
+
+    return p;
+}
+void *xrealloc(void *p, size_t n, void* heap, int type, const char* func,
+               const char* file, unsigned int line)
+{
+    void*   newp = NULL;
+    word32* p32;
+    word32* oldp32 = NULL;
+    word32  oldLen;
+
+    if (p != NULL) {
+        oldp32 = (word32*)p;
+        oldp32 -= 4;
+        oldLen = oldp32[0];
+    }
+
+    if (realloc_function)
+        p32 = realloc_function(oldp32, n + sizeof(word32) * 4);
+    else
+        p32 = realloc(oldp32, n + sizeof(word32) * 4);
+
+    if (p32 != NULL) {
+        p32[0] = n;
+        newp = (void*)(p32 + 4);
+
+        fprintf(stderr, "Alloc: %p -> %u (%d) at %s:%s:%d\n", newp, (word32)n,
+                                                        type, func, file, line);
+        if (p != NULL) {
+            fprintf(stderr, "Free: %p -> %u (%d) at %s:%s:%d\n", p, oldLen,
+                                                        type, func, file, line);
+        }
+    }
+
+    (void)heap;
+
+    return newp;
+}
+void xfree(void *p, void* heap, int type, const char* func, const char* file,
+           unsigned int line)
+{
+    word32* p32 = (word32*)p;
+
+    if (p != NULL) {
+        p32 -= 4;
+
+        fprintf(stderr, "Free: %p -> %u (%d) at %s:%s:%d\n", p, p32[0], type,
+                                                              func, file, line);
+
+        if (free_function)
+            free_function(p32);
+        else
+            free(p32);
+    }
+
+    (void)heap;
+}
+#endif /* WOLFSSL_MEMORY_LOG */
+
+#ifdef WOLFSSL_STACK_LOG
+/* Note: this code only works with GCC using -finstrument-functions. */
+void __attribute__((no_instrument_function))
+     __cyg_profile_func_enter(void *func,  void *caller)
+{
+    register void* sp asm("sp");
+    fprintf(stderr, "ENTER: %016lx %p\n", (size_t)func, sp);
+    (void)caller;
+}
+
+void __attribute__((no_instrument_function))
+     __cyg_profile_func_exit(void *func, void *caller)
+{
+    register void* sp asm("sp");
+    fprintf(stderr, "EXIT: %016lx %p\n", (size_t)func, sp);
+    (void)caller;
+}
+#endif
+

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/misc.c

@@ -47 +47 @@
 /* Check for if compiling misc.c when not needed. */
 #if !defined(WOLFSSL_MISC_INCLUDED) && !defined(NO_INLINE)
+    #ifndef WOLFSSL_IGNORE_FILE_WARN
     #warning misc.c does not need to be compiled when using inline (NO_INLINE not defined)
+    #endif
 
 #else
@@ -65 +67 @@
     #pragma intrinsic(_lrotl, _lrotr)
 
-    STATIC INLINE word32 rotlFixed(word32 x, word32 y)
+    STATIC WC_INLINE word32 rotlFixed(word32 x, word32 y)
     {
         return y ? _lrotl(x, y) : x;
     }
 
-    STATIC INLINE word32 rotrFixed(word32 x, word32 y)
+    STATIC WC_INLINE word32 rotrFixed(word32 x, word32 y)
     {
         return y ? _lrotr(x, y) : x;
@@ -77 +79 @@
 #else /* generic */
 
-    STATIC INLINE word32 rotlFixed(word32 x, word32 y)
+    STATIC WC_INLINE word32 rotlFixed(word32 x, word32 y)
     {
         return (x << y) | (x >> (sizeof(y) * 8 - y));
@@ -83 +85 @@
 
 
-    STATIC INLINE word32 rotrFixed(word32 x, word32 y)
+    STATIC WC_INLINE word32 rotrFixed(word32 x, word32 y)
     {
         return (x >> y) | (x << (sizeof(y) * 8 - y));
@@ -91 +93 @@
 
 
-STATIC INLINE word32 ByteReverseWord32(word32 value)
+STATIC WC_INLINE word32 ByteReverseWord32(word32 value)
 {
 #ifdef PPC_INTRINSICS
@@ -100 +102 @@
 #elif defined(KEIL_INTRINSICS)
     return (word32)__rev(value);
+#elif defined(WOLF_ALLOW_BUILTIN) && \
+        defined(__GNUC_PREREQ) && __GNUC_PREREQ(4, 3)
+    return (word32)__builtin_bswap32(value);
 #elif defined(FAST_ROTATE)
     /* 5 instructions with rotate instruction, 9 without */
@@ -112 +117 @@
 
 
-STATIC INLINE void ByteReverseWords(word32* out, const word32* in,
+STATIC WC_INLINE void ByteReverseWords(word32* out, const word32* in,
                                     word32 byteCount)
 {
@@ -123 +128 @@
 
 
-#ifdef WORD64_AVAILABLE
-
-
-STATIC INLINE word64 rotlFixed64(word64 x, word64 y)
+#if defined(WORD64_AVAILABLE) && !defined(WOLFSSL_NO_WORD64_OPS)
+
+
+STATIC WC_INLINE word64 rotlFixed64(word64 x, word64 y)
 {
     return (x << y) | (x >> (sizeof(y) * 8 - y));
@@ -132 +137 @@
 
 
-STATIC INLINE word64 rotrFixed64(word64 x, word64 y)
+STATIC WC_INLINE word64 rotrFixed64(word64 x, word64 y)
 {
     return (x >> y) | (x << (sizeof(y) * 8 - y));
@@ -138 +143 @@
 
 
-STATIC INLINE word64 ByteReverseWord64(word64 value)
-{
-#if defined(WOLFCRYPT_SLOW_WORD64)
-        return (word64)(ByteReverseWord32((word32)value)) << 32 |
-                    ByteReverseWord32((word32)(value>>32));
+STATIC WC_INLINE word64 ByteReverseWord64(word64 value)
+{
+#if defined(WOLF_ALLOW_BUILTIN) && defined(__GNUC_PREREQ) && __GNUC_PREREQ(4, 3)
+    return (word64)__builtin_bswap64(value);
+#elif defined(WOLFCRYPT_SLOW_WORD64)
+        return (word64)((word64)ByteReverseWord32((word32) value)) << 32 |
+                    (word64)ByteReverseWord32((word32)(value   >> 32));
 #else
         value = ((value & W64LIT(0xFF00FF00FF00FF00)) >> 8) |
@@ -153 +160 @@
 
 
-STATIC INLINE void ByteReverseWords64(word64* out, const word64* in,
+STATIC WC_INLINE void ByteReverseWords64(word64* out, const word64* in,
                                       word32 byteCount)
 {
@@ -163 +170 @@
 }
 
-#endif /* WORD64_AVAILABLE */
-
-
-STATIC INLINE void XorWords(wolfssl_word* r, const wolfssl_word* a, word32 n)
+#endif /* WORD64_AVAILABLE && !WOLFSSL_NO_WORD64_OPS */
+
+#ifndef WOLFSSL_NO_XOR_OPS
+STATIC WC_INLINE void XorWords(wolfssl_word* r, const wolfssl_word* a, word32 n)
 {
     word32 i;
@@ -174 +181 @@
 
 
-STATIC INLINE void xorbuf(void* buf, const void* mask, word32 count)
+STATIC WC_INLINE void xorbuf(void* buf, const void* mask, word32 count)
 {
     if (((wolfssl_word)buf | (wolfssl_word)mask | count) % WOLFSSL_WORD_SIZE == 0)
@@ -187 +194 @@
     }
 }
-
-
+#endif
+
+#ifndef WOLFSSL_NO_FORCE_ZERO
 /* Make sure compiler doesn't skip */
-STATIC INLINE void ForceZero(const void* mem, word32 len)
+STATIC WC_INLINE void ForceZero(const void* mem, word32 len)
 {
     volatile byte* z = (volatile byte*)mem;
-#ifdef WOLFSSL_X86_64_BUILD
+
+#if defined(WOLFSSL_X86_64_BUILD) && defined(WORD64_AVAILABLE)
     volatile word64* w;
-
+    #ifndef WOLFSSL_UNALIGNED_64BIT_ACCESS
+        word32 l = (sizeof(word64) - ((size_t)z & (sizeof(word64)-1))) &
+                                                             (sizeof(word64)-1);
+
+        if (len < l) l = len;
+        len -= l;
+        while (l--) *z++ = 0;
+    #endif
     for (w = (volatile word64*)z; len >= sizeof(*w); len -= sizeof(*w))
         *w++ = 0;
     z = (volatile byte*)w;
 #endif
+
     while (len--) *z++ = 0;
 }
-
-
+#endif
+
+
+#ifndef WOLFSSL_NO_CONST_CMP
 /* check all length bytes for equality, return 0 on success */
-STATIC INLINE int ConstantCompare(const byte* a, const byte* b, int length)
+STATIC WC_INLINE int ConstantCompare(const byte* a, const byte* b, int length)
 {
     int i;
@@ -216 +235 @@
     return compareSum;
 }
+#endif
 
 
@@ -223 +243 @@
         #define min min
     #endif
-    STATIC INLINE word32 min(word32 a, word32 b)
+    STATIC WC_INLINE word32 min(word32 a, word32 b)
     {
         return a > b ? b : a;
@@ -234 +254 @@
         #define max max
     #endif
-    STATIC INLINE word32 max(word32 a, word32 b)
+    STATIC WC_INLINE word32 max(word32 a, word32 b)
     {
         return a > b ? a : b;
@@ -240 +260 @@
 #endif /* !WOLFSSL_HAVE_MAX */
 
+#ifndef WOLFSSL_NO_INT_ENCODE
 /* converts a 32 bit integer to 24 bit */
-STATIC INLINE void c32to24(word32 in, word24 out)
+STATIC WC_INLINE void c32to24(word32 in, word24 out)
 {
     out[0] = (in >> 16) & 0xff;
@@ -249 +270 @@
 
 /* convert 16 bit integer to opaque */
-STATIC INLINE void c16toa(word16 u16, byte* c)
-{
-    c[0] = (u16 >> 8) & 0xff;
-    c[1] =  u16 & 0xff;
+STATIC WC_INLINE void c16toa(word16 wc_u16, byte* c)
+{
+    c[0] = (wc_u16 >> 8) & 0xff;
+    c[1] =  wc_u16 & 0xff;
 }
 
 /* convert 32 bit integer to opaque */
-STATIC INLINE void c32toa(word32 u32, byte* c)
-{
-    c[0] = (u32 >> 24) & 0xff;
-    c[1] = (u32 >> 16) & 0xff;
-    c[2] = (u32 >>  8) & 0xff;
-    c[3] =  u32 & 0xff;
-}
-
+STATIC WC_INLINE void c32toa(word32 wc_u32, byte* c)
+{
+    c[0] = (wc_u32 >> 24) & 0xff;
+    c[1] = (wc_u32 >> 16) & 0xff;
+    c[2] = (wc_u32 >>  8) & 0xff;
+    c[3] =  wc_u32 & 0xff;
+}
+#endif
+
+#ifndef WOLFSSL_NO_INT_DECODE
 /* convert a 24 bit integer into a 32 bit one */
-STATIC INLINE void c24to32(const word24 u24, word32* u32)
-{
-    *u32 = (u24[0] << 16) | (u24[1] << 8) | u24[2];
+STATIC WC_INLINE void c24to32(const word24 wc_u24, word32* wc_u32)
+{
+    *wc_u32 = (wc_u24[0] << 16) | (wc_u24[1] << 8) | wc_u24[2];
 }
 
 
 /* convert opaque to 24 bit integer */
-STATIC INLINE void ato24(const byte* c, word32* u24)
-{
-    *u24 = (c[0] << 16) | (c[1] << 8) | c[2];
+STATIC WC_INLINE void ato24(const byte* c, word32* wc_u24)
+{
+    *wc_u24 = (c[0] << 16) | (c[1] << 8) | c[2];
 }
 
 /* convert opaque to 16 bit integer */
-STATIC INLINE void ato16(const byte* c, word16* u16)
-{
-    *u16 = (word16) ((c[0] << 8) | (c[1]));
+STATIC WC_INLINE void ato16(const byte* c, word16* wc_u16)
+{
+    *wc_u16 = (word16) ((c[0] << 8) | (c[1]));
 }
 
 /* convert opaque to 32 bit integer */
-STATIC INLINE void ato32(const byte* c, word32* u32)
-{
-    *u32 = (c[0] << 24) | (c[1] << 16) | (c[2] << 8) | c[3];
-}
-
-
-STATIC INLINE word32 btoi(byte b)
+STATIC WC_INLINE void ato32(const byte* c, word32* wc_u32)
+{
+    *wc_u32 = ((word32)c[0] << 24) | (c[1] << 16) | (c[2] << 8) | c[3];
+}
+
+
+STATIC WC_INLINE word32 btoi(byte b)
 {
     return (word32)(b - 0x30);
 }
-
+#endif
+
+
+#ifndef WOLFSSL_NO_CT_OPS
+/* Constant time - mask set when a > b. */
+STATIC WC_INLINE byte ctMaskGT(int a, int b)
+{
+    return (((word32)a - b - 1) >> 31) - 1;
+}
+
+/* Constant time - mask set when a >= b. */
+STATIC WC_INLINE byte ctMaskGTE(int a, int b)
+{
+    return (((word32)a - b    ) >> 31) - 1;
+}
+
+/* Constant time - mask set when a < b. */
+STATIC WC_INLINE byte ctMaskLT(int a, int b)
+{
+    return (((word32)b - a - 1) >> 31) - 1;
+}
+
+/* Constant time - mask set when a <= b. */
+STATIC WC_INLINE byte ctMaskLTE(int a, int b)
+{
+    return (((word32)b - a    ) >> 31) - 1;
+}
+
+/* Constant time - mask set when a == b. */
+STATIC WC_INLINE byte ctMaskEq(int a, int b)
+{
+    return 0 - (a == b);
+}
+
+/* Constant time - mask set when a != b. */
+STATIC WC_INLINE byte ctMaskNotEq(int a, int b)
+{
+    return 0 - (a != b);
+}
+
+/* Constant time - select a when mask is set and b otherwise. */
+STATIC WC_INLINE byte ctMaskSel(byte m, byte a, byte b)
+{
+    return (b & ((byte)~(word32)m)) | (a & m);
+}
+
+/* Constant time - select integer a when mask is set and integer b otherwise. */
+STATIC WC_INLINE int ctMaskSelInt(byte m, int a, int b)
+{
+    return (b & (~(signed int)(signed char)m)) |
+           (a & ( (signed int)(signed char)m));
+}
+
+/* Constant time - bit set when a <= b. */
+STATIC WC_INLINE byte ctSetLTE(int a, int b)
+{
+    return ((word32)a - b - 1) >> 31;
+}
+#endif
 
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/pwdbased.c

@@ -31 +31 @@
 #include <wolfssl/wolfcrypt/pwdbased.h>
 #include <wolfssl/wolfcrypt/hmac.h>
+#include <wolfssl/wolfcrypt/hash.h>
 #include <wolfssl/wolfcrypt/integer.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
-#if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
-    #include <wolfssl/wolfcrypt/sha512.h>
-#endif
 
 #ifdef NO_INLINE
@@ -45 +43 @@
 
 
-#ifndef NO_SHA
-/* PBKDF1 needs at least SHA available */
+/* PKCS#5 v1.5 with non standard extension to optionally derive the extra data (IV) */
+int wc_PBKDF1_ex(byte* key, int keyLen, byte* iv, int ivLen,
+    const byte* passwd, int passwdLen, const byte* salt, int saltLen,
+    int iterations, int hashType, void* heap)
+{
+    int  err;
+    int  keyLeft, ivLeft, i;
+    int  digestLeft, store;
+    int  keyOutput = 0;
+    int  diestLen;
+    byte digest[WC_MAX_DIGEST_SIZE];
+#ifdef WOLFSSL_SMALL_STACK
+    wc_HashAlg* hash = NULL;
+#else
+    wc_HashAlg  hash[1];
+#endif
+    enum wc_HashType hashT;
+
+    (void)heap;
+
+    if (key == NULL || keyLen < 0 || passwdLen < 0 || saltLen < 0 || ivLen < 0){
+        return BAD_FUNC_ARG;
+    }
+
+    if (iterations <= 0)
+        iterations = 1;
+
+    hashT = wc_HashTypeConvert(hashType);
+    err = wc_HashGetDigestSize(hashT);
+    if (err < 0)
+        return err;
+    diestLen = err;
+
+    /* initialize hash */
+#ifdef WOLFSSL_SMALL_STACK
+    hash = (wc_HashAlg*)XMALLOC(sizeof(wc_HashAlg), heap,
+                                DYNAMIC_TYPE_HASHCTX);
+    if (hash == NULL)
+        return MEMORY_E;
+#endif
+
+    err = wc_HashInit(hash, hashT);
+    if (err != 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(hash, heap, DYNAMIC_TYPE_HASHCTX);
+    #endif
+        return err;
+            }
+
+    keyLeft = keyLen;
+    ivLeft  = ivLen;
+    while (keyOutput < (keyLen + ivLen)) {
+        digestLeft = diestLen;
+        /* D_(i - 1) */
+        if (keyOutput) { /* first time D_0 is empty */
+            err = wc_HashUpdate(hash, hashT, digest, diestLen);
+            if (err != 0) break;
+            }
+
+        /* data */
+        err = wc_HashUpdate(hash, hashT, passwd, passwdLen);
+        if (err != 0) break;
+
+        /* salt */
+        if (salt) {
+            err = wc_HashUpdate(hash, hashT, salt, saltLen);
+            if (err != 0) break;
+    }
+
+        err = wc_HashFinal(hash, hashT, digest);
+        if (err != 0) break;
+
+        /* count */
+    for (i = 1; i < iterations; i++) {
+            err = wc_HashUpdate(hash, hashT, digest, diestLen);
+            if (err != 0) break;
+
+            err = wc_HashFinal(hash, hashT, digest);
+            if (err != 0) break;
+            }
+
+        if (keyLeft) {
+            store = min(keyLeft, diestLen);
+            XMEMCPY(&key[keyLen - keyLeft], digest, store);
+
+            keyOutput  += store;
+            keyLeft    -= store;
+            digestLeft -= store;
+            }
+
+        if (ivLeft && digestLeft) {
+            store = min(ivLeft, digestLeft);
+            if (iv != NULL)
+                XMEMCPY(&iv[ivLen - ivLeft],
+                        &digest[diestLen - digestLeft], store);
+            keyOutput += store;
+            ivLeft    -= store;
+        }
+    }
+
+    wc_HashFree(hash, hashT);
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(hash, heap, DYNAMIC_TYPE_HASHCTX);
+#endif
+
+    if (err != 0)
+        return err;
+
+    if (keyOutput != (keyLen + ivLen))
+        return BUFFER_E;
+
+    return err;
+    }
+
+/* PKCS#5 v1.5 */
 int wc_PBKDF1(byte* output, const byte* passwd, int pLen, const byte* salt,
            int sLen, int iterations, int kLen, int hashType)
 {
-    wc_Sha  sha;
-#ifndef NO_MD5
-    wc_Md5  md5;
-#endif
-    int  hLen = (int)WC_SHA_DIGEST_SIZE;
-    int  i, ret = 0;
-    byte buffer[WC_SHA_DIGEST_SIZE];  /* max size */
-
-    if (hashType != WC_MD5 && hashType != WC_SHA)
-        return BAD_FUNC_ARG;
-
-#ifndef NO_MD5
-    if (hashType == WC_MD5)
-        hLen = (int)WC_MD5_DIGEST_SIZE;
-#endif
-
-    if ((kLen > hLen) || (kLen < 0))
-        return BAD_FUNC_ARG;
-
-    if (iterations < 1)
-        return BAD_FUNC_ARG;
-
-    switch (hashType) {
-#ifndef NO_MD5
-        case WC_MD5:
-            ret = wc_InitMd5(&md5);
-            if (ret != 0) {
-                return ret;
-            }
-            ret = wc_Md5Update(&md5, passwd, pLen);
-            if (ret != 0) {
-                return ret;
-            }
-            ret = wc_Md5Update(&md5, salt,   sLen);
-            if (ret != 0) {
-                return ret;
-            }
-            ret = wc_Md5Final(&md5,  buffer);
-            if (ret != 0) {
-                return ret;
-            }
-            break;
-#endif /* NO_MD5 */
-        case WC_SHA:
-        default:
-            ret = wc_InitSha(&sha);
-            if (ret != 0)
-                return ret;
-            wc_ShaUpdate(&sha, passwd, pLen);
-            wc_ShaUpdate(&sha, salt,   sLen);
-            wc_ShaFinal(&sha,  buffer);
-            break;
-    }
-
-    for (i = 1; i < iterations; i++) {
-        if (hashType == WC_SHA) {
-            wc_ShaUpdate(&sha, buffer, hLen);
-            wc_ShaFinal(&sha,  buffer);
-        }
-#ifndef NO_MD5
-        else {
-            ret = wc_Md5Update(&md5, buffer, hLen);
-            if (ret != 0) {
-                return ret;
-            }
-            ret = wc_Md5Final(&md5,  buffer);
-            if (ret != 0) {
-                return ret;
-            }
-        }
-#endif
-    }
-    XMEMCPY(output, buffer, kLen);
-
-    return 0;
-}
-#endif /* NO_SHA */
-
-
-int GetDigestSize(int hashType)
-{
-    int hLen;
-
-    switch (hashType) {
-#ifndef NO_MD5
-        case WC_MD5:
-            hLen = WC_MD5_DIGEST_SIZE;
-            break;
-#endif
-#ifndef NO_SHA
-        case WC_SHA:
-            hLen = WC_SHA_DIGEST_SIZE;
-            break;
-#endif
-#ifndef NO_SHA256
-        case WC_SHA256:
-            hLen = WC_SHA256_DIGEST_SIZE;
-            break;
-#endif
-#ifdef WOLFSSL_SHA512
-        case WC_SHA512:
-            hLen = WC_SHA512_DIGEST_SIZE;
-            break;
-#endif
-        default:
-            return BAD_FUNC_ARG;
-    }
-
-    return hLen;
+    return wc_PBKDF1_ex(output, kLen, NULL, 0,
+        passwd, pLen, salt, sLen, iterations, hashType, NULL);
 }
 
@@ -168 +173 @@
     int    hLen;
     int    j, ret;
-    Hmac   hmac;
 #ifdef WOLFSSL_SMALL_STACK
     byte*  buffer;
-#else
-    byte   buffer[MAX_DIGEST_SIZE];
-#endif
-
-    hLen = GetDigestSize(hashType);
+    Hmac*  hmac;
+#else
+    byte   buffer[WC_MAX_DIGEST_SIZE];
+    Hmac   hmac[1];
+#endif
+    enum wc_HashType hashT;
+
+    if (output == NULL || pLen < 0 || sLen < 0 || kLen < 0) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (iterations <= 0)
+        iterations = 1;
+
+    hashT = wc_HashTypeConvert(hashType);
+    hLen = wc_HashGetDigestSize(hashT);
     if (hLen < 0)
         return BAD_FUNC_ARG;
 
 #ifdef WOLFSSL_SMALL_STACK
-    buffer = (byte*)XMALLOC(MAX_DIGEST_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    buffer = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (buffer == NULL)
         return MEMORY_E;
-#endif
-
-    ret = wc_HmacInit(&hmac, NULL, INVALID_DEVID);
+    hmac = (Hmac*)XMALLOC(sizeof(Hmac), NULL, DYNAMIC_TYPE_HMAC);
+    if (buffer == NULL)
+        return MEMORY_E;
+#endif
+
+    ret = wc_HmacInit(hmac, NULL, INVALID_DEVID);
     if (ret == 0) {
-        ret = wc_HmacSetKey(&hmac, hashType, passwd, pLen);
+        /* use int hashType here, since HMAC FIPS uses the old unique value */
+        ret = wc_HmacSetKey(hmac, hashType, passwd, pLen);
 
         while (ret == 0 && kLen) {
             int currentLen;
 
-            ret = wc_HmacUpdate(&hmac, salt, sLen);
+            ret = wc_HmacUpdate(hmac, salt, sLen);
             if (ret != 0)
                 break;
@@ -200 +219 @@
                 byte b = (byte)(i >> ((3-j) * 8));
 
-                ret = wc_HmacUpdate(&hmac, &b, 1);
+                ret = wc_HmacUpdate(hmac, &b, 1);
                 if (ret != 0)
                     break;
@@ -209 +228 @@
                 break;
 
-            ret = wc_HmacFinal(&hmac, buffer);
+            ret = wc_HmacFinal(hmac, buffer);
             if (ret != 0)
                 break;
@@ -217 +236 @@
 
             for (j = 1; j < iterations; j++) {
-                ret = wc_HmacUpdate(&hmac, buffer, hLen);
+                ret = wc_HmacUpdate(hmac, buffer, hLen);
                 if (ret != 0)
                     break;
-                ret = wc_HmacFinal(&hmac, buffer);
+                ret = wc_HmacFinal(hmac, buffer);
                 if (ret != 0)
                     break;
@@ -234 +253 @@
             i++;
         }
-        wc_HmacFree(&hmac);
+        wc_HmacFree(hmac);
     }
 
 #ifdef WOLFSSL_SMALL_STACK
     XFREE(buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(hmac, NULL, DYNAMIC_TYPE_HMAC);
 #endif
 
@@ -244 +264 @@
 }
 
-#ifdef WOLFSSL_SHA512
-    #define PBKDF_DIGEST_SIZE WC_SHA512_BLOCK_SIZE
-#elif !defined(NO_SHA256)
-    #define PBKDF_DIGEST_SIZE WC_SHA256_BLOCK_SIZE
-#else
-    #define PBKDF_DIGEST_SIZE WC_SHA_DIGEST_SIZE
-#endif
-
-/* helper for wc_PKCS12_PBKDF(), sets block and digest sizes */
-int GetPKCS12HashSizes(int hashType, word32* v, word32* u)
-{
-    if (!v || !u)
-        return BAD_FUNC_ARG;
-
-    switch (hashType) {
-#ifndef NO_MD5
-        case WC_MD5:
-            *v = WC_MD5_BLOCK_SIZE;
-            *u = WC_MD5_DIGEST_SIZE;
-            break;
-#endif
-#ifndef NO_SHA
-        case WC_SHA:
-            *v = WC_SHA_BLOCK_SIZE;
-            *u = WC_SHA_DIGEST_SIZE;
-            break;
-#endif
-#ifndef NO_SHA256
-        case WC_SHA256:
-            *v = WC_SHA256_BLOCK_SIZE;
-            *u = WC_SHA256_DIGEST_SIZE;
-            break;
-#endif
-#ifdef WOLFSSL_SHA512
-        case WC_SHA512:
-            *v = WC_SHA512_BLOCK_SIZE;
-            *u = WC_SHA512_DIGEST_SIZE;
-            break;
-#endif
-        default:
-            return BAD_FUNC_ARG;
-    }
-
-    return 0;
-}
-
 /* helper for PKCS12_PBKDF(), does hash operation */
-int DoPKCS12Hash(int hashType, byte* buffer, word32 totalLen,
+static int DoPKCS12Hash(int hashType, byte* buffer, word32 totalLen,
                  byte* Ai, word32 u, int iterations)
 {
     int i;
     int ret = 0;
-
-    if (buffer == NULL || Ai == NULL)
+#ifdef WOLFSSL_SMALL_STACK
+    wc_HashAlg* hash = NULL;
+#else
+    wc_HashAlg  hash[1];
+#endif
+    enum wc_HashType hashT;
+
+    if (buffer == NULL || Ai == NULL) {
         return BAD_FUNC_ARG;
-
-    switch (hashType) {
-#ifndef NO_MD5
-        case WC_MD5:
-            {
-                wc_Md5 md5;
-                ret = wc_InitMd5(&md5);
-                if (ret != 0) {
-                    break;
                 }
-                ret = wc_Md5Update(&md5, buffer, totalLen);
-                if (ret != 0) {
-                    break;
+
+    hashT = wc_HashTypeConvert(hashType);
+
+    /* initialize hash */
+#ifdef WOLFSSL_SMALL_STACK
+    hash = (wc_HashAlg*)XMALLOC(sizeof(wc_HashAlg), NULL,
+                                DYNAMIC_TYPE_HASHCTX);
+    if (hash == NULL)
+        return MEMORY_E;
+#endif
+
+    ret = wc_HashInit(hash, hashT);
+                    if (ret != 0) {
+    #ifdef WOLFSSL_SMALL_STACK
+        XFREE(hash, NULL, DYNAMIC_TYPE_HASHCTX);
+    #endif
+        return ret;
+            }
+
+    ret = wc_HashUpdate(hash, hashT, buffer, totalLen);
+
+    if (ret == 0)
+        ret = wc_HashFinal(hash, hashT, Ai);
+
+                for (i = 1; i < iterations; i++) {
+        if (ret == 0)
+            ret = wc_HashUpdate(hash, hashT, Ai, u);
+        if (ret == 0)
+            ret = wc_HashFinal(hash, hashT, Ai);
                 }
-                ret = wc_Md5Final(&md5, Ai);
-                if (ret != 0) {
-                    break;
-                }
-
-                for (i = 1; i < iterations; i++) {
-                    ret = wc_Md5Update(&md5, Ai, u);
-                    if (ret != 0) {
-                        break;
-                    }
-                    ret = wc_Md5Final(&md5, Ai);
-                    if (ret != 0) {
-                        break;
-                    }
-                }
-            }
-            break;
-#endif /* NO_MD5 */
-#ifndef NO_SHA
-        case WC_SHA:
-            {
-                wc_Sha sha;
-                ret = wc_InitSha(&sha);
-                if (ret != 0)
-                    break;
-                ret = wc_ShaUpdate(&sha, buffer, totalLen);
-                if (ret != 0) {
-                    break;
-                }
-                ret = wc_ShaFinal(&sha, Ai);
-                if (ret != 0) {
-                    break;
-                }
-
-                for (i = 1; i < iterations; i++) {
-                    ret = wc_ShaUpdate(&sha, Ai, u);
-                    if (ret != 0) {
-                        break;
-                    }
-                    ret = wc_ShaFinal(&sha, Ai);
-                    if (ret != 0) {
-                        break;
-                    }
-                }
-            }
-            break;
-#endif /* NO_SHA */
-#ifndef NO_SHA256
-        case WC_SHA256:
-            {
-                wc_Sha256 sha256;
-                ret = wc_InitSha256(&sha256);
-                if (ret != 0)
-                    break;
-
-                ret = wc_Sha256Update(&sha256, buffer, totalLen);
-                if (ret != 0)
-                    break;
-
-                ret = wc_Sha256Final(&sha256, Ai);
-                if (ret != 0)
-                    break;
-
-                for (i = 1; i < iterations; i++) {
-                    ret = wc_Sha256Update(&sha256, Ai, u);
-                    if (ret != 0)
-                        break;
-
-                    ret = wc_Sha256Final(&sha256, Ai);
-                    if (ret != 0)
-                        break;
-                }
-            }
-            break;
-#endif /* NO_SHA256 */
-#ifdef WOLFSSL_SHA512
-        case WC_SHA512:
-            {
-                wc_Sha512 sha512;
-                ret = wc_InitSha512(&sha512);
-                if (ret != 0)
-                    break;
-
-                ret = wc_Sha512Update(&sha512, buffer, totalLen);
-                if (ret != 0)
-                    break;
-
-                ret = wc_Sha512Final(&sha512, Ai);
-                if (ret != 0)
-                    break;
-
-                for (i = 1; i < iterations; i++) {
-                    ret = wc_Sha512Update(&sha512, Ai, u);
-                    if (ret != 0)
-                        break;
-
-                    ret = wc_Sha512Final(&sha512, Ai);
-                    if (ret != 0)
-                        break;
-                }
-            }
-            break;
-#endif /* WOLFSSL_SHA512 */
-
-        default:
-            ret = BAD_FUNC_ARG;
-            break;
-    }
+
+    wc_HashFree(hash, hashT);
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(hash, NULL, DYNAMIC_TYPE_HASHCTX);
+#endif
 
     return ret;
@@ -426 +321 @@
 
 
-int wc_PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,const byte* salt,
-                 int saltLen, int iterations, int kLen, int hashType, int id)
+int wc_PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,
+    const byte* salt, int saltLen, int iterations, int kLen, int hashType,
+    int id)
 {
     return wc_PKCS12_PBKDF_ex(output, passwd, passLen, salt, saltLen,
@@ -456 +352 @@
     byte*  B;
 #else
-    byte   Ai[PBKDF_DIGEST_SIZE];
-    byte   B[PBKDF_DIGEST_SIZE];
-#endif
-
-    if (!iterations)
+    byte   Ai[WC_MAX_DIGEST_SIZE];
+    byte   B[WC_MAX_BLOCK_SIZE];
+#endif
+    enum wc_HashType hashT;
+
+    (void)heap;
+
+    if (output == NULL || passLen < 0 || saltLen < 0 || kLen < 0) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (iterations <= 0)
         iterations = 1;
 
-    ret = GetPKCS12HashSizes(hashType, &v, &u);
+    hashT = wc_HashTypeConvert(hashType);
+    ret = wc_HashGetDigestSize(hashT);
     if (ret < 0)
-        return BAD_FUNC_ARG;
-
-#ifdef WOLFSSL_SMALL_STACK
-    Ai = (byte*)XMALLOC(PBKDF_DIGEST_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        return ret;
+    u = ret;
+
+    ret = wc_HashGetBlockSize(hashT);
+    if (ret < 0)
+        return ret;
+    v = ret;
+
+#ifdef WOLFSSL_SMALL_STACK
+    Ai = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (Ai == NULL)
         return MEMORY_E;
 
-    B = (byte*)XMALLOC(PBKDF_DIGEST_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    B = (byte*)XMALLOC(WC_MAX_BLOCK_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (B == NULL) {
-        XFREE(Ai, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
 
-    XMEMSET(Ai, 0, PBKDF_DIGEST_SIZE);
-    XMEMSET(B,  0, PBKDF_DIGEST_SIZE);
+    XMEMSET(Ai, 0, WC_MAX_DIGEST_SIZE);
+    XMEMSET(B,  0, WC_MAX_BLOCK_SIZE);
 
     dLen = v;
@@ -496 +406 @@
         if (buffer == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(Ai, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            XFREE(B,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(B,  heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return MEMORY_E;
@@ -584 +494 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(Ai, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(B,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(B,  heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
@@ -740 +650 @@
 #else
         byte* t = x + (2*r - 1) * 64;
-        j = (t[0] | (t[1] << 8) | (t[2] << 16) | (t[3] << 24)) & (n-1);
+        j = (t[0] | (t[1] << 8) | (t[2] << 16) | ((word32)t[3] << 24)) & (n-1);
 #endif
 #ifdef WORD64_AVAILABLE
@@ -828 +738 @@
 #endif
 
-#undef PBKDF_DIGEST_SIZE
+#undef WC_MAX_DIGEST_SIZE
 
 #endif /* NO_PWDBASED */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/rabbit.c

@@ -146 +146 @@
 
 /* Key setup */
-static INLINE int DoKey(Rabbit* ctx, const byte* key, const byte* iv)
+static WC_INLINE int DoKey(Rabbit* ctx, const byte* key, const byte* iv)
 {
     /* Temporary variables */
@@ -248 +248 @@
 
 /* Encrypt/decrypt a message of any size */
-static INLINE int DoProcess(Rabbit* ctx, byte* output, const byte* input,
+static WC_INLINE int DoProcess(Rabbit* ctx, byte* output, const byte* input,
                             word32 msglen)
 {

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/random.c

@@ -26 +26 @@
 
 #include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
 
 /* on HPUX 11 you may need to install /dev/random see
@@ -32 +33 @@
 */
 
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$c")
+        #pragma const_seg(".fipsB$c")
+    #endif
+#endif
+
+
 #include <wolfssl/wolfcrypt/random.h>
 #include <wolfssl/wolfcrypt/cpuid.h>
 
 
-#ifdef HAVE_FIPS
+/* If building for old FIPS. */
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
 int wc_GenerateSeed(OS_Seed* os, byte* seed, word32 sz)
 {
@@ -73 +90 @@
     }
 
-    int wc_RNG_HealthTest(int reseed,
-                                        const byte* entropyA, word32 entropyASz,
-                                        const byte* entropyB, word32 entropyBSz,
+    int wc_RNG_HealthTest(int reseed, const byte* seedA, word32 seedASz,
+                                      const byte* seedB, word32 seedBSz,
                                         byte* output, word32 outputSz)
     {
-        return RNG_HealthTest_fips(reseed, entropyA, entropyASz,
-                              entropyB, entropyBSz, output, outputSz);
+        return RNG_HealthTest_fips(reseed, seedA, seedASz,
+                              seedB, seedBSz, output, outputSz);
     }
 #endif /* HAVE_HASHDRBG */
 
-#else /* else build without fips */
+#else /* else build without fips, or for new fips */
 
 #ifndef WC_NO_RNG /* if not FIPS and RNG is disabled then do not compile */
 
-#include <wolfssl/wolfcrypt/error-crypt.h>
 #include <wolfssl/wolfcrypt/sha256.h>
 
@@ -127 +142 @@
 #elif defined(WOLFSSL_EMBOS)
 #elif defined(MICRIUM)
+#elif defined(WOLFSSL_NUCLEUS)
+#elif defined(WOLFSSL_PB)
 #else
     /* include headers that may be needed to get good seed */
@@ -148 +165 @@
     static int wc_GenerateRand_IntelRD(OS_Seed* os, byte* output, word32 sz);
     #endif
+
+#ifdef USE_WINDOWS_API
+    #include <immintrin.h>
+#endif /* USE_WINDOWS_API */
 #endif
 
@@ -156 +177 @@
 #define MAX_REQUEST_LEN   (0x10000)
 #define RESEED_INTERVAL   WC_RESEED_INTERVAL
-#define SECURITY_STRENGTH (256)
-#define ENTROPY_SZ        (SECURITY_STRENGTH/8)
-#define NONCE_SZ          (ENTROPY_SZ/2)
-#define ENTROPY_NONCE_SZ  (ENTROPY_SZ+NONCE_SZ)
+
+
+/* For FIPS builds, the user should not be adjusting the values. */
+#if defined(HAVE_FIPS) && \
+    defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+    #if defined(RNG_SECURITY_STRENGTH) \
+            || defined(ENTROPY_SCALE_FACTOR) \
+            || defined(SEED_BLOCK_SZ)
+
+        #error "Do not change the RNG parameters for FIPS builds."
+    #endif
+#endif
+
+
+/* The security strength for the RNG is the target number of bits of
+ * entropy you are looking for in a seed. */
+#ifndef RNG_SECURITY_STRENGTH
+    #if defined(HAVE_FIPS) && \
+            defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+        /* SHA-256 requires a minimum of 256-bits of entropy. The goal
+         * of 1024 will provide 4 times that. */
+        #define RNG_SECURITY_STRENGTH (1024)
+    #else
+        /* If not using FIPS or using old FIPS, set the number down a bit.
+         * More is better, but more is also slower. */
+        #define RNG_SECURITY_STRENGTH (256)
+    #endif
+#endif
+
+#ifndef ENTROPY_SCALE_FACTOR
+    /* The entropy scale factor should be the whole number inverse of the
+     * minimum bits of entropy per bit of NDRNG output. */
+    #if defined(HAVE_INTEL_RDSEED) || defined(HAVE_INTEL_RDRAND)
+        /* The value of 2 applies to Intel's RDSEED which provides about
+         * 0.5 bits minimum of entropy per bit. */
+        #define ENTROPY_SCALE_FACTOR 2
+    #else
+        /* Setting the default to 1. */
+        #define ENTROPY_SCALE_FACTOR 1
+    #endif
+#endif
+
+#ifndef SEED_BLOCK_SZ
+    /* The seed block size, is the size of the output of the underlying NDRNG.
+     * This value is used for testing the output of the NDRNG. */
+    #if defined(HAVE_INTEL_RDSEED) || defined(HAVE_INTEL_RDRAND)
+        /* RDSEED outputs in blocks of 64-bits. */
+        #define SEED_BLOCK_SZ sizeof(word64)
+    #else
+        /* Setting the default to 4. */
+        #define SEED_BLOCK_SZ 4
+    #endif
+#endif
+
+#define SEED_SZ        (RNG_SECURITY_STRENGTH*ENTROPY_SCALE_FACTOR/8)
+
+/* The maximum seed size will be the seed size plus a seed block for the
+ * test, and an additional half of the seed size. This additional half
+ * is in case the user does not supply a nonce. A nonce will be obtained
+ * from the NDRNG. */
+#define MAX_SEED_SZ    (SEED_SZ + SEED_SZ/2 + SEED_BLOCK_SZ)
+
 
 /* Internal return codes */
 #define DRBG_SUCCESS      0
-#define DRBG_ERROR        1
-#define DRBG_FAILURE      2
-#define DRBG_NEED_RESEED  3
-#define DRBG_CONT_FAILURE 4
+#define DRBG_FAILURE      1
+#define DRBG_NEED_RESEED  2
+#define DRBG_CONT_FAILURE 3
 
 /* RNG health states */
@@ -200 +278 @@
 #endif
     byte   matchCount;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    wc_Sha256 sha256;
+#endif
 } DRBG;
 
@@ -216 +297 @@
     int len;
     word32 bits = (outSz * 8); /* reverse byte order */
-    wc_Sha256 sha;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    wc_Sha256* sha = &drbg->sha256;
+#else
+    wc_Sha256 sha[1];
+#endif
+#ifdef WC_ASYNC_ENABLE_SHA256
     DECLARE_VAR(digest, byte, WC_SHA256_DIGEST_SIZE, drbg->heap);
+#else
+    byte digest[WC_SHA256_DIGEST_SIZE];
+#endif
 
     (void)drbg;
-#ifdef WOLFSSL_ASYNC_CRYPT
+#ifdef WC_ASYNC_ENABLE_SHA256
     if (digest == NULL)
         return DRBG_FAILURE;
@@ -232 +321 @@
 
     for (i = 0, ctr = 1; i < len; i++, ctr++) {
+#ifndef WOLFSSL_SMALL_STACK_CACHE
     #ifdef WOLFSSL_ASYNC_CRYPT
-        ret = wc_InitSha256_ex(&sha, drbg->heap, drbg->devId);
+        ret = wc_InitSha256_ex(sha, drbg->heap, drbg->devId);
     #else
-        ret = wc_InitSha256(&sha);
+        ret = wc_InitSha256(sha);
     #endif
         if (ret != 0)
@@ -241 +331 @@
 
         if (ret == 0)
-            ret = wc_Sha256Update(&sha, &ctr, sizeof(ctr));
+#endif
+            ret = wc_Sha256Update(sha, &ctr, sizeof(ctr));
         if (ret == 0)
-            ret = wc_Sha256Update(&sha, (byte*)&bits, sizeof(bits));
+            ret = wc_Sha256Update(sha, (byte*)&bits, sizeof(bits));
 
         if (ret == 0) {
             /* churning V is the only string that doesn't have the type added */
             if (type != drbgInitV)
-                ret = wc_Sha256Update(&sha, &type, sizeof(type));
+                ret = wc_Sha256Update(sha, &type, sizeof(type));
         }
         if (ret == 0)
-            ret = wc_Sha256Update(&sha, inA, inASz);
+            ret = wc_Sha256Update(sha, inA, inASz);
         if (ret == 0) {
             if (inB != NULL && inBSz > 0)
-                ret = wc_Sha256Update(&sha, inB, inBSz);
+                ret = wc_Sha256Update(sha, inB, inBSz);
         }
         if (ret == 0)
-            ret = wc_Sha256Final(&sha, digest);
-
-        wc_Sha256Free(&sha);
+            ret = wc_Sha256Final(sha, digest);
+
+#ifndef WOLFSSL_SMALL_STACK_CACHE
+        wc_Sha256Free(sha);
+#endif
         if (ret == 0) {
             if (outSz > OUTPUT_BLOCK_LEN) {
@@ -274 +367 @@
     ForceZero(digest, WC_SHA256_DIGEST_SIZE);
 
+#ifdef WC_ASYNC_ENABLE_SHA256
     FREE_VAR(digest, drbg->heap);
+#endif
 
     return (ret == 0) ? DRBG_SUCCESS : DRBG_FAILURE;
@@ -280 +375 @@
 
 /* Returns: DRBG_SUCCESS or DRBG_FAILURE */
-static int Hash_DRBG_Reseed(DRBG* drbg, const byte* entropy, word32 entropySz)
-{
-    byte seed[DRBG_SEED_LEN];
-
-    if (Hash_df(drbg, seed, sizeof(seed), drbgReseed, drbg->V, sizeof(drbg->V),
-                                          entropy, entropySz) != DRBG_SUCCESS) {
+static int Hash_DRBG_Reseed(DRBG* drbg, const byte* seed, word32 seedSz)
+{
+    byte newV[DRBG_SEED_LEN];
+
+    XMEMSET(newV, 0, DRBG_SEED_LEN);
+
+    if (Hash_df(drbg, newV, sizeof(newV), drbgReseed,
+                drbg->V, sizeof(drbg->V), seed, seedSz) != DRBG_SUCCESS) {
         return DRBG_FAILURE;
     }
 
-    XMEMCPY(drbg->V, seed, sizeof(drbg->V));
-    ForceZero(seed, sizeof(seed));
+    XMEMCPY(drbg->V, newV, sizeof(drbg->V));
+    ForceZero(newV, sizeof(newV));
 
     if (Hash_df(drbg, drbg->C, sizeof(drbg->C), drbgInitC, drbg->V,
@@ -303 +400 @@
 }
 
-static INLINE void array_add_one(byte* data, word32 dataSz)
+/* Returns: DRBG_SUCCESS and DRBG_FAILURE or BAD_FUNC_ARG on fail */
+int wc_RNG_DRBG_Reseed(WC_RNG* rng, const byte* seed, word32 seedSz)
+{
+    if (rng == NULL || seed == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    return Hash_DRBG_Reseed(rng->drbg, seed, seedSz);
+}
+
+static WC_INLINE void array_add_one(byte* data, word32 dataSz)
 {
     int i;
@@ -322 +429 @@
     int len;
     word32 checkBlock;
-    wc_Sha256 sha;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    wc_Sha256* sha = &drbg->sha256;
+#else
+    wc_Sha256 sha[1];
+#endif
+#ifdef WC_ASYNC_ENABLE_SHA256
     DECLARE_VAR(digest, byte, WC_SHA256_DIGEST_SIZE, drbg->heap);
+#else
+    byte digest[WC_SHA256_DIGEST_SIZE];
+#endif
 
     /* Special case: outSz is 0 and out is NULL. wc_Generate a block to save for
@@ -334 +449 @@
     XMEMCPY(data, V, sizeof(data));
     for (i = 0; i < len; i++) {
+#ifndef WOLFSSL_SMALL_STACK_CACHE
     #ifdef WOLFSSL_ASYNC_CRYPT
-        ret = wc_InitSha256_ex(&sha, drbg->heap, drbg->devId);
+        ret = wc_InitSha256_ex(sha, drbg->heap, drbg->devId);
     #else
-        ret = wc_InitSha256(&sha);
+        ret = wc_InitSha256(sha);
     #endif
         if (ret == 0)
-            ret = wc_Sha256Update(&sha, data, sizeof(data));
+#endif
+            ret = wc_Sha256Update(sha, data, sizeof(data));
         if (ret == 0)
-            ret = wc_Sha256Final(&sha, digest);
-        wc_Sha256Free(&sha);
+            ret = wc_Sha256Final(sha, digest);
+#ifndef WOLFSSL_SMALL_STACK_CACHE
+        wc_Sha256Free(sha);
+#endif
 
         if (ret == 0) {
@@ -379 +498 @@
     ForceZero(data, sizeof(data));
 
+#ifdef WC_ASYNC_ENABLE_SHA256
     FREE_VAR(digest, drbg->heap);
+#endif
 
     return (ret == 0) ? DRBG_SUCCESS : DRBG_FAILURE;
 }
 
-static INLINE void array_add(byte* d, word32 dLen, const byte* s, word32 sLen)
+static WC_INLINE void array_add(byte* d, word32 dLen, const byte* s, word32 sLen)
 {
     word16 carry = 0;
@@ -410 +531 @@
 {
     int ret;
-    wc_Sha256 sha;
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    wc_Sha256* sha = &drbg->sha256;
+#else
+    wc_Sha256 sha[1];
+#endif
     byte type;
     word32 reseedCtr;
@@ -417 +542 @@
         return DRBG_NEED_RESEED;
     } else {
+    #ifdef WC_ASYNC_ENABLE_SHA256
         DECLARE_VAR(digest, byte, WC_SHA256_DIGEST_SIZE, drbg->heap);
+    #else
+        byte digest[WC_SHA256_DIGEST_SIZE];
+    #endif
         type = drbgGenerateH;
         reseedCtr = drbg->reseedCtr;
@@ -423 +552 @@
         ret = Hash_gen(drbg, out, outSz, drbg->V);
         if (ret == DRBG_SUCCESS) {
+#ifndef WOLFSSL_SMALL_STACK_CACHE
         #ifdef WOLFSSL_ASYNC_CRYPT
-            ret = wc_InitSha256_ex(&sha, drbg->heap, drbg->devId);
+            ret = wc_InitSha256_ex(sha, drbg->heap, drbg->devId);
         #else
-            ret = wc_InitSha256(&sha);
+            ret = wc_InitSha256(sha);
         #endif
             if (ret == 0)
-                ret = wc_Sha256Update(&sha, &type, sizeof(type));
+#endif
+                ret = wc_Sha256Update(sha, &type, sizeof(type));
             if (ret == 0)
-                ret = wc_Sha256Update(&sha, drbg->V, sizeof(drbg->V));
+                ret = wc_Sha256Update(sha, drbg->V, sizeof(drbg->V));
             if (ret == 0)
-                ret = wc_Sha256Final(&sha, digest);
-
-            wc_Sha256Free(&sha);
+                ret = wc_Sha256Final(sha, digest);
+
+#ifndef WOLFSSL_SMALL_STACK_CACHE
+            wc_Sha256Free(sha);
+#endif
 
             if (ret == 0) {
@@ -450 +583 @@
         }
         ForceZero(digest, WC_SHA256_DIGEST_SIZE);
+    #ifdef WC_ASYNC_ENABLE_SHA256
         FREE_VAR(digest, drbg->heap);
+    #endif
     }
 
@@ -472 +607 @@
 #endif
 
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    #ifdef WOLFSSL_ASYNC_CRYPT
+        ret = wc_InitSha256_ex(&drbg->sha256, drbg->heap, drbg->devId);
+    #else
+        ret = wc_InitSha256(&drbg->sha256);
+    #endif
+    if (ret != 0)
+        return ret;
+#endif
+
     if (Hash_df(drbg, drbg->V, sizeof(drbg->V), drbgInitV, seed, seedSz,
                                               nonce, nonceSz) == DRBG_SUCCESS &&
@@ -493 +638 @@
     byte*  compareDrbg = (byte*)drbg;
 
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    wc_Sha256Free(&drbg->sha256);
+#endif
+
     ForceZero(drbg, sizeof(DRBG));
 
@@ -500 +649 @@
     return (compareSum == 0) ? DRBG_SUCCESS : DRBG_FAILURE;
 }
+
+
+int wc_RNG_TestSeed(const byte* seed, word32 seedSz)
+{
+    int ret = DRBG_SUCCESS;
+
+    /* Check the seed for duplicate words. */
+    word32 seedIdx = 0;
+    word32 scratchSz = min(SEED_BLOCK_SZ, seedSz - SEED_BLOCK_SZ);
+
+    while (seedIdx < seedSz - SEED_BLOCK_SZ) {
+        if (ConstantCompare(seed + seedIdx,
+                            seed + seedIdx + scratchSz,
+                            scratchSz) == 0) {
+
+            ret = DRBG_CONT_FAILURE;
+        }
+        seedIdx += SEED_BLOCK_SZ;
+        scratchSz = min(SEED_BLOCK_SZ, (seedSz - seedIdx));
+    }
+
+    return ret;
+}
 #endif /* HAVE_HASHDRBG */
 /* End NIST DRBG Code */
 
 
-int wc_InitRng_ex(WC_RNG* rng, void* heap, int devId)
+static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz,
+                    void* heap, int devId)
 {
     int ret = RNG_FAILURE_E;
+#ifdef HAVE_HASHDRBG
+    word32 seedSz = SEED_SZ + SEED_BLOCK_SZ;
+#endif
+
+    (void)nonce;
+    (void)nonceSz;
 
     if (rng == NULL)
+        return BAD_FUNC_ARG;
+    if (nonce == NULL && nonceSz != 0)
         return BAD_FUNC_ARG;
 
@@ -552 +733 @@
 #else
 #ifdef HAVE_HASHDRBG
+    if (nonceSz == 0)
+        seedSz = MAX_SEED_SZ;
+
     if (wc_RNG_HealthTestLocal(0) == 0) {
-        DECLARE_VAR(entropy, byte, ENTROPY_NONCE_SZ, rng->heap);
+    #ifdef WC_ASYNC_ENABLE_SHA256
+        DECLARE_VAR(seed, byte, MAX_SEED_SZ, rng->heap);
+    #else
+        byte seed[MAX_SEED_SZ];
+    #endif
 
         rng->drbg =
@@ -561 +749 @@
             ret = MEMORY_E;
         }
-        /* This doesn't use a separate nonce. The entropy input will be
-         * the default size plus the size of the nonce making the seed
-         * size. */
-        else if (wc_GenerateSeed(&rng->seed, entropy, ENTROPY_NONCE_SZ) == 0 &&
-                 Hash_DRBG_Instantiate(rng->drbg, entropy, ENTROPY_NONCE_SZ,
-                                   NULL, 0, rng->heap, devId) == DRBG_SUCCESS) {
+        else {
+            ret = wc_GenerateSeed(&rng->seed, seed, seedSz);
+            if (ret != 0)
+                ret = DRBG_FAILURE;
+            else
+                ret = wc_RNG_TestSeed(seed, seedSz);
+
+            if (ret == DRBG_SUCCESS)
+                 ret = Hash_DRBG_Instantiate(rng->drbg,
+                            seed + SEED_BLOCK_SZ, seedSz - SEED_BLOCK_SZ,
+                            nonce, nonceSz, rng->heap, devId);
+
+            if (ret == DRBG_SUCCESS)
             ret = Hash_DRBG_Generate(rng->drbg, NULL, 0);
         }
-        else
-            ret = DRBG_FAILURE;
-
-        ForceZero(entropy, ENTROPY_NONCE_SZ);
-        FREE_VAR(entropy, rng->heap);
+
+        ForceZero(seed, seedSz);
+    #ifdef WC_ASYNC_ENABLE_SHA256
+        FREE_VAR(seed, rng->heap);
+    #endif
     }
     else
@@ -599 +794 @@
 }
 
+
 int wc_InitRng(WC_RNG* rng)
 {
-    return wc_InitRng_ex(rng, NULL, INVALID_DEVID);
+    return _InitRng(rng, NULL, 0, NULL, INVALID_DEVID);
+}
+
+
+int wc_InitRng_ex(WC_RNG* rng, void* heap, int devId)
+{
+    return _InitRng(rng, NULL, 0, heap, devId);
+}
+
+
+int wc_InitRngNonce(WC_RNG* rng, byte* nonce, word32 nonceSz)
+{
+    return _InitRng(rng, nonce, nonceSz, NULL, INVALID_DEVID);
+}
+
+
+int wc_InitRngNonce_ex(WC_RNG* rng, byte* nonce, word32 nonceSz,
+                       void* heap, int devId)
+{
+    return _InitRng(rng, nonce, nonceSz, heap, devId);
 }
 
@@ -623 +838 @@
     #ifdef HAVE_CAVIUM
         return NitroxRngGenerateBlock(rng, output, sz);
-    #elif defined(HAVE_INTEL_QA)
+    #elif defined(HAVE_INTEL_QA) && defined(QAT_ENABLE_RNG)
         return IntelQaDrbg(&rng->asyncDev, output, sz);
     #else
@@ -646 +861 @@
     if (ret == DRBG_NEED_RESEED) {
         if (wc_RNG_HealthTestLocal(1) == 0) {
-            byte entropy[ENTROPY_SZ];
-
-            if (wc_GenerateSeed(&rng->seed, entropy, ENTROPY_SZ) == 0 &&
-                Hash_DRBG_Reseed(rng->drbg, entropy, ENTROPY_SZ)
-                                                              == DRBG_SUCCESS) {
-
+            byte newSeed[SEED_SZ + SEED_BLOCK_SZ];
+
+            ret = wc_GenerateSeed(&rng->seed, newSeed,
+                                  SEED_SZ + SEED_BLOCK_SZ);
+            if (ret != 0)
+                ret = DRBG_FAILURE;
+            else
+                ret = wc_RNG_TestSeed(newSeed, SEED_SZ + SEED_BLOCK_SZ);
+
+            if (ret == DRBG_SUCCESS)
+                ret = Hash_DRBG_Reseed(rng->drbg, newSeed + SEED_BLOCK_SZ,
+                                       SEED_SZ);
+            if (ret == DRBG_SUCCESS)
                 ret = Hash_DRBG_Generate(rng->drbg, NULL, 0);
                 if (ret == DRBG_SUCCESS)
                     ret = Hash_DRBG_Generate(rng->drbg, output, sz);
-            }
-            else
-                ret = DRBG_FAILURE;
-
-            ForceZero(entropy, ENTROPY_SZ);
+
+            ForceZero(newSeed, sizeof(newSeed));
         }
         else
@@ -721 +940 @@
 
 #ifdef HAVE_HASHDRBG
-int wc_RNG_HealthTest(int reseed, const byte* entropyA, word32 entropyASz,
-                                  const byte* entropyB, word32 entropyBSz,
+int wc_RNG_HealthTest(int reseed, const byte* seedA, word32 seedASz,
+                                  const byte* seedB, word32 seedBSz,
                                   byte* output, word32 outputSz)
+{
+    return wc_RNG_HealthTest_ex(reseed, NULL, 0,
+                                seedA, seedASz, seedB, seedBSz,
+                                output, outputSz,
+                                NULL, INVALID_DEVID);
+}
+
+
+int wc_RNG_HealthTest_ex(int reseed, const byte* nonce, word32 nonceSz,
+                                  const byte* seedA, word32 seedASz,
+                                  const byte* seedB, word32 seedBSz,
+                                  byte* output, word32 outputSz,
+                                  void* heap, int devId)
 {
     int ret = -1;
@@ -731 +963 @@
 #endif
 
-    if (entropyA == NULL || output == NULL) {
+    if (seedA == NULL || output == NULL) {
         return BAD_FUNC_ARG;
     }
 
-    if (reseed != 0 && entropyB == NULL) {
+    if (reseed != 0 && seedB == NULL) {
         return BAD_FUNC_ARG;
     }
@@ -744 +976 @@
 
 #ifdef WOLFSSL_SMALL_STACK
-    drbg = (struct DRBG*)XMALLOC(sizeof(DRBG), NULL, DYNAMIC_TYPE_RNG);
+    drbg = (DRBG*)XMALLOC(sizeof(DRBG), NULL, DYNAMIC_TYPE_RNG);
     if (drbg == NULL) {
         return MEMORY_E;
@@ -752 +984 @@
 #endif
 
-    if (Hash_DRBG_Instantiate(drbg, entropyA, entropyASz, NULL, 0, NULL,
-                                                    INVALID_DEVID) != 0) {
+    if (Hash_DRBG_Instantiate(drbg, seedA, seedASz, nonce, nonceSz,
+                              heap, devId) != 0) {
         goto exit_rng_ht;
     }
 
     if (reseed) {
-        if (Hash_DRBG_Reseed(drbg, entropyB, entropyBSz) != 0) {
+        if (Hash_DRBG_Reseed(drbg, seedB, seedBSz) != 0) {
             goto exit_rng_ht;
         }
@@ -789 +1021 @@
 
 
-const byte entropyA[] = {
+const byte seedA[] = {
     0x63, 0x36, 0x33, 0x77, 0xe4, 0x1e, 0x86, 0x46, 0x8d, 0xeb, 0x0a, 0xb4,
     0xa8, 0xed, 0x68, 0x3f, 0x6a, 0x13, 0x4e, 0x47, 0xe0, 0x14, 0xc7, 0x00,
@@ -796 +1028 @@
 };
 
-const byte reseedEntropyA[] = {
+const byte reseedSeedA[] = {
     0xe6, 0x2b, 0x8a, 0x8e, 0xe8, 0xf1, 0x41, 0xb6, 0x98, 0x05, 0x66, 0xe3,
     0xbf, 0xe3, 0xc0, 0x49, 0x03, 0xda, 0xd4, 0xac, 0x2c, 0xdf, 0x9f, 0x22,
@@ -816 +1048 @@
 };
 
-const byte entropyB[] = {
+const byte seedB[] = {
     0xa6, 0x5a, 0xd0, 0xf3, 0x45, 0xdb, 0x4e, 0x0e, 0xff, 0xe8, 0x75, 0xc3,
     0xa2, 0xe7, 0x1f, 0x42, 0xc7, 0x12, 0x9d, 0x62, 0x0f, 0xf5, 0xc1, 0x19,
-    0xa9, 0xef, 0x55, 0xf0, 0x51, 0x85, 0xe0, 0xfb, 0x85, 0x81, 0xf9, 0x31,
-    0x75, 0x17, 0x27, 0x6e, 0x06, 0xe9, 0x60, 0x7d, 0xdb, 0xcb, 0xcc, 0x2e
+    0xa9, 0xef, 0x55, 0xf0, 0x51, 0x85, 0xe0, 0xfb, /* nonce next */
+    0x85, 0x81, 0xf9, 0x31, 0x75, 0x17, 0x27, 0x6e, 0x06, 0xe9, 0x60, 0x7d,
+    0xdb, 0xcb, 0xcc, 0x2e
 };
 
@@ -856 +1089 @@
 
     if (reseed) {
-        ret = wc_RNG_HealthTest(1, entropyA, sizeof(entropyA),
-                                reseedEntropyA, sizeof(reseedEntropyA),
+        ret = wc_RNG_HealthTest(1, seedA, sizeof(seedA),
+                                reseedSeedA, sizeof(reseedSeedA),
                                 check, RNG_HEALTH_TEST_CHECK_SIZE);
         if (ret == 0) {
@@ -866 +1099 @@
     }
     else {
-        ret = wc_RNG_HealthTest(0, entropyB, sizeof(entropyB),
+        ret = wc_RNG_HealthTest(0, seedB, sizeof(seedB),
                                 NULL, 0,
                                 check, RNG_HEALTH_TEST_CHECK_SIZE);
@@ -873 +1106 @@
                                 RNG_HEALTH_TEST_CHECK_SIZE) != 0)
                 ret = -1;
+        }
+
+        /* The previous test cases use a large seed instead of a seed and nonce.
+         * seedB is actually from a test case with a seed and nonce, and
+         * just concatenates them. The pivot point between seed and nonce is
+         * byte 32, feed them into the health test separately. */
+        if (ret == 0) {
+            ret = wc_RNG_HealthTest_ex(0,
+                                    seedB + 32, sizeof(seedB) - 32,
+                                    seedB, 32,
+                                    NULL, 0,
+                                    check, RNG_HEALTH_TEST_CHECK_SIZE,
+                                    NULL, INVALID_DEVID);
+            if (ret == 0) {
+                if (ConstantCompare(check, outputB, sizeof(outputB)) != 0)
+                    ret = -1;
+            }
         }
     }
@@ -995 +1245 @@
 #ifdef HAVE_INTEL_RDSEED
 
+#ifndef USE_WINDOWS_API
+
 /* return 0 on success */
-static INLINE int IntelRDseed64(word64* seed)
+    static WC_INLINE int IntelRDseed64(word64* seed)
 {
     unsigned char ok;
@@ -1004 +1256 @@
 }
 
+#else /* USE_WINDOWS_API */
+    /* The compiler Visual Studio uses does not allow inline assembly.
+     * It does allow for Intel intrinsic functions. */
+
 /* return 0 on success */
-static INLINE int IntelRDseed64_r(word64* rnd)
+    static WC_INLINE int IntelRDseed64(word64* seed)
+    {
+        int ok;
+
+        ok = _rdseed64_step(seed);
+        return (ok) ? 0 : -1;
+    }
+
+#endif /* USE_WINDOWS_API */
+
+/* return 0 on success */
+static WC_INLINE int IntelRDseed64_r(word64* rnd)
 {
     int i;
@@ -1041 +1308 @@
 
     XMEMCPY(output, &rndTmp, sz);
+    ForceZero(&rndTmp, sizeof(rndTmp));
 
     return 0;
@@ -1049 +1317 @@
 #ifdef HAVE_INTEL_RDRAND
 
+#ifndef USE_WINDOWS_API
+
 /* return 0 on success */
-static INLINE int IntelRDrand64(word64 *rnd)
+static WC_INLINE int IntelRDrand64(word64 *rnd)
 {
     unsigned char ok;
@@ -1059 +1329 @@
 }
 
+#else /* USE_WINDOWS_API */
+    /* The compiler Visual Studio uses does not allow inline assembly.
+     * It does allow for Intel intrinsic functions. */
+
 /* return 0 on success */
-static INLINE int IntelRDrand64_r(word64 *rnd)
+static WC_INLINE int IntelRDrand64(word64 *rnd)
+{
+    int ok;
+
+    ok = _rdrand64_step(rnd);
+
+    return (ok) ? 0 : -1;
+}
+
+#endif /* USE_WINDOWS_API */
+
+/* return 0 on success */
+static WC_INLINE int IntelRDrand64_r(word64 *rnd)
 {
     int i;
@@ -1182 +1468 @@
 int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
 {
+    #ifdef HAVE_INTEL_RDSEED
+        if (IS_INTEL_RDSEED(intel_flags)) {
+             if (!wc_GenerateSeed_IntelRD(NULL, output, sz)) {
+                 /* success, we're done */
+                 return 0;
+             }
+        #ifdef FORCE_FAILURE_RDSEED
+             /* don't fall back to CryptoAPI */
+             return READ_RAN_E;
+        #endif
+        }
+    #endif /* HAVE_INTEL_RDSEED */
+
     if(!CryptAcquireContext(&os->handle, 0, 0, PROV_RSA_FULL,
                             CRYPT_VERIFYCONTEXT))
@@ -1302 +1601 @@
         int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
         {
-            int i;
+            word32 i;
 
             /* turn on RNGA module */
@@ -1418 +1717 @@
 
 #elif defined(STM32_RNG)
-    /*
-     * wc_Generate a RNG seed using the hardware random number generator
+     /* Generate a RNG seed using the hardware random number generator
      * on the STM32F2/F4/F7. */
 
@@ -1443 +1741 @@
         return 0;
     }
+    #elif defined(WOLFSSL_STM32F427_RNG)
+
+    /* Generate a RNG seed using the hardware RNG on the STM32F427
+     * directly, following steps outlined in STM32F4 Reference
+     * Manual (Chapter 24) for STM32F4xx family. */
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+    {
+        int i;
+        (void)os;
+
+        /* enable RNG peripheral clock */
+        RCC->AHB2ENR |= RCC_AHB2ENR_RNGEN;
+
+        /* enable RNG interrupt, set IE bit in RNG->CR register */
+        RNG->CR |= RNG_CR_IE;
+
+        /* enable RNG, set RNGEN bit in RNG->CR. Activates RNG,
+         * RNG_LFSR, and error detector */
+        RNG->CR |= RNG_CR_RNGEN;
+
+        /* verify no errors, make sure SEIS and CEIS bits are 0
+         * in RNG->SR register */
+        if (RNG->SR & (RNG_SR_SECS | RNG_SR_CECS))
+            return RNG_FAILURE_E;
+
+        for (i = 0; i < (int)sz; i++) {
+            /* wait until RNG number is ready */
+            while ((RNG->SR & RNG_SR_DRDY) == 0) { }
+
+            /* get value */
+            output[i] = RNG->DR;
+        }
+
+        return 0;
+    }
+
     #else
+
+    /* Generate a RNG seed using the STM32 Standard Peripheral Library */
     int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
     {
@@ -1493 +1829 @@
     }
 
+#elif defined(WOLFSSL_PB)
+
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+    {
+        word32 i;
+        for (i = 0; i < sz; i++)
+            output[i] = UTL_Rand();
+
+        (void)os;
+
+        return 0;
+    }
+
+#elif defined(WOLFSSL_NUCLEUS)
+#include "nucleus.h"
+#include "kernel/plus_common.h"
+
+#warning "potential for not enough entropy, currently being used for testing"
+int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+{
+    int i;
+    srand(NU_Get_Time_Stamp());
+
+    for (i = 0; i < sz; i++ ) {
+        output[i] = rand() % 256;
+        if ((i % 8) == 7) {
+            srand(NU_Get_Time_Stamp());
+        }
+    }
+
+    return 0;
+}
 #elif defined(WOLFSSL_VXWORKS)
 
@@ -1630 +1998 @@
     }
 
+#elif (defined(WOLFSSL_IMX6_CAAM) || defined(WOLFSSL_IMX6_CAAM_RNG))
+
+    #include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>
+    #include <wolfssl/wolfcrypt/port/caam/caam_driver.h>
+
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+    {
+        Buffer buf[1];
+        int ret  = 0;
+        int times = 1000, i;
+
+        (void)os;
+
+        if (output == NULL) {
+            return BUFFER_E;
+        }
+
+        buf[0].BufferType = DataBuffer | LastBuffer;
+        buf[0].TheAddress = (Address)output;
+        buf[0].Length     = sz;
+
+        /* Check Waiting to make sure entropy is ready */
+        for (i = 0; i < times; i++) {
+            ret = wc_caamAddAndWait(buf, NULL, CAAM_ENTROPY);
+            if (ret == Success) {
+                break;
+            }
+
+            /* driver could be waiting for entropy */
+            if (ret != RAN_BLOCK_E) {
+                return ret;
+            }
+            usleep(100);
+        }
+
+        if (i == times && ret != Success) {
+             return RNG_FAILURE_E;
+        }
+        else { /* Success case */
+            ret = 0;
+        }
+
+        return ret;
+    }
+
+#elif defined(WOLFSSL_APACHE_MYNEWT)
+
+    #include <stdlib.h>
+    #include "os/os_time.h"
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+    {
+        int i;
+        srand(os_time_get());
+
+        for (i = 0; i < sz; i++ ) {
+            output[i] = rand() % 256;
+            if ((i % 8) == 7) {
+                srand(os_time_get());
+            }
+        }
+
+        return 0;
+    }
+
+#elif defined(WOLFSSL_ESPIDF)
+    #if defined(WOLFSSL_ESPWROOM32)
+        #include <esp_system.h>
+        
+        int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+        {
+            int i;
+            
+            for (i = 0; i< sz; i++) {
+               output[i] =  esp_random( );
+            }
+        
+            return 0;
+        }
+    #endif /* end WOLFSSL_ESPWROOM32 */
+ 
 #elif defined(CUSTOM_RAND_GENERATE_BLOCK)
     /* #define CUSTOM_RAND_GENERATE_BLOCK myRngFunc
@@ -1640 +2088 @@
       defined(WOLFSSL_LPC43xx)  || defined(WOLFSSL_STM32F2xx) || \
       defined(MBED)             || defined(WOLFSSL_EMBOS) || \
-      defined(WOLFSSL_GENSEED_FORTEST)
+      defined(WOLFSSL_GENSEED_FORTEST) || defined(WOLFSSL_CHIBIOS) || \
+      defined(WOLFSSL_CONTIKI)
 
     /* these platforms do not have a default random seed and
@@ -1677 +2126 @@
              return ret;
     #else
-             /* fallback to /dev/urandom attempt */
+             /* reset error and fallback to using /dev/urandom */
              ret = 0;
     #endif
         }
-
     #endif /* HAVE_INTEL_RDSEED */
 
+    #ifndef NO_DEV_URANDOM /* way to disable use of /dev/urandom */
         os->fd = open("/dev/urandom",O_RDONLY);
-        if (os->fd == -1) {
+        if (os->fd == -1)
+    #endif
+        {
             /* may still have /dev/random */
             os->fd = open("/dev/random",O_RDONLY);
@@ -1703 +2154 @@
 
             if (sz) {
-    #ifdef BLOCKING
+    #if defined(BLOCKING) || defined(WC_RNG_BLOCKING)
                 sleep(0);             /* context switch */
     #else
@@ -1738 +2189 @@
 
 /* End wc_GenerateSeed */
-
 #endif /* WC_NO_RNG */
 #endif /* HAVE_FIPS */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/ripemd.c

@@ -272 +272 @@
 
 
-static INLINE void AddLength(RipeMd* ripemd, word32 len)
+static WC_INLINE void AddLength(RipeMd* ripemd, word32 len)
 {
     word32 tmp = ripemd->loLen;

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/rsa.c

@@ -30 +30 @@
 #ifndef NO_RSA
 
+#if defined(HAVE_FIPS) && \
+    defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+       #ifdef USE_WINDOWS_API
+               #pragma code_seg(".fipsA$e")
+               #pragma const_seg(".fipsB$e")
+       #endif
+#endif
+
 #include <wolfssl/wolfcrypt/rsa.h>
 
@@ -44 +56 @@
  * RSA_LOW_MEM:         NON CRT Private Operations, less memory     default: off
  * WC_NO_RSA_OAEP:      Disables RSA OAEP padding                   default: on (not defined)
-
+ * WC_RSA_NONBLOCK:     Enables support for RSA non-blocking        default: off
+ * WC_RSA_NONBLOCK_TIME:Enables support for time based blocking     default: off
+ *                      time calculation.
 */
 
@@ -55 +69 @@
 
 
-#ifdef HAVE_FIPS
+/* If building for old FIPS. */
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
 int  wc_InitRsaKey(RsaKey* key, void* ptr)
 {
@@ -64 +81 @@
     return InitRsaKey_fips(key, ptr);
 }
+
 
 int  wc_InitRsaKey_ex(RsaKey* key, void* ptr, int devId)
@@ -74 +92 @@
 }
 
+
 int  wc_FreeRsaKey(RsaKey* key)
 {
@@ -80 +99 @@
 
 
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 int  wc_RsaPublicEncrypt(const byte* in, word32 inLen, byte* out,
                                  word32 outLen, RsaKey* key, WC_RNG* rng)
@@ -88 +108 @@
     return RsaPublicEncrypt_fips(in, inLen, out, outLen, key, rng);
 }
-
-
+#endif
+
+
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
 int  wc_RsaPrivateDecryptInline(byte* in, word32 inLen, byte** out,
                                         RsaKey* key)
@@ -118 +140 @@
     return RsaSSL_Sign_fips(in, inLen, out, outLen, key, rng);
 }
+#endif
 
 
@@ -148 +171 @@
 
 
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 int wc_RsaFlattenPublicKey(RsaKey* key, byte* a, word32* aSz, byte* b,
                            word32* bSz)
@@ -155 +179 @@
     return RsaFlattenPublicKey(key, a, aSz, b, bSz);
 }
+#endif
+
+
 #ifdef WOLFSSL_KEY_GEN
     int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
@@ -168 +195 @@
 */
 
-#else /* else build without fips */
+#else /* else build without fips, or for new fips */
 
 #include <wolfssl/wolfcrypt/random.h>
 #include <wolfssl/wolfcrypt/logging.h>
+#ifdef WOLF_CRYPTO_DEV
+    #include <wolfssl/wolfcrypt/cryptodev.h>
+#endif
 #ifdef NO_INLINE
     #include <wolfssl/wolfcrypt/misc.h>
@@ -179 +209 @@
 #endif
 
-#define ERROR_OUT(x) { ret = (x); goto done;}
-
 
 enum {
@@ -196 +224 @@
 static void wc_RsaCleanup(RsaKey* key)
 {
+#ifndef WOLFSSL_RSA_VERIFY_INLINE
     if (key && key->data) {
         /* make sure any allocated memory is free'd */
         if (key->dataIsAlloc) {
+        #ifndef WOLFSSL_RSA_PUBLIC_ONLY
             if (key->type == RSA_PRIVATE_DECRYPT ||
                 key->type == RSA_PRIVATE_ENCRYPT) {
                 ForceZero(key->data, key->dataLen);
             }
+        #endif
             XFREE(key->data, key->heap, DYNAMIC_TYPE_WOLF_BIGINT);
             key->dataIsAlloc = 0;
@@ -209 +240 @@
         key->dataLen = 0;
     }
+#else
+    (void)key;
+#endif
 }
 
@@ -218 +252 @@
         return BAD_FUNC_ARG;
     }
+
+    XMEMSET(key, 0, sizeof(RsaKey));
 
     key->type = RSA_TYPE_UNKNOWN;
     key->state = RSA_STATE_NONE;
     key->heap = heap;
+#ifndef WOLFSSL_RSA_VERIFY_INLINE
+    key->dataIsAlloc = 0;
     key->data = NULL;
+#endif
     key->dataLen = 0;
-    key->dataIsAlloc = 0;
 #ifdef WC_RSA_BLINDING
     key->rng = NULL;
+#endif
+
+#ifdef WOLF_CRYPTO_DEV
+    key->devId = devId;
+#else
+    (void)devId;
 #endif
 
@@ -241 +285 @@
             return ret;
     #endif /* WC_ASYNC_ENABLE_RSA */
-#else
-    (void)devId;
 #endif /* WOLFSSL_ASYNC_CRYPT */
 
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
     ret = mp_init_multi(&key->n, &key->e, NULL, NULL, NULL, NULL);
     if (ret != MP_OKAY)
         return ret;
 
+#if !defined(WOLFSSL_KEY_GEN) && !defined(OPENSSL_EXTRA) && defined(RSA_LOW_MEM)
+    ret = mp_init_multi(&key->d, &key->p, &key->q, NULL, NULL, NULL);
+#else
     ret = mp_init_multi(&key->d, &key->p, &key->q, &key->dP, &key->dQ, &key->u);
+#endif
     if (ret != MP_OKAY) {
         mp_clear(&key->n);
@@ -255 +302 @@
         return ret;
     }
+#else
+    ret = mp_init(&key->n);
+    if (ret != MP_OKAY)
+        return ret;
+    ret = mp_init(&key->e);
+    if (ret != MP_OKAY) {
+        mp_clear(&key->n);
+        return ret;
+    }
+#endif
 
 #ifdef WOLFSSL_XILINX_CRYPT
@@ -268 +325 @@
     return wc_InitRsaKey_ex(key, heap, INVALID_DEVID);
 }
+
+#ifdef HAVE_PKCS11
+int wc_InitRsaKey_Id(RsaKey* key, unsigned char* id, int len, void* heap,
+                     int devId)
+{
+    int ret = 0;
+
+    if (key == NULL)
+        ret = BAD_FUNC_ARG;
+    if (ret == 0 && (len < 0 || len > RSA_MAX_ID_LEN))
+        ret = BUFFER_E;
+
+    if (ret == 0)
+        ret = wc_InitRsaKey_ex(key, heap, devId);
+
+    if (ret == 0 && id != NULL && len != 0) {
+        XMEMCPY(key->id, id, len);
+        key->idLen = len;
+    }
+
+    return ret;
+}
+#endif
 
 
@@ -359 +439 @@
 #endif
 
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
     if (key->type == RSA_PRIVATE) {
+#if defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || !defined(RSA_LOW_MEM)
         mp_forcezero(&key->u);
         mp_forcezero(&key->dQ);
         mp_forcezero(&key->dP);
+#endif
         mp_forcezero(&key->q);
         mp_forcezero(&key->p);
@@ -368 +451 @@
     }
     /* private part */
+#if defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || !defined(RSA_LOW_MEM)
     mp_clear(&key->u);
     mp_clear(&key->dQ);
     mp_clear(&key->dP);
+#endif
     mp_clear(&key->q);
     mp_clear(&key->p);
     mp_clear(&key->d);
+#endif /* WOLFSSL_RSA_PUBLIC_ONLY */
 
     /* public part */
@@ -386 +472 @@
     return ret;
 }
+
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
+/* Check the pair-wise consistency of the RSA key.
+ * From NIST SP 800-56B, section 6.4.1.1.
+ * Verify that k = (k^e)^d, for some k: 1 < k < n-1. */
+int wc_CheckRsaKey(RsaKey* key)
+{
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int *k = NULL, *tmp = NULL;
+#else
+    mp_int k[1], tmp[1];
+#endif
+    int ret = 0;
+
+#ifdef WOLFSSL_SMALL_STACK
+    k = (mp_int*)XMALLOC(sizeof(mp_int) * 2, NULL, DYNAMIC_TYPE_RSA);
+    if (k == NULL)
+        return MEMORY_E;
+    tmp = k + 1;
+#endif
+
+    if (mp_init_multi(k, tmp, NULL, NULL, NULL, NULL) != MP_OKAY)
+        ret = MP_INIT_E;
+
+    if (ret == 0) {
+        if (key == NULL)
+            ret = BAD_FUNC_ARG;
+    }
+
+    if (ret == 0) {
+        if (mp_set_int(k, 0x2342) != MP_OKAY)
+            ret = MP_READ_E;
+    }
+
+#ifdef WOLFSSL_SP_RSA
+#ifndef WOLFSSL_SP_NO_2048
+    if (mp_count_bits(&key->n) == 2048) {
+        ret = sp_ModExp_2048(k, &key->e, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+        ret = sp_ModExp_2048(tmp, &key->d, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+    }
+    else
+#endif
+#ifndef WOLFSSL_SP_NO_3072
+    if (mp_count_bits(&key->n) == 3072) {
+        ret = sp_ModExp_3072(k, &key->e, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+        ret = sp_ModExp_3072(tmp, &key->d, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+    }
+    else
+#endif
+#endif
+#ifdef WOLFSSL_SP_MATH
+    {
+        ret = WC_KEY_SIZE_E;
+    }
+#else
+    {
+        if (ret == 0) {
+            if (mp_exptmod(k, &key->e, &key->n, tmp) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+        }
+
+        if (ret == 0) {
+            if (mp_exptmod(tmp, &key->d, &key->n, tmp) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+        }
+    }
+#endif
+
+    if (ret == 0) {
+        if (mp_cmp(k, tmp) != MP_EQ)
+            ret = RSA_KEY_PAIR_E;
+    }
+
+    mp_forcezero(tmp);
+    mp_clear(tmp);
+    mp_clear(k);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(k, NULL, DYNAMIC_TYPE_RSA);
+#endif
+
+    return ret;
+}
+#endif
 
 
@@ -494 +671 @@
             break;
     #endif
-    #ifdef WOLFSSL_SHA512
     #ifdef WOLFSSL_SHA384
         case WC_MGF1SHA384:
@@ -500 +676 @@
             break;
     #endif
+    #ifdef WOLFSSL_SHA512
         case WC_MGF1SHA512:
             ret = RsaMGF1(WC_HASH_TYPE_SHA512, seed, seedSz, out, outSz, heap);
@@ -522 +699 @@
 
 /* Padding */
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
+#ifndef WC_NO_RNG
 #ifndef WC_NO_RSA_OAEP
 static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock,
@@ -700 +879 @@
 
 #ifdef WC_RSA_PSS
+
 /* 0x00 .. 0x00 0x01 | Salt | Gen Hash | 0xbc
  * XOR MGF over all bytes down to end of Salt
  * Gen Hash = HASH(8 * 0x00 | Message Hash | Salt)
+ *
+ * input         Digest of the message.
+ * inputLen      Length of digest.
+ * pkcsBlock     Buffer to write to.
+ * pkcsBlockLen  Length of buffer to write to.
+ * rng           Random number generator (for salt).
+ * htype         Hash function to use.
+ * mgf           Mask generation function.
+ * saltLen       Length of salt to put in padding.
+ * bits          Length of key in bits.
+ * heap          Used for dynamic memory allocation.
+ * returns 0 on success, PSS_SALTLEN_E when the salt length is invalid
+ * and other negative values on error.
  */
 static int RsaPad_PSS(const byte* input, word32 inputLen, byte* pkcsBlock,
         word32 pkcsBlockLen, WC_RNG* rng, enum wc_HashType hType, int mgf,
-        int bits, void* heap)
+        int saltLen, int bits, void* heap)
 {
     int   ret;
@@ -719 +912 @@
         return hLen;
 
+    if (saltLen == -1) {
+        saltLen = hLen;
+        #ifdef WOLFSSL_SHA512
+            /* See FIPS 186-4 section 5.5 item (e). */
+            if (bits == 1024 && hLen == WC_SHA512_DIGEST_SIZE)
+                saltLen = RSA_PSS_SALT_MAX_SZ;
+        #endif
+    }
+    else if (saltLen > hLen || saltLen < -1)
+        return PSS_SALTLEN_E;
+    if ((int)pkcsBlockLen - hLen < saltLen + 2)
+        return PSS_SALTLEN_E;
+
     s = m = pkcsBlock;
-    XMEMSET(m, 0, 8);
-    m += 8;
+    XMEMSET(m, 0, RSA_PSS_PAD_SZ);
+    m += RSA_PSS_PAD_SZ;
     XMEMCPY(m, input, inputLen);
     m += inputLen;
-    if ((ret = wc_RNG_GenerateBlock(rng, salt, hLen)) != 0)
+    if ((ret = wc_RNG_GenerateBlock(rng, salt, saltLen)) != 0)
         return ret;
-    XMEMCPY(m, salt, hLen);
-    m += hLen;
+    XMEMCPY(m, salt, saltLen);
+    m += saltLen;
 
     h = pkcsBlock + pkcsBlockLen - 1 - hLen;
     if ((ret = wc_Hash(hType, s, (word32)(m - s), h, hLen)) != 0)
         return ret;
-    pkcsBlock[pkcsBlockLen - 1] = 0xbc;
+    pkcsBlock[pkcsBlockLen - 1] = RSA_PSS_PAD_TERM;
 
     ret = RsaMGF(mgf, h, hLen, pkcsBlock, pkcsBlockLen - hLen - 1, heap);
@@ -739 +945 @@
     pkcsBlock[0] &= (1 << ((bits - 1) & 0x7)) - 1;
 
-    m = pkcsBlock + pkcsBlockLen - 1 - hLen - hLen - 1;
+    m = pkcsBlock + pkcsBlockLen - 1 - saltLen - hLen - 1;
     *(m++) ^= 0x01;
-    for (i = 0; i < hLen; i++)
+    for (i = 0; i < saltLen; i++)
         m[i] ^= salt[i];
 
     return 0;
 }
-#endif
+#endif /* WC_RSA_PSS */
 
 static int RsaPad(const byte* input, word32 inputLen, byte* pkcsBlock,
@@ -770 +976 @@
     }
     else {
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
         /* pad with non-zero random bytes */
         word32 padLen, i;
@@ -789 +996 @@
             if (pkcsBlock[i] == 0) pkcsBlock[i] = 0x01;
         }
+#else
+        (void)rng;
+        return RSA_WRONG_TYPE_E;
+#endif
     }
 
@@ -796 +1007 @@
     return 0;
 }
+#endif /* !WC_NO_RNG */
 
 /* helper function to direct which padding is used */
 static int wc_RsaPad_ex(const byte* input, word32 inputLen, byte* pkcsBlock,
     word32 pkcsBlockLen, byte padValue, WC_RNG* rng, int padType,
-    enum wc_HashType hType, int mgf, byte* optLabel, word32 labelLen, int bits,
-    void* heap)
+    enum wc_HashType hType, int mgf, byte* optLabel, word32 labelLen,
+    int saltLen, int bits, void* heap)
 {
     int ret;
@@ -807 +1019 @@
     switch (padType)
     {
+#ifndef WC_NO_RNG
         case WC_RSA_PKCSV15_PAD:
             /*WOLFSSL_MSG("wolfSSL Using RSA PKCSV15 padding");*/
@@ -825 +1038 @@
             WOLFSSL_MSG("wolfSSL Using RSA PSS padding");
             ret = RsaPad_PSS(input, inputLen, pkcsBlock, pkcsBlockLen, rng,
-                                                        hType, mgf, bits, heap);
+                                               hType, mgf, saltLen, bits, heap);
+            break;
+    #endif
+#endif /* !WC_NO_RNG */
+
+    #ifdef WC_RSA_NO_PADDING
+        case WC_RSA_NO_PAD:
+            WOLFSSL_MSG("wolfSSL Using NO padding");
+
+            /* In the case of no padding being used check that input is exactly
+             * the RSA key length */
+            if (bits <= 0 || inputLen != ((word32)bits/WOLFSSL_BIT_SIZE)) {
+                WOLFSSL_MSG("Bad input size");
+                ret = RSA_PAD_E;
+            }
+            else {
+                XMEMCPY(pkcsBlock, input, inputLen);
+                ret = 0;
+            }
             break;
     #endif
@@ -835 +1066 @@
 
     /* silence warning if not used with padding scheme */
+    (void)input;
+    (void)inputLen;
+    (void)pkcsBlock;
+    (void)pkcsBlockLen;
+    (void)padValue;
+    (void)rng;
+    (void)padType;
     (void)hType;
     (void)mgf;
     (void)optLabel;
     (void)labelLen;
+    (void)saltLen;
     (void)bits;
     (void)heap;
@@ -844 +1083 @@
     return ret;
 }
+#endif /* WOLFSSL_RSA_VERIFY_ONLY */
 
 
@@ -923 +1163 @@
     ret += pkcsBlock[0]     ^ 0x00; /* Y, the first value, should be 0 */
 
-    if (ret != 0) {
-        WOLFSSL_MSG("RsaUnPad_OAEP: Padding Error");
-        return BAD_PADDING_E;
-    }
+    /* Return 0 data length on error. */
+    idx = ctMaskSelInt(ctMaskEq(ret, 0), idx, pkcsBlockLen);
 
     /* adjust pointer to correct location in array and return size of M */
@@ -935 +1173 @@
 
 #ifdef WC_RSA_PSS
+/* 0x00 .. 0x00 0x01 | Salt | Gen Hash | 0xbc
+ * MGF over all bytes down to end of Salt
+ *
+ * pkcsBlock     Buffer holding decrypted data.
+ * pkcsBlockLen  Length of buffer.
+ * htype         Hash function to use.
+ * mgf           Mask generation function.
+ * saltLen       Length of salt to put in padding.
+ * bits          Length of key in bits.
+ * heap          Used for dynamic memory allocation.
+ * returns 0 on success, PSS_SALTLEN_E when the salt length is invalid,
+ * BAD_PADDING_E when the padding is not valid, MEMORY_E when allocation fails
+ * and other negative values on error.
+ */
 static int RsaUnPad_PSS(byte *pkcsBlock, unsigned int pkcsBlockLen,
                         byte **output, enum wc_HashType hType, int mgf,
-                        int bits, void* heap)
+                        int saltLen, int bits, void* heap)
 {
     int   ret;
@@ -947 +1199 @@
         return hLen;
 
-    if (pkcsBlock[pkcsBlockLen - 1] != 0xbc) {
-        WOLFSSL_MSG("RsaUnPad_PSS: Padding Error 0xBC");
+    if (saltLen == -1) {
+        saltLen = hLen;
+        #ifdef WOLFSSL_SHA512
+            /* See FIPS 186-4 section 5.5 item (e). */
+            if (bits == 1024 && hLen == WC_SHA512_DIGEST_SIZE)
+                saltLen = RSA_PSS_SALT_MAX_SZ;
+        #endif
+    }
+    else if (saltLen > hLen || saltLen < -1)
+        return PSS_SALTLEN_E;
+    if ((int)pkcsBlockLen - hLen < saltLen + 2)
+        return PSS_SALTLEN_E;
+
+    if (pkcsBlock[pkcsBlockLen - 1] != RSA_PSS_PAD_TERM) {
+        WOLFSSL_MSG("RsaUnPad_PSS: Padding Term Error");
         return BAD_PADDING_E;
     }
 
     tmp = (byte*)XMALLOC(pkcsBlockLen, heap, DYNAMIC_TYPE_RSA_BUFFER);
-    if (tmp == NULL) {
+    if (tmp == NULL)
         return MEMORY_E;
-    }
 
     if ((ret = RsaMGF(mgf, pkcsBlock + pkcsBlockLen - 1 - hLen, hLen,
@@ -964 +1228 @@
 
     tmp[0] &= (1 << ((bits - 1) & 0x7)) - 1;
-    for (i = 0; i < (int)(pkcsBlockLen - 1 - hLen - hLen - 1); i++) {
+    for (i = 0; i < (int)(pkcsBlockLen - 1 - saltLen - hLen - 1); i++) {
         if (tmp[i] != pkcsBlock[i]) {
             XFREE(tmp, heap, DYNAMIC_TYPE_RSA_BUFFER);
@@ -981 +1245 @@
     XFREE(tmp, heap, DYNAMIC_TYPE_RSA_BUFFER);
 
-    i = pkcsBlockLen - (RSA_PSS_PAD_SZ + 3 * hLen + 1);
-    XMEMSET(pkcsBlock + i, 0, RSA_PSS_PAD_SZ);
-
-    *output = pkcsBlock + i;
-    return RSA_PSS_PAD_SZ + 3 * hLen;
+    *output = pkcsBlock + pkcsBlockLen - (hLen + saltLen + 1);
+    return saltLen + hLen;
 }
 #endif
@@ -994 +1255 @@
                                                byte **output, byte padValue)
 {
-    word32 maxOutputLen = (pkcsBlockLen > 10) ? (pkcsBlockLen - 10) : 0;
-    word32 invalid = 0;
-    word32 i = 1;
-    word32 outputLen;
+    int    ret = BAD_FUNC_ARG;
+    word32 i;
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
+    byte   invalid = 0;
+#endif
 
     if (output == NULL || pkcsBlockLen == 0) {
@@ -1003 +1265 @@
     }
 
-    if (pkcsBlock[0] != 0x0) { /* skip past zero */
-        invalid = 1;
-    }
-    pkcsBlock++; pkcsBlockLen--;
-
-    /* Require block type padValue */
-    invalid = (pkcsBlock[0] != padValue) || invalid;
-
-    /* verify the padding until we find the separator */
     if (padValue == RSA_BLOCK_TYPE_1) {
-        while (i<pkcsBlockLen && pkcsBlock[i++] == 0xFF) {/* Null body */}
-    }
-    else {
-        while (i<pkcsBlockLen && pkcsBlock[i++]) {/* Null body */}
-    }
-
-    if (!(i==pkcsBlockLen || pkcsBlock[i-1]==0)) {
+        /* First byte must be 0x00 and Second byte, block type, 0x01 */
+        if (pkcsBlock[0] != 0 || pkcsBlock[1] != RSA_BLOCK_TYPE_1) {
+            WOLFSSL_MSG("RsaUnPad error, invalid formatting");
+            return RSA_PAD_E;
+    }
+
+        /* check the padding until we find the separator */
+        for (i = 2; i < pkcsBlockLen && pkcsBlock[i++] == 0xFF; ) { }
+
+        /* Minimum of 11 bytes of pre-message data and must have separator. */
+        if (i < RSA_MIN_PAD_SZ || pkcsBlock[i-1] != 0) {
         WOLFSSL_MSG("RsaUnPad error, bad formatting");
         return RSA_PAD_E;
     }
 
-    outputLen = pkcsBlockLen - i;
-    invalid = (outputLen > maxOutputLen) || invalid;
-
-    if (invalid) {
-        WOLFSSL_MSG("RsaUnPad error, invalid formatting");
-        return RSA_PAD_E;
-    }
+        *output = (byte *)(pkcsBlock + i);
+        ret = pkcsBlockLen - i;
+    }
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
+    else {
+        word32 j;
+        byte   pastSep = 0;
+
+        /* Decrypted with private key - unpad must be constant time. */
+        for (i = 0, j = 2; j < pkcsBlockLen; j++) {
+           /* Update i if not passed the separator and at separator. */
+           i |= (~pastSep) & ctMaskEq(pkcsBlock[j], 0x00) & (j + 1);
+           pastSep |= ctMaskEq(pkcsBlock[j], 0x00);
+        }
+
+        /* Minimum of 11 bytes of pre-message data - including leading 0x00. */
+        invalid |= ctMaskLT(i, RSA_MIN_PAD_SZ);
+        /* Must have seen separator. */
+        invalid |= ~pastSep;
+        /* First byte must be 0x00. */
+        invalid |= ctMaskNotEq(pkcsBlock[0], 0x00);
+        /* Check against expected block type: padValue */
+        invalid |= ctMaskNotEq(pkcsBlock[1], padValue);
 
     *output = (byte *)(pkcsBlock + i);
-    return outputLen;
-}
-
-/* helper function to direct unpadding */
+        ret = ((int)~invalid) & (pkcsBlockLen - i);
+    }
+#endif
+
+    return ret;
+}
+
+/* helper function to direct unpadding
+ *
+ * bits is the key modulus size in bits
+ */
 static int wc_RsaUnPad_ex(byte* pkcsBlock, word32 pkcsBlockLen, byte** out,
                           byte padValue, int padType, enum wc_HashType hType,
-                          int mgf, byte* optLabel, word32 labelLen, int bits,
-                          void* heap)
+                          int mgf, byte* optLabel, word32 labelLen, int saltLen,
+                          int bits, void* heap)
 {
     int ret;
@@ -1062 +1342 @@
             WOLFSSL_MSG("wolfSSL Using RSA PSS un-padding");
             ret = RsaUnPad_PSS((byte*)pkcsBlock, pkcsBlockLen, out, hType, mgf,
-                                                                    bits, heap);
+                                                           saltLen, bits, heap);
             break;
     #endif
+
+    #ifdef WC_RSA_NO_PADDING
+        case WC_RSA_NO_PAD:
+            WOLFSSL_MSG("wolfSSL Using NO un-padding");
+
+            /* In the case of no padding being used check that input is exactly
+             * the RSA key length */
+            if (bits <= 0 || pkcsBlockLen != ((word32)bits/WOLFSSL_BIT_SIZE)) {
+                WOLFSSL_MSG("Bad input size");
+                ret = RSA_PAD_E;
+            }
+            else {
+                if (out != NULL) {
+                    *out = pkcsBlock;
+                }
+                ret = pkcsBlockLen;
+            }
+            break;
+    #endif /* WC_RSA_NO_PADDING */
 
         default:
@@ -1076 +1375 @@
     (void)optLabel;
     (void)labelLen;
+    (void)saltLen;
     (void)bits;
     (void)heap;
@@ -1131 +1431 @@
 #endif /* WOLFSSL_XILINX_CRYPT */
 
+#ifdef WC_RSA_NONBLOCK
+static int wc_RsaFunctionNonBlock(const byte* in, word32 inLen, byte* out,
+                          word32* outLen, int type, RsaKey* key)
+{
+    int    ret = 0;
+    word32 keyLen, len;
+
+    if (key == NULL || key->nb == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (key->nb->exptmod.state == TFM_EXPTMOD_NB_INIT) {
+        if (mp_init(&key->nb->tmp) != MP_OKAY) {
+            ret = MP_INIT_E;
+        }
+
+        if (ret == 0) {
+            if (mp_read_unsigned_bin(&key->nb->tmp, (byte*)in, inLen) != MP_OKAY) {
+                ret = MP_READ_E;
+            }
+        }
+    }
+
+    if (ret == 0) {
+        switch(type) {
+        case RSA_PRIVATE_DECRYPT:
+        case RSA_PRIVATE_ENCRYPT:
+            ret = fp_exptmod_nb(&key->nb->exptmod, &key->nb->tmp, &key->d,
+                &key->n, &key->nb->tmp);
+            if (ret == FP_WOULDBLOCK)
+                return ret;
+            if (ret != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+            break;
+
+        case RSA_PUBLIC_ENCRYPT:
+        case RSA_PUBLIC_DECRYPT:
+            ret = fp_exptmod_nb(&key->nb->exptmod, &key->nb->tmp, &key->e,
+                &key->n, &key->nb->tmp);
+            if (ret == FP_WOULDBLOCK)
+                return ret;
+            if (ret != MP_OKAY)
+                ret = MP_EXPTMOD_E;
+            break;
+        default:
+            ret = RSA_WRONG_TYPE_E;
+            break;
+        }
+    }
+
+    if (ret == 0) {
+        keyLen = wc_RsaEncryptSize(key);
+        if (keyLen > *outLen)
+            ret = RSA_BUFFER_E;
+    }
+    if (ret == 0) {
+        len = mp_unsigned_bin_size(&key->nb->tmp);
+
+        /* pad front w/ zeros to match key length */
+        while (len < keyLen) {
+            *out++ = 0x00;
+            len++;
+        }
+
+        *outLen = keyLen;
+
+        /* convert */
+        if (mp_to_unsigned_bin(&key->nb->tmp, out) != MP_OKAY) {
+             ret = MP_TO_E;
+        }
+    }
+
+    mp_clear(&key->nb->tmp);
+
+    return ret;
+}
+#endif /* WC_RSA_NONBLOCK */
+
 static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
                           word32* outLen, int type, RsaKey* key, WC_RNG* rng)
 {
-    mp_int tmp;
+#ifndef WOLFSSL_SP_MATH
+#ifdef WOLFSSL_SMALL_STACK
+    mp_int* tmp = NULL;
 #ifdef WC_RSA_BLINDING
-    mp_int rnd, rndi;
+    mp_int* rnd = NULL;
+    mp_int* rndi = NULL;
+#endif
+#else
+    mp_int tmp[1];
+#ifdef WC_RSA_BLINDING
+    mp_int rnd[1], rndi[1];
+#endif
 #endif
     int    ret = 0;
-    word32 keyLen, len;
+    word32 keyLen = 0;
+#endif
 
 #ifdef WOLFSSL_HAVE_SP_RSA
@@ -1145 +1533 @@
     if (mp_count_bits(&key->n) == 2048) {
         switch(type) {
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
         case RSA_PRIVATE_DECRYPT:
         case RSA_PRIVATE_ENCRYPT:
@@ -1151 +1540 @@
                 return MISSING_RNG_E;
     #endif
+    #ifndef RSA_LOW_MEM
             return sp_RsaPrivate_2048(in, inLen, &key->d, &key->p, &key->q,
                                       &key->dP, &key->dQ, &key->u, &key->n,
                                       out, outLen);
+    #else
+            return sp_RsaPrivate_2048(in, inLen, &key->d, &key->p, &key->q,
+                                      NULL, NULL, NULL, &key->n, out, outLen);
+    #endif
+#endif
         case RSA_PUBLIC_ENCRYPT:
         case RSA_PUBLIC_DECRYPT:
@@ -1163 +1558 @@
     if (mp_count_bits(&key->n) == 3072) {
         switch(type) {
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
         case RSA_PRIVATE_DECRYPT:
         case RSA_PRIVATE_ENCRYPT:
@@ -1169 +1565 @@
                 return MISSING_RNG_E;
     #endif
+    #ifndef RSA_LOW_MEM
             return sp_RsaPrivate_3072(in, inLen, &key->d, &key->p, &key->q,
                                       &key->dP, &key->dQ, &key->u, &key->n,
                                       out, outLen);
+    #else
+            return sp_RsaPrivate_3072(in, inLen, &key->d, &key->p, &key->q,
+                                      NULL, NULL, NULL, &key->n, out, outLen);
+    #endif
+#endif
         case RSA_PUBLIC_ENCRYPT:
         case RSA_PUBLIC_DECRYPT:
@@ -1180 +1582 @@
 #endif /* WOLFSSL_HAVE_SP_RSA */
 
+#ifdef WOLFSSL_SP_MATH
     (void)rng;
-
-    if (mp_init(&tmp) != MP_OKAY)
-        return MP_INIT_E;
-
+    return WC_KEY_SIZE_E;
+#else
+    (void)rng;
+
+#ifdef WOLFSSL_SMALL_STACK
+    tmp = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_RSA);
+    if (tmp == NULL)
+        return MEMORY_E;
 #ifdef WC_RSA_BLINDING
+    rnd = (mp_int*)XMALLOC(sizeof(mp_int) * 2, key->heap, DYNAMIC_TYPE_RSA);
+    if (rnd == NULL) {
+        XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
+        return MEMORY_E;
+    }
+    rndi = rnd + 1;
+#endif /* WC_RSA_BLINDING */
+#endif /* WOLFSSL_SMALL_STACK */
+
+    if (mp_init(tmp) != MP_OKAY)
+        ret = MP_INIT_E;
+
+#ifdef WC_RSA_BLINDING
+    if (ret == 0) {
     if (type == RSA_PRIVATE_DECRYPT || type == RSA_PRIVATE_ENCRYPT) {
-        if (mp_init_multi(&rnd, &rndi, NULL, NULL, NULL, NULL) != MP_OKAY) {
-            mp_clear(&tmp);
-            return MP_INIT_E;
-        }
-    }
-#endif
-
-    if (mp_read_unsigned_bin(&tmp, (byte*)in, inLen) != MP_OKAY)
-        ERROR_OUT(MP_READ_E);
-
+            if (mp_init_multi(rnd, rndi, NULL, NULL, NULL, NULL) != MP_OKAY) {
+                mp_clear(tmp);
+                ret = MP_INIT_E;
+            }
+        }
+    }
+#endif
+
+#ifndef TEST_UNPAD_CONSTANT_TIME
+    if (ret == 0 && mp_read_unsigned_bin(tmp, (byte*)in, inLen) != MP_OKAY)
+        ret = MP_READ_E;
+
+    if (ret == 0) {
     switch(type) {
+    #ifndef WOLFSSL_RSA_PUBLIC_ONLY
     case RSA_PRIVATE_DECRYPT:
     case RSA_PRIVATE_ENCRYPT:
     {
-    #ifdef WC_RSA_BLINDING
+        #if defined(WC_RSA_BLINDING) && !defined(WC_NO_RNG)
         /* blind */
-        ret = mp_rand(&rnd, get_digit_count(&key->n), rng);
-        if (ret != MP_OKAY)
-            goto done;
+            ret = mp_rand(rnd, get_digit_count(&key->n), rng);
 
         /* rndi = 1/rnd mod n */
-        if (mp_invmod(&rnd, &key->n, &rndi) != MP_OKAY)
-            ERROR_OUT(MP_INVMOD_E);
+            if (ret == 0 && mp_invmod(rnd, &key->n, rndi) != MP_OKAY)
+                ret = MP_INVMOD_E;
 
         /* rnd = rnd^e */
-        if (mp_exptmod(&rnd, &key->e, &key->n, &rnd) != MP_OKAY)
-            ERROR_OUT(MP_EXPTMOD_E);
+            if (ret == 0 && mp_exptmod(rnd, &key->e, &key->n, rnd) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
 
         /* tmp = tmp*rnd mod n */
-        if (mp_mulmod(&tmp, &rnd, &key->n, &tmp) != MP_OKAY)
-            ERROR_OUT(MP_MULMOD_E);
-    #endif /* WC_RSA_BLINGING */
+            if (ret == 0 && mp_mulmod(tmp, rnd, &key->n, tmp) != MP_OKAY)
+                ret = MP_MULMOD_E;
+        #endif /* WC_RSA_BLINDING && !WC_NO_RNG */
 
     #ifdef RSA_LOW_MEM      /* half as much memory but twice as slow */
-        if (mp_exptmod(&tmp, &key->d, &key->n, &tmp) != MP_OKAY)
-            ERROR_OUT(MP_EXPTMOD_E);
+            if (ret == 0 && mp_exptmod(tmp, &key->d, &key->n, tmp) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
     #else
-        /* Return 0 when cond is false and n when cond is true. */
-        #define COND_N(cond, n)    ((0 - (cond)) & (n))
-        /* If ret has an error value return it otherwise if r is OK then return
-         * 0 otherwise return e.
-         */
-        #define RET_ERR(ret, r, e) \
-            ((ret) | (COND_N((ret) == 0, COND_N((r) != MP_OKAY, (e)))))
-
-        { /* tmpa/b scope */
-        mp_int tmpa, tmpb;
-        int r;
-
-        if (mp_init(&tmpa) != MP_OKAY)
-            ERROR_OUT(MP_INIT_E);
-
-        if (mp_init(&tmpb) != MP_OKAY) {
-            mp_clear(&tmpa);
-            ERROR_OUT(MP_INIT_E);
+            if (ret == 0) {
+            #ifdef WOLFSSL_SMALL_STACK
+                mp_int* tmpa = NULL;
+                mp_int* tmpb = NULL;
+            #else
+                mp_int tmpa[1], tmpb[1];
+            #endif
+                int cleara = 0, clearb = 0;
+
+            #ifdef WOLFSSL_SMALL_STACK
+                tmpa = XMALLOC(sizeof(mp_int) * 2, key->heap, DYNAMIC_TYPE_RSA);
+                if (tmpa != NULL)
+                    tmpb = tmpa + 1;
+                else
+                    ret = MEMORY_E;
+            #endif
+
+                if (ret == 0) {
+                    if (mp_init(tmpa) != MP_OKAY)
+                        ret = MP_INIT_E;
+                    else
+                        cleara = 1;
+                }
+
+                if (ret == 0) {
+                    if (mp_init(tmpb) != MP_OKAY)
+                        ret = MP_INIT_E;
+                    else
+                        clearb = 1;
         }
 
         /* tmpa = tmp^dP mod p */
-        r = mp_exptmod(&tmp, &key->dP, &key->p, &tmpa);
-        ret = RET_ERR(ret, r, MP_EXPTMOD_E);
+                if (ret == 0 && mp_exptmod(tmp, &key->dP, &key->p,
+                                                               tmpa) != MP_OKAY)
+                    ret = MP_EXPTMOD_E;
 
         /* tmpb = tmp^dQ mod q */
-        r = mp_exptmod(&tmp, &key->dQ, &key->q, &tmpb);
-        ret = RET_ERR(ret, r, MP_EXPTMOD_E);
+                if (ret == 0 && mp_exptmod(tmp, &key->dQ, &key->q,
+                                                               tmpb) != MP_OKAY)
+                    ret = MP_EXPTMOD_E;
 
         /* tmp = (tmpa - tmpb) * qInv (mod p) */
-        r = mp_sub(&tmpa, &tmpb, &tmp);
-        ret = RET_ERR(ret, r, MP_SUB_E);
-
-        r = mp_mulmod(&tmp, &key->u, &key->p, &tmp);
-        ret = RET_ERR(ret, r, MP_MULMOD_E);
+                if (ret == 0 && mp_sub(tmpa, tmpb, tmp) != MP_OKAY)
+                    ret = MP_SUB_E;
+
+                if (ret == 0 && mp_mulmod(tmp, &key->u, &key->p,
+                                                                tmp) != MP_OKAY)
+                    ret = MP_MULMOD_E;
 
         /* tmp = tmpb + q * tmp */
-        r = mp_mul(&tmp, &key->q, &tmp);
-        ret = RET_ERR(ret, r, MP_MUL_E);
-
-        r = mp_add(&tmp, &tmpb, &tmp);
-        ret = RET_ERR(ret, r, MP_ADD_E);
-
-        mp_clear(&tmpa);
-        mp_clear(&tmpb);
-
-        if (ret != 0) {
-            goto done;
-        }
-        #undef RET_ERR
-        #undef COND_N
+                if (ret == 0 && mp_mul(tmp, &key->q, tmp) != MP_OKAY)
+                    ret = MP_MUL_E;
+
+                if (ret == 0 && mp_add(tmp, tmpb, tmp) != MP_OKAY)
+                    ret = MP_ADD_E;
+
+            #ifdef WOLFSSL_SMALL_STACK
+                if (tmpa != NULL)
+            #endif
+                {
+                    if (cleara)
+                        mp_clear(tmpa);
+                    if (clearb)
+                        mp_clear(tmpb);
+            #ifdef WOLFSSL_SMALL_STACK
+                    XFREE(tmpa, key->heap, DYNAMIC_TYPE_RSA);
+            #endif
+        }
         } /* tmpa/b scope */
     #endif   /* RSA_LOW_MEM */
@@ -1279 +1720 @@
     #ifdef WC_RSA_BLINDING
         /* unblind */
-        if (mp_mulmod(&tmp, &rndi, &key->n, &tmp) != MP_OKAY)
-            ERROR_OUT(MP_MULMOD_E);
+            if (ret == 0 && mp_mulmod(tmp, rndi, &key->n, tmp) != MP_OKAY)
+                ret = MP_MULMOD_E;
     #endif   /* WC_RSA_BLINDING */
 
         break;
     }
+    #endif
     case RSA_PUBLIC_ENCRYPT:
     case RSA_PUBLIC_DECRYPT:
     #ifdef WOLFSSL_XILINX_CRYPT
         ret = wc_RsaFunctionXil(in, inLen, out, outLen, type, key, rng);
-        goto done;
     #else
-        if (mp_exptmod(&tmp, &key->e, &key->n, &tmp) != MP_OKAY)
-            ERROR_OUT(MP_EXPTMOD_E);
+            if (mp_exptmod(tmp, &key->e, &key->n, tmp) != MP_OKAY)
+                ret = MP_EXPTMOD_E;
         break;
     #endif
     default:
-        ERROR_OUT(RSA_WRONG_TYPE_E);
-    }
-
-    keyLen = wc_RsaEncryptSize(key);
-    if (keyLen > *outLen) {
-        ERROR_OUT(RSA_BUFFER_E);
-    }
-
-    len = mp_unsigned_bin_size(&tmp);
-
-    /* pad front w/ zeros to match key length */
-    while (len < keyLen) {
-        *out++ = 0x00;
-        len++;
-    }
-
+            ret = RSA_WRONG_TYPE_E;
+            break;
+    }
+    }
+
+    if (ret == 0) {
+        keyLen = wc_RsaEncryptSize(key);
+        if (keyLen > *outLen)
+            ret = RSA_BUFFER_E;
+    }
+    if (ret == 0) {
     *outLen = keyLen;
-
-    /* convert */
-    if (mp_to_unsigned_bin(&tmp, out) != MP_OKAY)
-        ERROR_OUT(MP_TO_E);
-
-done:
-    mp_clear(&tmp);
+        if (mp_to_unsigned_bin_len(tmp, out, keyLen) != MP_OKAY)
+             ret = MP_TO_E;
+    }
+#else
+    (void)type;
+    (void)key;
+    (void)keyLen;
+    XMEMCPY(out, in, inLen);
+    *outLen = inLen;
+#endif
+
+    mp_clear(tmp);
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
+#endif
 #ifdef WC_RSA_BLINDING
     if (type == RSA_PRIVATE_DECRYPT || type == RSA_PRIVATE_ENCRYPT) {
-        mp_clear(&rndi);
-        mp_clear(&rnd);
-    }
-#endif
+        mp_clear(rndi);
+        mp_clear(rnd);
+    }
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(rnd, key->heap, DYNAMIC_TYPE_RSA);
+#endif
+#endif /* WC_RSA_BLINDING */
     return ret;
+#endif /* WOLFSSL_SP_MATH */
 }
 
@@ -1352 +1800 @@
 
     switch(type) {
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
     case RSA_PRIVATE_DECRYPT:
     case RSA_PRIVATE_ENCRYPT:
     #ifdef HAVE_CAVIUM
+        key->dataLen = key->n.raw.len;
         ret = NitroxRsaExptMod(in, inLen,
                                key->d.raw.buf, key->d.raw.len,
@@ -1375 +1825 @@
     #endif
         break;
+#endif
 
     case RSA_PUBLIC_ENCRYPT:
     case RSA_PUBLIC_DECRYPT:
     #ifdef HAVE_CAVIUM
+        key->dataLen = key->n.raw.len;
         ret = NitroxRsaExptMod(in, inLen,
                                key->e.raw.buf, key->e.raw.len,
@@ -1400 +1852 @@
 #endif /* WOLFSSL_ASYNC_CRYPT && WC_ASYNC_ENABLE_RSA */
 
+#if defined(WC_RSA_DIRECT) || defined(WC_RSA_NO_PADDING)
+/* Function that does the RSA operation directly with no padding.
+ *
+ * in       buffer to do operation on
+ * inLen    length of input buffer
+ * out      buffer to hold results
+ * outSz    gets set to size of result buffer. Should be passed in as length
+ *          of out buffer. If the pointer "out" is null then outSz gets set to
+ *          the expected buffer size needed and LENGTH_ONLY_E gets returned.
+ * key      RSA key to use for encrypt/decrypt
+ * type     if using private or public key {RSA_PUBLIC_ENCRYPT,
+ *          RSA_PUBLIC_DECRYPT, RSA_PRIVATE_ENCRYPT, RSA_PRIVATE_DECRYPT}
+ * rng      wolfSSL RNG to use if needed
+ *
+ * returns size of result on success
+ */
+int wc_RsaDirect(byte* in, word32 inLen, byte* out, word32* outSz,
+        RsaKey* key, int type, WC_RNG* rng)
+{
+    int ret;
+
+    if (in == NULL || outSz == NULL || key == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* sanity check on type of RSA operation */
+    switch (type) {
+        case RSA_PUBLIC_ENCRYPT:
+        case RSA_PUBLIC_DECRYPT:
+        case RSA_PRIVATE_ENCRYPT:
+        case RSA_PRIVATE_DECRYPT:
+            break;
+        default:
+            WOLFSSL_MSG("Bad RSA type");
+            return BAD_FUNC_ARG;
+    }
+
+    if ((ret = wc_RsaEncryptSize(key)) < 0) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (inLen != (word32)ret) {
+        WOLFSSL_MSG("Bad input length. Should be RSA key size");
+        return BAD_FUNC_ARG;
+    }
+
+    if (out == NULL) {
+        *outSz = inLen;
+        return LENGTH_ONLY_E;
+    }
+
+    switch (key->state) {
+        case RSA_STATE_NONE:
+        case RSA_STATE_ENCRYPT_PAD:
+        case RSA_STATE_ENCRYPT_EXPTMOD:
+        case RSA_STATE_DECRYPT_EXPTMOD:
+        case RSA_STATE_DECRYPT_UNPAD:
+            key->state = (type == RSA_PRIVATE_ENCRYPT ||
+                    type == RSA_PUBLIC_ENCRYPT) ? RSA_STATE_ENCRYPT_EXPTMOD:
+                                                  RSA_STATE_DECRYPT_EXPTMOD;
+
+            key->dataLen = *outSz;
+
+            ret = wc_RsaFunction(in, inLen, out, &key->dataLen, type, key, rng);
+            if (ret >= 0 || ret == WC_PENDING_E) {
+                key->state = (type == RSA_PRIVATE_ENCRYPT ||
+                    type == RSA_PUBLIC_ENCRYPT) ? RSA_STATE_ENCRYPT_RES:
+                                                  RSA_STATE_DECRYPT_RES;
+            }
+            if (ret < 0) {
+                break;
+            }
+
+            FALL_THROUGH;
+
+        case RSA_STATE_ENCRYPT_RES:
+        case RSA_STATE_DECRYPT_RES:
+            ret = key->dataLen;
+            break;
+
+        default:
+            ret = BAD_STATE_E;
+    }
+
+    /* if async pending then skip cleanup*/
+    if (ret == WC_PENDING_E
+    #ifdef WC_RSA_NONBLOCK
+        || ret == FP_WOULDBLOCK
+    #endif
+    ) {
+        return ret;
+    }
+
+    key->state = RSA_STATE_NONE;
+    wc_RsaCleanup(key);
+
+    return ret;
+}
+#endif /* WC_RSA_DIRECT || WC_RSA_NO_PADDING */
+
+
 int wc_RsaFunction(const byte* in, word32 inLen, byte* out,
                           word32* outLen, int type, RsaKey* key, WC_RNG* rng)
 {
-    int ret;
+    int ret = 0;
 
     if (key == NULL || in == NULL || inLen == 0 || out == NULL ||
@@ -1409 +1962 @@
         return BAD_FUNC_ARG;
     }
+
+#ifdef WOLF_CRYPTO_DEV
+    if (key->devId != INVALID_DEVID) {
+        ret = wc_CryptoDev_Rsa(in, inLen, out, outLen, type, key, rng);
+        if (ret != NOT_COMPILED_IN)
+            return ret;
+        ret = 0; /* reset error code and try using software */
+    }
+#endif
+
+#ifndef TEST_UNPAD_CONSTANT_TIME
+#ifndef NO_RSA_BOUNDS_CHECK
+    if (type == RSA_PRIVATE_DECRYPT &&
+        key->state == RSA_STATE_DECRYPT_EXPTMOD) {
+
+        /* Check that 1 < in < n-1. (Requirement of 800-56B.) */
+#ifdef WOLFSSL_SMALL_STACK
+        mp_int* c = NULL;
+#else
+        mp_int c[1];
+#endif
+
+#ifdef WOLFSSL_SMALL_STACK
+        c = (mp_int*)XMALLOC(sizeof(mp_int), key->heap, DYNAMIC_TYPE_RSA);
+        if (c == NULL)
+            ret = MEMORY_E;
+#endif
+
+        if (mp_init(c) != MP_OKAY)
+            ret = MEMORY_E;
+        if (ret == 0) {
+            if (mp_read_unsigned_bin(c, in, inLen) != 0)
+                ret = MP_READ_E;
+        }
+        if (ret == 0) {
+            /* check c > 1 */
+            if (mp_cmp_d(c, 1) != MP_GT)
+                ret = RSA_OUT_OF_RANGE_E;
+        }
+        if (ret == 0) {
+            /* add c+1 */
+            if (mp_add_d(c, 1, c) != MP_OKAY)
+                ret = MP_ADD_E;
+        }
+        if (ret == 0) {
+            /* check c+1 < n */
+            if (mp_cmp(c, &key->n) != MP_LT)
+                ret = RSA_OUT_OF_RANGE_E;
+        }
+        mp_clear(c);
+
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(c, key->heap, DYNAMIC_TYPE_RSA);
+#endif
+
+        if (ret != 0)
+            return ret;
+    }
+#endif /* NO_RSA_BOUNDS_CHECK */
+#endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA)
@@ -1417 +2030 @@
     else
 #endif
+#ifdef WC_RSA_NONBLOCK
+    if (key->nb) {
+        ret = wc_RsaFunctionNonBlock(in, inLen, out, outLen, type, key);
+    }
+    else
+#endif
     {
         ret = wc_RsaFunctionSync(in, inLen, out, outLen, type, key, rng);
@@ -1422 +2041 @@
 
     /* handle error */
-    if (ret < 0 && ret != WC_PENDING_E) {
+    if (ret < 0 && ret != WC_PENDING_E
+    #ifdef WC_RSA_NONBLOCK
+        && ret != FP_WOULDBLOCK
+    #endif
+    ) {
         if (ret == MP_EXPTMOD_E) {
             /* This can happen due to incorrectly set FP_MAX_BITS or missing XREALLOC */
@@ -1436 +2059 @@
 
 
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 /* Internal Wrappers */
 /* Gives the option of choosing padding type
@@ -1447 +2071 @@
         RSA_PRIVATE_ENCRYPT or RSA_PRIVATE_DECRYPT
    pad_value: RSA_BLOCK_TYPE_1 or RSA_BLOCK_TYPE_2
-   pad_type  : type of padding: WC_RSA_PKCSV15_PAD, WC_RSA_OAEP_PAD or
-        WC_RSA_PSS_PAD
+   pad_type  : type of padding: WC_RSA_PKCSV15_PAD, WC_RSA_OAEP_PAD,
+        WC_RSA_NO_PAD or WC_RSA_PSS_PAD
    hash  : type of hash algorithm to use found in wolfssl/wolfcrypt/hash.h
    mgf   : type of mask generation function to use
    label : optional label
-   labelSz : size of optional label buffer */
+   labelSz : size of optional label buffer
+   saltLen : Length of salt used in PSS
+   rng : random number generator */
 static int RsaPublicEncryptEx(const byte* in, word32 inLen, byte* out,
                             word32 outLen, RsaKey* key, int rsa_type,
                             byte pad_value, int pad_type,
                             enum wc_HashType hash, int mgf,
-                            byte* label, word32 labelSz, WC_RNG* rng)
+                            byte* label, word32 labelSz, int saltLen,
+                            WC_RNG* rng)
 {
     int ret, sz;
@@ -1475 +2102 @@
 
     if (inLen > (word32)(sz - RSA_MIN_PAD_SZ)) {
+#ifdef WC_RSA_NO_PADDING
+        /* In the case that no padding is used the input length can and should
+         * be the same size as the RSA key. */
+        if (pad_type != WC_RSA_NO_PAD)
+#endif
         return RSA_BUFFER_E;
     }
@@ -1481 +2113 @@
     case RSA_STATE_NONE:
     case RSA_STATE_ENCRYPT_PAD:
-        key->state = RSA_STATE_ENCRYPT_PAD;
-
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA) && \
             defined(HAVE_CAVIUM)
-        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA && key->n.raw.buf) {
+        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA &&
+                                 pad_type != WC_RSA_PSS_PAD && key->n.raw.buf) {
             /* Async operations that include padding */
             if (rsa_type == RSA_PUBLIC_ENCRYPT &&
@@ -1502 +2133 @@
     #endif
 
+        key->state = RSA_STATE_ENCRYPT_PAD;
         ret = wc_RsaPad_ex(in, inLen, out, sz, pad_value, rng, pad_type, hash,
-                           mgf, label, labelSz, mp_count_bits(&key->n),
+                           mgf, label, labelSz, saltLen, mp_count_bits(&key->n),
                            key->heap);
         if (ret < 0) {
@@ -1510 +2142 @@
 
         key->state = RSA_STATE_ENCRYPT_EXPTMOD;
-
         FALL_THROUGH;
 
@@ -1537 +2168 @@
 
     /* if async pending then return and skip done cleanup below */
-    if (ret == WC_PENDING_E) {
+    if (ret == WC_PENDING_E
+    #ifdef WC_RSA_NONBLOCK
+        || ret == FP_WOULDBLOCK
+    #endif
+    ) {
         return ret;
     }
@@ -1546 +2181 @@
     return ret;
 }
+#endif
 
 /* Gives the option of choosing padding type
@@ -1557 +2193 @@
         RSA_PRIVATE_ENCRYPT or RSA_PRIVATE_DECRYPT
    pad_value: RSA_BLOCK_TYPE_1 or RSA_BLOCK_TYPE_2
-   pad_type  : type of padding: WC_RSA_PKCSV15_PAD, WC_RSA_OAEP_PAD
-        WC_RSA_PSS_PAD
+   pad_type  : type of padding: WC_RSA_PKCSV15_PAD, WC_RSA_OAEP_PAD,
+        WC_RSA_NO_PAD, WC_RSA_PSS_PAD
    hash  : type of hash algorithm to use found in wolfssl/wolfcrypt/hash.h
    mgf   : type of mask generation function to use
    label : optional label
-   labelSz : size of optional label buffer */
+   labelSz : size of optional label buffer
+   saltLen : Length of salt used in PSS
+   rng : random number generator */
 static int RsaPrivateDecryptEx(byte* in, word32 inLen, byte* out,
                             word32 outLen, byte** outPtr, RsaKey* key,
                             int rsa_type, byte pad_value, int pad_type,
                             enum wc_HashType hash, int mgf,
-                            byte* label, word32 labelSz, WC_RNG* rng)
+                            byte* label, word32 labelSz, int saltLen,
+                            WC_RNG* rng)
 {
     int ret = RSA_WRONG_TYPE_E;
@@ -1577 +2216 @@
     switch (key->state) {
     case RSA_STATE_NONE:
-    case RSA_STATE_DECRYPT_EXPTMOD:
-        key->state = RSA_STATE_DECRYPT_EXPTMOD;
         key->dataLen = inLen;
 
@@ -1584 +2221 @@
             defined(HAVE_CAVIUM)
         /* Async operations that include padding */
-        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA) {
+        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA &&
+                                                   pad_type != WC_RSA_PSS_PAD) {
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
             if (rsa_type == RSA_PRIVATE_DECRYPT &&
                                                 pad_value == RSA_BLOCK_TYPE_2) {
                 key->state = RSA_STATE_DECRYPT_RES;
                 key->data = NULL;
-                if (outPtr)
-                    *outPtr = in;
-                return NitroxRsaPrivateDecrypt(in, inLen, out, &key->dataLen, key);
+                return NitroxRsaPrivateDecrypt(in, inLen, out, &key->dataLen,
+                                               key);
+#endif
             }
             else if (rsa_type == RSA_PUBLIC_DECRYPT &&
@@ -1602 +2241 @@
     #endif
 
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_VERIFY_INLINE)
         /* verify the tmp ptr is NULL, otherwise indicates bad state */
         if (key->data != NULL) {
@@ -1610 +2250 @@
         /* if not doing this inline then allocate a buffer for it */
         if (outPtr == NULL) {
-            key->data = (byte*)XMALLOC(inLen, key->heap, DYNAMIC_TYPE_WOLF_BIGINT);
+            key->data = (byte*)XMALLOC(inLen, key->heap,
+                                                      DYNAMIC_TYPE_WOLF_BIGINT);
             key->dataIsAlloc = 1;
             if (key->data == NULL) {
@@ -1621 +2262 @@
             key->data = out;
         }
-        ret = wc_RsaFunction(key->data, inLen, key->data, &key->dataLen, rsa_type,
-                                                                      key, rng);
+#endif
+
+        key->state = RSA_STATE_DECRYPT_EXPTMOD;
+        FALL_THROUGH;
+
+    case RSA_STATE_DECRYPT_EXPTMOD:
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_VERIFY_INLINE)
+        ret = wc_RsaFunction(key->data, inLen, key->data, &key->dataLen,
+                                                            rsa_type, key, rng);
+#else
+        ret = wc_RsaFunction(out, inLen, out, &key->dataLen, rsa_type, key,
+                                                                           rng);
+#endif
 
         if (ret >= 0 || ret == WC_PENDING_E) {
@@ -1636 +2288 @@
     {
         byte* pad = NULL;
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLFSSL_RSA_VERIFY_INLINE)
         ret = wc_RsaUnPad_ex(key->data, key->dataLen, &pad, pad_value, pad_type,
-                             hash, mgf, label, labelSz, mp_count_bits(&key->n),
-                             key->heap);
-        if (ret > 0 && ret <= (int)outLen && pad != NULL) {
+                             hash, mgf, label, labelSz, saltLen,
+                             mp_count_bits(&key->n), key->heap);
+#else
+        ret = wc_RsaUnPad_ex(out, key->dataLen, &pad, pad_value, pad_type, hash,
+                             mgf, label, labelSz, saltLen,
+                             mp_count_bits(&key->n), key->heap);
+#endif
+        if (rsa_type == RSA_PUBLIC_DECRYPT && ret > (int)outLen)
+            ret = RSA_BUFFER_E;
+        else if (ret >= 0 && pad != NULL) {
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY)
+            signed char c;
+#endif
+
             /* only copy output if not inline */
             if (outPtr == NULL) {
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY)
+                word32 i, j;
+                int start = (int)((size_t)pad - (size_t)key->data);
+
+                for (i = 0, j = 0; j < key->dataLen; j++) {
+                    out[i] = key->data[j];
+                    c  = ctMaskGTE(j, start);
+                    c &= ctMaskLT(i, outLen);
+                    /* 0 - no add, -1 add */
+                    i += -c;
+                }
+#else
                 XMEMCPY(out, pad, ret);
+#endif
             }
-            else {
+            else
                 *outPtr = pad;
-            }
-        }
-        else if (ret >= 0) {
+
+#if !defined(WOLFSSL_RSA_VERIFY_ONLY)
+            ret = ctMaskSelInt(ctMaskLTE(ret, outLen), ret, RSA_BUFFER_E);
+            ret = ctMaskSelInt(ctMaskNotEq(ret, 0), ret, RSA_BUFFER_E);
+#else
+            if (outLen < (word32)ret)
             ret = RSA_BUFFER_E;
-        }
-        if (ret < 0) {
-            break;
+#endif
         }
 
@@ -1662 +2340 @@
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA) && \
             defined(HAVE_CAVIUM)
-        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA) {
-            /* return event ret */
-            ret = key->asyncDev.event.ret;
-            if (ret == 0) {
+        if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA &&
+                                                   pad_type != WC_RSA_PSS_PAD) {
+            if (ret > 0) {
                 /* convert result */
                 byte* dataLen = (byte*)&key->dataLen;
                 ret = (dataLen[0] << 8) | (dataLen[1]);
+
+                if (outPtr)
+                    *outPtr = in;
             }
         }
@@ -1680 +2360 @@
 
     /* if async pending then return and skip done cleanup below */
-    if (ret == WC_PENDING_E) {
+    if (ret == WC_PENDING_E
+    #ifdef WC_RSA_NONBLOCK
+        || ret == FP_WOULDBLOCK
+    #endif
+    ) {
         return ret;
     }
@@ -1691 +2375 @@
 
 
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 /* Public RSA Functions */
 int wc_RsaPublicEncrypt(const byte* in, word32 inLen, byte* out, word32 outLen,
@@ -1697 +2382 @@
     return RsaPublicEncryptEx(in, inLen, out, outLen, key,
         RSA_PUBLIC_ENCRYPT, RSA_BLOCK_TYPE_2, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
-}
-
-
-#ifndef WC_NO_RSA_OAEP
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
+}
+
+
+#if !defined(WC_NO_RSA_OAEP) || defined(WC_RSA_NO_PADDING)
 int wc_RsaPublicEncrypt_ex(const byte* in, word32 inLen, byte* out,
                     word32 outLen, RsaKey* key, WC_RNG* rng, int type,
@@ -1708 +2393 @@
 {
     return RsaPublicEncryptEx(in, inLen, out, outLen, key, RSA_PUBLIC_ENCRYPT,
-        RSA_BLOCK_TYPE_2, type, hash, mgf, label, labelSz, rng);
+        RSA_BLOCK_TYPE_2, type, hash, mgf, label, labelSz, 0, rng);
 }
 #endif /* WC_NO_RSA_OAEP */
-
-
+#endif
+
+
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
 int wc_RsaPrivateDecryptInline(byte* in, word32 inLen, byte** out, RsaKey* key)
 {
@@ -1721 +2408 @@
     return RsaPrivateDecryptEx(in, inLen, in, inLen, out, key,
         RSA_PRIVATE_DECRYPT, RSA_BLOCK_TYPE_2, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
 }
 
@@ -1736 +2423 @@
     return RsaPrivateDecryptEx(in, inLen, in, inLen, out, key,
         RSA_PRIVATE_DECRYPT, RSA_BLOCK_TYPE_2, type, hash,
-        mgf, label, labelSz, rng);
+        mgf, label, labelSz, 0, rng);
 }
 #endif /* WC_NO_RSA_OAEP */
@@ -1750 +2437 @@
     return RsaPrivateDecryptEx((byte*)in, inLen, out, outLen, NULL, key,
         RSA_PRIVATE_DECRYPT, RSA_BLOCK_TYPE_2, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
-}
-
-#ifndef WC_NO_RSA_OAEP
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
+}
+
+#if !defined(WC_NO_RSA_OAEP) || defined(WC_RSA_NO_PADDING)
 int wc_RsaPrivateDecrypt_ex(const byte* in, word32 inLen, byte* out,
                             word32 outLen, RsaKey* key, int type,
@@ -1765 +2452 @@
     return RsaPrivateDecryptEx((byte*)in, inLen, out, outLen, NULL, key,
         RSA_PRIVATE_DECRYPT, RSA_BLOCK_TYPE_2, type, hash, mgf, label,
-        labelSz, rng);
-}
-#endif /* WC_NO_RSA_OAEP */
+        labelSz, 0, rng);
+}
+#endif /* WC_NO_RSA_OAEP || WC_RSA_NO_PADDING */
+#endif /* WOLFSSL_RSA_PUBLIC_ONLY */
 
 
@@ -1778 +2466 @@
     return RsaPrivateDecryptEx(in, inLen, in, inLen, out, key,
         RSA_PUBLIC_DECRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
-}
-
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
+}
+
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 int wc_RsaSSL_Verify(const byte* in, word32 inLen, byte* out, word32 outLen,
                                                                  RsaKey* key)
@@ -1796 +2485 @@
     return RsaPrivateDecryptEx((byte*)in, inLen, out, outLen, NULL, key,
         RSA_PUBLIC_DECRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
-}
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
+}
+#endif
 
 #ifdef WC_RSA_PSS
+/* Verify the message signed with RSA-PSS.
+ * The input buffer is reused for the ouput buffer.
+ * Salt length is equal to hash length.
+ *
+ * in     Buffer holding encrypted data.
+ * inLen  Length of data in buffer.
+ * out    Pointer to address containing the PSS data.
+ * hash   Hash algorithm.
+ * mgf    Mask generation function.
+ * key    Public RSA key.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
 int wc_RsaPSS_VerifyInline(byte* in, word32 inLen, byte** out,
                            enum wc_HashType hash, int mgf, RsaKey* key)
+{
+    return wc_RsaPSS_VerifyInline_ex(in, inLen, out, hash, mgf, -1, key);
+}
+
+/* Verify the message signed with RSA-PSS.
+ * The input buffer is reused for the ouput buffer.
+ *
+ * in       Buffer holding encrypted data.
+ * inLen    Length of data in buffer.
+ * out      Pointer to address containing the PSS data.
+ * hash     Hash algorithm.
+ * mgf      Mask generation function.
+ * key      Public RSA key.
+ * saltLen  Length of salt used. -1 indicates salt length is the same as the
+ *          hash length.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
+int wc_RsaPSS_VerifyInline_ex(byte* in, word32 inLen, byte** out,
+                              enum wc_HashType hash, int mgf, int saltLen,
+                              RsaKey* key)
 {
     WC_RNG* rng = NULL;
@@ -1809 +2531 @@
     return RsaPrivateDecryptEx(in, inLen, in, inLen, out, key,
         RSA_PUBLIC_DECRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PSS_PAD,
-        hash, mgf, NULL, 0, rng);
-}
-
-/* Sig = 8 * 0x00 | Space for Message Hash | Salt | Exp Hash
- * Exp Hash = HASH(8 * 0x00 | Message Hash | Salt)
+        hash, mgf, NULL, 0, saltLen, rng);
+}
+
+/* Verify the message signed with RSA-PSS.
+ * Salt length is equal to hash length.
+ *
+ * in     Buffer holding encrypted data.
+ * inLen  Length of data in buffer.
+ * out    Pointer to address containing the PSS data.
+ * hash   Hash algorithm.
+ * mgf    Mask generation function.
+ * key    Public RSA key.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
+int wc_RsaPSS_Verify(byte* in, word32 inLen, byte* out, word32 outLen,
+                     enum wc_HashType hash, int mgf, RsaKey* key)
+{
+    return wc_RsaPSS_Verify_ex(in, inLen, out, outLen, hash, mgf, -1, key);
+}
+
+/* Verify the message signed with RSA-PSS.
+ *
+ * in       Buffer holding encrypted data.
+ * inLen    Length of data in buffer.
+ * out      Pointer to address containing the PSS data.
+ * hash     Hash algorithm.
+ * mgf      Mask generation function.
+ * key      Public RSA key.
+ * saltLen  Length of salt used. -1 indicates salt length is the same as the
+ *          hash length.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
+int wc_RsaPSS_Verify_ex(byte* in, word32 inLen, byte* out, word32 outLen,
+                        enum wc_HashType hash, int mgf, int saltLen,
+                        RsaKey* key)
+{
+    WC_RNG* rng = NULL;
+#ifdef WC_RSA_BLINDING
+    rng = key->rng;
+#endif
+    return RsaPrivateDecryptEx(in, inLen, out, outLen, NULL, key,
+        RSA_PUBLIC_DECRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PSS_PAD,
+        hash, mgf, NULL, 0, saltLen, rng);
+}
+
+
+/* Checks the PSS data to ensure that the signature matches.
+ * Salt length is equal to hash length.
+ *
+ * in        Hash of the data that is being verified.
+ * inSz      Length of hash.
+ * sig       Buffer holding PSS data.
+ * sigSz     Size of PSS data.
+ * hashType  Hash algorithm.
+ * returns BAD_PADDING_E when the PSS data is invalid, BAD_FUNC_ARG when
+ * NULL is passed in to in or sig or inSz is not the same as the hash
+ * algorithm length and 0 on success.
  */
 int wc_RsaPSS_CheckPadding(const byte* in, word32 inSz, byte* sig,
                            word32 sigSz, enum wc_HashType hashType)
 {
-    int ret;
+    return wc_RsaPSS_CheckPadding_ex(in, inSz, sig, sigSz, hashType, inSz, 0);
+}
+
+/* Checks the PSS data to ensure that the signature matches.
+ *
+ * in        Hash of the data that is being verified.
+ * inSz      Length of hash.
+ * sig       Buffer holding PSS data.
+ * sigSz     Size of PSS data.
+ * hashType  Hash algorithm.
+ * saltLen   Length of salt used. -1 indicates salt length is the same as the
+ *           hash length.
+ * returns BAD_PADDING_E when the PSS data is invalid, BAD_FUNC_ARG when
+ * NULL is passed in to in or sig or inSz is not the same as the hash
+ * algorithm length and 0 on success.
+ */
+int wc_RsaPSS_CheckPadding_ex(const byte* in, word32 inSz, byte* sig,
+                              word32 sigSz, enum wc_HashType hashType,
+                              int saltLen, int bits)
+{
+    int ret = 0;
+    byte sigCheck[WC_MAX_DIGEST_SIZE*2 + RSA_PSS_PAD_SZ];
+
+    (void)bits;
 
     if (in == NULL || sig == NULL ||
-                      inSz != (word32)wc_HashGetDigestSize(hashType) ||
-                      sigSz != RSA_PSS_PAD_SZ + inSz * 3)
+                      inSz != (word32)wc_HashGetDigestSize(hashType))
         ret = BAD_FUNC_ARG;
-    else {
-        XMEMCPY(sig + RSA_PSS_PAD_SZ, in, inSz);
-        ret = wc_Hash(hashType, sig, RSA_PSS_PAD_SZ + inSz * 2, sig, inSz);
-        if (ret != 0)
-            return ret;
-        if (XMEMCMP(sig, sig + RSA_PSS_PAD_SZ + inSz * 2, inSz) != 0) {
+
+    if (ret == 0) {
+        if (saltLen == -1) {
+            saltLen = inSz;
+            #ifdef WOLFSSL_SHA512
+                /* See FIPS 186-4 section 5.5 item (e). */
+                if (bits == 1024 && inSz == WC_SHA512_DIGEST_SIZE)
+                    saltLen = RSA_PSS_SALT_MAX_SZ;
+            #endif
+        }
+        else if (saltLen < -1 || (word32)saltLen > inSz)
+            ret = PSS_SALTLEN_E;
+    }
+
+    /* Sig = Salt | Exp Hash */
+    if (ret == 0) {
+        if (sigSz != inSz + saltLen)
+            ret = BAD_PADDING_E;
+    }
+
+    /* Exp Hash = HASH(8 * 0x00 | Message Hash | Salt) */
+    if (ret == 0) {
+        XMEMSET(sigCheck, 0, RSA_PSS_PAD_SZ);
+        XMEMCPY(sigCheck + RSA_PSS_PAD_SZ, in, inSz);
+        XMEMCPY(sigCheck + RSA_PSS_PAD_SZ + inSz, sig, saltLen);
+        ret = wc_Hash(hashType, sigCheck, RSA_PSS_PAD_SZ + inSz + saltLen,
+                      sigCheck, inSz);
+    }
+    if (ret == 0) {
+        if (XMEMCMP(sigCheck, sig + saltLen, inSz) != 0) {
             WOLFSSL_MSG("RsaPSS_CheckPadding: Padding Error");
             ret = BAD_PADDING_E;
         }
-        else
-            ret = 0;
     }
 
     return ret;
 }
-#endif
-
+
+
+/* Verify the message signed with RSA-PSS.
+ * The input buffer is reused for the ouput buffer.
+ * Salt length is equal to hash length.
+ *
+ * in     Buffer holding encrypted data.
+ * inLen  Length of data in buffer.
+ * out    Pointer to address containing the PSS data.
+ * digest Hash of the data that is being verified.
+ * digestLen Length of hash.
+ * hash   Hash algorithm.
+ * mgf    Mask generation function.
+ * key    Public RSA key.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
+int wc_RsaPSS_VerifyCheckInline(byte* in, word32 inLen, byte** out,
+                           const byte* digest, word32 digestLen,
+                           enum wc_HashType hash, int mgf, RsaKey* key)
+{
+    int ret = 0, verify, saltLen, hLen, bits = 0;
+
+    hLen = wc_HashGetDigestSize(hash);
+    if (hLen < 0)
+        return hLen;
+    if ((word32)hLen != digestLen)
+        return BAD_FUNC_ARG;
+
+    saltLen = hLen;
+    #ifdef WOLFSSL_SHA512
+        /* See FIPS 186-4 section 5.5 item (e). */
+        bits = mp_count_bits(&key->n);
+        if (bits == 1024 && hLen == WC_SHA512_DIGEST_SIZE)
+            saltLen = RSA_PSS_SALT_MAX_SZ;
+    #endif
+
+    verify = wc_RsaPSS_VerifyInline_ex(in, inLen, out, hash, mgf, saltLen, key);
+    if (verify > 0)
+        ret = wc_RsaPSS_CheckPadding_ex(digest, digestLen, *out, verify,
+                                        hash, saltLen, bits);
+    if (ret == 0)
+        ret = verify;
+
+    return ret;
+}
+
+
+/* Verify the message signed with RSA-PSS.
+ * Salt length is equal to hash length.
+ *
+ * in     Buffer holding encrypted data.
+ * inLen  Length of data in buffer.
+ * out    Pointer to address containing the PSS data.
+ * outLen Length of the output.
+ * digest Hash of the data that is being verified.
+ * digestLen Length of hash.
+ * hash   Hash algorithm.
+ * mgf    Mask generation function.
+ * key    Public RSA key.
+ * returns the length of the PSS data on success and negative indicates failure.
+ */
+int wc_RsaPSS_VerifyCheck(byte* in, word32 inLen, byte* out, word32 outLen,
+                          const byte* digest, word32 digestLen,
+                          enum wc_HashType hash, int mgf,
+                          RsaKey* key)
+{
+    int ret = 0, verify, saltLen, hLen, bits = 0;
+
+    hLen = wc_HashGetDigestSize(hash);
+    if (hLen < 0)
+        return hLen;
+    if ((word32)hLen != digestLen)
+        return BAD_FUNC_ARG;
+
+    saltLen = hLen;
+    #ifdef WOLFSSL_SHA512
+        /* See FIPS 186-4 section 5.5 item (e). */
+        bits = mp_count_bits(&key->n);
+        if (bits == 1024 && hLen == WC_SHA512_DIGEST_SIZE)
+            saltLen = RSA_PSS_SALT_MAX_SZ;
+    #endif
+
+    verify = wc_RsaPSS_Verify_ex(in, inLen, out, outLen, hash,
+                                 mgf, saltLen, key);
+    if (verify > 0)
+        ret = wc_RsaPSS_CheckPadding_ex(digest, digestLen, out, verify,
+                                        hash, saltLen, bits);
+    if (ret == 0)
+        ret = verify;
+
+    return ret;
+}
+
+#endif
+
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
 int wc_RsaSSL_Sign(const byte* in, word32 inLen, byte* out, word32 outLen,
                                                    RsaKey* key, WC_RNG* rng)
@@ -1846 +2758 @@
     return RsaPublicEncryptEx(in, inLen, out, outLen, key,
         RSA_PRIVATE_ENCRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PKCSV15_PAD,
-        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, rng);
+        WC_HASH_TYPE_NONE, WC_MGF1NONE, NULL, 0, 0, rng);
 }
 
 #ifdef WC_RSA_PSS
+/* Sign the hash of a message using RSA-PSS.
+ * Salt length is equal to hash length.
+ *
+ * in      Buffer holding hash of message.
+ * inLen   Length of data in buffer (hash length).
+ * out     Buffer to write encrypted signature into.
+ * outLen  Size of buffer to write to.
+ * hash    Hash algorithm.
+ * mgf     Mask generation function.
+ * key     Public RSA key.
+ * rng     Random number generator.
+ * returns the length of the encrypted signature on success, a negative value
+ * indicates failure.
+ */
 int wc_RsaPSS_Sign(const byte* in, word32 inLen, byte* out, word32 outLen,
                        enum wc_HashType hash, int mgf, RsaKey* key, WC_RNG* rng)
 {
+    return wc_RsaPSS_Sign_ex(in, inLen, out, outLen, hash, mgf, -1, key, rng);
+}
+
+/* Sign the hash of a message using RSA-PSS.
+ *
+ * in       Buffer holding hash of message.
+ * inLen    Length of data in buffer (hash length).
+ * out      Buffer to write encrypted signature into.
+ * outLen   Size of buffer to write to.
+ * hash     Hash algorithm.
+ * mgf      Mask generation function.
+ * saltLen  Length of salt used. -1 indicates salt length is the same as the
+ *          hash length.
+ * key      Public RSA key.
+ * rng      Random number generator.
+ * returns the length of the encrypted signature on success, a negative value
+ * indicates failure.
+ */
+int wc_RsaPSS_Sign_ex(const byte* in, word32 inLen, byte* out, word32 outLen,
+                      enum wc_HashType hash, int mgf, int saltLen, RsaKey* key,
+                      WC_RNG* rng)
+{
     return RsaPublicEncryptEx(in, inLen, out, outLen, key,
         RSA_PRIVATE_ENCRYPT, RSA_BLOCK_TYPE_1, WC_RSA_PSS_PAD,
-        hash, mgf, NULL, 0, rng);
-}
-#endif
-
+        hash, mgf, NULL, 0, saltLen, rng);
+}
+#endif
+#endif
+
+#if !defined(WOLFSSL_RSA_PUBLIC_ONLY) || !defined(WOLFSSL_SP_MATH)
 int wc_RsaEncryptSize(RsaKey* key)
 {
+    int ret;
+
     if (key == NULL) {
         return BAD_FUNC_ARG;
     }
-    return mp_unsigned_bin_size(&key->n);
-}
-
-
+
+    ret = mp_unsigned_bin_size(&key->n);
+
+#ifdef WOLF_CRYPTO_DEV
+    if (ret == 0 && key->devId != INVALID_DEVID) {
+        ret = 2048/8; /* hardware handles, use 2048-bit as default */
+}
+#endif
+
+    return ret;
+}
+#endif
+
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
 /* flatten RsaKey structure into individual elements (e, n) */
 int wc_RsaFlattenPublicKey(RsaKey* key, byte* e, word32* eSz, byte* n,
@@ -1896 +2858 @@
     return 0;
 }
+#endif
+
+#endif /* HAVE_FIPS */
+
+
+#ifndef WOLFSSL_RSA_VERIFY_ONLY
+static int RsaGetValue(mp_int* in, byte* out, word32* outSz)
+{
+    word32 sz;
+    int ret = 0;
+
+    /* Parameters ensured by calling function. */
+
+    sz = (word32)mp_unsigned_bin_size(in);
+    if (sz > *outSz)
+        ret = RSA_BUFFER_E;
+
+    if (ret == 0)
+        ret = mp_to_unsigned_bin(in, out);
+
+    if (ret == MP_OKAY)
+        *outSz = sz;
+
+    return ret;
+}
+
+
+int wc_RsaExportKey(RsaKey* key,
+                    byte* e, word32* eSz, byte* n, word32* nSz,
+                    byte* d, word32* dSz, byte* p, word32* pSz,
+                    byte* q, word32* qSz)
+{
+    int ret = BAD_FUNC_ARG;
+
+    if (key && e && eSz && n && nSz && d && dSz && p && pSz && q && qSz)
+        ret = 0;
+
+    if (ret == 0)
+        ret = RsaGetValue(&key->e, e, eSz);
+    if (ret == 0)
+        ret = RsaGetValue(&key->n, n, nSz);
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
+    if (ret == 0)
+        ret = RsaGetValue(&key->d, d, dSz);
+    if (ret == 0)
+        ret = RsaGetValue(&key->p, p, pSz);
+    if (ret == 0)
+        ret = RsaGetValue(&key->q, q, qSz);
+#else
+    /* no private parts to key */
+    if (d == NULL || p == NULL || q == NULL || dSz == NULL || pSz == NULL
+            || qSz == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        *dSz = 0;
+        *pSz = 0;
+        *qSz = 0;
+    }
+#endif /* WOLFSSL_RSA_PUBLIC_ONLY */
+
+    return ret;
+}
+#endif
+
 
 #ifdef WOLFSSL_KEY_GEN
+
+/* Check that |p-q| > 2^((size/2)-100) */
+static int wc_CompareDiffPQ(mp_int* p, mp_int* q, int size)
+{
+    mp_int c, d;
+    int ret;
+
+    if (p == NULL || q == NULL)
+        return BAD_FUNC_ARG;
+
+    ret = mp_init_multi(&c, &d, NULL, NULL, NULL, NULL);
+
+    /* c = 2^((size/2)-100) */
+    if (ret == 0)
+        ret = mp_2expt(&c, (size/2)-100);
+
+    /* d = |p-q| */
+    if (ret == 0)
+        ret = mp_sub(p, q, &d);
+
+    if (ret == 0)
+        ret = mp_abs(&d, &d);
+
+    /* compare */
+    if (ret == 0)
+        ret = mp_cmp(&d, &c);
+
+    if (ret == MP_GT)
+        ret = MP_OKAY;
+
+    mp_clear(&d);
+    mp_clear(&c);
+
+    return ret;
+}
+
+
+/* The lower_bound value is floor(2^(0.5) * 2^((nlen/2)-1)) where nlen is 4096.
+ * This number was calculated using a small test tool written with a common
+ * large number math library. Other values of nlen may be checked with a subset
+ * of lower_bound. */
+static const byte lower_bound[] = {
+    0xB5, 0x04, 0xF3, 0x33, 0xF9, 0xDE, 0x64, 0x84,
+    0x59, 0x7D, 0x89, 0xB3, 0x75, 0x4A, 0xBE, 0x9F,
+    0x1D, 0x6F, 0x60, 0xBA, 0x89, 0x3B, 0xA8, 0x4C,
+    0xED, 0x17, 0xAC, 0x85, 0x83, 0x33, 0x99, 0x15,
+/* 512 */
+    0x4A, 0xFC, 0x83, 0x04, 0x3A, 0xB8, 0xA2, 0xC3,
+    0xA8, 0xB1, 0xFE, 0x6F, 0xDC, 0x83, 0xDB, 0x39,
+    0x0F, 0x74, 0xA8, 0x5E, 0x43, 0x9C, 0x7B, 0x4A,
+    0x78, 0x04, 0x87, 0x36, 0x3D, 0xFA, 0x27, 0x68,
+/* 1024 */
+    0xD2, 0x20, 0x2E, 0x87, 0x42, 0xAF, 0x1F, 0x4E,
+    0x53, 0x05, 0x9C, 0x60, 0x11, 0xBC, 0x33, 0x7B,
+    0xCA, 0xB1, 0xBC, 0x91, 0x16, 0x88, 0x45, 0x8A,
+    0x46, 0x0A, 0xBC, 0x72, 0x2F, 0x7C, 0x4E, 0x33,
+    0xC6, 0xD5, 0xA8, 0xA3, 0x8B, 0xB7, 0xE9, 0xDC,
+    0xCB, 0x2A, 0x63, 0x43, 0x31, 0xF3, 0xC8, 0x4D,
+    0xF5, 0x2F, 0x12, 0x0F, 0x83, 0x6E, 0x58, 0x2E,
+    0xEA, 0xA4, 0xA0, 0x89, 0x90, 0x40, 0xCA, 0x4A,
+/* 2048 */
+    0x81, 0x39, 0x4A, 0xB6, 0xD8, 0xFD, 0x0E, 0xFD,
+    0xF4, 0xD3, 0xA0, 0x2C, 0xEB, 0xC9, 0x3E, 0x0C,
+    0x42, 0x64, 0xDA, 0xBC, 0xD5, 0x28, 0xB6, 0x51,
+    0xB8, 0xCF, 0x34, 0x1B, 0x6F, 0x82, 0x36, 0xC7,
+    0x01, 0x04, 0xDC, 0x01, 0xFE, 0x32, 0x35, 0x2F,
+    0x33, 0x2A, 0x5E, 0x9F, 0x7B, 0xDA, 0x1E, 0xBF,
+    0xF6, 0xA1, 0xBE, 0x3F, 0xCA, 0x22, 0x13, 0x07,
+    0xDE, 0xA0, 0x62, 0x41, 0xF7, 0xAA, 0x81, 0xC2,
+/* 3072 */
+    0xC1, 0xFC, 0xBD, 0xDE, 0xA2, 0xF7, 0xDC, 0x33,
+    0x18, 0x83, 0x8A, 0x2E, 0xAF, 0xF5, 0xF3, 0xB2,
+    0xD2, 0x4F, 0x4A, 0x76, 0x3F, 0xAC, 0xB8, 0x82,
+    0xFD, 0xFE, 0x17, 0x0F, 0xD3, 0xB1, 0xF7, 0x80,
+    0xF9, 0xAC, 0xCE, 0x41, 0x79, 0x7F, 0x28, 0x05,
+    0xC2, 0x46, 0x78, 0x5E, 0x92, 0x95, 0x70, 0x23,
+    0x5F, 0xCF, 0x8F, 0x7B, 0xCA, 0x3E, 0xA3, 0x3B,
+    0x4D, 0x7C, 0x60, 0xA5, 0xE6, 0x33, 0xE3, 0xE1
+/* 4096 */
+};
+
+
+/* returns 1 on key size ok and 0 if not ok */
+static WC_INLINE int RsaSizeCheck(int size)
+{
+    if (size < RSA_MIN_SIZE || size > RSA_MAX_SIZE) {
+        return 0;
+    }
+
+#ifdef HAVE_FIPS
+    /* Key size requirements for CAVP */
+    switch (size) {
+        case 1024:
+        case 2048:
+        case 3072:
+        case 4096:
+            return 1;
+    }
+
+    return 0;
+#else
+    return 1; /* allow unusual key sizes in non FIPS mode */
+#endif /* HAVE_FIPS */
+}
+
+
+static int _CheckProbablePrime(mp_int* p, mp_int* q, mp_int* e, int nlen,
+                                    int* isPrime, WC_RNG* rng)
+{
+    int ret;
+    mp_int tmp1, tmp2;
+    mp_int* prime;
+
+    if (p == NULL || e == NULL || isPrime == NULL)
+        return BAD_FUNC_ARG;
+
+    if (!RsaSizeCheck(nlen))
+        return BAD_FUNC_ARG;
+
+    *isPrime = MP_NO;
+
+    if (q != NULL) {
+        /* 5.4 - check that |p-q| <= (2^(1/2))(2^((nlen/2)-1)) */
+        ret = wc_CompareDiffPQ(p, q, nlen);
+        if (ret != MP_OKAY) goto notOkay;
+        prime = q;
+    }
+    else
+        prime = p;
+
+    ret = mp_init_multi(&tmp1, &tmp2, NULL, NULL, NULL, NULL);
+    if (ret != MP_OKAY) goto notOkay;
+
+    /* 4.4,5.5 - Check that prime >= (2^(1/2))(2^((nlen/2)-1))
+     *           This is a comparison against lowerBound */
+    ret = mp_read_unsigned_bin(&tmp1, lower_bound, nlen/16);
+    if (ret != MP_OKAY) goto notOkay;
+    ret = mp_cmp(prime, &tmp1);
+    if (ret == MP_LT) goto exit;
+
+    /* 4.5,5.6 - Check that GCD(p-1, e) == 1 */
+    ret = mp_sub_d(prime, 1, &tmp1);  /* tmp1 = prime-1 */
+    if (ret != MP_OKAY) goto notOkay;
+    ret = mp_gcd(&tmp1, e, &tmp2);  /* tmp2 = gcd(prime-1, e) */
+    if (ret != MP_OKAY) goto notOkay;
+    ret = mp_cmp_d(&tmp2, 1);
+    if (ret != MP_EQ) goto exit; /* e divides p-1 */
+
+    /* 4.5.1,5.6.1 - Check primality of p with 8 rounds of M-R.
+     * mp_prime_is_prime_ex() performs test divisions against the first 256
+     * prime numbers. After that it performs 8 rounds of M-R using random
+     * bases between 2 and n-2.
+     * mp_prime_is_prime() performs the same test divisions and then does
+     * M-R with the first 8 primes. Both functions set isPrime as a
+     * side-effect. */
+    if (rng != NULL)
+        ret = mp_prime_is_prime_ex(prime, 8, isPrime, rng);
+    else
+        ret = mp_prime_is_prime(prime, 8, isPrime);
+    if (ret != MP_OKAY) goto notOkay;
+
+exit:
+    ret = MP_OKAY;
+notOkay:
+    mp_clear(&tmp1);
+    mp_clear(&tmp2);
+    return ret;
+}
+
+
+int wc_CheckProbablePrime_ex(const byte* pRaw, word32 pRawSz,
+                          const byte* qRaw, word32 qRawSz,
+                          const byte* eRaw, word32 eRawSz,
+                          int nlen, int* isPrime, WC_RNG* rng)
+{
+    mp_int p, q, e;
+    mp_int* Q = NULL;
+    int ret;
+
+    if (pRaw == NULL || pRawSz == 0 ||
+        eRaw == NULL || eRawSz == 0 ||
+        isPrime == NULL) {
+
+        return BAD_FUNC_ARG;
+    }
+
+    if ((qRaw != NULL && qRawSz == 0) || (qRaw == NULL && qRawSz != 0))
+        return BAD_FUNC_ARG;
+
+    ret = mp_init_multi(&p, &q, &e, NULL, NULL, NULL);
+
+    if (ret == MP_OKAY)
+        ret = mp_read_unsigned_bin(&p, pRaw, pRawSz);
+
+    if (ret == MP_OKAY) {
+        if (qRaw != NULL) {
+            ret = mp_read_unsigned_bin(&q, qRaw, qRawSz);
+            if (ret == MP_OKAY)
+                Q = &q;
+        }
+    }
+
+    if (ret == MP_OKAY)
+        ret = mp_read_unsigned_bin(&e, eRaw, eRawSz);
+
+    if (ret == MP_OKAY)
+        ret = _CheckProbablePrime(&p, Q, &e, nlen, isPrime, rng);
+
+    ret = (ret == MP_OKAY) ? 0 : PRIME_GEN_E;
+
+    mp_clear(&p);
+    mp_clear(&q);
+    mp_clear(&e);
+
+    return ret;
+}
+
+
+int wc_CheckProbablePrime(const byte* pRaw, word32 pRawSz,
+                          const byte* qRaw, word32 qRawSz,
+                          const byte* eRaw, word32 eRawSz,
+                          int nlen, int* isPrime)
+{
+    return wc_CheckProbablePrime_ex(pRaw, pRawSz, qRaw, qRawSz,
+                          eRaw, eRawSz, nlen, isPrime, NULL);
+}
+
+#if !defined(HAVE_FIPS) || (defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2))
 /* Make an RSA key for size bits, with e specified, 65537 is a good e */
 int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
 {
+#ifndef WC_NO_RNG
     mp_int p, q, tmp1, tmp2, tmp3;
-    int    err;
+    int err, i, failCount, primeSz, isPrime = 0;
+    byte* buf = NULL;
 
     if (key == NULL || rng == NULL)
         return BAD_FUNC_ARG;
 
-    if (size < RSA_MIN_SIZE || size > RSA_MAX_SIZE)
+    if (!RsaSizeCheck(size))
         return BAD_FUNC_ARG;
 
@@ -1913 +3171 @@
         return BAD_FUNC_ARG;
 
-#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA)
+#ifdef WOLF_CRYPTO_DEV
+    if (key->devId != INVALID_DEVID) {
+        int ret = wc_CryptoDev_MakeRsaKey(key, size, e, rng);
+        if (ret != NOT_COMPILED_IN)
+            return ret;
+    }
+#endif
+
+#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA) && \
+    defined(WC_ASYNC_ENABLE_RSA_KEYGEN)
     if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA) {
     #ifdef HAVE_CAVIUM
         /* TODO: Not implemented */
     #elif defined(HAVE_INTEL_QA)
-        /* TODO: Not implemented */
+        return IntelQaRsaKeyGen(&key->asyncDev, key, size, e, rng);
     #else
         if (wc_AsyncTestInit(&key->asyncDev, ASYNC_TEST_RSA_MAKE)) {
@@ -1932 +3199 @@
 #endif
 
-    if ((err = mp_init_multi(&p, &q, &tmp1, &tmp2, &tmp3, NULL)) != MP_OKAY)
-        return err;
-
+    err = mp_init_multi(&p, &q, &tmp1, &tmp2, &tmp3, NULL);
+
+    if (err == MP_OKAY)
     err = mp_set_int(&tmp3, e);
+
+    /* The failCount value comes from NIST FIPS 186-4, section B.3.3,
+     * process steps 4.7 and 5.8. */
+    failCount = 5 * (size / 2);
+    primeSz = size / 16; /* size is the size of n in bits.
+                            primeSz is in bytes. */
+
+    /* allocate buffer to work with */
+    if (err == MP_OKAY) {
+        buf = (byte*)XMALLOC(primeSz, key->heap, DYNAMIC_TYPE_RSA);
+        if (buf == NULL)
+            err = MEMORY_E;
+    }
 
     /* make p */
     if (err == MP_OKAY) {
+        isPrime = 0;
+        i = 0;
         do {
-            err = mp_rand_prime(&p, size/16, rng, key->heap); /* size in bytes/2 */
+#ifdef SHOW_GEN
+            printf(".");
+            fflush(stdout);
+#endif
+            /* generate value */
+            err = wc_RNG_GenerateBlock(rng, buf, primeSz);
+            if (err == 0) {
+                /* prime lower bound has the MSB set, set it in candidate */
+                buf[0] |= 0x80;
+                /* make candidate odd */
+                buf[primeSz-1] |= 0x01;
+                /* load value */
+                err = mp_read_unsigned_bin(&p, buf, primeSz);
+            }
 
             if (err == MP_OKAY)
-                err = mp_sub_d(&p, 1, &tmp1);  /* tmp1 = p-1 */
-
-            if (err == MP_OKAY)
-                err = mp_gcd(&tmp1, &tmp3, &tmp2);  /* tmp2 = gcd(p-1, e) */
-        } while (err == MP_OKAY && mp_cmp_d(&tmp2, 1) != 0);  /* e divides p-1 */
-    }
+                err = _CheckProbablePrime(&p, NULL, &tmp3, size, &isPrime, rng);
+
+#ifdef WOLFSSL_FIPS
+            i++;
+#else
+            /* Keep the old retry behavior in non-FIPS build. */
+            (void)i;
+#endif
+        } while (err == MP_OKAY && !isPrime && i < failCount);
+    }
+
+    if (err == MP_OKAY && !isPrime)
+        err = PRIME_GEN_E;
 
     /* make q */
     if (err == MP_OKAY) {
+        isPrime = 0;
+        i = 0;
         do {
-            err = mp_rand_prime(&q, size/16, rng, key->heap); /* size in bytes/2 */
+#ifdef SHOW_GEN
+            printf(".");
+            fflush(stdout);
+#endif
+            /* generate value */
+            err = wc_RNG_GenerateBlock(rng, buf, primeSz);
+            if (err == 0) {
+                /* prime lower bound has the MSB set, set it in candidate */
+                buf[0] |= 0x80;
+                /* make candidate odd */
+                buf[primeSz-1] |= 0x01;
+                /* load value */
+                err = mp_read_unsigned_bin(&q, buf, primeSz);
+            }
 
             if (err == MP_OKAY)
-                err = mp_sub_d(&q, 1, &tmp1);  /* tmp1 = q-1 */
-
-            if (err == MP_OKAY)
-                err = mp_gcd(&tmp1, &tmp3, &tmp2);  /* tmp2 = gcd(q-1, e) */
-        } while (err == MP_OKAY && mp_cmp_d(&tmp2, 1) != 0);  /* e divides q-1 */
-    }
-
+                err = _CheckProbablePrime(&p, &q, &tmp3, size, &isPrime, rng);
+
+#ifdef WOLFSSL_FIPS
+            i++;
+#else
+            /* Keep the old retry behavior in non-FIPS build. */
+            (void)i;
+#endif
+        } while (err == MP_OKAY && !isPrime && i < failCount);
+    }
+
+    if (err == MP_OKAY && !isPrime)
+        err = PRIME_GEN_E;
+
+    if (buf) {
+        ForceZero(buf, primeSz);
+        XFREE(buf, key->heap, DYNAMIC_TYPE_RSA);
+    }
+
+
+    /* Setup RsaKey buffers */
     if (err == MP_OKAY)
         err = mp_init_multi(&key->n, &key->e, &key->d, &key->p, &key->q, NULL);
-
     if (err == MP_OKAY)
         err = mp_init_multi(&key->dP, &key->dQ, &key->u, NULL, NULL, NULL);
 
-    if (err == MP_OKAY)
-        err = mp_sub_d(&p, 1, &tmp2);  /* tmp2 = p-1 */
-
-    if (err == MP_OKAY)
-        err = mp_lcm(&tmp1, &tmp2, &tmp1);  /* tmp1 = lcm(p-1, q-1),last loop */
-
+    /* Software Key Calculation */
+    if (err == MP_OKAY)                /* tmp1 = p-1 */
+        err = mp_sub_d(&p, 1, &tmp1);
+    if (err == MP_OKAY)                /* tmp2 = q-1 */
+        err = mp_sub_d(&q, 1, &tmp2);
+    if (err == MP_OKAY)                /* tmp3 = lcm(p-1, q-1), last loop */
+        err = mp_lcm(&tmp1, &tmp2, &tmp3);
     /* make key */
-    if (err == MP_OKAY)
-        err = mp_set_int(&key->e, (mp_digit)e);  /* key->e = e */
-
+    if (err == MP_OKAY)                /* key->e = e */
+        err = mp_set_int(&key->e, (mp_digit)e);
     if (err == MP_OKAY)                /* key->d = 1/e mod lcm(p-1, q-1) */
-        err = mp_invmod(&key->e, &tmp1, &key->d);
-
-    if (err == MP_OKAY)
-        err = mp_mul(&p, &q, &key->n);  /* key->n = pq */
-
-    if (err == MP_OKAY)
-        err = mp_sub_d(&p, 1, &tmp1);
-
-    if (err == MP_OKAY)
-        err = mp_sub_d(&q, 1, &tmp2);
-
-    if (err == MP_OKAY)
+        err = mp_invmod(&key->e, &tmp3, &key->d);
+    if (err == MP_OKAY)                /* key->n = pq */
+        err = mp_mul(&p, &q, &key->n);
+    if (err == MP_OKAY)                /* key->dP = d mod(p-1) */
         err = mp_mod(&key->d, &tmp1, &key->dP);
-
-    if (err == MP_OKAY)
+    if (err == MP_OKAY)                /* key->dQ = d mod(q-1) */
         err = mp_mod(&key->d, &tmp2, &key->dQ);
-
-    if (err == MP_OKAY)
+    if (err == MP_OKAY)                /* key->u = 1/q mod p */
         err = mp_invmod(&q, &p, &key->u);
-
     if (err == MP_OKAY)
         err = mp_copy(&p, &key->p);
-
     if (err == MP_OKAY)
         err = mp_copy(&q, &key->q);
 
+#ifdef HAVE_WOLF_BIGINT
+    /* make sure raw unsigned bin version is available */
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->n, &key->n.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->e, &key->e.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->d, &key->d.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->p, &key->p.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->q, &key->q.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->dP, &key->dP.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->dQ, &key->dQ.raw);
+    if (err == MP_OKAY)
+         err = wc_mp_to_bigint(&key->u, &key->u.raw);
+#endif
+
     if (err == MP_OKAY)
         key->type = RSA_PRIVATE;
 
+    mp_clear(&tmp1);
+    mp_clear(&tmp2);
     mp_clear(&tmp3);
-    mp_clear(&tmp2);
-    mp_clear(&tmp1);
+    mp_clear(&p);
     mp_clear(&q);
-    mp_clear(&p);
-
-    if (err != MP_OKAY) {
+
+    /* Perform the pair-wise consistency test on the new key. */
+    if (err == 0)
+        err = wc_CheckRsaKey(key);
+
+    if (err != 0) {
         wc_FreeRsaKey(key);
         return err;
@@ -2025 +3367 @@
     }
 #endif
-
     return 0;
-}
+#else
+    return NOT_COMPILED_IN;
+#endif
+}
+#endif /* !FIPS || FIPS_VER >= 2 */
 #endif /* WOLFSSL_KEY_GEN */
 
 
 #ifdef WC_RSA_BLINDING
-
 int wc_RsaSetRNG(RsaKey* key, WC_RNG* rng)
 {
@@ -2042 +3386 @@
     return 0;
 }
-
 #endif /* WC_RSA_BLINDING */
 
-
-#undef ERROR_OUT
-
-#endif /* HAVE_FIPS */
+#ifdef WC_RSA_NONBLOCK
+int wc_RsaSetNonBlock(RsaKey* key, RsaNb* nb)
+{
+    if (key == NULL)
+        return BAD_FUNC_ARG;
+
+    if (nb) {
+        XMEMSET(nb, 0, sizeof(RsaNb));
+    }
+
+    /* Allow nb == NULL to clear non-block mode */
+    key->nb = nb;
+
+    return 0;
+}
+#ifdef WC_RSA_NONBLOCK_TIME
+int wc_RsaSetNonBlockTime(RsaKey* key, word32 maxBlockUs, word32 cpuMHz)
+{
+    if (key == NULL || key->nb == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* calculate maximum number of instructions to block */
+    key->nb->exptmod.maxBlockInst = cpuMHz * maxBlockUs;
+
+    return 0;
+}
+#endif /* WC_RSA_NONBLOCK_TIME */
+#endif /* WC_RSA_NONBLOCK */
+
 #endif /* NO_RSA */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/sha.c

@@ -29 +29 @@
 #if !defined(NO_SHA)
 
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$j")
+        #pragma const_seg(".fipsB$j")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/sha.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
 
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
     int wc_InitSha(wc_Sha* sha)
     {
@@ -72 +86 @@
     }
 
-#else /* else build without fips */
+#else /* else build without fips, or for FIPS v2 */
 
 
@@ -88 +102 @@
 #endif
 
-static INLINE void AddLength(wc_Sha* sha, word32 len);
-
 
 /* Hardware Acceleration */
@@ -97 +109 @@
 #elif defined(STM32_HASH)
 
-    /*
-     * STM32F2/F4/F7 hardware SHA1 support through the HASH_* API's from the
-     * Standard Peripheral Library or CubeMX (See note in README).
-     */
-
-    /* STM32 register size, bytes */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        #define SHA_REG_SIZE  WC_SHA_BLOCK_SIZE
-    #else
-        #define SHA_REG_SIZE  4
-        /* STM32 struct notes:
-         * sha->buffer  = first 4 bytes used to hold partial block if needed
-         * sha->buffLen = num bytes currently stored in sha->buffer
-         * sha->loLen   = num bytes that have been written to STM32 FIFO
-         */
-    #endif
-    #define SHA_HW_TIMEOUT 0xFF
-
+    /* Supports CubeMX HAL or Standard Peripheral Library */
         int wc_InitSha_ex(wc_Sha* sha, void* heap, int devId)
     {
-                if (sha == NULL)
+        if (sha == NULL) {
                         return BAD_FUNC_ARG;
-
-                sha->heap = heap;
-        XMEMSET(sha->buffer, 0, sizeof(sha->buffer));
-        sha->buffLen = 0;
-        sha->loLen = 0;
-        sha->hiLen = 0;
-
-        /* initialize HASH peripheral */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        HAL_HASH_DeInit(&sha->hashHandle);
-        sha->hashHandle.Init.DataType = HASH_DATATYPE_8B;
-        if (HAL_HASH_Init(&sha->hashHandle) != HAL_OK) {
-            return ASYNC_INIT_E;
-        }
-
-        /* reset the hash control register */
-        /* required because Cube MX is not clearing algo bits */
-        HASH->CR &= ~HASH_CR_ALGO;
-    #else
-        HASH_DeInit();
-
-        /* reset the hash control register */
-        HASH->CR &= ~ (HASH_CR_ALGO | HASH_CR_DATATYPE | HASH_CR_MODE);
-
-        /* configure algo used, algo mode, datatype */
-        HASH->CR |= (HASH_AlgoSelection_SHA1 | HASH_AlgoMode_HASH
-                   | HASH_DataType_8b);
-
-        /* reset HASH processor */
-        HASH->CR |= HASH_CR_INIT;
-    #endif
+        }
+
+        (void)devId;
+        (void)heap;
+
+        wc_Stm32_Hash_Init(&sha->stmCtx);
 
         return 0;
@@ -156 +126 @@
     int wc_ShaUpdate(wc_Sha* sha, const byte* data, word32 len)
     {
-        int ret = 0;
-        byte* local;
+        int ret;
 
         if (sha == NULL || (data == NULL && len > 0)) {
@@ -163 +132 @@
         }
 
-        /* do block size increments */
-        local = (byte*)sha->buffer;
-
-        /* check that internal buffLen is valid */
-        if (sha->buffLen >= SHA_REG_SIZE)
-            return BUFFER_E;
-
-        while (len) {
-            word32 add = min(len, SHA_REG_SIZE - sha->buffLen);
-            XMEMCPY(&local[sha->buffLen], data, add);
-
-            sha->buffLen += add;
-            data         += add;
-            len          -= add;
-
-            if (sha->buffLen == SHA_REG_SIZE) {
-            #ifdef WOLFSSL_STM32_CUBEMX
-                if (HAL_HASH_SHA1_Accumulate(
-                        &sha->hashHandle, local, SHA_REG_SIZE) != HAL_OK) {
-                    ret = ASYNC_OP_E;
-                }
-            #else
-                HASH_DataIn(*(uint32_t*)local);
-            #endif
-
-                AddLength(sha, SHA_REG_SIZE);
-                sha->buffLen = 0;
-            }
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Update(&sha->stmCtx, HASH_AlgoSelection_SHA1,
+                data, len);
+            wolfSSL_CryptHwMutexUnLock();
         }
         return ret;
@@ -197 +143 @@
     int wc_ShaFinal(wc_Sha* sha, byte* hash)
     {
-        int ret = 0;
-
-        if (sha == NULL || hash == NULL)
+        int ret;
+
+        if (sha == NULL || hash == NULL) {
             return BAD_FUNC_ARG;
-
-    #ifdef WOLFSSL_STM32_CUBEMX
-        if (HAL_HASH_SHA1_Start(&sha->hashHandle,
-                (byte*)sha->buffer, sha->buffLen,
-                (byte*)sha->digest, SHA_HW_TIMEOUT) != HAL_OK) {
-            ret = ASYNC_OP_E;
-        }
-        HAL_HASH_DeInit(&sha->hashHandle);
-    #else
-        __IO uint16_t nbvalidbitsdata = 0;
-
-        /* finish reading any trailing bytes into FIFO */
-        if (sha->buffLen > 0) {
-            HASH_DataIn(*(uint32_t*)sha->buffer);
-            AddLength(sha, sha->buffLen);
-        }
-
-        /* calculate number of valid bits in last word of input data */
-        nbvalidbitsdata = 8 * (sha->loLen % SHA_REG_SIZE);
-
-        /* configure number of valid bits in last word of the data */
-        HASH_SetLastWordValidBitsNbr(nbvalidbitsdata);
-
-        /* start HASH processor */
-        HASH_StartDigest();
-
-        /* wait until Busy flag == RESET */
-        while (HASH_GetFlagStatus(HASH_FLAG_BUSY) != RESET) {}
-
-        /* read message digest */
-        sha->digest[0] = HASH->HR[0];
-        sha->digest[1] = HASH->HR[1];
-        sha->digest[2] = HASH->HR[2];
-        sha->digest[3] = HASH->HR[3];
-        sha->digest[4] = HASH->HR[4];
-
-        ByteReverseWords(sha->digest, sha->digest, WC_SHA_DIGEST_SIZE);
-    #endif /* WOLFSSL_STM32_CUBEMX */
-
-        XMEMCPY(hash, sha->digest, WC_SHA_DIGEST_SIZE);
-
-        (void)wc_InitSha_ex(sha, sha->heap, INVALID_DEVID);  /* reset state */
+        }
+
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Final(&sha->stmCtx, HASH_AlgoSelection_SHA1,
+                hash, WC_SHA_DIGEST_SIZE);
+            wolfSSL_CryptHwMutexUnLock();
+        }
+
+        (void)wc_InitSha(sha);  /* reset state */
 
         return ret;
@@ -251 +165 @@
 
     #include "fsl_ltc.h"
-    static int InitSha(wc_Sha* sha)
-    {
+    int wc_InitSha_ex(wc_Sha* sha, void* heap, int devId)
+    {
+        if (sha == NULL) {
+            return BAD_FUNC_ARG;
+        }
+
+        (void)devId;
+        (void)heap;
+
         LTC_HASH_Init(LTC_BASE, &sha->ctx, kLTC_Sha1, NULL, 0);
         return 0;
@@ -317 +238 @@
     }
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* wolfcrypt/src/port/caam/caam_sha.c */
 #else
 
@@ -342 +265 @@
 
 
-#if defined(USE_SHA_SOFTWARE_IMPL) || defined(STM32_HASH)
-static INLINE void AddLength(wc_Sha* sha, word32 len)
+/* Software implementation */
+#ifdef USE_SHA_SOFTWARE_IMPL
+
+static WC_INLINE void AddLength(wc_Sha* sha, word32 len)
 {
     word32 tmp = sha->loLen;
@@ -349 +274 @@
         sha->hiLen++;                       /* carry low to high */
 }
-#endif
-
-
-/* Software implementation */
-#ifdef USE_SHA_SOFTWARE_IMPL
 
 /* Check if custom wc_Sha transform is used */
@@ -367 +287 @@
     #define f3(x,y,z) (((x)&(y))|((z)&((x)|(y))))
     #define f4(x,y,z) ((x)^(y)^(z))
+
+    #ifdef WOLFSSL_NUCLEUS_1_2
+        /* nucleus.h also defines R1-R4 */
+        #undef R1
+        #undef R2
+        #undef R3
+        #undef R4
+    #endif
 
     /* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
@@ -526 +454 @@
 }
 
+int wc_ShaFinalRaw(wc_Sha* sha, byte* hash)
+{
+#ifdef LITTLE_ENDIAN_ORDER
+    word32 digest[WC_SHA_DIGEST_SIZE / sizeof(word32)];
+#endif
+
+    if (sha == NULL || hash == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef LITTLE_ENDIAN_ORDER
+    ByteReverseWords((word32*)digest, (word32*)sha->digest, WC_SHA_DIGEST_SIZE);
+    XMEMCPY(hash, digest, WC_SHA_DIGEST_SIZE);
+#else
+    XMEMCPY(hash, sha->digest, WC_SHA_DIGEST_SIZE);
+#endif
+
+    return 0;
+}
+
 int wc_ShaFinal(wc_Sha* sha, byte* hash)
 {
@@ -606 +554 @@
     wolfAsync_DevCtxFree(&sha->asyncDev, WOLFSSL_ASYNC_MARKER_SHA);
 #endif /* WOLFSSL_ASYNC_CRYPT */
+
+#ifdef WOLFSSL_PIC32MZ_HASH
+    wc_ShaPic32Free(sha);
+#endif
 }
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/sha256.c

@@ -29 +29 @@
 #include <wolfssl/wolfcrypt/settings.h>
 
-#if !defined(NO_SHA256)
+#if !defined(NO_SHA256) && !defined(WOLFSSL_ARMASM)
+
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$d")
+        #pragma const_seg(".fipsB$d")
+    #endif
+#endif
 
 #include <wolfssl/wolfcrypt/sha256.h>
@@ -36 +48 @@
 
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
 
     int wc_InitSha256(wc_Sha256* sha)
@@ -59 +72 @@
             return BAD_FUNC_ARG;
         }
+
+        if (data == NULL && len == 0) {
+            /* valid, but do nothing */
+            return 0;
+        }
+
         return Sha256Update_fips(sha, data, len);
     }
@@ -74 +93 @@
     }
 
-#else /* else build without fips */
+#else /* else build without fips, or for FIPS v2 */
 
 
@@ -90 +109 @@
 #endif
 
+#ifdef WOLFSSL_DEVCRYPTO_HASH
+    #include <wolfssl/wolfcrypt/port/devcrypto/wc_devcrypto.h>
+#endif
+
+
 
 #if defined(USE_INTEL_SPEEDUP)
+    #if defined(__GNUC__) && ((__GNUC__ < 4) || \
+                              (__GNUC__ == 4 && __GNUC_MINOR__ <= 8))
+        #undef  NO_AVX2_SUPPORT
+        #define NO_AVX2_SUPPORT
+    #endif
+    #if defined(__clang__) && ((__clang_major__ < 3) || \
+                               (__clang_major__ == 3 && __clang_minor__ <= 5))
+        #define NO_AVX2_SUPPORT
+    #elif defined(__clang__) && defined(NO_AVX2_SUPPORT)
+        #undef NO_AVX2_SUPPORT
+    #endif
+
     #define HAVE_INTEL_AVX1
+    #ifndef NO_AVX2_SUPPORT
     #define HAVE_INTEL_AVX2
+    #endif
 #endif /* USE_INTEL_SPEEDUP */
 
@@ -101 +139 @@
 
 
-static INLINE void AddLength(wc_Sha256* sha256, word32 len);
-
-#if !defined(WOLFSSL_PIC32MZ_HASH) && !defined(STM32_HASH)
+#if !defined(WOLFSSL_PIC32MZ_HASH) && !defined(STM32_HASH_SHA2) && \
+    (!defined(WOLFSSL_IMX6_CAAM) || defined(NO_IMX6_CAAM_HASH)) && \
+    !defined(WOLFSSL_AFALG_HASH) && !defined(WOLFSSL_DEVCRYPTO_HASH)
 static int InitSha256(wc_Sha256* sha256)
 {
@@ -151 +189 @@
 
     #if defined(HAVE_INTEL_AVX1)|| defined(HAVE_INTEL_AVX2)
-      Transform(); Function prototype
+      Transform_Sha256(); Function prototype
     #else
-      Transform() {   }
+      Transform_Sha256() {   }
       int Sha256Final() {
          Save/Recover XMM, YMM
@@ -172 +210 @@
        #define XMM Instructions/inline asm
 
-       int Transform() {
+       int Transform_Sha256() {
            Stitched Message Sched/Round
         }
@@ -180 +218 @@
       #define YMM Instructions/inline asm
 
-      int Transform() {
+      int Transform_Sha256() {
           More granural Stitched Message Sched/Round
       }
@@ -193 +231 @@
 
     /* #if defined(HAVE_INTEL_AVX1/2) at the tail of sha256 */
-    static int Transform(wc_Sha256* sha256);
+    static int Transform_Sha256(wc_Sha256* sha256);
     #if defined(HAVE_INTEL_AVX1)
-        static int Transform_AVX1(wc_Sha256 *sha256);
+        static int Transform_Sha256_AVX1(wc_Sha256 *sha256);
+        static int Transform_Sha256_AVX1_Len(wc_Sha256* sha256, word32 len);
     #endif
     #if defined(HAVE_INTEL_AVX2)
-        static int Transform_AVX2(wc_Sha256 *sha256);
-        static int Transform_AVX1_RORX(wc_Sha256 *sha256);
-    #endif
-    static int (*Transform_p)(wc_Sha256* sha256) /* = _Transform */;
+        static int Transform_Sha256_AVX2(wc_Sha256 *sha256);
+        static int Transform_Sha256_AVX2_Len(wc_Sha256* sha256, word32 len);
+        #ifdef HAVE_INTEL_RORX
+        static int Transform_Sha256_AVX1_RORX(wc_Sha256 *sha256);
+        static int Transform_Sha256_AVX1_RORX_Len(wc_Sha256* sha256, word32 len);
+        static int Transform_Sha256_AVX2_RORX(wc_Sha256 *sha256);
+        static int Transform_Sha256_AVX2_RORX_Len(wc_Sha256* sha256, word32 len);
+    #endif
+    #endif
+    static int (*Transform_Sha256_p)(wc_Sha256* sha256);
+                                                       /* = _Transform_Sha256 */
+    static int (*Transform_Sha256_Len_p)(wc_Sha256* sha256, word32 len);
+                                                                    /* = NULL */
     static int transform_check = 0;
     static word32 intel_flags;
-    #define XTRANSFORM(S, B)  (*Transform_p)((S))
+    #define XTRANSFORM(S)         (*Transform_Sha256_p)((S))
+    #define XTRANSFORM_LEN(S, L)  (*Transform_Sha256_Len_p)((S),(L))
 
     static void Sha256_SetTransform(void)
@@ -214 +263 @@
         intel_flags = cpuid_get_flags();
 
-    #if defined(HAVE_INTEL_AVX2)
-        if (IS_INTEL_AVX2(intel_flags) && IS_INTEL_BMI2(intel_flags)) {
+    #ifdef HAVE_INTEL_AVX2
+        if (IS_INTEL_AVX2(intel_flags)) {
+        #ifdef HAVE_INTEL_RORX
+            if (IS_INTEL_BMI2(intel_flags)) {
+                Transform_Sha256_p = Transform_Sha256_AVX2_RORX;
+                Transform_Sha256_Len_p = Transform_Sha256_AVX2_RORX_Len;
+            }
+            else
+        #endif
             if (1)
-                Transform_p = Transform_AVX1_RORX;
-            else
-                Transform_p = Transform_AVX2;
+            {
+                Transform_Sha256_p = Transform_Sha256_AVX2;
+                Transform_Sha256_Len_p = Transform_Sha256_AVX2_Len;
+            }
+        #ifdef HAVE_INTEL_RORX
+            else {
+                Transform_Sha256_p = Transform_Sha256_AVX1_RORX;
+                Transform_Sha256_Len_p = Transform_Sha256_AVX1_RORX_Len;
+            }
+        #endif
         }
         else
     #endif
-    #if defined(HAVE_INTEL_AVX1)
-        if (1) {
-            Transform_p = ((IS_INTEL_AVX1(intel_flags)) ? Transform_AVX1 :
-                                                                     Transform);
+    #ifdef HAVE_INTEL_AVX1
+        if (IS_INTEL_AVX1(intel_flags)) {
+            Transform_Sha256_p = Transform_Sha256_AVX1;
+            Transform_Sha256_Len_p = Transform_Sha256_AVX1_Len;
         }
         else
     #endif
-            Transform_p = Transform;
+        {
+            Transform_Sha256_p = Transform_Sha256;
+            Transform_Sha256_Len_p = NULL;
+        }
 
         transform_check = 1;
     }
-
-    /* Dummy for saving MM_REGs on behalf of Transform */
-    #if defined(HAVE_INTEL_AVX2) && !defined(HAVE_INTEL_AVX1)
-        #define SAVE_XMM_YMM   __asm__ volatile("or %%r8d, %%r8d":::\
-          "%ymm4","%ymm5","%ymm6","%ymm7","%ymm8","%ymm9","%ymm10","%ymm11","%ymm12","%ymm13","%ymm14","%ymm15")
-    #elif defined(HAVE_INTEL_AVX1)
-        #define SAVE_XMM_YMM   __asm__ volatile("or %%r8d, %%r8d":::\
-            "xmm0","xmm1","xmm2","xmm3","xmm4","xmm5","xmm6","xmm7","xmm8","xmm9","xmm10",\
-            "xmm11","xmm12","xmm13","xmm14","xmm15")
-    #endif
 
     int wc_InitSha256_ex(wc_Sha256* sha256, void* heap, int devId)
@@ -289 +345 @@
     #endif
 
-    #define XTRANSFORM(S, B)  Transform((S), (B))
+    #define XTRANSFORM(S)        Transform_Sha256((S))
+    #define XTRANSFORM_LEN(S,L)  Transform_Sha256_Len((S),(L))
 
     int wc_InitSha256_ex(wc_Sha256* sha256, void* heap, int devId)
@@ -316 +373 @@
     }
 
-    static int Transform(wc_Sha256* sha256, byte* buf)
+    static int Transform_Sha256(wc_Sha256* sha256)
     {
         int ret = wolfSSL_CryptHwMutexLock();
         if (ret == 0) {
     #ifdef FREESCALE_MMCAU_CLASSIC_SHA
-            cau_sha256_hash_n(buf, 1, sha256->digest);
+            cau_sha256_hash_n((byte*)sha256->buffer, 1, sha256->digest);
     #else
-            MMCAU_SHA256_HashN(buf, 1, sha256->digest);
+            MMCAU_SHA256_HashN((byte*)sha256->buffer, 1, sha256->digest);
     #endif
             wolfSSL_CryptHwMutexUnLock();
@@ -333 +390 @@
     #include <wolfssl/wolfcrypt/port/pic32/pic32mz-crypt.h>
 
-#elif defined(STM32_HASH)
-
-    /*
-     * STM32F2/F4/F7 hardware SHA256 support through the HASH_* API's from the
-     * Standard Peripheral Library or CubeMX (See note in README).
-     */
-
-    /* STM32 register size, bytes */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        #define SHA256_REG_SIZE  SHA256_BLOCK_SIZE
-    #else
-        #define SHA256_REG_SIZE  4
-        /* STM32 struct notes:
-         * sha256->buffer  = first 4 bytes used to hold partial block if needed
-         * sha256->buffLen = num bytes currently stored in sha256->buffer
-         * sha256->loLen   = num bytes that have been written to STM32 FIFO
-         */
-    #endif
-    #define SHA256_HW_TIMEOUT 0xFF
+#elif defined(STM32_HASH_SHA2)
+
+    /* Supports CubeMX HAL or Standard Peripheral Library */
 
     int wc_InitSha256_ex(wc_Sha256* sha256, void* heap, int devId)
@@ -358 +399 @@
             return BAD_FUNC_ARG;
 
-        sha256->heap = heap;
-        XMEMSET(sha256->buffer, 0, sizeof(sha256->buffer));
-        sha256->buffLen = 0;
-        sha256->loLen = 0;
-        sha256->hiLen = 0;
-
-        /* initialize HASH peripheral */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        HAL_HASH_DeInit(&sha256->hashHandle);
-        sha256->hashHandle.Init.DataType = HASH_DATATYPE_8B;
-        if (HAL_HASH_Init(&sha256->hashHandle) != HAL_OK) {
-            return ASYNC_INIT_E;
-        }
-        /* reset the hash control register */
-        /* required because Cube MX is not clearing algo bits */
-        HASH->CR &= ~HASH_CR_ALGO;
-    #else
-        HASH_DeInit();
-
-        /* reset the hash control register */
-        HASH->CR &= ~ (HASH_CR_ALGO | HASH_CR_DATATYPE | HASH_CR_MODE);
-
-        /* configure algo used, algo mode, datatype */
-        HASH->CR |= (HASH_AlgoSelection_SHA256 | HASH_AlgoMode_HASH
-                   | HASH_DataType_8b);
-
-        /* reset HASH processor */
-        HASH->CR |= HASH_CR_INIT;
-    #endif
-
+        (void)devId;
+        (void)heap;
+
+        wc_Stm32_Hash_Init(&sha256->stmCtx);
         return 0;
     }
@@ -394 +409 @@
     {
         int ret = 0;
-        byte* local;
 
         if (sha256 == NULL || (data == NULL && len > 0)) {
@@ -400 +414 @@
         }
 
-        /* do block size increments */
-        local = (byte*)sha256->buffer;
-
-        /* check that internal buffLen is valid */
-        if (sha256->buffLen >= SHA256_REG_SIZE)
-            return BUFFER_E;
-
-        while (len) {
-            word32 add = min(len, SHA256_REG_SIZE - sha256->buffLen);
-            XMEMCPY(&local[sha256->buffLen], data, add);
-
-            sha256->buffLen += add;
-            data            += add;
-            len             -= add;
-
-            if (sha256->buffLen == SHA256_REG_SIZE) {
-            #ifdef WOLFSSL_STM32_CUBEMX
-                if (HAL_HASHEx_SHA256_Accumulate(
-                        &sha256->hashHandle, local, SHA256_REG_SIZE) != HAL_OK) {
-                    ret = ASYNC_OP_E;
-                }
-            #else
-                HASH_DataIn(*(uint32_t*)local);
-            #endif
-
-                AddLength(sha256, SHA256_REG_SIZE);
-                sha256->buffLen = 0;
-            }
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Update(&sha256->stmCtx,
+                HASH_AlgoSelection_SHA256, data, len);
+            wolfSSL_CryptHwMutexUnLock();
         }
         return ret;
@@ -436 +427 @@
         int ret = 0;
 
-        if (sha256 == NULL || hash == NULL)
+        if (sha256 == NULL || hash == NULL) {
             return BAD_FUNC_ARG;
-
-    #ifdef WOLFSSL_STM32_CUBEMX
-        if (HAL_HASHEx_SHA256_Start(&sha256->hashHandle,
-                (byte*)sha256->buffer, sha256->buffLen,
-                (byte*)sha256->digest, SHA256_HW_TIMEOUT) != HAL_OK) {
-            ret = ASYNC_OP_E;
-        }
-    #else
-        __IO uint16_t nbvalidbitsdata = 0;
-
-        /* finish reading any trailing bytes into FIFO */
-        if (sha256->buffLen > 0) {
-            HASH_DataIn(*(uint32_t*)sha256->buffer);
-            AddLength(sha256, sha256->buffLen);
-        }
-
-        /* calculate number of valid bits in last word of input data */
-        nbvalidbitsdata = 8 * (sha256->loLen % SHA256_REG_SIZE);
-
-        /* configure number of valid bits in last word of the data */
-        HASH_SetLastWordValidBitsNbr(nbvalidbitsdata);
-
-        /* start HASH processor */
-        HASH_StartDigest();
-
-        /* wait until Busy flag == RESET */
-        while (HASH_GetFlagStatus(HASH_FLAG_BUSY) != RESET) {}
-
-        /* read message digest */
-        sha256->digest[0] = HASH->HR[0];
-        sha256->digest[1] = HASH->HR[1];
-        sha256->digest[2] = HASH->HR[2];
-        sha256->digest[3] = HASH->HR[3];
-        sha256->digest[4] = HASH->HR[4];
-        sha256->digest[5] = HASH_DIGEST->HR[5];
-        sha256->digest[6] = HASH_DIGEST->HR[6];
-        sha256->digest[7] = HASH_DIGEST->HR[7];
-
-        ByteReverseWords(sha256->digest, sha256->digest, SHA256_DIGEST_SIZE);
-    #endif /* WOLFSSL_STM32_CUBEMX */
-
-        XMEMCPY(hash, sha256->digest, SHA256_DIGEST_SIZE);
-
-        (void)wc_InitSha256_ex(sha256, sha256->heap, INVALID_DEVID);
+        }
+
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Final(&sha256->stmCtx,
+                HASH_AlgoSelection_SHA256, hash, WC_SHA256_DIGEST_SIZE);
+            wolfSSL_CryptHwMutexUnLock();
+        }
+
+        (void)wc_InitSha256(sha256); /* reset state */
 
         return ret;
     }
+
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* functions defined in wolfcrypt/src/port/caam/caam_sha256.c */
+
+#elif defined(WOLFSSL_AFALG_HASH)
+    /* implemented in wolfcrypt/src/port/af_alg/afalg_hash.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_HASH)
+    /* implemented in wolfcrypt/src/port/devcrypto/devcrypt_hash.c */
 
 #else
@@ -500 +466 @@
         if (ret != 0)
             return ret;
+
+    #ifdef WOLFSSL_SMALL_STACK_CACHE
+        sha256->W = NULL;
+    #endif
 
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA256)
@@ -511 +481 @@
     }
 #endif /* End Hardware Acceleration */
-
-#ifndef SAVE_XMM_YMM
-    #define SAVE_XMM_YMM
-#endif
 
 #ifdef NEED_SOFT_SHA256
@@ -544 +510 @@
     #define Gamma1(x)       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
 
-    #define RND(a,b,c,d,e,f,g,h,i) \
-         t0 = (h) + Sigma1((e)) + Ch((e), (f), (g)) + K[(i)] + W[(i)]; \
-         t1 = Sigma0((a)) + Maj((a), (b), (c)); \
-         (d) += t0; \
-         (h)  = t0 + t1;
+    #define a(i) S[(0-i) & 7]
+    #define b(i) S[(1-i) & 7]
+    #define c(i) S[(2-i) & 7]
+    #define d(i) S[(3-i) & 7]
+    #define e(i) S[(4-i) & 7]
+    #define f(i) S[(5-i) & 7]
+    #define g(i) S[(6-i) & 7]
+    #define h(i) S[(7-i) & 7]
+
+    #define RND(j) \
+         t0 = h(j) + Sigma1(e(j)) + Ch(e(j), f(j), g(j)) + K[i+j] + W[i+j]; \
+         t1 = Sigma0(a(j)) + Maj(a(j), b(j), c(j)); \
+         d(j) += t0; \
+         h(j)  = t0 + t1
 
     #ifndef XTRANSFORM
-         #define XTRANSFORM(S, B) Transform((S))
+         #define XTRANSFORM(S)        Transform_Sha256((S))
+         #define XTRANSFORM_LEN(S,L)  Transform_Sha256_Len((S),(L))
      #endif
 
-    static int Transform(wc_Sha256* sha256)
+    static int Transform_Sha256(wc_Sha256* sha256)
     {
         word32 S[8], t0, t1;
         int i;
 
-    #ifdef WOLFSSL_SMALL_STACK
+    #ifdef WOLFSSL_SMALL_STACK_CACHE
+        word32* W = sha256->W;
+        if (W == NULL) {
+            W = (word32*)XMALLOC(sizeof(word32) * WC_SHA256_BLOCK_SIZE, NULL,
+                                                           DYNAMIC_TYPE_DIGEST);
+            if (W == NULL)
+                return MEMORY_E;
+            sha256->W = W;
+        }
+    #elif defined(WOLFSSL_SMALL_STACK)
         word32* W;
-
         W = (word32*)XMALLOC(sizeof(word32) * WC_SHA256_BLOCK_SIZE, NULL,
             DYNAMIC_TYPE_TMP_BUFFER);
@@ -580 +564 @@
             W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15]) + W[i-16];
 
+    #ifdef USE_SLOW_SHA256
+        /* not unrolled - ~2k smaller and ~25% slower */
         for (i = 0; i < WC_SHA256_BLOCK_SIZE; i += 8) {
-            RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i+0);
-            RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],i+1);
-            RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],i+2);
-            RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],i+3);
-            RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],i+4);
-            RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],i+5);
-            RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],i+6);
-            RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],i+7);
-        }
+            int j;
+            for (j = 0; j < 8; j++) { /* braces needed here for macros {} */
+                RND(j);
+            }
+        }
+    #else
+        /* partially loop unrolled */
+        for (i = 0; i < WC_SHA256_BLOCK_SIZE; i += 8) {
+            RND(0); RND(1); RND(2); RND(3);
+            RND(4); RND(5); RND(6); RND(7);
+        }
+    #endif /* USE_SLOW_SHA256 */
 
         /* Add the working vars back into digest state[] */
@@ -596 +585 @@
         }
 
-    #ifdef WOLFSSL_SMALL_STACK
+    #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_SMALL_STACK_CACHE)
         XFREE(W, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     #endif
-
         return 0;
     }
@@ -606 +594 @@
 
 
-#if defined(XTRANSFORM) || defined(STM32_HASH)
-static INLINE void AddLength(wc_Sha256* sha256, word32 len)
+#ifdef XTRANSFORM
+
+    static WC_INLINE void AddLength(wc_Sha256* sha256, word32 len)
 {
     word32 tmp = sha256->loLen;
@@ -613 +602 @@
         sha256->hiLen++;                       /* carry low to high */
 }
-#endif
-
-
-#ifdef XTRANSFORM
-
-    static INLINE int Sha256Update(wc_Sha256* sha256, const byte* data, word32 len)
+
+    static WC_INLINE int Sha256Update(wc_Sha256* sha256, const byte* data, word32 len)
     {
         int ret = 0;
@@ -625 +610 @@
         if (sha256 == NULL || (data == NULL && len > 0)) {
             return BAD_FUNC_ARG;
+        }
+
+        if (data == NULL && len == 0) {
+            /* valid, but do nothing */
+            return 0;
         }
 
@@ -642 +632 @@
             return BUFFER_E;
 
-        SAVE_XMM_YMM; /* for Intel AVX */
-
-        while (len) {
+        if (sha256->buffLen > 0) {
             word32 add = min(len, WC_SHA256_BLOCK_SIZE - sha256->buffLen);
             XMEMCPY(&local[sha256->buffLen], data, add);
@@ -662 +650 @@
                 }
         #endif
-                ret = XTRANSFORM(sha256, local);
-                if (ret != 0) {
+                ret = XTRANSFORM(sha256);
+                if (ret == 0) {
+                    AddLength(sha256, WC_SHA256_BLOCK_SIZE);
+                    sha256->buffLen = 0;
+                }
+                else
+                    len = 0;
+            }
+        }
+
+    #if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+        if (Transform_Sha256_Len_p != NULL) {
+            word32 blocksLen = len & ~(WC_SHA256_BLOCK_SIZE-1);
+
+            if (blocksLen > 0) {
+                AddLength(sha256, blocksLen);
+                sha256->data = data;
+                /* Byte reversal performed in function if required. */
+                XTRANSFORM_LEN(sha256, blocksLen);
+                data += blocksLen;
+                len  -= blocksLen;
+            }
+        }
+        else
+    #endif
+    #if !defined(LITTLE_ENDIAN_ORDER) || defined(FREESCALE_MMCAU_SHA) || \
+                            defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+        {
+            word32 blocksLen = len & ~(WC_SHA256_BLOCK_SIZE-1);
+
+            AddLength(sha256, blocksLen);
+            while (len >= WC_SHA256_BLOCK_SIZE) {
+                XMEMCPY(local, data, WC_SHA256_BLOCK_SIZE);
+
+                data += WC_SHA256_BLOCK_SIZE;
+                len  -= WC_SHA256_BLOCK_SIZE;
+
+                /* Byte reversal performed in function if required. */
+                ret = XTRANSFORM(sha256);
+                if (ret != 0)
                     break;
                 }
-
-                AddLength(sha256, WC_SHA256_BLOCK_SIZE);
-                sha256->buffLen = 0;
+        }
+    #else
+        {
+            word32 blocksLen = len & ~(WC_SHA256_BLOCK_SIZE-1);
+
+            AddLength(sha256, blocksLen);
+            while (len >= WC_SHA256_BLOCK_SIZE) {
+                XMEMCPY(local, data, WC_SHA256_BLOCK_SIZE);
+
+                data += WC_SHA256_BLOCK_SIZE;
+                len  -= WC_SHA256_BLOCK_SIZE;
+
+                ByteReverseWords(sha256->buffer, sha256->buffer,
+                                                          WC_SHA256_BLOCK_SIZE);
+                ret = XTRANSFORM(sha256);
+                if (ret != 0)
+                    break;
             }
+            }
+    #endif
+
+        if (len > 0) {
+            XMEMCPY(local, data, len);
+            sha256->buffLen = len;
         }
 
@@ -680 +726 @@
     }
 
-    static INLINE int Sha256Final(wc_Sha256* sha256)
+    static WC_INLINE int Sha256Final(wc_Sha256* sha256)
     {
 
@@ -689 +735 @@
             return BAD_FUNC_ARG;
         }
-
-        SAVE_XMM_YMM; /* for Intel AVX */
 
         AddLength(sha256, sha256->buffLen);  /* before adding pads */
@@ -713 +757 @@
             }
 
-            ret = XTRANSFORM(sha256, local);
+            ret = XTRANSFORM(sha256);
             if (ret != 0)
                 return ret;
@@ -755 +799 @@
     #endif
 
-        return XTRANSFORM(sha256, local);
+        return XTRANSFORM(sha256);
+    }
+
+    int wc_Sha256FinalRaw(wc_Sha256* sha256, byte* hash)
+    {
+    #ifdef LITTLE_ENDIAN_ORDER
+        word32 digest[WC_SHA256_DIGEST_SIZE / sizeof(word32)];
+    #endif
+
+        if (sha256 == NULL || hash == NULL) {
+            return BAD_FUNC_ARG;
+        }
+
+    #ifdef LITTLE_ENDIAN_ORDER
+        ByteReverseWords((word32*)digest, (word32*)sha256->digest,
+                                                         WC_SHA256_DIGEST_SIZE);
+        XMEMCPY(hash, digest, WC_SHA256_DIGEST_SIZE);
+    #else
+        XMEMCPY(hash, sha256->digest, WC_SHA256_DIGEST_SIZE);
+    #endif
+
+        return 0;
     }
 
@@ -792 +857 @@
 #if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
 
-#define _DigestToReg(S0, S1, S2, S3, S4, S5, S6, S7) \
-    "leaq       %[digest], %%r8\n\t"                 \
-    "movl         (%%r8), %"#S0"\n\t"                \
-    "movl        4(%%r8), %"#S1"\n\t"                \
-    "movl        8(%%r8), %"#S2"\n\t"                \
-    "movl       12(%%r8), %"#S3"\n\t"                \
-    "movl       16(%%r8), %"#S4"\n\t"                \
-    "movl       20(%%r8), %"#S5"\n\t"                \
-    "movl       24(%%r8), %"#S6"\n\t"                \
-    "movl       28(%%r8), %"#S7"\n\t"
-
-#define _RegToDigest(S0, S1, S2, S3, S4, S5, S6, S7) \
-    "leaq       %[digest], %%r8\n\t"                 \
-    "addl %"#S0",   (%%r8)\n\t"                      \
-    "addl %"#S1",  4(%%r8)\n\t"                      \
-    "addl %"#S2",  8(%%r8)\n\t"                      \
-    "addl %"#S3", 12(%%r8)\n\t"                      \
-    "addl %"#S4", 16(%%r8)\n\t"                      \
-    "addl %"#S5", 20(%%r8)\n\t"                      \
-    "addl %"#S6", 24(%%r8)\n\t"                      \
-    "addl %"#S7", 28(%%r8)\n\t"
-
-#define DigestToReg(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-    _DigestToReg(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )
-
-#define RegToDigest(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-    _RegToDigest(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )
-
-
-#define S_0 %r15d
-#define S_1 %r10d
-#define S_2 %r11d
-#define S_3 %r12d
-#define S_4 %r13d
-#define S_5 %r14d
-#define S_6 %ebx
-#define S_7 %r9d
-
-#define SSE_REGs "%edi", "%esi", "%edx", "%ebx","%r8","%r9","%r10","%r11","%r12","%r13","%r14","%r15"
+#define _LOAD_DIGEST()                     \
+    "movl         (%[sha256]), %%r8d \n\t" \
+    "movl        4(%[sha256]), %%r9d \n\t" \
+    "movl        8(%[sha256]), %%r10d\n\t" \
+    "movl       12(%[sha256]), %%r11d\n\t" \
+    "movl       16(%[sha256]), %%r12d\n\t" \
+    "movl       20(%[sha256]), %%r13d\n\t" \
+    "movl       24(%[sha256]), %%r14d\n\t" \
+    "movl       28(%[sha256]), %%r15d\n\t"
+
+#define _STORE_ADD_DIGEST()                \
+    "addl       %%r8d ,   (%[sha256])\n\t" \
+    "addl       %%r9d ,  4(%[sha256])\n\t" \
+    "addl       %%r10d,  8(%[sha256])\n\t" \
+    "addl       %%r11d, 12(%[sha256])\n\t" \
+    "addl       %%r12d, 16(%[sha256])\n\t" \
+    "addl       %%r13d, 20(%[sha256])\n\t" \
+    "addl       %%r14d, 24(%[sha256])\n\t" \
+    "addl       %%r15d, 28(%[sha256])\n\t"
+
+#define _ADD_DIGEST()                      \
+    "addl         (%[sha256]), %%r8d \n\t" \
+    "addl        4(%[sha256]), %%r9d \n\t" \
+    "addl        8(%[sha256]), %%r10d\n\t" \
+    "addl       12(%[sha256]), %%r11d\n\t" \
+    "addl       16(%[sha256]), %%r12d\n\t" \
+    "addl       20(%[sha256]), %%r13d\n\t" \
+    "addl       24(%[sha256]), %%r14d\n\t" \
+    "addl       28(%[sha256]), %%r15d\n\t"
+
+#define _STORE_DIGEST()                    \
+    "movl       %%r8d ,   (%[sha256])\n\t" \
+    "movl       %%r9d ,  4(%[sha256])\n\t" \
+    "movl       %%r10d,  8(%[sha256])\n\t" \
+    "movl       %%r11d, 12(%[sha256])\n\t" \
+    "movl       %%r12d, 16(%[sha256])\n\t" \
+    "movl       %%r13d, 20(%[sha256])\n\t" \
+    "movl       %%r14d, 24(%[sha256])\n\t" \
+    "movl       %%r15d, 28(%[sha256])\n\t"
+
+#define LOAD_DIGEST() \
+    _LOAD_DIGEST()
+
+#define STORE_ADD_DIGEST() \
+    _STORE_ADD_DIGEST()
+
+#define ADD_DIGEST() \
+    _ADD_DIGEST()
+
+#define STORE_DIGEST() \
+    _STORE_DIGEST()
+
+
+#define S_0 %r8d
+#define S_1 %r9d
+#define S_2 %r10d
+#define S_3 %r11d
+#define S_4 %r12d
+#define S_5 %r13d
+#define S_6 %r14d
+#define S_7 %r15d
+
+#define L1  "%%edx"
+#define L2  "%%ecx"
+#define L3  "%%eax"
+#define L4  "%%ebx"
+#define WK  "%%rsp"
+
+#define WORK_REGS  "eax", "ebx", "ecx", "edx"
+#define STATE_REGS "r8","r9","r10","r11","r12","r13","r14","r15"
+#define XMM_REGS   "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6",    \
+                   "xmm7", "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13"
 
 #if defined(HAVE_INTEL_RORX)
-#define RND_STEP_RORX_1(a,b,c,d,e,f,g,h,i) \
-    "# edx = e>>>6\n\t"                    \
-    "rorx       $6, %"#e", %%edx\n\t"
-
-#define RND_STEP_RORX_2(a,b,c,d,e,f,g,h,i) \
-    "# edi = e>>>11\n\t"                   \
-    "rorx       $11, %"#e",%%edi\n\t"      \
-    "# edi = (e>>11) ^ (e>>6)\n\t"         \
-    "xorl       %%edx, %%edi\n\t"          \
-    "# edx = e>>>25\n\t"                   \
-    "rorx       $25, %"#e", %%edx\n\t"
-
-#define RND_STEP_RORX_3(a,b,c,d,e,f,g,h,i) \
-    "# esi = f\n\t"                        \
-    "movl       %"#f", %%esi\n\t"          \
-    "# esi = f ^ g\n\t"                    \
-    "xorl       %"#g", %%esi\n\t"          \
-    "# edx = Sigma1(e)\n\t"                \
-    "xorl       %%edi, %%edx\n\t"          \
-    "# esi = (f ^ g) & e\n\t"              \
-    "andl       %"#e", %%esi\n\t"          \
-    "# esi = Ch(e,f,g)\n\t"                \
-    "xorl       %"#g", %%esi\n\t"
-
-#define RND_STEP_RORX_4(a,b,c,d,e,f,g,h,i) \
-    "# h += w_k\n\t"                       \
-    "leaq       %[W_K], %%r8\n\t"          \
-    "addl       ("#i")*4(%%r8), %"#h"\n\t" \
-    "# h = h + w_k + Sigma1(e)\n\t"        \
-    "addl       %%edx, %"#h"\n\t"          \
-    "# r8d = a>>>2\n\t"                    \
-    "rorx       $2, %"#a", %%r8d\n\t"      \
-    "# edi = a>>>13\n\t"                   \
-    "rorx       $13, %"#a", %%edi\n\t"
-
-#define RND_STEP_RORX_5(a,b,c,d,e,f,g,h,i) \
-    "# edx = a>>22\n\t"                    \
-    "rorx       $22, %"#a", %%edx\n\t"     \
-    "# edi = (a>>>2) ^ (a>>>13)\n\t"       \
-    "xorl       %%r8d, %%edi\n\t"          \
-    "# edx = Sigma0(a)\n\t"                \
-    "xorl       %%edi, %%edx\n\t"
-
-#define RND_STEP_RORX_6(a,b,c,d,e,f,g,h,i) \
-    "# edi = b\n\t"                        \
-    "movl       %"#b", %%edi\n\t"          \
-    "# edi = a | b\n\t"                    \
-    "orl        %"#a", %%edi\n\t"          \
-    "# edi = (a | b) & c\n\t"              \
-    "andl       %"#c", %%edi\n\t"          \
-    "# r8d = b\n\t"                        \
-    "movl       %"#b", %%r8d\n\t"
-
-#define RND_STEP_RORX_7(a,b,c,d,e,f,g,h,i) \
-    "# h += Ch(e,f,g)\n\t"                 \
-    "addl       %%esi, %"#h"\n\t"          \
-    "# r8d = b & a\n\t"                    \
-    "andl       %"#a", %%r8d\n\t"          \
-    "# r8d = Maj(a,b,c)\n\t"               \
-    "orl        %%edi, %%r8d\n\t"
-
-#define RND_STEP_RORX_8(a,b,c,d,e,f,g,h,i)       \
-    "# d += h + w_k + Sigma1(e) + Ch(e,f,g)\n\t" \
+#define RND_STEP_RORX_0_1(a, b, c, d, e, f, g, h, i) \
+    /* L3 = f */                                     \
+    "movl       %" #f ", " L3 "\n\t"                 \
+    /* L2 = e>>>11 */                                \
+    "rorx       $11, %" #e ", " L2 "\n\t"            \
+    /* h += w_k */                                   \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"     \
+
+#define RND_STEP_RORX_0_2(a, b, c, d, e, f, g, h, i) \
+    /* L2 = (e>>>6) ^ (e>>>11) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L3 = f ^ g */                                 \
+    "xorl       %" #g ", " L3 "\n\t"                 \
+    /* L1 = e>>>25 */                                \
+    "rorx       $25, %" #e ", " L1 "\n\t"            \
+
+#define RND_STEP_RORX_0_3(a, b, c, d, e, f, g, h, i) \
+    /* L3 = (f ^ g) & e */                           \
+    "andl       %" #e ", " L3 "\n\t"                 \
+    /* L1 = Sigma1(e) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L2 = a>>>13 */                                \
+    "rorx       $13, %" #a ", " L2 "\n\t"            \
+
+#define RND_STEP_RORX_0_4(a, b, c, d, e, f, g, h, i) \
+    /* h += Sigma1(e) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L1 = a>>>2 */                                 \
+    "rorx       $2, %" #a ", " L1 "\n\t"             \
+    /* L3 = Ch(e,f,g) */                             \
+    "xorl       %" #g ", " L3 "\n\t"                 \
+
+#define RND_STEP_RORX_0_5(a, b, c, d, e, f, g, h, i) \
+    /* L2 = (a>>>2) ^ (a>>>13) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L1 = a>>>22 */                                \
+    "rorx       $22, %" #a ", " L1 "\n\t"            \
+    /* h += Ch(e,f,g) */                             \
+    "addl       " L3 ", %" #h "\n\t"                 \
+
+#define RND_STEP_RORX_0_6(a, b, c, d, e, f, g, h, i) \
+    /* L1 = Sigma0(a) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L3 = b */                                     \
+    "movl       %" #b ", " L3 "\n\t"                 \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */       \
+    "addl       %" #h ", %" #d "\n\t"                \
+
+#define RND_STEP_RORX_0_7(a, b, c, d, e, f, g, h, i) \
+    /* L3 = a ^ b */                                 \
+    "xorl       %" #a ", " L3 "\n\t"                 \
+    /* h += Sigma0(a) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L4 = (a ^ b) & (b ^ c) */                     \
+    "andl       " L3 ", " L4 "\n\t"                  \
+
+#define RND_STEP_RORX_0_8(a, b, c, d, e, f, g, h, i) \
+    /* L4 = Maj(a,b,c) */                            \
+    "xorl       %" #b ", " L4 "\n\t"                 \
+    /* L1 = d>>>6 (= e>>>6 next RND) */              \
+    "rorx       $6, %" #d ", " L1 "\n\t"             \
+    /* h += Maj(a,b,c) */                            \
+    "addl       " L4 ", %" #h "\n\t"                 \
+
+#define RND_STEP_RORX_1_1(a, b, c, d, e, f, g, h, i) \
+    /* L4 = f */                                     \
+    "movl       %" #f ", " L4 "\n\t"                 \
+    /* L2 = e>>>11 */                                \
+    "rorx       $11, %" #e ", " L2 "\n\t"            \
+    /* h += w_k */                                   \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"     \
+
+#define RND_STEP_RORX_1_2(a, b, c, d, e, f, g, h, i) \
+    /* L2 = (e>>>6) ^ (e>>>11) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L4 = f ^ g */                                 \
+    "xorl       %" #g ", " L4 "\n\t"                 \
+    /* L1 = e>>>25 */                                \
+    "rorx       $25, %" #e ", " L1 "\n\t"            \
+
+#define RND_STEP_RORX_1_3(a, b, c, d, e, f, g, h, i) \
+    /* L4 = (f ^ g) & e */                           \
+    "andl       %" #e ", " L4 "\n\t"                 \
+    /* L1 = Sigma1(e) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L2 = a>>>13 */                                \
+    "rorx       $13, %" #a ", " L2 "\n\t"            \
+
+#define RND_STEP_RORX_1_4(a, b, c, d, e, f, g, h, i) \
+    /* h += Sigma1(e) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L1 = a>>>2 */                                 \
+    "rorx       $2, %" #a ", " L1 "\n\t"             \
+    /* L4 = Ch(e,f,g) */                             \
+    "xorl       %" #g ", " L4 "\n\t"                 \
+
+#define RND_STEP_RORX_1_5(a, b, c, d, e, f, g, h, i) \
+    /* L2 = (a>>>2) ^ (a>>>13) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L1 = a>>>22 */                                \
+    "rorx       $22, %" #a ", " L1 "\n\t"            \
+    /* h += Ch(e,f,g) */                             \
+    "addl       " L4 ", %" #h "\n\t"                 \
+
+#define RND_STEP_RORX_1_6(a, b, c, d, e, f, g, h, i) \
+    /* L1 = Sigma0(a) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L4 = b */                                     \
+    "movl       %" #b ", " L4 "\n\t"                 \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */       \
     "addl       %"#h", %"#d"\n\t"                \
-    "addl       %"#h", %%r8d\n\t"                \
-    "addl       %%edx, %%r8d\n\t"                \
-    "movl       %%r8d, %"#h"\n\t"
+
+#define RND_STEP_RORX_1_7(a, b, c, d, e, f, g, h, i) \
+    /* L4 = a ^ b */                                 \
+    "xorl       %" #a ", " L4 "\n\t"                 \
+    /* h += Sigma0(a) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L3 = (a ^ b) & (b ^ c) */                     \
+    "andl       " L4 ", " L3 "\n\t"                  \
+
+#define RND_STEP_RORX_1_8(a, b, c, d, e, f, g, h, i) \
+    /* L3 = Maj(a,b,c) */                            \
+    "xorl       %" #b ", " L3 "\n\t"                 \
+    /* L1 = d>>>6 (= e>>>6 next RND) */              \
+    "rorx       $6, %" #d ", " L1 "\n\t"             \
+    /* h += Maj(a,b,c) */                            \
+    "addl       " L3 ", %" #h "\n\t"                 \
+
+#define _RND_RORX_X_0(a, b, c, d, e, f, g, h, i)     \
+    /* L1 = e>>>6 */                                 \
+    "rorx       $6, %" #e ", " L1 "\n\t"             \
+    /* L2 = e>>>11 */                                \
+    "rorx       $11, %" #e ", " L2 "\n\t"            \
+    /* Prev RND: h += Maj(a,b,c) */                  \
+    "addl       " L3 ", %" #a "\n\t"                 \
+    /* h += w_k */                                   \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"     \
+    /* L3 = f */                                     \
+    "movl       %" #f ", " L3 "\n\t"                 \
+    /* L2 = (e>>>6) ^ (e>>>11) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L3 = f ^ g */                                 \
+    "xorl       %" #g ", " L3 "\n\t"                 \
+    /* L1 = e>>>25 */                                \
+    "rorx       $25, %" #e ", " L1 "\n\t"            \
+    /* L1 = Sigma1(e) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L3 = (f ^ g) & e */                           \
+    "andl       %" #e ", " L3 "\n\t"                 \
+    /* h += Sigma1(e) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L1 = a>>>2 */                                 \
+    "rorx       $2, %" #a ", " L1 "\n\t"             \
+    /* L2 = a>>>13 */                                \
+    "rorx       $13, %" #a ", " L2 "\n\t"            \
+    /* L3 = Ch(e,f,g) */                             \
+    "xorl       %" #g ", " L3 "\n\t"                 \
+    /* L2 = (a>>>2) ^ (a>>>13) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L1 = a>>>22 */                                \
+    "rorx       $22, %" #a ", " L1 "\n\t"            \
+    /* h += Ch(e,f,g) */                             \
+    "addl       " L3 ", %" #h "\n\t"                 \
+    /* L1 = Sigma0(a) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L3 = b */                                     \
+    "movl       %" #b ", " L3 "\n\t"                 \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */       \
+    "addl       %" #h ", %" #d "\n\t"                \
+    /* L3 = a ^ b */                                 \
+    "xorl       %" #a ", " L3 "\n\t"                 \
+    /* L4 = (a ^ b) & (b ^ c) */                     \
+    "andl       " L3 ", " L4 "\n\t"                  \
+    /* h += Sigma0(a) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L4 = Maj(a,b,c) */                            \
+    "xorl       %" #b ", " L4 "\n\t"                 \
+
+#define _RND_RORX_X_1(a, b, c, d, e, f, g, h, i)     \
+    /* L1 = e>>>6 */                                 \
+    "rorx       $6, %" #e ", " L1 "\n\t"             \
+    /* L2 = e>>>11 */                                \
+    "rorx       $11, %" #e ", " L2 "\n\t"            \
+    /* Prev RND: h += Maj(a,b,c) */                  \
+    "addl       " L4 ", %" #a "\n\t"                 \
+    /* h += w_k */                                   \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"     \
+    /* L4 = f */                                     \
+    "movl       %" #f ", " L4 "\n\t"                 \
+    /* L2 = (e>>>6) ^ (e>>>11) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L4 = f ^ g */                                 \
+    "xorl       %" #g ", " L4 "\n\t"                 \
+    /* L1 = e>>>25 */                                \
+    "rorx       $25, %" #e ", " L1 "\n\t"            \
+    /* L1 = Sigma1(e) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L4 = (f ^ g) & e */                           \
+    "andl       %" #e ", " L4 "\n\t"                 \
+    /* h += Sigma1(e) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L1 = a>>>2 */                                 \
+    "rorx       $2, %" #a ", " L1 "\n\t"             \
+    /* L2 = a>>>13 */                                \
+    "rorx       $13, %" #a ", " L2 "\n\t"            \
+    /* L4 = Ch(e,f,g) */                             \
+    "xorl       %" #g ", " L4 "\n\t"                 \
+    /* L2 = (a>>>2) ^ (a>>>13) */                    \
+    "xorl       " L1 ", " L2 "\n\t"                  \
+    /* L1 = a>>>22 */                                \
+    "rorx       $22, %" #a ", " L1 "\n\t"            \
+    /* h += Ch(e,f,g) */                             \
+    "addl       " L4 ", %" #h "\n\t"                 \
+    /* L1 = Sigma0(a) */                             \
+    "xorl       " L2 ", " L1 "\n\t"                  \
+    /* L4 = b */                                     \
+    "movl       %" #b ", " L4 "\n\t"                 \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */       \
+    "addl       %" #h ", %" #d "\n\t"                \
+    /* L4 = a ^ b */                                 \
+    "xorl       %" #a ", " L4 "\n\t"                 \
+    /* L2 = (a ^ b) & (b ^ c) */                     \
+    "andl       " L4 ", " L3 "\n\t"                  \
+    /* h += Sigma0(a) */                             \
+    "addl       " L1 ", %" #h "\n\t"                 \
+    /* L3 = Maj(a,b,c) */                            \
+    "xorl       %" #b ", " L3 "\n\t"                 \
+
+
+#define RND_RORX_X_0(a,b,c,d,e,f,g,h,i) \
+       _RND_RORX_X_0(a,b,c,d,e,f,g,h,i)
+#define RND_RORX_X_1(a,b,c,d,e,f,g,h,i) \
+       _RND_RORX_X_1(a,b,c,d,e,f,g,h,i)
+
+#define RND_RORX_X4(a,b,c,d,e,f,g,h,i)    \
+        RND_RORX_X_0(a,b,c,d,e,f,g,h,i+0) \
+        RND_RORX_X_1(h,a,b,c,d,e,f,g,i+1) \
+        RND_RORX_X_0(g,h,a,b,c,d,e,f,i+2) \
+        RND_RORX_X_1(f,g,h,a,b,c,d,e,i+3)
+
 #endif /* HAVE_INTEL_RORX */
 
-#define RND_STEP_1(a,b,c,d,e,f,g,h,i) \
-    "movl       %"#e", %%edx\n\t"     \
-    "# edx = e>>>6\n\t"               \
-    "roll       $26, %%edx\n\t"       \
-    "movl       %"#e", %%edi\n\t"
-
-#define RND_STEP_2(a,b,c,d,e,f,g,h,i) \
-    "# edi = e>>>11\n\t"              \
-    "roll       $21, %%edi\n\t"       \
-    "# edi = (e>>11) ^ (e>>6)\n\t"    \
-    "xorl       %%edx, %%edi\n\t"     \
-    "# edx = e\n\t"                   \
-    "movl       %"#e", %%edx\n\t"     \
-    "# edx = e>>>25\n\t"              \
-    "roll       $7, %%edx\n\t"
-
-#define RND_STEP_3(a,b,c,d,e,f,g,h,i) \
-    "# esi = f\n\t"                   \
-    "movl       %"#f", %%esi\n\t"     \
-    "# esi = f ^ g\n\t"               \
-    "xorl       %"#g", %%esi\n\t"     \
-    "# edx = Sigma1(e)\n\t"           \
-    "xorl       %%edi, %%edx\n\t"     \
-    "# esi = (f ^ g) & e\n\t"         \
-    "andl       %"#e", %%esi\n\t"     \
-    "# esi = Ch(e,f,g)\n\t"           \
-    "xorl       %"#g", %%esi\n\t"
-
-#define RND_STEP_4(a,b,c,d,e,f,g,h,i)      \
-    "# h += w_k\n\t"                       \
-    "leaq       %[W_K], %%r8\n\t"          \
-    "addl       ("#i")*4(%%r8), %"#h"\n\t" \
-    "# h = h + w_k + Sigma1(e)\n\t"        \
-    "addl       %%edx, %"#h"\n\t"          \
-    "# r8d = a\n\t"                        \
-    "movl       %"#a", %%r8d\n\t"          \
-    "# r8d = a>>>2\n\t"                    \
-    "roll       $30, %%r8d\n\t"            \
-    "# edi = a\n\t"                        \
-    "movl       %"#a", %%edi\n\t"          \
-    "# edi = a>>>13\n\t"                   \
-    "roll       $19, %%edi\n\t"            \
-    "# edx = a\n\t"                        \
-    "movl       %"#a", %%edx\n\t"
-
-#define RND_STEP_5(a,b,c,d,e,f,g,h,i) \
-    "# edx = a>>>22\n\t"              \
-    "roll       $10, %%edx\n\t"       \
-    "# edi = (a>>>2) ^ (a>>>13)\n\t"  \
-    "xorl       %%r8d, %%edi\n\t"     \
-    "# edx = Sigma0(a)\n\t"           \
-    "xorl       %%edi, %%edx\n\t"
-
-#define RND_STEP_6(a,b,c,d,e,f,g,h,i) \
-    "# edi = b\n\t"                   \
-    "movl       %"#b", %%edi\n\t"     \
-    "# edi = a | b\n\t"               \
-    "orl        %"#a", %%edi\n\t"     \
-    "# edi = (a | b) & c\n\t"         \
-    "andl       %"#c", %%edi\n\t"     \
-    "# r8d = b\n\t"                   \
-    "movl       %"#b", %%r8d\n\t"
-
-#define RND_STEP_7(a,b,c,d,e,f,g,h,i) \
-    "# h += Ch(e,f,g)\n\t"            \
-    "addl       %%esi, %"#h"\n\t"     \
-    "#r8d = b & a\n\t"                \
-    "andl       %"#a", %%r8d\n\t"     \
-    "# r8d = Maj(a,b,c)\n\t"          \
-    "orl        %%edi, %%r8d\n\t"
-
-#define RND_STEP_8(a,b,c,d,e,f,g,h,i)                                    \
-    "# d += h + w_k + Sigma1(e) + Ch(e,f,g)\n\t"                         \
+#define RND_STEP_0_1(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = e>>>14 */                                                 \
+    "rorl       $14, " L1 "\n\t"                                      \
+
+#define RND_STEP_0_2(a,b,c,d,e,f,g,h,i)                               \
+    /* L3 = b */                                                      \
+    "movl       %" #b ", " L3 "\n\t"                                  \
+    /* L2 = f */                                                      \
+    "movl       %" #f ", " L2 "\n\t"                                  \
+    /* h += w_k */                                                    \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"                      \
+    /* L2 = f ^ g */                                                  \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+
+#define RND_STEP_0_3(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = (e>>>14) ^ e */                                           \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L2 = (f ^ g) & e */                                            \
+    "andl       %" #e ", " L2 "\n\t"                                  \
+
+#define RND_STEP_0_4(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = ((e>>>14) ^ e) >>> 5 */                                   \
+    "rorl       $5, " L1 "\n\t"                                       \
+    /* L2 = Ch(e,f,g) */                                              \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = (((e>>>14) ^ e) >>> 5) ^ e */                             \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* h += Ch(e,f,g) */                                              \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+#define RND_STEP_0_5(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = ((((e>>>14) ^ e) >>> 5) ^ e) >>> 6 */                     \
+    "rorl       $6, " L1 "\n\t"                                       \
+    /* L3 = a ^ b (= b ^ c of next RND) */                            \
+    "xorl       %" #a ", " L3 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) */                                     \
+    "addl       " L1 ", %" #h "\n\t"                                  \
+    /* L2 = a */                                                      \
+    "movl       %" #a ", " L2 "\n\t"                                  \
+
+#define RND_STEP_0_6(a,b,c,d,e,f,g,h,i)                               \
+    /* L3 = (a ^ b) & (b ^ c) */                                      \
+    "andl       " L3 ", " L4 "\n\t"                                   \
+    /* L2 = a>>>9 */                                                  \
+    "rorl       $9, " L2 "\n\t"                                       \
+    /* L2 = (a>>>9) ^ a */                                            \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* L1 = Maj(a,b,c) */                                             \
+    "xorl       %" #b ", " L4 "\n\t"                                  \
+
+#define RND_STEP_0_7(a,b,c,d,e,f,g,h,i)                               \
+    /* L2 = ((a>>>9) ^ a) >>> 11 */                                   \
+    "rorl       $11, " L2 "\n\t"                                      \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */                        \
+    "addl       %" #h ", %" #d "\n\t"                                 \
+    /* L2 = (((a>>>9) ^ a) >>> 11) ^ a */                             \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) + Ch(e,f,g) + Maj(a,b,c) */            \
+    "addl       " L4 ", %" #h "\n\t"                                  \
+
+#define RND_STEP_0_8(a,b,c,d,e,f,g,h,i)                               \
+    /* L2 = ((((a>>>9) ^ a) >>> 11) ^ a) >>> 2 */                     \
+    "rorl       $2, " L2 "\n\t"                                       \
+    /* L1 = d (e of next RND) */                                      \
+    "movl       %" #d ", " L1 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) Sigma0(a) + Ch(e,f,g) + Maj(a,b,c) */  \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+#define RND_STEP_1_1(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = e>>>14 */                                                 \
+    "rorl       $14, " L1 "\n\t"                                      \
+
+#define RND_STEP_1_2(a,b,c,d,e,f,g,h,i)                               \
+    /* L3 = b */                                                      \
+    "movl       %" #b ", " L4 "\n\t"                                  \
+    /* L2 = f */                                                      \
+    "movl       %" #f ", " L2 "\n\t"                                  \
+    /* h += w_k */                                                    \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"                      \
+    /* L2 = f ^ g */                                                  \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+
+#define RND_STEP_1_3(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = (e>>>14) ^ e */                                           \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L2 = (f ^ g) & e */                                            \
+    "andl       %" #e ", " L2 "\n\t"                                  \
+
+#define RND_STEP_1_4(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = ((e>>>14) ^ e) >>> 5 */                                   \
+    "rorl       $5, " L1 "\n\t"                                       \
+    /* L2 = Ch(e,f,g) */                                              \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = (((e>>>14) ^ e) >>> 5) ^ e */                             \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* h += Ch(e,f,g) */                                              \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+#define RND_STEP_1_5(a,b,c,d,e,f,g,h,i)                               \
+    /* L1 = ((((e>>>14) ^ e) >>> 5) ^ e) >>> 6 */                     \
+    "rorl       $6, " L1 "\n\t"                                       \
+    /* L4 = a ^ b (= b ^ c of next RND) */                            \
+    "xorl       %" #a ", " L4 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) */                                     \
+    "addl       " L1 ", %" #h "\n\t"                                  \
+    /* L2 = a */                                                      \
+    "movl       %" #a ", " L2 "\n\t"                                  \
+
+#define RND_STEP_1_6(a,b,c,d,e,f,g,h,i)                               \
+    /* L3 = (a ^ b) & (b ^ c)  */                                     \
+    "andl       " L4 ", " L3 "\n\t"                                   \
+    /* L2 = a>>>9 */                                                  \
+    "rorl       $9, " L2 "\n\t"                                       \
+    /* L2 = (a>>>9) ^ a */                                            \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* L1 = Maj(a,b,c) */                                             \
+    "xorl       %" #b ", " L3 "\n\t"                                  \
+
+#define RND_STEP_1_7(a,b,c,d,e,f,g,h,i)                               \
+    /* L2 = ((a>>>9) ^ a) >>> 11 */                                   \
+    "rorl       $11, " L2 "\n\t"                                      \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */                        \
+    "addl       %" #h ", %" #d "\n\t"                                 \
+    /* L2 = (((a>>>9) ^ a) >>> 11) ^ a */                             \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) + Ch(e,f,g) + Maj(a,b,c) */            \
+    "addl       " L3 ", %" #h "\n\t"                                  \
+
+#define RND_STEP_1_8(a,b,c,d,e,f,g,h,i)                               \
+    /* L2 = ((((a>>>9) ^ a) >>> 11) ^ a) >>> 2 */                     \
+    "rorl       $2, " L2 "\n\t"                                       \
+    /* L1 = d (e of next RND) */                                      \
+    "movl       %" #d ", " L1 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) Sigma0(a) + Ch(e,f,g) + Maj(a,b,c) */  \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+#define _RND_ALL_0(a,b,c,d,e,f,g,h,i)                                 \
+    /* h += w_k */                                                    \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"                      \
+    /* L2 = f */                                                      \
+    "movl       %" #f ", " L2 "\n\t"                                  \
+    /* L3 = b */                                                      \
+    "movl       %" #b ", " L3 "\n\t"                                  \
+    /* L2 = f ^ g */                                                  \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = e>>>14 */                                                 \
+    "rorl       $14, " L1 "\n\t"                                      \
+    /* L2 = (f ^ g) & e */                                            \
+    "andl       %" #e ", " L2 "\n\t"                                  \
+    /* L1 = (e>>>14) ^ e */                                           \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L2 = Ch(e,f,g) */                                              \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = ((e>>>14) ^ e) >>> 5 */                                   \
+    "rorl       $5, " L1 "\n\t"                                       \
+    /* h += Ch(e,f,g) */                                              \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+    /* L1 = (((e>>>14) ^ e) >>> 5) ^ e */                             \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L3 = a ^ b */                                                  \
+    "xorl       %" #a ", " L3 "\n\t"                                  \
+    /* L1 = ((((e>>>14) ^ e) >>> 5) ^ e) >>> 6 */                     \
+    "rorl       $6, " L1 "\n\t"                                       \
+    /* L2 = a */                                                      \
+    "movl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) */                                     \
+    "addl       " L1 ", %" #h "\n\t"                                  \
+    /* L2 = a>>>9 */                                                  \
+    "rorl       $9, " L2 "\n\t"                                       \
+    /* L3 = (a ^ b) & (b ^ c) */                                      \
+    "andl       " L3 ", " L4 "\n\t"                                   \
+    /* L2 = (a>>>9) ^ a */                                            \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* L1 = Maj(a,b,c) */                                             \
+    "xorl       %" #b ", " L4 "\n\t"                                  \
+    /* L2 = ((a>>>9) ^ a) >>> 11 */                                   \
+    "rorl       $11, " L2 "\n\t"                                      \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */                        \
+    "addl       %" #h ", %" #d "\n\t"                                 \
+    /* L2 = (((a>>>9) ^ a) >>> 11) ^ a */                             \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) + Ch(e,f,g) + Maj(a,b,c) */            \
+    "addl       " L4 ", %" #h "\n\t"                                  \
+    /* L2 = ((((a>>>9) ^ a) >>> 11) ^ a) >>> 2 */                     \
+    "rorl       $2, " L2 "\n\t"                                       \
+    /* L1 = d (e of next RND) */                                      \
+    "movl       %" #d ", " L1 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) Sigma0(a) + Ch(e,f,g) + Maj(a,b,c) */  \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+#define _RND_ALL_1(a,b,c,d,e,f,g,h,i)                                 \
+    /* h += w_k */                                                    \
+    "addl       (" #i ")*4(" WK "), %" #h "\n\t"                      \
+    /* L2 = f */                                                      \
+    "movl       %" #f ", " L2 "\n\t"                                  \
+    /* L3 = b */                                                      \
+    "movl       %" #b ", " L4 "\n\t"                                  \
+    /* L2 = f ^ g */                                                  \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = e>>>14 */                                                 \
+    "rorl       $14, " L1 "\n\t"                                      \
+    /* L2 = (f ^ g) & e */                                            \
+    "andl       %" #e ", " L2 "\n\t"                                  \
+    /* L1 = (e>>>14) ^ e */                                           \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L2 = Ch(e,f,g) */                                              \
+    "xorl       %" #g ", " L2 "\n\t"                                  \
+    /* L1 = ((e>>>14) ^ e) >>> 5 */                                   \
+    "rorl       $5, " L1 "\n\t"                                       \
+    /* h += Ch(e,f,g) */                                              \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+    /* L1 = (((e>>>14) ^ e) >>> 5) ^ e */                             \
+    "xorl       %" #e ", " L1 "\n\t"                                  \
+    /* L3 = a ^ b */                                                  \
+    "xorl       %" #a ", " L4 "\n\t"                                  \
+    /* L1 = ((((e>>>14) ^ e) >>> 5) ^ e) >>> 6 */                     \
+    "rorl       $6, " L1 "\n\t"                                       \
+    /* L2 = a */                                                      \
+    "movl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) */                                     \
+    "addl       " L1 ", %" #h "\n\t"                                  \
+    /* L2 = a>>>9 */                                                  \
+    "rorl       $9, " L2 "\n\t"                                       \
+    /* L3 = (a ^ b) & (b ^ c)  */                                     \
+    "andl       " L4 ", " L3 "\n\t"                                   \
+    /* L2 = (a>>>9) ^ a */                                            \
+    "xorl       %" #a", " L2 "\n\t"                                   \
+    /* L1 = Maj(a,b,c) */                                             \
+    "xorl       %" #b ", " L3 "\n\t"                                  \
+    /* L2 = ((a>>>9) ^ a) >>> 11 */                                   \
+    "rorl       $11, " L2 "\n\t"                                      \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */                        \
     "addl       %"#h", %"#d"\n\t"                                        \
-    "# r8b = h + w_k + Sigma1(e) + Ch(e,f,g) + Maj(a,b,c)\n\t"           \
-    "addl       %"#h", %%r8d\n\t"                                        \
-    "# r8b = h + w_k + Sigma1(e) Sigma0(a) + Ch(e,f,g) + Maj(a,b,c)\n\t" \
-    "addl       %%edx, %%r8d\n\t"                                        \
-    "# h = h + w_k + Sigma1(e) + Sigma0(a) + Ch(e,f,g) + Maj(a,b,c)\n\t" \
-    "movl       %%r8d, %"#h"\n\t"
-
-#define RND_X(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_1(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_2(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_3(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_4(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_5(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_6(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_7(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_8(a,b,c,d,e,f,g,h,i)
-
-#define RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i)
-#define RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_7,S_0,S_1,S_2,S_3,S_4,S_5,S_6,_i)
-#define RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_6,S_7,S_0,S_1,S_2,S_3,S_4,S_5,_i)
-#define RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_5,S_6,S_7,S_0,S_1,S_2,S_3,S_4,_i)
-#define RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,_i)
-#define RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_3,S_4,S_5,S_6,S_7,S_0,S_1,S_2,_i)
-#define RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_2,S_3,S_4,S_5,S_6,S_7,S_0,S_1,_i)
-#define RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_1,S_2,S_3,S_4,S_5,S_6,S_7,S_0,_i)
-
-
-#define RND_1_3(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_1(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_2(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_3(a,b,c,d,e,f,g,h,i)
-
-#define RND_4_6(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_4(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_5(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_6(a,b,c,d,e,f,g,h,i)
-
-#define RND_7_8(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_7(a,b,c,d,e,f,g,h,i) \
-       RND_STEP_8(a,b,c,d,e,f,g,h,i)
-
-#define RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i)
-#define RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_7,S_0,S_1,S_2,S_3,S_4,S_5,S_6,_i)
-#define RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_6,S_7,S_0,S_1,S_2,S_3,S_4,S_5,_i)
-#define RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_5,S_6,S_7,S_0,S_1,S_2,S_3,S_4,_i)
-#define RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,_i)
-#define RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_3,S_4,S_5,S_6,S_7,S_0,S_1,S_2,_i)
-#define RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_2,S_3,S_4,S_5,S_6,S_7,S_0,S_1,_i)
-#define RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_X(S_1,S_2,S_3,S_4,S_5,S_6,S_7,S_0,_i)
-
-
-#define RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i)
-#define RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_7,S_0,S_1,S_2,S_3,S_4,S_5,S_6,_i)
-#define RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_6,S_7,S_0,S_1,S_2,S_3,S_4,S_5,_i)
-#define RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_5,S_6,S_7,S_0,S_1,S_2,S_3,S_4,_i)
-#define RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,_i)
-#define RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_3,S_4,S_5,S_6,S_7,S_0,S_1,S_2,_i)
-#define RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_2,S_3,S_4,S_5,S_6,S_7,S_0,S_1,_i)
-#define RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_1_3(S_1,S_2,S_3,S_4,S_5,S_6,S_7,S_0,_i)
-
-#define RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i)
-#define RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_7,S_0,S_1,S_2,S_3,S_4,S_5,S_6,_i)
-#define RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_6,S_7,S_0,S_1,S_2,S_3,S_4,S_5,_i)
-#define RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_5,S_6,S_7,S_0,S_1,S_2,S_3,S_4,_i)
-#define RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,_i)
-#define RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_3,S_4,S_5,S_6,S_7,S_0,S_1,S_2,_i)
-#define RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_2,S_3,S_4,S_5,S_6,S_7,S_0,S_1,_i)
-#define RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_4_6(S_1,S_2,S_3,S_4,S_5,S_6,S_7,S_0,_i)
-
-#define RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i)
-#define RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_7,S_0,S_1,S_2,S_3,S_4,S_5,S_6,_i)
-#define RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_6,S_7,S_0,S_1,S_2,S_3,S_4,S_5,_i)
-#define RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_5,S_6,S_7,S_0,S_1,S_2,S_3,S_4,_i)
-#define RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,_i)
-#define RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_3,S_4,S_5,S_6,S_7,S_0,S_1,S_2,_i)
-#define RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_2,S_3,S_4,S_5,S_6,S_7,S_0,S_1,_i)
-#define RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,_i) RND_7_8(S_1,S_2,S_3,S_4,S_5,S_6,S_7,S_0,_i)
-
-#define FOR(cnt, init, max, inc, loop)  \
-    __asm__ volatile("movl $"#init", %0\n\t"#loop":"::"m"(cnt):)
-#define END(cnt, init, max, inc, loop)  \
-    __asm__ volatile("addl $"#inc", %0\n\tcmpl $"#max", %0\n\tjle "#loop"\n\t":"=m"(cnt)::);
+    /* L2 = (((a>>>9) ^ a) >>> 11) ^ a */                             \
+    "xorl       %" #a ", " L2 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) + Ch(e,f,g) + Maj(a,b,c) */            \
+    "addl       " L3 ", %" #h "\n\t"                                  \
+    /* L2 = ((((a>>>9) ^ a) >>> 11) ^ a) >>> 2 */                     \
+    "rorl       $2, " L2 "\n\t"                                       \
+    /* L1 = d (e of next RND) */                                      \
+    "movl       %" #d ", " L1 "\n\t"                                  \
+    /* h = h + w_k + Sigma1(e) Sigma0(a) + Ch(e,f,g) + Maj(a,b,c) */  \
+    "addl       " L2 ", %" #h "\n\t"                                  \
+
+
+#define RND_ALL_0(a, b, c, d, e, f, g, h, i) \
+       _RND_ALL_0(a, b, c, d, e, f, g, h, i)
+#define RND_ALL_1(a, b, c, d, e, f, g, h, i) \
+       _RND_ALL_1(a, b, c, d, e, f, g, h, i)
+
+#define RND_ALL_4(a, b, c, d, e, f, g, h, i)   \
+        RND_ALL_0(a, b, c, d, e, f, g, h, i+0) \
+        RND_ALL_1(h, a, b, c, d, e, f, g, i+1) \
+        RND_ALL_0(g, h, a, b, c, d, e, f, i+2) \
+        RND_ALL_1(f, g, h, a, b, c, d, e, i+3)
 
 #endif  /* defined(HAVE_INTEL_AVX1) ||  defined(HAVE_INTEL_AVX2) */
@@ -1063 +1433 @@
 #if defined(HAVE_INTEL_AVX1) /* inline Assember for Intel AVX1 instructions */
 
-#define VPALIGNR(op1,op2,op3,op4) \
+#define _VPALIGNR(op1, op2, op3, op4)                    \
     "vpalignr   $"#op4", %"#op3", %"#op2", %"#op1"\n\t"
-#define VPADDD(op1,op2,op3)       \
+#define VPALIGNR(op1, op2, op3, op4)                     \
+        _VPALIGNR(op1, op2, op3, op4)
+#define _VPADDD(op1, op2, op3)                           \
     "vpaddd     %"#op3", %"#op2", %"#op1"\n\t"
-#define VPSRLD(op1,op2,op3)       \
+#define VPADDD(op1, op2, op3)                            \
+       _VPADDD(op1, op2, op3)
+#define _VPSRLD(op1, op2, op3)                           \
     "vpsrld     $"#op3", %"#op2", %"#op1"\n\t"
-#define VPSRLQ(op1,op2,op3)       \
+#define VPSRLD(op1, op2, op3)        \
+       _VPSRLD(op1, op2, op3)
+#define _VPSRLQ(op1, op2, op3)                           \
     "vpsrlq     $"#op3", %"#op2", %"#op1"\n\t"
-#define VPSLLD(op1,op2,op3)       \
+#define VPSRLQ(op1,op2,op3)        \
+       _VPSRLQ(op1,op2,op3)
+#define _VPSLLD(op1,op2,op3)                             \
     "vpslld     $"#op3", %"#op2", %"#op1"\n\t"
-#define VPOR(op1,op2,op3)         \
+#define VPSLLD(op1,op2,op3)        \
+       _VPSLLD(op1,op2,op3)
+#define _VPOR(op1,op2,op3)                               \
     "vpor       %"#op3", %"#op2", %"#op1"\n\t"
-#define VPXOR(op1,op2,op3)        \
+#define VPOR(op1,op2,op3)          \
+       _VPOR(op1,op2,op3)
+#define _VPXOR(op1,op2,op3)                              \
     "vpxor      %"#op3", %"#op2", %"#op1"\n\t"
-#define VPSHUFD(op1,op2,op3)      \
+#define VPXOR(op1,op2,op3)         \
+       _VPXOR(op1,op2,op3)
+#define _VPSHUFD(op1,op2,op3)                            \
     "vpshufd    $"#op3", %"#op2", %"#op1"\n\t"
-#define VPSHUFB(op1,op2,op3)      \
+#define VPSHUFD(op1,op2,op3)       \
+       _VPSHUFD(op1,op2,op3)
+#define _VPSHUFB(op1,op2,op3)                            \
     "vpshufb    %"#op3", %"#op2", %"#op1"\n\t"
-
-#define MessageSched(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER, SHUF_00BA, SHUF_DC00,\
-     a,b,c,d,e,f,g,h,_i)\
-            RND_STEP_1(a,b,c,d,e,f,g,h,_i)\
+#define VPSHUFB(op1,op2,op3)       \
+       _VPSHUFB(op1,op2,op3)
+#define _VPSLLDQ(op1,op2,op3)                            \
+    "vpslldq    $" #op3", %" #op2", %" #op1"\n\t"
+#define VPSLLDQ(op1,op2,op3)       \
+       _VPSLLDQ(op1,op2,op3)
+
+#define MsgSched(X0,X1,X2,X3,a,b,c,d,e,f,g,h,_i)                           \
+            RND_STEP_0_1(a,b,c,d,e,f,g,h,_i)                               \
+    VPALIGNR (XTMP1, X1, X0, 4)   /* XTMP1 = W[-15] */\
+    VPALIGNR (XTMP0, X3, X2, 4)    /* XTMP0 = W[-7] */                     \
+            RND_STEP_0_2(a,b,c,d,e,f,g,h,_i)                               \
+            RND_STEP_0_3(a,b,c,d,e,f,g,h,_i)                               \
+    VPSRLD   (XTMP2, XTMP1, 7)     /* XTMP2 = W[-15] >> 7 */               \
+    VPSLLD   (XTMP3, XTMP1, 25)    /* XTEMP3 = W[-15] << (32-7) */         \
+            RND_STEP_0_4(a,b,c,d,e,f,g,h,_i)                               \
+            RND_STEP_0_5(a,b,c,d,e,f,g,h,_i)                               \
+    VPSRLD   (XTMP4, XTMP1, 18)    /* XTEMP4 = W[-15] >> 18 */             \
+    VPSLLD   (XTMP5, XTMP1, 14)    /* XTEMP5 = W[-15] << (32-18) */        \
+            RND_STEP_0_6(a,b,c,d,e,f,g,h,_i)                               \
+            RND_STEP_0_7(a,b,c,d,e,f,g,h,_i)                               \
+    VPOR     (XTMP2, XTMP3, XTMP2) /* XTMP2 = W[-15] >>> 7 */              \
+    VPOR     (XTMP4, XTMP5, XTMP4) /* XTMP4 = W[-15] >>> 18 */             \
+            RND_STEP_0_8(a,b,c,d,e,f,g,h,_i)                               \
+            RND_STEP_1_1(h,a,b,c,d,e,f,g,_i+1)                             \
+            RND_STEP_1_2(h,a,b,c,d,e,f,g,_i+1)                             \
+    VPSRLD   (XTMP5, XTMP1, 3)     /* XTMP4 = W[-15] >> 3 */               \
+    VPXOR    (XTMP2, XTMP4, XTMP2)                                         \
+                          /* XTMP2 = W[-15] MY_ROR 7 ^ W[-15] MY_ROR 18 */ \
+            RND_STEP_1_3(h,a,b,c,d,e,f,g,_i+1)                             \
+            RND_STEP_1_4(h,a,b,c,d,e,f,g,_i+1)                             \
+    VPXOR    (XTMP1, XTMP5, XTMP2)  /* XTMP1 = s0 */                       \
+    VPSHUFD(XTMP2, X3, 0b11111010)  /* XTMP2 = W[-2] {BBAA}*/\
+            RND_STEP_1_5(h,a,b,c,d,e,f,g,_i+1)                             \
+            RND_STEP_1_6(h,a,b,c,d,e,f,g,_i+1)                             \
+    VPSRLD   (XTMP4, XTMP2, 10)      /* XTMP4 = W[-2] >> 10 {BBAA} */\
+    VPSRLQ   (XTMP3, XTMP2, 19)      /* XTMP3 = W[-2] MY_ROR 19 {xBxA} */\
+            RND_STEP_1_7(h,a,b,c,d,e,f,g,_i+1)                             \
+            RND_STEP_1_8(h,a,b,c,d,e,f,g,_i+1)                             \
+            RND_STEP_0_1(g,h,a,b,c,d,e,f,_i+2)                             \
+    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xBxA} */\
+    VPADDD   (XTMP0, XTMP0, X0)                                            \
+            RND_STEP_0_2(g,h,a,b,c,d,e,f,_i+2)                             \
+            RND_STEP_0_3(g,h,a,b,c,d,e,f,_i+2)                             \
+            RND_STEP_0_4(g,h,a,b,c,d,e,f,_i+2)                             \
+    VPXOR    (XTMP2, XTMP3, XTMP2)                                         \
+    VPADDD   (XTMP0, XTMP0, XTMP1)  /* XTMP0 = W[-16] + W[-7] + s0 */      \
+            RND_STEP_0_5(g,h,a,b,c,d,e,f,_i+2)                             \
+    VPXOR    (XTMP4, XTMP4, XTMP2)   /* XTMP4 = s1 {xBxA} */\
+            RND_STEP_0_6(g,h,a,b,c,d,e,f,_i+2)                             \
+    VPSHUFB  (XTMP4, XTMP4, SHUF_00BA)  /* XTMP4 = s1 {00BA} */\
+            RND_STEP_0_7(g,h,a,b,c,d,e,f,_i+2)                             \
+    VPADDD   (XTMP0, XTMP0, XTMP4)  /* XTMP0 = {..., ..., W[1], W[0]} */\
+            RND_STEP_0_8(g,h,a,b,c,d,e,f,_i+2)                             \
+            RND_STEP_1_1(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPSHUFD  (XTMP2, XTMP0, 0b01010000) /* XTMP2 = W[-2] {DDCC} */\
+            RND_STEP_1_2(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPSRLQ   (XTMP4, XTMP2, 17)      /* XTMP4 = W[-2] MY_ROR 17 {xDxC} */  \
+    VPSRLQ   (XTMP3, XTMP2, 19)       /* XTMP3 = W[-2] MY_ROR 19 {xDxC} */\
+            RND_STEP_1_3(f,g,h,a,b,c,d,e,_i+3)                             \
+            RND_STEP_1_4(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPSRLD   (XTMP5, XTMP2, 10)       /* XTMP5 = W[-2] >> 10 {DDCC} */     \
+    VPXOR    (XTMP4, XTMP3, XTMP4)                                         \
+            RND_STEP_1_5(f,g,h,a,b,c,d,e,_i+3)                             \
+            RND_STEP_1_6(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPXOR    (XTMP5, XTMP4, XTMP5)   /* XTMP5 = s1 {xDxC} */               \
+            RND_STEP_1_7(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPSHUFB  (XTMP5, XTMP5, SHUF_DC00) /* XTMP5 = s1 {DC00} */\
+            RND_STEP_1_8(f,g,h,a,b,c,d,e,_i+3)                             \
+    VPADDD   (X0, XTMP5, XTMP0)      /* X0 = {W[3], W[2], W[1], W[0]} */
+
+#if defined(HAVE_INTEL_RORX)
+
+#define MsgSched_RORX(X0,X1,X2,X3,a,b,c,d,e,f,g,h,_i)                      \
+            RND_STEP_RORX_0_1(a,b,c,d,e,f,g,h,_i)                          \
     VPALIGNR (XTMP0, X3, X2, 4)\
-            RND_STEP_2(a,b,c,d,e,f,g,h,_i)\
-    VPADDD   (XTMP0, XTMP0, X0)\
-            RND_STEP_3(a,b,c,d,e,f,g,h,_i)\
     VPALIGNR (XTMP1, X1, X0, 4)   /* XTMP1 = W[-15] */\
-            RND_STEP_4(a,b,c,d,e,f,g,h,_i)\
+            RND_STEP_RORX_0_2(a,b,c,d,e,f,g,h,_i)                          \
+            RND_STEP_RORX_0_3(a,b,c,d,e,f,g,h,_i)                          \
     VPSRLD   (XTMP2, XTMP1, 7)\
-            RND_STEP_5(a,b,c,d,e,f,g,h,_i)\
     VPSLLD   (XTMP3, XTMP1, 25) /* VPSLLD   (XTMP3, XTMP1, (32-7)) */\
-            RND_STEP_6(a,b,c,d,e,f,g,h,_i)\
+            RND_STEP_RORX_0_4(a,b,c,d,e,f,g,h,_i)                          \
+            RND_STEP_RORX_0_5(a,b,c,d,e,f,g,h,_i)                          \
+    VPSRLD   (XTMP4, XTMP1, 3)  /* XTMP4 = W[-15] >> 3 */                  \
     VPOR     (XTMP3, XTMP3, XTMP2)  /* XTMP1 = W[-15] MY_ROR 7 */\
-            RND_STEP_7(a,b,c,d,e,f,g,h,_i)\
-    VPSRLD   (XTMP2, XTMP1,18)\
-            RND_STEP_8(a,b,c,d,e,f,g,h,_i)\
+            RND_STEP_RORX_0_6(a,b,c,d,e,f,g,h,_i)                          \
+            RND_STEP_RORX_0_7(a,b,c,d,e,f,g,h,_i)                          \
+            RND_STEP_RORX_0_8(a,b,c,d,e,f,g,h,_i)                          \
 \
-            RND_STEP_1(h,a,b,c,d,e,f,g,_i+1)\
-    VPSRLD   (XTMP4, XTMP1, 3)  /* XTMP4 = W[-15] >> 3 */\
-            RND_STEP_2(h,a,b,c,d,e,f,g,_i+1)\
+            RND_STEP_RORX_1_1(h,a,b,c,d,e,f,g,_i+1)                        \
+    VPSRLD   (XTMP2, XTMP1,18)                                             \
+            RND_STEP_RORX_1_2(h,a,b,c,d,e,f,g,_i+1)                        \
     VPSLLD   (XTMP1, XTMP1, 14) /* VPSLLD   (XTMP1, XTMP1, (32-18)) */\
-            RND_STEP_3(h,a,b,c,d,e,f,g,_i+1)\
+            RND_STEP_RORX_1_3(h,a,b,c,d,e,f,g,_i+1)                        \
     VPXOR    (XTMP3, XTMP3, XTMP1)\
-            RND_STEP_4(h,a,b,c,d,e,f,g,_i+1)\
-    VPXOR    (XTMP3, XTMP3, XTMP2)  /* XTMP1 = W[-15] MY_ROR 7 ^ W[-15] MY_ROR 18 */\
-            RND_STEP_5(h,a,b,c,d,e,f,g,_i+1)\
-    VPXOR    (XTMP1, XTMP3, XTMP4)  /* XTMP1 = s0 */\
-            RND_STEP_6(h,a,b,c,d,e,f,g,_i+1)\
+            RND_STEP_RORX_1_4(h,a,b,c,d,e,f,g,_i+1)                        \
+    VPXOR    (XTMP3, XTMP3, XTMP2)                                         \
+                          /* XTMP1 = W[-15] MY_ROR 7 ^ W[-15] MY_ROR 18 */ \
+            RND_STEP_RORX_1_5(h,a,b,c,d,e,f,g,_i+1)                        \
     VPSHUFD(XTMP2, X3, 0b11111010)  /* XTMP2 = W[-2] {BBAA}*/\
-            RND_STEP_7(h,a,b,c,d,e,f,g,_i+1)\
-    VPADDD   (XTMP0, XTMP0, XTMP1)  /* XTMP0 = W[-16] + W[-7] + s0 */\
-            RND_STEP_8(h,a,b,c,d,e,f,g,_i+1)\
+            RND_STEP_RORX_1_6(h,a,b,c,d,e,f,g,_i+1)                        \
+    VPXOR    (XTMP1, XTMP3, XTMP4)  /* XTMP1 = s0 */                       \
+            RND_STEP_RORX_1_7(h,a,b,c,d,e,f,g,_i+1)                        \
+    VPSRLD   (XTMP4, XTMP2, 10)      /* XTMP4 = W[-2] >> 10 {BBAA} */\
+            RND_STEP_RORX_1_8(h,a,b,c,d,e,f,g,_i+1)                        \
+                                                                           \
+            RND_STEP_RORX_0_1(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPSRLQ   (XTMP3, XTMP2, 19)      /* XTMP3 = W[-2] MY_ROR 19 {xBxA} */\
+            RND_STEP_RORX_0_2(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xBxA} */\
+    VPADDD   (XTMP0, XTMP0, X0)                                            \
+            RND_STEP_RORX_0_3(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPADDD   (XTMP0, XTMP0, XTMP1)  /* XTMP0 = W[-16] + W[-7] + s0 */      \
+            RND_STEP_RORX_0_4(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPXOR    (XTMP2, XTMP2, XTMP3)\
+            RND_STEP_RORX_0_5(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPXOR    (XTMP4, XTMP4, XTMP2)   /* XTMP4 = s1 {xBxA} */\
+            RND_STEP_RORX_0_6(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPSHUFB  (XTMP4, XTMP4, SHUF_00BA)  /* XTMP4 = s1 {00BA} */\
+            RND_STEP_RORX_0_7(g,h,a,b,c,d,e,f,_i+2)                        \
+    VPADDD   (XTMP0, XTMP0, XTMP4)  /* XTMP0 = {..., ..., W[1], W[0]} */\
+            RND_STEP_RORX_0_8(g,h,a,b,c,d,e,f,_i+2)                        \
 \
-            RND_STEP_1(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLD   (XTMP4, XTMP2, 10)      /* XTMP4 = W[-2] >> 10 {BBAA} */\
-            RND_STEP_2(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLQ   (XTMP3, XTMP2, 19)      /* XTMP3 = W[-2] MY_ROR 19 {xBxA} */\
-            RND_STEP_3(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xBxA} */\
-            RND_STEP_4(g,h,a,b,c,d,e,f,_i+2)\
+            RND_STEP_RORX_1_1(f,g,h,a,b,c,d,e,_i+3)                        \
+    VPSHUFD  (XTMP2, XTMP0, 0b01010000) /* XTMP2 = W[-2] {DDCC} */\
+            RND_STEP_RORX_1_2(f,g,h,a,b,c,d,e,_i+3)                        \
+    VPSRLD   (XTMP5, XTMP2, 10)       /* XTMP5 = W[-2] >> 10 {DDCC} */\
+            RND_STEP_RORX_1_3(f,g,h,a,b,c,d,e,_i+3)                        \
+    VPSRLQ   (XTMP3, XTMP2, 19)       /* XTMP3 = W[-2] MY_ROR 19 {xDxC} */\
+            RND_STEP_RORX_1_4(f,g,h,a,b,c,d,e,_i+3)                        \
+    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xDxC} */\
+            RND_STEP_RORX_1_5(f,g,h,a,b,c,d,e,_i+3)                        \
     VPXOR    (XTMP2, XTMP2, XTMP3)\
-            RND_STEP_5(g,h,a,b,c,d,e,f,_i+2)\
-    VPXOR    (XTMP4, XTMP4, XTMP2)   /* XTMP4 = s1 {xBxA} */\
-            RND_STEP_6(g,h,a,b,c,d,e,f,_i+2)\
-    VPSHUFB  (XTMP4, XTMP4, SHUF_00BA)  /* XTMP4 = s1 {00BA} */\
-            RND_STEP_7(g,h,a,b,c,d,e,f,_i+2)\
-    VPADDD   (XTMP0, XTMP0, XTMP4)  /* XTMP0 = {..., ..., W[1], W[0]} */\
-            RND_STEP_8(g,h,a,b,c,d,e,f,_i+2)\
-\
-            RND_STEP_1(f,g,h,a,b,c,d,e,_i+3)\
-    VPSHUFD  (XTMP2, XTMP0, 0b01010000) /* XTMP2 = W[-2] {DDCC} */\
-            RND_STEP_2(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLD   (XTMP5, XTMP2, 10)       /* XTMP5 = W[-2] >> 10 {DDCC} */\
-            RND_STEP_3(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLQ   (XTMP3, XTMP2, 19)       /* XTMP3 = W[-2] MY_ROR 19 {xDxC} */\
-            RND_STEP_4(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xDxC} */\
-            RND_STEP_5(f,g,h,a,b,c,d,e,_i+3)\
-    VPXOR    (XTMP2, XTMP2, XTMP3)\
-            RND_STEP_6(f,g,h,a,b,c,d,e,_i+3)\
+            RND_STEP_RORX_1_6(f,g,h,a,b,c,d,e,_i+3)                        \
     VPXOR    (XTMP5, XTMP5, XTMP2)   /* XTMP5 = s1 {xDxC} */\
-            RND_STEP_7(f,g,h,a,b,c,d,e,_i+3)\
+            RND_STEP_RORX_1_7(f,g,h,a,b,c,d,e,_i+3)                        \
     VPSHUFB  (XTMP5, XTMP5, SHUF_DC00) /* XTMP5 = s1 {DC00} */\
-            RND_STEP_8(f,g,h,a,b,c,d,e,_i+3)\
-    VPADDD   (X0, XTMP5, XTMP0)      /* X0 = {W[3], W[2], W[1], W[0]} */\
-
-#if defined(HAVE_INTEL_RORX)
-
-#define MessageSched_RORX(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, \
-                          XFER, SHUF_00BA, SHUF_DC00,a,b,c,d,e,f,g,h,_i)\
-            RND_STEP_RORX_1(a,b,c,d,e,f,g,h,_i)\
-    VPALIGNR (XTMP0, X3, X2, 4)\
-            RND_STEP_RORX_2(a,b,c,d,e,f,g,h,_i)\
-    VPADDD   (XTMP0, XTMP0, X0)\
-            RND_STEP_RORX_3(a,b,c,d,e,f,g,h,_i)\
-    VPALIGNR (XTMP1, X1, X0, 4)   /* XTMP1 = W[-15] */\
-            RND_STEP_RORX_4(a,b,c,d,e,f,g,h,_i)\
-    VPSRLD   (XTMP2, XTMP1, 7)\
-            RND_STEP_RORX_5(a,b,c,d,e,f,g,h,_i)\
-    VPSLLD   (XTMP3, XTMP1, 25) /* VPSLLD   (XTMP3, XTMP1, (32-7)) */\
-            RND_STEP_RORX_6(a,b,c,d,e,f,g,h,_i)\
-    VPOR     (XTMP3, XTMP3, XTMP2)  /* XTMP1 = W[-15] MY_ROR 7 */\
-            RND_STEP_RORX_7(a,b,c,d,e,f,g,h,_i)\
-    VPSRLD   (XTMP2, XTMP1,18)\
-            RND_STEP_RORX_8(a,b,c,d,e,f,g,h,_i)\
-\
-            RND_STEP_RORX_1(h,a,b,c,d,e,f,g,_i+1)\
-    VPSRLD   (XTMP4, XTMP1, 3)  /* XTMP4 = W[-15] >> 3 */\
-            RND_STEP_RORX_2(h,a,b,c,d,e,f,g,_i+1)\
-    VPSLLD   (XTMP1, XTMP1, 14) /* VPSLLD   (XTMP1, XTMP1, (32-18)) */\
-            RND_STEP_RORX_3(h,a,b,c,d,e,f,g,_i+1)\
-    VPXOR    (XTMP3, XTMP3, XTMP1)\
-            RND_STEP_RORX_4(h,a,b,c,d,e,f,g,_i+1)\
-    VPXOR    (XTMP3, XTMP3, XTMP2)  /* XTMP1 = W[-15] MY_ROR 7 ^ W[-15] MY_ROR 18 */\
-            RND_STEP_RORX_5(h,a,b,c,d,e,f,g,_i+1)\
-    VPXOR    (XTMP1, XTMP3, XTMP4)  /* XTMP1 = s0 */\
-            RND_STEP_RORX_6(h,a,b,c,d,e,f,g,_i+1)\
-    VPSHUFD(XTMP2, X3, 0b11111010)  /* XTMP2 = W[-2] {BBAA}*/\
-            RND_STEP_RORX_7(h,a,b,c,d,e,f,g,_i+1)\
-    VPADDD   (XTMP0, XTMP0, XTMP1)  /* XTMP0 = W[-16] + W[-7] + s0 */\
-            RND_STEP_RORX_8(h,a,b,c,d,e,f,g,_i+1)\
-\
-            RND_STEP_RORX_1(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLD   (XTMP4, XTMP2, 10)      /* XTMP4 = W[-2] >> 10 {BBAA} */\
-            RND_STEP_RORX_2(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLQ   (XTMP3, XTMP2, 19)      /* XTMP3 = W[-2] MY_ROR 19 {xBxA} */\
-            RND_STEP_RORX_3(g,h,a,b,c,d,e,f,_i+2)\
-    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xBxA} */\
-            RND_STEP_RORX_4(g,h,a,b,c,d,e,f,_i+2)\
-    VPXOR    (XTMP2, XTMP2, XTMP3)\
-            RND_STEP_RORX_5(g,h,a,b,c,d,e,f,_i+2)\
-    VPXOR    (XTMP4, XTMP4, XTMP2)   /* XTMP4 = s1 {xBxA} */\
-            RND_STEP_RORX_6(g,h,a,b,c,d,e,f,_i+2)\
-    VPSHUFB  (XTMP4, XTMP4, SHUF_00BA)  /* XTMP4 = s1 {00BA} */\
-            RND_STEP_RORX_7(g,h,a,b,c,d,e,f,_i+2)\
-    VPADDD   (XTMP0, XTMP0, XTMP4)  /* XTMP0 = {..., ..., W[1], W[0]} */\
-            RND_STEP_RORX_8(g,h,a,b,c,d,e,f,_i+2)\
-\
-            RND_STEP_RORX_1(f,g,h,a,b,c,d,e,_i+3)\
-    VPSHUFD  (XTMP2, XTMP0, 0b01010000) /* XTMP2 = W[-2] {DDCC} */\
-            RND_STEP_RORX_2(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLD   (XTMP5, XTMP2, 10)       /* XTMP5 = W[-2] >> 10 {DDCC} */\
-            RND_STEP_RORX_3(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLQ   (XTMP3, XTMP2, 19)       /* XTMP3 = W[-2] MY_ROR 19 {xDxC} */\
-            RND_STEP_RORX_4(f,g,h,a,b,c,d,e,_i+3)\
-    VPSRLQ   (XTMP2, XTMP2, 17)      /* XTMP2 = W[-2] MY_ROR 17 {xDxC} */\
-            RND_STEP_RORX_5(f,g,h,a,b,c,d,e,_i+3)\
-    VPXOR    (XTMP2, XTMP2, XTMP3)\
-            RND_STEP_RORX_6(f,g,h,a,b,c,d,e,_i+3)\
-    VPXOR    (XTMP5, XTMP5, XTMP2)   /* XTMP5 = s1 {xDxC} */\
-            RND_STEP_RORX_7(f,g,h,a,b,c,d,e,_i+3)\
-    VPSHUFB  (XTMP5, XTMP5, SHUF_DC00) /* XTMP5 = s1 {DC00} */\
-            RND_STEP_RORX_8(f,g,h,a,b,c,d,e,_i+3)\
-    VPADDD   (X0, XTMP5, XTMP0)      /* X0 = {W[3], W[2], W[1], W[0]} */\
+            RND_STEP_RORX_1_8(f,g,h,a,b,c,d,e,_i+3)                        \
+    VPADDD   (X0, XTMP5, XTMP0)      /* X0 = {W[3], W[2], W[1], W[0]} */
 
 #endif /* HAVE_INTEL_RORX */
 
 
-#define W_K_from_buff()                      \
-    "leaq       %[buf], %%r8\n\t"            \
-    "vmovdqu      (%%r8), %%xmm4\n\t"        \
-    "vpshufb    %%xmm13, %%xmm4, %%xmm4\n\t" \
-    "vmovdqu    16(%%r8), %%xmm5\n\t"        \
-    "vpshufb    %%xmm13, %%xmm5, %%xmm5\n\t" \
-    "vmovdqu    32(%%r8), %%xmm6\n\t"        \
-    "vpshufb    %%xmm13, %%xmm6, %%xmm6\n\t" \
-    "vmovdqu    48(%%r8), %%xmm7\n\t"        \
-    "vpshufb    %%xmm13, %%xmm7, %%xmm7\n\t"
-
-#define _SET_W_K_XFER(reg, i)                        \
-    "leaq       %[K], %%r8\n\t"                      \
-    "vpaddd     ("#i")*4(%%r8), %"#reg", %%xmm9\n\t" \
-    "leaq       %[W_K], %%r8\n\t"                    \
-    "vmovdqa    %%xmm9, ("#i")*4(%%r8)\n\t"
-
-#define SET_W_K_XFER(reg, i) _SET_W_K_XFER(reg, i)
-
-static const ALIGN32 word64 mSHUF_00BA[] = { 0x0b0a090803020100, 0xFFFFFFFFFFFFFFFF }; /* shuffle xBxA -> 00BA */
-static const ALIGN32 word64 mSHUF_DC00[] = { 0xFFFFFFFFFFFFFFFF, 0x0b0a090803020100 }; /* shuffle xDxC -> DC00 */
-static const ALIGN32 word64 mBYTE_FLIP_MASK[] =  { 0x0405060700010203, 0x0c0d0e0f08090a0b };
-
+#define _W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK) \
+    "# X0, X1, X2, X3 = W[0..15]\n\t"                  \
+    "vmovdqu      (%%rax), %" #X0 "\n\t"               \
+    "vmovdqu    16(%%rax), %" #X1 "\n\t"               \
+    VPSHUFB(X0, X0, BYTE_FLIP_MASK)                    \
+    VPSHUFB(X1, X1, BYTE_FLIP_MASK)                    \
+    "vmovdqu    32(%%rax), %" #X2 "\n\t"               \
+    "vmovdqu    48(%%rax), %" #X3 "\n\t"               \
+    VPSHUFB(X2, X2, BYTE_FLIP_MASK)                    \
+    VPSHUFB(X3, X3, BYTE_FLIP_MASK)
+
+#define W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK) \
+       _W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK)
+
+
+#define _SET_W_K_XFER_4(i) \
+    "vpaddd     (" #i "*4)+ 0+%[K], %%xmm0, %%xmm4\n\t"  \
+    "vpaddd     (" #i "*4)+16+%[K], %%xmm1, %%xmm5\n\t"  \
+    "vmovdqu    %%xmm4,   (" WK ")\n\t"                  \
+    "vmovdqu    %%xmm5, 16(" WK ")\n\t"                  \
+    "vpaddd     (" #i "*4)+32+%[K], %%xmm2, %%xmm6\n\t"  \
+    "vpaddd     (" #i "*4)+48+%[K], %%xmm3, %%xmm7\n\t"  \
+    "vmovdqu    %%xmm6, 32(" WK ")\n\t"                  \
+    "vmovdqu    %%xmm7, 48(" WK ")\n\t"
+
+#define SET_W_K_XFER_4(i) \
+       _SET_W_K_XFER_4(i)
+
+
+static const ALIGN32 word64 mSHUF_00BA[] =
+    { 0x0b0a090803020100, 0xFFFFFFFFFFFFFFFF }; /* shuffle xBxA -> 00BA */
+static const ALIGN32 word64 mSHUF_DC00[] =
+    { 0xFFFFFFFFFFFFFFFF, 0x0b0a090803020100 }; /* shuffle xDxC -> DC00 */
+static const ALIGN32 word64 mBYTE_FLIP_MASK[] =
+    { 0x0405060700010203, 0x0c0d0e0f08090a0b };
 
 #define _Init_Masks(mask1, mask2, mask3)     \
-    "vmovdqu    %[FLIP], %"#mask1"\n\t"      \
-    "vmovdqu    %[SHUF00BA], %"#mask2"\n\t"  \
-    "vmovdqu    %[SHUFDC00], %"#mask3"\n\t"
+    "vmovdqa    %[FLIP], %" #mask1 "\n\t"      \
+    "vmovdqa    %[SHUF00BA], %" #mask2 "\n\t"  \
+    "vmovdqa    %[SHUFDC00], %" #mask3 "\n\t"
 
 #define Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)\
     _Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
 
-#define X0 %xmm4
-#define X1 %xmm5
-#define X2 %xmm6
-#define X3 %xmm7
-#define X_ X0
-
-#define XTMP0 %xmm0
-#define XTMP1 %xmm1
-#define XTMP2 %xmm2
-#define XTMP3 %xmm3
+#define X0 %xmm0
+#define X1 %xmm1
+#define X2 %xmm2
+#define X3 %xmm3
+
+#define XTMP0 %xmm4
+#define XTMP1 %xmm5
+#define XTMP2 %xmm6
+#define XTMP3 %xmm7
 #define XTMP4 %xmm8
 #define XTMP5 %xmm9
@@ -1272 +1672 @@
 
 
-static int Transform_AVX1(wc_Sha256* sha256)
+SHA256_NOINLINE static int Transform_Sha256_AVX1(wc_Sha256* sha256)
 {
-    ALIGN32 word32 W_K[64];  /* temp for W+K */
-
     __asm__ __volatile__ (
 
+        "subq   $64, %%rsp\n\t"
+
+        "leaq   32(%[sha256]), %%rax\n\t"
     Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
-    "# X0, X1, X2, X3 = W[0..15]; \n\t"
-    W_K_from_buff()
-
-    DigestToReg(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
-
-    SET_W_K_XFER(X0, 0)
-    MessageSched(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,0)
-    SET_W_K_XFER(X1, 4)
-    MessageSched(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,4)
-    SET_W_K_XFER(X2, 8)
-    MessageSched(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,8)
-    SET_W_K_XFER(X3, 12)
-    MessageSched(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,12)
-    SET_W_K_XFER(X0, 16)
-    MessageSched(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,16)
-    SET_W_K_XFER(X1, 20)
-    MessageSched(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,20)
-    SET_W_K_XFER(X2, 24)
-    MessageSched(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,24)
-    SET_W_K_XFER(X3, 28)
-    MessageSched(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,28)
-    SET_W_K_XFER(X0, 32)
-    MessageSched(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,32)
-    SET_W_K_XFER(X1, 36)
-    MessageSched(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,36)
-    SET_W_K_XFER(X2, 40)
-    MessageSched(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,40)
-    SET_W_K_XFER(X3, 44)
-    MessageSched(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,44)
-
-    SET_W_K_XFER(X0, 48)
-    SET_W_K_XFER(X1, 52)
-    SET_W_K_XFER(X2, 56)
-    SET_W_K_XFER(X3, 60)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,48)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,49)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,50)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,51)
-
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,52)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,53)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,54)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,55)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,56)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,57)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,58)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,59)
-
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,60)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,61)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,62)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,63)
-
-    RegToDigest(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
+    LOAD_DIGEST()
+
+    W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK)
+
+        "movl   %%r9d, " L4 "\n\t"
+        "movl   %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_K_XFER_4(0)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(16)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(32)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(48)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    STORE_ADD_DIGEST()
+
+        "addq   $64, %%rsp\n\t"
 
         :
@@ -1352 +1720 @@
           [SHUF00BA] "m" (mSHUF_00BA[0]),
           [SHUFDC00] "m" (mSHUF_DC00[0]),
-          [digest]   "m" (sha256->digest),
-          [buf]      "m" (sha256->buffer),
-          [K]        "m" (K),
-          [W_K]      "m" (W_K)
-        : SSE_REGs, "memory"
+          [sha256]   "r" (sha256),
+          [K]        "m" (K)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory"
     );
 
@@ -1362 +1728 @@
 }
 
-#if defined(HAVE_INTEL_RORX)
-static int Transform_AVX1_RORX(wc_Sha256* sha256)
+SHA256_NOINLINE static int Transform_Sha256_AVX1_Len(wc_Sha256* sha256,
+                                                     word32 len)
 {
-    ALIGN32 word32 W_K[64];  /* temp for W+K */
-
     __asm__ __volatile__ (
 
+        "subq   $64, %%rsp\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
     Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
-    "# X0, X1, X2, X3 = W[0..15]; \n\t"
-    W_K_from_buff()
-
-    DigestToReg(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
-
-    SET_W_K_XFER(X0, 0)
-    MessageSched(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5, XFER,
-            SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,0)
-    SET_W_K_XFER(X1, 4)
-    MessageSched_RORX(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,4)
-    SET_W_K_XFER(X2, 8)
-    MessageSched_RORX(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,8)
-    SET_W_K_XFER(X3, 12)
-    MessageSched_RORX(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,12)
-    SET_W_K_XFER(X0, 16)
-    MessageSched_RORX(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,16)
-    SET_W_K_XFER(X1, 20)
-    MessageSched_RORX(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,20)
-    SET_W_K_XFER(X2, 24)
-    MessageSched_RORX(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,24)
-    SET_W_K_XFER(X3, 28)
-    MessageSched_RORX(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,28)
-    SET_W_K_XFER(X0, 32)
-    MessageSched_RORX(X0, X1, X2, X3, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,32)
-    SET_W_K_XFER(X1, 36)
-    MessageSched_RORX(X1, X2, X3, X0, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,36)
-    SET_W_K_XFER(X2, 40)
-    MessageSched_RORX(X2, X3, X0, X1, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,40)
-    SET_W_K_XFER(X3, 44)
-    MessageSched_RORX(X3, X0, X1, X2, XTMP0, XTMP1, XTMP2, XTMP3, XTMP4, XTMP5,
-            XFER, SHUF_00BA, SHUF_DC00, S_4,S_5,S_6,S_7,S_0,S_1,S_2,S_3,44)
-
-    SET_W_K_XFER(X0, 48)
-    SET_W_K_XFER(X1, 52)
-    SET_W_K_XFER(X2, 56)
-    SET_W_K_XFER(X3, 60)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,48)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,49)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,50)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,51)
-
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,52)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,53)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,54)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,55)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,56)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,57)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,58)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,59)
-
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,60)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,61)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,62)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,63)
-
-    RegToDigest(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
+    LOAD_DIGEST()
+
+        "# Start of loop processing a block\n"
+        "1:\n\t"
+
+    W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK)
+
+        "movl   %%r9d, " L4 "\n\t"
+        "movl   %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_K_XFER_4(0)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(16)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(32)
+    MsgSched(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(48)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    ADD_DIGEST()
+
+        "addq   $64, %%rax\n\t"
+        "subl   $64, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "movq   %%rax, 120(%[sha256])\n\t"
+        "jnz    1b\n\t"
+
+        "addq   $64, %%rsp\n\t"
 
         :
@@ -1443 +1789 @@
           [SHUF00BA] "m" (mSHUF_00BA[0]),
           [SHUFDC00] "m" (mSHUF_DC00[0]),
-          [digest]   "m" (sha256->digest),
-          [buf]      "m" (sha256->buffer),
-          [K]        "m" (K),
-          [W_K]      "m" (W_K)
-        : SSE_REGs, "memory"
+          [sha256]   "r" (sha256),
+          [len]      "r" (len),
+          [K]        "m" (K)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory"
     );
 
     return 0;
 }
-#endif  /* HAVE_INTEL_RORX */
 #endif  /* HAVE_INTEL_AVX1 */
 
-
-#if defined(HAVE_INTEL_AVX2)
-
-#define _MOVE_to_REG(ymm, mem, i) \
-    "leaq       %["#mem"], %%r8\n\t" \
-    "vmovdqu ("#i")*4(%%r8), %%"#ymm"\n\t"
-#define _MOVE_to_MEM(mem, i, ymm) \
-    "leaq       %["#mem"], %%r8\n\t" \
-    "vmovdqu %%"#ymm",  "#i"*4(%%r8)\n\t"
-#define _BYTE_SWAP(ymm, map)   \
-    "vpshufb %["#map"], %%"#ymm", %%"#ymm"\n\t"
-#define _MOVE_128(ymm0, ymm1, ymm2, map) \
-    "vperm2i128  $"#map", %%"#ymm2", %%"#ymm1", %%"#ymm0"\n\t"
-#define _MOVE_BYTE(ymm0, ymm1, map) \
-    "vpshufb %["#map"], %%"#ymm1", %%"#ymm0"\n\t"
-#define _S_TEMP(dest, src, bits, temp) \
-    "vpsrld  $"#bits", %%"#src", %%"#dest"\n\t" \
-    "vpslld  $32-"#bits", %%"#src", %%"#temp"\n\t" \
-    "vpor %%"#temp",%%"#dest", %%"#dest"\n\t"
-#define _AVX2_R(dest, src, bits) \
-    "vpsrld  $"#bits", %%"#src", %%"#dest"\n\t"
-#define _XOR(dest, src1, src2) \
-    "vpxor   %%"#src1", %%"#src2", %%"#dest"\n\t"
-#define _OR(dest, src1, src2) \
-    "vpor    %%"#src1", %%"#src2", %%"#dest"\n\t"
-#define _ADD(dest, src1, src2) \
-    "vpaddd   %%"#src1", %%"#src2", %%"#dest"\n\t"
-#define _ADD_MEM(dest, src1, mem, i) \
-    "leaq       %["#mem"], %%r8\n\t" \
-    "vpaddd   "#i"*4(%%r8), %%"#src1", %%"#dest"\n\t"
-#define _BLEND(map, dest, src1, src2) \
-    "vpblendd    $"#map", %%"#src1",   %%"#src2", %%"#dest"\n\t"
-
-#define    _EXTRACT_XMM_0(xmm, mem) \
-    "vpextrd $0, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_1(xmm, mem) \
-    "vpextrd $1, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_2(xmm, mem) \
-    "vpextrd $2, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_3(xmm, mem) \
-    "vpextrd $3, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_4(ymm, xmm, mem) \
-    "vperm2i128 $0x1, %%"#ymm", %%"#ymm", %%"#ymm"\n\t" \
-    "vpextrd $0, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_5(xmm, mem) \
-    "vpextrd $1, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_6(xmm, mem) \
-    "vpextrd $2, %%"#xmm", %["#mem"]\n\t"
-#define    _EXTRACT_XMM_7(xmm, mem) \
-    "vpextrd $3, %%"#xmm", %["#mem"]\n\t"
-
-#define    _SWAP_YMM_HL(ymm)  \
-    "vperm2i128 $0x1, %%"#ymm", %%"#ymm", %%"#ymm"\n\t"
-#define     SWAP_YMM_HL(ymm)   _SWAP_YMM_HL(ymm)
-
-#define MOVE_to_REG(ymm, mem, i)   _MOVE_to_REG(ymm, mem, i)
-#define MOVE_to_MEM(mem, i, ymm)   _MOVE_to_MEM(mem, i, ymm)
-#define BYTE_SWAP(ymm, map)        _BYTE_SWAP(ymm, map)
-#define MOVE_128(ymm0, ymm1, ymm2, map) _MOVE_128(ymm0, ymm1, ymm2, map)
-#define MOVE_BYTE(ymm0, ymm1, map) _MOVE_BYTE(ymm0, ymm1, map)
-#define XOR(dest, src1, src2)      _XOR(dest, src1, src2)
-#define OR(dest, src1, src2)       _OR(dest, src1, src2)
-#define ADD(dest, src1, src2)      _ADD(dest, src1, src2)
-#define ADD_MEM(dest, src1, mem, i)  _ADD_MEM(dest, src1, mem, i)
-#define BLEND(map, dest, src1, src2) _BLEND(map, dest, src1, src2)
-
-#define S_TMP(dest, src, bits, temp) _S_TEMP(dest, src, bits, temp)
-#define AVX2_S(dest, src, bits)      S_TMP(dest, src, bits, S_TEMP)
-#define AVX2_R(dest, src, bits)      _AVX2_R(dest, src, bits)
-
-#define GAMMA0(dest, src)      AVX2_S(dest, src, 7)  AVX2_S(G_TEMP, src, 18) \
-    XOR(dest, G_TEMP, dest) AVX2_R(G_TEMP, src, 3)  XOR(dest, G_TEMP, dest)
-#define GAMMA0_1(dest, src)    AVX2_S(dest, src, 7)  AVX2_S(G_TEMP, src, 18)
-#define GAMMA0_2(dest, src)    XOR(dest, G_TEMP, dest) AVX2_R(G_TEMP, src, 3)  \
-    XOR(dest, G_TEMP, dest)
-
-#define GAMMA1(dest, src)      AVX2_S(dest, src, 17) AVX2_S(G_TEMP, src, 19) \
-    XOR(dest, G_TEMP, dest) AVX2_R(G_TEMP, src, 10) XOR(dest, G_TEMP, dest)
-#define GAMMA1_1(dest, src)    AVX2_S(dest, src, 17) AVX2_S(G_TEMP, src, 19)
-#define GAMMA1_2(dest, src)    XOR(dest, G_TEMP, dest) AVX2_R(G_TEMP, src, 10) \
-    XOR(dest, G_TEMP, dest)
-
-#define    FEEDBACK1_to_W_I_2    MOVE_BYTE(YMM_TEMP0, W_I, MAP1W_2) \
-    BLEND(0x0c, W_I_2, YMM_TEMP0, W_I_2)
-#define    FEEDBACK2_to_W_I_2    MOVE_128(YMM_TEMP0, W_I, W_I, 0x08)  \
-    MOVE_BYTE(YMM_TEMP0, YMM_TEMP0, MAP2W_2) BLEND(0x30, W_I_2, YMM_TEMP0, W_I_2)
-#define    FEEDBACK3_to_W_I_2    MOVE_BYTE(YMM_TEMP0, W_I, MAP3W_2) \
-    BLEND(0xc0, W_I_2, YMM_TEMP0, W_I_2)
-
-#define    FEEDBACK_to_W_I_7     MOVE_128(YMM_TEMP0, W_I, W_I, 0x08)\
-    MOVE_BYTE(YMM_TEMP0, YMM_TEMP0, MAPW_7) BLEND(0x80, W_I_7, YMM_TEMP0, W_I_7)
-
-#undef voitle
-
-#define W_I_16  ymm8
-#define W_I_15  ymm9
-#define W_I_7  ymm10
-#define W_I_2  ymm11
-#define W_I    ymm12
-#define G_TEMP     ymm13
-#define S_TEMP     ymm14
-#define YMM_TEMP0  ymm15
-#define YMM_TEMP0x xmm15
-#define W_I_TEMP   ymm7
-#define W_K_TEMP   ymm15
-#define W_K_TEMPx  xmm15
-
-#define MOVE_15_to_16(w_i_16, w_i_15, w_i_7)\
-    "vperm2i128 $0x01, %%"#w_i_15", %%"#w_i_15", %%"#w_i_15"\n\t" \
-    "vpblendd   $0x08, %%"#w_i_15", %%"#w_i_7",  %%"#w_i_16"\n\t" \
-    "vperm2i128 $0x01, %%"#w_i_7",  %%"#w_i_7",  %%"#w_i_15"\n\t" \
-    "vpblendd   $0x80, %%"#w_i_15", %%"#w_i_16", %%"#w_i_16"\n\t" \
-    "vpshufd    $0x93, %%"#w_i_16", %%"#w_i_16"\n\t"
-
-#define MOVE_7_to_15(w_i_15, w_i_7)\
-    "vmovdqu    %%"#w_i_7",  %%"#w_i_15"\n\t"
-
-#define MOVE_I_to_7(w_i_7, w_i)\
-    "vperm2i128 $0x01, %%"#w_i",   %%"#w_i", %%"#w_i_7"\n\t" \
-    "vpblendd   $0x01, %%"#w_i_7", %%"#w_i", %%"#w_i_7"\n\t" \
-    "vpshufd    $0x39, %%"#w_i_7", %%"#w_i_7"\n\t"
-
-#define MOVE_I_to_2(w_i_2, w_i)\
-    "vperm2i128 $0x01, %%"#w_i", %%"#w_i", %%"#w_i_2"\n\t" \
-    "vpshufd    $0x0e, %%"#w_i_2", %%"#w_i_2"\n\t"
-
-#define ROTATE_W(w_i_16, w_i_15, w_i_7, w_i_2, w_i)\
-    MOVE_15_to_16(w_i_16, w_i_15, w_i_7) \
-    MOVE_7_to_15(w_i_15, w_i_7) \
-    MOVE_I_to_7(w_i_7, w_i) \
-    MOVE_I_to_2(w_i_2, w_i)
-
-#define _DumpS(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-  { word32 d[8];\
-    __asm__ volatile("movl %"#S_0", %0":"=r"(d[0])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_1", %0":"=r"(d[1])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_2", %0":"=r"(d[2])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_3", %0":"=r"(d[3])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_4", %0":"=r"(d[4])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_5", %0":"=r"(d[5])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_6", %0":"=r"(d[6])::SSE_REGs);\
-    __asm__ volatile("movl %"#S_7", %0":"=r"(d[7])::SSE_REGs);\
-        printf("S[0..7]=%08x,%08x,%08x,%08x,%08x,%08x,%08x,%08x\n", d[0],d[1],d[2],d[3],d[4],d[5],d[6],d[7]);\
-    __asm__ volatile("movl %0, %"#S_0::"r"(d[0]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_1::"r"(d[1]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_2::"r"(d[2]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_3::"r"(d[3]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_4::"r"(d[4]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_5::"r"(d[5]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_6::"r"(d[6]):SSE_REGs);\
-    __asm__ volatile("movl %0, %"#S_7::"r"(d[7]):SSE_REGs);\
-}
-
-
-#define DigestToReg(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-    _DigestToReg(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )
-
-#define RegToDigest(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-    _RegToDigest(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )
-
-#define DumS(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )\
-    _DumpS(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7 )
-
-
-    /* Byte swap Masks to ensure that rest of the words are filled with zero's. */
-    static const unsigned long mBYTE_FLIP_MASK_16[] =
-        { 0x0405060700010203, 0x0c0d0e0f08090a0b, 0x0405060700010203, 0x0c0d0e0f08090a0b };
-    static const unsigned long mBYTE_FLIP_MASK_15[] =
-        { 0x0405060700010203, 0x0c0d0e0f08090a0b, 0x0405060700010203, 0x0c0d0e0f08090a0b };
-    static const unsigned long mBYTE_FLIP_MASK_7 [] =
-        { 0x0405060700010203, 0x0c0d0e0f08090a0b, 0x0405060700010203, 0x8080808008090a0b };
-    static const unsigned long mBYTE_FLIP_MASK_2 [] =
-        { 0x0405060700010203, 0x8080808080808080, 0x8080808080808080, 0x8080808080808080 };
-
-    static const unsigned long mMAPtoW_I_7[] =
-        { 0x8080808080808080, 0x8080808080808080, 0x8080808080808080, 0x0302010080808080 };
-    static const unsigned long mMAP1toW_I_2[] =
-        { 0x8080808080808080, 0x0706050403020100, 0x8080808080808080, 0x8080808080808080 };
-    static const unsigned long mMAP2toW_I_2[] =
-        { 0x8080808080808080, 0x8080808080808080, 0x0f0e0d0c0b0a0908, 0x8080808080808080 };
-    static const unsigned long mMAP3toW_I_2[] =
-        { 0x8080808080808080, 0x8080808080808080, 0x8080808080808080, 0x0706050403020100 };
-
-static int Transform_AVX2(wc_Sha256* sha256)
+#if defined(HAVE_INTEL_AVX2) && defined(HAVE_INTEL_RORX)
+SHA256_NOINLINE static int Transform_Sha256_AVX1_RORX(wc_Sha256* sha256)
 {
-#ifdef WOLFSSL_SMALL_STACK
-    word32* W_K;
-    W_K = (word32*) XMALLOC(sizeof(word32) * 64, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    if (W_K == NULL)
-        return MEMORY_E;
-#else
-    word32 W_K[64];
-#endif
-
     __asm__ __volatile__ (
 
-    MOVE_to_REG(W_I_16, buf, 0)     BYTE_SWAP(W_I_16, FLIP_16)
-    MOVE_to_REG(W_I_15, buf, 1)     BYTE_SWAP(W_I_15, FLIP_15)
-    MOVE_to_REG(W_I,    buf, 8)     BYTE_SWAP(W_I,    FLIP_16)
-    MOVE_to_REG(W_I_7,  buf, 16-7)  BYTE_SWAP(W_I_7,  FLIP_7)
-    MOVE_to_REG(W_I_2,  buf, 16-2)  BYTE_SWAP(W_I_2,  FLIP_2)
-
-    DigestToReg(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
-
-    ADD_MEM(W_K_TEMP, W_I_16, K, 0)
-    MOVE_to_MEM(W_K, 0, W_K_TEMP)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,0)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,1)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,2)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,3)
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,4)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,5)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,6)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,7)
-
-    ADD_MEM(YMM_TEMP0, W_I, K, 8)
-    MOVE_to_MEM(W_K, 8, YMM_TEMP0)
-
-    /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,8)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,8)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,8)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,9)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,9)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,9)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,10)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,10)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,10)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,11)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,11)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,11)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,12)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,12)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,12)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,13)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,13)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,13)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,14)
-    GAMMA1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,14)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,14)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,15)
-
-    MOVE_to_REG(YMM_TEMP0, K, 16)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,15)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,15)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 16, YMM_TEMP0)
-
-    /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,16)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,16)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,16)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,17)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,17)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,17)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,18)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,18)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,18)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,19)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,19)
-    GAMMA1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,19)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,20)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,20)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,20)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,21)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,21)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,21)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,22)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,22)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,22)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,23)
-
-    MOVE_to_REG(YMM_TEMP0, K, 24)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,23)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,23)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 24, YMM_TEMP0)
-
-            /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,24)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,24)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,24)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,25)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,25)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,25)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,26)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,26)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,26)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,27)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,27)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,27)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,28)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,28)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,28)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,29)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,29)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,29)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,30)
-    GAMMA1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,30)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,30)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,31)
-
-    MOVE_to_REG(YMM_TEMP0, K, 32)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,31)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,31)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 32, YMM_TEMP0)
-
-
-            /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,32)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,32)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,32)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,33)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,33)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,33)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,34)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,34)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,34)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,35)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,35)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,35)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,36)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,36)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,36)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,37)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,37)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,37)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,38)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,38)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,38)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,39)
-
-    MOVE_to_REG(YMM_TEMP0, K, 40)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,39)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,39)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 40, YMM_TEMP0)
-
-            /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,40)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,40)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,40)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,41)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,41)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,41)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,42)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,42)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,42)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,43)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,43)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,43)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,44)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,44)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,44)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,45)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,45)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,45)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,46)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,46)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,46)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,47)
-
-    MOVE_to_REG(YMM_TEMP0, K, 48)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,47)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,47)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 48, YMM_TEMP0)
-
-            /* W[i] = Gamma1(W[i-2]) + W[i-7] + Gamma0(W[i-15] + W[i-16]) */
-            RND_0_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,48)
-    GAMMA0_1(W_I_TEMP, W_I_15)
-            RND_0_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,48)
-    GAMMA0_2(W_I_TEMP, W_I_15)
-            RND_0_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,48)
-    ADD(W_I_TEMP, W_I_16, W_I_TEMP)/* for saving W_I before adding incomplete W_I_7 */
-            RND_7_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,49)
-    ADD(W_I, W_I_7, W_I_TEMP)
-            RND_7_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,49)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_7_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,49)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_6_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,50)
-    ADD(W_I, W_I, YMM_TEMP0)/* now W[16..17] are completed */
-            RND_6_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,50)
-    FEEDBACK1_to_W_I_2
-            RND_6_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,50)
-    FEEDBACK_to_W_I_7
-            RND_5_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,51)
-    ADD(W_I_TEMP, W_I_7, W_I_TEMP)
-            RND_5_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,51)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_5_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,51)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_4_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,52)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0)/* now W[16..19] are completed */
-            RND_4_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,52)
-    FEEDBACK2_to_W_I_2
-            RND_4_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,52)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_3_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,53)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_3_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,53)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..21] are completed */
-            RND_3_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,53)
-    FEEDBACK3_to_W_I_2
-            RND_2_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,54)
-    GAMMA1_1(YMM_TEMP0, W_I_2)
-            RND_2_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,54)
-    GAMMA1_2(YMM_TEMP0, W_I_2)
-            RND_2_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,54)
-    ADD(W_I, W_I_TEMP, YMM_TEMP0) /* now W[16..23] are completed */
-            RND_1_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,55)
-
-    MOVE_to_REG(YMM_TEMP0, K, 56)
-            RND_1_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,55)
-    ROTATE_W(W_I_16, W_I_15, W_I_7, W_I_2, W_I)
-            RND_1_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,55)
-    ADD(YMM_TEMP0, YMM_TEMP0, W_I)
-    MOVE_to_MEM(W_K, 56, YMM_TEMP0)
-
-    RND_0(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,56)
-    RND_7(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,57)
-    RND_6(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,58)
-    RND_5(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,59)
-
-    RND_4(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,60)
-    RND_3(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,61)
-    RND_2(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,62)
-    RND_1(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7,63)
-
-    RegToDigest(S_0,S_1,S_2,S_3,S_4,S_5,S_6,S_7)
+        "subq   $64, %%rsp\n\t"
+
+    Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
+        "leaq   32(%[sha256]), %%rax\n\t"
+    W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK)
+
+    LOAD_DIGEST()
+
+    SET_W_K_XFER_4(0)
+        "movl   %%r9d, " L4 "\n\t"
+        "rorx   $6, %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(16)
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(32)
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(48)
+        "xorl   " L3 ", " L3 "\n\t"
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addl   " L3 ", %%r8d\n\t"
+
+    STORE_ADD_DIGEST()
+
+        "addq   $64, %%rsp\n\t"
 
         :
-        : [FLIP_16] "m" (mBYTE_FLIP_MASK_16[0]),
-          [FLIP_15] "m" (mBYTE_FLIP_MASK_15[0]),
-          [FLIP_7]  "m" (mBYTE_FLIP_MASK_7[0]),
-          [FLIP_2]  "m" (mBYTE_FLIP_MASK_2),
-          [MAPW_7]  "m" (mMAPtoW_I_7[0]),
-          [MAP1W_2] "m" (mMAP1toW_I_2[0]),
-          [MAP2W_2] "m" (mMAP2toW_I_2[0]),
-          [MAP3W_2] "m" (mMAP3toW_I_2[0]),
-          [digest]  "m" (sha256->digest),
-          [buf]     "m" (sha256->buffer),
-          [K]       "m" (K),
-          [W_K]     "m" (W_K)
-        : SSE_REGs, "memory"
+        : [FLIP]     "m" (mBYTE_FLIP_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_DC00[0]),
+          [sha256]   "r" (sha256),
+          [K]        "m" (K)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory"
     );
-
-#ifdef WOLFSSL_SMALL_STACK
-    XFREE(W_K, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-#endif
 
     return 0;
 }
 
-#endif   /* HAVE_INTEL_AVX2 */
+SHA256_NOINLINE static int Transform_Sha256_AVX1_RORX_Len(wc_Sha256* sha256,
+                                                          word32 len)
+{
+    __asm__ __volatile__ (
+
+        "subq   $64, %%rsp\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    Init_Masks(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
+    LOAD_DIGEST()
+
+        "# Start of loop processing a block\n"
+        "1:\n\t"
+
+    W_K_from_buff(X0, X1, X2, X3, BYTE_FLIP_MASK)
+
+    SET_W_K_XFER_4(0)
+        "movl   %%r9d, " L4 "\n\t"
+        "rorx   $6, %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(16)
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(32)
+    MsgSched_RORX(X0, X1, X2, X3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_RORX(X1, X2, X3, X0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    MsgSched_RORX(X2, X3, X0, X1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    MsgSched_RORX(X3, X0, X1, X2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+
+    SET_W_K_XFER_4(48)
+        "xorl   " L3 ", " L3 "\n\t"
+        "xorl   " L2 ", " L2 "\n\t"
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  4)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  8)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 12)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addl   " L3 ", %%r8d\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    ADD_DIGEST()
+
+        "addq   $64, %%rax\n\t"
+        "subl   $64, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "movq   %%rax, 120(%[sha256])\n\t"
+        "jnz    1b\n\t"
+
+        "addq   $64, %%rsp\n\t"
+
+        :
+        : [FLIP]     "m" (mBYTE_FLIP_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_DC00[0]),
+          [sha256]   "r" (sha256),
+          [len]      "r" (len),
+          [K]        "m" (K)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory"
+    );
+
+    return 0;
+}
+#endif /* HAVE_INTEL_AVX2 && HAVE_INTEL_RORX */
+
+
+#if defined(HAVE_INTEL_AVX2)
+#define Y0 %ymm0
+#define Y1 %ymm1
+#define Y2 %ymm2
+#define Y3 %ymm3
+
+#define YTMP0 %ymm4
+#define YTMP1 %ymm5
+#define YTMP2 %ymm6
+#define YTMP3 %ymm7
+#define YTMP4 %ymm8
+#define YTMP5 %ymm9
+#define YXFER %ymm10
+
+#define SHUF_Y_00BA       %ymm11 /* shuffle xBxA -> 00BA */
+#define SHUF_Y_DC00       %ymm12 /* shuffle xDxC -> DC00 */
+#define BYTE_FLIP_Y_MASK  %ymm13
+
+#define YMM_REGS "ymm0", "ymm1", "ymm2", "ymm3", "ymm4", "ymm5", "ymm6", \
+                 "ymm7", "ymm8", "ymm9", "ymm10", "ymm11", "ymm12", "ymm13"
+
+#define MsgSched_Y(Y0,Y1,Y2,Y3,a,b,c,d,e,f,g,h,_i)                            \
+            RND_STEP_0_1(a,b,c,d,e,f,g,h,_i)                                  \
+    VPALIGNR (YTMP1, Y1, Y0, 4)    /* YTMP1 = W[-15] */                       \
+    VPALIGNR (YTMP0, Y3, Y2, 4)    /* YTMP0 = W[-7] */                        \
+            RND_STEP_0_2(a,b,c,d,e,f,g,h,_i)                                  \
+            RND_STEP_0_3(a,b,c,d,e,f,g,h,_i)                                  \
+    VPSRLD   (YTMP2, YTMP1, 7)     /* YTMP2 = W[-15] >> 7 */                  \
+    VPSLLD   (YTMP3, YTMP1, 25)    /* YTEMP3 = W[-15] << (32-7) */            \
+            RND_STEP_0_4(a,b,c,d,e,f,g,h,_i)                                  \
+            RND_STEP_0_5(a,b,c,d,e,f,g,h,_i)                                  \
+    VPSRLD   (YTMP4, YTMP1, 18)    /* YTEMP4 = W[-15] >> 18 */                \
+    VPSLLD   (YTMP5, YTMP1, 14)    /* YTEMP5 = W[-15] << (32-18) */           \
+            RND_STEP_0_6(a,b,c,d,e,f,g,h,_i)                                  \
+            RND_STEP_0_7(a,b,c,d,e,f,g,h,_i)                                  \
+    VPOR     (YTMP2, YTMP3, YTMP2) /* YTMP2 = W[-15] >>> 7 */                 \
+    VPOR     (YTMP4, YTMP5, YTMP4) /* YTMP4 = W[-15] >>> 18 */                \
+            RND_STEP_0_8(a,b,c,d,e,f,g,h,_i)                                  \
+            RND_STEP_1_1(h,a,b,c,d,e,f,g,_i+1)                                \
+            RND_STEP_1_2(h,a,b,c,d,e,f,g,_i+1)                                \
+    VPSRLD   (YTMP5, YTMP1, 3)     /* YTMP4 = W[-15] >> 3 */                  \
+    VPXOR    (YTMP2, YTMP4, YTMP2) /* YTMP2 = W[-15] >>> 7 ^ W[-15] >>> 18 */ \
+            RND_STEP_1_3(h,a,b,c,d,e,f,g,_i+1)                                \
+            RND_STEP_1_4(h,a,b,c,d,e,f,g,_i+1)                                \
+    VPXOR    (YTMP1, YTMP5, YTMP2)  /* YTMP1 = s0 */                          \
+    VPSHUFD  (YTMP2, Y3, 0b11111010)  /* YTMP2 = W[-2] {BBAA}*/               \
+            RND_STEP_1_5(h,a,b,c,d,e,f,g,_i+1)                                \
+            RND_STEP_1_6(h,a,b,c,d,e,f,g,_i+1)                                \
+    VPSRLD   (YTMP4, YTMP2, 10)      /* YTMP4 = W[-2] >> 10 {BBAA} */         \
+    VPSRLQ   (YTMP3, YTMP2, 19)      /* YTMP3 = W[-2] MY_ROR 19 {xBxA} */     \
+            RND_STEP_1_7(h,a,b,c,d,e,f,g,_i+1)                                \
+            RND_STEP_1_8(h,a,b,c,d,e,f,g,_i+1)                                \
+            RND_STEP_0_1(g,h,a,b,c,d,e,f,_i+2)                                \
+    VPSRLQ   (YTMP2, YTMP2, 17)      /* YTMP2 = W[-2] MY_ROR 17 {xBxA} */     \
+    VPADDD   (YTMP0, YTMP0, Y0)                                               \
+            RND_STEP_0_2(g,h,a,b,c,d,e,f,_i+2)                                \
+            RND_STEP_0_3(g,h,a,b,c,d,e,f,_i+2)                                \
+            RND_STEP_0_4(g,h,a,b,c,d,e,f,_i+2)                                \
+    VPXOR    (YTMP2, YTMP3, YTMP2)                                            \
+    VPADDD   (YTMP0, YTMP0, YTMP1)  /* YTMP0 = W[-16] + W[-7] + s0 */         \
+            RND_STEP_0_5(g,h,a,b,c,d,e,f,_i+2)                                \
+    VPXOR    (YTMP4, YTMP4, YTMP2)   /* YTMP4 = s1 {xBxA} */                  \
+            RND_STEP_0_6(g,h,a,b,c,d,e,f,_i+2)                                \
+    VPSHUFB  (YTMP4, YTMP4, SHUF_Y_00BA)  /* YTMP4 = s1 {00BA} */             \
+            RND_STEP_0_7(g,h,a,b,c,d,e,f,_i+2)                                \
+    VPADDD   (YTMP0, YTMP0, YTMP4)  /* YTMP0 = {..., ..., W[1], W[0]} */      \
+            RND_STEP_0_8(g,h,a,b,c,d,e,f,_i+2)                                \
+            RND_STEP_1_1(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPSHUFD  (YTMP2, YTMP0, 0b01010000) /* YTMP2 = W[-2] {DDCC} */            \
+            RND_STEP_1_2(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPSRLQ   (YTMP4, YTMP2, 17)      /* YTMP4 = W[-2] MY_ROR 17 {xDxC} */     \
+    VPSRLQ   (YTMP3, YTMP2, 19)       /* YTMP3 = W[-2] MY_ROR 19 {xDxC} */    \
+            RND_STEP_1_3(f,g,h,a,b,c,d,e,_i+3)                                \
+            RND_STEP_1_4(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPSRLD   (YTMP5, YTMP2, 10)       /* YTMP5 = W[-2] >> 10 {DDCC} */        \
+    VPXOR    (YTMP4, YTMP3, YTMP4)                                            \
+            RND_STEP_1_5(f,g,h,a,b,c,d,e,_i+3)                                \
+            RND_STEP_1_6(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPXOR    (YTMP5, YTMP4, YTMP5)   /* YTMP5 = s1 {xDxC} */                  \
+            RND_STEP_1_7(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPSHUFB  (YTMP5, YTMP5, SHUF_Y_DC00) /* YTMP5 = s1 {DC00} */              \
+            RND_STEP_1_8(f,g,h,a,b,c,d,e,_i+3)                                \
+    VPADDD   (Y0, YTMP5, YTMP0)      /* Y0 = {W[3], W[2], W[1], W[0]} */
+
+#if defined(HAVE_INTEL_RORX)
+
+#define MsgSched_Y_RORX(Y0,Y1,Y2,Y3,a,b,c,d,e,f,g,h,_i)                       \
+            RND_STEP_RORX_0_1(a,b,c,d,e,f,g,h,_i)                             \
+    VPALIGNR (YTMP1, Y1, Y0, 4)    /* YTMP1 = W[-15] */                       \
+            RND_STEP_RORX_0_2(a,b,c,d,e,f,g,h,_i)                             \
+    VPALIGNR (YTMP0, Y3, Y2, 4)    /* YTMP0 = W[-7] */                        \
+            RND_STEP_RORX_0_3(a,b,c,d,e,f,g,h,_i)                             \
+    VPSRLD   (YTMP2, YTMP1, 7)     /* YTMP2 = W[-15] >> 7 */                  \
+            RND_STEP_RORX_0_4(a,b,c,d,e,f,g,h,_i)                             \
+    VPSLLD   (YTMP3, YTMP1, 25)    /* YTEMP3 = W[-15] << (32-7) */            \
+            RND_STEP_RORX_0_5(a,b,c,d,e,f,g,h,_i)                             \
+    VPSRLD   (YTMP4, YTMP1, 18)    /* YTEMP4 = W[-15] >> 18 */                \
+            RND_STEP_RORX_0_6(a,b,c,d,e,f,g,h,_i)                             \
+    VPSLLD   (YTMP5, YTMP1, 14)    /* YTEMP5 = W[-15] << (32-18) */           \
+            RND_STEP_RORX_0_7(a,b,c,d,e,f,g,h,_i)                             \
+    VPOR     (YTMP2, YTMP2, YTMP3) /* YTMP2 = W[-15] >>> 7 */                 \
+            RND_STEP_RORX_0_8(a,b,c,d,e,f,g,h,_i)                             \
+    VPOR     (YTMP4, YTMP4, YTMP5) /* YTMP4 = W[-15] >>> 18 */                \
+            RND_STEP_RORX_1_1(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPSRLD   (YTMP5, YTMP1, 3)     /* YTMP4 = W[-15] >> 3 */                  \
+            RND_STEP_RORX_1_2(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPXOR    (YTMP2, YTMP2, YTMP4) /* YTMP2 = W[-15] >>> 7 ^ W[-15] >>> 18 */ \
+            RND_STEP_RORX_1_3(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPSHUFD  (YTMP3, Y3, 0b11111010)  /* YTMP2 = W[-2] {BBAA}*/               \
+            RND_STEP_RORX_1_4(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPXOR    (YTMP1, YTMP5, YTMP2)  /* YTMP1 = s0 */                          \
+            RND_STEP_RORX_1_5(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPSRLD   (YTMP4, YTMP3, 10)      /* YTMP4 = W[-2] >> 10 {BBAA} */         \
+            RND_STEP_RORX_1_6(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPSRLQ   (YTMP2, YTMP3, 19)      /* YTMP3 = W[-2] MY_ROR 19 {xBxA} */     \
+            RND_STEP_RORX_1_7(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPSRLQ   (YTMP3, YTMP3, 17)      /* YTMP2 = W[-2] MY_ROR 17 {xBxA} */     \
+            RND_STEP_RORX_1_8(h,a,b,c,d,e,f,g,_i+1)                           \
+    VPADDD   (YTMP0, YTMP0, Y0)                                               \
+            RND_STEP_RORX_0_1(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPXOR    (YTMP2, YTMP2, YTMP3)                                            \
+            RND_STEP_RORX_0_2(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPXOR    (YTMP4, YTMP4, YTMP2)   /* YTMP4 = s1 {xBxA} */                  \
+            RND_STEP_RORX_0_3(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPADDD   (YTMP0, YTMP0, YTMP1)  /* YTMP0 = W[-16] + W[-7] + s0 */         \
+            RND_STEP_RORX_0_4(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPSHUFB  (YTMP4, YTMP4, SHUF_Y_00BA)  /* YTMP4 = s1 {00BA} */             \
+            RND_STEP_RORX_0_5(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPADDD   (YTMP0, YTMP0, YTMP4)  /* YTMP0 = {..., ..., W[1], W[0]} */      \
+            RND_STEP_RORX_0_6(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPSHUFD  (YTMP2, YTMP0, 0b01010000) /* YTMP2 = W[-2] {DDCC} */            \
+            RND_STEP_RORX_0_7(g,h,a,b,c,d,e,f,_i+2)                           \
+            RND_STEP_RORX_0_8(g,h,a,b,c,d,e,f,_i+2)                           \
+    VPSRLQ   (YTMP4, YTMP2, 17)      /* YTMP4 = W[-2] MY_ROR 17 {xDxC} */     \
+            RND_STEP_RORX_1_1(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPSRLQ   (YTMP3, YTMP2, 19)       /* YTMP3 = W[-2] MY_ROR 19 {xDxC} */    \
+            RND_STEP_RORX_1_2(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPSRLD   (YTMP5, YTMP2, 10)       /* YTMP5 = W[-2] >> 10 {DDCC} */        \
+            RND_STEP_RORX_1_3(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPXOR    (YTMP4, YTMP4, YTMP3)                                            \
+            RND_STEP_RORX_1_4(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPXOR    (YTMP5, YTMP5, YTMP4)   /* YTMP5 = s1 {xDxC} */                  \
+            RND_STEP_RORX_1_5(f,g,h,a,b,c,d,e,_i+3)                           \
+            RND_STEP_RORX_1_6(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPSHUFB  (YTMP5, YTMP5, SHUF_Y_DC00) /* YTMP5 = s1 {DC00} */              \
+            RND_STEP_RORX_1_7(f,g,h,a,b,c,d,e,_i+3)                           \
+            RND_STEP_RORX_1_8(f,g,h,a,b,c,d,e,_i+3)                           \
+    VPADDD   (Y0, YTMP5, YTMP0)      /* Y0 = {W[3], W[2], W[1], W[0]} */      \
+
+#endif /* HAVE_INTEL_RORX */
+
+#define _VINSERTI128(op1,op2,op3,op4) \
+    "vinserti128        $" #op4 ", %" #op3 ", %" #op2 ", %" #op1 "\n\t"
+#define VINSERTI128(op1,op2,op3,op4)  \
+       _VINSERTI128(op1,op2,op3,op4)
+
+
+#define _LOAD_W_K_LOW(BYTE_FLIP_MASK, reg)   \
+    "# X0, X1, X2, X3 = W[0..15]\n\t"        \
+    "vmovdqu      (%%" #reg "), %%xmm0\n\t"  \
+    "vmovdqu    16(%%" #reg "), %%xmm1\n\t"  \
+    VPSHUFB(X0, X0, BYTE_FLIP_MASK)          \
+    VPSHUFB(X1, X1, BYTE_FLIP_MASK)          \
+    "vmovdqu    32(%%" #reg "), %%xmm2\n\t"  \
+    "vmovdqu    48(%%" #reg "), %%xmm3\n\t"  \
+    VPSHUFB(X2, X2, BYTE_FLIP_MASK)          \
+    VPSHUFB(X3, X3, BYTE_FLIP_MASK)
+
+#define LOAD_W_K_LOW(BYTE_FLIP_MASK, reg) \
+       _LOAD_W_K_LOW(BYTE_FLIP_MASK, reg)
+
+
+#define _LOAD_W_K(BYTE_FLIP_Y_MASK, reg)      \
+    "# X0, X1, X2, X3 = W[0..15]\n\t"         \
+    "vmovdqu       (%%" #reg "), %%xmm0\n\t"  \
+    "vmovdqu     16(%%" #reg "), %%xmm1\n\t"  \
+    "vmovdqu     64(%%" #reg "), %%xmm4\n\t"  \
+    "vmovdqu     80(%%" #reg "), %%xmm5\n\t"  \
+    VINSERTI128(Y0, Y0, XTMP0, 1)             \
+    VINSERTI128(Y1, Y1, XTMP1, 1)             \
+    VPSHUFB(Y0, Y0, BYTE_FLIP_Y_MASK)         \
+    VPSHUFB(Y1, Y1, BYTE_FLIP_Y_MASK)         \
+    "vmovdqu     32(%%" #reg "), %%xmm2\n\t"  \
+    "vmovdqu     48(%%" #reg "), %%xmm3\n\t"  \
+    "vmovdqu     96(%%" #reg "), %%xmm6\n\t"  \
+    "vmovdqu    112(%%" #reg "), %%xmm7\n\t"  \
+    VINSERTI128(Y2, Y2, XTMP2, 1)             \
+    VINSERTI128(Y3, Y3, XTMP3, 1)             \
+    VPSHUFB(Y2, Y2, BYTE_FLIP_Y_MASK)         \
+    VPSHUFB(Y3, Y3, BYTE_FLIP_Y_MASK)
+
+#define LOAD_W_K(BYTE_FLIP_Y_MASK, reg) \
+       _LOAD_W_K(BYTE_FLIP_Y_MASK, reg)
+
+
+#define _SET_W_Y_4(i)  \
+    "vpaddd     (" #i "*8)+ 0+%[K], %%ymm0, %%ymm4\n\t" \
+    "vpaddd     (" #i "*8)+32+%[K], %%ymm1, %%ymm5\n\t" \
+    "vmovdqu    %%ymm4, (" #i "*8)+ 0(" WK ")\n\t"      \
+    "vmovdqu    %%ymm5, (" #i "*8)+32(" WK ")\n\t"      \
+    "vpaddd     (" #i "*8)+64+%[K], %%ymm2, %%ymm4\n\t" \
+    "vpaddd     (" #i "*8)+96+%[K], %%ymm3, %%ymm5\n\t" \
+    "vmovdqu    %%ymm4, (" #i "*8)+64(" WK ")\n\t"      \
+    "vmovdqu    %%ymm5, (" #i "*8)+96(" WK ")\n\t"
+
+#define SET_W_Y_4(i) \
+       _SET_W_Y_4(i)
+
+
+static const ALIGN32 word64 mSHUF_Y_00BA[] =
+    { 0x0b0a090803020100, 0xFFFFFFFFFFFFFFFF,
+      0x0b0a090803020100, 0xFFFFFFFFFFFFFFFF }; /* shuffle xBxA -> 00BA */
+static const ALIGN32 word64 mSHUF_Y_DC00[] =
+    { 0xFFFFFFFFFFFFFFFF, 0x0b0a090803020100,
+      0xFFFFFFFFFFFFFFFF, 0x0b0a090803020100 }; /* shuffle xDxC -> DC00 */
+static const ALIGN32 word64 mBYTE_FLIP_Y_MASK[] =
+    { 0x0405060700010203, 0x0c0d0e0f08090a0b,
+      0x0405060700010203, 0x0c0d0e0f08090a0b };
+
+#define _INIT_MASKS_Y(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00) \
+    "vmovdqa    %[FLIP], %" #BYTE_FLIP_MASK "\n\t"          \
+    "vmovdqa    %[SHUF00BA], %" #SHUF_00BA "\n\t"           \
+    "vmovdqa    %[SHUFDC00], %" #SHUF_DC00 "\n\t"
+
+#define INIT_MASKS_Y(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00) \
+       _INIT_MASKS_Y(BYTE_FLIP_MASK, SHUF_00BA, SHUF_DC00)
+
+static const ALIGN32 word32 K256[128] = {
+    0x428A2F98L, 0x71374491L, 0xB5C0FBCFL, 0xE9B5DBA5L,
+    0x428A2F98L, 0x71374491L, 0xB5C0FBCFL, 0xE9B5DBA5L,
+    0x3956C25BL, 0x59F111F1L, 0x923F82A4L, 0xAB1C5ED5L,
+    0x3956C25BL, 0x59F111F1L, 0x923F82A4L, 0xAB1C5ED5L,
+    0xD807AA98L, 0x12835B01L, 0x243185BEL, 0x550C7DC3L,
+    0xD807AA98L, 0x12835B01L, 0x243185BEL, 0x550C7DC3L,
+    0x72BE5D74L, 0x80DEB1FEL, 0x9BDC06A7L, 0xC19BF174L,
+    0x72BE5D74L, 0x80DEB1FEL, 0x9BDC06A7L, 0xC19BF174L,
+    0xE49B69C1L, 0xEFBE4786L, 0x0FC19DC6L, 0x240CA1CCL,
+    0xE49B69C1L, 0xEFBE4786L, 0x0FC19DC6L, 0x240CA1CCL,
+    0x2DE92C6FL, 0x4A7484AAL, 0x5CB0A9DCL, 0x76F988DAL,
+    0x2DE92C6FL, 0x4A7484AAL, 0x5CB0A9DCL, 0x76F988DAL,
+    0x983E5152L, 0xA831C66DL, 0xB00327C8L, 0xBF597FC7L,
+    0x983E5152L, 0xA831C66DL, 0xB00327C8L, 0xBF597FC7L,
+    0xC6E00BF3L, 0xD5A79147L, 0x06CA6351L, 0x14292967L,
+    0xC6E00BF3L, 0xD5A79147L, 0x06CA6351L, 0x14292967L,
+    0x27B70A85L, 0x2E1B2138L, 0x4D2C6DFCL, 0x53380D13L,
+    0x27B70A85L, 0x2E1B2138L, 0x4D2C6DFCL, 0x53380D13L,
+    0x650A7354L, 0x766A0ABBL, 0x81C2C92EL, 0x92722C85L,
+    0x650A7354L, 0x766A0ABBL, 0x81C2C92EL, 0x92722C85L,
+    0xA2BFE8A1L, 0xA81A664BL, 0xC24B8B70L, 0xC76C51A3L,
+    0xA2BFE8A1L, 0xA81A664BL, 0xC24B8B70L, 0xC76C51A3L,
+    0xD192E819L, 0xD6990624L, 0xF40E3585L, 0x106AA070L,
+    0xD192E819L, 0xD6990624L, 0xF40E3585L, 0x106AA070L,
+    0x19A4C116L, 0x1E376C08L, 0x2748774CL, 0x34B0BCB5L,
+    0x19A4C116L, 0x1E376C08L, 0x2748774CL, 0x34B0BCB5L,
+    0x391C0CB3L, 0x4ED8AA4AL, 0x5B9CCA4FL, 0x682E6FF3L,
+    0x391C0CB3L, 0x4ED8AA4AL, 0x5B9CCA4FL, 0x682E6FF3L,
+    0x748F82EEL, 0x78A5636FL, 0x84C87814L, 0x8CC70208L,
+    0x748F82EEL, 0x78A5636FL, 0x84C87814L, 0x8CC70208L,
+    0x90BEFFFAL, 0xA4506CEBL, 0xBEF9A3F7L, 0xC67178F2L,
+    0x90BEFFFAL, 0xA4506CEBL, 0xBEF9A3F7L, 0xC67178F2L
+};
+
+SHA256_NOINLINE static int Transform_Sha256_AVX2(wc_Sha256* sha256)
+{
+    __asm__ __volatile__ (
+
+        "subq   $512, %%rsp\n\t"
+        "leaq   32(%[sha256]), %%rax\n\t"
+
+    INIT_MASKS_Y(BYTE_FLIP_MASK, SHUF_Y_00BA, SHUF_Y_DC00)
+    LOAD_DIGEST()
+
+    LOAD_W_K_LOW(BYTE_FLIP_MASK, rax)
+
+        "movl   %%r9d, " L4 "\n\t"
+        "movl   %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_Y_4(0)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  8)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 16)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 24)
+
+    SET_W_Y_4(16)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 32)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 40)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 48)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 56)
+
+    SET_W_Y_4(32)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 64)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 72)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 80)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 88)
+
+    SET_W_Y_4(48)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  96)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 104)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 112)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 120)
+
+    STORE_ADD_DIGEST()
+
+        "addq   $512, %%rsp\n\t"
+
+        :
+        : [FLIP]     "m" (mBYTE_FLIP_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_Y_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_Y_DC00[0]),
+          [sha256]   "r" (sha256),
+          [K]        "m" (K256)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory"
+    );
+
+    return 0;
+}
+
+SHA256_NOINLINE static int Transform_Sha256_AVX2_Len(wc_Sha256* sha256,
+                                                     word32 len)
+{
+    if ((len & WC_SHA256_BLOCK_SIZE) != 0) {
+        XMEMCPY(sha256->buffer, sha256->data, WC_SHA256_BLOCK_SIZE);
+        Transform_Sha256_AVX2(sha256);
+        sha256->data += WC_SHA256_BLOCK_SIZE;
+        len -= WC_SHA256_BLOCK_SIZE;
+        if (len == 0)
+    return 0;
+}
+
+    __asm__ __volatile__ (
+
+        "subq   $512, %%rsp\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    INIT_MASKS_Y(BYTE_FLIP_Y_MASK, SHUF_Y_00BA, SHUF_Y_DC00)
+    LOAD_DIGEST()
+
+        "# Start of loop processing two blocks\n"
+        "1:\n\t"
+
+    LOAD_W_K(BYTE_FLIP_Y_MASK, rax)
+
+        "movl   %%r9d, " L4 "\n\t"
+        "movl   %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_Y_4(0)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  8)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 16)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 24)
+
+    SET_W_Y_4(16)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 32)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 40)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 48)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 56)
+
+    SET_W_Y_4(32)
+    MsgSched_Y(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 64)
+    MsgSched_Y(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 72)
+    MsgSched_Y(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 80)
+    MsgSched_Y(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 88)
+
+    SET_W_Y_4(48)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  96)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 104)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 112)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 120)
+
+    ADD_DIGEST()
+    STORE_DIGEST()
+
+        "movl   %%r9d, " L4 "\n\t"
+        "movl   %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,   4)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  12)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  20)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  28)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  36)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  44)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  52)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  60)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  68)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  76)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  84)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  92)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 100)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 108)
+    RND_ALL_4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 116)
+    RND_ALL_4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 124)
+
+    ADD_DIGEST()
+
+        "movq   120(%[sha256]), %%rax\n\t"
+        "addq   $128, %%rax\n\t"
+        "subl   $128, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "movq   %%rax, 120(%[sha256])\n\t"
+        "jnz    1b\n\t"
+
+        "addq   $512, %%rsp\n\t"
+
+        :
+        : [FLIP]     "m" (mBYTE_FLIP_Y_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_Y_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_Y_DC00[0]),
+          [sha256]   "r" (sha256),
+          [len]      "r" (len),
+          [K]        "m" (K256)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory"
+    );
+
+    return 0;
+        }
+
+#if defined(HAVE_INTEL_RORX)
+SHA256_NOINLINE static int Transform_Sha256_AVX2_RORX(wc_Sha256* sha256)
+{
+    __asm__ __volatile__ (
+
+        "subq   $512, %%rsp\n\t"
+        "leaq   32(%[sha256]), %%rax\n\t"
+
+    INIT_MASKS_Y(BYTE_FLIP_MASK, SHUF_Y_00BA, SHUF_Y_DC00)
+    LOAD_W_K_LOW(BYTE_FLIP_MASK, rax)
+
+    LOAD_DIGEST()
+
+        "movl   %%r9d, " L4 "\n\t"
+        "rorx   $6, %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_Y_4(0)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  8)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 16)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 24)
+
+    SET_W_Y_4(16)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 32)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 40)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 48)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 56)
+
+    SET_W_Y_4(32)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 64)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 72)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 80)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 88)
+
+    SET_W_Y_4(48)
+        "xorl   " L3 ", " L3 "\n\t"
+        "xorl   " L2 ", " L2 "\n\t"
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  96)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 104)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 112)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 120)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addl   " L3 ", %%r8d\n\t"
+
+    STORE_ADD_DIGEST()
+
+        "addq   $512, %%rsp\n\t"
+
+        :
+        : [FLIP]     "m" (mBYTE_FLIP_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_Y_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_Y_DC00[0]),
+          [sha256]   "r" (sha256),
+          [K]        "m" (K256)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory"
+    );
+
+        return 0;
+    }
+
+SHA256_NOINLINE static int Transform_Sha256_AVX2_RORX_Len(wc_Sha256* sha256,
+                                                          word32 len)
+    {
+    if ((len & WC_SHA256_BLOCK_SIZE) != 0) {
+        XMEMCPY(sha256->buffer, sha256->data, WC_SHA256_BLOCK_SIZE);
+        Transform_Sha256_AVX2_RORX(sha256);
+        sha256->data += WC_SHA256_BLOCK_SIZE;
+        len -= WC_SHA256_BLOCK_SIZE;
+        if (len == 0)
+            return 0;
+    }
+
+    __asm__ __volatile__ (
+
+        "subq   $512, %%rsp\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    INIT_MASKS_Y(BYTE_FLIP_Y_MASK, SHUF_Y_00BA, SHUF_Y_DC00)
+    LOAD_DIGEST()
+
+        "# Start of loop processing two blocks\n"
+        "1:\n\t"
+
+    LOAD_W_K(BYTE_FLIP_Y_MASK, rax)
+
+        "movl   %%r9d, " L4 "\n\t"
+        "rorx   $6, %%r12d, " L1 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    SET_W_Y_4(0)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  0)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  8)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 16)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 24)
+
+    SET_W_Y_4(16)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 32)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 40)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 48)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 56)
+
+    SET_W_Y_4(32)
+    MsgSched_Y_RORX(Y0, Y1, Y2, Y3, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 64)
+    MsgSched_Y_RORX(Y1, Y2, Y3, Y0, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 72)
+    MsgSched_Y_RORX(Y2, Y3, Y0, Y1, S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 80)
+    MsgSched_Y_RORX(Y3, Y0, Y1, Y2, S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 88)
+
+    SET_W_Y_4(48)
+        "xorl   " L3 ", " L3 "\n\t"
+        "xorl   " L2 ", " L2 "\n\t"
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  96)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 104)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 112)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 120)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addl   " L3 ", %%r8d\n\t"
+        "xorl   " L2 ", " L2 "\n\t"
+
+    ADD_DIGEST()
+    STORE_DIGEST()
+
+        "movl   %%r9d, " L4 "\n\t"
+        "xorl   " L3 ", " L3 "\n\t"
+        "xorl   %%r10d, " L4 "\n\t"
+
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,   4)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  12)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  20)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  28)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  36)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  44)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  52)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  60)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  68)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  76)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7,  84)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3,  92)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 100)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 108)
+    RND_RORX_X4(S_0, S_1, S_2, S_3, S_4, S_5, S_6, S_7, 116)
+    RND_RORX_X4(S_4, S_5, S_6, S_7, S_0, S_1, S_2, S_3, 124)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addl   " L3 ", %%r8d\n\t"
+        "movq   120(%[sha256]), %%rax\n\t"
+
+    ADD_DIGEST()
+
+        "addq   $128, %%rax\n\t"
+        "subl   $128, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "movq   %%rax, 120(%[sha256])\n\t"
+        "jnz    1b\n\t"
+
+        "addq   $512, %%rsp\n\t"
+
+        :
+        : [FLIP]     "m" (mBYTE_FLIP_Y_MASK[0]),
+          [SHUF00BA] "m" (mSHUF_Y_00BA[0]),
+          [SHUFDC00] "m" (mSHUF_Y_DC00[0]),
+          [sha256]   "r" (sha256),
+          [len]      "r" (len),
+          [K]        "m" (K256)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory"
+    );
+
+    return 0;
+                }
+#endif  /* HAVE_INTEL_RORX */
+#endif  /* HAVE_INTEL_AVX2 */
 
 
 #ifdef WOLFSSL_SHA224
 
-#ifdef STM32_HASH
-
-    #define Sha256Update Sha224Update
-    #define Sha256Final  Sha224Final
-
-    /*
-     * STM32F2/F4/F7 hardware SHA224 support through the HASH_* API's from the
-     * Standard Peripheral Library or CubeMX (See note in README).
-     */
-
-    /* STM32 register size, bytes */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        #define SHA224_REG_SIZE  WC_SHA224_BLOCK_SIZE
-    #else
-        #define SHA224_REG_SIZE  4
-        /* STM32 struct notes:
-         * sha224->buffer  = first 4 bytes used to hold partial block if needed
-         * sha224->buffLen = num bytes currently stored in sha256->buffer
-         * sha224->loLen   = num bytes that have been written to STM32 FIFO
-         */
-    #endif
-    #define SHA224_HW_TIMEOUT 0xFF
-
-    static int InitSha224(wc_Sha224* sha224)
+#ifdef STM32_HASH_SHA2
+
+    /* Supports CubeMX HAL or Standard Peripheral Library */
+
+    int wc_InitSha224_ex(wc_Sha224* sha224, void* heap, int devId)
     {
         if (sha224 == NULL)
             return BAD_FUNC_ARG;
 
-        XMEMSET(sha224->buffer, 0, sizeof(sha224->buffer));
-        sha224->buffLen = 0;
-        sha224->loLen = 0;
-        sha224->hiLen = 0;
-
-        /* initialize HASH peripheral */
-    #ifdef WOLFSSL_STM32_CUBEMX
-        HAL_HASH_DeInit(&sha224->hashHandle);
-        sha224->hashHandle.Init.DataType = HASH_DATATYPE_8B;
-        if (HAL_HASH_Init(&sha224->hashHandle) != HAL_OK) {
-            return ASYNC_INIT_E;
-        }
-        /* required because Cube MX is not clearing algo bits */
-        HASH->CR &= ~HASH_CR_ALGO;
-    #else
-        HASH_DeInit();
-
-        /* reset the hash control register */
-        /* required because Cube MX is not clearing algo bits */
-        HASH->CR &= ~ (HASH_CR_ALGO | HASH_CR_DATATYPE | HASH_CR_MODE);
-
-        /* configure algo used, algo mode, datatype */
-        HASH->CR |= (HASH_AlgoSelection_SHA224 | HASH_AlgoMode_HASH
-                   | HASH_DataType_8b);
-
-        /* reset HASH processor */
-        HASH->CR |= HASH_CR_INIT;
-    #endif
-
+        (void)devId;
+        (void)heap;
+
+        wc_Stm32_Hash_Init(&sha224->stmCtx);
         return 0;
     }
 
-    static int Sha224Update(wc_Sha256* sha224, const byte* data, word32 len)
+    int wc_Sha224Update(wc_Sha224* sha224, const byte* data, word32 len)
     {
         int ret = 0;
-        byte* local;
-
-        /* do block size increments */
-        local = (byte*)sha224->buffer;
-
-        /* check that internal buffLen is valid */
-        if (sha224->buffLen >= SHA224_REG_SIZE)
-            return BUFFER_E;
-
-        while (len) {
-            word32 add = min(len, SHA224_REG_SIZE - sha224->buffLen);
-            XMEMCPY(&local[sha224->buffLen], data, add);
-
-            sha224->buffLen += add;
-            data         += add;
-            len          -= add;
-
-            if (sha224->buffLen == SHA224_REG_SIZE) {
-            #ifdef WOLFSSL_STM32_CUBEMX
-                if (HAL_HASHEx_SHA224_Accumulate(
-                        &sha224->hashHandle, local, SHA224_REG_SIZE) != HAL_OK) {
-                    ret = ASYNC_OP_E;
-                }
-            #else
-                HASH_DataIn(*(uint32_t*)local);
-            #endif
-
-                AddLength(sha224, SHA224_REG_SIZE);
-                sha224->buffLen = 0;
+
+        if (sha224 == NULL || (data == NULL && len > 0)) {
+            return BAD_FUNC_ARG;
             }
+
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Update(&sha224->stmCtx,
+                HASH_AlgoSelection_SHA224, data, len);
+            wolfSSL_CryptHwMutexUnLock();
         }
         return ret;
     }
 
-    static int Sha224Final(wc_Sha256* sha224)
+    int wc_Sha224Final(wc_Sha224* sha224, byte* hash)
     {
         int ret = 0;
 
-    #ifdef WOLFSSL_STM32_CUBEMX
-        if (HAL_HASHEx_SHA224_Start(&sha224->hashHandle,
-                (byte*)sha224->buffer, sha224->buffLen,
-                (byte*)sha224->digest, SHA224_HW_TIMEOUT) != HAL_OK) {
-            ret = ASYNC_OP_E;
-        }
-    #else
-        __IO uint16_t nbvalidbitsdata = 0;
-
-        /* finish reading any trailing bytes into FIFO */
-        if (sha224->buffLen > 0) {
-            HASH_DataIn(*(uint32_t*)sha224->buffer);
-            AddLength(sha224, sha224->buffLen);
-        }
-
-        /* calculate number of valid bits in last word of input data */
-        nbvalidbitsdata = 8 * (sha224->loLen % SHA224_REG_SIZE);
-
-        /* configure number of valid bits in last word of the data */
-        HASH_SetLastWordValidBitsNbr(nbvalidbitsdata);
-
-        /* start HASH processor */
-        HASH_StartDigest();
-
-        /* wait until Busy flag == RESET */
-        while (HASH_GetFlagStatus(HASH_FLAG_BUSY) != RESET) {}
-
-        /* read message digest */
-        sha224->digest[0] = HASH->HR[0];
-        sha224->digest[1] = HASH->HR[1];
-        sha224->digest[2] = HASH->HR[2];
-        sha224->digest[3] = HASH->HR[3];
-        sha224->digest[4] = HASH->HR[4];
-        sha224->digest[5] = HASH_DIGEST->HR[5];
-        sha224->digest[6] = HASH_DIGEST->HR[6];
-
-        ByteReverseWords(sha224->digest, sha224->digest, SHA224_DIGEST_SIZE);
-    #endif /* WOLFSSL_STM32_CUBEMX */
+        if (sha224 == NULL || hash == NULL) {
+            return BAD_FUNC_ARG;
+        }
+
+        ret = wolfSSL_CryptHwMutexLock();
+        if (ret == 0) {
+            ret = wc_Stm32_Hash_Final(&sha224->stmCtx,
+                HASH_AlgoSelection_SHA224, hash, WC_SHA224_DIGEST_SIZE);
+            wolfSSL_CryptHwMutexUnLock();
+        }
+
+        (void)wc_InitSha224(sha224); /* reset state */
 
         return ret;
     }
 
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* functions defined in wolfcrypt/src/port/caam/caam_sha256.c */
+
+#elif defined(WOLFSSL_AFALG_HASH)
+    #error SHA224 currently not supported with AF_ALG enabled
+
+#elif defined(WOLFSSL_DEVCRYPTO_HASH)
+    /* implemented in wolfcrypt/src/port/devcrypto/devcrypt_hash.c */
+
 #else
+
+    #define NEED_SOFT_SHA224
+
 
     static int InitSha224(wc_Sha224* sha224)
@@ -2199 +2626 @@
     }
 
-#endif /* STM32_HASH */
-
+#endif
+
+#ifdef NEED_SOFT_SHA224
     int wc_InitSha224_ex(wc_Sha224* sha224, void* heap, int devId)
     {
@@ -2213 +2641 @@
         if (ret != 0)
             return ret;
+
+    #ifdef WOLFSSL_SMALL_STACK_CACHE
+        sha224->W = NULL;
+    #endif
 
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA224)
@@ -2224 +2656 @@
     }
 
-    int wc_InitSha224(wc_Sha224* sha224)
-    {
-        return wc_InitSha224_ex(sha224, NULL, INVALID_DEVID);
-    }
-
     int wc_Sha224Update(wc_Sha224* sha224, const byte* data, word32 len)
     {
@@ -2271 +2698 @@
             return ret;
 
-    #if defined(LITTLE_ENDIAN_ORDER) && !defined(STM32_HASH)
+    #if defined(LITTLE_ENDIAN_ORDER)
         ByteReverseWords(sha224->digest, sha224->digest, WC_SHA224_DIGEST_SIZE);
     #endif
@@ -2277 +2704 @@
 
         return InitSha224(sha224);  /* reset state */
+    }
+#endif /* end of SHA224 software implementation */
+
+    int wc_InitSha224(wc_Sha224* sha224)
+    {
+        return wc_InitSha224_ex(sha224, NULL, INVALID_DEVID);
     }
 
@@ -2283 +2716 @@
         if (sha224 == NULL)
             return;
+
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    if (sha224->W != NULL) {
+        XFREE(sha224->W, NULL, DYNAMIC_TYPE_DIGEST);
+        sha224->W = NULL;
+    }
+#endif
 
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA224)
         wolfAsync_DevCtxFree(&sha224->asyncDev, WOLFSSL_ASYNC_MARKER_SHA224);
     #endif /* WOLFSSL_ASYNC_CRYPT */
-    }
-
+
+    #ifdef WOLFSSL_PIC32MZ_HASH
+        wc_Sha256Pic32Free(sha224);
+    #endif
+    }
 #endif /* WOLFSSL_SHA224 */
 
@@ -2302 +2745 @@
         return;
 
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    if (sha256->W != NULL) {
+        XFREE(sha256->W, NULL, DYNAMIC_TYPE_DIGEST);
+        sha256->W = NULL;
+    }
+#endif
+
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA256)
     wolfAsync_DevCtxFree(&sha256->asyncDev, WOLFSSL_ASYNC_MARKER_SHA256);
 #endif /* WOLFSSL_ASYNC_CRYPT */
+#ifdef WOLFSSL_PIC32MZ_HASH
+    wc_Sha256Pic32Free(sha256);
+#endif
+#if defined(WOLFSSL_AFALG_HASH)
+    if (sha256->alFd > 0) {
+        close(sha256->alFd);
+        sha256->alFd = -1; /* avoid possible double close on socket */
+    }
+    if (sha256->rdFd > 0) {
+        close(sha256->rdFd);
+        sha256->rdFd = -1; /* avoid possible double close on socket */
+    }
+#endif /* WOLFSSL_AFALG_HASH */
+#ifdef WOLFSSL_DEVCRYPTO_HASH
+    wc_DevCryptoFree(&sha256->ctx);
+#endif /* WOLFSSL_DEVCRYPTO */
+#if defined(WOLFSSL_AFALG_HASH_KEEP) || \
+    (defined(WOLFSSL_DEVCRYPTO_HASH) && defined(WOLFSSL_DEVCRYPTO_HASH_KEEP))
+    if (sha256->msg != NULL) {
+        XFREE(sha256->msg, sha256->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        sha256->msg = NULL;
+    }
+#endif
 }
 
@@ -2324 +2797 @@
         if (ret == 0) {
             ret = wc_Sha224Final(&tmpSha224, hash);
+            wc_Sha224Free(&tmpSha224);
         }
         return ret;
@@ -2335 +2809 @@
 
         XMEMCPY(dst, src, sizeof(wc_Sha224));
+    #ifdef WOLFSSL_SMALL_STACK_CACHE
+        dst->W = NULL;
+    #endif
 
     #ifdef WOLFSSL_ASYNC_CRYPT
@@ -2343 +2820 @@
     }
 #endif /* WOLFSSL_SHA224 */
+
+#ifdef WOLFSSL_AFALG_HASH
+    /* implemented in wolfcrypt/src/port/af_alg/afalg_hash.c */
+
+#elif defined(WOLFSSL_DEVCRYPTO_HASH)
+    /* implemented in wolfcrypt/src/port/devcrypto/devcrypt_hash.c */
+
+#else
 
 int wc_Sha256GetHash(wc_Sha256* sha256, byte* hash)
@@ -2355 +2840 @@
     if (ret == 0) {
         ret = wc_Sha256Final(&tmpSha256, hash);
+        wc_Sha256Free(&tmpSha256);
     }
     return ret;
@@ -2366 +2852 @@
 
     XMEMCPY(dst, src, sizeof(wc_Sha256));
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    dst->W = NULL;
+#endif
 
 #ifdef WOLFSSL_ASYNC_CRYPT
@@ -2376 +2865 @@
     return ret;
 }
+#endif
 #endif /* !WOLFSSL_TI_HASH */
 

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/sha512.c

@@ -27 +27 @@
 #include <wolfssl/wolfcrypt/settings.h>
 
-#ifdef WOLFSSL_SHA512
+#if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
+
+#if defined(HAVE_FIPS) && \
+        defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
+
+    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
+    #define FIPS_NO_WRAPPERS
+
+    #ifdef USE_WINDOWS_API
+        #pragma code_seg(".fipsA$k")
+        #pragma const_seg(".fipsB$k")
+    #endif
+#endif
+
 #include <wolfssl/wolfcrypt/sha512.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
 #include <wolfssl/wolfcrypt/cpuid.h>
 
+/* deprecated USE_SLOW_SHA2 (replaced with USE_SLOW_SHA512) */
+#if defined(USE_SLOW_SHA2) && !defined(USE_SLOW_SHA512)
+    #define USE_SLOW_SHA512
+#endif
+
 /* fips wrapper calls, user can call direct */
-#ifdef HAVE_FIPS
+#if defined(HAVE_FIPS) && \
+    (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
+
+    #ifdef WOLFSSL_SHA512
+
     int wc_InitSha512(wc_Sha512* sha)
     {
@@ -72 +94 @@
         /* Not supported in FIPS */
     }
+    #endif
 
     #if defined(WOLFSSL_SHA384) || defined(HAVE_AESGCM)
@@ -111 +134 @@
     #endif /* WOLFSSL_SHA384 || HAVE_AESGCM */
 
-#else /* else build without using fips */
+#else /* else build without fips, or for FIPS v2 */
 
 #include <wolfssl/wolfcrypt/logging.h>
@@ -124 +147 @@
 
 #if defined(USE_INTEL_SPEEDUP)
+    #if defined(__GNUC__) && ((__GNUC__ < 4) || \
+                              (__GNUC__ == 4 && __GNUC_MINOR__ <= 8))
+        #undef  NO_AVX2_SUPPORT
+        #define NO_AVX2_SUPPORT
+    #endif
+    #if defined(__clang__) && ((__clang_major__ < 3) || \
+                               (__clang_major__ == 3 && __clang_minor__ <= 5))
+        #define NO_AVX2_SUPPORT
+    #elif defined(__clang__) && defined(NO_AVX2_SUPPORT)
+        #undef NO_AVX2_SUPPORT
+    #endif
+
     #define HAVE_INTEL_AVX1
+    #ifndef NO_AVX2_SUPPORT
     #define HAVE_INTEL_AVX2
+#endif
 #endif
 
@@ -136 +173 @@
     /* #define DEBUG_YMM  */
 #endif
-
-
-#if defined(HAVE_INTEL_RORX)
-    #define ROTR(func, bits, x) \
-    word64 func(word64 x) {  word64 ret ;\
-        __asm__ ("rorx $"#bits", %1, %0\n\t":"=r"(ret):"r"(x)) ;\
-        return ret ;\
-    }
-
-    static INLINE ROTR(rotrFixed64_28, 28, x);
-    static INLINE ROTR(rotrFixed64_34, 34, x);
-    static INLINE ROTR(rotrFixed64_39, 39, x);
-    static INLINE ROTR(rotrFixed64_14, 14, x);
-    static INLINE ROTR(rotrFixed64_18, 18, x);
-    static INLINE ROTR(rotrFixed64_41, 41, x);
-
-    #define S0_RORX(x) (rotrFixed64_28(x)^rotrFixed64_34(x)^rotrFixed64_39(x))
-    #define S1_RORX(x) (rotrFixed64_14(x)^rotrFixed64_18(x)^rotrFixed64_41(x))
-#endif /* HAVE_INTEL_RORX */
 
 #if defined(HAVE_BYTEREVERSE64) && \
@@ -167 +185 @@
 #endif
 
+#if defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* functions defined in wolfcrypt/src/port/caam/caam_sha.c */
+#else
+
+#ifdef WOLFSSL_SHA512
+
 static int InitSha512(wc_Sha512* sha512)
 {
@@ -188 +212 @@
 }
 
+#endif /* WOLFSSL_SHA512 */
 
 /* Hardware Acceleration */
 #if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+
+#ifdef WOLFSSL_SHA512
 
     /*****
@@ -208 +235 @@
 
     #if defined(HAVE_INTEL_AVX1)|| defined(HAVE_INTEL_AVX2)
-      Transform_AVX1(); # Function prototype
-      Transform_AVX2(); #
+      Transform_Sha512_AVX1(); # Function prototype
+      Transform_Sha512_AVX2(); #
     #endif
 
-      _Transform() {     # Native Transform Function body
+      _Transform_Sha512() {     # Native Transform Function body
 
       }
@@ -241 +268 @@
     #if defnied(HAVE_INTEL_AVX1)
 
-      int Transform_AVX1() {
+      int Transform_Sha512_AVX1() {
           Stitched Message Sched/Round
       }
@@ -249 +276 @@
     #if defnied(HAVE_INTEL_AVX2)
 
-      int Transform_AVX2() {
+      int Transform_Sha512_AVX2() {
           Stitched Message Sched/Round
       }
@@ -262 +289 @@
 
     #if defined(HAVE_INTEL_AVX1)
-        static int Transform_AVX1(wc_Sha512 *sha512);
+        static int Transform_Sha512_AVX1(wc_Sha512 *sha512);
+        static int Transform_Sha512_AVX1_Len(wc_Sha512 *sha512, word32 len);
     #endif
     #if defined(HAVE_INTEL_AVX2)
-        static int Transform_AVX2(wc_Sha512 *sha512);
-        #if defined(HAVE_INTEL_AVX1) && defined(HAVE_INTEL_AVX2) && defined(HAVE_INTEL_RORX)
-            static int Transform_AVX1_RORX(wc_Sha512 *sha512);
+        static int Transform_Sha512_AVX2(wc_Sha512 *sha512);
+        static int Transform_Sha512_AVX2_Len(wc_Sha512 *sha512, word32 len);
+        #if defined(HAVE_INTEL_RORX)
+            static int Transform_Sha512_AVX1_RORX(wc_Sha512 *sha512);
+            static int Transform_Sha512_AVX1_RORX_Len(wc_Sha512 *sha512,
+                                                      word32 len);
+            static int Transform_Sha512_AVX2_RORX(wc_Sha512 *sha512);
+            static int Transform_Sha512_AVX2_RORX_Len(wc_Sha512 *sha512,
+                                                      word32 len);
         #endif
     #endif
-    static int _Transform(wc_Sha512 *sha512);
-    static int (*Transform_p)(wc_Sha512* sha512) = _Transform;
+    static int _Transform_Sha512(wc_Sha512 *sha512);
+    static int (*Transform_Sha512_p)(wc_Sha512* sha512) = _Transform_Sha512;
+    static int (*Transform_Sha512_Len_p)(wc_Sha512* sha512, word32 len) = NULL;
     static int transform_check = 0;
     static int intel_flags;
-    #define Transform(sha512) (*Transform_p)(sha512)
-
-    /* Dummy for saving MM_REGs on behalf of Transform */
-    /* #if defined(HAVE_INTEL_AVX2)
-     #define SAVE_XMM_YMM   __asm__ volatile("orq %%r8, %%r8":::\
-       "%ymm0","%ymm1","%ymm2","%ymm3","%ymm4","%ymm5","%ymm6","%ymm7","%ymm8","%ymm9","%ymm10","%ymm11",\
-       "%ymm12","%ymm13","%ymm14","%ymm15")
-    */
-    #if defined(HAVE_INTEL_AVX1)
-        #define SAVE_XMM_YMM   __asm__ volatile("orq %%r8, %%r8":::\
-            "xmm0","xmm1","xmm2","xmm3","xmm4","xmm5","xmm6","xmm7","xmm8","xmm9","xmm10","xmm11","xmm12","xmm13","xmm14","xmm15")
-    #endif
+    #define Transform_Sha512(sha512)     (*Transform_Sha512_p)(sha512)
+    #define Transform_Sha512_Len(sha512, len) \
+        (*Transform_Sha512_Len_p)(sha512, len)
 
     static void Sha512_SetTransform()
@@ -295 +321 @@
 
     #if defined(HAVE_INTEL_AVX2)
-        if (IS_INTEL_AVX2(intel_flags) && IS_INTEL_BMI2(intel_flags)) {
-            if (1)
-                Transform_p = Transform_AVX1_RORX;
+        if (IS_INTEL_AVX2(intel_flags)) {
+        #ifdef HAVE_INTEL_RORX
+            if (IS_INTEL_BMI2(intel_flags)) {
+                Transform_Sha512_p = Transform_Sha512_AVX2_RORX;
+                Transform_Sha512_Len_p = Transform_Sha512_AVX2_RORX_Len;
+            }
             else
-                Transform_p = Transform_AVX2;
+        #endif
+            if (1) {
+                Transform_Sha512_p = Transform_Sha512_AVX2;
+                Transform_Sha512_Len_p = Transform_Sha512_AVX2_Len;
+            }
+        #ifdef HAVE_INTEL_RORX
+            else {
+                Transform_Sha512_p = Transform_Sha512_AVX1_RORX;
+                Transform_Sha512_Len_p = Transform_Sha512_AVX1_RORX_Len;
+            }
+        #endif
         }
         else
     #endif
     #if defined(HAVE_INTEL_AVX1)
-        if (1) {
-            Transform_p = ((IS_INTEL_AVX1(intel_flags)) ? Transform_AVX1 :
-                                                                    _Transform);
+        if (IS_INTEL_AVX1(intel_flags)) {
+            Transform_Sha512_p = Transform_Sha512_AVX1;
+            Transform_Sha512_Len_p = Transform_Sha512_AVX1_Len;
         }
         else
     #endif
-            Transform_p = _Transform;
+            Transform_Sha512_p = _Transform_Sha512;
 
         transform_check = 1;
     }
-
-    int wc_InitSha512_ex(wc_Sha512* sha512, void* heap, int devId)
-    {
-        int ret = InitSha512(sha512);
-
-        (void)heap;
-        (void)devId;
-
-        Sha512_SetTransform();
-
-        return ret;
-    }
+#endif /* WOLFSSL_SHA512 */
 
 #else
-    #define Transform(sha512) _Transform(sha512)
+    #define Transform_Sha512(sha512) _Transform_Sha512(sha512)
+
+#endif
+
+#ifdef WOLFSSL_SHA512
 
     int wc_InitSha512_ex(wc_Sha512* sha512, void* heap, int devId)
@@ -342 +374 @@
         if (ret != 0)
             return ret;
+
+#if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+    Sha512_SetTransform();
+#endif
+
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    sha512->W = NULL;
+#endif
 
     #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA512)
@@ -353 +393 @@
     }
 
-#endif /* Hardware Acceleration */
-
-#ifndef SAVE_XMM_YMM
-    #define SAVE_XMM_YMM
-#endif
+#endif /* WOLFSSL_SHA512 */
+
 
 static const word64 K512[80] = {
@@ -402 +439 @@
 };
 
-
-
 #define blk0(i) (W[i] = sha512->buffer[i])
 
-#define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
+#define blk2(i) (\
+               W[ i     & 15] += \
+            s1(W[(i-2)  & 15])+ \
+               W[(i-7)  & 15] + \
+            s0(W[(i-15) & 15])  \
+        )
 
 #define Ch(x,y,z) (z^(x&(y^z)))
@@ -425 +465 @@
 #define s1(x) (rotrFixed64(x,19)^rotrFixed64(x,61)^(x>>6))
 
-#define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+K[i+j]+(j?blk2(i):blk0(i));\
-    d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i))
-
-static int _Transform(wc_Sha512* sha512)
+#define R(i) \
+    h(i) += S1(e(i)) + Ch(e(i),f(i),g(i)) + K[i+j] + (j ? blk2(i) : blk0(i)); \
+    d(i) += h(i); \
+    h(i) += S0(a(i)) + Maj(a(i),b(i),c(i))
+
+static int _Transform_Sha512(wc_Sha512* sha512)
 {
     const word64* K = K512;
-
     word32 j;
     word64 T[8];
 
-
-#ifdef WOLFSSL_SMALL_STACK
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    word64* W = sha512->W;
+    if (W == NULL) {
+        W = (word64*) XMALLOC(sizeof(word64) * 16, NULL,
+                                                       DYNAMIC_TYPE_TMP_BUFFER);
+        if (W == NULL)
+            return MEMORY_E;
+        sha512->W = W;
+    }
+#elif defined(WOLFSSL_SMALL_STACK)
     word64* W;
     W = (word64*) XMALLOC(sizeof(word64) * 16, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -448 +497 @@
     XMEMCPY(T, sha512->digest, sizeof(T));
 
-#ifdef USE_SLOW_SHA2
+#ifdef USE_SLOW_SHA512
     /* over twice as small, but 50% slower */
     /* 80 operations, not unrolled */
@@ -465 +514 @@
         R(12); R(13); R(14); R(15);
     }
-#endif /* USE_SLOW_SHA2 */
+#endif /* USE_SLOW_SHA512 */
 
     /* Add the working vars back into digest */
-
     sha512->digest[0] += a(0);
     sha512->digest[1] += b(0);
@@ -482 +530 @@
     ForceZero(T, sizeof(T));
 
-#ifdef WOLFSSL_SMALL_STACK
+#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_SMALL_STACK_CACHE)
     XFREE(W, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
@@ -490 +538 @@
 
 
-static INLINE void AddLength(wc_Sha512* sha512, word32 len)
+static WC_INLINE void AddLength(wc_Sha512* sha512, word32 len)
 {
     word64 tmp = sha512->loLen;
@@ -497 +545 @@
 }
 
-static INLINE int Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
+static WC_INLINE int Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
 {
     int ret = 0;
@@ -507 +555 @@
         return BUFFER_E;
 
-    SAVE_XMM_YMM; /* for Intel AVX */
-
-    while (len) {
+    if (sha512->buffLen > 0) {
         word32 add = min(len, WC_SHA512_BLOCK_SIZE - sha512->buffLen);
+        if (add > 0) {
         XMEMCPY(&local[sha512->buffLen], data, add);
 
@@ -516 +563 @@
         data            += add;
         len             -= add;
+        }
 
         if (sha512->buffLen == WC_SHA512_BLOCK_SIZE) {
@@ -527 +575 @@
             }
     #endif
-            ret = Transform(sha512);
+            ret = Transform_Sha512(sha512);
+            if (ret == 0) {
+                AddLength(sha512, WC_SHA512_BLOCK_SIZE);
+                sha512->buffLen = 0;
+            }
+            else
+                len = 0;
+        }
+    }
+
+#if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+    if (Transform_Sha512_Len_p != NULL) {
+        word32 blocksLen = len & ~(WC_SHA512_BLOCK_SIZE-1);
+
+        if (blocksLen > 0) {
+            AddLength(sha512, blocksLen);
+            sha512->data = data;
+            /* Byte reversal performed in function if required. */
+            Transform_Sha512_Len(sha512, blocksLen);
+            data += blocksLen;
+            len  -= blocksLen;
+        }
+    }
+    else
+#endif
+#if !defined(LITTLE_ENDIAN_ORDER) || defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+    {
+        word32 blocksLen = len & ~(WC_SHA512_BLOCK_SIZE-1);
+
+        AddLength(sha512, blocksLen);
+        while (len >= WC_SHA512_BLOCK_SIZE) {
+            XMEMCPY(local, data, WC_SHA512_BLOCK_SIZE);
+
+            data += WC_SHA512_BLOCK_SIZE;
+            len  -= WC_SHA512_BLOCK_SIZE;
+
+            /* Byte reversal performed in function if required. */
+            ret = Transform_Sha512(sha512);
             if (ret != 0)
                 break;
-
-            AddLength(sha512, WC_SHA512_BLOCK_SIZE);
-            sha512->buffLen = 0;
         }
+    }
+#else
+    {
+        word32 blocksLen = len & ~(WC_SHA512_BLOCK_SIZE-1);
+
+        AddLength(sha512, blocksLen);
+        while (len >= WC_SHA512_BLOCK_SIZE) {
+            XMEMCPY(local, data, WC_SHA512_BLOCK_SIZE);
+
+            data += WC_SHA512_BLOCK_SIZE;
+            len  -= WC_SHA512_BLOCK_SIZE;
+
+            ByteReverseWords64(sha512->buffer, sha512->buffer,
+                                                          WC_SHA512_BLOCK_SIZE);
+            ret = Transform_Sha512(sha512);
+            if (ret != 0)
+                break;
+        }
+    }
+#endif
+
+    if (len > 0) {
+        XMEMCPY(local, data, len);
+        sha512->buffLen = len;
     }
 
     return ret;
 }
+
+#ifdef WOLFSSL_SHA512
 
 int wc_Sha512Update(wc_Sha512* sha512, const byte* data, word32 len)
@@ -556 +664 @@
 }
 
-
-static INLINE int Sha512Final(wc_Sha512* sha512)
+#endif /* WOLFSSL_SHA512 */
+
+#endif /* WOLFSSL_IMX6_CAAM */
+
+static WC_INLINE int Sha512Final(wc_Sha512* sha512)
 {
     byte* local = (byte*)sha512->buffer;
@@ -566 +677 @@
     }
 
-    SAVE_XMM_YMM ; /* for Intel AVX */
     AddLength(sha512, sha512->buffLen);               /* before adding pads */
 
@@ -584 +694 @@
         }
 #endif /* LITTLE_ENDIAN_ORDER */
-        ret = Transform(sha512);
+        ret = Transform_Sha512(sha512);
         if (ret != 0)
             return ret;
@@ -614 +724 @@
                            WC_SHA512_BLOCK_SIZE - WC_SHA512_PAD_SIZE);
 #endif
-    ret = Transform(sha512);
+    ret = Transform_Sha512(sha512);
     if (ret != 0)
         return ret;
@@ -621 +731 @@
         ByteReverseWords64(sha512->digest, sha512->digest, WC_SHA512_DIGEST_SIZE);
     #endif
+
+    return 0;
+}
+
+#ifdef WOLFSSL_SHA512
+
+int wc_Sha512FinalRaw(wc_Sha512* sha512, byte* hash)
+{
+#ifdef LITTLE_ENDIAN_ORDER
+    word64 digest[WC_SHA512_DIGEST_SIZE / sizeof(word64)];
+#endif
+
+    if (sha512 == NULL || hash == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef LITTLE_ENDIAN_ORDER
+    ByteReverseWords64((word64*)digest, (word64*)sha512->digest,
+                                                         WC_SHA512_DIGEST_SIZE);
+    XMEMCPY(hash, digest, WC_SHA512_DIGEST_SIZE);
+#else
+    XMEMCPY(hash, sha512->digest, WC_SHA512_DIGEST_SIZE);
+#endif
 
     return 0;
@@ -662 +795 @@
         return;
 
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    if (sha512->W != NULL) {
+        XFREE(sha512->W, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        sha512->W = NULL;
+    }
+#endif
+
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA512)
     wolfAsync_DevCtxFree(&sha512->asyncDev, WOLFSSL_ASYNC_MARKER_SHA512);
@@ -670 +810 @@
 #if defined(HAVE_INTEL_AVX1)
 
-#define Rx_1(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+K[i+j] + W_X[i];
-#define Rx_2(i) d(i)+=h(i);
-#define Rx_3(i) h(i)+=S0(a(i))+Maj(a(i),b(i),c(i));
+static word64 mBYTE_FLIP_MASK[] =  { 0x0001020304050607, 0x08090a0b0c0d0e0f };
+
+#define W_0     xmm0
+#define W_2     xmm1
+#define W_4     xmm2
+#define W_6     xmm3
+#define W_8     xmm4
+#define W_10    xmm5
+#define W_12    xmm6
+#define W_14    xmm7
+
+#define W_M15   xmm12
+#define W_M7    xmm13
+#define MASK    xmm14
+
+#define XTMP1   xmm8
+#define XTMP2   xmm9
+#define XTMP3   xmm10
+#define XTMP4   xmm11
+
+#define XMM_REGS \
+    "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6", "xmm7",       \
+    "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13", "xmm14", "xmm15"
+
+#define _VPALIGNR(dest, src1, src2, bits)                               \
+    "vpalignr   $" #bits ", %%" #src2 ", %%" #src1 ", %%" #dest "\n\t"
+#define VPALIGNR(dest, src1, src2, bits) \
+       _VPALIGNR(dest, src1, src2, bits)
+
+#define _V_SHIFT_R(dest, src, bits)                             \
+    "vpsrlq     $" #bits ", %%" #src ", %%" #dest "\n\t"
+#define V_SHIFT_R(dest, src, bits) \
+       _V_SHIFT_R(dest, src, bits)
+
+#define _V_SHIFT_L(dest, src, bits)                             \
+    "vpsllq     $" #bits ", %%" #src ", %%" #dest "\n\t"
+#define V_SHIFT_L(dest, src, bits) \
+       _V_SHIFT_L(dest, src, bits)
+
+#define _V_ADD(dest, src1, src2)                                \
+    "vpaddq     %%" #src1 ", %%" #src2 ", %%" #dest "\n\t"
+#define V_ADD(dest, src1, src2) \
+       _V_ADD(dest, src1, src2)
+
+#define _V_XOR(dest, src1, src2)                                \
+    "vpxor      %%" #src1 ", %%" #src2 ", %%" #dest "\n\t"
+#define V_XOR(dest, src1, src2) \
+       _V_XOR(dest, src1, src2)
+
+#define _V_OR(dest, src1, src2)                                 \
+    "vpor       %%" #src1 ", %%" #src2 ", %%" #dest "\n\t"
+#define V_OR(dest, src1, src2) \
+       _V_OR(dest, src1, src2)
+
+#define RA  %%r8
+#define RB  %%r9
+#define RC  %%r10
+#define RD  %%r11
+#define RE  %%r12
+#define RF  %%r13
+#define RG  %%r14
+#define RH  %%r15
+
+#define STATE_REGS "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
+
+#define L1  "%%rax"
+#define L2  "%%rcx"
+#define L3  "%%rdx"
+#define L4  "%%rbx"
+#define WX  "%%rsp"
+
+#define WORK_REGS "rax", "rbx", "rcx", "rdx"
+
+#define RND_0_1(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = e >>> 23 */                              \
+    "rorq        $23, " L1 "\n\t"                    \
+
+#define RND_0_2(a,b,c,d,e,f,g,h,i)                   \
+    /* L3 = a */                                     \
+    "movq       "#a", " L3 "\n\t"                    \
+    /* L2 = f */                                     \
+    "movq       "#f", " L2 "\n\t"                    \
+    /* h += W_X[i] */                                \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"          \
+    /* L2 = f ^ g */                                 \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_0_2_A(a,b,c,d,e,f,g,h,i)                 \
+    /* L3 = a */                                     \
+    "movq       "#a", " L3 "\n\t"                    \
+    /* L2 = f */                                     \
+    "movq       "#f", " L2 "\n\t"                    \
+
+#define RND_0_2_B(a,b,c,d,e,f,g,h,i)                 \
+    /* h += W_X[i] */                                \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"          \
+    /* L2 = f ^ g */                                 \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_0_3(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = (e >>> 23) ^ e */                        \
+    "xorq       "#e", " L1 "\n\t"                    \
+    /* L2 = (f ^ g) & e */                           \
+    "andq       "#e", " L2 "\n\t"                    \
+
+#define RND_0_4(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = ((e >>> 23) ^ e) >>> 4 */                \
+    "rorq        $4, " L1 "\n\t"                     \
+    /* L2 = ((f ^ g) & e) ^ g */                     \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_0_5(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = (((e >>> 23) ^ e) >>> 4) ^ e */          \
+    "xorq       "#e", " L1 "\n\t"                    \
+    /* h += Ch(e,f,g) */                             \
+    "addq       " L2 ", "#h"\n\t"                    \
+
+#define RND_0_6(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = ((((e >>> 23) ^ e) >>> 4) ^ e) >>> 14 */ \
+    "rorq       $14, " L1 "\n\t"                     \
+    /* L3 = a ^ b */                                 \
+    "xorq       "#b", " L3 "\n\t"                    \
+
+#define RND_0_7(a,b,c,d,e,f,g,h,i)                   \
+    /* h += Sigma1(e) */                             \
+    "addq       " L1 ", "#h"\n\t"                    \
+    /* L2 = a */                                     \
+    "movq       "#a", " L2 "\n\t"                    \
+
+#define RND_0_8(a,b,c,d,e,f,g,h,i)                   \
+    /* L4 = (a ^ b) & (b ^ c) */                     \
+    "andq       " L3 ", " L4 "\n\t"                  \
+    /* L2 = a >>> 5 */                               \
+    "rorq       $5, " L2 "\n\t"                      \
+
+#define RND_0_9(a,b,c,d,e,f,g,h,i)                   \
+    /* L2 = (a >>> 5) ^ a */                         \
+    "xorq       "#a", " L2 "\n\t"                    \
+    /* L4 = ((a ^ b) & (b ^ c) ^ b */                \
+    "xorq       "#b", " L4 "\n\t"                    \
+
+#define RND_0_10(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = ((a >>> 5) ^ a) >>> 6 */                 \
+    "rorq        $6, " L2 "\n\t"                     \
+    /* d += h */                                     \
+    "addq       "#h", "#d"\n\t"                      \
+
+#define RND_0_11(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = (((a >>> 5) ^ a) >>> 6) ^ a */           \
+    "xorq       "#a", " L2 "\n\t"                    \
+    /* h += Sigma0(a) */                             \
+    "addq       " L4 ", "#h"\n\t"                    \
+
+#define RND_0_12(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = ((((a >>> 5) ^ a) >>> 6) ^ a) >>> 28 */  \
+    "rorq       $28, " L2 "\n\t"                     \
+    /* d (= e next RND) */                           \
+    "movq       "#d", " L1 "\n\t"                    \
+    /* h += Maj(a,b,c) */                            \
+    "addq       " L2 ", "#h"\n\t"                    \
+
+#define RND_1_1(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = e >>> 23 */                              \
+    "rorq        $23, " L1 "\n\t"                    \
+
+#define RND_1_2(a,b,c,d,e,f,g,h,i)                   \
+    /* L4 = a */                                     \
+    "movq       "#a", " L4 "\n\t"                    \
+    /* L2 = f */                                     \
+    "movq       "#f", " L2 "\n\t"                    \
+    /* h += W_X[i] */                                \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"          \
+    /* L2 = f ^ g */                                 \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_1_2_A(a,b,c,d,e,f,g,h,i)                 \
+    /* L4 = a */                                     \
+    "movq       "#a", " L4 "\n\t"                    \
+    /* L2 = f */                                     \
+    "movq       "#f", " L2 "\n\t"                    \
+
+#define RND_1_2_B(a,b,c,d,e,f,g,h,i)                 \
+    /* h += W_X[i] */                                \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"          \
+    /* L2 = f ^ g */                                 \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_1_3(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = (e >>> 23) ^ e */                        \
+    "xorq       "#e", " L1 "\n\t"                    \
+    /* L2 = (f ^ g) & e */                           \
+    "andq       "#e", " L2 "\n\t"                    \
+
+#define RND_1_4(a,b,c,d,e,f,g,h,i)                   \
+    /* ((e >>> 23) ^ e) >>> 4 */                     \
+    "rorq        $4, " L1 "\n\t"                     \
+    /* ((f ^ g) & e) ^ g */                          \
+    "xorq       "#g", " L2 "\n\t"                    \
+
+#define RND_1_5(a,b,c,d,e,f,g,h,i)                   \
+    /* (((e >>> 23) ^ e) >>> 4) ^ e */               \
+    "xorq       "#e", " L1 "\n\t"                    \
+    /* h += Ch(e,f,g) */                             \
+    "addq       " L2 ", "#h"\n\t"                    \
+
+#define RND_1_6(a,b,c,d,e,f,g,h,i)                   \
+    /* L1 = ((((e >>> 23) ^ e) >>> 4) ^ e) >>> 14 */ \
+    "rorq       $14, " L1 "\n\t"                     \
+    /* L4 = a ^ b */                                 \
+    "xorq       "#b", " L4 "\n\t"                    \
+
+#define RND_1_7(a,b,c,d,e,f,g,h,i)                   \
+    /* h += Sigma1(e) */                             \
+    "addq       " L1 ", "#h"\n\t"                    \
+    /* L2 = a */                                     \
+    "movq       "#a", " L2 "\n\t"                    \
+
+#define RND_1_8(a,b,c,d,e,f,g,h,i)                   \
+    /* L3 = (a ^ b) & (b ^ c) */                     \
+    "andq       " L4 ", " L3 "\n\t"                  \
+    /* L2 = a >>> 5 */                               \
+    "rorq       $5, " L2 "\n\t"                      \
+
+#define RND_1_9(a,b,c,d,e,f,g,h,i)                   \
+    /* L2 = (a >>> 5) ^ a */                         \
+    "xorq       "#a", " L2 "\n\t"                    \
+    /* L3 = ((a ^ b) & (b ^ c) ^ b */                \
+    "xorq       "#b", " L3 "\n\t"                    \
+
+#define RND_1_10(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = ((a >>> 5) ^ a) >>> 6 */                 \
+    "rorq        $6, " L2 "\n\t"                     \
+    /* d += h */                                     \
+    "addq       "#h", "#d"\n\t"                      \
+
+#define RND_1_11(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = (((a >>> 5) ^ a) >>> 6) ^ a */           \
+    "xorq       "#a", " L2 "\n\t"                    \
+    /* h += Sigma0(a) */                             \
+    "addq       " L3 ", "#h"\n\t"                    \
+
+#define RND_1_12(a,b,c,d,e,f,g,h,i)                  \
+    /* L2 = ((((a >>> 5) ^ a) >>> 6) ^ a) >>> 28 */  \
+    "rorq       $28, " L2 "\n\t"                     \
+    /* d (= e next RND) */                           \
+    "movq       "#d", " L1 "\n\t"                    \
+    /* h += Maj(a,b,c) */                            \
+    "addq       " L2 ", "#h"\n\t"                    \
+
+
+#define MsgSched2(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,a,b,c,d,e,f,g,h,i) \
+            RND_0_1(a,b,c,d,e,f,g,h,i)                                  \
+    VPALIGNR(W_M15, W_2, W_0, 8)                                        \
+    VPALIGNR(W_M7, W_10, W_8, 8)                                        \
+            RND_0_2(a,b,c,d,e,f,g,h,i)                                  \
+    V_SHIFT_R(XTMP1, W_M15, 1)                                          \
+    V_SHIFT_L(XTMP2, W_M15, 63)                                         \
+            RND_0_3(a,b,c,d,e,f,g,h,i)                                  \
+            RND_0_4(a,b,c,d,e,f,g,h,i)                                  \
+    V_SHIFT_R(XTMP3, W_M15, 8)                                          \
+    V_SHIFT_L(XTMP4, W_M15, 56)                                         \
+            RND_0_5(a,b,c,d,e,f,g,h,i)                                  \
+            RND_0_6(a,b,c,d,e,f,g,h,i)                                  \
+    V_OR(XTMP1, XTMP2, XTMP1)                                           \
+    V_OR(XTMP3, XTMP4, XTMP3)                                           \
+            RND_0_7(a,b,c,d,e,f,g,h,i)                                  \
+            RND_0_8(a,b,c,d,e,f,g,h,i)                                  \
+    V_SHIFT_R(XTMP4, W_M15, 7)                                          \
+    V_XOR(XTMP1, XTMP3, XTMP1)                                          \
+            RND_0_9(a,b,c,d,e,f,g,h,i)                                  \
+            RND_0_10(a,b,c,d,e,f,g,h,i)                                 \
+    V_XOR(XTMP1, XTMP4, XTMP1)                                          \
+    V_ADD(W_0, W_0, W_M7)                                               \
+            RND_0_11(a,b,c,d,e,f,g,h,i)                                 \
+            RND_0_12(a,b,c,d,e,f,g,h,i)                                 \
+            RND_1_1(h,a,b,c,d,e,f,g,i+1)                                \
+    V_ADD(W_0, W_0, XTMP1)                                              \
+            RND_1_2(h,a,b,c,d,e,f,g,i+1)                                \
+    V_SHIFT_R(XTMP1, W_14, 19)                                          \
+    V_SHIFT_L(XTMP2, W_14, 45)                                          \
+            RND_1_3(h,a,b,c,d,e,f,g,i+1)                                \
+            RND_1_4(h,a,b,c,d,e,f,g,i+1)                                \
+    V_SHIFT_R(XTMP3, W_14, 61)                                          \
+    V_SHIFT_L(XTMP4, W_14, 3)                                           \
+            RND_1_5(h,a,b,c,d,e,f,g,i+1)                                \
+            RND_1_6(h,a,b,c,d,e,f,g,i+1)                                \
+            RND_1_7(h,a,b,c,d,e,f,g,i+1)                                \
+    V_OR(XTMP1, XTMP2, XTMP1)                                           \
+    V_OR(XTMP3, XTMP4, XTMP3)                                           \
+            RND_1_8(h,a,b,c,d,e,f,g,i+1)                                \
+            RND_1_9(h,a,b,c,d,e,f,g,i+1)                                \
+    V_XOR(XTMP1, XTMP3, XTMP1)                                          \
+    V_SHIFT_R(XTMP4, W_14, 6)                                           \
+            RND_1_10(h,a,b,c,d,e,f,g,i+1)                               \
+            RND_1_11(h,a,b,c,d,e,f,g,i+1)                               \
+    V_XOR(XTMP1, XTMP4, XTMP1)                                          \
+            RND_1_12(h,a,b,c,d,e,f,g,i+1)                               \
+    V_ADD(W_0, W_0, XTMP1)                                              \
+
+#define RND_ALL_2(a, b, c, d, e, f, g, h, i) \
+    RND_0_1 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_2 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_3 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_4 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_5 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_6 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_7 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_8 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_9 (a, b, c, d, e, f, g, h, i )     \
+    RND_0_10(a, b, c, d, e, f, g, h, i )     \
+    RND_0_11(a, b, c, d, e, f, g, h, i )     \
+    RND_0_12(a, b, c, d, e, f, g, h, i )     \
+    RND_1_1 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_2 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_3 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_4 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_5 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_6 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_7 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_8 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_9 (h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_10(h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_11(h, a, b, c, d, e, f, g, i+1)    \
+    RND_1_12(h, a, b, c, d, e, f, g, i+1)
+
 
 #if defined(HAVE_INTEL_RORX)
 
-    #define Rx_RORX_1(i) h(i)+=S1_RORX(e(i))+Ch(e(i),f(i),g(i))+K[i+j] + W_X[i];
-    #define Rx_RORX_2(i) d(i)+=h(i);
-    #define Rx_RORX_3(i) h(i)+=S0_RORX(a(i))+Maj(a(i),b(i),c(i));
-#endif /* HAVE_INTEL_RORX */
+#define RND_RORX_0_1(a, b, c, d, e, f, g, h, i) \
+    /* L1 = e>>>14 */                           \
+    "rorxq      $14, "#e", " L1 "\n\t"          \
+    /* L2 = e>>>18 */                           \
+    "rorxq      $18, "#e", " L2 "\n\t"          \
+    /* Prev RND: h += Maj(a,b,c) */             \
+    "addq       " L3 ", "#a"\n\t"               \
+
+#define RND_RORX_0_2(a, b, c, d, e, f, g, h, i) \
+    /* h += w_k */                              \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"     \
+    /* L3 = f */                                \
+    "movq       "#f", " L3 "\n\t"               \
+    /* L2 = (e>>>14) ^ (e>>>18) */              \
+    "xorq       " L1 ", " L2 "\n\t"             \
+
+#define RND_RORX_0_3(a, b, c, d, e, f, g, h, i) \
+    /* L3 = f ^ g */                            \
+    "xorq       "#g", " L3 "\n\t"               \
+    /* L1 = e>>>41 */                           \
+    "rorxq      $41, "#e", " L1 "\n\t"          \
+    /* L1 = Sigma1(e) */                        \
+    "xorq       " L2 ", " L1 "\n\t"             \
+
+#define RND_RORX_0_4(a, b, c, d, e, f, g, h, i) \
+    /* L3 = (f ^ g) & e */                      \
+    "andq       "#e", " L3 "\n\t"               \
+    /* h += Sigma1(e) */                        \
+    "addq       " L1 ", "#h"\n\t"               \
+    /* L1 = a>>>28 */                           \
+    "rorxq      $28, "#a", " L1 "\n\t"          \
+
+#define RND_RORX_0_5(a, b, c, d, e, f, g, h, i) \
+    /* L2 = a>>>34 */                           \
+    "rorxq      $34, "#a", " L2 "\n\t"          \
+    /* L3 = Ch(e,f,g) */                        \
+    "xorq       "#g", " L3 "\n\t"               \
+    /* L2 = (a>>>28) ^ (a>>>34) */              \
+    "xorq       " L1 ", " L2 "\n\t"             \
+
+#define RND_RORX_0_6(a, b, c, d, e, f, g, h, i) \
+    /* L1 = a>>>39 */                           \
+    "rorxq      $39, "#a", " L1 "\n\t"          \
+    /* h += Ch(e,f,g) */                        \
+    "addq       " L3 ", "#h"\n\t"               \
+    /* L1 = Sigma0(a) */                        \
+    "xorq       " L2 ", " L1 "\n\t"             \
+
+#define RND_RORX_0_7(a, b, c, d, e, f, g, h, i) \
+    /* L3 = b */                                \
+    "movq       "#b", " L3 "\n\t"               \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */  \
+    "addq       "#h", "#d"\n\t"                 \
+    /* L3 = a ^ b */                            \
+    "xorq       "#a", " L3 "\n\t"               \
+
+#define RND_RORX_0_8(a, b, c, d, e, f, g, h, i) \
+    /* L4 = (a ^ b) & (b ^ c) */                \
+    "andq       " L3 ", " L4 "\n\t"             \
+    /* h += Sigma0(a) */                        \
+    "addq       " L1 ", "#h"\n\t"               \
+    /* L4 = Maj(a,b,c) */                       \
+    "xorq       "#b", " L4 "\n\t"               \
+
+#define RND_RORX_1_1(a, b, c, d, e, f, g, h, i) \
+    /* L1 = e>>>14 */                           \
+    "rorxq      $14, "#e", " L1 "\n\t"          \
+    /* L2 = e>>>18 */                           \
+    "rorxq      $18, "#e", " L2 "\n\t"          \
+    /* Prev RND: h += Maj(a,b,c) */             \
+    "addq       " L4 ", "#a"\n\t"               \
+
+#define RND_RORX_1_2(a, b, c, d, e, f, g, h, i) \
+    /* h += w_k */                              \
+    "addq       ("#i")*8(" WX "), "#h"\n\t"     \
+    /* L4 = f */                                \
+    "movq       "#f", " L4 "\n\t"               \
+    /* L2 = (e>>>14) ^ (e>>>18) */              \
+    "xorq       " L1 ", " L2 "\n\t"             \
+
+#define RND_RORX_1_3(a, b, c, d, e, f, g, h, i) \
+    /* L4 = f ^ g */                            \
+    "xorq       "#g", " L4 "\n\t"               \
+    /* L1 = e>>>41 */                           \
+    "rorxq      $41, "#e", " L1 "\n\t"          \
+    /* L1 = Sigma1(e) */                        \
+    "xorq       " L2 ", " L1 "\n\t"             \
+
+#define RND_RORX_1_4(a, b, c, d, e, f, g, h, i) \
+    /* L4 = (f ^ g) & e */                      \
+    "andq       "#e", " L4 "\n\t"               \
+    /* h += Sigma1(e) */                        \
+    "addq       " L1 ", "#h"\n\t"               \
+    /* L1 = a>>>28 */                           \
+    "rorxq      $28, "#a", " L1 "\n\t"          \
+
+#define RND_RORX_1_5(a, b, c, d, e, f, g, h, i) \
+    /* L2 = a>>>34 */                           \
+    "rorxq      $34, "#a", " L2 "\n\t"          \
+    /* L4 = Ch(e,f,g) */                        \
+    "xorq       "#g", " L4 "\n\t"               \
+    /* L2 = (a>>>28) ^ (a>>>34) */              \
+    "xorq       " L1 ", " L2 "\n\t"             \
+
+#define RND_RORX_1_6(a, b, c, d, e, f, g, h, i) \
+    /* L1 = a>>>39 */                           \
+    "rorxq      $39, "#a", " L1 "\n\t"          \
+    /* h += Ch(e,f,g) */                        \
+    "addq       " L4 ", "#h"\n\t"               \
+    /* L1 = Sigma0(a) */                        \
+    "xorq       " L2 ", " L1 "\n\t"             \
+
+#define RND_RORX_1_7(a, b, c, d, e, f, g, h, i) \
+    /* L4 = b */                                \
+    "movq       "#b", " L4 "\n\t"               \
+    /* d += h + w_k + Sigma1(e) + Ch(e,f,g) */  \
+    "addq       "#h", "#d"\n\t"                 \
+    /* L4 = a ^ b */                            \
+    "xorq       "#a", " L4 "\n\t"               \
+
+#define RND_RORX_1_8(a, b, c, d, e, f, g, h, i) \
+    /* L2 = (a ^ b) & (b ^ c) */                \
+    "andq       " L4 ", " L3 "\n\t"             \
+    /* h += Sigma0(a) */                        \
+    "addq       " L1 ", "#h"\n\t"               \
+    /* L3 = Maj(a,b,c) */                       \
+    "xorq       "#b", " L3 "\n\t"               \
+
+#define RND_RORX_ALL_2(a, b, c, d, e, f, g, h, i) \
+    RND_RORX_0_1(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_2(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_3(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_4(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_5(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_6(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_7(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_0_8(a, b, c, d, e, f, g, h, i+0)     \
+    RND_RORX_1_1(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_2(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_3(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_4(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_5(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_6(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_7(h, a, b, c, d, e, f, g, i+1)     \
+    RND_RORX_1_8(h, a, b, c, d, e, f, g, i+1)     \
+
+#define RND_RORX_ALL_4(a, b, c, d, e, f, g, h, i) \
+    RND_RORX_ALL_2(a, b, c, d, e, f, g, h, i+0)   \
+    RND_RORX_ALL_2(g, h, a, b, c, d, e, f, i+2)
+
+#define MsgSched_RORX(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,a,b,c,d,e,f,g,h,i) \
+            RND_RORX_0_1(a,b,c,d,e,f,g,h,i)                                 \
+    VPALIGNR(W_M15, W_2, W_0, 8)                                            \
+    VPALIGNR(W_M7, W_10, W_8, 8)                                            \
+            RND_RORX_0_2(a,b,c,d,e,f,g,h,i)                                 \
+    V_SHIFT_R(XTMP1, W_M15, 1)                                              \
+    V_SHIFT_L(XTMP2, W_M15, 63)                                             \
+            RND_RORX_0_3(a,b,c,d,e,f,g,h,i)                                 \
+    V_SHIFT_R(XTMP3, W_M15, 8)                                              \
+    V_SHIFT_L(XTMP4, W_M15, 56)                                             \
+            RND_RORX_0_4(a,b,c,d,e,f,g,h,i)                                 \
+    V_OR(XTMP1, XTMP2, XTMP1)                                               \
+    V_OR(XTMP3, XTMP4, XTMP3)                                               \
+            RND_RORX_0_5(a,b,c,d,e,f,g,h,i)                                 \
+    V_SHIFT_R(XTMP4, W_M15, 7)                                              \
+    V_XOR(XTMP1, XTMP3, XTMP1)                                              \
+            RND_RORX_0_6(a,b,c,d,e,f,g,h,i)                                 \
+    V_XOR(XTMP1, XTMP4, XTMP1)                                              \
+    V_ADD(W_0, W_0, W_M7)                                                   \
+            RND_RORX_0_7(a,b,c,d,e,f,g,h,i)                                 \
+            RND_RORX_0_8(a,b,c,d,e,f,g,h,i)                                 \
+    V_ADD(W_0, W_0, XTMP1)                                                  \
+            RND_RORX_1_1(h,a,b,c,d,e,f,g,i+1)                               \
+    V_SHIFT_R(XTMP1, W_14, 19)                                              \
+    V_SHIFT_L(XTMP2, W_14, 45)                                              \
+            RND_RORX_1_2(h,a,b,c,d,e,f,g,i+1)                               \
+    V_SHIFT_R(XTMP3, W_14, 61)                                              \
+    V_SHIFT_L(XTMP4, W_14, 3)                                               \
+            RND_RORX_1_3(h,a,b,c,d,e,f,g,i+1)                               \
+    V_OR(XTMP1, XTMP2, XTMP1)                                               \
+    V_OR(XTMP3, XTMP4, XTMP3)                                               \
+            RND_RORX_1_4(h,a,b,c,d,e,f,g,i+1)                               \
+            RND_RORX_1_5(h,a,b,c,d,e,f,g,i+1)                               \
+    V_XOR(XTMP1, XTMP3, XTMP1)                                              \
+    V_SHIFT_R(XTMP4, W_14, 6)                                               \
+            RND_RORX_1_6(h,a,b,c,d,e,f,g,i+1)                               \
+            RND_RORX_1_7(h,a,b,c,d,e,f,g,i+1)                               \
+    V_XOR(XTMP1, XTMP4, XTMP1)                                              \
+            RND_RORX_1_8(h,a,b,c,d,e,f,g,i+1)                               \
+    V_ADD(W_0, W_0, XTMP1)                                                  \
+
+#endif
+
+#define _INIT_MASK(mask) \
+    "vmovdqu %[mask], %%" #mask "\n\t"
+#define INIT_MASK(mask) \
+       _INIT_MASK(mask)
+
+#define _LOAD_W_2(i1, i2, xmm1, xmm2, mask, reg)           \
+    "vmovdqu    " #i1 "*16(%%" #reg "), %%" #xmm1 "\n\t"   \
+    "vmovdqu    " #i2 "*16(%%" #reg "), %%" #xmm2 "\n\t"   \
+    "vpshufb    %%" #mask ", %%" #xmm1 ", %%" #xmm1 "\n\t" \
+    "vpshufb    %%" #mask ", %%" #xmm2 ", %%" #xmm2 "\n\t"
+#define LOAD_W_2(i1, i2, xmm1, xmm2, mask, reg) \
+       _LOAD_W_2(i1, i2, xmm1, xmm2, mask, reg)
+
+#define LOAD_W(mask, reg)                           \
+    /* X0..3(xmm4..7), W[0..15] = buffer[0.15];  */ \
+    LOAD_W_2(0, 1, W_0 , W_2 , mask, reg)           \
+    LOAD_W_2(2, 3, W_4 , W_6 , mask, reg)           \
+    LOAD_W_2(4, 5, W_8 , W_10, mask, reg)           \
+    LOAD_W_2(6, 7, W_12, W_14, mask, reg)
+
+#define _SET_W_X_2(xmm0, xmm1, reg, i)                          \
+    "vpaddq     " #i "+ 0(%%" #reg "), %%" #xmm0 ", %%xmm8\n\t" \
+    "vpaddq     " #i "+16(%%" #reg "), %%" #xmm1 ", %%xmm9\n\t" \
+    "vmovdqu    %%xmm8, " #i "+ 0(" WX ")\n\t"                  \
+    "vmovdqu    %%xmm9, " #i "+16(" WX ")\n\t"                  \
+
+#define SET_W_X_2(xmm0, xmm1, reg, i) \
+       _SET_W_X_2(xmm0, xmm1, reg, i)
+
+#define SET_W_X(reg)                \
+    SET_W_X_2(W_0 , W_2 , reg,  0)  \
+    SET_W_X_2(W_4 , W_6 , reg, 32)  \
+    SET_W_X_2(W_8 , W_10, reg, 64)  \
+    SET_W_X_2(W_12, W_14, reg, 96)
+
+#define LOAD_DIGEST()                     \
+    "movq         (%[sha512]), %%r8 \n\t" \
+    "movq        8(%[sha512]), %%r9 \n\t" \
+    "movq       16(%[sha512]), %%r10\n\t" \
+    "movq       24(%[sha512]), %%r11\n\t" \
+    "movq       32(%[sha512]), %%r12\n\t" \
+    "movq       40(%[sha512]), %%r13\n\t" \
+    "movq       48(%[sha512]), %%r14\n\t" \
+    "movq       56(%[sha512]), %%r15\n\t"
+
+#define STORE_ADD_DIGEST()                \
+    "addq        %%r8,   (%[sha512])\n\t" \
+    "addq        %%r9,  8(%[sha512])\n\t" \
+    "addq       %%r10, 16(%[sha512])\n\t" \
+    "addq       %%r11, 24(%[sha512])\n\t" \
+    "addq       %%r12, 32(%[sha512])\n\t" \
+    "addq       %%r13, 40(%[sha512])\n\t" \
+    "addq       %%r14, 48(%[sha512])\n\t" \
+    "addq       %%r15, 56(%[sha512])\n\t"
+
+#define ADD_DIGEST()                      \
+    "addq         (%[sha512]), %%r8 \n\t" \
+    "addq        8(%[sha512]), %%r9 \n\t" \
+    "addq       16(%[sha512]), %%r10\n\t" \
+    "addq       24(%[sha512]), %%r11\n\t" \
+    "addq       32(%[sha512]), %%r12\n\t" \
+    "addq       40(%[sha512]), %%r13\n\t" \
+    "addq       48(%[sha512]), %%r14\n\t" \
+    "addq       56(%[sha512]), %%r15\n\t"
+
+#define STORE_DIGEST()                    \
+    "movq        %%r8,   (%[sha512])\n\t" \
+    "movq        %%r9,  8(%[sha512])\n\t" \
+    "movq       %%r10, 16(%[sha512])\n\t" \
+    "movq       %%r11, 24(%[sha512])\n\t" \
+    "movq       %%r12, 32(%[sha512])\n\t" \
+    "movq       %%r13, 40(%[sha512])\n\t" \
+    "movq       %%r14, 48(%[sha512])\n\t" \
+    "movq       %%r15, 56(%[sha512])\n\t"
 
 #endif /* HAVE_INTEL_AVX1 */
-
-#if defined(HAVE_INTEL_AVX2)
-#define Ry_1(i, w) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+K[i+j] + w;
-#define Ry_2(i, w) d(i)+=h(i);
-#define Ry_3(i, w) h(i)+=S0(a(i))+Maj(a(i),b(i),c(i));
-#endif /* HAVE_INTEL_AVX2 */
-
-/* INLINE Assember for Intel AVX1 instructions */
-#if defined(HAVE_INTEL_AVX1)
-#if defined(DEBUG_XMM)
-    #define SAVE_REG(i)     __asm__ volatile("vmovdqu %%xmm"#i", %0 \n\t":"=m"(reg[i][0]):);
-    #define RECV_REG(i)     __asm__ volatile("vmovdqu %0, %%xmm"#i" \n\t"::"m"(reg[i][0]));
-
-    #define _DUMP_REG(REG, name)\
-        { word64 buf[16];word64 reg[16][2];int k;\
-          SAVE_REG(0); SAVE_REG(1); SAVE_REG(2);  SAVE_REG(3);  SAVE_REG(4);  \
-          SAVE_REG(5);   SAVE_REG(6); SAVE_REG(7);SAVE_REG(8); SAVE_REG(9); SAVE_REG(10);\
-           SAVE_REG(11); SAVE_REG(12); SAVE_REG(13); SAVE_REG(14); SAVE_REG(15); \
-          __asm__ volatile("vmovdqu %%"#REG", %0 \n\t":"=m"(buf[0]):);\
-          printf(" "#name":\t"); for(k=0; k<2; k++) printf("%016lx.", (word64)(buf[k])); printf("\n"); \
-          RECV_REG(0); RECV_REG(1); RECV_REG(2);  RECV_REG(3);  RECV_REG(4);\
-          RECV_REG(5);   RECV_REG(6); RECV_REG(7); RECV_REG(8); RECV_REG(9);\
-          RECV_REG(10); RECV_REG(11); RECV_REG(12); RECV_REG(13); RECV_REG(14); RECV_REG(15);\
-        }
-
-    #define DUMP_REG(REG) _DUMP_REG(REG, #REG)
-    #define PRINTF(fmt, ...)
-#else
-    #define DUMP_REG(REG)
-    #define PRINTF(fmt, ...)
-#endif /* DEBUG_XMM */
-
-#define _MOVE_to_REG(xymm, mem)       __asm__ volatile("vmovdqu %0, %%"#xymm" "\
-        :: "m"(mem));
-#define _MOVE_to_MEM(mem,i, xymm)     __asm__ volatile("vmovdqu %%"#xymm", %0" :\
-         "=m"(mem[i]),"=m"(mem[i+1]),"=m"(mem[i+2]),"=m"(mem[i+3]):);
-#define _MOVE(dest, src)              __asm__ volatile("vmovdqu %%"#src",  %%"\
-        #dest" "::);
-
-#define _S_TEMP(dest, src, bits, temp)  __asm__ volatile("vpsrlq  $"#bits", %%"\
-        #src", %%"#dest"\n\tvpsllq  $64-"#bits", %%"#src", %%"#temp"\n\tvpor %%"\
-        #temp",%%"#dest", %%"#dest" "::);
-#define _AVX1_R(dest, src, bits)      __asm__ volatile("vpsrlq  $"#bits", %%"\
-        #src", %%"#dest" "::);
-#define _XOR(dest, src1, src2)        __asm__ volatile("vpxor   %%"#src1", %%"\
-        #src2", %%"#dest" "::);
-#define _OR(dest, src1, src2)         __asm__ volatile("vpor    %%"#src1", %%"\
-        #src2", %%"#dest" "::);
-#define _ADD(dest, src1, src2)        __asm__ volatile("vpaddq   %%"#src1", %%"\
-        #src2", %%"#dest" "::);
-#define _ADD_MEM(dest, src1, mem)     __asm__ volatile("vpaddq   %0, %%"#src1", %%"\
-        #dest" "::"m"(mem));
-
-#define MOVE_to_REG(xymm, mem)      _MOVE_to_REG(xymm, mem)
-#define MOVE_to_MEM(mem, i, xymm)   _MOVE_to_MEM(mem, i, xymm)
-#define MOVE(dest, src)             _MOVE(dest, src)
-
-#define XOR(dest, src1, src2)      _XOR(dest, src1, src2)
-#define OR(dest, src1, src2)       _OR(dest, src1, src2)
-#define ADD(dest, src1, src2)      _ADD(dest, src1, src2)
-
-#define S_TMP(dest, src, bits, temp) _S_TEMP(dest, src, bits, temp);
-#define AVX1_S(dest, src, bits)      S_TMP(dest, src, bits, S_TEMP)
-#define AVX1_R(dest, src, bits)      _AVX1_R(dest, src, bits)
-
-#define Init_Mask(mask) \
-     __asm__ volatile("vmovdqu %0, %%xmm1\n\t"::"m"(mask):"%xmm1");
-
-#define _W_from_buff1(w, buff, xmm) \
-    /* X0..3(xmm4..7), W[0..15] = sha512->buffer[0.15];  */\
-     __asm__ volatile("vmovdqu %1, %%"#xmm"\n\t"\
-                      "vpshufb %%xmm1, %%"#xmm", %%"#xmm"\n\t"\
-                      "vmovdqu %%"#xmm", %0"\
-                      :"=m"(w): "m"(buff):"%xmm0");
-
-#define W_from_buff1(w, buff, xmm) _W_from_buff1(w, buff, xmm)
-
-#define W_from_buff(w, buff)\
-     Init_Mask(mBYTE_FLIP_MASK[0]);\
-     W_from_buff1(w[0], buff[0], W_0);\
-     W_from_buff1(w[2], buff[2], W_2);\
-     W_from_buff1(w[4], buff[4], W_4);\
-     W_from_buff1(w[6], buff[6], W_6);\
-     W_from_buff1(w[8], buff[8], W_8);\
-     W_from_buff1(w[10],buff[10],W_10);\
-     W_from_buff1(w[12],buff[12],W_12);\
-     W_from_buff1(w[14],buff[14],W_14);
-
-static word64 mBYTE_FLIP_MASK[] =  { 0x0001020304050607, 0x08090a0b0c0d0e0f };
-
-#define W_I_15  xmm14
-#define W_I_7   xmm11
-#define W_I_2   xmm13
-#define W_I     xmm12
-#define G_TEMP  xmm0
-#define S_TEMP  xmm1
-#define XMM_TEMP0  xmm2
-
-#define W_0     xmm12
-#define W_2     xmm3
-#define W_4     xmm4
-#define W_6     xmm5
-#define W_8     xmm6
-#define W_10    xmm7
-#define W_12    xmm8
-#define W_14    xmm9
-
-#define s0_1(dest, src)      AVX1_S(dest, src, 1);
-#define s0_2(dest, src)      AVX1_S(G_TEMP, src, 8); XOR(dest, G_TEMP, dest);
-#define s0_3(dest, src)      AVX1_R(G_TEMP, src, 7);  XOR(dest, G_TEMP, dest);
-
-#define s1_1(dest, src)      AVX1_S(dest, src, 19);
-#define s1_2(dest, src)      AVX1_S(G_TEMP, src, 61); XOR(dest, G_TEMP, dest);
-#define s1_3(dest, src)      AVX1_R(G_TEMP, src, 6); XOR(dest, G_TEMP, dest);
-
-#define s0_(dest, src)       s0_1(dest, src); s0_2(dest, src); s0_3(dest, src)
-#define s1_(dest, src)       s1_1(dest, src); s1_2(dest, src); s1_3(dest, src)
-
-#define Block_xx_1(i) \
-    MOVE_to_REG(W_I_15, W_X[(i-15)&15]);\
-    MOVE_to_REG(W_I_7,  W_X[(i- 7)&15]);\
-
-#define Block_xx_2(i) \
-    MOVE_to_REG(W_I_2,  W_X[(i- 2)&15]);\
-    MOVE_to_REG(W_I,    W_X[(i)]);\
-
-#define Block_xx_3(i) \
-    s0_ (XMM_TEMP0, W_I_15);\
-
-#define Block_xx_4(i) \
-    ADD(W_I, W_I, XMM_TEMP0);\
-    ADD(W_I, W_I, W_I_7);\
-
-#define Block_xx_5(i) \
-    s1_ (XMM_TEMP0, W_I_2);\
-
-#define Block_xx_6(i) \
-    ADD(W_I, W_I, XMM_TEMP0);\
-    MOVE_to_MEM(W_X,i, W_I);\
-    if (i==0)\
-        MOVE_to_MEM(W_X,16, W_I);\
-
-#define Block_xx_7(i) \
-    MOVE_to_REG(W_I_15, W_X[(i-15)&15]);\
-    MOVE_to_REG(W_I_7,  W_X[(i- 7)&15]);\
-
-#define Block_xx_8(i) \
-    MOVE_to_REG(W_I_2,  W_X[(i- 2)&15]);\
-    MOVE_to_REG(W_I,    W_X[(i)]);\
-
-#define Block_xx_9(i) \
-    s0_ (XMM_TEMP0, W_I_15);\
-
-#define Block_xx_10(i) \
-    ADD(W_I, W_I, XMM_TEMP0);\
-    ADD(W_I, W_I, W_I_7);\
-
-#define Block_xx_11(i) \
-    s1_ (XMM_TEMP0, W_I_2);\
-
-#define Block_xx_12(i) \
-    ADD(W_I, W_I, XMM_TEMP0);\
-    MOVE_to_MEM(W_X,i, W_I);\
-    if ((i)==0)\
-        MOVE_to_MEM(W_X,16, W_I);\
-
-static INLINE void Block_0_1(word64 *W_X) { Block_xx_1(0); }
-static INLINE void Block_0_2(word64 *W_X) { Block_xx_2(0); }
-static INLINE void Block_0_3(void) { Block_xx_3(0); }
-static INLINE void Block_0_4(void) { Block_xx_4(0); }
-static INLINE void Block_0_5(void) { Block_xx_5(0); }
-static INLINE void Block_0_6(word64 *W_X) { Block_xx_6(0); }
-static INLINE void Block_0_7(word64 *W_X) { Block_xx_7(2); }
-static INLINE void Block_0_8(word64 *W_X) { Block_xx_8(2); }
-static INLINE void Block_0_9(void) { Block_xx_9(2); }
-static INLINE void Block_0_10(void){ Block_xx_10(2); }
-static INLINE void Block_0_11(void){ Block_xx_11(2); }
-static INLINE void Block_0_12(word64 *W_X){ Block_xx_12(2); }
-
-static INLINE void Block_4_1(word64 *W_X) { Block_xx_1(4); }
-static INLINE void Block_4_2(word64 *W_X) { Block_xx_2(4); }
-static INLINE void Block_4_3(void) { Block_xx_3(4); }
-static INLINE void Block_4_4(void) { Block_xx_4(4); }
-static INLINE void Block_4_5(void) { Block_xx_5(4); }
-static INLINE void Block_4_6(word64 *W_X) { Block_xx_6(4); }
-static INLINE void Block_4_7(word64 *W_X) { Block_xx_7(6); }
-static INLINE void Block_4_8(word64 *W_X) { Block_xx_8(6); }
-static INLINE void Block_4_9(void) { Block_xx_9(6); }
-static INLINE void Block_4_10(void){ Block_xx_10(6); }
-static INLINE void Block_4_11(void){ Block_xx_11(6); }
-static INLINE void Block_4_12(word64 *W_X){ Block_xx_12(6); }
-
-static INLINE void Block_8_1(word64 *W_X) { Block_xx_1(8); }
-static INLINE void Block_8_2(word64 *W_X) { Block_xx_2(8); }
-static INLINE void Block_8_3(void) { Block_xx_3(8); }
-static INLINE void Block_8_4(void) { Block_xx_4(8); }
-static INLINE void Block_8_5(void) { Block_xx_5(8); }
-static INLINE void Block_8_6(word64 *W_X) { Block_xx_6(8); }
-static INLINE void Block_8_7(word64 *W_X) { Block_xx_7(10); }
-static INLINE void Block_8_8(word64 *W_X) { Block_xx_8(10); }
-static INLINE void Block_8_9(void) { Block_xx_9(10); }
-static INLINE void Block_8_10(void){ Block_xx_10(10); }
-static INLINE void Block_8_11(void){ Block_xx_11(10); }
-static INLINE void Block_8_12(word64 *W_X){ Block_xx_12(10); }
-
-static INLINE void Block_12_1(word64 *W_X) { Block_xx_1(12); }
-static INLINE void Block_12_2(word64 *W_X) { Block_xx_2(12); }
-static INLINE void Block_12_3(void) { Block_xx_3(12); }
-static INLINE void Block_12_4(void) { Block_xx_4(12); }
-static INLINE void Block_12_5(void) { Block_xx_5(12); }
-static INLINE void Block_12_6(word64 *W_X) { Block_xx_6(12); }
-static INLINE void Block_12_7(word64 *W_X) { Block_xx_7(14); }
-static INLINE void Block_12_8(word64 *W_X) { Block_xx_8(14); }
-static INLINE void Block_12_9(void) { Block_xx_9(14); }
-static INLINE void Block_12_10(void){ Block_xx_10(14); }
-static INLINE void Block_12_11(void){ Block_xx_11(14); }
-static INLINE void Block_12_12(word64 *W_X){ Block_xx_12(14); }
-
-#endif /* HAVE_INTEL_AVX1 */
-
-#if defined(HAVE_INTEL_AVX2)
-static const unsigned long mBYTE_FLIP_MASK_Y[] =
-   { 0x0001020304050607, 0x08090a0b0c0d0e0f, 0x0001020304050607, 0x08090a0b0c0d0e0f };
-
-#define W_from_buff_Y(buff)\
-    { /* X0..3(ymm9..12), W_X[0..15] = sha512->buffer[0.15];  */\
-     __asm__ volatile("vmovdqu %0, %%ymm8\n\t"::"m"(mBYTE_FLIP_MASK_Y[0]));\
-     __asm__ volatile("vmovdqu %0, %%ymm12\n\t"\
-                      "vmovdqu %1, %%ymm4\n\t"\
-                      "vpshufb %%ymm8, %%ymm12, %%ymm12\n\t"\
-                      "vpshufb %%ymm8, %%ymm4, %%ymm4\n\t"\
-                      :: "m"(buff[0]),  "m"(buff[4]));\
-     __asm__ volatile("vmovdqu %0, %%ymm5\n\t"\
-                      "vmovdqu %1, %%ymm6\n\t"\
-                      "vpshufb %%ymm8, %%ymm5, %%ymm5\n\t"\
-                      "vpshufb %%ymm8, %%ymm6, %%ymm6\n\t"\
-                      :: "m"(buff[8]),  "m"(buff[12]));\
-    }
-
-#if defined(DEBUG_YMM)
-    #define SAVE_REG_Y(i) __asm__ volatile("vmovdqu %%ymm"#i", %0 \n\t":"=m"(reg[i-4][0]):);
-    #define RECV_REG_Y(i) __asm__ volatile("vmovdqu %0, %%ymm"#i" \n\t"::"m"(reg[i-4][0]));
-
-    #define _DUMP_REG_Y(REG, name)\
-        { word64 buf[16];word64 reg[16][2];int k;\
-          SAVE_REG_Y(4);  SAVE_REG_Y(5);   SAVE_REG_Y(6); SAVE_REG_Y(7); \
-          SAVE_REG_Y(8); SAVE_REG_Y(9); SAVE_REG_Y(10); SAVE_REG_Y(11); SAVE_REG_Y(12);\
-          SAVE_REG_Y(13); SAVE_REG_Y(14); SAVE_REG_Y(15); \
-          __asm__ volatile("vmovdqu %%"#REG", %0 \n\t":"=m"(buf[0]):);\
-          printf(" "#name":\t"); for(k=0; k<4; k++) printf("%016lx.", (word64)buf[k]); printf("\n"); \
-          RECV_REG_Y(4);  RECV_REG_Y(5);   RECV_REG_Y(6); RECV_REG_Y(7); \
-          RECV_REG_Y(8); RECV_REG_Y(9); RECV_REG_Y(10); RECV_REG_Y(11); RECV_REG_Y(12); \
-          RECV_REG_Y(13); RECV_REG_Y(14); RECV_REG_Y(15);\
-        }
-
-    #define DUMP_REG_Y(REG) _DUMP_REG_Y(REG, #REG)
-    #define DUMP_REG2_Y(REG) _DUMP_REG_Y(REG, #REG)
-    #define PRINTF_Y(fmt, ...)
-#else
-    #define DUMP_REG_Y(REG)
-    #define DUMP_REG2_Y(REG)
-    #define PRINTF_Y(fmt, ...)
-#endif /* DEBUG_YMM */
-
-#define _MOVE_to_REGy(ymm, mem)         __asm__ volatile("vmovdqu %0, %%"#ymm" "\
-                                        :: "m"(mem));
-#define _MOVE_to_MEMy(mem,i, ymm)       __asm__ volatile("vmovdqu %%"#ymm", %0" \
-        : "=m"(mem[i]),"=m"(mem[i+1]),"=m"(mem[i+2]),"=m"(mem[i+3]):);
-#define _MOVE_128y(ymm0, ymm1, ymm2, map)  __asm__ volatile("vperm2i128  $"\
-        #map", %%"#ymm2", %%"#ymm1", %%"#ymm0" "::);
-#define _S_TEMPy(dest, src, bits, temp) \
-         __asm__ volatile("vpsrlq  $"#bits", %%"#src", %%"#dest"\n\tvpsllq  $64-"#bits\
-        ", %%"#src", %%"#temp"\n\tvpor %%"#temp",%%"#dest", %%"#dest" "::);
-#define _AVX2_R(dest, src, bits)        __asm__ volatile("vpsrlq  $"#bits", %%"\
-         #src", %%"#dest" "::);
-#define _XORy(dest, src1, src2)         __asm__ volatile("vpxor   %%"#src1", %%"\
-         #src2", %%"#dest" "::);
-#define _ADDy(dest, src1, src2)         __asm__ volatile("vpaddq   %%"#src1", %%"\
-         #src2", %%"#dest" "::);
-#define _BLENDy(map, dest, src1, src2)  __asm__ volatile("vpblendd    $"#map", %%"\
-         #src1",   %%"#src2", %%"#dest" "::);
-#define _BLENDQy(map, dest, src1, src2) __asm__ volatile("vblendpd   $"#map", %%"\
-         #src1",   %%"#src2", %%"#dest" "::);
-#define _PERMQy(map, dest, src)         __asm__ volatile("vpermq  $"#map", %%"\
-         #src", %%"#dest" "::);
-
-#define MOVE_to_REGy(ymm, mem)      _MOVE_to_REGy(ymm, mem)
-#define MOVE_to_MEMy(mem, i, ymm)   _MOVE_to_MEMy(mem, i, ymm)
-
-#define MOVE_128y(ymm0, ymm1, ymm2, map) _MOVE_128y(ymm0, ymm1, ymm2, map)
-#define XORy(dest, src1, src2)      _XORy(dest, src1, src2)
-#define ADDy(dest, src1, src2)      _ADDy(dest, src1, src2)
-#define BLENDy(map, dest, src1, src2) _BLENDy(map, dest, src1, src2)
-#define BLENDQy(map, dest, src1, src2) _BLENDQy(map, dest, src1, src2)
-#define PERMQy(map, dest, src)      _PERMQy(map, dest, src)
-
-
-#define S_TMPy(dest, src, bits, temp) _S_TEMPy(dest, src, bits, temp);
-#define AVX2_S(dest, src, bits)      S_TMPy(dest, src, bits, S_TEMPy)
-#define AVX2_R(dest, src, bits)      _AVX2_R(dest, src, bits)
-
-
-#define    FEEDBACK1_to_W_I_2(w_i_2, w_i)    MOVE_128y(YMM_TEMP0, w_i, w_i, 0x08);\
-                                       BLENDy(0xf0, w_i_2, YMM_TEMP0, w_i_2);
-
-#define    MOVE_W_to_W_I_15(w_i_15, w_0, w_4)  BLENDQy(0x1, w_i_15, w_4, w_0);\
-                                       PERMQy(0x39, w_i_15, w_i_15);
-#define    MOVE_W_to_W_I_7(w_i_7,  w_8, w_12)  BLENDQy(0x1, w_i_7, w_12, w_8);\
-                                       PERMQy(0x39, w_i_7, w_i_7);
-#define    MOVE_W_to_W_I_2(w_i_2,  w_12)       BLENDQy(0xc, w_i_2, w_12, w_i_2);\
-                                       PERMQy(0x0e, w_i_2, w_i_2);
-
-
-#define W_I_16y  ymm8
-#define W_I_15y  ymm9
-#define W_I_7y  ymm10
-#define W_I_2y  ymm11
-#define W_Iy    ymm12
-#define G_TEMPy     ymm13
-#define S_TEMPy     ymm14
-#define YMM_TEMP0  ymm15
-#define YMM_TEMP0x xmm15
-#define W_I_TEMPy   ymm7
-#define W_K_TEMPy   ymm15
-#define W_K_TEMPx  xmm15
-#define W_0y     ymm12
-#define W_4y     ymm4
-#define W_8y     ymm5
-#define W_12y    ymm6
-
-
-#define MOVE_15_to_16(w_i_16, w_i_15, w_i_7)\
-    __asm__ volatile("vperm2i128  $0x01, %%"#w_i_15", %%"#w_i_15", %%"#w_i_15" "::);\
-    __asm__ volatile("vpblendd    $0x08, %%"#w_i_15", %%"#w_i_7", %%"#w_i_16" "::);\
-    __asm__ volatile("vperm2i128 $0x01,  %%"#w_i_7",  %%"#w_i_7", %%"#w_i_15" "::);\
-    __asm__ volatile("vpblendd    $0x80, %%"#w_i_15", %%"#w_i_16", %%"#w_i_16" "::);\
-    __asm__ volatile("vpshufd    $0x93,  %%"#w_i_16", %%"#w_i_16" "::);\
-
-#define MOVE_7_to_15(w_i_15, w_i_7)\
-    __asm__ volatile("vmovdqu                 %%"#w_i_7",  %%"#w_i_15" "::);\
-
-#define MOVE_I_to_7(w_i_7, w_i)\
-    __asm__ volatile("vperm2i128 $0x01,       %%"#w_i",   %%"#w_i",   %%"#w_i_7" "::);\
-    __asm__ volatile("vpblendd    $0x01,       %%"#w_i_7",   %%"#w_i", %%"#w_i_7" "::);\
-    __asm__ volatile("vpshufd    $0x39, %%"#w_i_7", %%"#w_i_7" "::);\
-
-#define MOVE_I_to_2(w_i_2, w_i)\
-    __asm__ volatile("vperm2i128 $0x01,       %%"#w_i", %%"#w_i", %%"#w_i_2" "::);\
-    __asm__ volatile("vpshufd    $0x0e, %%"#w_i_2", %%"#w_i_2" "::);\
-
-#endif /* HAVE_INTEL_AVX2 */
 
 
 /***  Transform Body ***/
 #if defined(HAVE_INTEL_AVX1)
-static int Transform_AVX1(wc_Sha512* sha512)
+static int Transform_Sha512_AVX1(wc_Sha512* sha512)
 {
-    const word64* K = K512;
-    word64 W_X[16+4] = {0};
-    word32 j;
-    word64 T[8];
-
-    /* Copy digest to working vars */
-    XMEMCPY(T, sha512->digest, sizeof(T));
-
-    W_from_buff(W_X, sha512->buffer);
-    for (j = 0; j < 80; j += 16) {
-        Rx_1( 0); Block_0_1(W_X); Rx_2( 0); Block_0_2(W_X); Rx_3( 0); Block_0_3();
-        Rx_1( 1); Block_0_4(); Rx_2( 1); Block_0_5(); Rx_3( 1); Block_0_6(W_X);
-        Rx_1( 2); Block_0_7(W_X); Rx_2( 2); Block_0_8(W_X); Rx_3( 2); Block_0_9();
-        Rx_1( 3); Block_0_10();Rx_2( 3); Block_0_11();Rx_3( 3); Block_0_12(W_X);
-
-        Rx_1( 4); Block_4_1(W_X); Rx_2( 4); Block_4_2(W_X); Rx_3( 4); Block_4_3();
-        Rx_1( 5); Block_4_4(); Rx_2( 5); Block_4_5(); Rx_3( 5); Block_4_6(W_X);
-        Rx_1( 6); Block_4_7(W_X); Rx_2( 6); Block_4_8(W_X); Rx_3( 6); Block_4_9();
-        Rx_1( 7); Block_4_10();Rx_2( 7); Block_4_11();Rx_3( 7); Block_4_12(W_X);
-
-        Rx_1( 8); Block_8_1(W_X); Rx_2( 8); Block_8_2(W_X); Rx_3( 8); Block_8_3();
-        Rx_1( 9); Block_8_4(); Rx_2( 9); Block_8_5(); Rx_3( 9); Block_8_6(W_X);
-        Rx_1(10); Block_8_7(W_X); Rx_2(10); Block_8_8(W_X); Rx_3(10); Block_8_9();
-        Rx_1(11); Block_8_10();Rx_2(11); Block_8_11();Rx_3(11); Block_8_12(W_X);
-
-        Rx_1(12); Block_12_1(W_X); Rx_2(12); Block_12_2(W_X); Rx_3(12); Block_12_3();
-        Rx_1(13); Block_12_4(); Rx_2(13); Block_12_5(); Rx_3(13); Block_12_6(W_X);
-        Rx_1(14); Block_12_7(W_X); Rx_2(14); Block_12_8(W_X); Rx_3(14); Block_12_9();
-        Rx_1(15); Block_12_10();Rx_2(15); Block_12_11();Rx_3(15); Block_12_12(W_X);
-    }
-
-    /* Add the working vars back into digest */
-    sha512->digest[0] += a(0);
-    sha512->digest[1] += b(0);
-    sha512->digest[2] += c(0);
-    sha512->digest[3] += d(0);
-    sha512->digest[4] += e(0);
-    sha512->digest[5] += f(0);
-    sha512->digest[6] += g(0);
-    sha512->digest[7] += h(0);
-
-    /* Wipe variables */
-#if !defined(HAVE_INTEL_AVX1) && !defined(HAVE_INTEL_AVX2)
-    XMEMSET(W_X, 0, sizeof(word64) * 16);
-#endif
-    XMEMSET(T, 0, sizeof(T));
+    __asm__ __volatile__ (
+
+        /* 16 Ws plus loop counter. */
+        "subq   $136, %%rsp\n\t"
+        "leaq   64(%[sha512]), %%rax\n\t"
+
+    INIT_MASK(MASK)
+    LOAD_DIGEST()
+
+    LOAD_W(MASK, rax)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+        /* b */
+        "movq   %%r9, " L4 "\n\t"
+        /* e */
+        "movq   %%r12, " L1 "\n\t"
+        /* b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+    SET_W_X(rsi)
+
+        "addq   $128, %%rsi\n\t"
+
+    MsgSched2(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched2(W_2,W_4,W_6,W_8,W_10,W_12,W_14,W_0,RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    MsgSched2(W_4,W_6,W_8,W_10,W_12,W_14,W_0,W_2,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched2(W_6,W_8,W_10,W_12,W_14,W_0,W_2,W_4,RC,RD,RE,RF,RG,RH,RA,RB, 6)
+    MsgSched2(W_8,W_10,W_12,W_14,W_0,W_2,W_4,W_6,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched2(W_10,W_12,W_14,W_0,W_2,W_4,W_6,W_8,RG,RH,RA,RB,RC,RD,RE,RF,10)
+    MsgSched2(W_12,W_14,W_0,W_2,W_4,W_6,W_8,W_10,RE,RF,RG,RH,RA,RB,RC,RD,12)
+    MsgSched2(W_14,W_0,W_2,W_4,W_6,W_8,W_10,W_12,RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+        "subl   $1, 16*8(" WX ")\n\t"
+        "jne    1b\n\t"
+
+    SET_W_X(rsi)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB, 6)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,10)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,12)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    STORE_ADD_DIGEST()
+
+        "addq   $136, %%rsp\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory", "rsi"
+    );
+
+    return 0;
+    }
+
+static int Transform_Sha512_AVX1_Len(wc_Sha512* sha512, word32 len)
+{
+    __asm__ __volatile__ (
+
+        "movq   224(%[sha512]), %%rsi\n\t"
+        "leaq   %[K512], %%rdx\n\t"
+
+    INIT_MASK(MASK)
+    LOAD_DIGEST()
+
+        "# Start of processing a block\n"
+        "2:\n\t"
+
+        /* 16 Ws plus loop counter and K512. len goes into -4(%rsp).
+         * Debug needs more stack space. */
+        "subq   $256, %%rsp\n\t"
+
+    LOAD_W(MASK, rsi)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        /* b */
+        "movq   %%r9, " L4 "\n\t"
+        /* e */
+        "movq   %%r12, " L1 "\n\t"
+        /* b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+    SET_W_X(rdx)
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+        "addq   $128, %%rdx\n\t"
+        "movq   %%rdx, 17*8(%%rsp)\n\t"
+
+    MsgSched2(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched2(W_2,W_4,W_6,W_8,W_10,W_12,W_14,W_0,RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    MsgSched2(W_4,W_6,W_8,W_10,W_12,W_14,W_0,W_2,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched2(W_6,W_8,W_10,W_12,W_14,W_0,W_2,W_4,RC,RD,RE,RF,RG,RH,RA,RB, 6)
+    MsgSched2(W_8,W_10,W_12,W_14,W_0,W_2,W_4,W_6,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched2(W_10,W_12,W_14,W_0,W_2,W_4,W_6,W_8,RG,RH,RA,RB,RC,RD,RE,RF,10)
+    MsgSched2(W_12,W_14,W_0,W_2,W_4,W_6,W_8,W_10,RE,RF,RG,RH,RA,RB,RC,RD,12)
+    MsgSched2(W_14,W_0,W_2,W_4,W_6,W_8,W_10,W_12,RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+        "movq   17*8(%%rsp), %%rdx\n\t"
+
+    SET_W_X(rdx)
+
+        "subl   $1, 16*8(" WX ")\n\t"
+        "jne    1b\n\t"
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB, 6)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,10)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,12)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    ADD_DIGEST()
+
+        "addq   $256, %%rsp\n\t"
+        "leaq   %[K512], %%rdx\n\t"
+        "addq   $128, %%rsi\n\t"
+        "subl   $128, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "jnz    2b\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK),
+          [len]    "m" (len),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory", "rsi"
+    );
 
     return 0;
@@ -1090 +1562 @@
 #endif /* HAVE_INTEL_AVX1 */
 
-#if defined(HAVE_INTEL_AVX2) && defined(HAVE_INTEL_AVX1) && defined(HAVE_INTEL_RORX)
-static int Transform_AVX1_RORX(wc_Sha512* sha512)
+#if defined(HAVE_INTEL_AVX2) && defined(HAVE_INTEL_RORX)
+static int Transform_Sha512_AVX1_RORX(wc_Sha512* sha512)
 {
-    const word64* K = K512;
-    word64 W_X[16+4] = {0};
-    word32 j;
-    word64 T[8];
-
-    /* Copy digest to working vars */
-    XMEMCPY(T, sha512->digest, sizeof(T));
-
-    W_from_buff(W_X, sha512->buffer);
-    for (j = 0; j < 80; j += 16) {
-        Rx_RORX_1( 0); Block_0_1(W_X); Rx_RORX_2( 0); Block_0_2(W_X);
-                                    Rx_RORX_3( 0); Block_0_3();
-        Rx_RORX_1( 1); Block_0_4(); Rx_RORX_2( 1); Block_0_5();
-                                    Rx_RORX_3( 1); Block_0_6(W_X);
-        Rx_RORX_1( 2); Block_0_7(W_X); Rx_RORX_2( 2); Block_0_8(W_X);
-                                    Rx_RORX_3( 2); Block_0_9();
-        Rx_RORX_1( 3); Block_0_10();Rx_RORX_2( 3); Block_0_11();
-                                    Rx_RORX_3( 3); Block_0_12(W_X);
-
-        Rx_RORX_1( 4); Block_4_1(W_X); Rx_RORX_2( 4); Block_4_2(W_X);
-                                    Rx_RORX_3( 4); Block_4_3();
-        Rx_RORX_1( 5); Block_4_4(); Rx_RORX_2( 5); Block_4_5();
-                                    Rx_RORX_3( 5); Block_4_6(W_X);
-        Rx_RORX_1( 6); Block_4_7(W_X); Rx_RORX_2( 6); Block_4_8(W_X);
-                                    Rx_RORX_3( 6); Block_4_9();
-        Rx_RORX_1( 7); Block_4_10();Rx_RORX_2( 7); Block_4_11();
-                                    Rx_RORX_3( 7); Block_4_12(W_X);
-
-        Rx_RORX_1( 8); Block_8_1(W_X); Rx_RORX_2( 8); Block_8_2(W_X);
-                                    Rx_RORX_3( 8); Block_8_3();
-        Rx_RORX_1( 9); Block_8_4(); Rx_RORX_2( 9); Block_8_5();
-                                    Rx_RORX_3( 9); Block_8_6(W_X);
-        Rx_RORX_1(10); Block_8_7(W_X); Rx_RORX_2(10); Block_8_8(W_X);
-                                    Rx_RORX_3(10); Block_8_9();
-        Rx_RORX_1(11); Block_8_10();Rx_RORX_2(11); Block_8_11();
-                                    Rx_RORX_3(11); Block_8_12(W_X);
-
-        Rx_RORX_1(12); Block_12_1(W_X); Rx_RORX_2(12); Block_12_2(W_X);
-                                     Rx_RORX_3(12); Block_12_3();
-        Rx_RORX_1(13); Block_12_4(); Rx_RORX_2(13); Block_12_5();
-                                     Rx_RORX_3(13); Block_12_6(W_X);
-        Rx_RORX_1(14); Block_12_7(W_X); Rx_RORX_2(14); Block_12_8(W_X);
-                                     Rx_RORX_3(14); Block_12_9();
-        Rx_RORX_1(15); Block_12_10();Rx_RORX_2(15); Block_12_11();
-                                     Rx_RORX_3(15); Block_12_12(W_X);
-    }
-
-    /* Add the working vars back into digest */
-    sha512->digest[0] += a(0);
-    sha512->digest[1] += b(0);
-    sha512->digest[2] += c(0);
-    sha512->digest[3] += d(0);
-    sha512->digest[4] += e(0);
-    sha512->digest[5] += f(0);
-    sha512->digest[6] += g(0);
-    sha512->digest[7] += h(0);
-
-    /* Wipe variables */
-#if !defined(HAVE_INTEL_AVX1)&&!defined(HAVE_INTEL_AVX2)
-    XMEMSET(W_X, 0, sizeof(word64) * 16);
-#endif
-    XMEMSET(T, 0, sizeof(T));
+    __asm__ __volatile__ (
+
+        /* 16 Ws plus loop counter and K512. */
+        "subq   $144, %%rsp\n\t"
+        "leaq   64(%[sha512]), %%rax\n\t"
+
+    INIT_MASK(MASK)
+    LOAD_DIGEST()
+
+    LOAD_W(MASK, rax)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* L3 = 0 (add to prev h) */
+        "xorq   " L3 ", " L3 "\n\t"
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+    SET_W_X(rsi)
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+        "addq   $128, %%rsi\n\t"
+
+    MsgSched_RORX(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched_RORX(W_2,W_4,W_6,W_8,W_10,W_12,W_14,W_0,RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    MsgSched_RORX(W_4,W_6,W_8,W_10,W_12,W_14,W_0,W_2,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched_RORX(W_6,W_8,W_10,W_12,W_14,W_0,W_2,W_4,RC,RD,RE,RF,RG,RH,RA,RB, 6)
+    MsgSched_RORX(W_8,W_10,W_12,W_14,W_0,W_2,W_4,W_6,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched_RORX(W_10,W_12,W_14,W_0,W_2,W_4,W_6,W_8,RG,RH,RA,RB,RC,RD,RE,RF,10)
+    MsgSched_RORX(W_12,W_14,W_0,W_2,W_4,W_6,W_8,W_10,RE,RF,RG,RH,RA,RB,RC,RD,12)
+    MsgSched_RORX(W_14,W_0,W_2,W_4,W_6,W_8,W_10,W_12,RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    SET_W_X(rsi)
+
+        "subl   $1, 16*8(" WX ")\n\t"
+        "jne    1b\n\t"
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB, 6)
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,10)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,12)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+        /* Prev RND: h += Maj(a,b,c) */
+        "addq   " L3 ", %%r8\n\t"
+        "addq   $144, %%rsp\n\t"
+
+    STORE_ADD_DIGEST()
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory", "rsi"
+    );
+
+    return 0;
+    }
+
+static int Transform_Sha512_AVX1_RORX_Len(wc_Sha512* sha512, word32 len)
+{
+    __asm__ __volatile__ (
+
+        "movq   224(%[sha512]), %%rsi\n\t"
+        "leaq   %[K512], %%rcx\n\t"
+
+    INIT_MASK(MASK)
+    LOAD_DIGEST()
+
+        "# Start of processing a block\n"
+        "2:\n\t"
+
+        /* 16 Ws plus loop counter and K512. len goes into -4(%rsp).
+         * Debug needs more stack space. */
+        "subq   $256, %%rsp\n\t"
+
+    LOAD_W(MASK, rsi)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* L3 = 0 (add to prev h) */
+        "xorq   " L3 ", " L3 "\n\t"
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+    SET_W_X(rcx)
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+        "addq   $128, %%rcx\n\t"
+        "movq   %%rcx, 17*8(%%rsp)\n\t"
+
+    MsgSched_RORX(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched_RORX(W_2,W_4,W_6,W_8,W_10,W_12,W_14,W_0,RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    MsgSched_RORX(W_4,W_6,W_8,W_10,W_12,W_14,W_0,W_2,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched_RORX(W_6,W_8,W_10,W_12,W_14,W_0,W_2,W_4,RC,RD,RE,RF,RG,RH,RA,RB, 6)
+    MsgSched_RORX(W_8,W_10,W_12,W_14,W_0,W_2,W_4,W_6,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched_RORX(W_10,W_12,W_14,W_0,W_2,W_4,W_6,W_8,RG,RH,RA,RB,RC,RD,RE,RF,10)
+    MsgSched_RORX(W_12,W_14,W_0,W_2,W_4,W_6,W_8,W_10,RE,RF,RG,RH,RA,RB,RC,RD,12)
+    MsgSched_RORX(W_14,W_0,W_2,W_4,W_6,W_8,W_10,W_12,RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+        "movq   17*8(%%rsp), %%rcx\n\t"
+
+    SET_W_X(rcx)
+
+        "subl   $1, 16*8(" WX ")\n\t"
+        "jne    1b\n\t"
+
+    SET_W_X(rcx)
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB, 6)
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,10)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,12)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+        /* Prev RND: h += Maj(a,b,c) */
+        "addq   " L3 ", %%r8\n\t"
+        "addq   $256, %%rsp\n\t"
+
+    ADD_DIGEST()
+
+        "leaq   %[K512], %%rcx\n\t"
+        "addq   $128, %%rsi\n\t"
+        "subl   $128, %[len]\n\t"
+
+    STORE_DIGEST()
+
+        "jnz    2b\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK),
+          [len]    "m" (len),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, XMM_REGS, "memory", "rsi"
+    );
 
     return 0;
 }
-#endif /* HAVE_INTEL_AVX2 && HAVE_INTEL_AVX1 && HAVE_INTEL_RORX */
+#endif /* HAVE_INTEL_AVX2 && HAVE_INTEL_RORX */
 
 #if defined(HAVE_INTEL_AVX2)
-
-#define s0_1y(dest, src)      AVX2_S(dest, src, 1);
-#define s0_2y(dest, src)      AVX2_S(G_TEMPy, src, 8); XORy(dest, G_TEMPy, dest);
-#define s0_3y(dest, src)      AVX2_R(G_TEMPy, src, 7);  XORy(dest, G_TEMPy, dest);
-
-#define s1_1y(dest, src)      AVX2_S(dest, src, 19);
-#define s1_2y(dest, src)      AVX2_S(G_TEMPy, src, 61); XORy(dest, G_TEMPy, dest);
-#define s1_3y(dest, src)      AVX2_R(G_TEMPy, src, 6); XORy(dest, G_TEMPy, dest);
-
-#define s0_y(dest, src)       s0_1y(dest, src); s0_2y(dest, src); s0_3y(dest, src)
-#define s1_y(dest, src)       s1_1y(dest, src); s1_2y(dest, src); s1_3y(dest, src)
-
-
-#define Block_Y_xx_1(i, w_0, w_4, w_8, w_12)\
-    MOVE_W_to_W_I_15(W_I_15y, w_0, w_4);\
-    MOVE_W_to_W_I_7 (W_I_7y,  w_8, w_12);\
-    MOVE_W_to_W_I_2 (W_I_2y,  w_12);\
-
-#define Block_Y_xx_2(i, w_0, w_4, w_8, w_12)\
-    s0_1y (YMM_TEMP0, W_I_15y);\
-
-#define Block_Y_xx_3(i, w_0, w_4, w_8, w_12)\
-    s0_2y (YMM_TEMP0, W_I_15y);\
-
-#define Block_Y_xx_4(i, w_0, w_4, w_8, w_12)\
-    s0_3y (YMM_TEMP0, W_I_15y);\
-
-#define Block_Y_xx_5(i, w_0, w_4, w_8, w_12)\
-    ADDy(W_I_TEMPy, w_0, YMM_TEMP0);\
-
-#define Block_Y_xx_6(i, w_0, w_4, w_8, w_12)\
-    ADDy(W_I_TEMPy, W_I_TEMPy, W_I_7y);\
-    s1_1y (YMM_TEMP0, W_I_2y);\
-
-#define Block_Y_xx_7(i, w_0, w_4, w_8, w_12)\
-    s1_2y (YMM_TEMP0, W_I_2y);\
-
-#define Block_Y_xx_8(i, w_0, w_4, w_8, w_12)\
-    s1_3y (YMM_TEMP0, W_I_2y);\
-    ADDy(w_0, W_I_TEMPy, YMM_TEMP0);\
-
-#define Block_Y_xx_9(i, w_0, w_4, w_8, w_12)\
-    FEEDBACK1_to_W_I_2(W_I_2y, w_0);\
-
-#define Block_Y_xx_10(i, w_0, w_4, w_8, w_12) \
-    s1_1y (YMM_TEMP0, W_I_2y);\
-
-#define Block_Y_xx_11(i, w_0, w_4, w_8, w_12) \
-    s1_2y (YMM_TEMP0, W_I_2y);\
-
-#define Block_Y_xx_12(i, w_0, w_4, w_8, w_12)\
-    s1_3y (YMM_TEMP0, W_I_2y);\
-    ADDy(w_0, W_I_TEMPy, YMM_TEMP0);\
-    MOVE_to_MEMy(w,0, w_4);\
-
-
-static INLINE void Block_Y_0_1(void) { Block_Y_xx_1(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_2(void) { Block_Y_xx_2(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_3(void) { Block_Y_xx_3(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_4(void) { Block_Y_xx_4(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_5(void) { Block_Y_xx_5(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_6(void) { Block_Y_xx_6(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_7(void) { Block_Y_xx_7(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_8(void) { Block_Y_xx_8(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_9(void) { Block_Y_xx_9(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_10(void){ Block_Y_xx_10(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_11(void){ Block_Y_xx_11(0, W_0y, W_4y, W_8y, W_12y); }
-static INLINE void Block_Y_0_12(word64 *w){ Block_Y_xx_12(0, W_0y, W_4y, W_8y, W_12y); }
-
-static INLINE void Block_Y_4_1(void) { Block_Y_xx_1(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_2(void) { Block_Y_xx_2(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_3(void) { Block_Y_xx_3(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_4(void) { Block_Y_xx_4(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_5(void) { Block_Y_xx_5(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_6(void) { Block_Y_xx_6(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_7(void) { Block_Y_xx_7(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_8(void) { Block_Y_xx_8(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_9(void) { Block_Y_xx_9(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_10(void) { Block_Y_xx_10(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_11(void) { Block_Y_xx_11(4, W_4y, W_8y, W_12y, W_0y); }
-static INLINE void Block_Y_4_12(word64 *w) { Block_Y_xx_12(4, W_4y, W_8y, W_12y, W_0y); }
-
-static INLINE void Block_Y_8_1(void) { Block_Y_xx_1(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_2(void) { Block_Y_xx_2(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_3(void) { Block_Y_xx_3(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_4(void) { Block_Y_xx_4(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_5(void) { Block_Y_xx_5(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_6(void) { Block_Y_xx_6(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_7(void) { Block_Y_xx_7(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_8(void) { Block_Y_xx_8(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_9(void) { Block_Y_xx_9(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_10(void) { Block_Y_xx_10(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_11(void) { Block_Y_xx_11(8, W_8y, W_12y, W_0y, W_4y); }
-static INLINE void Block_Y_8_12(word64 *w) { Block_Y_xx_12(8, W_8y, W_12y, W_0y, W_4y); }
-
-static INLINE void Block_Y_12_1(void) { Block_Y_xx_1(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_2(void) { Block_Y_xx_2(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_3(void) { Block_Y_xx_3(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_4(void) { Block_Y_xx_4(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_5(void) { Block_Y_xx_5(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_6(void) { Block_Y_xx_6(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_7(void) { Block_Y_xx_7(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_8(void) { Block_Y_xx_8(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_9(void) { Block_Y_xx_9(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_10(void) { Block_Y_xx_10(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_11(void) { Block_Y_xx_11(12, W_12y, W_0y, W_4y, W_8y); }
-static INLINE void Block_Y_12_12(word64 *w) { Block_Y_xx_12(12, W_12y, W_0y, W_4y, W_8y); }
-
-
-static int Transform_AVX2(wc_Sha512* sha512)
+static const unsigned long mBYTE_FLIP_MASK_Y[] =
+   { 0x0001020304050607, 0x08090a0b0c0d0e0f,
+     0x0001020304050607, 0x08090a0b0c0d0e0f };
+
+#define W_Y_0       ymm0
+#define W_Y_4       ymm1
+#define W_Y_8       ymm2
+#define W_Y_12      ymm3
+
+#define X0       xmm0
+#define X1       xmm1
+#define X2       xmm2
+#define X3       xmm3
+#define X4       xmm4
+#define X5       xmm5
+#define X6       xmm6
+#define X7       xmm7
+#define X8       xmm8
+#define X9       xmm9
+#define Y0       ymm0
+#define Y1       ymm1
+#define Y2       ymm2
+#define Y3       ymm3
+#define Y4       ymm4
+#define Y5       ymm5
+#define Y6       ymm6
+#define Y7       ymm7
+
+#define W_Y_M15     ymm12
+#define W_Y_M7      ymm13
+#define W_Y_M2      ymm14
+#define MASK_Y      ymm15
+
+#define YTMP1       ymm8
+#define YTMP2       ymm9
+#define YTMP3       ymm10
+#define YTMP4       ymm11
+
+#define YMM_REGS \
+    "ymm0", "ymm1", "ymm2", "ymm3", "ymm4", "ymm5", "ymm6", "ymm7",       \
+    "xmm8", "ymm9", "ymm10", "ymm11", "ymm12", "ymm13", "ymm14", "ymm15"
+
+#define _VPERM2I128(dest, src1, src2, sel)                             \
+    "vperm2I128 $" #sel ", %%" #src2 ", %%" #src1 ", %%" #dest "\n\t"
+#define VPERM2I128(dest, src1, src2, sel) \
+       _VPERM2I128(dest, src1, src2, sel)
+
+#define _VPERMQ(dest, src, sel)                                        \
+    "vpermq     $" #sel ", %%" #src ", %%" #dest "\n\t"
+#define VPERMQ(dest, src, sel) \
+       _VPERMQ(dest, src, sel)
+
+#define _VPBLENDD(dest, src1, src2, sel)                               \
+    "vpblendd   $" #sel ", %%" #src2 ", %%" #src1 ", %%" #dest "\n\t"
+#define VPBLENDD(dest, src1, src2, sel) \
+       _VPBLENDD(dest, src1, src2, sel)
+
+#define _V_ADD_I(dest, src1, addr, i)                                  \
+    "vpaddq      "#i"*8(%%" #addr "), %%" #src1 ", %%" #dest "\n\t"
+#define V_ADD_I(dest, src1, addr, i) \
+       _V_ADD_I(dest, src1, addr, i)
+
+#define _VMOVDQU_I(addr, i, src)                                       \
+    "vmovdqu     %%" #src ", " #i "*8(%%" #addr ")\n\t"
+#define VMOVDQU_I(addr, i, src) \
+       _VMOVDQU_I(addr, i, src)
+
+#define MsgSched4_AVX2(W_Y_0,W_Y_4,W_Y_8,W_Y_12,a,b,c,d,e,f,g,h,i) \
+            RND_0_1(a,b,c,d,e,f,g,h,i)                             \
+    /* W[-13]..W[-15], W[-12] */                                   \
+    VPBLENDD(W_Y_M15, W_Y_0, W_Y_4, 0x03)                          \
+    /* W[-5]..W[-7], W[-4] */                                      \
+    VPBLENDD(W_Y_M7, W_Y_8, W_Y_12, 0x03)                          \
+            RND_0_2(a,b,c,d,e,f,g,h,i)                             \
+            RND_0_3(a,b,c,d,e,f,g,h,i)                             \
+    /* W_Y_M15 = W[-12]..W[-15] */                                 \
+    VPERMQ(W_Y_M15, W_Y_M15, 0x39)                                 \
+            RND_0_4(a,b,c,d,e,f,g,h,i)                             \
+    /* W_Y_M7 = W[-4]..W[-7] */                                    \
+    VPERMQ(W_Y_M7, W_Y_M7, 0x39)                                   \
+            RND_0_5(a,b,c,d,e,f,g,h,i)                             \
+            RND_0_6(a,b,c,d,e,f,g,h,i)                             \
+    /* W[-15] >>  1 */                                             \
+    V_SHIFT_R(YTMP1, W_Y_M15, 1)                                   \
+            RND_0_7(a,b,c,d,e,f,g,h,i)                             \
+    /* W[-15] << 63 */                                             \
+    V_SHIFT_L(YTMP2, W_Y_M15, 63)                                  \
+            RND_0_8(a,b,c,d,e,f,g,h,i)                             \
+    /* W[-15] >>  8 */                                             \
+    V_SHIFT_R(YTMP3, W_Y_M15, 8)                                   \
+            RND_0_9(a,b,c,d,e,f,g,h,i)                             \
+    /* W[-15] << 56 */                                             \
+    V_SHIFT_L(YTMP4, W_Y_M15, 56)                                  \
+            RND_0_10(a,b,c,d,e,f,g,h,i)                            \
+    /* W[-15] >>> 1 */                                             \
+    V_OR(YTMP1, YTMP2, YTMP1)                                      \
+            RND_0_11(a,b,c,d,e,f,g,h,i)                            \
+    /* W[-15] >>> 8 */                                             \
+    V_OR(YTMP3, YTMP4, YTMP3)                                      \
+            RND_0_12(a,b,c,d,e,f,g,h,i)                            \
+            RND_1_1(h,a,b,c,d,e,f,g,i+1)                           \
+    /* W[-15] >> 7 */                                              \
+    V_SHIFT_R(YTMP4, W_Y_M15, 7)                                   \
+            RND_1_2_A(h,a,b,c,d,e,f,g,i+1)                         \
+    /* (W[-15] >>> 1) ^ (W[-15] >>> 8) */                          \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                     \
+            RND_1_2_B(h,a,b,c,d,e,f,g,i+1)                         \
+    /* (W[-15] >>> 1) ^ (W[-15] >>> 8) ^ (W[-15] >> 7) */          \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                     \
+            RND_1_3(h,a,b,c,d,e,f,g,i+1)                           \
+    /* W[0] = W[-16] + W[-7] */                                    \
+    V_ADD(W_Y_0, W_Y_0, W_Y_M7)                                    \
+            RND_1_4(h,a,b,c,d,e,f,g,i+1)                           \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) */                       \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                     \
+            RND_1_5(h,a,b,c,d,e,f,g,i+1)                           \
+    /* 0, 0, W[-1], W[-2] */                                       \
+    VPERM2I128(W_Y_M2, W_Y_12, W_Y_12, 0x81)                       \
+            RND_1_6(h,a,b,c,d,e,f,g,i+1)                           \
+            RND_1_7(h,a,b,c,d,e,f,g,i+1)                           \
+            RND_1_8(h,a,b,c,d,e,f,g,i+1)                           \
+    /* W[-2] >> 19 */                                              \
+    V_SHIFT_R(YTMP1, W_Y_M2, 19)                                   \
+            RND_1_9(h,a,b,c,d,e,f,g,i+1)                           \
+    /* W[-2] << 45 */                                              \
+    V_SHIFT_L(YTMP2, W_Y_M2, 45)                                   \
+            RND_1_10(h,a,b,c,d,e,f,g,i+1)                          \
+    /* W[-2] >> 61 */                                              \
+    V_SHIFT_R(YTMP3, W_Y_M2, 61)                                   \
+            RND_1_11(h,a,b,c,d,e,f,g,i+1)                          \
+    /* W[-2] <<  3 */                                              \
+    V_SHIFT_L(YTMP4, W_Y_M2, 3)                                    \
+            RND_1_12(h,a,b,c,d,e,f,g,i+1)                          \
+            RND_0_1(g,h,a,b,c,d,e,f,i+2)                           \
+    /* W[-2] >>> 19 */                                             \
+    V_OR(YTMP1, YTMP2, YTMP1)                                      \
+            RND_0_2(g,h,a,b,c,d,e,f,i+2)                           \
+    /* W[-2] >>> 61 */                                             \
+    V_OR(YTMP3, YTMP4, YTMP3)                                      \
+            RND_0_3(g,h,a,b,c,d,e,f,i+2)                           \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) */                          \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                     \
+            RND_0_4(g,h,a,b,c,d,e,f,i+2)                           \
+    /* W[-2] >>  6 */                                              \
+    V_SHIFT_R(YTMP4, W_Y_M2, 6)                                    \
+            RND_0_5(g,h,a,b,c,d,e,f,i+2)                           \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) ^ (W[-2] >> 6) */           \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                     \
+            RND_0_6(g,h,a,b,c,d,e,f,i+2)                           \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) + s1(W[-2]) */           \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                     \
+            RND_0_7(g,h,a,b,c,d,e,f,i+2)                           \
+            RND_0_8(g,h,a,b,c,d,e,f,i+2)                           \
+    /* W[1], W[0], 0, 0 */                                         \
+    VPERM2I128(W_Y_M2, W_Y_0, W_Y_0, 0x08)                         \
+            RND_0_9(g,h,a,b,c,d,e,f,i+2)                           \
+            RND_0_10(g,h,a,b,c,d,e,f,i+2)                          \
+    /* W[-2] >> 19 */                                              \
+    V_SHIFT_R(YTMP1, W_Y_M2, 19)                                   \
+            RND_0_11(g,h,a,b,c,d,e,f,i+2)                          \
+    /* W[-2] << 45 */                                              \
+    V_SHIFT_L(YTMP2, W_Y_M2, 45)                                   \
+            RND_0_12(g,h,a,b,c,d,e,f,i+2)                          \
+            RND_1_1(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[-2] >> 61 */                                              \
+    V_SHIFT_R(YTMP3, W_Y_M2, 61)                                   \
+            RND_1_2(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[-2] <<  3 */                                              \
+    V_SHIFT_L(YTMP4, W_Y_M2, 3)                                    \
+            RND_1_3(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[-2] >>> 19 */                                             \
+    V_OR(YTMP1, YTMP2, YTMP1)                                      \
+            RND_1_4(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[-2] >>> 61 */                                             \
+    V_OR(YTMP3, YTMP4, YTMP3)                                      \
+            RND_1_5(f,g,h,a,b,c,d,e,i+3)                           \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) */                          \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                     \
+            RND_1_6(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[-2] >>  6 */                                              \
+    V_SHIFT_R(YTMP4, W_Y_M2, 6)                                    \
+            RND_1_7(f,g,h,a,b,c,d,e,i+3)                           \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) ^ (W[-2] >> 6) */           \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                     \
+            RND_1_8(f,g,h,a,b,c,d,e,i+3)                           \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) + s1(W[-2]) */           \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                     \
+            RND_1_9(f,g,h,a,b,c,d,e,i+3)                           \
+            RND_1_10(f,g,h,a,b,c,d,e,i+3)                          \
+            RND_1_11(f,g,h,a,b,c,d,e,i+3)                          \
+            RND_1_12(f,g,h,a,b,c,d,e,i+3)                          \
+
+#define MsgSched2_AVX2(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,a,b,c,d,e,f,g,h,i) \
+            RND_0_1(a,b,c,d,e,f,g,h,i)                                       \
+    VPALIGNR(W_Y_M15, W_2, W_0, 8)                                           \
+    VPALIGNR(W_Y_M7, W_10, W_8, 8)                                           \
+            RND_0_2(a,b,c,d,e,f,g,h,i)                                       \
+    V_SHIFT_R(YTMP1, W_Y_M15, 1)                                             \
+    V_SHIFT_L(YTMP2, W_Y_M15, 63)                                            \
+            RND_0_3(a,b,c,d,e,f,g,h,i)                                       \
+            RND_0_4(a,b,c,d,e,f,g,h,i)                                       \
+    V_SHIFT_R(YTMP3, W_Y_M15, 8)                                             \
+    V_SHIFT_L(YTMP4, W_Y_M15, 56)                                            \
+            RND_0_5(a,b,c,d,e,f,g,h,i)                                       \
+            RND_0_6(a,b,c,d,e,f,g,h,i)                                       \
+    V_OR(YTMP1, YTMP2, YTMP1)                                                \
+    V_OR(YTMP3, YTMP4, YTMP3)                                                \
+            RND_0_7(a,b,c,d,e,f,g,h,i)                                       \
+            RND_0_8(a,b,c,d,e,f,g,h,i)                                       \
+    V_SHIFT_R(YTMP4, W_Y_M15, 7)                                             \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                               \
+            RND_0_9(a,b,c,d,e,f,g,h,i)                                       \
+            RND_0_10(a,b,c,d,e,f,g,h,i)                                      \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                               \
+    V_ADD(W_0, W_0, W_Y_M7)                                                  \
+            RND_0_11(a,b,c,d,e,f,g,h,i)                                      \
+            RND_0_12(a,b,c,d,e,f,g,h,i)                                      \
+            RND_1_1(h,a,b,c,d,e,f,g,i+1)                                     \
+    V_ADD(W_0, W_0, YTMP1)                                                   \
+            RND_1_2(h,a,b,c,d,e,f,g,i+1)                                     \
+    V_SHIFT_R(YTMP1, W_14, 19)                                               \
+    V_SHIFT_L(YTMP2, W_14, 45)                                               \
+            RND_1_3(h,a,b,c,d,e,f,g,i+1)                                     \
+            RND_1_4(h,a,b,c,d,e,f,g,i+1)                                     \
+    V_SHIFT_R(YTMP3, W_14, 61)                                               \
+    V_SHIFT_L(YTMP4, W_14, 3)                                                \
+            RND_1_5(h,a,b,c,d,e,f,g,i+1)                                     \
+            RND_1_6(h,a,b,c,d,e,f,g,i+1)                                     \
+            RND_1_7(h,a,b,c,d,e,f,g,i+1)                                     \
+    V_OR(YTMP1, YTMP2, YTMP1)                                                \
+    V_OR(YTMP3, YTMP4, YTMP3)                                                \
+            RND_1_8(h,a,b,c,d,e,f,g,i+1)                                     \
+            RND_1_9(h,a,b,c,d,e,f,g,i+1)                                     \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                               \
+    V_SHIFT_R(YTMP4, W_14, 6)                                                \
+            RND_1_10(h,a,b,c,d,e,f,g,i+1)                                    \
+            RND_1_11(h,a,b,c,d,e,f,g,i+1)                                    \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                               \
+            RND_1_12(h,a,b,c,d,e,f,g,i+1)                                    \
+    V_ADD(W_0, W_0, YTMP1)                                                   \
+
+#define MsgSched4_AVX2_RORX_SET(W_Y_0,W_Y_4,W_Y_8,W_Y_12,a,b,c,d,e,f,g,h,i) \
+            RND_RORX_0_1(a,b,c,d,e,f,g,h,i)                                 \
+    /* W[-13]..W[-15], W[-12] */                                            \
+    VPBLENDD(W_Y_M15, W_Y_0, W_Y_4, 0x03)                                   \
+    /* W[-5]..W[-7], W[-4] */                                               \
+    VPBLENDD(W_Y_M7, W_Y_8, W_Y_12, 0x03)                                   \
+            RND_RORX_0_2(a,b,c,d,e,f,g,h,i)                                 \
+    /* W_Y_M15 = W[-12]..W[-15] */                                          \
+    VPERMQ(W_Y_M15, W_Y_M15, 0x39)                                          \
+            RND_RORX_0_3(a,b,c,d,e,f,g,h,i)                                 \
+    /* W_Y_M7 = W[-4]..W[-7] */                                             \
+    VPERMQ(W_Y_M7, W_Y_M7, 0x39)                                            \
+            RND_RORX_0_4(a,b,c,d,e,f,g,h,i)                                 \
+    /* W[-15] >>  1 */                                                      \
+    V_SHIFT_R(YTMP1, W_Y_M15, 1)                                            \
+    /* W[-15] << 63 */                                                      \
+    V_SHIFT_L(YTMP2, W_Y_M15, 63)                                           \
+            RND_RORX_0_5(a,b,c,d,e,f,g,h,i)                                 \
+    /* W[-15] >>  8 */                                                      \
+    V_SHIFT_R(YTMP3, W_Y_M15, 8)                                            \
+    /* W[-15] << 56 */                                                      \
+    V_SHIFT_L(YTMP4, W_Y_M15, 56)                                           \
+    /* W[-15] >>> 1 */                                                      \
+    V_OR(YTMP1, YTMP2, YTMP1)                                               \
+    /* W[-15] >>> 8 */                                                      \
+    V_OR(YTMP3, YTMP4, YTMP3)                                               \
+            RND_RORX_0_6(a,b,c,d,e,f,g,h,i)                                 \
+    /* W[-15] >> 7 */                                                       \
+    V_SHIFT_R(YTMP4, W_Y_M15, 7)                                            \
+            RND_RORX_0_7(a,b,c,d,e,f,g,h,i)                                 \
+    /* 0, 0, W[-1], W[-2] */                                                \
+    VPERM2I128(W_Y_M2, W_Y_12, W_Y_12, 0x81)                                \
+            RND_RORX_0_8(a,b,c,d,e,f,g,h,i)                                 \
+            RND_RORX_1_1(h,a,b,c,d,e,f,g,i+1)                               \
+    /* (W[-15] >>> 1) ^ (W[-15] >>> 8) */                                   \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                              \
+            RND_RORX_1_2(h,a,b,c,d,e,f,g,i+1)                               \
+    /* (W[-15] >>> 1) ^ (W[-15] >>> 8) ^ (W[-15] >> 7) */                   \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                              \
+            RND_RORX_1_3(h,a,b,c,d,e,f,g,i+1)                               \
+    /* W[0] = W[-16] + W[-7] */                                             \
+    V_ADD(W_Y_0, W_Y_0, W_Y_M7)                                             \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) */                                \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                              \
+            RND_RORX_1_4(h,a,b,c,d,e,f,g,i+1)                               \
+    /* W[-2] >> 19 */                                                       \
+    V_SHIFT_R(YTMP1, W_Y_M2, 19)                                            \
+    /* W[-2] << 45 */                                                       \
+    V_SHIFT_L(YTMP2, W_Y_M2, 45)                                            \
+            RND_RORX_1_5(h,a,b,c,d,e,f,g,i+1)                               \
+    /* W[-2] >> 61 */                                                       \
+    V_SHIFT_R(YTMP3, W_Y_M2, 61)                                            \
+    /* W[-2] <<  3 */                                                       \
+    V_SHIFT_L(YTMP4, W_Y_M2, 3)                                             \
+    /* W[-2] >>> 19 */                                                      \
+    V_OR(YTMP1, YTMP2, YTMP1)                                               \
+            RND_RORX_1_6(h,a,b,c,d,e,f,g,i+1)                               \
+    /* W[-2] >>> 61 */                                                      \
+    V_OR(YTMP3, YTMP4, YTMP3)                                               \
+            RND_RORX_1_7(h,a,b,c,d,e,f,g,i+1)                               \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) */                                   \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                              \
+            RND_RORX_1_8(h,a,b,c,d,e,f,g,i+1)                               \
+    /* W[-2] >>  6 */                                                       \
+    V_SHIFT_R(YTMP4, W_Y_M2, 6)                                             \
+            RND_RORX_0_1(g,h,a,b,c,d,e,f,i+2)                               \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) ^ (W[-2] >> 6) */                    \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                              \
+            RND_RORX_0_2(g,h,a,b,c,d,e,f,i+2)                               \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) + s1(W[-2]) */                    \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                              \
+            RND_RORX_0_3(g,h,a,b,c,d,e,f,i+2)                               \
+    /* W[1], W[0], 0, 0 */                                                  \
+    VPERM2I128(W_Y_M2, W_Y_0, W_Y_0, 0x08)                                  \
+            RND_RORX_0_4(g,h,a,b,c,d,e,f,i+2)                               \
+            RND_RORX_0_5(g,h,a,b,c,d,e,f,i+2)                               \
+    /* W[-2] >> 19 */                                                       \
+    V_SHIFT_R(YTMP1, W_Y_M2, 19)                                            \
+    /* W[-2] << 45 */                                                       \
+    V_SHIFT_L(YTMP2, W_Y_M2, 45)                                            \
+            RND_RORX_0_6(g,h,a,b,c,d,e,f,i+2)                               \
+    /* W[-2] >> 61 */                                                       \
+    V_SHIFT_R(YTMP3, W_Y_M2, 61)                                            \
+    /* W[-2] <<  3 */                                                       \
+    V_SHIFT_L(YTMP4, W_Y_M2, 3)                                             \
+    /* W[-2] >>> 19 */                                                      \
+    V_OR(YTMP1, YTMP2, YTMP1)                                               \
+            RND_RORX_0_7(g,h,a,b,c,d,e,f,i+2)                               \
+    /* W[-2] >>> 61 */                                                      \
+    V_OR(YTMP3, YTMP4, YTMP3)                                               \
+            RND_RORX_0_8(g,h,a,b,c,d,e,f,i+2)                               \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) */                                   \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                              \
+            RND_RORX_1_1(f,g,h,a,b,c,d,e,i+3)                               \
+    /* W[-2] >>  6 */                                                       \
+    V_SHIFT_R(YTMP4, W_Y_M2, 6)                                             \
+            RND_RORX_1_2(f,g,h,a,b,c,d,e,i+3)                               \
+            RND_RORX_1_3(f,g,h,a,b,c,d,e,i+3)                               \
+    /* (W[-2] >>> 19) ^ (W[-2] >>> 61) ^ (W[-2] >> 6) */                    \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                              \
+            RND_RORX_1_4(f,g,h,a,b,c,d,e,i+3)                               \
+            RND_RORX_1_5(f,g,h,a,b,c,d,e,i+3)                               \
+    /* W[0] = W[-16] + W[-7] + s0(W[-15]) + s1(W[-2]) */                    \
+    V_ADD(W_Y_0, W_Y_0, YTMP1)                                              \
+            RND_RORX_1_6(f,g,h,a,b,c,d,e,i+3)                               \
+    V_ADD_I(YTMP1, W_Y_0, rsi, i)                                           \
+            RND_RORX_1_7(f,g,h,a,b,c,d,e,i+3)                               \
+            RND_RORX_1_8(f,g,h,a,b,c,d,e,i+3)                               \
+    VMOVDQU_I(rsp, i, YTMP1)                                                \
+
+#define MsgSched2_AVX2_RORX(W_0,W_2,W_4,W_6,W_8,W_10,W_12,W_14,a,b,c,d,e,  \
+                            f,g,h,i)                                       \
+            RND_RORX_0_1(a,b,c,d,e,f,g,h,i)                                \
+    VPALIGNR(W_Y_M15, W_2, W_0, 8)                                         \
+    VPALIGNR(W_Y_M7, W_10, W_8, 8)                                         \
+            RND_RORX_0_2(a,b,c,d,e,f,g,h,i)                                \
+    V_SHIFT_R(YTMP1, W_Y_M15, 1)                                           \
+    V_SHIFT_L(YTMP2, W_Y_M15, 63)                                          \
+            RND_RORX_0_3(a,b,c,d,e,f,g,h,i)                                \
+    V_SHIFT_R(YTMP3, W_Y_M15, 8)                                           \
+    V_SHIFT_L(YTMP4, W_Y_M15, 56)                                          \
+            RND_RORX_0_4(a,b,c,d,e,f,g,h,i)                                \
+    V_OR(YTMP1, YTMP2, YTMP1)                                              \
+    V_OR(YTMP3, YTMP4, YTMP3)                                              \
+            RND_RORX_0_5(a,b,c,d,e,f,g,h,i)                                \
+    V_SHIFT_R(YTMP4, W_Y_M15, 7)                                           \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                             \
+            RND_RORX_0_6(a,b,c,d,e,f,g,h,i)                                \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                             \
+    V_ADD(W_0, W_0, W_Y_M7)                                                \
+            RND_RORX_0_7(a,b,c,d,e,f,g,h,i)                                \
+            RND_RORX_0_8(a,b,c,d,e,f,g,h,i)                                \
+    V_ADD(W_0, W_0, YTMP1)                                                 \
+            RND_RORX_1_1(h,a,b,c,d,e,f,g,i+1)                              \
+    V_SHIFT_R(YTMP1, W_14, 19)                                             \
+    V_SHIFT_L(YTMP2, W_14, 45)                                             \
+            RND_RORX_1_2(h,a,b,c,d,e,f,g,i+1)                              \
+    V_SHIFT_R(YTMP3, W_14, 61)                                             \
+    V_SHIFT_L(YTMP4, W_14, 3)                                              \
+            RND_RORX_1_3(h,a,b,c,d,e,f,g,i+1)                              \
+    V_OR(YTMP1, YTMP2, YTMP1)                                              \
+    V_OR(YTMP3, YTMP4, YTMP3)                                              \
+            RND_RORX_1_4(h,a,b,c,d,e,f,g,i+1)                              \
+            RND_RORX_1_5(h,a,b,c,d,e,f,g,i+1)                              \
+    V_XOR(YTMP1, YTMP3, YTMP1)                                             \
+    V_SHIFT_R(YTMP4, W_14, 6)                                              \
+            RND_RORX_1_6(h,a,b,c,d,e,f,g,i+1)                              \
+            RND_RORX_1_7(h,a,b,c,d,e,f,g,i+1)                              \
+    V_XOR(YTMP1, YTMP4, YTMP1)                                             \
+            RND_RORX_1_8(h,a,b,c,d,e,f,g,i+1)                              \
+    V_ADD(W_0, W_0, YTMP1)                                                 \
+
+
+#define _INIT_MASK_Y(mask)            \
+    "vmovdqu %[mask], %%"#mask"\n\t"
+#define INIT_MASK_Y(mask) \
+       _INIT_MASK_Y(mask)
+
+/* Load into YMM registers and swap endian. */
+#define _LOAD_BLOCK_W_Y_2(mask, ymm0, ymm1, reg, i)           \
+    /* buffer[0..15] => ymm0..ymm3;  */                       \
+    "vmovdqu    " #i "+ 0(%%" #reg "), %%" #ymm0 "\n\t"       \
+    "vmovdqu    " #i "+32(%%" #reg "), %%" #ymm1 "\n\t"       \
+    "vpshufb    %%" #mask ", %%" #ymm0 ", %%" #ymm0 "\n\t"    \
+    "vpshufb    %%" #mask ", %%" #ymm1 ", %%" #ymm1 "\n\t"
+
+#define LOAD_BLOCK_W_Y_2(mask, ymm1, ymm2, reg, i) \
+       _LOAD_BLOCK_W_Y_2(mask, ymm1, ymm2, reg, i)
+
+#define LOAD_BLOCK_W_Y(mask, reg)                  \
+    LOAD_BLOCK_W_Y_2(mask, W_Y_0, W_Y_4 , reg,  0) \
+    LOAD_BLOCK_W_Y_2(mask, W_Y_8, W_Y_12, reg, 64)
+
+#define _SET_W_Y_2(ymm0, ymm1, ymm2, ymm3, reg, i)                    \
+    "vpaddq     " #i "+ 0(%%" #reg "), %%" #ymm0 ", %%" #ymm2 "\n\t"  \
+    "vpaddq     " #i "+32(%%" #reg "), %%" #ymm1 ", %%" #ymm3 "\n\t"  \
+    "vmovdqu    %%" #ymm2 ", " #i "+ 0(" WX ")\n\t"                   \
+    "vmovdqu    %%" #ymm3 ", " #i "+32(" WX ")\n\t"
+
+#define SET_W_Y_2(ymm0, ymm1, ymm2, ymm3, reg, i) \
+       _SET_W_Y_2(ymm0, ymm1, ymm2, ymm3, reg, i)
+
+#define SET_BLOCK_W_Y(reg)                          \
+    SET_W_Y_2(W_Y_0, W_Y_4 , YTMP1, YTMP2, reg,  0) \
+    SET_W_Y_2(W_Y_8, W_Y_12, YTMP1, YTMP2, reg, 64)
+
+/* Load into YMM registers and swap endian. */
+#define _LOAD_BLOCK2_W_Y_2(mask, Y0, Y1, X0, X1, X8, X9, reg, i)   \
+    "vmovdqu    " #i "+  0(%%" #reg "), %%" #X0 "\n\t"                   \
+    "vmovdqu    " #i "+ 16(%%" #reg "), %%" #X1 "\n\t"                   \
+    "vmovdqu    " #i "+128(%%" #reg "), %%" #X8 "\n\t"                   \
+    "vmovdqu    " #i "+144(%%" #reg "), %%" #X9 "\n\t"                   \
+    "vinserti128        $1, %%" #X8 ", %%" #Y0 ", %%" #Y0 "\n\t"         \
+    "vinserti128        $1, %%" #X9 ", %%" #Y1 ", %%" #Y1 "\n\t"         \
+    "vpshufb    %%" #mask ", %%" #Y0 ", %%" #Y0 "\n\t"                   \
+    "vpshufb    %%" #mask ", %%" #Y1 ", %%" #Y1 "\n\t"
+
+#define LOAD_BLOCK2_W_Y_2(mask, Y0, Y1, X0, X1, X8, X9, reg, i) \
+       _LOAD_BLOCK2_W_Y_2(mask, Y0, Y1, X0, X1, X8, X9, reg, i)
+
+#define LOAD_BLOCK2_W_Y(mask, reg)                           \
+    LOAD_BLOCK2_W_Y_2(mask, Y0, Y1, X0, X1, X8, X9, reg,  0) \
+    LOAD_BLOCK2_W_Y_2(mask, Y2, Y3, X2, X3, X8, X9, reg, 32) \
+    LOAD_BLOCK2_W_Y_2(mask, Y4, Y5, X4, X5, X8, X9, reg, 64) \
+    LOAD_BLOCK2_W_Y_2(mask, Y6, Y7, X6, X7, X8, X9, reg, 96) \
+
+#define SET_BLOCK2_W_Y(reg)                   \
+    SET_W_Y_2(Y0, Y1, YTMP1, YTMP2, reg,   0) \
+    SET_W_Y_2(Y2, Y3, YTMP1, YTMP2, reg,  64) \
+    SET_W_Y_2(Y4, Y5, YTMP1, YTMP2, reg, 128) \
+    SET_W_Y_2(Y6, Y7, YTMP1, YTMP2, reg, 192)
+
+static const word64 K512_AVX2[160] = {
+    W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd),
+    W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd),
+    W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
+    W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
+    W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019),
+    W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019),
+    W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
+    W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
+    W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe),
+    W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe),
+    W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
+    W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
+    W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1),
+    W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1),
+    W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
+    W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
+    W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3),
+    W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3),
+    W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
+    W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
+    W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483),
+    W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483),
+    W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
+    W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
+    W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210),
+    W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210),
+    W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
+    W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
+    W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725),
+    W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725),
+    W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
+    W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
+    W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926),
+    W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926),
+    W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
+    W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
+    W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8),
+    W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8),
+    W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
+    W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
+    W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001),
+    W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001),
+    W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
+    W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
+    W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910),
+    W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910),
+    W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
+    W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
+    W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53),
+    W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53),
+    W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
+    W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
+    W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb),
+    W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb),
+    W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
+    W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
+    W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60),
+    W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60),
+    W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
+    W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
+    W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9),
+    W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9),
+    W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
+    W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
+    W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207),
+    W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207),
+    W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
+    W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
+    W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6),
+    W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6),
+    W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
+    W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
+    W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493),
+    W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493),
+    W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
+    W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
+    W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a),
+    W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a),
+    W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817),
+    W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817)
+};
+static const word64* K512_AVX2_END = &K512_AVX2[128];
+
+static int Transform_Sha512_AVX2(wc_Sha512* sha512)
 {
-    const word64* K = K512;
-    word64 w[4];
-    word32 j;
-    word64 T[8];
-
-    /* Copy digest to working vars */
-    XMEMCPY(T, sha512->digest, sizeof(T));
-
-    W_from_buff_Y(sha512->buffer);
-    MOVE_to_MEMy(w,0, W_0y);
-    for (j = 0; j < 80; j += 16) {
-        Ry_1( 0, w[0]); Block_Y_0_1(); Ry_2( 0, w[0]); Block_Y_0_2();
-                                       Ry_3( 0, w[0]); Block_Y_0_3();
-        Ry_1( 1, w[1]); Block_Y_0_4(); Ry_2( 1, w[1]); Block_Y_0_5();
-                                       Ry_3( 1, w[1]); Block_Y_0_6();
-        Ry_1( 2, w[2]); Block_Y_0_7(); Ry_2( 2, w[2]); Block_Y_0_8();
-                                       Ry_3( 2, w[2]); Block_Y_0_9();
-        Ry_1( 3, w[3]); Block_Y_0_10();Ry_2( 3, w[3]); Block_Y_0_11();
-                                       Ry_3( 3, w[3]); Block_Y_0_12(w);
-
-        Ry_1( 4, w[0]); Block_Y_4_1(); Ry_2( 4, w[0]); Block_Y_4_2();
-                                       Ry_3( 4, w[0]); Block_Y_4_3();
-        Ry_1( 5, w[1]); Block_Y_4_4(); Ry_2( 5, w[1]); Block_Y_4_5();
-                                       Ry_3( 5, w[1]); Block_Y_4_6();
-        Ry_1( 6, w[2]); Block_Y_4_7(); Ry_2( 6, w[2]); Block_Y_4_8();
-                                       Ry_3( 6, w[2]); Block_Y_4_9();
-        Ry_1( 7, w[3]); Block_Y_4_10(); Ry_2( 7, w[3]);Block_Y_4_11();
-                                        Ry_3( 7, w[3]);Block_Y_4_12(w);
-
-        Ry_1( 8, w[0]); Block_Y_8_1(); Ry_2( 8, w[0]); Block_Y_8_2();
-                                       Ry_3( 8, w[0]); Block_Y_8_3();
-        Ry_1( 9, w[1]); Block_Y_8_4(); Ry_2( 9, w[1]); Block_Y_8_5();
-                                       Ry_3( 9, w[1]); Block_Y_8_6();
-        Ry_1(10, w[2]); Block_Y_8_7(); Ry_2(10, w[2]); Block_Y_8_8();
-                                       Ry_3(10, w[2]); Block_Y_8_9();
-        Ry_1(11, w[3]); Block_Y_8_10();Ry_2(11, w[3]); Block_Y_8_11();
-                                       Ry_3(11, w[3]); Block_Y_8_12(w);
-
-        Ry_1(12, w[0]); Block_Y_12_1(); Ry_2(12, w[0]); Block_Y_12_2();
-                                        Ry_3(12, w[0]); Block_Y_12_3();
-        Ry_1(13, w[1]); Block_Y_12_4(); Ry_2(13, w[1]); Block_Y_12_5();
-                                        Ry_3(13, w[1]); Block_Y_12_6();
-        Ry_1(14, w[2]); Block_Y_12_7(); Ry_2(14, w[2]); Block_Y_12_8();
-                                        Ry_3(14, w[2]); Block_Y_12_9();
-        Ry_1(15, w[3]); Block_Y_12_10();Ry_2(15, w[3]); Block_Y_12_11();
-                                        Ry_3(15, w[3]);Block_Y_12_12(w);
-    }
-
-    /* Add the working vars back into digest */
-    sha512->digest[0] += a(0);
-    sha512->digest[1] += b(0);
-    sha512->digest[2] += c(0);
-    sha512->digest[3] += d(0);
-    sha512->digest[4] += e(0);
-    sha512->digest[5] += f(0);
-    sha512->digest[6] += g(0);
-    sha512->digest[7] += h(0);
-
-    /* Wipe variables */
-#if !defined(HAVE_INTEL_AVX1) && !defined(HAVE_INTEL_AVX2)
-    XMEMSET(W, 0, sizeof(word64) * 16);
-#endif
-    XMEMSET(T, 0, sizeof(T));
+    __asm__ __volatile__ (
+
+        /* 16 Ws plus loop counter and K512. */
+        "subq   $136, %%rsp\n\t"
+        "leaq   64(%[sha512]), %%rax\n\t"
+
+    INIT_MASK(MASK_Y)
+    LOAD_DIGEST()
+
+    LOAD_BLOCK_W_Y(MASK_Y, rax)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+        /* b */
+        "movq   %%r9, " L4 "\n\t"
+        /* e */
+        "movq   %%r12, " L1 "\n\t"
+        /* b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+    SET_BLOCK_W_Y(rsi)
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+        "addq   $128, %%rsi\n\t"
+
+    MsgSched4_AVX2(W_Y_0,W_Y_4,W_Y_8,W_Y_12,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched4_AVX2(W_Y_4,W_Y_8,W_Y_12,W_Y_0,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched4_AVX2(W_Y_8,W_Y_12,W_Y_0,W_Y_4,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched4_AVX2(W_Y_12,W_Y_0,W_Y_4,W_Y_8,RE,RF,RG,RH,RA,RB,RC,RD,12)
+
+    SET_BLOCK_W_Y(rsi)
+
+        "subl   $1, 16*8(" WX ")\n\t"
+        "jne    1b\n\t"
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 2)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB, 6)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,10)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,12)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    STORE_ADD_DIGEST()
+
+        "addq   $136, %%rsp\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK_Y),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory", "rsi"
+    );
+
+    return 0;
+    }
+
+static int Transform_Sha512_AVX2_Len(wc_Sha512* sha512, word32 len)
+{
+    if ((len & WC_SHA512_BLOCK_SIZE) != 0) {
+        XMEMCPY(sha512->buffer, sha512->data, WC_SHA512_BLOCK_SIZE);
+        Transform_Sha512_AVX2(sha512);
+        sha512->data += WC_SHA512_BLOCK_SIZE;
+        len -= WC_SHA512_BLOCK_SIZE;
+        if (len == 0)
+            return 0;
+    }
+
+    __asm__ __volatile__ (
+
+        "movq   224(%[sha512]), %%rcx\n\t"
+
+    INIT_MASK(MASK_Y)
+    LOAD_DIGEST()
+
+        "# Start of processing two blocks\n"
+        "2:\n\t"
+
+        "subq   $1344, %%rsp\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* e */
+        "movq   %%r12, " L1 "\n\t"
+
+    LOAD_BLOCK2_W_Y(MASK_Y, rcx)
+
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+        "\n"
+        "1:\n\t"
+    SET_BLOCK2_W_Y(rsi)
+    MsgSched2_AVX2(Y0,Y1,Y2,Y3,Y4,Y5,Y6,Y7,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched2_AVX2(Y1,Y2,Y3,Y4,Y5,Y6,Y7,Y0,RG,RH,RA,RB,RC,RD,RE,RF, 4)
+    MsgSched2_AVX2(Y2,Y3,Y4,Y5,Y6,Y7,Y0,Y1,RE,RF,RG,RH,RA,RB,RC,RD, 8)
+    MsgSched2_AVX2(Y3,Y4,Y5,Y6,Y7,Y0,Y1,Y2,RC,RD,RE,RF,RG,RH,RA,RB,12)
+    MsgSched2_AVX2(Y4,Y5,Y6,Y7,Y0,Y1,Y2,Y3,RA,RB,RC,RD,RE,RF,RG,RH,16)
+    MsgSched2_AVX2(Y5,Y6,Y7,Y0,Y1,Y2,Y3,Y4,RG,RH,RA,RB,RC,RD,RE,RF,20)
+    MsgSched2_AVX2(Y6,Y7,Y0,Y1,Y2,Y3,Y4,Y5,RE,RF,RG,RH,RA,RB,RC,RD,24)
+    MsgSched2_AVX2(Y7,Y0,Y1,Y2,Y3,Y4,Y5,Y6,RC,RD,RE,RF,RG,RH,RA,RB,28)
+        "addq   $256, %%rsi\n\t"
+        "addq   $256, %%rsp\n\t"
+        "cmpq   %[K512_END], %%rsi\n\t"
+        "jne    1b\n\t"
+
+    SET_BLOCK2_W_Y(rsi)
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 4)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 8)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,12)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH,16)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,20)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,24)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,28)
+        "subq   $1024, %%rsp\n\t"
+
+    ADD_DIGEST()
+    STORE_DIGEST()
+
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* e */
+        "movq   %%r12, " L1 "\n\t"
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+        "movq   $5, %%rsi\n\t"
+        "\n"
+        "3:\n\t"
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 2)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 6)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,10)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    RND_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH,18)
+    RND_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,22)
+    RND_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,26)
+    RND_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,30)
+        "addq   $256, %%rsp\n\t"
+        "subq   $1, %%rsi\n\t"
+        "jnz    3b\n\t"
+
+    ADD_DIGEST()
+
+        "movq   224(%[sha512]), %%rcx\n\t"
+        "addq   $64, %%rsp\n\t"
+        "addq   $256, %%rcx\n\t"
+        "subl   $256, %[len]\n\t"
+        "movq   %%rcx, 224(%[sha512])\n\t"
+
+    STORE_DIGEST()
+
+        "jnz    2b\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK_Y),
+          [len]    "m" (len),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512_AVX2),
+          [K512_END]   "m" (K512_AVX2_END)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory", "rsi"
+    );
 
     return 0;
 }
+
+#ifdef HAVE_INTEL_RORX
+static int Transform_Sha512_AVX2_RORX(wc_Sha512* sha512)
+{
+    __asm__ __volatile__ (
+
+        /* 16 Ws plus loop counter. */
+        "subq   $136, %%rsp\n\t"
+        "leaq   64(%[sha512]), " L2 "\n\t"
+
+    INIT_MASK(MASK_Y)
+    LOAD_DIGEST()
+
+    LOAD_BLOCK_W_Y(MASK_Y, rcx)
+
+        "movl   $4, 16*8(" WX ")\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+        /* b */
+        "movq   %%r9, " L4 "\n\t"
+        /* L3 = 0 (add to prev h) */
+        "xorq   " L3 ", " L3 "\n\t"
+        /* b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+    SET_BLOCK_W_Y(rsi)
+
+        "# Start of 16 rounds\n"
+        "1:\n\t"
+
+        "addq   $128, %%rsi\n\t"
+
+    MsgSched4_AVX2_RORX_SET(W_Y_0,W_Y_4,W_Y_8,W_Y_12,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched4_AVX2_RORX_SET(W_Y_4,W_Y_8,W_Y_12,W_Y_0,RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    MsgSched4_AVX2_RORX_SET(W_Y_8,W_Y_12,W_Y_0,W_Y_4,RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    MsgSched4_AVX2_RORX_SET(W_Y_12,W_Y_0,W_Y_4,W_Y_8,RE,RF,RG,RH,RA,RB,RC,RD,12)
+
+        "subl   $1, 16*8(%%rsp)\n\t"
+        "jnz    1b\n\t"
+
+    RND_RORX_ALL_4(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_RORX_ALL_4(RE,RF,RG,RH,RA,RB,RC,RD, 4)
+    RND_RORX_ALL_4(RA,RB,RC,RD,RE,RF,RG,RH, 8)
+    RND_RORX_ALL_4(RE,RF,RG,RH,RA,RB,RC,RD,12)
+        /* Prev RND: h += Maj(a,b,c) */
+        "addq   " L3 ", %%r8\n\t"
+        "addq   $136, %%rsp\n\t"
+
+    STORE_ADD_DIGEST()
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK_Y),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory", "rsi"
+    );
+
+    return 0;
+}
+
+static int Transform_Sha512_AVX2_RORX_Len(wc_Sha512* sha512, word32 len)
+{
+    if ((len & WC_SHA512_BLOCK_SIZE) != 0) {
+        XMEMCPY(sha512->buffer, sha512->data, WC_SHA512_BLOCK_SIZE);
+        Transform_Sha512_AVX2_RORX(sha512);
+        sha512->data += WC_SHA512_BLOCK_SIZE;
+        len -= WC_SHA512_BLOCK_SIZE;
+        if (len == 0)
+            return 0;
+    }
+
+    __asm__ __volatile__ (
+
+        "movq   224(%[sha512]), %%rax\n\t"
+
+    INIT_MASK(MASK_Y)
+    LOAD_DIGEST()
+
+        "# Start of processing two blocks\n"
+        "2:\n\t"
+
+        "subq   $1344, %%rsp\n\t"
+        "leaq   %[K512], %%rsi\n\t"
+
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* L3 = 0 (add to prev h) */
+        "xorq   " L3 ", " L3 "\n\t"
+
+    LOAD_BLOCK2_W_Y(MASK_Y, rax)
+
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+        "\n"
+        "1:\n\t"
+    SET_BLOCK2_W_Y(rsi)
+    MsgSched2_AVX2_RORX(Y0,Y1,Y2,Y3,Y4,Y5,Y6,Y7,RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    MsgSched2_AVX2_RORX(Y1,Y2,Y3,Y4,Y5,Y6,Y7,Y0,RG,RH,RA,RB,RC,RD,RE,RF, 4)
+    MsgSched2_AVX2_RORX(Y2,Y3,Y4,Y5,Y6,Y7,Y0,Y1,RE,RF,RG,RH,RA,RB,RC,RD, 8)
+    MsgSched2_AVX2_RORX(Y3,Y4,Y5,Y6,Y7,Y0,Y1,Y2,RC,RD,RE,RF,RG,RH,RA,RB,12)
+    MsgSched2_AVX2_RORX(Y4,Y5,Y6,Y7,Y0,Y1,Y2,Y3,RA,RB,RC,RD,RE,RF,RG,RH,16)
+    MsgSched2_AVX2_RORX(Y5,Y6,Y7,Y0,Y1,Y2,Y3,Y4,RG,RH,RA,RB,RC,RD,RE,RF,20)
+    MsgSched2_AVX2_RORX(Y6,Y7,Y0,Y1,Y2,Y3,Y4,Y5,RE,RF,RG,RH,RA,RB,RC,RD,24)
+    MsgSched2_AVX2_RORX(Y7,Y0,Y1,Y2,Y3,Y4,Y5,Y6,RC,RD,RE,RF,RG,RH,RA,RB,28)
+        "addq   $256, %%rsi\n\t"
+        "addq   $256, %%rsp\n\t"
+        "cmpq   %[K512_END], %%rsi\n\t"
+        "jne    1b\n\t"
+
+    SET_BLOCK2_W_Y(rsi)
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 0)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 4)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD, 8)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,12)
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH,16)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,20)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,24)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,28)
+        "addq   " L3 ", %%r8\n\t"
+        "subq   $1024, %%rsp\n\t"
+
+    ADD_DIGEST()
+    STORE_DIGEST()
+
+        /* L4 = b */
+        "movq   %%r9, " L4 "\n\t"
+        /* L3 = 0 (add to prev h) */
+        "xorq   " L3 ", " L3 "\n\t"
+        /* L4 = b ^ c */
+        "xorq   %%r10, " L4 "\n\t"
+
+        "movq   $5, %%rsi\n\t"
+        "\n"
+        "3:\n\t"
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH, 2)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF, 6)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,10)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,14)
+
+    RND_RORX_ALL_2(RA,RB,RC,RD,RE,RF,RG,RH,18)
+    RND_RORX_ALL_2(RG,RH,RA,RB,RC,RD,RE,RF,22)
+    RND_RORX_ALL_2(RE,RF,RG,RH,RA,RB,RC,RD,26)
+    RND_RORX_ALL_2(RC,RD,RE,RF,RG,RH,RA,RB,30)
+        "addq   $256, %%rsp\n\t"
+        "subq   $1, %%rsi\n\t"
+        "jnz    3b\n\t"
+
+        "addq   " L3 ", %%r8\n\t"
+
+    ADD_DIGEST()
+
+        "movq   224(%[sha512]), %%rax\n\t"
+        "addq   $64, %%rsp\n\t"
+        "addq   $256, %%rax\n\t"
+        "subl   $256, %[len]\n\t"
+        "movq   %%rax, 224(%[sha512])\n\t"
+
+    STORE_DIGEST()
+
+        "jnz    2b\n\t"
+
+        :
+        : [mask]   "m" (mBYTE_FLIP_MASK_Y),
+          [len]    "m" (len),
+          [sha512] "r" (sha512),
+          [K512]   "m" (K512_AVX2),
+          [K512_END]   "m" (K512_AVX2_END)
+        : WORK_REGS, STATE_REGS, YMM_REGS, "memory", "rsi"
+    );
+
+    return 0;
+}
+#endif /* HAVE_INTEL_RORX */
 #endif /* HAVE_INTEL_AVX2 */
 
+#endif /* WOLFSSL_SHA512 */
 
 
@@ -1346 +2614 @@
 /* -------------------------------------------------------------------------- */
 #ifdef WOLFSSL_SHA384
+
+#if defined(WOLFSSL_IMX6_CAAM) && !defined(NO_IMX6_CAAM_HASH)
+    /* functions defined in wolfcrypt/src/port/caam/caam_sha.c */
+#else
+
 static int InitSha384(wc_Sha384* sha384)
 {
@@ -1386 +2659 @@
 
 
+int wc_Sha384FinalRaw(wc_Sha384* sha384, byte* hash)
+{
+#ifdef LITTLE_ENDIAN_ORDER
+    word64 digest[WC_SHA384_DIGEST_SIZE / sizeof(word64)];
+#endif
+
+    if (sha384 == NULL || hash == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef LITTLE_ENDIAN_ORDER
+    ByteReverseWords64((word64*)digest, (word64*)sha384->digest,
+                                                         WC_SHA384_DIGEST_SIZE);
+    XMEMCPY(hash, digest, WC_SHA384_DIGEST_SIZE);
+#else
+    XMEMCPY(hash, sha384->digest, WC_SHA384_DIGEST_SIZE);
+#endif
+
+    return 0;
+}
+
 int wc_Sha384Final(wc_Sha384* sha384, byte* hash)
 {
@@ -1412 +2706 @@
 }
 
-
-/* Hardware Acceleration */
-#if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
-    int wc_InitSha384_ex(wc_Sha384* sha384, void* heap, int devId)
-    {
-        int ret = InitSha384(sha384);
-
-        (void)heap;
-        (void)devId;
-
-        Sha512_SetTransform();
-
-        return ret;
-    }
-#else
 int wc_InitSha384_ex(wc_Sha384* sha384, void* heap, int devId)
 {
@@ -1439 +2718 @@
     if (ret != 0)
         return ret;
+
+#if defined(HAVE_INTEL_AVX1) || defined(HAVE_INTEL_AVX2)
+    Sha512_SetTransform();
+#endif
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    sha384->W = NULL;
+#endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA384)
@@ -1449 +2735 @@
     return ret;
 }
-#endif
+
+#endif /* WOLFSSL_IMX6_CAAM */
 
 int wc_InitSha384(wc_Sha384* sha384)
@@ -1461 +2748 @@
         return;
 
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    if (sha384->W != NULL) {
+        XFREE(sha384->W, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        sha384->W = NULL;
+    }
+#endif
+
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA384)
     wolfAsync_DevCtxFree(&sha384->asyncDev, WOLFSSL_ASYNC_MARKER_SHA384);
@@ -1470 +2764 @@
 #endif /* HAVE_FIPS */
 
+#ifdef WOLFSSL_SHA512
 
 int wc_Sha512GetHash(wc_Sha512* sha512, byte* hash)
@@ -1482 +2777 @@
     if (ret == 0) {
         ret = wc_Sha512Final(&tmpSha512, hash);
+        wc_Sha512Free(&tmpSha512);
     }
     return ret;
@@ -1494 +2790 @@
 
     XMEMCPY(dst, src, sizeof(wc_Sha512));
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    dst->W = NULL;
+#endif
 
 #ifdef WOLFSSL_ASYNC_CRYPT
@@ -1502 +2801 @@
 }
 
+#endif /* WOLFSSL_SHA512 */
+
 #ifdef WOLFSSL_SHA384
+
 int wc_Sha384GetHash(wc_Sha384* sha384, byte* hash)
 {
@@ -1514 +2816 @@
     if (ret == 0) {
         ret = wc_Sha384Final(&tmpSha384, hash);
+        wc_Sha384Free(&tmpSha384);
     }
     return ret;
@@ -1525 +2828 @@
 
     XMEMCPY(dst, src, sizeof(wc_Sha384));
+#ifdef WOLFSSL_SMALL_STACK_CACHE
+    dst->W = NULL;
+#endif
 
 #ifdef WOLFSSL_ASYNC_CRYPT
@@ -1532 +2838 @@
     return ret;
 }
+
 #endif /* WOLFSSL_SHA384 */
 
-#endif /* WOLFSSL_SHA512 */
+#endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/wc_encrypt.c

@@ -28 +28 @@
 #include <wolfssl/wolfcrypt/aes.h>
 #include <wolfssl/wolfcrypt/des3.h>
+#include <wolfssl/wolfcrypt/hash.h>
+#include <wolfssl/wolfcrypt/arc4.h>
 #include <wolfssl/wolfcrypt/wc_encrypt.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
-
+#include <wolfssl/wolfcrypt/asn.h>
+#include <wolfssl/wolfcrypt/coding.h>
+#include <wolfssl/wolfcrypt/pwdbased.h>
+#include <wolfssl/wolfcrypt/logging.h>
+
+#ifdef NO_INLINE
+    #include <wolfssl/wolfcrypt/misc.h>
+#else
+    #define WOLFSSL_MISC_INCLUDED
+    #include <wolfcrypt/src/misc.c>
+#endif
 
 #if !defined(NO_AES) && defined(HAVE_AES_CBC)
@@ -225 +237 @@
 
 #endif /* !NO_DES3 */
+
+
+#ifdef WOLFSSL_ENCRYPTED_KEYS
+
+int wc_BufferKeyDecrypt(EncryptedInfo* info, byte* der, word32 derSz,
+    const byte* password, int passwordSz, int hashType)
+{
+    int ret = NOT_COMPILED_IN;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* key      = NULL;
+#else
+    byte  key[WC_MAX_SYM_KEY_SIZE];
+#endif
+
+    (void)derSz;
+    (void)passwordSz;
+    (void)hashType;
+
+    if (der == NULL || password == NULL || info == NULL || info->keySz == 0) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* use file's salt for key derivation, hex decode first */
+    if (Base16_Decode(info->iv, info->ivSz, info->iv, &info->ivSz) != 0) {
+        return BUFFER_E;
+    }
+    if (info->ivSz < PKCS5_SALT_SZ)
+        return BUFFER_E;
+
+#ifdef WOLFSSL_SMALL_STACK
+    key = (byte*)XMALLOC(WC_MAX_SYM_KEY_SIZE, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+    if (key == NULL) {
+        return MEMORY_E;
+    }
+#endif
+
+#ifndef NO_PWDBASED
+    if ((ret = wc_PBKDF1(key, password, passwordSz, info->iv, PKCS5_SALT_SZ, 1,
+                                        info->keySz, hashType)) != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(key, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+#endif
+        return ret;
+    }
+#endif
+
+#ifndef NO_DES3
+    if (info->cipherType == WC_CIPHER_DES)
+        ret = wc_Des_CbcDecryptWithKey(der, der, derSz, key, info->iv);
+    if (info->cipherType == WC_CIPHER_DES3)
+        ret = wc_Des3_CbcDecryptWithKey(der, der, derSz, key, info->iv);
+#endif /* NO_DES3 */
+#if !defined(NO_AES) && defined(HAVE_AES_CBC) && defined(HAVE_AES_DECRYPT)
+    if (info->cipherType == WC_CIPHER_AES_CBC)
+        ret = wc_AesCbcDecryptWithKey(der, der, derSz, key, info->keySz,
+            info->iv);
+#endif /* !NO_AES && HAVE_AES_CBC && HAVE_AES_DECRYPT */
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(key, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+#endif
+
+    return ret;
+}
+
+int wc_BufferKeyEncrypt(EncryptedInfo* info, byte* der, word32 derSz,
+    const byte* password, int passwordSz, int hashType)
+{
+    int ret = NOT_COMPILED_IN;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* key      = NULL;
+#else
+    byte  key[WC_MAX_SYM_KEY_SIZE];
+#endif
+
+    (void)derSz;
+    (void)passwordSz;
+    (void)hashType;
+
+    if (der == NULL || password == NULL || info == NULL || info->keySz == 0 ||
+            info->ivSz < PKCS5_SALT_SZ) {
+        return BAD_FUNC_ARG;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    key = (byte*)XMALLOC(WC_MAX_SYM_KEY_SIZE, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+    if (key == NULL) {
+        return MEMORY_E;
+    }
+#endif /* WOLFSSL_SMALL_STACK */
+
+#ifndef NO_PWDBASED
+    if ((ret = wc_PBKDF1(key, password, passwordSz, info->iv, PKCS5_SALT_SZ, 1,
+                                        info->keySz, hashType)) != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(key, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+#endif
+        return ret;
+    }
+#endif
+
+#ifndef NO_DES3
+    if (info->cipherType == WC_CIPHER_DES)
+        ret = wc_Des_CbcEncryptWithKey(der, der, derSz, key, info->iv);
+    if (info->cipherType == WC_CIPHER_DES3)
+        ret = wc_Des3_CbcEncryptWithKey(der, der, derSz, key, info->iv);
+#endif /* NO_DES3 */
+#if !defined(NO_AES) && defined(HAVE_AES_CBC)
+    if (info->cipherType == WC_CIPHER_AES_CBC)
+        ret = wc_AesCbcEncryptWithKey(der, der, derSz, key, info->keySz,
+            info->iv);
+#endif /* !NO_AES && HAVE_AES_CBC */
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(key, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
+#endif
+
+    return ret;
+}
+
+#endif /* WOLFSSL_ENCRYPTED_KEYS */
+
+
+#ifndef NO_PWDBASED
+
+/* Decrypt/Encrypt input in place from parameters based on id
+ *
+ * returns a negative value on fail case
+ */
+int wc_CryptKey(const char* password, int passwordSz, byte* salt,
+                      int saltSz, int iterations, int id, byte* input,
+                      int length, int version, byte* cbcIv, int enc)
+{
+    int typeH;
+    int derivedLen;
+    int ret = 0;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* key;
+#else
+    byte key[MAX_KEY_SIZE];
+#endif
+
+    (void)input;
+    (void)length;
+    (void)enc;
+
+    WOLFSSL_ENTER("wc_CryptKey");
+
+    switch (id) {
+    #ifndef NO_DES3
+        #ifndef NO_MD5
+        case PBE_MD5_DES:
+            typeH = WC_MD5;
+            derivedLen = 16;           /* may need iv for v1.5 */
+            break;
+        #endif
+        #ifndef NO_SHA
+        case PBE_SHA1_DES:
+            typeH = WC_SHA;
+            derivedLen = 16;           /* may need iv for v1.5 */
+            break;
+
+        case PBE_SHA1_DES3:
+            typeH = WC_SHA;
+            derivedLen = 32;           /* may need iv for v1.5 */
+            break;
+        #endif /* !NO_SHA */
+    #endif /* !NO_DES3 */
+    #if !defined(NO_SHA) && !defined(NO_RC4)
+        case PBE_SHA1_RC4_128:
+            typeH = WC_SHA;
+            derivedLen = 16;
+            break;
+    #endif
+    #ifdef WOLFSSL_AES_256
+        case PBE_AES256_CBC:
+            typeH = WC_SHA256;
+            derivedLen = 32;
+            break;
+    #endif
+        default:
+            WOLFSSL_MSG("Unknown/Unsupported encrypt/decrypt id");
+            return ALGO_ID_E;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    key = (byte*)XMALLOC(MAX_KEY_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (key == NULL)
+        return MEMORY_E;
+#endif
+
+    if (version == PKCS5v2)
+        ret = wc_PBKDF2(key, (byte*)password, passwordSz,
+                        salt, saltSz, iterations, derivedLen, typeH);
+#ifndef NO_SHA
+    else if (version == PKCS5)
+        ret = wc_PBKDF1(key, (byte*)password, passwordSz,
+                        salt, saltSz, iterations, derivedLen, typeH);
+#endif
+    else if (version == PKCS12v1) {
+        int  i, idx = 0;
+        byte unicodePasswd[MAX_UNICODE_SZ];
+
+        if ( (passwordSz * 2 + 2) > (int)sizeof(unicodePasswd)) {
+#ifdef WOLFSSL_SMALL_STACK
+            XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+            return UNICODE_SIZE_E;
+        }
+
+        for (i = 0; i < passwordSz; i++) {
+            unicodePasswd[idx++] = 0x00;
+            unicodePasswd[idx++] = (byte)password[i];
+        }
+        /* add trailing NULL */
+        unicodePasswd[idx++] = 0x00;
+        unicodePasswd[idx++] = 0x00;
+
+        ret =  wc_PKCS12_PBKDF(key, unicodePasswd, idx, salt, saltSz,
+                            iterations, derivedLen, typeH, 1);
+        if (id != PBE_SHA1_RC4_128)
+            ret += wc_PKCS12_PBKDF(cbcIv, unicodePasswd, idx, salt, saltSz,
+                                iterations, 8, typeH, 2);
+    }
+    else {
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+        WOLFSSL_MSG("Unknown/Unsupported PKCS version");
+        return ALGO_ID_E;
+    }
+
+    if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+        XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+        return ret;
+    }
+
+    switch (id) {
+#ifndef NO_DES3
+    #if !defined(NO_SHA) || !defined(NO_MD5)
+        case PBE_MD5_DES:
+        case PBE_SHA1_DES:
+        {
+            Des    des;
+            byte*  desIv = key + 8;
+
+            if (version == PKCS5v2 || version == PKCS12v1)
+                desIv = cbcIv;
+
+            if (enc) {
+                ret = wc_Des_SetKey(&des, key, desIv, DES_ENCRYPTION);
+            }
+            else {
+                ret = wc_Des_SetKey(&des, key, desIv, DES_DECRYPTION);
+            }
+            if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+
+            if (enc) {
+                wc_Des_CbcEncrypt(&des, input, input, length);
+            }
+            else {
+                wc_Des_CbcDecrypt(&des, input, input, length);
+            }
+            break;
+        }
+    #endif /* !NO_SHA || !NO_MD5 */
+
+    #ifndef NO_SHA
+        case PBE_SHA1_DES3:
+        {
+            Des3   des;
+            byte*  desIv = key + 24;
+
+            if (version == PKCS5v2 || version == PKCS12v1)
+                desIv = cbcIv;
+
+            ret = wc_Des3Init(&des, NULL, INVALID_DEVID);
+            if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+            if (enc) {
+                ret = wc_Des3_SetKey(&des, key, desIv, DES_ENCRYPTION);
+            }
+            else {
+                ret = wc_Des3_SetKey(&des, key, desIv, DES_DECRYPTION);
+            }
+            if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+            if (enc) {
+                ret = wc_Des3_CbcEncrypt(&des, input, input, length);
+            }
+            else {
+                ret = wc_Des3_CbcDecrypt(&des, input, input, length);
+            }
+            if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+            break;
+        }
+    #endif /* !NO_SHA */
+#endif
+#if !defined(NO_RC4) && !defined(NO_SHA)
+        case PBE_SHA1_RC4_128:
+        {
+            Arc4    dec;
+
+            wc_Arc4SetKey(&dec, key, derivedLen);
+            wc_Arc4Process(&dec, input, input, length);
+            break;
+        }
+#endif
+#if !defined(NO_AES) && defined(HAVE_AES_CBC)
+    #ifdef WOLFSSL_AES_256
+        case PBE_AES256_CBC:
+        {
+            Aes aes;
+            ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
+            if (ret == 0) {
+                if (enc) {
+                    ret = wc_AesSetKey(&aes, key, derivedLen, cbcIv,
+                                                                AES_ENCRYPTION);
+                }
+                else {
+                    ret = wc_AesSetKey(&aes, key, derivedLen, cbcIv,
+                                                                AES_DECRYPTION);
+                }
+            }
+            if (ret == 0) {
+                if (enc)
+                    ret = wc_AesCbcEncrypt(&aes, input, input, length);
+                else
+                    ret = wc_AesCbcDecrypt(&aes, input, input, length);
+            }
+            if (ret != 0) {
+#ifdef WOLFSSL_SMALL_STACK
+                XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+                return ret;
+            }
+            ForceZero(&aes, sizeof(Aes));
+            break;
+        }
+    #endif /* WOLFSSL_AES_256 */
+#endif /* !NO_AES && HAVE_AES_CBC */
+
+        default:
+#ifdef WOLFSSL_SMALL_STACK
+            XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+            WOLFSSL_MSG("Unknown/Unsupported encrypt/decryption algorithm");
+            return ALGO_ID_E;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+
+    return ret;
+}
+
+#endif /* !NO_PWDBASED */

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/wc_port.c

@@ -43 +43 @@
 #endif
 
-#if defined(FREESCALE_LTC_TFM)
+#ifdef FREESCALE_LTC_TFM
     #include <wolfssl/wolfcrypt/port/nxp/ksdk_port.h>
 #endif
 
-#ifdef WOLFSSL_ATMEL
+#if defined(WOLFSSL_ATMEL) || defined(WOLFSSL_ATECC508A)
     #include <wolfssl/wolfcrypt/port/atmel/atmel.h>
+#endif
+
+#if defined(WOLFSSL_STSAFEA100)
+    #include <wolfssl/wolfcrypt/port/st/stsafe.h>
 #endif
 
@@ -58 +62 @@
     #include <wolfssl/wolfcrypt/memory.h>
     #include <wolfssl/wolfcrypt/mem_track.h>
+#endif
+
+#if defined(WOLFSSL_IMX6_CAAM) || defined(WOLFSSL_IMX6_CAAM_RNG) || \
+    defined(WOLFSSL_IMX6_CAAM_BLOB)
+    #include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>
+#endif
+
+#ifdef WOLF_CRYPTO_DEV
+    #include <wolfssl/wolfcrypt/cryptodev.h>
 #endif
 
@@ -77 +90 @@
     if (initRefCount == 0) {
         WOLFSSL_ENTER("wolfCrypt_Init");
+
+    #ifdef WOLFSSL_FORCE_MALLOC_FAIL_TEST
+        {
+            word32 rngMallocFail;
+            time_t seed = time(NULL);
+            srand((word32)seed);
+            rngMallocFail = rand() % 2000; /* max 2000 */
+            printf("\n--- RNG MALLOC FAIL AT %d---\n", rngMallocFail);
+            wolfSSL_SetMemFailCount(rngMallocFail);
+        }
+    #endif
+
+    #ifdef WOLF_CRYPTO_DEV
+        wc_CryptoDev_Init();
+    #endif
 
     #ifdef WOLFSSL_ASYNC_CRYPT
@@ -125 +153 @@
     #endif
 
-    #ifdef WOLFSSL_ATMEL
-        atmel_init();
+    #if defined(WOLFSSL_ATMEL) || defined(WOLFSSL_ATECC508A)
+        ret = atmel_init();
+        if (ret != 0) {
+            WOLFSSL_MSG("CryptoAuthLib init failed");
+            return ret;
+        }
+    #endif
+
+    #if defined(WOLFSSL_STSAFEA100)
+        stsafe_interface_init();
     #endif
 
     #ifdef WOLFSSL_ARMASM
         WOLFSSL_MSG("Using ARM hardware acceleration");
+    #endif
+
+    #ifdef WOLFSSL_AFALG
+        WOLFSSL_MSG("Using AF_ALG for crypto acceleration");
     #endif
 
@@ -154 +194 @@
 #endif
 
+#if defined(WOLFSSL_IMX6_CAAM) || defined(WOLFSSL_IMX6_CAAM_RNG) || \
+    defined(WOLFSSL_IMX6_CAAM_BLOB)
+        if ((ret = wc_caamInit()) != 0) {
+            return ret;
+        }
+#endif
+
         initRefCount = 1;
     }
@@ -190 +237 @@
     #endif
 
+    #if defined(WOLFSSL_IMX6_CAAM) || defined(WOLFSSL_IMX6_CAAM_RNG) || \
+        defined(WOLFSSL_IMX6_CAAM_BLOB)
+        wc_caamFree();
+    #endif
+
         initRefCount = 0; /* allow re-init */
     }
@@ -196 +248 @@
 }
 
-#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
+#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) && \
+        !defined(WOLFSSL_NUCLEUS) && !defined(WOLFSSL_NUCLEUS_1_2)
 
 /* File Handling Helpers */
-/* returns 0 if file found, -1 if no files or negative error */
+/* returns 0 if file found, WC_READDIR_NOFILE if no files or negative error */
 int wc_ReadDirFirst(ReadDirCtx* ctx, const char* path, char** name)
 {
-    int ret = -1; /* default to no files found */
+    int ret = WC_READDIR_NOFILE; /* default to no files found */
+    int pathLen = 0;
+    int dnameLen = 0;
 
     if (name)
@@ -212 +267 @@
 
     XMEMSET(ctx->name, 0, MAX_FILENAME_SZ);
+    pathLen = (int)XSTRLEN(path);
 
 #ifdef USE_WINDOWS_API
-    XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ - 4);
-    XSTRNCAT(ctx->name, "\\*", 3);
+    if (pathLen > MAX_FILENAME_SZ - 3)
+        return BAD_PATH_ERROR;
+
+    XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ - 3);
+    XSTRNCPY(ctx->name + pathLen, "\\*", MAX_FILENAME_SZ - pathLen);
 
     ctx->hFind = FindFirstFileA(ctx->name, &ctx->FindFileData);
@@ -225 +284 @@
     do {
         if (ctx->FindFileData.dwFileAttributes != FILE_ATTRIBUTE_DIRECTORY) {
-            XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ/2 - 3);
-            XSTRNCAT(ctx->name, "\\", 2);
-            XSTRNCAT(ctx->name, ctx->FindFileData.cFileName, MAX_FILENAME_SZ/2);
+            dnameLen = (int)XSTRLEN(ctx->FindFileData.cFileName);
+
+            if (pathLen + dnameLen + 2 > MAX_FILENAME_SZ) {
+                return BAD_PATH_ERROR;
+            }
+            XSTRNCPY(ctx->name, path, pathLen + 1);
+            ctx->name[pathLen] = '\\';
+            XSTRNCPY(ctx->name + pathLen + 1,
+                     ctx->FindFileData.cFileName,
+                     MAX_FILENAME_SZ - pathLen - 1);
             if (name)
                 *name = ctx->name;
@@ -241 +307 @@
 
     while ((ctx->entry = readdir(ctx->dir)) != NULL) {
-        XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ/2 - 2);
-        XSTRNCAT(ctx->name, "/", 1);
-        XSTRNCAT(ctx->name, ctx->entry->d_name, MAX_FILENAME_SZ/2);
+        dnameLen = (int)XSTRLEN(ctx->entry->d_name);
+
+        if (pathLen + dnameLen + 2 > MAX_FILENAME_SZ) {
+            ret = BAD_PATH_ERROR;
+            break;
+        }
+        XSTRNCPY(ctx->name, path, pathLen + 1);
+        ctx->name[pathLen] = '/';
+        XSTRNCPY(ctx->name + pathLen + 1,
+                 ctx->entry->d_name, MAX_FILENAME_SZ - pathLen - 1);
 
         if (stat(ctx->name, &ctx->s) != 0) {
@@ -249 +322 @@
             ret = BAD_PATH_ERROR;
             break;
-        } else if (ctx->s.st_mode & S_IFREG) {
+        } else if (S_ISREG(ctx->s.st_mode)) {
             if (name)
                 *name = ctx->name;
@@ -261 +334 @@
 }
 
-/* returns 0 if file found, -1 if no more files */
+/* returns 0 if file found, WC_READDIR_NOFILE if no more files */
 int wc_ReadDirNext(ReadDirCtx* ctx, const char* path, char** name)
 {
-    int ret = -1; /* default to no file found */
+    int ret = WC_READDIR_NOFILE; /* default to no file found */
+    int pathLen = 0;
+    int dnameLen = 0;
 
     if (name)
@@ -274 +349 @@
 
     XMEMSET(ctx->name, 0, MAX_FILENAME_SZ);
+    pathLen = (int)XSTRLEN(path);
 
 #ifdef USE_WINDOWS_API
     while (FindNextFileA(ctx->hFind, &ctx->FindFileData)) {
         if (ctx->FindFileData.dwFileAttributes != FILE_ATTRIBUTE_DIRECTORY) {
-            XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ/2 - 3);
-            XSTRNCAT(ctx->name, "\\", 2);
-            XSTRNCAT(ctx->name, ctx->FindFileData.cFileName, MAX_FILENAME_SZ/2);
+            dnameLen = (int)XSTRLEN(ctx->FindFileData.cFileName);
+
+            if (pathLen + dnameLen + 2 > MAX_FILENAME_SZ) {
+                return BAD_PATH_ERROR;
+            }
+            XSTRNCPY(ctx->name, path, pathLen + 1);
+            ctx->name[pathLen] = '\\';
+            XSTRNCPY(ctx->name + pathLen + 1,
+                     ctx->FindFileData.cFileName,
+                     MAX_FILENAME_SZ - pathLen - 1);
             if (name)
                 *name = ctx->name;
@@ -288 +371 @@
 #else
     while ((ctx->entry = readdir(ctx->dir)) != NULL) {
-        XSTRNCPY(ctx->name, path, MAX_FILENAME_SZ/2 - 2);
-        XSTRNCAT(ctx->name, "/", 1);
-        XSTRNCAT(ctx->name, ctx->entry->d_name, MAX_FILENAME_SZ/2);
+        dnameLen = (int)XSTRLEN(ctx->entry->d_name);
+
+        if (pathLen + dnameLen + 2 > MAX_FILENAME_SZ) {
+            ret = BAD_PATH_ERROR;
+            break;
+        }
+        XSTRNCPY(ctx->name, path, pathLen + 1);
+        ctx->name[pathLen] = '/';
+        XSTRNCPY(ctx->name + pathLen + 1,
+                 ctx->entry->d_name, MAX_FILENAME_SZ - pathLen - 1);
 
         if (stat(ctx->name, &ctx->s) != 0) {
@@ -296 +386 @@
             ret = BAD_PATH_ERROR;
             break;
-        } else if (ctx->s.st_mode & S_IFREG) {
+        } else if (S_ISREG(ctx->s.st_mode)) {
             if (name)
                 *name = ctx->name;
@@ -403 +493 @@
 #endif /* USE_WOLF_STRTOK */
 
+#ifdef USE_WOLF_STRSEP
+char* wc_strsep(char **stringp, const char *delim)
+{
+    char *s, *tok;
+    const char *spanp;
+
+    /* null check */
+    if (stringp == NULL || *stringp == NULL)
+        return NULL;
+
+    s = *stringp;
+    for (tok = s; *tok; ++tok) {
+        for (spanp = delim; *spanp; ++spanp) {
+            /* found delimiter */
+            if (*tok == *spanp) {
+                *tok = '\0'; /* replace delim with null term */
+                *stringp = tok + 1; /* return past delim */
+                return s;
+            }
+        }
+    }
+
+    *stringp = NULL;
+    return s;
+}
+#endif /* USE_WOLF_STRSEP */
+
 #if WOLFSSL_CRYPT_HW_MUTEX
 /* Mutex for protection of cryptography hardware */
@@ -445 +562 @@
 /* Mutex Ports */
 /* ---------------------------------------------------------------------------*/
+#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
+    static mutex_cb*     compat_mutex_cb = NULL;
+
+    /* Function that locks or unlocks a mutex based on the flag passed in.
+     *
+     * flag lock or unlock i.e. CRYPTO_LOCK
+     * type the type of lock to unlock or lock
+     * file name of the file calling
+     * line the line number from file calling
+     */
+    int wc_LockMutex_ex(int flag, int type, const char* file, int line)
+    {
+        if (compat_mutex_cb != NULL) {
+            compat_mutex_cb(flag, type, file, line);
+            return 0;
+        }
+        else {
+            WOLFSSL_MSG("Mutex call back function not set. Call wc_SetMutexCb");
+            return BAD_STATE_E;
+        }
+    }
+
+
+    /* Set the callback function to use for locking/unlocking mutex
+     *
+     * cb callback function to use
+     */
+    int wc_SetMutexCb(mutex_cb* cb)
+    {
+        compat_mutex_cb = cb;
+        return 0;
+    }
+#endif /* defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) */
 #ifdef SINGLE_THREADED
 
@@ -602 +752 @@
         else
             return BAD_MUTEX_E;
+    }
+
+#elif defined(WOLFSSL_VXWORKS)
+
+    int wc_InitMutex(wolfSSL_Mutex* m)
+    {
+        if (m) {
+            if ((*m = semMCreate(0)) != SEM_ID_NULL)
+                return 0;
+        }
+        return BAD_MUTEX_E;
+    }
+
+
+    int wc_FreeMutex(wolfSSL_Mutex* m)
+    {
+        if (m) {
+            if (semDelete(*m) == OK)
+                return 0;
+        }
+        return BAD_MUTEX_E;
+    }
+
+
+    int wc_LockMutex(wolfSSL_Mutex* m)
+    {
+        if (m) {
+            if (semTake(*m, WAIT_FOREVER) == OK)
+                return 0;
+        }
+        return BAD_MUTEX_E;
+    }
+
+
+    int wc_UnLockMutex(wolfSSL_Mutex* m)
+    {
+        if (m) {
+            if (semGive(*m) == OK)
+                return 0;
+        }
+        return BAD_MUTEX_E;
     }
 
@@ -1170 +1361 @@
     }
 
+#elif defined(WOLFSSL_NUCLEUS_1_2)
+
+    int wc_InitMutex(wolfSSL_Mutex* m)
+    {
+        /* Call the Nucleus function to create the semaphore */
+        if (NU_Create_Semaphore(m, "WOLFSSL_MTX", 1,
+                                NU_PRIORITY) == NU_SUCCESS) {
+            return 0;
+        }
+
+        return BAD_MUTEX_E;
+    }
+
+    int wc_FreeMutex(wolfSSL_Mutex* m)
+    {
+        if (NU_Delete_Semaphore(m) == NU_SUCCESS)
+            return 0;
+
+        return BAD_MUTEX_E;
+    }
+
+    int wc_LockMutex(wolfSSL_Mutex* m)
+    {
+        /* passing suspend task option */
+        if (NU_Obtain_Semaphore(m, NU_SUSPEND) == NU_SUCCESS)
+            return 0;
+
+        return BAD_MUTEX_E;
+    }
+
+    int wc_UnLockMutex(wolfSSL_Mutex* m)
+    {
+        if (NU_Release_Semaphore(m) == NU_SUCCESS)
+            return 0;
+
+        return BAD_MUTEX_E;
+    }
+
 #else
     #warning No mutex handling defined
@@ -1175 +1404 @@
 #endif
 
+#ifndef NO_ASN_TIME
+#if defined(_WIN32_WCE)
+time_t windows_time(time_t* timer)
+{
+    SYSTEMTIME     sysTime;
+    FILETIME       fTime;
+    ULARGE_INTEGER intTime;
+    time_t         localTime;
+
+    if (timer == NULL)
+        timer = &localTime;
+
+    GetSystemTime(&sysTime);
+    SystemTimeToFileTime(&sysTime, &fTime);
+
+    XMEMCPY(&intTime, &fTime, sizeof(FILETIME));
+    /* subtract EPOCH */
+    intTime.QuadPart -= 0x19db1ded53e8000;
+    /* to secs */
+    intTime.QuadPart /= 10000000;
+    *timer = (time_t)intTime.QuadPart;
+
+    return *timer;
+}
+#endif /*  _WIN32_WCE */
+
+#if defined(WOLFSSL_APACHE_MYNEWT)
+#include "os/os_time.h"
+
+time_t mynewt_time(time_t* timer)
+{
+    time_t now;
+    struct os_timeval tv;
+    os_gettimeofday(&tv, NULL);
+    now = (time_t)tv.tv_sec;
+    if(timer != NULL) {
+        *timer = now;
+    }
+    return now;
+}
+#endif /* WOLFSSL_APACHE_MYNEWT */
+
+#if defined(WOLFSSL_GMTIME)
+struct tm* gmtime(const time_t* timer)
+{
+    #define YEAR0          1900
+    #define EPOCH_YEAR     1970
+    #define SECS_DAY       (24L * 60L * 60L)
+    #define LEAPYEAR(year) (!((year) % 4) && (((year) % 100) || !((year) %400)))
+    #define YEARSIZE(year) (LEAPYEAR(year) ? 366 : 365)
+
+    static const int _ytab[2][12] =
+    {
+        {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},
+        {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}
+    };
+
+    static struct tm st_time;
+    struct tm* ret = &st_time;
+    time_t secs = *timer;
+    unsigned long dayclock, dayno;
+    int year = EPOCH_YEAR;
+
+    dayclock = (unsigned long)secs % SECS_DAY;
+    dayno    = (unsigned long)secs / SECS_DAY;
+
+    ret->tm_sec  = (int) dayclock % 60;
+    ret->tm_min  = (int)(dayclock % 3600) / 60;
+    ret->tm_hour = (int) dayclock / 3600;
+    ret->tm_wday = (int) (dayno + 4) % 7;        /* day 0 a Thursday */
+
+    while(dayno >= (unsigned long)YEARSIZE(year)) {
+        dayno -= YEARSIZE(year);
+        year++;
+    }
+
+    ret->tm_year = year - YEAR0;
+    ret->tm_yday = (int)dayno;
+    ret->tm_mon  = 0;
+
+    while(dayno >= (unsigned long)_ytab[LEAPYEAR(year)][ret->tm_mon]) {
+        dayno -= _ytab[LEAPYEAR(year)][ret->tm_mon];
+        ret->tm_mon++;
+    }
+
+    ret->tm_mday  = (int)++dayno;
+    ret->tm_isdst = 0;
+
+    return ret;
+}
+#endif /* WOLFSSL_GMTIME */
+
+
+#if defined(HAVE_RTP_SYS)
+#define YEAR0          1900
+
+struct tm* rtpsys_gmtime(const time_t* timer)       /* has a gmtime() but hangs */
+{
+    static struct tm st_time;
+    struct tm* ret = &st_time;
+
+    DC_RTC_CALENDAR cal;
+    dc_rtc_time_get(&cal, TRUE);
+
+    ret->tm_year  = cal.year - YEAR0;       /* gm starts at 1900 */
+    ret->tm_mon   = cal.month - 1;          /* gm starts at 0 */
+    ret->tm_mday  = cal.day;
+    ret->tm_hour  = cal.hour;
+    ret->tm_min   = cal.minute;
+    ret->tm_sec   = cal.second;
+
+    return ret;
+}
+
+#endif /* HAVE_RTP_SYS */
+
+
+#if defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
+
+/*
+ * time() is just a stub in Microchip libraries. We need our own
+ * implementation. Use SNTP client to get seconds since epoch.
+ */
+time_t pic32_time(time_t* timer)
+{
+#ifdef MICROCHIP_TCPIP_V5
+    DWORD sec = 0;
+#else
+    uint32_t sec = 0;
+#endif
+    time_t localTime;
+
+    if (timer == NULL)
+        timer = &localTime;
+
+#ifdef MICROCHIP_MPLAB_HARMONY
+    sec = TCPIP_SNTP_UTCSecondsGet();
+#else
+    sec = SNTPGetUTCSeconds();
+#endif
+    *timer = (time_t) sec;
+
+    return *timer;
+}
+
+#endif /* MICROCHIP_TCPIP || MICROCHIP_TCPIP_V5 */
+
+#if defined(MICRIUM)
+
+time_t micrium_time(time_t* timer)
+{
+    CLK_TS_SEC sec;
+
+    Clk_GetTS_Unix(&sec);
+
+    if (timer != NULL)
+        *timer = sec;
+
+    return (time_t) sec;
+}
+
+#endif /* MICRIUM */
+
+#if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
+
+time_t mqx_time(time_t* timer)
+{
+    time_t localTime;
+    TIME_STRUCT time_s;
+
+    if (timer == NULL)
+        timer = &localTime;
+
+    _time_get(&time_s);
+    *timer = (time_t) time_s.SECONDS;
+
+    return *timer;
+}
+
+#endif /* FREESCALE_MQX || FREESCALE_KSDK_MQX */
+
+
+#if defined(WOLFSSL_TIRTOS)
+
+time_t XTIME(time_t * timer)
+{
+    time_t sec = 0;
+
+    sec = (time_t) Seconds_get();
+
+    if (timer != NULL)
+        *timer = sec;
+
+    return sec;
+}
+
+#endif /* WOLFSSL_TIRTOS */
+
+#if defined(WOLFSSL_XILINX)
+#include "xrtcpsu.h"
+
+time_t XTIME(time_t * timer)
+{
+    time_t sec = 0;
+    XRtcPsu_Config* con;
+    XRtcPsu         rtc;
+
+    con = XRtcPsu_LookupConfig(XPAR_XRTCPSU_0_DEVICE_ID);
+    if (con != NULL) {
+        if (XRtcPsu_CfgInitialize(&rtc, con, con->BaseAddr) == XST_SUCCESS) {
+            sec = (time_t)XRtcPsu_GetCurrentTime(&rtc);
+        }
+        else {
+            WOLFSSL_MSG("Unable to initialize RTC");
+        }
+    }
+
+    if (timer != NULL)
+        *timer = sec;
+
+    return sec;
+}
+
+#endif /* WOLFSSL_XILINX */
+#endif /* !NO_ASN_TIME */
+
+#ifndef WOLFSSL_LEANPSK
+char* mystrnstr(const char* s1, const char* s2, unsigned int n)
+{
+    unsigned int s2_len = (unsigned int)XSTRLEN(s2);
+
+    if (s2_len == 0)
+        return (char*)s1;
+
+    while (n >= s2_len && s1[0]) {
+        if (s1[0] == s2[0])
+            if (XMEMCMP(s1, s2, s2_len) == 0)
+                return (char*)s1;
+        s1++;
+        n--;
+    }
+
+    return NULL;
+}
+#endif
+
+/* custom memory wrappers */
+#ifdef WOLFSSL_NUCLEUS_1_2
+
+    /* system memory pool */
+    extern NU_MEMORY_POOL System_Memory;
+
+    void* nucleus_malloc(unsigned long size, void* heap, int type)
+    {
+        STATUS status;
+        void*  stack_ptr;
+
+        status = NU_Allocate_Memory(&System_Memory, &stack_ptr, size,
+                                    NU_NO_SUSPEND);
+        if (status == NU_SUCCESS) {
+            return 0;
+        } else {
+            return stack_ptr;
+        }
+    }
+
+    void* nucleus_realloc(void* ptr, unsigned long size, void* heap, int type)
+    {
+        STATUS     status;
+        DM_HEADER* old_header;
+        word32     old_size, copy_size;
+        void*      new_mem;
+
+        /* if ptr is NULL, behave like malloc */
+        new_mem = nucleus_malloc(size, NULL, 0);
+        if (new_mem == 0 || ptr == 0) {
+            return new_mem;
+        }
+
+        /* calculate old memory block size */
+        /* mem pointers stored in block headers (ref dm_defs.h) */
+        old_header = (DM_HEADER*) ((byte*)ptr - DM_OVERHEAD);
+        old_size   = (byte*)old_header->dm_next_memory - (byte*)ptr;
+
+        /* copy old to new */
+        if (old_size < size) {
+            copy_size = old_size;
+        } else {
+            copy_size = size;
+        }
+        XMEMCPY(new_mem, ptr, copy_size);
+
+        /* free old */
+        nucleus_free(ptr, NULL, 0);
+
+        return new_mem;
+    }
+
+    void nucleus_free(void* ptr, void* heap, int type)
+    {
+        if (ptr != NULL)
+            NU_Deallocate_Memory(ptr);
+    }
+
+#endif /* WOLFSSL_NUCLEUS_1_2 */
 
 #if defined(WOLFSSL_TI_CRYPT) || defined(WOLFSSL_TI_HASH)

asp3_tinet_ecnl_arm/trunk/wolfssl-3.12.2/wolfcrypt/src/wolfmath.c

@@ -30 +30 @@
 #include <wolfssl/wolfcrypt/settings.h>
 
-#ifdef USE_FAST_MATH
-    #include <wolfssl/wolfcrypt/tfm.h>
-#else
     #include <wolfssl/wolfcrypt/integer.h>
-#endif
 
 #include <wolfssl/wolfcrypt/error-crypt.h>
@@ -92 +88 @@
 }
 
+#ifndef WC_NO_RNG
 int get_rand_digit(WC_RNG* rng, mp_digit* d)
 {
@@ -100 +97 @@
 int mp_rand(mp_int* a, int digits, WC_RNG* rng)
 {
-    int ret;
-    mp_digit d;
-
-    if (rng == NULL)
-        return MISSING_RNG_E;
-
-    if (a == NULL)
-        return BAD_FUNC_ARG;
+    int ret = 0;
+    DECLARE_VAR(d, mp_digit, 1, rng ? rng->heap : NULL);
+
+    if (rng == NULL) {
+        ret = MISSING_RNG_E; goto exit;
+    }
+
+    if (a == NULL
+    #ifdef WOLFSSL_ASYNC_CRYPT
+        || d == NULL
+    #endif
+    ) {
+        ret = BAD_FUNC_ARG; goto exit;
+    }
 
     mp_zero(a);
     if (digits <= 0) {
-        return MP_OKAY;
+        ret = MP_OKAY; goto exit;
     }
 
     /* first place a random non-zero digit */
     do {
-        ret = get_rand_digit(rng, &d);
+        ret = get_rand_digit(rng, d);
         if (ret != 0) {
-            return ret;
-        }
-    } while (d == 0);
-
-    if ((ret = mp_add_d(a, d, a)) != MP_OKAY) {
-        return ret;
+            goto exit;
+        }
+    } while (*d == 0);
+
+    if ((ret = mp_add_d(a, *d, a)) != MP_OKAY) {
+        goto exit;
     }
 
     while (--digits > 0) {
         if ((ret = mp_lshd(a, 1)) != MP_OKAY) {
-            return ret;
-        }
-        if ((ret = get_rand_digit(rng, &d)) != 0) {
-            return ret;
-        }
-        if ((ret = mp_add_d(a, d, a)) != MP_OKAY) {
-            return ret;
-        }
-    }
+            goto exit;
+        }
+        if ((ret = get_rand_digit(rng, d)) != 0) {
+            goto exit;
+        }
+        if ((ret = mp_add_d(a, *d, a)) != MP_OKAY) {
+            goto exit;
+        }
+    }
+
+exit:
+    FREE_VAR(d, rng ? rng->heap : NULL);
 
     return ret;
 }
 #endif /* WC_RSA_BLINDING */
+#endif
+
+/* export an mp_int as unsigned char or hex string
+ * encType is WC_TYPE_UNSIGNED_BIN or WC_TYPE_HEX_STR
+ * return MP_OKAY on success */
+int wc_export_int(mp_int* mp, byte* buf, word32* len, word32 keySz,
+    int encType)
+{
+    int err;
+
+    if (mp == NULL)
+        return BAD_FUNC_ARG;
+
+    /* check buffer size */
+    if (*len < keySz) {
+        *len = keySz;
+        return BUFFER_E;
+    }
+
+    *len = keySz;
+    XMEMSET(buf, 0, *len);
+
+    if (encType == WC_TYPE_HEX_STR) {
+    #ifdef WC_MP_TO_RADIX
+        err = mp_tohex(mp, (char*)buf);
+    #else
+        err = NOT_COMPILED_IN;
+    #endif
+    }
+    else {
+        err = mp_to_unsigned_bin(mp, buf + (keySz - mp_unsigned_bin_size(mp)));
+    }
+
+    return err;
+}
 
 
@@ -236 +277 @@
 }
 
+/* sz: make sure the buffer is at least that size and zero padded.
+ *     A `sz == 0` will use the size of `src`.
+ *     The calulcates sz is stored into dst->len in `wc_bigint_alloc`.
+ */
+int wc_mp_to_bigint_sz(mp_int* src, WC_BIGINT* dst, word32 sz)
+{
+    int err;
+    word32 x, y;
+
+    if (src == NULL || dst == NULL)
+        return BAD_FUNC_ARG;
+
+    /* get size of source */
+    x = mp_unsigned_bin_size(src);
+    if (sz < x)
+        sz = x;
+
+    /* make sure destination is allocated and large enough */
+    err = wc_bigint_alloc(dst, sz);
+    if (err == MP_OKAY) {
+
+        /* leading zero pad */
+        y = sz - x;
+        XMEMSET(dst->buf, 0, y);
+
+        /* export src as unsigned bin to destination buf */
+        err = mp_to_unsigned_bin(src, dst->buf + y);
+    }
+
+    return err;
+}
+
 int wc_mp_to_bigint(mp_int* src, WC_BIGINT* dst)
 {
-    int err;
-    word32 sz;
-
     if (src == NULL || dst == NULL)
         return BAD_FUNC_ARG;
 
-    sz = mp_unsigned_bin_size(src);
-    err = wc_bigint_alloc(dst, sz);
-    if (err == MP_OKAY)
-        err = mp_to_unsigned_bin(src, dst->buf);
-
-    return err;
+    return wc_mp_to_bigint_sz(src, dst, 0);
 }