Added underlying DNSSEC support (dst and crypto libraries)

2025-08-31 06:25:31 +00:00 · 1999-07-12 20:08:42 +00:00
parent e430659af6
commit 65c4736d9c
238 changed files with 31070 additions and 9 deletions
--- a/bin/tests/Makefile.in
+++ b/bin/tests/Makefile.in
@@ -34,7 +34,7 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@

 LIBS =		@LIBS@

-SUBDIRS = master names rbt
+SUBDIRS = master names rbt dst
 TARGETS =	res_test \
 		lex_test \
 		name_test \
--- a/bin/tests/dst/Ktest.+001+00000.key
+++ b/bin/tests/dst/Ktest.+001+00000.key
@@ -0,0 +1 @@
+test. IN KEY 49152 2 1 
--- a/bin/tests/dst/Ktest.+001+54622.key
+++ b/bin/tests/dst/Ktest.+001+54622.key
@@ -0,0 +1 @@
+test. IN KEY 257 3 1 AQPQjwSpaVzxIgRCpiUoozUQKGh2oX8NIFKDOvtxK+tn536OZg2cROKTlgGEHXJK9YHfW/6nzQULTVpb63P+SQMmjCCidb8IYyhItixRztVeJQ==
--- a/bin/tests/dst/Ktest.+001+54622.private
+++ b/bin/tests/dst/Ktest.+001+54622.private
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 1 (RSA)
+Modulus: 0I8EqWlc8SIEQqYlKKM1EChodqF/DSBSgzr7cSvrZ+d+jmYNnETik5YBhB1ySvWB31v+p80FC01aW+tz/kkDJowgonW/CGMoSLYsUc7VXiU=
+PublicExponent: Aw==
+PrivateExponent: iwoDG5uTS2wC1xluGxd4tXBFpGuqCMA3AidSS3Kc7++ptEQJEtiXC9kfCJMvZhGfQLaujft2OgrmkcuDVtPIbQWEENhyJhb4Lk82kFXbfus=
+Prime1: /rSKuzcZY7R5cY2YWD4CiBNyj9WJMq1wWmBnb9+5M08nTl5E9NW5qQ==
+Prime2: 0Z5shXQYd16E2Gs6e5WxtO0Oqlly2KkSqXohwTQWDWTb8Pw0WTZmHQ==
+Exponent1: qc2x0iS7l82mS7O65X6sWrehtTkGIcj1kZWaSpUmIjTE3umDTePRGw==
+Exponent2: i77zA6K6+j8DOvIm/Q52eJ4JxuZMkHC3G6bBK3gOs5iSoKgi5iREEw==
+Coefficient: 3+wYZB0SJad7z2EsjzgbSlg6CawoaOvrROGSbwSiW5DCsMFROudOTw==
--- a/bin/tests/dst/Ktest.+003+00000.key
+++ b/bin/tests/dst/Ktest.+003+00000.key
@@ -0,0 +1 @@
+test. IN KEY 49152 2 3 
--- a/bin/tests/dst/Ktest.+003+06204.key
+++ b/bin/tests/dst/Ktest.+003+06204.key
@@ -0,0 +1 @@
+test. IN KEY 16641 3 3 ANp1//lqDlEfTavcFI+cyudNfgEz73V/K7fSDvkA0eDYcGg/kSvEjAEO/oLWCERltkuC55ZcM/mSv17WF1d/wR6kww/pLI9eXwkjftAYqs5sNxk+mbEGl6zwve9wq5z7IoTY5/J4l7XLCKftg/wGvrzXQhggIkRvEh3myhxd+ouILcpfvTIthWlTKiH59tSJpmgmiSMTE7nDYaf10iVRWN6DMSprgejiH05/fpmyZAt44tyAh4m1wXS5u4tam1PXDJYJozn7EfQ8e2weIv1yC+t6PHSx
--- a/bin/tests/dst/Ktest.+003+06204.private
+++ b/bin/tests/dst/Ktest.+003+06204.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.2
+Algorithm: 3 (DSA)
+Prime(p): 73V/K7fSDvkA0eDYcGg/kSvEjAEO/oLWCERltkuC55ZcM/mSv17WF1d/wR6kww/pLI9eXwkjftAYqs5sNxk+mQ==
+Subprime(q): 2nX/+WoOUR9Nq9wUj5zK501+ATM=
+Base(g): sQaXrPC973CrnPsihNjn8niXtcsIp+2D/Aa+vNdCGCAiRG8SHebKHF36i4gtyl+9Mi2FaVMqIfn21ImmaCaJIw==
+Private_value(x): Nky4tvIwg6xlcyeHXr4k2DEZg0E=
+Public_value(y): ExO5w2Gn9dIlUVjegzEqa4Ho4h9Of36ZsmQLeOLcgIeJtcF0ubuLWptT1wyWCaM5+xH0PHtsHiL9cgvrejx0sQ==
--- a/bin/tests/dst/Makefile.in
+++ b/bin/tests/dst/Makefile.in
@@ -0,0 +1,44 @@
+# Copyright (C) 1999  Internet Software Consortium.
+# 
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+# SOFTWARE.
+
+srcdir =	@srcdir@
+VPATH =		@srcdir@
+top_srcdir =	@top_srcdir@
+
+CINCLUDES =	-I${srcdir}/../../../lib/isc/unix/include \
+		-I${srcdir}/../../../lib/isc/pthreads/include \
+		-I${srcdir}/../../../lib/isc/include \
+		-I${srcdir}/../../../lib/dns/include \
+		-I${srcdir}/../../../lib/dns/sec/dst/include \
+
+CDEFINES =
+CWARNINGS =
+
+LIBS =		../../../lib/dns/libdns.@A@ \
+		../../../lib/isc/libisc.@A@ \
+		@LIBS@
+
+TARGETS =	dst_test
+
+@BIND9_MAKE_RULES@
+
+dst_test: dst_test.o
+	${LIBTOOL} ${CC} -o $@ dst_test.o ${LIBS}
+
+test:
+	-@ ./dst_test
+
+clean distclean::
+	rm -f ${TARGETS}
--- a/bin/tests/dst/dst_test.c
+++ b/bin/tests/dst/dst_test.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 1999  Internet Software Consortium.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <config.h>
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/assertions.h>
+#include <isc/error.h>
+#include <isc/boolean.h>
+#include <isc/region.h>
+#include <isc/mem.h>
+
+#include <dst/dst.h>
+#include <dst/result.h>
+
+char *current, *tmp = "/tmp";
+
+static void
+use(dst_key_t *key, isc_mem_t *mctx) {
+	dst_result_t ret;
+	char *data = "This is some data";
+	unsigned char sig[512];
+	isc_buffer_t databuf, sigbuf;
+	isc_region_t datareg, sigreg;
+
+	isc_buffer_init(&sigbuf, sig, sizeof(sig), ISC_BUFFERTYPE_BINARY);
+	/* Advance 1 byte for fun */
+	isc_buffer_add(&sigbuf, 1);
+
+	isc_buffer_init(&databuf, data, strlen(data), ISC_BUFFERTYPE_TEXT);
+	isc_buffer_add(&databuf, strlen(data));
+	isc_buffer_used(&databuf, &datareg);
+
+	ret = dst_sign(DST_SIG_MODE_ALL, key, NULL, &datareg, &sigbuf, mctx);
+	printf("sign(%d) returned: %s\n", dst_key_alg(key),
+	       dst_result_totext(ret));
+
+	isc_buffer_forward(&sigbuf, 1);
+	isc_buffer_remaining(&sigbuf, &sigreg);
+	ret = dst_verify(DST_SIG_MODE_ALL, key, NULL, &datareg, &sigreg, mctx);
+	printf("verify(%d) returned: %s\n", dst_key_alg(key),
+	       dst_result_totext(ret));
+}
+
+static void
+io(char *name, int id, int alg, int type, isc_mem_t *mctx) {
+	dst_key_t *key;
+	dst_result_t ret;
+
+	chdir(current);
+	ret = dst_key_fromfile(name, id, alg, type, mctx, &key);
+	printf("read(%d) returned: %s\n", alg, dst_result_totext(ret));
+	if (ret != 0)
+		return;
+	chdir(tmp);
+	ret = dst_key_tofile(key, type);
+	printf("write(%d) returned: %s\n", alg, dst_result_totext(ret));
+	if (ret != 0)
+		return;
+	use(key, mctx);
+	dst_key_free(key, mctx);
+}
+
+static void
+generate(int alg, isc_mem_t *mctx) {
+	dst_result_t ret;
+	dst_key_t *key;
+
+	ret = dst_key_generate("test.", alg, 512, 0, 0, 0, mctx, &key);
+	printf("generate(%d) returned: %s\n", alg, dst_result_totext(ret));
+
+	use(key, mctx);
+
+	dst_key_free(key, mctx);
+}
+
+static void
+get_random() {
+	unsigned char data[25];
+	isc_buffer_t databuf;
+	dst_result_t ret;
+	unsigned int i;
+
+	isc_buffer_init(&databuf, data, sizeof data, ISC_BUFFERTYPE_BINARY);
+	ret = dst_random(sizeof(data), &databuf);
+	printf("random() returned: %s\n", dst_result_totext(ret));
+	for (i = 0; i < sizeof data; i++)
+		printf("%02x ", data[i]);
+	printf("\n");
+}
+
+int
+main() {
+	isc_mem_t *mctx = NULL;
+
+	isc_mem_create(0, 0, &mctx);
+
+	current = isc_mem_get(mctx, 256);
+	getcwd(current, 256);
+
+	io("test.", 6204, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
+	io("test.", 54622, DST_ALG_RSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
+
+	io("test.", 0, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
+	io("test.", 0, DST_ALG_RSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
+
+	generate(DST_ALG_RSA, mctx);
+	generate(DST_ALG_DSA, mctx);
+	generate(DST_ALG_HMAC_MD5, mctx);
+
+	get_random();
+
+	isc_mem_put(mctx, current, 256);
+/*	isc_mem_stats(mctx, stdout);*/
+	isc_mem_destroy(&mctx);
+
+	exit(0);
+}
--- a/18
+++ b/18
@@ -2850,6 +2850,14 @@ trap 'rm -fr `echo "make/rules
 	lib/dns/Makefile
 	lib/dns/include/Makefile
 	lib/dns/include/dns/Makefile
+	lib/dns/sec/Makefile
+	lib/dns/sec/openssl/Makefile
+	lib/dns/sec/openssl/include/Makefile
+	lib/dns/sec/openssl/include/openssl/Makefile
+	lib/dns/sec/dnssafe/Makefile
+	lib/dns/sec/dst/Makefile
+	lib/dns/sec/dst/include/Makefile
+	lib/dns/sec/dst/include/dst/Makefile
 	lib/tests/Makefile
 	lib/tests/include/Makefile
 	lib/tests/include/tests/Makefile
@@ -2859,6 +2867,7 @@ trap 'rm -fr `echo "make/rules
 	bin/tests/names/Makefile
 	bin/tests/master/Makefile
 	bin/tests/rbt/Makefile
+	bin/tests/dst/Makefile
 config.h" | sed "s/:[^ ]*//g"` conftest*; exit 1' 1 2 15
 EOF
 cat >> $CONFIG_STATUS <<EOF
@@ -2991,6 +3000,14 @@ CONFIG_FILES=\${CONFIG_FILES-"make/rules
 	lib/dns/Makefile
 	lib/dns/include/Makefile
 	lib/dns/include/dns/Makefile
+	lib/dns/sec/Makefile
+	lib/dns/sec/openssl/Makefile
+	lib/dns/sec/openssl/include/Makefile
+	lib/dns/sec/openssl/include/openssl/Makefile
+	lib/dns/sec/dnssafe/Makefile
+	lib/dns/sec/dst/Makefile
+	lib/dns/sec/dst/include/Makefile
+	lib/dns/sec/dst/include/dst/Makefile
 	lib/tests/Makefile
 	lib/tests/include/Makefile
 	lib/tests/include/tests/Makefile
@@ -3000,6 +3017,7 @@ CONFIG_FILES=\${CONFIG_FILES-"make/rules
 	bin/tests/names/Makefile
 	bin/tests/master/Makefile
 	bin/tests/rbt/Makefile
+	bin/tests/dst/Makefile
 "}
 EOF
 cat >> $CONFIG_STATUS <<\EOF
--- a/configure.in
+++ b/configure.in
@@ -13,7 +13,7 @@ dnl PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
 dnl ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 dnl SOFTWARE.

-AC_REVISION($Revision: 1.36 $)
+AC_REVISION($Revision: 1.37 $)

 AC_PREREQ(2.13)

@@ -357,6 +357,14 @@ AC_OUTPUT(
 	lib/dns/Makefile
 	lib/dns/include/Makefile
 	lib/dns/include/dns/Makefile
+	lib/dns/sec/Makefile
+	lib/dns/sec/openssl/Makefile
+	lib/dns/sec/openssl/include/Makefile
+	lib/dns/sec/openssl/include/openssl/Makefile
+	lib/dns/sec/dnssafe/Makefile
+	lib/dns/sec/dst/Makefile
+	lib/dns/sec/dst/include/Makefile
+	lib/dns/sec/dst/include/dst/Makefile
 	lib/tests/Makefile
 	lib/tests/include/Makefile
 	lib/tests/include/tests/Makefile
@@ -366,4 +374,5 @@ AC_OUTPUT(
 	bin/tests/names/Makefile
 	bin/tests/master/Makefile
 	bin/tests/rbt/Makefile
+	bin/tests/dst/Makefile
 )
--- a/lib/dns/Makefile.in
+++ b/lib/dns/Makefile.in
@@ -35,19 +35,90 @@ CWARNINGS =
 LIBS =		@LIBS@

 # Alphabetically
+DSTOBJS =	sec/dst/bsafe_link.@O@ sec/dst/dst_api.@O@ \
+		sec/dst/dst_parse.@O@ sec/dst/hmac_link.@O@ \
+		sec/dst/openssl_link.@O@ sec/dst/dst_result.@O@ \
+		sec/dst/dst_support.@O@ sec/dst/dst_lib.@O@
+
+OPENSSLOBJS =	sec/openssl/bn_add.@O@ sec/openssl/bn_asm.@O@ \
+		sec/openssl/bn_comba.@O@ sec/openssl/bn_div.@O@ \
+		sec/openssl/bn_err.@O@ sec/openssl/bn_exp.@O@ \
+		sec/openssl/bn_exp2.@O@ sec/openssl/bn_gcd.@O@ \
+		sec/openssl/bn_lib.@O@ sec/openssl/bn_m.@O@ \
+		sec/openssl/bn_mont.@O@ sec/openssl/bn_mul.@O@ \
+		sec/openssl/bn_prime.@O@ sec/openssl/bn_rand.@O@ \
+		sec/openssl/bn_recp.@O@ sec/openssl/bn_shift.@O@ \
+		sec/openssl/bn_sqr.@O@ sec/openssl/bn_word.@O@ \
+		sec/openssl/buffer.@O@ sec/openssl/cryptlib.@O@ \
+		sec/openssl/dsa_asn1.@O@ sec/openssl/dsa_err.@O@ \
+		sec/openssl/dsa_gen.@O@ sec/openssl/dsa_key.@O@ \
+		sec/openssl/dsa_lib.@O@ sec/openssl/dsa_sign.@O@ \
+		sec/openssl/dsa_vrf.@O@ sec/openssl/err.@O@ \
+		sec/openssl/lhash.@O@ sec/openssl/md_rand.@O@ \
+		sec/openssl/md5_dgst.@O@ sec/openssl/mem.@O@ \
+		sec/openssl/rand_lib.@O@ sec/openssl/sha1_one.@O@ \
+		sec/openssl/sha1dgst.@O@ sec/openssl/stack.@O@ \
+		sec/openssl/th-lock.@O@
+
+DNSSAFEOBJS =	sec/dnssafe/ahchdig.@O@ sec/dnssafe/ahchencr.@O@ \
+		sec/dnssafe/ahchgen.@O@ sec/dnssafe/ahchrand.@O@ \
+		sec/dnssafe/ahdigest.@O@ sec/dnssafe/ahencryp.@O@ \
+		sec/dnssafe/ahgen.@O@ sec/dnssafe/ahrandom.@O@ \
+		sec/dnssafe/ahrsaenc.@O@ sec/dnssafe/ahrsaepr.@O@ \
+		sec/dnssafe/ahrsaepu.@O@ sec/dnssafe/aichdig.@O@ \
+		sec/dnssafe/aichenc8.@O@ sec/dnssafe/aichencn.@O@ \
+		sec/dnssafe/aichencr.@O@ sec/dnssafe/aichgen.@O@ \
+		sec/dnssafe/aichrand.@O@ sec/dnssafe/aimd5.@O@ \
+		sec/dnssafe/aimd5ran.@O@ sec/dnssafe/ainfotyp.@O@ \
+		sec/dnssafe/ainull.@O@ sec/dnssafe/airsaepr.@O@ \
+		sec/dnssafe/airsaepu.@O@ sec/dnssafe/airsakgn.@O@ \
+		sec/dnssafe/airsaprv.@O@ sec/dnssafe/airsapub.@O@ \
+		sec/dnssafe/algchoic.@O@ sec/dnssafe/algobj.@O@ \
+		sec/dnssafe/amcrte.@O@ sec/dnssafe/ammd5.@O@ \
+		sec/dnssafe/ammd5r.@O@ sec/dnssafe/amrkg.@O@ \
+		sec/dnssafe/amrsae.@O@ \
+		sec/dnssafe/balg.@O@ sec/dnssafe/bgclrbit.@O@ \
+		sec/dnssafe/bgmdmpyx.@O@ sec/dnssafe/bgmdsqx.@O@ \
+		sec/dnssafe/bgmodexp.@O@ sec/dnssafe/bgpegcd.@O@ \
+		sec/dnssafe/big2exp.@O@ sec/dnssafe/bigabs.@O@ \
+		sec/dnssafe/bigacc.@O@ sec/dnssafe/bigarith.@O@ \
+		sec/dnssafe/bigcmp.@O@ sec/dnssafe/bigconst.@O@ \
+		sec/dnssafe/biginv.@O@ sec/dnssafe/biglen.@O@ \
+		sec/dnssafe/bigmodx.@O@ sec/dnssafe/bigmpy.@O@ \
+		sec/dnssafe/bigpdiv.@O@ sec/dnssafe/bigpmpy.@O@ \
+		sec/dnssafe/bigpmpyh.@O@ sec/dnssafe/bigpmpyl.@O@ \
+		sec/dnssafe/bigpsq.@O@ sec/dnssafe/bigqrx.@O@ \
+		sec/dnssafe/bigsmod.@O@ sec/dnssafe/bigtocan.@O@ \
+		sec/dnssafe/bigu.@O@ sec/dnssafe/bigunexp.@O@ \
+		sec/dnssafe/binfocsh.@O@ sec/dnssafe/bkey.@O@ \
+		sec/dnssafe/bmempool.@O@ sec/dnssafe/cantobig.@O@ \
+		sec/dnssafe/crt2.@O@ sec/dnssafe/digest.@O@ \
+		sec/dnssafe/digrand.@O@ sec/dnssafe/encrypt.@O@ \
+		sec/dnssafe/generate.@O@ sec/dnssafe/intbits.@O@ \
+		sec/dnssafe/intitem.@O@ sec/dnssafe/keyobj.@O@ \
+		sec/dnssafe/ki8byte.@O@ sec/dnssafe/kiitem.@O@ \
+		sec/dnssafe/kinfotyp.@O@ sec/dnssafe/kifulprv.@O@ \
+		sec/dnssafe/kipkcrpr.@O@ sec/dnssafe/kirsacrt.@O@ \
+		sec/dnssafe/kirsapub.@O@ sec/dnssafe/md5.@O@ \
+		sec/dnssafe/md5rand.@O@ sec/dnssafe/prime.@O@ \
+		sec/dnssafe/random.@O@ sec/dnssafe/rsa.@O@ \
+		sec/dnssafe/rsakeygn.@O@ sec/dnssafe/seccbcd.@O@ \
+		sec/dnssafe/seccbce.@O@ sec/dnssafe/surrendr.@O@
+
 OBJS =		callbacks.@O@ compress.@O@ db.@O@ dbiterator.@O@ \
 		dbtable.@O@ dispatch.@O@ lib.@O@ master.@O@ message.@O@ \
 		name.@O@ rbt.@O@ rbtdb.@O@ rbtdb64.@O@ rdata.@O@ \
 		rdatalist.@O@ rdataset.@O@ rdatasetiter.@O@ rdataslab.@O@ \
 		resolver.@O@ result.@O@ version.@O@ masterdump.@O@ time.@O@ \
-		ttl.@O@ tcpmsg.@O@
+		ttl.@O@ tcpmsg.@O@ \
+		${DSTOBJS} ${OPENSSLOBJS} ${DNSSAFEOBJS}

 OSRC =		callbacks.c compress.c db.c dbiterator.c dbtable.c dispatch.c \
 		lib.c master.c name.c rbt.c rbtdb.c rbtdb64.c \
 		rdata.c rdatalist.c rdataset.c rdatasetiter.c rdataslab.c \
 		resolver.c result.c version.c masterdump.c time.c ttl.c

-SUBDIRS =	include
+SUBDIRS =	include sec
 TARGETS =	include/dns/enumtype.h include/dns/enumclass.h \
 		include/dns/rdatastruct.h timestamp

@@ -87,6 +158,8 @@ clean distclean::
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h

+sec: include/dns/enumtype.h include/dns/enumclass.h include/dns/rdatastruct.h
+
 rdata.@O@: code.h

 include/dns/enumtype.h: gen
--- a/lib/dns/include/dns/Makefile.in
+++ b/lib/dns/include/dns/Makefile.in
@@ -20,11 +20,11 @@ top_srcdir =	@top_srcdir@
@BIND9_VERSION@

 HEADERS =	callbacks.h cert.h compress.h db.h dbiterator.h dbtable.h \
-		events.h dispatch.h events.h fixedname.h lib.h master.h \
-		masterdump.h message.h name.h rbt.h rcode.h rdata.h \
-		rdataclass.h rdatalist.h rdataset.h rdatasetiter.h \
-		rdataslab.h rdatatype.h result.h secalg.h tcpmsg.h time.h \
-		ttl.h types.h
+		events.h dispatch.h events.h fixedname.h keyvalues.h \
+		lib.h master.h masterdump.h message.h name.h rbt.h \
+		rcode.h rdata.h rdataclass.h rdatalist.h rdataset.h \
+		rdatasetiter.h rdataslab.h rdatatype.h result.h \
+		secalg.h tcpmsg.h time.h ttl.h types.h
 GENHEADERS =	enumclass.h enumtype.h rdatastruct.h

 SUBDIRS =
--- a/lib/dns/include/dns/keyvalues.h
+++ b/lib/dns/include/dns/keyvalues.h
@@ -0,0 +1,76 @@
+#ifndef DNS_KEYVALUES_H
+#define DNS_KEYVALUES_H 1
+
+ISC_LANG_BEGINDECLS
+
+/*
+ * Flags field of the KEY RR rdata
+ */
+#define NS_KEY_TYPEMASK		0xC000	/* Mask for "type" bits */
+#define NS_KEY_TYPE_AUTH_CONF	0x0000	/* Key usable for both */
+#define NS_KEY_TYPE_CONF_ONLY	0x8000	/* Key usable for confidentiality */
+#define NS_KEY_TYPE_AUTH_ONLY	0x4000	/* Key usable for authentication */
+#define NS_KEY_TYPE_NO_KEY	0xC000	/* No key usable for either; no key */
+/* The type bits can also be interpreted independently, as single bits: */
+#define NS_KEY_NO_AUTH		0x8000	/* Key unusable for authentication */
+#define NS_KEY_NO_CONF		0x4000	/* Key unusable for confidentiality */
+#define NS_KEY_RESERVED2	0x2000	/* Security is *mandatory* if bit=0 */
+#define NS_KEY_EXTENDED_FLAGS	0x1000	/* reserved - must be zero */
+#define NS_KEY_RESERVED4	0x0800	/* reserved - must be zero */
+#define NS_KEY_RESERVED5	0x0400	/* reserved - must be zero */
+#define NS_KEY_NAME_TYPE	0x0300	/* these bits determine the type */
+#define NS_KEY_NAME_USER	0x0000	/* key is assoc. with user */
+#define NS_KEY_NAME_ENTITY	0x0200	/* key is assoc. with entity eg host */
+#define NS_KEY_NAME_ZONE	0x0100	/* key is zone key */
+#define NS_KEY_NAME_RESERVED	0x0300	/* reserved meaning */
+#define NS_KEY_RESERVED8	0x0080	/* reserved - must be zero */
+#define NS_KEY_RESERVED9	0x0040	/* reserved - must be zero */
+#define NS_KEY_RESERVED10	0x0020	/* reserved - must be zero */
+#define NS_KEY_RESERVED11	0x0010	/* reserved - must be zero */
+#define NS_KEY_SIGNATORYMASK	0x000F	/* key can sign RR's of same name */
+
+#define NS_KEY_RESERVED_BITMASK ( NS_KEY_RESERVED2 | \
+				  NS_KEY_RESERVED4 | \
+				  NS_KEY_RESERVED5 | \
+				  NS_KEY_RESERVED8 | \
+				  NS_KEY_RESERVED9 | \
+				  NS_KEY_RESERVED10 | \
+				  NS_KEY_RESERVED11 )
+
+#define NS_KEY_RESERVED_BITMASK2 0xFFFF	/* no bits defined here */
+
+/* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
+#define NS_ALG_MD5RSA		1       /* MD5 with RSA */
+#define NS_ALG_DH		2       /* Diffie Hellman KEY */
+#define NS_ALG_DSA		3       /* DSA KEY */
+#define NS_ALG_DSS		NS_ALG_DSA
+#define NS_ALG_EXPIRE_ONLY	253     /* No alg, no security */
+#define NS_ALG_PRIVATE_OID	254     /* Key begins with OID giving alg */
+
+/* Protocol values  */
+/* value 0 is reserved */
+#define NS_KEY_PROT_TLS		1
+#define NS_KEY_PROT_EMAIL	2
+#define NS_KEY_PROT_DNSSEC	3
+#define NS_KEY_PROT_IPSEC	4
+#define NS_KEY_PROT_ANY		255
+
+/* Signatures */
+#define NS_MD5RSA_MIN_BITS	512	/* Size of a mod or exp in bits */
+#define NS_MD5RSA_MAX_BITS	2552
+	/* Total of binary mod and exp */
+#define NS_MD5RSA_MAX_BYTES	((NS_MD5RSA_MAX_BITS+7/8)*2+3)
+	/* Max length of text sig block */
+#define NS_MD5RSA_MAX_BASE64	(((NS_MD5RSA_MAX_BYTES+2)/3)*4)
+#define NS_MD5RSA_MIN_SIZE	((NS_MD5RSA_MIN_BITS+7)/8)
+#define NS_MD5RSA_MAX_SIZE	((NS_MD5RSA_MAX_BITS+7)/8)
+
+#define NS_DSA_SIG_SIZE		41
+#define NS_DSA_MIN_BITS		512
+#define NS_DSA_MAX_BITS		1024
+#define NS_DSA_MIN_BYTES	213
+#define NS_DSA_MAX_BYTES	405
+
+ISC_LANG_ENDDECLS
+
+#endif /* DNS_KEYVALUES_H */
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -64,6 +64,7 @@ typedef struct dns_forwarders			dns_forwarders_t;
 typedef isc_uint16_t				dns_messageid_t;
 typedef isc_uint16_t				dns_trust_t;
 typedef struct dns_dispatch			dns_dispatch_t;
+typedef struct dns_tsig_key			dns_tsig_key_t;

 typedef enum {
 	dns_labeltype_ordinary = 0,
--- a/lib/dns/sec/Makefile.in
+++ b/lib/dns/sec/Makefile.in
@@ -0,0 +1,23 @@
+# Copyright (C) 1998  Internet Software Consortium.
+# 
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+# SOFTWARE.
+
+srcdir =	@srcdir@
+VPATH =		@srcdir@
+top_srcdir =	@top_srcdir@
+
+SUBDIRS =	dnssafe dst openssl
+TARGETS =
+
+@BIND9_MAKE_RULES@
--- a/lib/dns/sec/dnssafe/Makefile.in
+++ b/lib/dns/sec/dnssafe/Makefile.in
@@ -0,0 +1,63 @@
+# Copyright (C) 1998, 1999  Internet Software Consortium.
+# 
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+# SOFTWARE.
+
+srcdir =	@srcdir@
+VPATH =		@srcdir@
+top_srcdir =	@top_srcdir@
+
+@BIND9_VERSION@
+
+@LIBDNS_API@
+
+CINCLUDES =	-I${srcdir}/../../../isc/unix/include \
+		-I${srcdir}/../../../isc/pthreads/include \
+		-I${srcdir}/../../../isc/include \
+		-I${srcdir}/include \
+		-I${srcdir} \
+		-I./include \
+		-I.
+
+CDEFINES =
+CWARNINGS =
+
+LIBS =		@LIBS@
+
+# Alphabetically
+OBJS =		ahchdig.@O@ ahchencr.@O@ ahchgen.@O@ ahchrand.@O@ \
+		ahdigest.@O@ ahencryp.@O@ ahgen.@O@ ahrandom.@O@ \
+		ahrsaenc.@O@ ahrsaepr.@O@ ahrsaepu.@O@ aichdig.@O@ \
+		aichenc8.@O@ aichencn.@O@ aichencr.@O@ aichgen.@O@ \
+		aichrand.@O@ aimd5.@O@ aimd5ran.@O@ ainfotyp.@O@ \
+		ainull.@O@ airsaepr.@O@ airsaepu.@O@ airsakgn.@O@ \
+		airsaprv.@O@ airsapub.@O@ algchoic.@O@ algobj.@O@ \
+		amcrte.@O@ ammd5.@O@ ammd5r.@O@ amrkg.@O@ amrsae.@O@ \
+		balg.@O@ bgclrbit.@O@ bgmdmpyx.@O@ bgmdsqx.@O@ \
+		bgmodexp.@O@ bgpegcd.@O@ big2exp.@O@ bigabs.@O@ \
+		bigacc.@O@ bigarith.@O@ bigcmp.@O@ bigconst.@O@ \
+		biginv.@O@ biglen.@O@ bigmodx.@O@ bigmpy.@O@ \
+		bigpdiv.@O@ bigpmpy.@O@ bigpmpyh.@O@ bigpmpyl.@O@ \
+		bigpsq.@O@ bigqrx.@O@ bigsmod.@O@ bigtocan.@O@ \
+		bigu.@O@ bigunexp.@O@ binfocsh.@O@ bkey.@O@ \
+		bmempool.@O@ cantobig.@O@ crt2.@O@ digest.@O@ \
+		digrand.@O@ encrypt.@O@ generate.@O@ intbits.@O@ \
+		intitem.@O@ keyobj.@O@ ki8byte.@O@ kiitem.@O@ \
+		kinfotyp.@O@ kifulprv.@O@ kipkcrpr.@O@ kirsacrt.@O@ \
+		kirsapub.@O@ md5.@O@ md5rand.@O@ prime.@O@ random.@O@ \
+		rsa.@O@ rsakeygn.@O@ seccbcd.@O@ seccbce.@O@ surrendr.@O@
+
+SUBDIRS =
+TARGETS =	${OBJS}
+
+@BIND9_MAKE_RULES@
--- a/lib/dns/sec/dnssafe/ahcbcpad.c
+++ b/lib/dns/sec/dnssafe/ahcbcpad.c
@@ -0,0 +1,174 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AHSecretCBCPad;
+#define THIS_ENCRYPT_DECRYPT struct AHSecretCBCPad
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahcbcpad.h"
+
+#define GENERATE_BREAK(type) { \
+    status = type; \
+    break; \
+  }
+
+/* Inherit the base class destructor, block size,
+     and decrypt init and update routines.
+ */
+static AHEncryptDecryptVTable V_TABLE = {
+  AHChooseEncryptDestructor, AHChooseEncryptGetBlockLen,
+  AHSecretCBCPadEncryptInit, AHChooseEncryptDecryptInit,
+  AHSecretCBCPadEncryptUpdate, AHChooseEncryptDecryptUpdate,
+  AHSecretCBCPadEncryptFinal, AHSecretCBCPadDecryptFinal
+};
+
+AHSecretCBCPad *AHSecretCBCPadConstructor2 (handler, infoType, info)
+AHSecretCBCPad *handler;
+struct B_AlgorithmInfoType *infoType;
+POINTER info;
+{
+  if (handler == (AHSecretCBCPad *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AHSecretCBCPad *)T_malloc (sizeof (*handler)))
+        == (AHSecretCBCPad *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class with the infoType and info. */
+  AHChooseEncryptConstructor2
+    (&handler->chooseEncryptDecrypt, infoType, info);
+
+  handler->chooseEncryptDecrypt.encryptDecrypt.vTable = &V_TABLE;
+  return (handler);
+}
+
+int AHSecretCBCPadEncryptInit (handler, key, chooser, surrenderContext)
+AHSecretCBCPad *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  /* For encryption, we need to track the input length */
+  handler->_inputRemainder = 0;
+
+  return (AHChooseEncryptEncryptInit
+          (handler, key, chooser, surrenderContext));
+}
+
+int AHSecretCBCPadEncryptUpdate
+  (handler, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+AHSecretCBCPad *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  /* For encryption, we need to track the input length */
+  handler->_inputRemainder = (handler->_inputRemainder + partInLen) % 8;
+  
+  return (AHChooseEncryptEncryptUpdate
+          (handler, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+           randomAlgorithm, surrenderContext));
+}
+
+int AHSecretCBCPadEncryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AHSecretCBCPad *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned char finalBuffer[8];
+  unsigned int padLen, dummyPartOutLen;
+
+  padLen = 8 - handler->_inputRemainder;
+  T_memset ((POINTER)finalBuffer, padLen, padLen);
+
+  /* Add the pad bytes.  This should force the output of the final block.
+   */
+  if ((status = AHChooseEncryptEncryptUpdate
+       (handler, partOut, partOutLen, maxPartOutLen, finalBuffer, padLen,
+        randomAlgorithm, surrenderContext)) != 0)
+    return (status);
+
+  /* The encrypt final operation should have no output. */
+  if ((status = AHChooseEncryptEncryptFinal
+       (handler, (unsigned char *)NULL_PTR, &dummyPartOutLen, 0,
+        (B_Algorithm *)NULL_PTR, (A_SURRENDER_CTX *)NULL_PTR)) != 0)
+    return (status);
+
+  /* Restart the context. */
+  handler->_inputRemainder = 0;
+
+  /* No need to zeroize the finalBuffer since it only contains pad bytes. */
+  return (0);
+}
+
+int AHSecretCBCPadDecryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AHSecretCBCPad *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned char finalBuffer[16], *padBuffer;
+  unsigned int padLen, localPartOutLen, i;
+  
+  do {
+    /* For now, the DecrypyFinal operations is set to output 16 bytes.
+     */
+    if ((status = AHChooseEncryptDecryptFinal
+         (handler, finalBuffer, &localPartOutLen, sizeof (finalBuffer),
+          randomAlgorithm, surrenderContext)) != 0)
+      break;
+
+    if (localPartOutLen == 8)
+      padBuffer = finalBuffer;
+    else if (localPartOutLen == 16)
+      padBuffer = finalBuffer + 8;
+    else
+      GENERATE_BREAK (BE_INPUT_LEN);
+
+    /* Check that padding is one 1 to eight 8's.
+     */
+    if ((padLen = (unsigned int)padBuffer[7]) == 0 || padLen > 8)
+      GENERATE_BREAK (BE_INPUT_DATA);
+    for (i = 8 - padLen; i < 8; i++) {
+      if ((unsigned int)padBuffer[i] != padLen)
+        GENERATE_BREAK (BE_INPUT_DATA);
+    }
+
+    if ((*partOutLen = localPartOutLen - padLen) > maxPartOutLen)
+      GENERATE_BREAK (BE_OUTPUT_LEN);
+
+    T_memcpy
+      ((POINTER)partOut, (POINTER)finalBuffer, *partOutLen);
+  } while (0);
+
+  T_memset ((POINTER)finalBuffer, 0, sizeof (finalBuffer));
+  return (status);
+}
+
--- a/lib/dns/sec/dnssafe/ahcbcpad.h
+++ b/lib/dns/sec/dnssafe/ahcbcpad.h
@@ -0,0 +1,37 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHCBCPAD_H_
+#define _AHCBCPAD_H_
+
+#include "ahchencr.h"
+
+typedef struct AHSecretCBCPad {
+  AHChooseEncryptDecrypt chooseEncryptDecrypt;                 /* base class */
+
+  unsigned int _inputRemainder;    /* Used for encrypt to compute pad length */
+} AHSecretCBCPad;
+
+AHSecretCBCPad *AHSecretCBCPadConstructor2 PROTO_LIST
+  ((AHSecretCBCPad *, struct B_AlgorithmInfoType *, POINTER));
+
+int AHSecretCBCPadEncryptInit PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+    A_SURRENDER_CTX *));
+int AHSecretCBCPadEncryptUpdate PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, unsigned char *, unsigned int, B_Algorithm *,
+    A_SURRENDER_CTX *));
+int AHSecretCBCPadEncryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+int AHSecretCBCPadDecryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahchdig.c
+++ b/lib/dns/sec/dnssafe/ahchdig.c
@@ -0,0 +1,130 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AHChooseDigest;
+#define THIS_DIGEST struct AHChooseDigest
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "balgmeth.h"
+#include "ahchdig.h"
+#include "amdigest.h"
+
+static int InitDigestAlga PROTO_LIST
+  ((AlgaChoice *, POINTER, B_ALGORITHM_METHOD *, A_SURRENDER_CTX *));
+
+static AHDigestVTable V_TABLE = {
+  AHChooseDigestDestructor, AHChooseDigestInit, AHChooseDigestUpdate,
+  AHChooseDigestFinal
+};
+
+AHChooseDigest *AHChooseDigestConstructor2 (handler, infoType, info)
+AHChooseDigest *handler;
+struct B_AlgorithmInfoType *infoType;
+POINTER info;
+{
+  if (handler == (AHChooseDigest *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AHChooseDigest *)T_malloc (sizeof (*handler)))
+        == (AHChooseDigest *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AHDigestConstructor (&handler->digest);
+
+  ALGA_CHOICE_Constructor (&handler->algaChoice, InitDigestAlga);
+  handler->algaChoice._algorithmInfoType = infoType;
+  handler->algaChoice._algorithmInfo = info;
+
+  handler->digest.vTable = &V_TABLE;
+
+  return (handler);
+}
+
+void AHChooseDigestDestructor (handler)
+AHChooseDigest *handler;
+{
+  ALGA_CHOICE_Destructor (&handler->algaChoice);
+  /* There is no desructor to call for the base class. */
+}
+
+int AHChooseDigestInit (handler, key, chooser, surrenderContext)
+AHChooseDigest *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (AlgaChoiceChoose
+          (&handler->algaChoice, 0, key, chooser, surrenderContext));
+}
+
+int AHChooseDigestUpdate (handler, partIn, partInLen, surrenderContext)
+AHChooseDigest *handler;
+unsigned char *partIn;
+unsigned int partInLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  
+  if ((status = (*((A_DIGEST_ALGA *)handler->algaChoice._alga)->Update)
+       (handler->algaChoice.context.z.context, partIn, partInLen,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);    
+}
+
+int AHChooseDigestFinal
+  (handler, partOut, partOutLen, maxPartOutLen, surrenderContext)
+AHChooseDigest *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  
+  if ((status = (*((A_DIGEST_ALGA *)handler->algaChoice._alga)->Final)
+       (handler->algaChoice.context.z.context, partOut, partOutLen,
+        maxPartOutLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);    
+}
+
+static int InitDigestAlga
+  (algaChoice, keyInfo, algorithmMethod, surrenderContext)
+AlgaChoice *algaChoice;
+POINTER keyInfo;
+B_ALGORITHM_METHOD *algorithmMethod;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned int contextSize;
+
+UNUSED_ARG (keyInfo)
+  if ((status = (*((A_DIGEST_ALGA *)algorithmMethod->alga)->Query)
+       (&contextSize, algaChoice->_algorithmInfo)) != 0)
+    return (ConvertAlgaeError (status));
+
+  if ((status = ResizeContextMakeNewContext
+       (&algaChoice->context, contextSize)) != 0)
+    return (status);
+
+  if ((status = (*((A_DIGEST_ALGA *)algorithmMethod->alga)->Init)
+       (algaChoice->context.z.context, algaChoice->_algorithmInfo,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+
+  return (0);
+}
--- a/lib/dns/sec/dnssafe/ahchdig.h
+++ b/lib/dns/sec/dnssafe/ahchdig.h
@@ -0,0 +1,32 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHCHDIG_H_
+#define _AHCHDIG_H_ 1
+
+#include "ahdigest.h"
+#include "algchoic.h"
+
+typedef struct AHChooseDigest {
+  AHDigest digest;                                             /* base class */
+  AlgaChoice algaChoice;
+} AHChooseDigest;
+
+AHChooseDigest *AHChooseDigestConstructor2 PROTO_LIST
+  ((AHChooseDigest *, struct B_AlgorithmInfoType *, POINTER));
+void AHChooseDigestDestructor PROTO_LIST ((THIS_DIGEST *));
+
+int AHChooseDigestInit PROTO_LIST
+  ((THIS_DIGEST *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int AHChooseDigestUpdate PROTO_LIST
+  ((THIS_DIGEST *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int AHChooseDigestFinal PROTO_LIST
+  ((THIS_DIGEST *, unsigned char *, unsigned int *, unsigned int,
+    A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahchencr.c
+++ b/lib/dns/sec/dnssafe/ahchencr.c
@@ -0,0 +1,266 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AHChooseEncryptDecrypt;
+#define THIS_ENCRYPT_DECRYPT struct AHChooseEncryptDecrypt
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "balgmeth.h"
+#include "ahchencr.h"
+#include "amencdec.h"
+
+static int InitEncryptDecryptAlga PROTO_LIST
+  ((AlgaChoice *, POINTER, B_ALGORITHM_METHOD *, A_SURRENDER_CTX *));
+
+static AHEncryptDecryptVTable V_TABLE = {
+  AHChooseEncryptDestructor, AHChooseEncryptGetBlockLen,
+  AHChooseEncryptEncryptInit, AHChooseEncryptDecryptInit,
+  AHChooseEncryptEncryptUpdate, AHChooseEncryptDecryptUpdate,
+  AHChooseEncryptEncryptFinal, AHChooseEncryptDecryptFinal
+};
+
+/* In C++:
+AHChooseEncryptDecrypt::AHChooseEncryptDecrypt
+  (B_AlgorithmInfoType *infoType, POINTER info)
+  : algaChoice (InitEncryptDecryptAlga)
+{
+  algaChoice.setAlgorithmInfoType (infoType);
+  algaChoice.setAlgorithmInfo (info);
+}
+ */
+AHChooseEncryptDecrypt *AHChooseEncryptConstructor2 (handler, infoType, info)
+AHChooseEncryptDecrypt *handler;
+struct B_AlgorithmInfoType *infoType;
+POINTER info;
+{
+  if (handler == (AHChooseEncryptDecrypt *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AHChooseEncryptDecrypt *)T_malloc (sizeof (*handler)))
+        == (AHChooseEncryptDecrypt *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AHEncryptDecryptConstructor (&handler->encryptDecrypt);
+
+  ALGA_CHOICE_Constructor (&handler->algaChoice, InitEncryptDecryptAlga);
+  handler->algaChoice._algorithmInfoType = infoType;
+  handler->algaChoice._algorithmInfo = info;
+
+  handler->encryptDecrypt.vTable = &V_TABLE;
+
+  return (handler);
+}
+
+void AHChooseEncryptDestructor (handler)
+AHChooseEncryptDecrypt *handler;
+{
+  ALGA_CHOICE_Destructor (&handler->algaChoice);
+  /* There is no desructor to call for the base class. */
+}
+
+int AHChooseEncryptGetBlockLen (handler, blockLen)
+AHChooseEncryptDecrypt *handler;
+unsigned int *blockLen;
+{
+  int status;
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)handler->algaChoice._alga)->
+                 GetBlockLen)
+       (handler->algaChoice.context.z.context, blockLen)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}
+
+/* In C++:
+int AHChooseEncryptDecrypt::encryptInit
+  (B_Key *key, B_ALGORITHM_CHOOSER chooser, A_SURRENDER_CTX *surrenderContext)
+{
+  return (algaChoice.choose (1, key, chooser, surrenderContext));
+}
+ */
+int AHChooseEncryptEncryptInit (handler, key, chooser, surrenderContext)
+AHChooseEncryptDecrypt *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (AlgaChoiceChoose
+          (&handler->algaChoice, 1, key, chooser, surrenderContext));
+}
+
+int AHChooseEncryptDecryptInit (handler, key, chooser, surrenderContext)
+AHChooseEncryptDecrypt *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (AlgaChoiceChoose
+          (&handler->algaChoice, 0, key, chooser, surrenderContext));
+}
+
+/* In C++:
+int AHChooseEncryptDecrypt::encryptUpdate
+  (unsigned char *partOut, unsigned int *partOutLen,
+   unsigned int maxPartOutLen, unsigned char *partIn, unsigned int partInLen,
+   B_Algorithm *randomAlgorithm, A_SURRENDER_CTX *surrenderContext)
+{
+  int status;
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)algaChoice.alga ()) ->Update)
+       (algaChoice.context (), partOut, partOutLen, maxPartOutLen,
+        partIn, partInLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}  
+ */
+int AHChooseEncryptEncryptUpdate
+  (handler, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+AHChooseEncryptDecrypt *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+UNUSED_ARG (randomAlgorithm)
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)handler->algaChoice._alga)->
+                 Update)
+       (handler->algaChoice.context.z.context, partOut, partOutLen,
+        maxPartOutLen, partIn, partInLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}
+
+int AHChooseEncryptDecryptUpdate
+  (handler, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+AHChooseEncryptDecrypt *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+UNUSED_ARG (randomAlgorithm)
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)handler->algaChoice._alga)->
+                 Update)
+       (handler->algaChoice.context.z.context, partOut, partOutLen,
+        maxPartOutLen, partIn, partInLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}
+
+int AHChooseEncryptEncryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AHChooseEncryptDecrypt *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+UNUSED_ARG (randomAlgorithm)
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)handler->algaChoice._alga)->Final)
+       (handler->algaChoice.context.z.context, partOut, partOutLen,
+        maxPartOutLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}
+
+int AHChooseEncryptDecryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AHChooseEncryptDecrypt *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+UNUSED_ARG (randomAlgorithm)
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)handler->algaChoice._alga)->Final)
+       (handler->algaChoice.context.z.context, partOut, partOutLen,
+        maxPartOutLen, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);
+}
+
+/* In C++:
+static int InitEncryptDecryptAlga
+  (AlgaChoice *algaChoice, POINTER keyInfo, POINTER alga,
+   A_SURRENDER_CTX *surrenderContext)
+{
+  int status;
+  unsigned int contextSize;
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)alga)->Query)
+       (&contextSize, keyInfo, algaChoice->algorithmInfo ())) != 0)
+    return (ConvertAlgaeError (status));
+
+  if ((status = algaChoice->makeNewContext (contextSize)) != 0)
+    return (status);
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)alga)->Init)
+       (algaChoice->context (), keyInfo, algaChoice->algorithmInfo (),
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+
+  return (0);
+}
+ */
+static int InitEncryptDecryptAlga
+  (algaChoice, keyInfo, algorithmMethod, surrenderContext)
+AlgaChoice *algaChoice;
+POINTER keyInfo;
+B_ALGORITHM_METHOD *algorithmMethod;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned int contextSize;
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)algorithmMethod->alga)->Query)
+       (&contextSize, keyInfo, algaChoice->_algorithmInfo)) != 0)
+    return (ConvertAlgaeError (status));
+
+  if ((status = ResizeContextMakeNewContext
+       (&algaChoice->context, contextSize)) != 0)
+    return (status);
+
+  if ((status = (*((A_ENCRYPT_DECRYPT_ALGA *)algorithmMethod->alga)->Init)
+       (algaChoice->context.z.context, keyInfo, algaChoice->_algorithmInfo,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+
+  return (0);
+}
--- a/lib/dns/sec/dnssafe/ahchencr.h
+++ b/lib/dns/sec/dnssafe/ahchencr.h
@@ -0,0 +1,74 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHCHENCR_H_
+#define _AHCHENCR_H_ 1
+
+#include "ahencryp.h"
+#include "algchoic.h"
+
+/* In C++:
+class AHChooseEncryptDecrypt : public AHEncryptDecrypt {
+public:
+  AHChooseEncryptDecrypt (B_AlgorithmInfoType *, POINTER);
+  virtual ~AHChooseEncryptDecrypt () {};
+
+  virtual int getBlockLen (unsigned int *);
+  virtual int encryptInit (B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *);
+  virtual int decryptInit (B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *);
+  virtual int encryptUpdate
+    (unsigned char *, unsigned int *, unsigned int, unsigned char *,
+     unsigned int, B_Algorithm *, A_SURRENDER_CTX *);
+  virtual int decryptUpdate
+    (unsigned char *, unsigned int *, unsigned int, unsigned char *,
+     unsigned int, B_Algorithm *, A_SURRENDER_CTX *);
+  virtual int encryptFinal
+    (unsigned char *, unsigned int *, unsigned int, B_Algorithm *,
+     A_SURRENDER_CTX *);
+  virtual int decryptFinal
+    (unsigned char *, unsigned int *, unsigned int, B_Algorithm *,
+     A_SURRENDER_CTX *);
+
+private:
+  AlgaChoice algaChoice;
+};
+ */
+
+typedef struct AHChooseEncryptDecrypt {
+  AHEncryptDecrypt encryptDecrypt;                             /* base class */
+  AlgaChoice algaChoice;
+} AHChooseEncryptDecrypt;
+
+AHChooseEncryptDecrypt *AHChooseEncryptConstructor2 PROTO_LIST
+  ((AHChooseEncryptDecrypt *, struct B_AlgorithmInfoType *, POINTER));
+void AHChooseEncryptDestructor PROTO_LIST ((THIS_ENCRYPT_DECRYPT *));
+
+int AHChooseEncryptGetBlockLen PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned int *));
+int AHChooseEncryptEncryptInit PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+    A_SURRENDER_CTX *));
+int AHChooseEncryptDecryptInit PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+    A_SURRENDER_CTX *));
+int AHChooseEncryptEncryptUpdate PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, unsigned char *, unsigned int, B_Algorithm *,
+    A_SURRENDER_CTX *));
+int AHChooseEncryptDecryptUpdate PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, unsigned char *, unsigned int, B_Algorithm *,
+    A_SURRENDER_CTX *));
+int AHChooseEncryptEncryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+int AHChooseEncryptDecryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahchgen.c
+++ b/lib/dns/sec/dnssafe/ahchgen.c
@@ -0,0 +1,216 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AHChooseGenerate;
+#define THIS_GENERATE struct AHChooseGenerate
+
+/* Define this so that the type of the AlgaChoice pointer in the
+     INIT_ALGA functions will be correct for this derived class.
+ */
+struct GenerateAlgaChoice;
+#define THIS_ALGA_CHOICE struct GenerateAlgaChoice
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "balgmeth.h"
+#include "ahchgen.h"
+#include "amgen.h"
+
+static int InitGenerateAlga PROTO_LIST
+  ((GenerateAlgaChoice *, POINTER, B_ALGORITHM_METHOD *, A_SURRENDER_CTX *));
+static int GenerateResult PROTO_LIST
+  ((GenerateAlgaChoice *, POINTER *, B_Algorithm *, A_SURRENDER_CTX *));
+
+static AHGenerateVTable V_TABLE = {
+  AHChooseGenerateDestructor, AHChooseGenerateInit, AHChooseGenerateKeypair,
+  AHChooseGenerateParameters
+};
+
+AHChooseGenerate *AHChooseGenerateConstructor2 (handler, infoType, info)
+AHChooseGenerate *handler;
+struct B_AlgorithmInfoType *infoType;
+POINTER info;
+{
+  if (handler == (AHChooseGenerate *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AHChooseGenerate *)T_malloc (sizeof (*handler)))
+        == (AHChooseGenerate *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AHGenerateConstructor (&handler->generate);
+
+  ALGA_CHOICE_Constructor
+    (&handler->generateAlgaChoice.algaChoice, InitGenerateAlga);
+  ResizeContextConstructor (&handler->generateAlgaChoice.secondContext);
+  ResizeContextConstructor (&handler->generateAlgaChoice.randomBlock);
+
+  /* Set algaChoice.
+   */
+  handler->generateAlgaChoice.algaChoice._algorithmInfoType = infoType;
+  handler->generateAlgaChoice.algaChoice._algorithmInfo = info;
+
+  handler->generate.vTable = &V_TABLE;
+
+  return (handler);
+}
+
+void AHChooseGenerateDestructor (handler)
+AHChooseGenerate *handler;
+{
+  ResizeContextDestructor (&handler->generateAlgaChoice.secondContext);
+  ResizeContextDestructor (&handler->generateAlgaChoice.randomBlock);
+  ALGA_CHOICE_Destructor (&handler->generateAlgaChoice.algaChoice);
+  /* There is no desructor to call for the base class. */
+}
+
+int AHChooseGenerateInit (handler, chooser, surrenderContext)
+AHChooseGenerate *handler;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (AlgaChoiceChoose
+          (&handler->generateAlgaChoice.algaChoice, 0, (B_Key *)NULL_PTR,
+           chooser, surrenderContext));
+}
+
+int AHChooseGenerateKeypair
+  (handler, publicKey, privateKey, randomAlgorithm, surrenderContext)
+AHChooseGenerate *handler;
+B_Key *publicKey;
+B_Key *privateKey;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  POINTER result;
+  int status;  
+  
+  if ((status = GenerateResult
+       (&handler->generateAlgaChoice, &result, randomAlgorithm,
+        surrenderContext)) != 0)
+    return (status);
+  if ((status = B_KeySetInfo
+       (publicKey, handler->generateAlgaChoice._resultInfoType, result)) != 0)
+    return (status);
+  return (B_KeySetInfo
+          (privateKey, handler->generateAlgaChoice._resultInfoType, result));
+}
+
+int AHChooseGenerateParameters
+  (handler, resultAlgorithm, randomAlgorithm, surrenderContext)
+AHChooseGenerate *handler;
+B_Algorithm *resultAlgorithm;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  POINTER result;
+  int status;  
+  
+  if ((status = GenerateResult
+       (&handler->generateAlgaChoice, &result, randomAlgorithm,
+        surrenderContext)) != 0)
+    return (status);
+
+  /* Force the resultInfoType into a B_AlgorithmInfoType since it is
+       supplied in the chooser as a B_KeyInfoType. */
+  return (B_AlgorithmSetInfo
+          (resultAlgorithm, (struct B_AlgorithmInfoType *)
+           handler->generateAlgaChoice._resultInfoType, result));
+}
+
+static int InitGenerateAlga
+  (generateAlgaChoice, keyInfo, algorithmMethod, surrenderContext)
+GenerateAlgaChoice *generateAlgaChoice;
+POINTER keyInfo;
+B_ALGORITHM_METHOD *algorithmMethod;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned int contextSize, secondContextSize;
+
+UNUSED_ARG (keyInfo)
+  /* Note that this also gets the resultInfoType which will be used later
+       by GenerateResult. */
+  if ((status = (*((A_GENERATE_ALGA *)algorithmMethod->alga)->Query)
+       (&contextSize, &secondContextSize, &generateAlgaChoice->_randomBlockLen,
+        &generateAlgaChoice->_resultInfoType,
+        generateAlgaChoice->algaChoice._algorithmInfo)) != 0)
+    return (ConvertAlgaeError (status));
+
+  /* Create the context.
+   */
+  if ((status = ResizeContextMakeNewContext
+       (&generateAlgaChoice->algaChoice.context, contextSize)) != 0)
+    return (status);
+
+  /* Create the second context which is only passed during Init, but
+       must persist for all operations. */
+  if ((status = ResizeContextMakeNewContext
+       (&generateAlgaChoice->secondContext, secondContextSize)) != 0)
+    return (status);
+
+  /* Create randomBlock which will be filled in during GenerateResult. */
+  if ((status = ResizeContextMakeNewContext
+       (&generateAlgaChoice->randomBlock, generateAlgaChoice->_randomBlockLen))
+      != 0)
+    return (status);
+
+  if ((status = (*((A_GENERATE_ALGA *)algorithmMethod->alga)->Init)
+       (generateAlgaChoice->algaChoice.context.z.context,
+        generateAlgaChoice->secondContext.z.context,
+        generateAlgaChoice->algaChoice._algorithmInfo, surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+
+   return (0);
+}
+
+/* Call the generate procedure repeatedly with a new random block
+     until it succeeds.
+ */
+static int GenerateResult
+  (generateAlgaChoice, result, randomAlgorithm, surrenderContext)
+GenerateAlgaChoice *generateAlgaChoice;
+POINTER *result;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  /* Fill in the random block and try generating as long as the
+       the generate operation returns BE_NEED_RANDOM.
+   */
+  while (1) {
+    if ((status = B_AlgorithmGenerateRandomBytes
+         (randomAlgorithm,
+          (unsigned char *)generateAlgaChoice->randomBlock.z.context,
+          generateAlgaChoice->_randomBlockLen, surrenderContext)) != 0)
+      return (status);
+
+    if ((status = (*((A_GENERATE_ALGA *)
+                     generateAlgaChoice->algaChoice._alga)->Generate)
+         (generateAlgaChoice->algaChoice.context.z.context, result,
+          (unsigned char *)generateAlgaChoice->randomBlock.z.context,
+          surrenderContext)) != 0) {
+      if (status != AE_NEED_RANDOM)
+        return (ConvertAlgaeError (status));
+      
+      /* Else continue and try again */
+    }
+    else
+      /* Success, so return */
+      return (0);
+  }
+}
+
--- a/lib/dns/sec/dnssafe/ahchgen.h
+++ b/lib/dns/sec/dnssafe/ahchgen.h
@@ -0,0 +1,44 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHCHGEN_H_
+#define _AHCHGEN_H_ 1
+
+#include "ahgen.h"
+#include "algchoic.h"
+
+/* Make a new class derived from an AlgaChoice which records the
+     result algorithm info type and needed randomBlockLen.
+ */
+typedef struct GenerateAlgaChoice {
+  AlgaChoice algaChoice;                                       /* base class */
+
+  struct B_KeyInfoType *_resultInfoType;
+  ResizeContext secondContext;                           /* used for scratch */
+  ResizeContext randomBlock;
+  unsigned int _randomBlockLen;
+} GenerateAlgaChoice;
+
+typedef struct AHChooseGenerate {
+  AHGenerate generate;                                         /* base class */
+
+  GenerateAlgaChoice generateAlgaChoice;
+} AHChooseGenerate;
+
+AHChooseGenerate *AHChooseGenerateConstructor2 PROTO_LIST
+  ((AHChooseGenerate *, struct B_AlgorithmInfoType *, POINTER));
+void AHChooseGenerateDestructor PROTO_LIST ((THIS_GENERATE *));
+
+int AHChooseGenerateInit PROTO_LIST
+  ((THIS_GENERATE *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int AHChooseGenerateKeypair PROTO_LIST
+  ((THIS_GENERATE *, B_Key *, B_Key *, B_Algorithm *, A_SURRENDER_CTX *));
+int AHChooseGenerateParameters PROTO_LIST
+  ((THIS_GENERATE *, B_Algorithm *, B_Algorithm *, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahchrand.c
+++ b/lib/dns/sec/dnssafe/ahchrand.c
@@ -0,0 +1,128 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AHChooseRandom;
+#define THIS_RANDOM struct AHChooseRandom
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "balgmeth.h"
+#include "ahchrand.h"
+#include "amrandom.h"
+
+static int InitRandomAlga PROTO_LIST
+  ((AlgaChoice *, POINTER, B_ALGORITHM_METHOD *, A_SURRENDER_CTX *));
+
+static AHRandomVTable V_TABLE = {
+  AHChooseRandomDestructor, AHChooseRandomInit, AHChooseRandomUpdate,
+  AHChooseRandomGenerateBytes
+};
+
+AHChooseRandom *AHChooseRandomConstructor2 (handler, infoType, info)
+AHChooseRandom *handler;
+struct B_AlgorithmInfoType *infoType;
+POINTER info;
+{
+  if (handler == (AHChooseRandom *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AHChooseRandom *)T_malloc (sizeof (*handler)))
+        == (AHChooseRandom *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AHRandomConstructor (&handler->random);
+
+  ALGA_CHOICE_Constructor (&handler->algaChoice, InitRandomAlga);
+  handler->algaChoice._algorithmInfoType = infoType;
+  handler->algaChoice._algorithmInfo = info;
+
+  handler->random.vTable = &V_TABLE;
+
+  return (handler);
+}
+
+void AHChooseRandomDestructor (handler)
+AHChooseRandom *handler;
+{
+  ALGA_CHOICE_Destructor (&handler->algaChoice);
+  /* There is no desructor to call for the base class. */
+}
+
+int AHChooseRandomInit (handler, chooser, surrenderContext)
+AHChooseRandom *handler;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (AlgaChoiceChoose
+          (&handler->algaChoice, 0, (B_Key *)NULL_PTR, chooser,
+           surrenderContext));
+}
+
+int AHChooseRandomUpdate (handler, input, inputLen, surrenderContext)
+AHChooseRandom *handler;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  
+  if ((status = (*((A_RANDOM_ALGA *)handler->algaChoice._alga)->Update)
+       (handler->algaChoice.context.z.context, input, inputLen,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);    
+}
+
+int AHChooseRandomGenerateBytes (handler, output, outputLen, surrenderContext)
+AHChooseRandom *handler;
+unsigned char *output;
+unsigned int outputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  
+  if ((status = (*((A_RANDOM_ALGA *)handler->algaChoice._alga)->Generate)
+       (handler->algaChoice.context.z.context, output, outputLen,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+  return (0);    
+}
+
+static int InitRandomAlga
+  (algaChoice, keyInfo, algorithmMethod, surrenderContext)
+AlgaChoice *algaChoice;
+POINTER keyInfo;
+B_ALGORITHM_METHOD *algorithmMethod;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned int contextSize;
+
+UNUSED_ARG (keyInfo)
+  if ((status = (*((A_RANDOM_ALGA *)algorithmMethod->alga)->Query)
+       (&contextSize, algaChoice->_algorithmInfo)) != 0)
+    return (ConvertAlgaeError (status));
+
+  if ((status = ResizeContextMakeNewContext
+       (&algaChoice->context, contextSize)) != 0)
+    return (status);
+
+  if ((status = (*((A_RANDOM_ALGA *)algorithmMethod->alga)->Init)
+       (algaChoice->context.z.context, algaChoice->_algorithmInfo,
+        surrenderContext)) != 0)
+    return (ConvertAlgaeError (status));
+
+  return (0);
+}
--- a/lib/dns/sec/dnssafe/ahchrand.h
+++ b/lib/dns/sec/dnssafe/ahchrand.h
@@ -0,0 +1,31 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHCHRAND_H_
+#define _AHCHRAND_H_ 1
+
+#include "ahrandom.h"
+#include "algchoic.h"
+
+typedef struct AHChooseRandom {
+  AHRandom random;                                             /* base class */
+  AlgaChoice algaChoice;
+} AHChooseRandom;
+
+AHChooseRandom *AHChooseRandomConstructor2 PROTO_LIST
+  ((AHChooseRandom *, struct B_AlgorithmInfoType *, POINTER));
+void AHChooseRandomDestructor PROTO_LIST ((THIS_RANDOM *));
+
+int AHChooseRandomInit PROTO_LIST
+  ((THIS_RANDOM *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int AHChooseRandomUpdate PROTO_LIST
+  ((THIS_RANDOM *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int AHChooseRandomGenerateBytes PROTO_LIST
+  ((THIS_RANDOM *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahdigest.c
+++ b/lib/dns/sec/dnssafe/ahdigest.c
@@ -0,0 +1,91 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahdigest.h"
+
+static void TypedAHDigestDestructor PROTO_LIST ((B_TypeCheck *));
+
+void AHDigestConstructor (handler)
+AHDigest *handler;
+{
+  /* Construct base class, setting type tag. */
+  B_TYPE_CHECK_Constructor
+    (&handler->typeCheck, TypedAHDigestDestructor);
+
+  /* Don't set vTable since this is a pure virtual base class. */
+}
+
+int B_AlgorithmDigestInit
+  (algorithm, key, algorithmChooser, surrenderContext)
+B_Algorithm *algorithm;
+B_Key *key;
+B_ALGORITHM_CHOOSER algorithmChooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckType
+       (algorithm, TypedAHDigestDestructor)) != 0)
+    return (status);
+
+  if ((status =
+       (*((AHDigest *)algorithm->z.handler)->vTable->DigestInit)
+       ((AHDigest *)algorithm->z.handler, key, algorithmChooser,
+        surrenderContext)) != 0)
+    return (status);
+
+  algorithm->z.initFlag = 1;
+  return (0);
+}
+
+int B_AlgorithmDigestUpdate (algorithm, partIn, partInLen, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partIn;
+unsigned int partInLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHDigestDestructor)) != 0)
+    return (status);
+
+  return ((*((AHDigest *)algorithm->z.handler)->vTable->DigestUpdate)
+          ((AHDigest *)algorithm->z.handler, partIn, partInLen,
+           surrenderContext));
+}
+
+int B_AlgorithmDigestFinal
+  (algorithm, partOut, partOutLen, maxPartOutLen, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHDigestDestructor)) != 0)
+    return (status);
+
+  return ((*((AHDigest *)algorithm->z.handler)->vTable->DigestFinal)
+          ((AHDigest *)algorithm->z.handler, partOut, partOutLen,
+           maxPartOutLen, surrenderContext));
+}
+
+static void TypedAHDigestDestructor (typeCheck)
+B_TypeCheck *typeCheck;
+{
+  (*((AHDigest *)typeCheck)->vTable->Destructor) ((AHDigest *)typeCheck);
+}
+
--- a/lib/dns/sec/dnssafe/ahdigest.h
+++ b/lib/dns/sec/dnssafe/ahdigest.h
@@ -0,0 +1,48 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHDIGEST_H_
+#define _AHDIGEST_H_ 1
+
+#include "btypechk.h"
+
+/* Use the THIS_DIGEST macro to define the type of object in the
+     virtual function prototype.  It defaults to the most base class, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+#ifndef THIS_DIGEST
+#define THIS_DIGEST struct AHDigest
+#endif
+
+struct AHDigest;
+
+typedef struct {
+  void (*Destructor) PROTO_LIST ((THIS_DIGEST *));
+  int (*DigestInit) PROTO_LIST
+    ((THIS_DIGEST *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+  int (*DigestUpdate) PROTO_LIST
+    ((THIS_DIGEST *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+  int (*DigestFinal) PROTO_LIST
+    ((THIS_DIGEST *, unsigned char *, unsigned int *, unsigned int,
+      A_SURRENDER_CTX *));
+} AHDigestVTable;
+
+typedef struct AHDigest {
+  B_TypeCheck typeCheck;                                        /* inherited */
+  AHDigestVTable *vTable;                                    /* pure virtual */
+} AHDigest;
+
+/* The constructor does not set the vTable since this is a pure base class.
+ */
+void AHDigestConstructor PROTO_LIST ((AHDigest *));
+/* No destructor because it is pure virtual. Also, do not call destructor
+     for B_TypeCheck, since this will just re-invoke this virtual
+     destructor. */
+
+#endif
--- a/lib/dns/sec/dnssafe/ahencryp.c
+++ b/lib/dns/sec/dnssafe/ahencryp.c
@@ -0,0 +1,169 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahencryp.h"
+
+static void TypedAHEncryptDecryptDestructor PROTO_LIST ((B_TypeCheck *));
+
+void AHEncryptDecryptConstructor (handler)
+AHEncryptDecrypt *handler;
+{
+  /* Construct base class, setting type tag. */
+  B_TYPE_CHECK_Constructor
+    (&handler->typeCheck, TypedAHEncryptDecryptDestructor);
+
+  /* Don't set vTable since this is a pure virtual base class. */
+}
+
+int B_AlgorithmEncryptInit
+  (algorithm, key, algorithmChooser, surrenderContext)
+B_Algorithm *algorithm;
+B_Key *key;
+B_ALGORITHM_CHOOSER algorithmChooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckType
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  if ((status =
+       (*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->EncryptInit)
+       ((AHEncryptDecrypt *)algorithm->z.handler, key, algorithmChooser,
+        surrenderContext)) != 0)
+    return (status);
+
+  algorithm->z.initFlag = 1;
+  return (0);
+}
+
+int B_AlgorithmDecryptInit
+  (algorithm, key, algorithmChooser, surrenderContext)
+B_Algorithm *algorithm;
+B_Key *key;
+B_ALGORITHM_CHOOSER algorithmChooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckType
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  if ((status =
+       (*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->DecryptInit)
+       ((AHEncryptDecrypt *)algorithm->z.handler, key, algorithmChooser,
+        surrenderContext)) != 0)
+    return (status);
+
+  algorithm->z.initFlag = 1;
+  return (0);
+}
+
+int B_AlgorithmEncryptUpdate
+  (algorithm, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  return ((*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->EncryptUpdate)
+          ((AHEncryptDecrypt *)algorithm->z.handler, partOut, partOutLen,
+           maxPartOutLen, partIn, partInLen, randomAlgorithm,
+           surrenderContext));
+}
+
+int B_AlgorithmDecryptUpdate
+  (algorithm, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  return ((*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->DecryptUpdate)
+          ((AHEncryptDecrypt *)algorithm->z.handler, partOut, partOutLen,
+           maxPartOutLen, partIn, partInLen, randomAlgorithm,
+           surrenderContext));
+}
+
+int B_AlgorithmEncryptFinal
+  (algorithm, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  return ((*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->EncryptFinal)
+          ((AHEncryptDecrypt *)algorithm->z.handler, partOut, partOutLen,
+           maxPartOutLen, randomAlgorithm, surrenderContext));
+}
+
+int B_AlgorithmDecryptFinal
+  (algorithm, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHEncryptDecryptDestructor)) != 0)
+    return (status);
+
+  return ((*((AHEncryptDecrypt *)algorithm->z.handler)->vTable->DecryptFinal)
+          ((AHEncryptDecrypt *)algorithm->z.handler, partOut, partOutLen,
+           maxPartOutLen, randomAlgorithm, surrenderContext));
+}
+
+static void TypedAHEncryptDecryptDestructor (typeCheck)
+B_TypeCheck *typeCheck;
+{
+  (*((AHEncryptDecrypt *)typeCheck)->vTable->Destructor)
+    ((AHEncryptDecrypt *)typeCheck);
+}
+
--- a/lib/dns/sec/dnssafe/ahencryp.h
+++ b/lib/dns/sec/dnssafe/ahencryp.h
@@ -0,0 +1,85 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHENCRYP_H_
+#define _AHENCRYP_H_ 1
+
+#include "btypechk.h"
+
+/* In C++:
+class AHEncryptDecrypt : public B_TypeCheck {
+  AHEncryptDecrypt ();
+  virtual ~AHEncryptDecrypt () = 0;
+  
+  virtual int getBlockLen (unsigned int *) = 0;
+  virtual int encryptInit
+    (B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *) = 0;
+  virtual int decryptInit
+    (B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *) = 0;
+  virtual int encryptUpdate
+    (unsigned char *, unsigned int *, unsigned int, unsigned char *,
+     unsigned int, B_Algorithm *, A_SURRENDER_CTX *) = 0;
+  virtual int decryptUpdate
+    (unsigned char *, unsigned int *, unsigned int, unsigned char *,
+     unsigned int, B_Algorithm *, A_SURRENDER_CTX *) = 0;
+  virtual int encryptFinal
+    (unsigned char *, unsigned int *, unsigned int, B_Algorithm *,
+     A_SURRENDER_CTX *) = 0;
+  virtual int decryptFinal
+    (unsigned char *, unsigned int *, unsigned int, B_Algorithm *,
+     A_SURRENDER_CTX *) = 0;
+};
+ */
+
+/* Use the THIS_ENCRYPT_DECRYPT macro to define the type of object in the
+     virtual function prototype.  It defaults to the most base class, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+#ifndef THIS_ENCRYPT_DECRYPT
+#define THIS_ENCRYPT_DECRYPT struct AHEncryptDecrypt
+#endif
+
+struct AHEncryptDecrypt;
+
+typedef struct {
+  void (*Destructor) PROTO_LIST ((THIS_ENCRYPT_DECRYPT *));
+  int (*GetBlockLen) PROTO_LIST ((THIS_ENCRYPT_DECRYPT *, unsigned int *));
+  int (*EncryptInit) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+      A_SURRENDER_CTX *));
+  int (*DecryptInit) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+      A_SURRENDER_CTX *));
+  int (*EncryptUpdate) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *, unsigned int,
+      unsigned char *, unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+  int (*DecryptUpdate) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *, unsigned int,
+      unsigned char *, unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+  int (*EncryptFinal) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *, unsigned int,
+      B_Algorithm *, A_SURRENDER_CTX *));
+  int (*DecryptFinal) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *, unsigned int,
+      B_Algorithm *, A_SURRENDER_CTX *));
+} AHEncryptDecryptVTable;
+
+typedef struct AHEncryptDecrypt {
+  B_TypeCheck typeCheck;                                        /* inherited */
+  AHEncryptDecryptVTable *vTable;                            /* pure virtual */
+} AHEncryptDecrypt;
+
+/* The constructor does not set the vTable since this is a pure base class.
+ */
+void AHEncryptDecryptConstructor PROTO_LIST ((AHEncryptDecrypt *));
+/* No destructor because it is pure virtual. Also, do not call destructor
+     for B_TypeCheck, since this will just re-invoke this virtual
+     destructor. */
+
+#endif
--- a/lib/dns/sec/dnssafe/ahgen.c
+++ b/lib/dns/sec/dnssafe/ahgen.c
@@ -0,0 +1,90 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahgen.h"
+
+static void TypedAHGenerateDestructor PROTO_LIST ((B_TypeCheck *));
+
+void AHGenerateConstructor (handler)
+AHGenerate *handler;
+{
+  /* Construct base class, setting type tag. */
+  B_TYPE_CHECK_Constructor
+    (&handler->typeCheck, TypedAHGenerateDestructor);
+
+  /* Don't set vTable since this is a pure virtual base class. */
+}
+
+int B_AlgorithmGenerateInit (algorithm, algorithmChooser, surrenderContext)
+B_Algorithm *algorithm;
+B_ALGORITHM_CHOOSER algorithmChooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckType
+       (algorithm, TypedAHGenerateDestructor)) != 0)
+    return (status);
+
+  if ((status =
+       (*((AHGenerate *)algorithm->z.handler)->vTable->GenerateInit)
+       ((AHGenerate *)algorithm->z.handler, algorithmChooser,
+        surrenderContext)) != 0)
+    return (status);
+
+  algorithm->z.initFlag = 1;
+  return (0);
+}
+
+int B_AlgorithmGenerateKeypair
+  (algorithm, publicKey, privateKey, randomAlgorithm, surrenderContext)
+B_Algorithm *algorithm;
+B_Key *publicKey;
+B_Key *privateKey;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHGenerateDestructor)) != 0)
+    return (status);
+
+  return ((*((AHGenerate *)algorithm->z.handler)->vTable->GenerateKeypair)
+          ((AHGenerate *)algorithm->z.handler, publicKey, privateKey,
+           randomAlgorithm, surrenderContext));
+}
+
+int B_AlgorithmGenerateParameters
+  (algorithm, resultAlgorithm, randomAlgorithm, surrenderContext)
+B_Algorithm *algorithm;
+B_Algorithm *resultAlgorithm;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHGenerateDestructor)) != 0)
+    return (status);
+
+  return ((*((AHGenerate *)algorithm->z.handler)->vTable->GenerateParameters)
+          ((AHGenerate *)algorithm->z.handler, resultAlgorithm,
+           randomAlgorithm, surrenderContext));
+}
+
+static void TypedAHGenerateDestructor (typeCheck)
+B_TypeCheck *typeCheck;
+{
+  (*((AHGenerate *)typeCheck)->vTable->Destructor) ((AHGenerate *)typeCheck);
+}
+
--- a/lib/dns/sec/dnssafe/ahgen.h
+++ b/lib/dns/sec/dnssafe/ahgen.h
@@ -0,0 +1,47 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHGEN_H_
+#define _AHGEN_H_ 1
+
+#include "btypechk.h"
+
+/* Use the THIS_GENERATE macro to define the type of object in the
+     virtual function prototype.  It defaults to the most base class, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+#ifndef THIS_GENERATE
+#define THIS_GENERATE struct AHGenerate
+#endif
+
+struct AHGenerate;
+
+typedef struct {
+  void (*Destructor) PROTO_LIST ((THIS_GENERATE *));
+  int (*GenerateInit) PROTO_LIST
+    ((THIS_GENERATE *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+  int (*GenerateKeypair) PROTO_LIST
+    ((THIS_GENERATE *, B_Key *, B_Key *, B_Algorithm *, A_SURRENDER_CTX *));
+  int (*GenerateParameters) PROTO_LIST
+    ((THIS_GENERATE *, B_Algorithm *, B_Algorithm *, A_SURRENDER_CTX *));
+} AHGenerateVTable;
+
+typedef struct AHGenerate {
+  B_TypeCheck typeCheck;                                        /* inherited */
+  AHGenerateVTable *vTable;                                  /* pure virtual */
+} AHGenerate;
+
+/* The constructor does not set the vTable since this is a pure base class.
+ */
+void AHGenerateConstructor PROTO_LIST ((AHGenerate *));
+/* No destructor because it is pure virtual. Also, do not call destructor
+     for B_TypeCheck, since this will just re-invoke this virtual
+     destructor. */
+
+#endif
--- a/lib/dns/sec/dnssafe/ahrandom.c
+++ b/lib/dns/sec/dnssafe/ahrandom.c
@@ -0,0 +1,97 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahrandom.h"
+
+static void TypedAHRandomDestructor PROTO_LIST ((B_TypeCheck *));
+
+void AHRandomConstructor (handler)
+AHRandom *handler;
+{
+  /* Construct base class, setting type tag. */
+  B_TYPE_CHECK_Constructor
+    (&handler->typeCheck, TypedAHRandomDestructor);
+
+  /* Don't set vTable since this is a pure virtual base class. */
+}
+
+int B_AlgorithmRandomInit (algorithm, algorithmChooser, surrenderContext)
+B_Algorithm *algorithm;
+B_ALGORITHM_CHOOSER algorithmChooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckType (algorithm, TypedAHRandomDestructor))
+      != 0)
+    return (status);
+
+  if ((status =
+       (*((AHRandom *)algorithm->z.handler)->vTable->RandomInit)
+       ((AHRandom *)algorithm->z.handler, algorithmChooser, surrenderContext))
+      != 0)
+    return (status);
+
+  algorithm->z.initFlag = 1;
+  return (0);
+}
+
+int B_AlgorithmRandomUpdate (algorithm, input, inputLen, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHRandomDestructor)) != 0)
+    return (status == BE_ALGORITHM_NOT_INITIALIZED ?
+            BE_RANDOM_NOT_INITIALIZED : status);
+
+  return ((*((AHRandom *)algorithm->z.handler)->vTable->RandomUpdate)
+          ((AHRandom *)algorithm->z.handler, input, inputLen,
+           surrenderContext));
+}
+
+int B_AlgorithmGenerateRandomBytes
+  (algorithm, output, outputLen, surrenderContext)
+B_Algorithm *algorithm;
+unsigned char *output;
+unsigned int outputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  /* As a special case, check here for a null this pointer when the object
+       is actually being used since many routines take a "dummy" null
+       random algorithm.
+   */
+  if (algorithm == (B_Algorithm *)NULL_PTR)
+    return (BE_RANDOM_OBJ);
+
+  if ((status = B_AlgorithmCheckTypeAndInitFlag
+       (algorithm, TypedAHRandomDestructor)) != 0)
+    return (status == BE_ALGORITHM_NOT_INITIALIZED ?
+            BE_RANDOM_NOT_INITIALIZED : status);
+
+  return ((*((AHRandom *)algorithm->z.handler)->vTable->GenerateBytes)
+          ((AHRandom *)algorithm->z.handler, output, outputLen,
+           surrenderContext));
+}
+
+static void TypedAHRandomDestructor (typeCheck)
+B_TypeCheck *typeCheck;
+{
+  (*((AHRandom *)typeCheck)->vTable->Destructor) ((AHRandom *)typeCheck);
+}
+
--- a/lib/dns/sec/dnssafe/ahrandom.h
+++ b/lib/dns/sec/dnssafe/ahrandom.h
@@ -0,0 +1,47 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHRANDOM_H_
+#define _AHRANDOM_H_ 1
+
+#include "btypechk.h"
+
+/* Use the THIS_RANDOM macro to define the type of object in the
+     virtual function prototype.  It defaults to the most base class, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+#ifndef THIS_RANDOM
+#define THIS_RANDOM struct AHRandom
+#endif
+
+struct AHRandom;
+
+typedef struct {
+  void (*Destructor) PROTO_LIST ((THIS_RANDOM *));
+  int (*RandomInit) PROTO_LIST
+    ((THIS_RANDOM *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+  int (*RandomUpdate) PROTO_LIST
+    ((THIS_RANDOM *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+  int (*GenerateBytes) PROTO_LIST
+    ((THIS_RANDOM *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+} AHRandomVTable;
+
+typedef struct AHRandom {
+  B_TypeCheck typeCheck;                                        /* inherited */
+  AHRandomVTable *vTable;                                    /* pure virtual */
+} AHRandom;
+
+/* The constructor does not set the vTable since this is a pure base class.
+ */
+void AHRandomConstructor PROTO_LIST ((AHRandom *));
+/* No destructor because it is pure virtual. Also, do not call destructor
+     for B_TypeCheck, since this will just re-invoke this virtual
+     destructor. */
+
+#endif
--- a/lib/dns/sec/dnssafe/ahrsaenc.c
+++ b/lib/dns/sec/dnssafe/ahrsaenc.c
@@ -0,0 +1,241 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AH_RSAEncryption;
+#define THIS_ENCRYPT_DECRYPT struct AH_RSAEncryption
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahrsaenc.h"
+
+static int AH_RSAEncryptionInitHelper PROTO_LIST ((AH_RSAEncryption *, int));
+
+static AHEncryptDecryptVTable V_TABLE = {
+  AH_RSAEncryptionDestructor, AH_RSAEncryptionGetBlockLen,
+  AH_RSAEncryptionEncryptInit, AH_RSAEncryptionDecryptInit,
+  AH_RSAEncryptionUpdate, AH_RSAEncryptionUpdate,
+  AH_RSAEncryptionEncryptFinal, AH_RSAEncryptionDecryptFinal
+};
+
+void AH_RSAEncryptionConstructor1 (handler, infoType)
+AH_RSAEncryption *handler;
+struct B_AlgorithmInfoType *infoType;
+{
+  /* Construct base class with the infoType.  Assume info is NULL_PTR. */
+  AHChooseEncryptConstructor2
+    (&handler->chooseEncryptDecrypt, infoType, NULL_PTR);
+
+  T_memset ((POINTER)&handler->z, 0, sizeof (handler->z));
+  /* Set the AHEncryptDecrypt vTable, but don't set the RSAEncryption vTable
+      since it is pure virtual. */
+  handler->chooseEncryptDecrypt.encryptDecrypt.vTable = &V_TABLE;
+}
+
+void AH_RSAEncryptionDestructor (handler)
+AH_RSAEncryption *handler;
+{
+  T_memset ((POINTER)handler->z.block, 0, handler->z.blockLen);
+  T_free ((POINTER)handler->z.block);
+
+  /* Call base class destructor */
+  AHChooseEncryptDestructor (handler);
+}
+
+int AH_RSAEncryptionGetBlockLen (handler, blockLen)
+AH_RSAEncryption *handler;
+unsigned int *blockLen;
+{
+UNUSED_ARG (handler)
+UNUSED_ARG (blockLen)
+  return (BE_NOT_SUPPORTED);
+}
+
+int AH_RSAEncryptionEncryptInit (handler, key, chooser, surrenderContext)
+AH_RSAEncryption *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = AHChooseEncryptEncryptInit
+       (handler, key, chooser, surrenderContext)) != 0)
+    return (status);
+
+  return (AH_RSAEncryptionInitHelper (handler, 1));
+}
+
+int AH_RSAEncryptionDecryptInit (handler, key, chooser, surrenderContext)
+AH_RSAEncryption *handler;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+
+  if ((status = AHChooseEncryptDecryptInit
+       (handler, key, chooser, surrenderContext)) != 0)
+    return (status);
+
+  return (AH_RSAEncryptionInitHelper (handler, 0));
+}
+
+/* Accumulate into the z.block.
+ */
+int AH_RSAEncryptionUpdate
+  (handler, partOut, partOutLen, maxPartOutLen, partIn, partInLen,
+   randomAlgorithm, surrenderContext)
+AH_RSAEncryption *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+unsigned char *partIn;
+unsigned int partInLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (partOut)
+UNUSED_ARG (maxPartOutLen)
+UNUSED_ARG (randomAlgorithm)
+UNUSED_ARG (surrenderContext)
+  *partOutLen = 0;
+    
+  if (handler->_inputLen + partInLen > handler->_maxInputLen)
+    return (BE_INPUT_LEN);
+  T_memcpy
+    ((POINTER)(handler->z.block + handler->_inputLen), (POINTER)partIn,
+     partInLen);
+  handler->_inputLen += partInLen;
+  return (0);
+}
+
+int AH_RSAEncryptionEncryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AH_RSAEncryption *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned int dummyPartOutLen;
+  
+  /* Encode methodContext in place. */
+  if ((status = (*handler->vTable->EncodeBlock)
+       (handler, randomAlgorithm, surrenderContext)) != 0)
+    return (status);
+
+  /* This should not return BE_INPUT_DATA since it is well-formatted. */
+  if ((status = AHChooseEncryptEncryptUpdate
+       (handler, partOut, partOutLen, maxPartOutLen, handler->z.block,
+        handler->z.blockLen, (B_Algorithm *)NULL_PTR, surrenderContext)) != 0)
+    return (status);
+
+  /* Expect final to return zero bytes. */
+  if ((status = AHChooseEncryptEncryptFinal
+       (handler, (unsigned char *)NULL_PTR, &dummyPartOutLen, 0,
+        (B_Algorithm *)NULL_PTR, surrenderContext)) != 0)
+    return (status);
+    
+  /* Restart the handle for new input. */
+  handler->_inputLen = 0;
+  return (0);
+}
+
+int AH_RSAEncryptionDecryptFinal
+  (handler, partOut, partOutLen, maxPartOutLen, randomAlgorithm,
+   surrenderContext)
+AH_RSAEncryption *handler;
+unsigned char *partOut;
+unsigned int *partOutLen;
+unsigned int maxPartOutLen;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  ITEM output;
+  int status;
+  unsigned int decryptedLen, dummyPartOutLen;
+  
+UNUSED_ARG (randomAlgorithm)
+  /* Decrypt block in place.  The block lenghts are already within limits.
+   */
+  if ((status = AHChooseEncryptDecryptUpdate
+       (handler, handler->z.block, &decryptedLen, handler->z.blockLen,
+        handler->z.block, handler->_inputLen, (B_Algorithm *)NULL_PTR,
+        surrenderContext)) != 0)
+    return (status);
+  /* Expect final to return zero bytes. */
+  if ((status = AHChooseEncryptDecryptFinal
+       (handler, (unsigned char *)NULL_PTR, &dummyPartOutLen, 0,
+        (B_Algorithm *)NULL_PTR, surrenderContext)) != 0)
+    return (status);
+    
+  /* Restart the handle for new input. */
+  handler->_inputLen = 0;
+      
+  /* Now decode the block and copy the result to the partOut.
+   */
+  if ((status = (*handler->vTable->DecodeBlock)
+       (handler, &output, decryptedLen)) != 0)
+    return (status);
+      
+  if (output.len > handler->z.blockLen - 11)
+    /* This implies that the block was encrypted with less than
+       8 bytes of padding */
+    return (BE_INPUT_DATA);
+      
+  if ((*partOutLen = output.len) > maxPartOutLen)
+    return (BE_OUTPUT_LEN);      
+  T_memcpy ((POINTER)partOut, (POINTER)output.data, output.len);
+
+  return (0);
+}
+
+static int AH_RSAEncryptionInitHelper (handler, encryptFlag)
+AH_RSAEncryption *handler;
+int encryptFlag;
+{
+  int status;
+  unsigned int newBlockLen;
+
+  if ((status = AHChooseEncryptGetBlockLen (handler, &newBlockLen)) != 0)
+    return (status);
+
+  if (newBlockLen < 12)
+    /* PKCS Requires at least 12 bytes of modulus */
+    return (BE_NOT_SUPPORTED);
+
+  /* During encrypt, this will ensure that there are 8 bytes of padding.
+     During decrypt, the DecodeBlock procedure must check that the block
+       was encrypted with 8 bytes of padding.
+   */
+  handler->_maxInputLen = encryptFlag ? (newBlockLen - 11) : newBlockLen;
+
+  handler->_inputLen = 0;
+  
+  /* Zeroize old block and realloc to new size.
+   */
+  T_memset ((POINTER)handler->z.block, 0, handler->z.blockLen);
+  if ((handler->z.block = (unsigned char *)T_realloc
+       ((POINTER)handler->z.block, newBlockLen))
+      == (unsigned char *)NULL_PTR) {
+    handler->z.blockLen = 0;
+    return (BE_ALLOC);
+  }
+  
+  handler->z.blockLen = newBlockLen;
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/ahrsaenc.h
+++ b/lib/dns/sec/dnssafe/ahrsaenc.h
@@ -0,0 +1,68 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHRSAENC_H_
+#define _AHRSAENC_H_
+
+#include "ahchencr.h"
+
+struct AH_RSAEncryption;
+
+/* For EncodeBlock, the block to encode is left justified in the
+     z.block with length given by z._inputLen.  EncodeBlock encodes the block
+     in place to fill it out to z.blockLen.
+   For DecodeBlock, return the contents in the given ITEM by decoding
+     the z.block value which has length given by decryptedLen.  This
+     procedure must also ensure that the block was encrypted with 8 bytes
+     of padding.
+ */
+typedef struct {
+  int (*EncodeBlock) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, B_Algorithm * /* randomAlgorithm */,
+      A_SURRENDER_CTX *));
+  int (*DecodeBlock) PROTO_LIST
+    ((THIS_ENCRYPT_DECRYPT *, ITEM *, unsigned int /* decryptedLen */));
+} AH_RSAEncryptionVTable;
+
+typedef struct AH_RSAEncryption {
+  AHChooseEncryptDecrypt chooseEncryptDecrypt;                 /* base class */
+
+  struct {
+    unsigned char *block;
+    unsigned int blockLen;
+  } z;                                            /* Zeroized by constructor */
+
+  unsigned int _inputLen;            /* Length of data accumulated by Update */
+  unsigned int _maxInputLen;     /* used during update to check for overflow */
+  AH_RSAEncryptionVTable *vTable;                            /* pure virtual */
+} AH_RSAEncryption;
+
+void AH_RSAEncryptionConstructor1 PROTO_LIST
+  ((AH_RSAEncryption *, struct B_AlgorithmInfoType *));
+void AH_RSAEncryptionDestructor PROTO_LIST ((AH_RSAEncryption *));
+
+int AH_RSAEncryptionGetBlockLen PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned int *));
+int AH_RSAEncryptionEncryptInit PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+    A_SURRENDER_CTX *));
+int AH_RSAEncryptionDecryptInit PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, B_Key *, B_ALGORITHM_CHOOSER,
+    A_SURRENDER_CTX *));
+int AH_RSAEncryptionUpdate PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, unsigned char *, unsigned int, B_Algorithm *,
+    A_SURRENDER_CTX *));
+int AH_RSAEncryptionEncryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+int AH_RSAEncryptionDecryptFinal PROTO_LIST
+  ((THIS_ENCRYPT_DECRYPT *, unsigned char *, unsigned int *,
+    unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahrsaepr.c
+++ b/lib/dns/sec/dnssafe/ahrsaepr.c
@@ -0,0 +1,99 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AH_RSAEncryption;
+#define THIS_ENCRYPT_DECRYPT struct AH_RSAEncryption
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahrsaepr.h"
+
+static int EncodeBlock1 PROTO_LIST
+  ((AH_RSAEncryptionPrivate *, B_Algorithm *, A_SURRENDER_CTX *));
+static int DecodeBlock2 PROTO_LIST
+  ((AH_RSAEncryptionPrivate *, ITEM *, unsigned int));
+
+static AH_RSAEncryptionVTable ENCRYPTION_V_TABLE =
+  {EncodeBlock1, DecodeBlock2};
+
+extern struct B_AlgorithmInfoType AIT_RSAPrivate;
+
+AH_RSAEncryptionPrivate *AH_RSAEncrypPrivateConstructor (handler)
+AH_RSAEncryptionPrivate *handler;
+{
+  if (handler == (AH_RSAEncryptionPrivate *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AH_RSAEncryptionPrivate *)T_malloc (sizeof (*handler)))
+        == (AH_RSAEncryptionPrivate *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AH_RSAEncryptionConstructor1 (handler, &AIT_RSAPrivate);
+  
+  handler->vTable = &ENCRYPTION_V_TABLE;
+  return (handler);
+}
+
+/* block1 starts out with the input bytes of length inputLen left-justified.
+   Returns 0, BE_INPUT_LEN.
+ */
+static int EncodeBlock1 (handler, randomAlgorithm, surrenderContext)
+AH_RSAEncryptionPrivate *handler;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  unsigned int padLen;
+
+UNUSED_ARG (randomAlgorithm)
+UNUSED_ARG (surrenderContext)
+  if ((handler->_inputLen + 3) > handler->z.blockLen)
+    /* input is too large to make a block 1 */
+    return (BE_INPUT_LEN);
+
+  padLen = handler->z.blockLen - (handler->_inputLen + 3);
+  T_memmove
+    ((POINTER)(handler->z.block + padLen + 3), (POINTER)handler->z.block,
+     handler->_inputLen);
+
+  handler->z.block[0] = 0;
+  handler->z.block[1] = 1;
+  T_memset ((POINTER)(handler->z.block + 2), 0xff, padLen);
+  handler->z.block[2 + padLen] = 0;
+  return (0);
+}
+
+static int DecodeBlock2 (handler, output, block2Len)
+AH_RSAEncryptionPrivate *handler;
+ITEM *output;
+unsigned int block2Len;
+{
+  unsigned int i;
+  
+  if ((handler->z.block[0] != 0) || (handler->z.block[1] != 2))
+    return (BE_INPUT_DATA);
+    
+  /* Should be able to find the data after the first zero byte following
+       the random bytes. */
+  for (i = 2; i < block2Len && handler->z.block[i] != 0; i++);
+  i++;
+    
+  if (i > block2Len)
+    /* The data is not zero terminated. */
+    return (BE_INPUT_DATA);
+    
+  output->len = block2Len - i;
+  output->data = handler->z.block + i;
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/ahrsaepr.h
+++ b/lib/dns/sec/dnssafe/ahrsaepr.h
@@ -0,0 +1,20 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHRSAEPR_H_
+#define _AHRSAEPR_H_
+
+#include "ahrsaenc.h"
+
+/* structure is identical to base class, so just re-typedef. */
+typedef AH_RSAEncryption AH_RSAEncryptionPrivate;
+
+AH_RSAEncryptionPrivate *AH_RSAEncrypPrivateConstructor PROTO_LIST
+  ((AH_RSAEncryptionPrivate *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ahrsaepu.c
+++ b/lib/dns/sec/dnssafe/ahrsaepu.c
@@ -0,0 +1,112 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+/* Define this so that the type of the 'this' pointer in the
+     virtual functions will be correct for this derived class.
+ */
+struct AH_RSAEncryption;
+#define THIS_ENCRYPT_DECRYPT struct AH_RSAEncryption
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahrsaepu.h"
+
+static int EncodeBlock2 PROTO_LIST
+  ((AH_RSAEncryptionPublic *, B_Algorithm *, A_SURRENDER_CTX *));
+static int DecodeBlock1 PROTO_LIST
+  ((AH_RSAEncryptionPublic *, ITEM *, unsigned int));
+
+static AH_RSAEncryptionVTable ENCRYPTION_V_TABLE =
+  {EncodeBlock2, DecodeBlock1};
+
+extern struct B_AlgorithmInfoType AIT_RSAPublic;
+
+AH_RSAEncryptionPublic *AH_RSAEncrypPublicConstructor (handler)
+AH_RSAEncryptionPublic *handler;
+{
+  if (handler == (AH_RSAEncryptionPublic *)NULL_PTR) {
+    /* This constructor is being used to do a new */
+    if ((handler = (AH_RSAEncryptionPublic *)T_malloc (sizeof (*handler)))
+        == (AH_RSAEncryptionPublic *)NULL_PTR)
+      return (handler);
+  }
+
+  /* Construct base class */
+  AH_RSAEncryptionConstructor1 (handler, &AIT_RSAPublic);
+  
+  handler->vTable = &ENCRYPTION_V_TABLE;
+  return (handler);
+}
+
+/* block starts out with the input bytes of length inputLen left-justified.
+ */
+static int EncodeBlock2 (handler, randomAlgorithm, surrenderContext)
+AH_RSAEncryptionPublic *handler;
+B_Algorithm *randomAlgorithm;
+A_SURRENDER_CTX *surrenderContext;
+{
+  int status;
+  unsigned char randomByte;
+  unsigned int padLen, i;
+
+  if ((handler->_inputLen + 3) > handler->z.blockLen)
+    /* input is too large to make a block 2 */
+    return (BE_INPUT_LEN);
+
+  padLen = handler->z.blockLen - (handler->_inputLen + 3);
+  T_memmove
+    ((POINTER)(handler->z.block + padLen + 3), (POINTER)handler->z.block,
+     handler->_inputLen);
+
+  handler->z.block[0] = 0;
+  handler->z.block[1] = 2;
+
+  /* Pad out with random bytes, making sure that none of the bytes is zero.
+   */
+  for (i = 2; i < (padLen + 2); i++) {
+    do {
+      if ((status = B_AlgorithmGenerateRandomBytes
+           (randomAlgorithm, &randomByte, 1, surrenderContext)) != 0)
+        return (status);
+    } while (randomByte == 0);
+    
+    handler->z.block[i] = randomByte;
+  }
+  
+  handler->z.block[2 + padLen] = 0;
+  return (0);
+}
+
+static int DecodeBlock1 (handler, output, block1Len)
+AH_RSAEncryptionPublic *handler;
+ITEM *output;
+unsigned int block1Len;
+{
+  unsigned int i;
+  
+  /* Locate the digestInfo within the PKCS block 1.
+   */
+  if (handler->z.block[0] != 0 || handler->z.block[1] != 1)
+    return (BE_INPUT_DATA);
+    
+  /* Should be able to find the data after the first zero byte following
+       the 0xff. */
+  for (i = 2; i < block1Len && handler->z.block[i] == 0xff; i++);
+  i++;
+    
+  if (i > block1Len || handler->z.block[i - 1] != 0)
+    /* The data is not zero terminated, or a byte other than 0xff. */
+    return (BE_INPUT_DATA);
+
+  output->len = block1Len - i;
+  output->data = handler->z.block + i;
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/ahrsaepu.h
+++ b/lib/dns/sec/dnssafe/ahrsaepu.h
@@ -0,0 +1,20 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AHRSAEPU_H_
+#define _AHRSAEPU_H_
+
+#include "ahrsaenc.h"
+
+/* structure is identical to base class, so just re-typedef. */
+typedef AH_RSAEncryption AH_RSAEncryptionPublic;
+
+AH_RSAEncryptionPublic *AH_RSAEncrypPublicConstructor PROTO_LIST
+  ((AH_RSAEncryptionPublic *));
+
+#endif
--- a/lib/dns/sec/dnssafe/aichdig.c
+++ b/lib/dns/sec/dnssafe/aichdig.c
@@ -0,0 +1,36 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahchdig.h"
+#include "aichdig.h"
+
+B_TypeCheck *AITChooseDigestNullNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+B_AlgorithmInfoTypeVTable AITChooseDigestNull_V_TABLE =
+  {AITNullAddInfo, AITChooseDigestNullNewHandler,
+   B_AlgorithmInfoTypeMakeError};
+
+/* This always uses NULL_PTR for the info.
+ */
+B_TypeCheck *AITChooseDigestNullNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+UNUSED_ARG (algorithm)
+
+  /* Pass in NULL_PTR so that constructor will allocate.
+   */
+  return ((B_TypeCheck *)AHChooseDigestConstructor2
+          ((AHChooseDigest *)NULL_PTR, infoType, NULL_PTR));
+}
+
--- a/lib/dns/sec/dnssafe/aichdig.h
+++ b/lib/dns/sec/dnssafe/aichdig.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHDIG_H_
+#define _AICHDIG_H_ 1
+
+#include "ainfotyp.h"
+#include "ainull.h"
+
+extern B_AlgorithmInfoTypeVTable AITChooseDigestNull_V_TABLE;
+
+#endif
--- a/lib/dns/sec/dnssafe/aichenc8.c
+++ b/lib/dns/sec/dnssafe/aichenc8.c
@@ -0,0 +1,33 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichenc8.h"
+
+B_AlgorithmInfoTypeVTable AITChooseEncrypt8_V_TABLE =
+  {AIT_8AddInfo, AITChooseEncryptNewHandler, B_AlgorithmInfoTypeMakeError};
+
+int AIT_8AddInfo (infoType, algorithm, info)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+POINTER info;
+{
+  POINTER newInfo;
+  int status;
+  
+  if ((status = B_MemoryPoolAllocAndCopy
+       (&algorithm->infoCache.memoryPool, &newInfo, info, 8)) != 0)
+    return (status);
+  
+  return (B_InfoCacheAddInfo
+          (&algorithm->infoCache, (POINTER)infoType, newInfo));
+}
+
--- a/lib/dns/sec/dnssafe/aichenc8.h
+++ b/lib/dns/sec/dnssafe/aichenc8.h
@@ -0,0 +1,19 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHENC8_H_
+#define _AICHENC8_H_ 1
+
+#include "aichencr.h"
+
+extern B_AlgorithmInfoTypeVTable AITChooseEncrypt8_V_TABLE;
+
+int AIT_8AddInfo PROTO_LIST
+  ((THIS_ALGORITHM_INFO_TYPE *, B_Algorithm *, POINTER));
+
+#endif
--- a/lib/dns/sec/dnssafe/aichencn.c
+++ b/lib/dns/sec/dnssafe/aichencn.c
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichencn.h"
+
+B_AlgorithmInfoTypeVTable AITChooseEncryptNull_V_TABLE =
+  {AITNullAddInfo, AITChooseEncryptNewHandler, B_AlgorithmInfoTypeMakeError};
+
--- a/lib/dns/sec/dnssafe/aichencn.h
+++ b/lib/dns/sec/dnssafe/aichencn.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHENCN_H_
+#define _AICHENCN_H_ 1
+
+#include "aichencr.h"
+#include "ainull.h"
+
+extern B_AlgorithmInfoTypeVTable AITChooseEncryptNull_V_TABLE;
+
+#endif
--- a/lib/dns/sec/dnssafe/aichencr.c
+++ b/lib/dns/sec/dnssafe/aichencr.c
@@ -0,0 +1,31 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahchencr.h"
+#include "aichencr.h"
+
+B_TypeCheck *AITChooseEncryptNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+  POINTER info;
+
+  if (B_InfoCacheFindInfo (&algorithm->infoCache, &info, (POINTER)infoType)
+      != 0)
+    /* This really shouldn't happen since the info was just added. */
+    return ((B_TypeCheck *)NULL_PTR);
+
+  /* Pass in NULL_PTR so that constructor will allocate. */
+  return ((B_TypeCheck *)AHChooseEncryptConstructor2
+          ((AHChooseEncryptDecrypt *)NULL_PTR, infoType, info));
+}
+
--- a/lib/dns/sec/dnssafe/aichencr.h
+++ b/lib/dns/sec/dnssafe/aichencr.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHENCR_H_
+#define _AICHENCR_H_ 1
+
+#include "ainfotyp.h"
+
+struct B_TypeCheck *AITChooseEncryptNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+#endif
--- a/lib/dns/sec/dnssafe/aichgen.c
+++ b/lib/dns/sec/dnssafe/aichgen.c
@@ -0,0 +1,31 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahchgen.h"
+#include "aichgen.h"
+
+B_TypeCheck *AITChooseGenerateNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+  POINTER info;
+
+  if (B_InfoCacheFindInfo (&algorithm->infoCache, &info, (POINTER)infoType)
+      != 0)
+    /* This really shouldn't happen since the info was just added. */
+    return ((B_TypeCheck *)NULL_PTR);
+
+  /* Pass in NULL_PTR so that constructor will allocate. */
+  return ((B_TypeCheck *)AHChooseGenerateConstructor2
+          ((AHChooseGenerate *)NULL_PTR, infoType, info));
+}
+
--- a/lib/dns/sec/dnssafe/aichgen.h
+++ b/lib/dns/sec/dnssafe/aichgen.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHGEN_H_
+#define _AICHGEN_H_ 1
+
+#include "ainfotyp.h"
+
+struct B_TypeCheck *AITChooseGenerateNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+#endif
--- a/lib/dns/sec/dnssafe/aichrand.c
+++ b/lib/dns/sec/dnssafe/aichrand.c
@@ -0,0 +1,36 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ahchrand.h"
+#include "aichrand.h"
+
+B_TypeCheck *AITChooseRandomNullNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+B_AlgorithmInfoTypeVTable AITChooseRandomNull_V_TABLE =
+  {AITNullAddInfo, AITChooseRandomNullNewHandler,
+   B_AlgorithmInfoTypeMakeError};
+
+/* This always uses NULL_PTR for the info.
+ */
+B_TypeCheck *AITChooseRandomNullNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+UNUSED_ARG (algorithm)
+
+  /* Pass in NULL_PTR so that constructor will allocate.
+   */
+  return ((B_TypeCheck *)AHChooseRandomConstructor2
+          ((AHChooseRandom *)NULL_PTR, infoType, NULL_PTR));
+}
+
--- a/lib/dns/sec/dnssafe/aichrand.h
+++ b/lib/dns/sec/dnssafe/aichrand.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AICHRAND_H_
+#define _AICHRAND_H_ 1
+
+#include "ainfotyp.h"
+#include "ainull.h"
+
+extern B_AlgorithmInfoTypeVTable AITChooseRandomNull_V_TABLE;
+
+#endif
--- a/lib/dns/sec/dnssafe/aimd5.c
+++ b/lib/dns/sec/dnssafe/aimd5.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichdig.h"
+
+B_AlgorithmInfoType AIT_MD5 = {&AITChooseDigestNull_V_TABLE};
+
+int AI_MD5 (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_MD5;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/aimd5ran.c
+++ b/lib/dns/sec/dnssafe/aimd5ran.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichrand.h"
+
+B_AlgorithmInfoType AIT_MD5Random = {&AITChooseRandomNull_V_TABLE};
+
+int AI_MD5Random (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_MD5Random;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/ainfotyp.c
+++ b/lib/dns/sec/dnssafe/ainfotyp.c
@@ -0,0 +1,30 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ainfotyp.h"
+
+/* This is the default routine which algorithm info types point MakeInfo to
+     if not redefined by a derived class.
+ */
+int B_AlgorithmInfoTypeMakeError (infoType, info, algorithm)
+B_AlgorithmInfoType *infoType;
+POINTER *info;
+B_Algorithm *algorithm;
+{
+UNUSED_ARG (infoType)
+UNUSED_ARG (info)
+UNUSED_ARG (algorithm)
+
+  /* Should already have been found in the cache. */
+  return (BE_WRONG_ALGORITHM_INFO);
+}
+
--- a/lib/dns/sec/dnssafe/ainfotyp.h
+++ b/lib/dns/sec/dnssafe/ainfotyp.h
@@ -0,0 +1,39 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _AINFOTYP_H_
+#define _AINFOTYP_H_ 1
+
+/* Use the THIS_ALGORITHM_INFO_TYPE macro to define the type of object in the
+     virtual function prototype.  It defaults to the most base class, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+#ifndef THIS_ALGORITHM_INFO_TYPE
+#define THIS_ALGORITHM_INFO_TYPE struct B_AlgorithmInfoType
+#endif
+
+struct B_AlgorithmInfoType;
+
+typedef struct {
+  int (*AddInfo) PROTO_LIST
+    ((THIS_ALGORITHM_INFO_TYPE *, B_Algorithm *, POINTER));
+  struct B_TypeCheck * (*NewHandler) PROTO_LIST
+    ((THIS_ALGORITHM_INFO_TYPE *, B_Algorithm *));
+  int (*MakeInfo) PROTO_LIST
+    ((THIS_ALGORITHM_INFO_TYPE *, POINTER *, B_Algorithm *));
+} B_AlgorithmInfoTypeVTable;
+
+typedef struct B_AlgorithmInfoType {
+  B_AlgorithmInfoTypeVTable *vTable;
+} B_AlgorithmInfoType;
+
+int B_AlgorithmInfoTypeMakeError PROTO_LIST
+  ((THIS_ALGORITHM_INFO_TYPE *, POINTER *, B_Algorithm *));
+
+#endif
--- a/lib/dns/sec/dnssafe/ainull.c
+++ b/lib/dns/sec/dnssafe/ainull.c
@@ -0,0 +1,26 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ainfotyp.h"
+#include "ainull.h"
+
+int AITNullAddInfo (infoType, algorithm, info)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+POINTER info;
+{
+UNUSED_ARG (info)
+  /* Cache null parameters. */
+  return (B_InfoCacheAddInfo
+          (&algorithm->infoCache, (POINTER)infoType, NULL_PTR));
+}
+
--- a/lib/dns/sec/dnssafe/ainull.h
+++ b/lib/dns/sec/dnssafe/ainull.h
@@ -0,0 +1,10 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+int AITNullAddInfo PROTO_LIST
+  ((THIS_ALGORITHM_INFO_TYPE *, B_Algorithm *, POINTER));
--- a/lib/dns/sec/dnssafe/airsaepr.c
+++ b/lib/dns/sec/dnssafe/airsaepr.c
@@ -0,0 +1,45 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ainfotyp.h"
+#include "ainull.h"
+#include "ahrsaepr.h"
+
+B_TypeCheck *AIT_PKCS_RSAPrivateNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+static B_AlgorithmInfoTypeVTable V_TABLE =
+  {AITNullAddInfo, AIT_PKCS_RSAPrivateNewHandler,
+   B_AlgorithmInfoTypeMakeError};
+
+B_AlgorithmInfoType AIT_PKCS_RSAPrivate = {&V_TABLE};
+
+int AI_PKCS_RSAPrivate (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_PKCS_RSAPrivate;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
+B_TypeCheck *AIT_PKCS_RSAPrivateNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+UNUSED_ARG (infoType)
+UNUSED_ARG (algorithm)
+  /* Pass in NULL_PTR so that constructor will allocate. */
+  return ((B_TypeCheck *)AH_RSAEncrypPrivateConstructor
+          ((AH_RSAEncryptionPrivate *)NULL_PTR));
+}
+
--- a/lib/dns/sec/dnssafe/airsaepu.c
+++ b/lib/dns/sec/dnssafe/airsaepu.c
@@ -0,0 +1,45 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ainfotyp.h"
+#include "ainull.h"
+#include "ahrsaepu.h"
+
+B_TypeCheck *AIT_PKCS_RSAPublicNewHandler PROTO_LIST
+  ((B_AlgorithmInfoType *, B_Algorithm *));
+
+static B_AlgorithmInfoTypeVTable V_TABLE =
+  {AITNullAddInfo, AIT_PKCS_RSAPublicNewHandler,
+   B_AlgorithmInfoTypeMakeError};
+
+B_AlgorithmInfoType AIT_PKCS_RSAPublic = {&V_TABLE};
+
+int AI_PKCS_RSAPublic (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_PKCS_RSAPublic;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
+B_TypeCheck *AIT_PKCS_RSAPublicNewHandler (infoType, algorithm)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+{
+UNUSED_ARG (infoType)
+UNUSED_ARG (algorithm)
+  /* Pass in NULL_PTR so that constructor will allocate. */
+  return ((B_TypeCheck *)AH_RSAEncrypPublicConstructor
+          ((AH_RSAEncryptionPublic *)NULL_PTR));
+}
+
--- a/lib/dns/sec/dnssafe/airsakgn.c
+++ b/lib/dns/sec/dnssafe/airsakgn.c
@@ -0,0 +1,60 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "intitem.h"
+#include "aichgen.h"
+
+int AIT_RSAKeyGenAddInfo PROTO_LIST
+  ((THIS_ALGORITHM_INFO_TYPE *, B_Algorithm *, POINTER));
+
+static A_RSA_KEY_GEN_PARAMS STATIC_KEY_GEN_PARAMS;
+static ITEM *KEY_GEN_PARAMS_ITEMS[] = {&STATIC_KEY_GEN_PARAMS.publicExponent};
+
+static B_AlgorithmInfoTypeVTable V_TABLE =
+  {AIT_RSAKeyGenAddInfo, AITChooseGenerateNewHandler,
+   B_AlgorithmInfoTypeMakeError};
+
+B_AlgorithmInfoType AIT_RSAKeyGen = {&V_TABLE};
+
+int AI_RSAKeyGen (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_RSAKeyGen;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
+int AIT_RSAKeyGenAddInfo (infoType, algorithm, info)
+B_AlgorithmInfoType *infoType;
+B_Algorithm *algorithm;
+POINTER info;
+{
+  A_RSA_KEY_GEN_PARAMS *newInfo;
+  int status;
+  
+  if ((status = B_MemoryPoolAlloc
+       (&algorithm->infoCache.memoryPool, (POINTER *)&newInfo,
+        sizeof (A_RSA_KEY_GEN_PARAMS))) != 0)
+      return (status);
+  if ((status = AllocAndCopyIntegerItems
+       ((POINTER)newInfo, info, (POINTER)&STATIC_KEY_GEN_PARAMS,
+        KEY_GEN_PARAMS_ITEMS,
+        sizeof (KEY_GEN_PARAMS_ITEMS) / sizeof (KEY_GEN_PARAMS_ITEMS[0]),
+        &algorithm->infoCache.memoryPool)) != 0)
+    return (status);
+
+  newInfo->modulusBits = ((A_RSA_KEY_GEN_PARAMS *)info)->modulusBits;
+  return (B_InfoCacheAddInfo
+          (&algorithm->infoCache, (POINTER)infoType, (POINTER)newInfo));
+}
+
--- a/lib/dns/sec/dnssafe/airsaprv.c
+++ b/lib/dns/sec/dnssafe/airsaprv.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichencn.h"
+
+B_AlgorithmInfoType AIT_RSAPrivate = {&AITChooseEncryptNull_V_TABLE};
+
+int AI_RSAPrivate (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_RSAPrivate;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/airsapub.c
+++ b/lib/dns/sec/dnssafe/airsapub.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "aichencn.h"
+
+B_AlgorithmInfoType AIT_RSAPublic = {&AITChooseEncryptNull_V_TABLE};
+
+int AI_RSAPublic (infoType)
+POINTER *infoType;
+{
+  *infoType = (POINTER)&AIT_RSAPublic;
+
+  /* Return 0 to indicate a B_AlgorithmInfoType, not a B_KeyInfoType */
+  return (0);
+}
+
--- a/lib/dns/sec/dnssafe/algae.h
+++ b/lib/dns/sec/dnssafe/algae.h
@@ -0,0 +1,66 @@
+/* Copyright (C) RSA Data Security, Inc. created 1992, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _ALGAE_H_
+#define _ALGAE_H_ 1
+
+#ifndef T_CALL
+#define T_CALL
+#endif
+
+/* Used to reduce the stack size in routines with big scratch buffers.
+   If set to 1, this will make ALGAE allocate these buffers on the heap.
+ */
+#ifndef USE_ALLOCED_FRAME
+#define USE_ALLOCED_FRAME 1
+#endif
+
+#include "atypes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define AE_CANCEL 0x0001
+#define AE_DATA 0x0002
+#define AE_EXPONENT_EVEN 0x0003
+#define AE_EXPONENT_LEN 0x0004
+#define AE_INPUT_DATA 0x0005
+#define AE_INPUT_LEN 0x0006
+#define AE_MODULUS_LEN 0x0007
+#define AE_NEED_RANDOM 0x0008
+#define AE_NOT_SUPPORTED 0x0009
+#define AE_OUTPUT_LEN 0x000a
+#define AE_NOT_INITIALIZED 0x000b
+#define AE_KEY_LEN 0x000c
+#define AE_KEY_INFO 0x000d
+#define AE_SEQUENCE 0x000e
+#define AE_PARAMS 0x000f
+
+#if USE_ALLOCED_FRAME
+/* Needed only for big number code heap allocation of scratch arrays.
+ */
+#define AE_ALLOC 0x0080
+POINTER T_malloc PROTO_LIST ((unsigned int));
+void T_free PROTO_LIST ((POINTER));
+#endif
+
+/* Routines supplied by the implementor.
+ */
+void T_memset PROTO_LIST ((POINTER, int, unsigned int));
+void T_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
+void T_memmove PROTO_LIST ((POINTER, POINTER, unsigned int));
+int T_memcmp PROTO_LIST ((POINTER, POINTER, unsigned int));
+
+unsigned int A_IntegerBits PROTO_LIST ((unsigned char *, unsigned int));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/lib/dns/sec/dnssafe/algchoic.c
+++ b/lib/dns/sec/dnssafe/algchoic.c
@@ -0,0 +1,167 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "algae.h"
+#include "balgmeth.h"
+#include "bkey.h"
+#include "algchoic.h"
+
+/* In C++:
+ResizeContext::ResizeContext ()
+{
+  T_memset ((POINTER)&z, 0, sizeof (z));
+}
+ */
+void ResizeContextConstructor (resizeContext)
+ResizeContext *resizeContext;
+{
+  T_memset ((POINTER)&resizeContext->z, 0, sizeof (resizeContext->z));
+}
+
+/* In C++:
+ResizeContext::~ResizeContext ()
+{
+  T_memset (z.context, 0, z.contextSize);
+  T_free (z.context);
+}
+ */
+void ResizeContextDestructor (resizeContext)
+ResizeContext *resizeContext;
+{
+  T_memset (resizeContext->z.context, 0, resizeContext->z.contextSize);
+  T_free (resizeContext->z.context);
+}
+
+/* If the resizeContext's context is already the requested size, do nothing.
+   Otherwise, this memsets the existing context to zero, then allocates
+     the context as a buffer of the requested size.
+   If the allocate fails, the context size is set to
+     zero so that later calls will not zeroize non-existing buffers.
+ */
+int ResizeContextMakeNewContext (resizeContext, contextSize)
+ResizeContext *resizeContext;
+unsigned int contextSize;
+{
+  if (resizeContext->z.contextSize == contextSize)
+    return (0);
+
+  /* Take care of zeroizing the previous context.
+   */
+  T_memset (resizeContext->z.context, 0, resizeContext->z.contextSize);
+
+  if ((resizeContext->z.context = T_realloc
+       (resizeContext->z.context, contextSize)) == NULL_PTR) {
+    resizeContext->z.contextSize = 0;
+    return (BE_ALLOC);
+  }
+    
+  resizeContext->z.contextSize = contextSize;
+  return (0);
+}
+
+int AlgaChoiceChoose (algaChoice, encryptFlag, key, chooser, surrenderContext)
+AlgaChoice *algaChoice;
+int encryptFlag;
+B_Key *key;
+B_ALGORITHM_CHOOSER chooser;
+A_SURRENDER_CTX *surrenderContext;
+{
+  POINTER keyInfo;
+  int status, overallStatus;
+
+  /* Each alga init callback returns BE_NOT_SUPPORTED if the Query fails.
+     Each also may return a more specific error like BE_MODULUS_LEN if the
+       method is not supported, so return the more specific error if possible.
+   */
+  overallStatus = BE_METHOD_NOT_IN_CHOOSER;
+
+  for (; *chooser != (B_ALGORITHM_METHOD *)NULL_PTR; chooser++) {
+    if ((*chooser)->algorithmInfoType != algaChoice->_algorithmInfoType ||
+        (*chooser)->encryptFlag != encryptFlag)
+      /* Wrong type of algorithm, or the encryptFlag is wrong */
+      continue;
+
+    if ((*chooser)->keyInfoType != (struct B_KeyInfoType *)NULL_PTR) {
+      if ((status = B_KeyGetInfo
+           (key, &keyInfo, (*chooser)->keyInfoType)) != 0) {
+        if (IS_FATAL_BSAFE_ERROR (status))
+          return (status);
+      
+        /* Update the overall status with this more specific error. */
+        overallStatus = status;
+        continue;
+      }
+    }
+    else
+      keyInfo = NULL_PTR;
+
+    if ((status = (*algaChoice->_InitAlga)
+         (algaChoice, keyInfo, *chooser, surrenderContext)) != 0) {
+      if (IS_FATAL_BSAFE_ERROR (status))
+        return (status);
+
+      /* Update the overall status with this more specific error. */
+      overallStatus = status;
+      continue;
+    }
+
+    /* Succeeded */
+    algaChoice->_alga = (*chooser)->alga;
+    return (0);
+  }
+
+  return (overallStatus);
+}
+
+/* Convert the ALGAE error to a BSAFE2 error.
+   This does not check for zero since BSAFE should not bother to call
+     this function if there is no error.
+ */
+int ConvertAlgaeError (type)
+int type;
+{
+  switch (type) {
+  case AE_CANCEL:
+    return (BE_CANCEL);
+  case AE_DATA:
+    return (BE_DATA);
+  case AE_EXPONENT_EVEN:
+    return (BE_EXPONENT_EVEN);
+  case AE_EXPONENT_LEN:
+    return (BE_EXPONENT_LEN);
+  case AE_INPUT_DATA:
+    return (BE_INPUT_DATA);
+  case AE_INPUT_LEN:
+    return (BE_INPUT_LEN);
+  case AE_KEY_INFO:
+    return (BE_KEY_INFO);
+  case AE_KEY_LEN:
+    return (BE_KEY_LEN);
+  case AE_MODULUS_LEN:
+    return (BE_MODULUS_LEN);
+  case AE_NOT_INITIALIZED:
+    return (BE_NOT_INITIALIZED);
+  case AE_NOT_SUPPORTED:
+    return (BE_NOT_SUPPORTED);
+  case AE_OUTPUT_LEN:
+    return (BE_OUTPUT_LEN);
+  case AE_PARAMS:
+    return (BE_ALGORITHM_INFO);
+    
+#if USE_ALLOCED_FRAME
+  case AE_ALLOC:
+    return (BE_ALLOC);
+#endif
+
+  default:
+    return (BE_DATA);
+  }
+}
+
--- a/lib/dns/sec/dnssafe/algchoic.h
+++ b/lib/dns/sec/dnssafe/algchoic.h
@@ -0,0 +1,111 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _ALGCHOICE_H_
+#define _ALGCHOICE_H_ 1
+
+#define IS_FATAL_BSAFE_ERROR(status) \
+  (status == BE_ALLOC || status == BE_HARDWARE || status == BE_CANCEL)
+
+/* Use the THIS_ALGA_CHOICE macro to define the type of object in the
+     INIT_ALGA prototype.  It defaults to the AlgaChoice, but
+     derived modules may define the macro to a more derived class before
+     including this header file.
+ */
+struct AlgaChoice;
+#ifndef THIS_ALGA_CHOICE
+#define THIS_ALGA_CHOICE struct AlgaChoice
+#endif
+
+/* In C++:
+class ResizeContext {
+public:
+  ResizeContext ();
+  ~ResizeContext ();
+  int makeNewContext (unsigned int contextSize);
+  POINTER context () {return z.context;}
+
+private:
+  struct {
+    POINTER context;
+    unsigned int contextSize;
+  } z;
+};
+
+class AlgaChoice;
+typedef int (*INIT_ALGA)
+  (THIS_ALGA_CHOICE *algaChoice, POINTER keyInfo,
+   struct B_ALGORITHM_METHOD *algorithmMethod,
+   A_SURRENDER_CTX *surrenderContext);
+
+class AlgaChoice {
+public:
+  AlgaChoice (INIT_ALGA InitAlga) : _InitAlga (InitAlga) {}
+  ~AlgaChoice () {}
+  int choose
+    (int encryptFlag, B_Key *key, B_ALGORITHM_CHOOSER chooser,
+     A_SURRENDER_CTX *surrenderContext);
+  int makeNewContext (unsigned int contextSize) {
+    context.makeNewContext (contextSize); }
+  POINTER alga () {return _alga;}
+  POINTER algorithmInfo () {return _algorithmInfo;}
+  POINTER context () {return context.context ();}
+  void setAlgorithmInfoType (B_AlgorithmInfoType *algorithmInfoType) {
+    _algorithmInfoType = algorithmInfoType;
+  }
+  void setAlgorithmInfo (POINTER algorithmInfo) {
+    _algorithmInfo = algorithmInfo;
+  }
+
+private:
+  POINTER _alga;
+  B_AlgorithmInfoType *_algorithmInfoType;
+  POINTER _algorithmInfo;
+  INIT_ALGA _InitAlga;
+
+  ResizeContext context;
+};
+ */
+struct B_AlgorithmInfoType;
+
+typedef struct ResizeContext {
+  struct {
+    POINTER context;
+    unsigned int contextSize;
+  } z;                                            /* zeriozed by constructor */
+} ResizeContext;
+
+typedef int (*INIT_ALGA) PROTO_LIST
+  ((THIS_ALGA_CHOICE *, POINTER, struct B_ALGORITHM_METHOD *,
+    A_SURRENDER_CTX *));
+
+typedef struct AlgaChoice {
+  POINTER _alga;
+  struct B_AlgorithmInfoType *_algorithmInfoType;
+  POINTER _algorithmInfo;
+  INIT_ALGA _InitAlga;
+
+  ResizeContext context;
+} AlgaChoice;
+
+void ResizeContextConstructor PROTO_LIST ((ResizeContext *));
+void ResizeContextDestructor PROTO_LIST ((ResizeContext *));
+int ResizeContextMakeNewContext PROTO_LIST ((ResizeContext *, unsigned int));
+
+#define ALGA_CHOICE_Constructor(algaChoice, InitAlga)\
+  (ResizeContextConstructor (&(algaChoice)->context), \
+   (algaChoice)->_InitAlga = (InitAlga))
+#define ALGA_CHOICE_Destructor(algaChoice)\
+  (ResizeContextDestructor (&(algaChoice)->context))
+
+int AlgaChoiceChoose PROTO_LIST
+  ((AlgaChoice *, int, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+
+int ConvertAlgaeError PROTO_LIST ((int));
+
+#endif
--- a/lib/dns/sec/dnssafe/algobj.c
+++ b/lib/dns/sec/dnssafe/algobj.c
@@ -0,0 +1,121 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "ainfotyp.h"
+#include "keyobj.h"
+#include "algobj.h"
+
+static char ALGORITHM_TYPE_TAG = 0;
+
+int B_CreateAlgorithmObject (algorithmObject)
+B_ALGORITHM_OBJ *algorithmObject;
+{
+  AlgorithmWrap *algorithmWrap;
+
+  if ((*algorithmObject = T_malloc (sizeof (*algorithmWrap))) == NULL_PTR)
+    return (BE_ALLOC);
+
+  algorithmWrap = (AlgorithmWrap *)*algorithmObject;
+
+  /* First construct base class */
+  B_AlgorithmConstructor (&algorithmWrap->algorithm);
+  
+  algorithmWrap->typeTag = &ALGORITHM_TYPE_TAG;
+  algorithmWrap->selfCheck = algorithmWrap;
+  return (0);
+}
+
+void B_DestroyAlgorithmObject (algorithmObject)
+B_ALGORITHM_OBJ *algorithmObject;
+{
+  AlgorithmWrap *algorithmWrap = (AlgorithmWrap *)*algorithmObject;
+
+  if (AlgorithmWrapCheck (algorithmWrap) == 0) {
+    /* zeroize self check to invalidate memory. */
+    algorithmWrap->selfCheck = (AlgorithmWrap *)NULL_PTR;
+
+    /* Call base class descructor */
+    B_AlgorithmDestructor (&algorithmWrap->algorithm);
+
+    T_free ((POINTER)algorithmWrap);
+  }
+
+  *algorithmObject = NULL_PTR;
+}
+
+int B_SetAlgorithmInfo (algorithmObject, infoType, info)
+B_ALGORITHM_OBJ algorithmObject;
+B_INFO_TYPE infoType;
+POINTER info;
+{
+  B_AlgorithmInfoType *algorithmInfoType;
+  int status;
+  
+  if ((status = AlgorithmWrapCheck (THE_ALG_WRAP)) != 0)
+    return (status);
+
+  /* Get the AlgorithmInfoType from the B_INFO_TYPE, which returns
+       zero for an AlgorithmInfoType, non-zero for KeyInfoType
+   */
+  if ((*infoType) ((POINTER *)&algorithmInfoType) != 0)
+    return (BE_KEY_OPERATION_UNKNOWN);
+  
+  return (B_AlgorithmSetInfo
+          (&THE_ALG_WRAP->algorithm, algorithmInfoType, info));
+}
+
+int B_GetAlgorithmInfo (info, algorithmObject, infoType)
+POINTER *info;
+B_ALGORITHM_OBJ algorithmObject;
+B_INFO_TYPE infoType;
+{
+  B_AlgorithmInfoType *algorithmInfoType;
+  int status;
+  
+  if ((status = AlgorithmWrapCheck (THE_ALG_WRAP)) != 0)
+    return (status);
+
+  /* Get the AlgorithmInfoType from the B_INFO_TYPE, which returns
+       zero for an AlgorithmInfoType, non-zero for KeyInfoType
+   */
+  if ((*infoType) ((POINTER *)&algorithmInfoType) != 0)
+    return (BE_KEY_OPERATION_UNKNOWN);
+  
+  return (B_AlgorithmGetInfo
+          (&THE_ALG_WRAP->algorithm, info, algorithmInfoType));
+}
+
+/* Return 0 if this is a valid AlgorithmWrap object. Return BE_ALGORITHM_OBJ if
+     algorithmWrap is NULL_PTR or invalid.
+ */
+int AlgorithmWrapCheck (algorithmWrap)
+AlgorithmWrap *algorithmWrap;
+{
+  return ((algorithmWrap != (AlgorithmWrap *)NULL_PTR &&
+           algorithmWrap->selfCheck == algorithmWrap &&
+           algorithmWrap->typeTag == &ALGORITHM_TYPE_TAG) ?
+          0 : BE_ALGORITHM_OBJ);
+}
+
+/* Like AlgorithmWrapCheck except returns BE_RANDOM_OBJ for error.
+   Also, return OK status if randomAlgorithm is NULL_PTR.
+ */
+int RandomAlgorithmCheck (randomAlgorithm)
+B_ALGORITHM_OBJ randomAlgorithm;
+{
+  if (randomAlgorithm == NULL_PTR)
+    return (0);
+
+  return (AlgorithmWrapCheck ((AlgorithmWrap *)randomAlgorithm) ?
+          BE_RANDOM_OBJ : 0);
+}
+
--- a/lib/dns/sec/dnssafe/algobj.h
+++ b/lib/dns/sec/dnssafe/algobj.h
@@ -0,0 +1,19 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#define THE_ALG_WRAP ((AlgorithmWrap *)algorithmObject)
+
+typedef struct AlgorithmWrap {
+  B_Algorithm algorithm;
+  char *typeTag;
+  struct AlgorithmWrap *selfCheck;
+} AlgorithmWrap;
+
+int AlgorithmWrapCheck PROTO_LIST ((AlgorithmWrap *));
+int RandomAlgorithmCheck PROTO_LIST ((B_ALGORITHM_OBJ));
+
--- a/lib/dns/sec/dnssafe/amcrte.c
+++ b/lib/dns/sec/dnssafe/amcrte.c
@@ -0,0 +1,117 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "balgmeth.h"
+#include "crt2.h"
+#include "amencdec.h"
+
+static int RSA_CRT2Query PROTO_LIST ((unsigned int *, POINTER, POINTER));
+static int RSA_CRT2Init PROTO_LIST
+  ((POINTER, POINTER, POINTER, A_SURRENDER_CTX *));
+static int RSA_CRT2Update PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int, A_SURRENDER_CTX *));
+static int RSA_CRT2Final PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int *, unsigned int,
+    A_SURRENDER_CTX *));
+static int RSA_CRT2GetMaxOutputLen PROTO_LIST
+  ((POINTER, unsigned int *, unsigned int));
+static int RSA_CRT2GetBlockLen PROTO_LIST ((POINTER, unsigned int *));
+
+extern struct B_AlgorithmInfoType AIT_RSAPrivate;
+extern struct B_KeyInfoType KIT_RSA_CRT;
+
+static A_ENCRYPT_DECRYPT_ALGA A_RSA_CRT2_CRYPT = {
+  RSA_CRT2Query, RSA_CRT2Init, RSA_CRT2Update, RSA_CRT2Final,
+  RSA_CRT2GetMaxOutputLen, RSA_CRT2GetBlockLen
+};
+
+B_ALGORITHM_METHOD AM_RSA_CRT_DECRYPT =
+  {&AIT_RSAPrivate, 0, &KIT_RSA_CRT, (POINTER)&A_RSA_CRT2_CRYPT};
+B_ALGORITHM_METHOD AM_RSA_CRT_ENCRYPT =
+  {&AIT_RSAPrivate, 1, &KIT_RSA_CRT, (POINTER)&A_RSA_CRT2_CRYPT};
+
+static int RSA_CRT2Query (contextLen, key, params)
+unsigned int *contextLen;
+POINTER key;
+POINTER params;
+{
+UNUSED_ARG (params)
+
+  if (A_IntegerBits
+      (((A_RSA_CRT_KEY *)key)->modulus.data,
+       ((A_RSA_CRT_KEY *)key)->modulus.len) > MAX_RSA_MODULUS_BITS)
+    /* Key size is too big to handle. */
+    return (AE_MODULUS_LEN);
+
+  *contextLen = sizeof (A_RSA_CRT2_CTX);
+  return (0);
+}
+
+static int RSA_CRT2Init (context, key, params, surrenderContext)
+POINTER context;
+POINTER key;
+POINTER params;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (params)
+UNUSED_ARG (surrenderContext)
+
+  return (A_RSA_CRT2Init ((A_RSA_CRT2_CTX *)context, (A_RSA_CRT_KEY *)key));
+}
+
+static int RSA_CRT2Update
+  (context, output, outputLen, maxOutputLen, input, inputLen, surrenderContext)
+POINTER context;
+unsigned char *output;
+unsigned int *outputLen;
+unsigned int maxOutputLen;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (A_RSA_CRT2Update
+          ((A_RSA_CRT2_CTX *)context, output, outputLen, maxOutputLen, input,
+           inputLen, surrenderContext));
+}
+
+static int RSA_CRT2Final
+  (context, output, outputLen, maxOutputLen, surrenderContext)
+POINTER context;
+unsigned char *output;
+unsigned int *outputLen;
+unsigned int maxOutputLen;
+A_SURRENDER_CTX * surrenderContext;
+{
+UNUSED_ARG (output)
+UNUSED_ARG (maxOutputLen)
+UNUSED_ARG (surrenderContext)
+
+  *outputLen = 0;
+  return (A_RSA_CRT2Final ((A_RSA_CRT2_CTX *)context));
+}
+
+static int RSA_CRT2GetMaxOutputLen (context, outputLen, inputLen)
+POINTER context;
+unsigned int *outputLen;
+unsigned int inputLen;
+{
+  *outputLen = A_RSA_CRT2_MAX_OUTPUT_LEN ((A_RSA_CRT2_CTX *)context, inputLen);
+  return (0);
+}
+
+static int RSA_CRT2GetBlockLen (context, blockLen)
+POINTER context;
+unsigned int *blockLen;
+{
+  *blockLen = A_RSA_CRT2_BLOCK_LEN ((A_RSA_CRT2_CTX *)context);
+  return(0);
+}
--- a/lib/dns/sec/dnssafe/amdigest.h
+++ b/lib/dns/sec/dnssafe/amdigest.h
@@ -0,0 +1,19 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+typedef struct {
+  int (*Query) PROTO_LIST ((unsigned int *, POINTER));
+  int (*Init) PROTO_LIST ((POINTER, POINTER, A_SURRENDER_CTX *));
+  int (*Update) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+  int (*Final) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int *, unsigned int,
+      A_SURRENDER_CTX *));
+  int (*GetMaxOutputLen) PROTO_LIST ((POINTER, unsigned int *));
+} A_DIGEST_ALGA;
+
--- a/lib/dns/sec/dnssafe/amencdec.h
+++ b/lib/dns/sec/dnssafe/amencdec.h
@@ -0,0 +1,21 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+typedef struct {
+  int (*Query) PROTO_LIST ((unsigned int *, POINTER, POINTER));
+  int (*Init) PROTO_LIST ((POINTER, POINTER, POINTER, A_SURRENDER_CTX *));
+  int (*Update) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int *, unsigned int,
+      unsigned char *, unsigned int, A_SURRENDER_CTX *));
+  int (*Final) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int *, unsigned int,
+      A_SURRENDER_CTX *));
+  int (*GetMaxOutputLen) PROTO_LIST ((POINTER, unsigned int *, unsigned int));
+  int (*GetBlockLen) PROTO_LIST ((POINTER, unsigned int *));
+} A_ENCRYPT_DECRYPT_ALGA;
+
--- a/lib/dns/sec/dnssafe/amgen.h
+++ b/lib/dns/sec/dnssafe/amgen.h
@@ -0,0 +1,19 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+struct B_KeyInfoType;
+
+typedef struct {
+  int (*Query) PROTO_LIST
+    ((unsigned int *, unsigned int *, unsigned int *, struct B_KeyInfoType **,
+      POINTER));
+  int (*Init) PROTO_LIST ((POINTER, POINTER, POINTER, A_SURRENDER_CTX *));
+  int (*Generate) PROTO_LIST
+    ((POINTER, POINTER *, unsigned char *, A_SURRENDER_CTX *));
+} A_GENERATE_ALGA;
+
--- a/lib/dns/sec/dnssafe/ammd5.c
+++ b/lib/dns/sec/dnssafe/ammd5.c
@@ -0,0 +1,100 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "balgmeth.h"
+#include "md5.h"
+#include "amdigest.h"
+
+static int MD5Query PROTO_LIST ((unsigned int *, POINTER));
+static int MD5Init PROTO_LIST ((POINTER, POINTER, A_SURRENDER_CTX*));
+static int MD5Update PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX*));
+static int MD5Final PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int *, unsigned int, A_SURRENDER_CTX*));
+static int MD5GetMaxOutputLen PROTO_LIST ((POINTER, unsigned int *));
+
+static A_DIGEST_ALGA A_MD5_DIGEST = {
+  MD5Query, MD5Init, MD5Update, MD5Final, MD5GetMaxOutputLen
+};
+
+extern struct B_AlgorithmInfoType AIT_MD5;
+
+B_ALGORITHM_METHOD AM_MD5 =
+  {&AIT_MD5, 0, (struct B_KeyInfoType *)NULL_PTR, (POINTER)&A_MD5_DIGEST};
+
+/* Returns 0.
+ */
+static int MD5Query (contextLen, params)
+unsigned int *contextLen;
+POINTER params;
+{
+UNUSED_ARG (params)
+
+  *contextLen = sizeof (A_MD5_CTX);
+  return (0);
+}
+
+/* Returns 0.
+ */
+static int MD5Init (context, params, surrenderContext)
+POINTER context;
+POINTER params;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (params)
+UNUSED_ARG (surrenderContext)
+
+  A_MD5Init ((A_MD5_CTX *)context);
+  return (0);
+}
+
+/* Returns 0.
+ */
+static int MD5Update (context, input, inputLen, surrenderContext)
+POINTER context;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (surrenderContext)
+
+  A_MD5Update ((A_MD5_CTX *)context, input, inputLen);
+  return (0);
+}
+
+/* Returns 0, AE_OUTPUT_LEN if maxDigestLen is too small.
+ */
+static int MD5Final
+  (context, digest, digestLen, maxDigestLen, surrenderContext)
+POINTER context;
+unsigned char *digest;
+unsigned int *digestLen;
+unsigned int maxDigestLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (surrenderContext)
+
+  if ((*digestLen = A_MD5_DIGEST_LEN) > maxDigestLen)
+    return (AE_OUTPUT_LEN);
+
+  A_MD5Final ((A_MD5_CTX *)context, digest);
+  return (0);
+}
+
+static int MD5GetMaxOutputLen (context, outputLen)
+POINTER context;
+unsigned int *outputLen;
+{
+UNUSED_ARG (context)
+
+  *outputLen = A_MD5_DIGEST_LEN;
+  return(0);
+}
--- a/lib/dns/sec/dnssafe/ammd5r.c
+++ b/lib/dns/sec/dnssafe/ammd5r.c
@@ -0,0 +1,77 @@
+/* Copyright (C) RSA Data Security, Inc. created 1990, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "balgmeth.h"
+#include "md5rand.h"
+#include "amrandom.h"
+
+static int MD5RandomQuery PROTO_LIST ((unsigned int *, POINTER));
+static int MD5RandomInit PROTO_LIST ((POINTER, POINTER, A_SURRENDER_CTX *));
+static int MD5RandomUpdate PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+static int MD5RandomGenerateBytes PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+
+extern struct B_AlgorithmInfoType AIT_MD5Random;
+
+static A_RANDOM_ALGA A_MD5_RANDOM =
+  {MD5RandomQuery, MD5RandomInit, MD5RandomUpdate, MD5RandomGenerateBytes};
+
+B_ALGORITHM_METHOD AM_MD5_RANDOM =
+  {&AIT_MD5Random, 0, (struct B_KeyInfoType *)NULL_PTR,
+   (POINTER)&A_MD5_RANDOM};
+
+static int MD5RandomQuery (contextLen, params)
+unsigned int *contextLen;
+POINTER params;
+{
+UNUSED_ARG (params)
+
+  *contextLen = sizeof (A_MD5_RANDOM_CTX);
+  return (0);
+}
+
+static int MD5RandomInit (context, params, surrenderContext)
+POINTER context;
+POINTER params;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (params)
+UNUSED_ARG (surrenderContext)
+
+  A_MD5RandomInit ((A_MD5_RANDOM_CTX *)context);
+  return (0);
+}
+
+static int MD5RandomUpdate (context, input, inputLen, surrenderContext)
+POINTER context;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (surrenderContext)
+
+  A_MD5RandomUpdate ((A_MD5_RANDOM_CTX *)context, input, inputLen);
+  return (0);
+}
+
+static int MD5RandomGenerateBytes
+  (context, output, outputLen, surrenderContext)
+POINTER context;
+unsigned char *output;
+unsigned int outputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (surrenderContext)
+
+  A_MD5RandomGenerateBytes ((A_MD5_RANDOM_CTX *)context, output, outputLen);
+  return (0);
+}
--- a/lib/dns/sec/dnssafe/amrandom.h
+++ b/lib/dns/sec/dnssafe/amrandom.h
@@ -0,0 +1,17 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+typedef struct {
+  int (*Query) PROTO_LIST ((unsigned int *, POINTER));
+  int (*Init) PROTO_LIST ((POINTER, POINTER, A_SURRENDER_CTX *));
+  int (*Update) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+  int (*Generate) PROTO_LIST
+    ((POINTER, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+} A_RANDOM_ALGA;
+
--- a/lib/dns/sec/dnssafe/amrkg.c
+++ b/lib/dns/sec/dnssafe/amrkg.c
@@ -0,0 +1,81 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "algae.h"
+#include "rsakeygn.h"
+#include "balgmeth.h"
+#include "amgen.h"
+
+#define THE_GEN_PARAMS ((A_RSA_KEY_GEN_PARAMS *)params)
+
+extern struct B_AlgorithmInfoType AIT_RSAKeyGen;
+extern struct B_KeyInfoType KIT_PKCS_RSAPrivate;
+
+static int RSAKeyGenQuery PROTO_LIST
+  ((unsigned int *, unsigned int *, unsigned int *, struct B_KeyInfoType **,
+    POINTER));
+static int RSAKeyGenInit PROTO_LIST
+  ((POINTER, POINTER, POINTER, A_SURRENDER_CTX *));
+static int RSAKeyGen PROTO_LIST
+  ((POINTER, POINTER *, unsigned char *, A_SURRENDER_CTX *));
+
+static A_GENERATE_ALGA A_RSA_KEY_GEN =
+  {RSAKeyGenQuery, RSAKeyGenInit, RSAKeyGen};
+
+B_ALGORITHM_METHOD AM_RSA_KEY_GEN =
+  {&AIT_RSAKeyGen, 0, (struct B_KeyInfoType *)NULL_PTR,
+   (POINTER)&A_RSA_KEY_GEN};
+
+static int RSAKeyGenQuery
+  (contextLen, secondContextLen, randomBlockLen, resultInfoType, params)
+unsigned int *contextLen;
+unsigned int *secondContextLen;
+unsigned int *randomBlockLen;
+struct B_KeyInfoType **resultInfoType;
+POINTER params;
+{
+  if ((THE_GEN_PARAMS->modulusBits > MAX_RSA_MODULUS_BITS) ||
+      (THE_GEN_PARAMS->modulusBits < MIN_RSA_MODULUS_BITS))
+    /* Can't support a keypair of this size. */
+    return (AE_MODULUS_LEN);
+  
+  *contextLen = sizeof (A_RSA_KEY_GEN_CTX);
+  *secondContextLen = 0;
+  *randomBlockLen =
+     A_RSA_KEY_GEN_RANDOM_BLOCK_LEN (THE_GEN_PARAMS->modulusBits);
+  *resultInfoType = &KIT_PKCS_RSAPrivate;
+
+  return (0);
+}
+
+static int RSAKeyGenInit (context, secondContext, params, surrenderContext)
+POINTER context;
+POINTER secondContext;
+POINTER params;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (secondContext)
+UNUSED_ARG (surrenderContext)
+
+  return (A_RSAKeyGenInit
+          ((A_RSA_KEY_GEN_CTX *)context, (A_RSA_KEY_GEN_PARAMS *)params));
+}
+
+static int RSAKeyGen (context, result, randomBlock, surrenderContext)
+POINTER context;
+POINTER *result;
+unsigned char *randomBlock;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (A_RSAKeyGen
+          ((A_RSA_KEY_GEN_CTX *)context, (A_PKCS_RSA_PRIVATE_KEY **)result,
+           randomBlock, surrenderContext));
+}
+
--- a/lib/dns/sec/dnssafe/amrsae.c
+++ b/lib/dns/sec/dnssafe/amrsae.c
@@ -0,0 +1,115 @@
+/* Copyright (C) RSA Data Security, Inc. created 1994, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "algae.h"
+#include "bsafe2.h"
+#include "balgmeth.h"
+#include "rsa.h"
+#include "amencdec.h"
+
+static int RSAQuery PROTO_LIST ((unsigned int *, POINTER, POINTER));
+static int RSAInit PROTO_LIST ((POINTER, POINTER, POINTER, A_SURRENDER_CTX *));
+static int RSAUpdate PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int, A_SURRENDER_CTX *));
+static int RSAFinal PROTO_LIST
+  ((POINTER, unsigned char *, unsigned int *, unsigned int,
+    A_SURRENDER_CTX *));
+static int RSAGetMaxOutputLen PROTO_LIST
+  ((POINTER, unsigned int *, unsigned int));
+static int RSAGetBlockLen PROTO_LIST ((POINTER, unsigned int *));
+
+extern struct B_AlgorithmInfoType AIT_RSAPublic;
+extern struct B_KeyInfoType KIT_RSAPublic;
+
+static A_ENCRYPT_DECRYPT_ALGA A_RSA_CRYPT = {
+  RSAQuery, RSAInit, RSAUpdate, RSAFinal, RSAGetMaxOutputLen, RSAGetBlockLen
+};
+
+B_ALGORITHM_METHOD AM_RSA_DECRYPT =
+  {&AIT_RSAPublic, 0, &KIT_RSAPublic, (POINTER)&A_RSA_CRYPT};
+B_ALGORITHM_METHOD AM_RSA_ENCRYPT =
+  {&AIT_RSAPublic, 1, &KIT_RSAPublic, (POINTER)&A_RSA_CRYPT};
+
+static int RSAQuery (contextLen, key, params)
+unsigned int *contextLen;
+POINTER key;
+POINTER params;
+{
+UNUSED_ARG (params)
+
+  if (A_IntegerBits
+      (((A_RSA_KEY *)key)->modulus.data, ((A_RSA_KEY *)key)->modulus.len)
+      > MAX_RSA_MODULUS_BITS)
+    /* Key size is too big to handle. */
+    return (AE_MODULUS_LEN);
+
+  *contextLen = sizeof (A_RSA_CTX);
+  return (0);
+}
+
+static int RSAInit (context, key, params, surrenderContext)
+POINTER context;
+POINTER key;
+POINTER params;
+A_SURRENDER_CTX *surrenderContext;
+{
+UNUSED_ARG (params)
+UNUSED_ARG (surrenderContext)
+
+  return (A_RSAInit ((A_RSA_CTX *)context, (A_RSA_KEY *)key));
+}
+
+static int RSAUpdate
+  (context, output, outputLen, maxOutputLen, input, inputLen, surrenderContext)
+POINTER context;
+unsigned char *output;
+unsigned int *outputLen;
+unsigned int maxOutputLen;
+unsigned char *input;
+unsigned int inputLen;
+A_SURRENDER_CTX *surrenderContext;
+{
+  return (A_RSAUpdate
+          ((A_RSA_CTX *)context, output, outputLen, maxOutputLen, input,
+           inputLen, surrenderContext));
+}
+
+static int RSAFinal
+  (context, output, outputLen, maxOutputLen, surrenderContext)
+POINTER context;
+unsigned char *output;
+unsigned int *outputLen;
+unsigned int maxOutputLen;
+A_SURRENDER_CTX * surrenderContext;
+{
+UNUSED_ARG (output)
+UNUSED_ARG (maxOutputLen)
+UNUSED_ARG (surrenderContext)
+
+  *outputLen = 0;
+  return (A_RSAFinal ((A_RSA_CTX *)context));
+}
+
+static int RSAGetMaxOutputLen (context, outputLen, inputLen)
+POINTER context;
+unsigned int *outputLen;
+unsigned int inputLen;
+{
+  *outputLen = A_RSA_MAX_OUTPUT_LEN ((A_RSA_CTX *)context, inputLen);
+  return (0);
+}
+
+static int RSAGetBlockLen (context, blockLen)
+POINTER context;
+unsigned int *blockLen;
+{
+  *blockLen = A_RSA_BLOCK_LEN ((A_RSA_CTX *)context);
+  return(0);
+}
--- a/lib/dns/sec/dnssafe/atypes.h
+++ b/lib/dns/sec/dnssafe/atypes.h
@@ -0,0 +1,60 @@
+/* Copyright (C) RSA Data Security, Inc. created 1992, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _ATYPES_H_
+#define _ATYPES_H_ 1
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef _ITEM_
+#define _ITEM_ 1
+typedef struct {
+  unsigned char *data;
+  unsigned int len;
+} ITEM;
+#endif
+
+typedef struct {
+  int (T_CALL *Surrender) PROTO_LIST ((POINTER));
+  POINTER handle;
+  POINTER reserved;
+} A_SURRENDER_CTX;
+
+typedef struct {
+  ITEM modulus;
+  ITEM publicExponent;
+  ITEM privateExponent;
+  ITEM prime[2];                                            /* prime factors */
+  ITEM primeExponent[2];                      /* exponents for prime factors */
+  ITEM coefficient;                                       /* CRT coefficient */
+} A_PKCS_RSA_PRIVATE_KEY;
+
+typedef struct {
+  ITEM modulus;
+  ITEM prime[2];                                            /* prime factors */
+  ITEM primeExponent[2];                      /* exponents for prime factors */
+  ITEM coefficient;                                       /* CRT coefficient */
+} A_RSA_CRT_KEY;
+
+typedef struct {
+  ITEM modulus;                                                   /* modulus */
+  ITEM exponent;                                                 /* exponent */
+} A_RSA_KEY;
+
+typedef struct {
+  unsigned int modulusBits;
+  ITEM publicExponent;
+} A_RSA_KEY_GEN_PARAMS;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/lib/dns/sec/dnssafe/balg.c
+++ b/lib/dns/sec/dnssafe/balg.c
@@ -0,0 +1,115 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bsafe2.h"
+#include "bkey.h"
+#include "balg.h"
+#include "btypechk.h"
+#include "ainfotyp.h"
+
+void B_AlgorithmConstructor (algorithm)
+B_Algorithm *algorithm;
+{
+  /* Construct immediate base class. */
+  B_InfoCacheConstructor (&algorithm->infoCache);
+
+  T_memset ((POINTER)&algorithm->z, 0, sizeof (algorithm->z));
+}
+
+void B_AlgorithmDestructor (algorithm)
+B_Algorithm *algorithm;
+{
+  if (algorithm->z.handler != (B_TypeCheck *)NULL_PTR) {
+    B_TYPE_CHECK_Destructor (algorithm->z.handler);
+    T_free ((POINTER)algorithm->z.handler);
+  }
+
+  /* Destroy base class */
+  B_INFO_CACHE_Destructor (&algorithm->infoCache);
+}
+
+int B_AlgorithmCheckType (algorithm, Destructor)
+B_Algorithm *algorithm;
+B_TYPE_CHECK_DESTRUCTOR Destructor;
+{
+  if (algorithm->z.handler == (B_TypeCheck *)NULL_PTR)
+    return (BE_ALGORITHM_NOT_SET);
+
+  if (algorithm->z.handler->_Destructor != Destructor)
+    return (BE_ALG_OPERATION_UNKNOWN);
+
+  return (0);
+}
+
+int B_AlgorithmCheckTypeAndInitFlag (algorithm, Destructor)
+B_Algorithm *algorithm;
+B_TYPE_CHECK_DESTRUCTOR Destructor;
+{
+  int status;
+
+  /* Check the type first. */
+  if ((status = B_AlgorithmCheckType (algorithm, Destructor)) != 0)
+    return (status);
+
+  if (!algorithm->z.initFlag)
+    return (BE_ALGORITHM_NOT_INITIALIZED);
+
+  return (0);
+}
+
+int B_AlgorithmSetInfo (algorithm, algorithmInfoType, info)
+B_Algorithm *algorithm;
+B_AlgorithmInfoType *algorithmInfoType;
+POINTER info;
+{
+  int status;
+  
+  if (algorithm->infoCache.z.infoCount > 0)
+    return (BE_ALGORITHM_ALREADY_SET);
+
+  /* This will cache the encoding. */
+  if ((status = (*algorithmInfoType->vTable->AddInfo)
+       (algorithmInfoType, algorithm, info)) != 0)
+    return (status);
+
+  /* Allocate the algorithm handler.  NewHandler returns NULL_PTR for error.
+   */
+  if ((algorithm->z.handler = (*algorithmInfoType->vTable->NewHandler)
+       (algorithmInfoType, algorithm)) == (B_TypeCheck *)NULL_PTR)
+    return (BE_ALLOC);
+
+  return (0);
+}
+
+int B_AlgorithmGetInfo (algorithm, info, algorithmInfoType)
+B_Algorithm *algorithm;
+POINTER *info;
+B_AlgorithmInfoType *algorithmInfoType;
+{
+  int status;
+  
+  if (algorithm->infoCache.z.infoCount == 0)
+    return (BE_ALGORITHM_NOT_SET);
+
+  /* First check if the encoding is already in the encoding cache.
+   */
+  if (B_InfoCacheFindInfo
+      (&algorithm->infoCache, info, (POINTER)algorithmInfoType) == 0)
+    return (0);
+  
+  /* Info is not in the cache, go ahead and encode.
+   */
+  if ((status = (*algorithmInfoType->vTable->MakeInfo)
+       (algorithmInfoType, info, algorithm)) != 0)
+    return (status);
+
+  return (B_InfoCacheAddInfo
+          (&algorithm->infoCache, (POINTER)algorithmInfoType, *info));
+}
+
--- a/lib/dns/sec/dnssafe/balg.h
+++ b/lib/dns/sec/dnssafe/balg.h
@@ -0,0 +1,116 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _BALG_H_
+#define _BALG_H_ 1
+
+#include "binfocsh.h"
+#include "btypechk.h"
+
+typedef struct {
+  B_InfoCache infoCache;                                        /* inherited */
+
+  struct {
+    B_TypeCheck *handler;
+    int initFlag;
+    /* POINTER reserved; */
+  } z;
+} B_Algorithm;
+
+void B_AlgorithmConstructor PROTO_LIST ((B_Algorithm *));
+void B_AlgorithmDestructor PROTO_LIST ((B_Algorithm *));
+
+int B_AlgorithmCheckType PROTO_LIST ((B_Algorithm *, B_TYPE_CHECK_DESTRUCTOR));
+int B_AlgorithmCheckTypeAndInitFlag PROTO_LIST
+  ((B_Algorithm *, B_TYPE_CHECK_DESTRUCTOR));
+
+struct B_AlgorithmInfoType;
+int B_AlgorithmSetInfo PROTO_LIST
+  ((B_Algorithm *, struct B_AlgorithmInfoType *, POINTER));
+int B_AlgorithmGetInfo PROTO_LIST
+  ((B_Algorithm *, POINTER *, struct B_AlgorithmInfoType *));
+
+int B_AlgorithmRandomInit PROTO_LIST
+  ((B_Algorithm *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmRandomUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int B_AlgorithmGenerateRandomBytes PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+
+int B_AlgorithmDigestInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmDigestUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int B_AlgorithmDigestFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    A_SURRENDER_CTX *));
+
+int B_AlgorithmEncryptInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmDecryptInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmEncryptUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+int B_AlgorithmDecryptUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int, B_Algorithm *, A_SURRENDER_CTX *));
+int B_AlgorithmEncryptFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    B_Algorithm *, A_SURRENDER_CTX *));
+int B_AlgorithmDecryptFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    B_Algorithm *, A_SURRENDER_CTX *));
+
+int B_AlgorithmEncodeInit PROTO_LIST ((B_Algorithm *));
+int B_AlgorithmDecodeInit PROTO_LIST ((B_Algorithm *));
+int B_AlgorithmEncodeUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int));
+int B_AlgorithmDecodeUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int));
+int B_AlgorithmEncodeFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int));
+int B_AlgorithmDecodeFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int));
+
+int B_AlgorithmSignInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmSignUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int B_AlgorithmSignFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    B_Algorithm *, A_SURRENDER_CTX *));
+
+int B_AlgorithmVerifyInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmVerifyUpdate PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, A_SURRENDER_CTX *));
+int B_AlgorithmVerifyFinal PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int, B_Algorithm *,
+    A_SURRENDER_CTX *));
+
+int B_AlgorithmKeyAgreeInit PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmKeyAgreePhase1 PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    B_Algorithm *, A_SURRENDER_CTX *));
+int B_AlgorithmKeyAgreePhase2 PROTO_LIST
+  ((B_Algorithm *, unsigned char *, unsigned int *, unsigned int,
+    unsigned char *, unsigned int, A_SURRENDER_CTX *));
+
+int B_AlgorithmGenerateInit PROTO_LIST
+  ((B_Algorithm *, B_ALGORITHM_CHOOSER, A_SURRENDER_CTX *));
+int B_AlgorithmGenerateKeypair PROTO_LIST
+  ((B_Algorithm *, B_Key *, B_Key *, B_Algorithm *,
+    A_SURRENDER_CTX *));
+int B_AlgorithmGenerateParameters PROTO_LIST
+  ((B_Algorithm *, B_Algorithm *, B_Algorithm *, A_SURRENDER_CTX *));
+
+#endif
--- a/lib/dns/sec/dnssafe/balgmeth.h
+++ b/lib/dns/sec/dnssafe/balgmeth.h
@@ -0,0 +1,18 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+struct B_AlgorithmInfoType;
+struct B_KeyInfoType;
+
+struct B_ALGORITHM_METHOD {
+  struct B_AlgorithmInfoType *algorithmInfoType;
+  int encryptFlag;
+  struct B_KeyInfoType *keyInfoType;
+  POINTER alga;
+};
+
--- a/lib/dns/sec/dnssafe/bgclrbit.c
+++ b/lib/dns/sec/dnssafe/bgclrbit.c
@@ -0,0 +1,28 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigClrbit (a, v) -- clears v-th bit of a, where v is nonnegative.
+ */
+void BigClrbit (a, v)
+UINT2 *a;
+unsigned int v;
+{ 
+  a[v/16] &= ~ (1 << (v % 16)); 
+}
+
+/* BigSetbit (a, v) -- sets v-th bit of a, where v is nonnegative.
+ */
+void BigSetbit (a, v)
+UINT2 *a;
+unsigned int v;
+{ 
+  a[v/16] |= (1 << (v % 16)); 
+}
--- a/lib/dns/sec/dnssafe/bgmdmpyx.c
+++ b/lib/dns/sec/dnssafe/bgmdmpyx.c
@@ -0,0 +1,26 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigModMpyx (a, b, c, d, dInv, n) -- a = (b * c) mod d !! EXPRESS.
+     -- assumes a, b, c, d of length n, dInv of length n+2.
+     -- assumes dInv previously computed by BigInv.
+ */
+void BigModMpyx (a, b, c, d, dInv, n)
+UINT2 *a, *b, *c, *d, *dInv;
+unsigned int n;
+{
+  UINT2 prod[2 * MAX_RSA_MODULUS_WORDS];
+
+  BigPmpy (prod, b, c, n);
+  BigModx (a, prod, d, dInv, n);
+
+  T_memset ((POINTER)prod, 0, sizeof (prod));
+}
--- a/lib/dns/sec/dnssafe/bgmdsqx.c
+++ b/lib/dns/sec/dnssafe/bgmdsqx.c
@@ -0,0 +1,24 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigModSqx (a, b, d, dInv, n) -- a = (b * b) mod d !! EXPRESS.
+ */
+void BigModSqx (a, b, d, dInv, n)
+UINT2 *a, *b, *d, *dInv;
+unsigned int n;
+{
+  UINT2 prod[2 * MAX_RSA_MODULUS_WORDS];
+
+  BigPsq (prod, b, n);
+  BigModx (a, prod, d, dInv, n);
+
+  T_memset ((POINTER)prod, 0, sizeof (prod));
+}
--- a/lib/dns/sec/dnssafe/bgmodexp.c
+++ b/lib/dns/sec/dnssafe/bgmodexp.c
@@ -0,0 +1,132 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+#include "surrendr.h"
+
+/* BigModExp (a, b, c, d, n): a = b**c (mod d)
+   Assumes a, b, c, d of length n.
+   Returns 0, AE_CANCEL.
+ */
+int BigModExp (a, b, c, d, n, surrenderContext) 
+UINT2 *a, *b, *c, *d;
+unsigned int n;
+A_SURRENDER_CTX *surrenderContext;
+{
+  struct BigModExpFrame {
+    UINT2 dInv[MAX_RSA_MODULUS_WORDS + 2], result[MAX_RSA_MODULUS_WORDS], 
+      tab[16][MAX_RSA_MODULUS_WORDS];
+  } *frame = (struct BigModExpFrame *)NULL_PTR;
+#if !USE_ALLOCED_FRAME
+  struct BigModExpFrame stackFrame;
+#endif
+  int i, didAMultiply, status;
+  unsigned int cLen, w, setup[64], power, mask;
+
+  /* Initialize.
+   */
+  do {
+#if USE_ALLOCED_FRAME
+    if ((frame = (struct BigModExpFrame *)T_malloc (sizeof (*frame)))
+        == (struct BigModExpFrame *)NULL_PTR) {
+      status = AE_ALLOC;
+      break;
+    }
+#else
+    /* Just use the buffers allocated on the stack. */
+    frame = &stackFrame;
+#endif
+
+    /* precompute inverse of d to enable express mod-outs */
+    BigInv (frame->dInv, d, n);
+    if ((status = CheckSurrender (surrenderContext)) != 0)
+      break;
+    
+    /* precompute small (size 2**w) table of powers of b */
+    cLen = BigLen (c, n);
+    if (cLen < 4)
+      w = 1;
+    else if (cLen < 16)
+      w = 2;
+    else if (cLen < 64)
+      w = 3;
+    else
+      w = 4; 
+
+    /* zeroth power is one */
+    BigConst (frame->tab[0], 1, n);
+
+    /* first power is b */
+    BigCopy (frame->tab[1], b, n);
+    setup[0] = 1;
+    setup[1] = 1;
+    for (i = 2; i < 64; i++)
+      setup[i] = 0;
+
+    /* Loop over elements of exponent c in appropriate radix.
+     */
+    power = 0;
+    didAMultiply = 0;
+    mask = 1 << ((cLen) % 16);
+    for (i = cLen; i >= 0; i--) {
+      if (didAMultiply) {
+        BigModSqx (frame->result, frame->result, d, frame->dInv, n);
+        if ((status = CheckSurrender (surrenderContext)) != 0)
+          break;
+      }
+
+      power = power << 1;
+      if (setup[power] == 0) {
+        BigModSqx (frame->tab[power], frame->tab[power/2], d, frame->dInv, n);
+        if ((status = CheckSurrender (surrenderContext)) != 0)
+          break;
+        setup[power] = 1;
+      }
+      if (c[i/16] & mask)
+        power = power + 1;
+      if (mask == 1)
+        mask = 0x8000;
+      else
+        mask = (mask >> 1) & 0x7FFF;
+      if (setup[power] == 0) {
+        BigModMpyx
+          (frame->tab[power], frame->tab[power-1], b, d, frame->dInv, n);
+        if ((status = CheckSurrender (surrenderContext)) != 0)
+          break;
+        setup[power] = 1;
+      }
+      if ((i == 0) || (power >= (unsigned int)(1 << (w-1)))) {
+        if (didAMultiply) {
+          BigModMpyx
+            (frame->result, frame->result, frame->tab[power], d, frame->dInv,
+             n);
+          if ((status = CheckSurrender (surrenderContext)) != 0)
+            break;
+        }
+        else
+          BigCopy (frame->result, frame->tab[power], n);
+      
+        power = 0;
+        didAMultiply = 1;
+      }
+    }
+    if (status)
+      break;
+
+    BigCopy (a, frame->result, n);
+  } while (0);
+
+  if (frame != (struct BigModExpFrame *)NULL_PTR) {
+    T_memset ((POINTER)frame, 0, sizeof (*frame));
+#if USE_ALLOCED_FRAME
+    T_free ((POINTER)frame);
+#endif
+  }
+  return (status);
+}
--- a/lib/dns/sec/dnssafe/bgpegcd.c
+++ b/lib/dns/sec/dnssafe/bgpegcd.c
@@ -0,0 +1,78 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigPegcd
+     input
+     u, v     bignums
+     k       int size of u, v regs
+     restriction u, v positive
+     output
+     u3=GCD (u, v)     (pos)
+     u1=inv (u)modv   (pos)
+     u2=inv (v)modu   (pos)
+     if GCD (u, v)!=1 then u1, u2 st
+     u3=u * u1mod (v) & u3=v * u2mod (u)
+     (see KNUTH vol 2)
+ */
+void BigPegcd (u3, u1, u2, u, v, k)
+UINT2 *u3, *u2, *u1, *u, *v;
+unsigned int k;
+{
+  UINT2 v1[2 * MAX_RSA_PRIME_WORDS], v2[2 * MAX_RSA_PRIME_WORDS], 
+    v3[2 * MAX_RSA_PRIME_WORDS], q[2 * MAX_RSA_PRIME_WORDS],
+    r[2 * MAX_RSA_PRIME_WORDS], t1[2 * MAX_RSA_PRIME_WORDS],
+    t2[2 * MAX_RSA_PRIME_WORDS], t3[2 * MAX_RSA_PRIME_WORDS];
+
+  BigConst (u1, 1, k);
+  BigConst (u2, 0, k);
+  BigCopy (u3, u, k);
+  BigConst (v1, 0, k);
+  BigConst (v2, 1, k);
+  BigCopy (v3, v, k);
+
+  /* Begin calc.
+   */
+  while (1) {
+    if (BigSign (v3, k) == 0)
+      break;
+    BigPdiv (q, r, u3, v3, k, k);
+    BigPmpyl (t1, v1, q, k);
+    BigPmpyl (t2, v2, q, k);
+    BigPmpyl (t3, v3, q, k);
+    BigSub (t1, u1, t1, k);
+    BigSub (t2, u2, t2, k);
+    BigSub (t3, u3, t3, k);
+
+    BigCopy (u1, v1, k);
+    BigCopy (u2, v2, k);
+    BigCopy (u3, v3, k);
+    BigCopy (v1, t1, k);
+    BigCopy (v2, t2, k);
+    BigCopy (v3, t3, k);
+  }
+
+  if (BigSign (u1, k) == -1)
+    /* make positive */
+    BigAdd (u1, u1, v, k);
+
+  if (BigSign (u2, k) == -1)
+    /* make positive */
+    BigAdd (u2, u2, u, k);
+
+  T_memset ((POINTER)v1, 0, sizeof (v1));
+  T_memset ((POINTER)v2, 0, sizeof (v2));
+  T_memset ((POINTER)v3, 0, sizeof (v3));
+  T_memset ((POINTER)q, 0, sizeof (q));
+  T_memset ((POINTER)r, 0, sizeof (r));
+  T_memset ((POINTER)t1, 0, sizeof (t1));
+  T_memset ((POINTER)t2, 0, sizeof (t2));
+  T_memset ((POINTER)t3, 0, sizeof (t3));
+}
--- a/lib/dns/sec/dnssafe/big2exp.c
+++ b/lib/dns/sec/dnssafe/big2exp.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* Big2Exp (a, v, n) -- a = 2**v, where v is nonnegative int.  
+   Sets a to be 2**v.
+ */
+void Big2Exp (a, v, n)
+UINT2 *a;
+unsigned v;
+unsigned int n;
+{
+  register unsigned int i;
+
+  for (i = 0; i < n; i++)
+    a[i] = 0;
+  a[v/16] = 1 << (v % 16);
+}
--- a/lib/dns/sec/dnssafe/bigabs.c
+++ b/lib/dns/sec/dnssafe/bigabs.c
@@ -0,0 +1,22 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigAbs (a, b, n) -- a = ABS (b).
+ */
+void BigAbs (a, b, n)
+UINT2 *a, *b;
+unsigned int n;
+{
+  if (BigSign (b, n) >= 0)
+    BigCopy (a, b, n); 
+  else
+    BigNeg (a, b, n);
+}
--- a/lib/dns/sec/dnssafe/bigacc.c
+++ b/lib/dns/sec/dnssafe/bigacc.c
@@ -0,0 +1,34 @@
+/* Copyright (C) RSA Data Security, Inc. created 1987, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* Returns carry: vector a = b * vector c.
+ */
+UINT2 BigAcc (a, b, c, n)
+UINT2 *a;
+unsigned int b;
+UINT2 *c;
+unsigned int n;
+{
+  UINT4 bTemp, result = (UINT4)0;
+  register unsigned int i;
+
+  if (!b)
+    return (0);
+
+  bTemp = b;
+  for (i = 0; i < n; i++) {
+    result += bTemp * ((UINT4) c[i]);
+    result += ((UINT4) a[i]);
+    a[i] = (UINT2) result;
+    result >>= 16;
+  }
+  return ((UINT2)result);
+}
--- a/lib/dns/sec/dnssafe/bigarith.c
+++ b/lib/dns/sec/dnssafe/bigarith.c
@@ -0,0 +1,138 @@
+/* Copyright (C) RSA Data Security, Inc. created 1987, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+void BigZero (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  register unsigned int i;
+  
+  for (i = 0; i < n; i++)
+    a[i] = 0;
+}
+
+void BigAdd (a, b, c, n)
+UINT2 *a, *b, *c;
+unsigned int n;
+{
+  UINT4 result = (UINT4)0;
+  register unsigned int i;
+
+  for (i = 0; i < n; i++) {
+    result += (UINT4) b[i];
+    result += (UINT4) c[i];
+    a[i] = (UINT2) result;
+    result >>= 16;
+  }
+}
+
+void BigSub (a, b, c, n)
+UINT2 *a, *b, *c;
+unsigned int n;
+{
+  UINT4 result = (UINT4)1;                   /* carry bit for negation of c */
+  register unsigned int i;
+
+  for (i = 0; i < n; i++) {
+    result += (UINT4) b[i];
+    result += (((UINT4) ~c[i]) & 0x0000FFFFL);
+    a[i] = (UINT2)result;
+    result >>= 16;
+  }
+}
+
+void BigNeg (a, b, n)
+UINT2 *a, *b;
+unsigned int n;
+{
+  register unsigned int i;
+  unsigned int carry = 1;
+
+  for (i = 0; i < n-1; i++) {
+    a[i] = ~b[i] + carry;
+    if (a[i])
+      carry = 0;
+  }
+  
+  a[i] = ~b[i] + carry;
+}
+
+void BigInc (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  register unsigned int i;
+  unsigned int carry = 1;                                 /* carry to start */
+
+  for (i = 0; i < n-1 && carry; i++) {
+    a[i]++;
+    if (a[i])
+      carry = 0;
+  }
+  
+  if (carry)
+    a[i]++;
+}
+
+void BigDec (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  register unsigned int i;
+  unsigned int borrow = 1;                               /* borrow to start */
+
+  for (i = 0; i < n-1 && borrow; i++) {
+    a[i]--;
+    if (a[i] != 0xFFFF)
+      borrow = 0;
+  }
+  
+  if (borrow)
+    a[i]--;
+}
+
+int BigSign (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  register int i;
+  
+  if (a[n-1] & 0x8000)
+    return (-1);
+  for (i = n-1; i >= 0; i--)
+    if (a[i])
+      return (1);
+  return (0);
+}
+
+void BigCopy (a, b, n)
+UINT2 *a, *b;
+unsigned int n;
+{
+  register unsigned int i;
+  
+  for (i = 0; i < n; i++)
+    a[i] = b[i];
+}
+
+/* Assumes a is nonnegative.
+ */
+unsigned int BigLenw (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  register int i;
+  
+  for (i = n-1; i >= 0; i--)
+    if (a[i])
+      return (i+1);
+  return (0);
+}
--- a/lib/dns/sec/dnssafe/bigcmp.c
+++ b/lib/dns/sec/dnssafe/bigcmp.c
@@ -0,0 +1,34 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* Comparison operator.
+   BigCmp (a, b, n) -- returns sign of a-b.
+ */
+int BigCmp (a, b, n)
+UINT2 *a, *b;
+unsigned int n;
+{
+  register int i;
+  int aSign = BigSign (a, n), bSign = BigSign (b, n);
+
+  if (aSign > bSign)
+    return (1);
+  if (aSign < bSign)
+    return (-1);
+  
+  for (i = n-1; i >= 0 && a[i] == b[i]; i--);
+  
+  if (i == -1)
+    return (0);
+  if (a[i] > b[i])
+    return (1);
+  return (-1);
+}
--- a/lib/dns/sec/dnssafe/bigconst.c
+++ b/lib/dns/sec/dnssafe/bigconst.c
@@ -0,0 +1,26 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigConst (a, v, n) -- a = v, where v is an int.  Initialize bignum a to
+     value v.
+ */
+void BigConst (a, v, n)
+UINT2 *a;
+unsigned int v;
+unsigned int n;
+{
+  UINT2 signWord = (((UINT2)v & 0x8000) ? ~0 : 0);
+  register unsigned int i;
+
+  a[0] = (UINT2)v;
+  for (i = 1; i < n; i++)
+    a[i] = signWord;
+}
--- a/lib/dns/sec/dnssafe/biginv.c
+++ b/lib/dns/sec/dnssafe/biginv.c
@@ -0,0 +1,103 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+static unsigned int Log2 PROTO_LIST ((unsigned int));
+
+/* BigInv (a, b, n) -- compute a as an "inverse" to b, suitable for
+     modding out integers which are < b**2.
+     -- assumes a has n+2 words, b has n words.
+     -- assumes b is a positive integer.
+ */              
+void BigInv (a, b, n)
+UINT2 *a, *b;
+unsigned int n;
+{
+  UINT2 p[2 * (MAX_RSA_MODULUS_WORDS + 2)],
+    q[2 * (MAX_RSA_MODULUS_WORDS + 3)], t1[MAX_RSA_MODULUS_WORDS + 3];
+  register int i;
+  unsigned int bl, u, uw, sw;
+
+  /* Do initializations.
+   */
+  /* 2** (bl-1) <= b < 2 ** bl */
+  bl = BigLen (b, n);
+  u = BigU (2 * bl);
+  
+  /* uw and sw are in words */
+  uw = u/16;
+  sw = (bl - 2) / 16;
+  
+  /* since a = floor ((2**u)/b),  2**(u-bl) < a <= 2**(u-bl+1) */
+
+  /* Initialize a to 1+2**(u-bl) -- we will converge from below.
+   */
+  Big2Exp (a, u - bl, n + 2);
+  BigInc (a, n + 2);
+  
+  /* Copy b to local register.
+   */
+  BigZero (t1, n + 3);
+  BigCopy (t1, b, n);
+
+  /* Convergence is quadratic, so iterate log (len (a)) times.
+   */
+  for (i = 1 + Log2 (u - bl + 1); i > 0; i--) {
+    /* use fast squaring routine to compute p = a**2
+       2**(2 * (u-bl)) < p <= 2**(2 * (u-bl+1)) */
+    BigPsq (p, a, n + 2); 
+
+    /* compute q = b * floor (p/ (2**s))
+       2**(2 * (u-bl)-s+bl-1) <= q <= 2**(2 * (u-bl+1)-s+bl
+       2**(2 * u-bl-s-1) <= q <= 2**(2 * u-bl-s+2) */
+    BigPmpy (q, t1, &p[sw], n + 3);
+
+    /* double a
+       2**(u-bl+1) < a <= 2**(u-bl+2) */
+    BigAdd (a, a, a, n + 2);
+    /* a = a - floor (q/(2**(u-s)))
+       2**(u-bl) < a <= 2**(u-bl+1) + epsilon */
+    BigSub (a, a, &q[uw-sw], n + 2);
+  }
+
+  /* now we are guaranteed that a is not too small */
+  BigInc (a, n + 2);
+
+  while (1) {
+    BigPmpy (p, a, t1, n + 2);
+    /* makes comparison to 2**u easier */
+    BigDec (p, 2 * (n + 2));
+
+    /* a is desired result */
+    if (BigLen (p, 2 * (n + 2)) <= u)
+      break;
+
+    /* a was too big, reduce and try again */
+    BigDec (a, n + 2);
+  }
+
+  T_memset ((POINTER)p, 0, sizeof (p));
+  T_memset ((POINTER)q, 0, sizeof (q));
+  T_memset ((POINTER)t1, 0, sizeof (t1));
+}
+
+/* Log2 (x) -- ceiling of log base 2 of x > 0. Auxiliary function.
+ */
+static unsigned int Log2 (x)
+unsigned int x;
+{
+  unsigned int i;
+
+  x = x - 1;
+  /* now Log2 is equal to len in bits of x */
+  for (i = 0; x > 0; i++, x >>= 1);
+
+  return (i);
+}
--- a/lib/dns/sec/dnssafe/biglen.c
+++ b/lib/dns/sec/dnssafe/biglen.c
@@ -0,0 +1,28 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+unsigned int BigLen (a, n)
+UINT2 *a;
+unsigned int n;
+{
+  UINT2 signWord = ((a[n-1] & 0x8000) ? ~0 : 0);
+  int i, j;
+  unsigned int k;
+
+  for (i = n-1; i >= 0 && a[i] == signWord; i--);
+  if (i == -1)
+    return (1);  /* len of 0 or -1 */
+
+  for (j = 16, k = 0x8000; 
+       j >= 0 && 0 == (k & (signWord ^ a[i])); 
+       j--, k >>= 1);
+  return (16 * i + j);
+}
--- a/lib/dns/sec/dnssafe/bigmath.h
+++ b/lib/dns/sec/dnssafe/bigmath.h
@@ -0,0 +1,71 @@
+/* Copyright (C) RSA Data Security, Inc. created 1992, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _BIGMATH_H_
+#define _BIGMATH_H_ 1
+
+#include "algae.h"
+#include "bigmaxes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void Big2Exp PROTO_LIST ((UINT2 *, unsigned int, unsigned int));
+void BigAbs PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+UINT2 BigAcc PROTO_LIST ((UINT2 *, unsigned int, UINT2 *, unsigned int));
+void BigZero PROTO_LIST ((UINT2 *, unsigned int));
+void BigAdd PROTO_LIST ((UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigSub PROTO_LIST ((UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigNeg PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+void BigInc PROTO_LIST ((UINT2 *, unsigned int));
+void BigDec PROTO_LIST ((UINT2 *, unsigned int));
+int BigSign PROTO_LIST ((UINT2 *, unsigned int));
+void BigCopy PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+unsigned int BigLenw PROTO_LIST ((UINT2 *, unsigned int));
+void BigClrbit PROTO_LIST ((UINT2 *, unsigned int));
+void BigSetbit PROTO_LIST ((UINT2 *, unsigned int));
+int BigCmp PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+void BigConst PROTO_LIST ((UINT2 *, unsigned int, unsigned int));
+void BigInv PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+unsigned int BigLen PROTO_LIST ((UINT2 *, unsigned int));
+void BigModMpyx PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigModSqx PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int));
+int BigModExp PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int, A_SURRENDER_CTX *));
+void BigModx PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigMpy PROTO_LIST ((UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigPdiv PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int , unsigned int));
+void BigPegcd PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigPmpy PROTO_LIST ((UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigPmpyh PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, unsigned int, unsigned int));
+void BigPmpyl PROTO_LIST ((UINT2 *, UINT2 *, UINT2 *, unsigned int));
+void BigPsq PROTO_LIST ((UINT2 *, UINT2 *, unsigned int));
+void BigQrx PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *, unsigned int));
+UINT2 BigSmod PROTO_LIST ((UINT2 *, unsigned int, unsigned int));
+int BigToCanonical PROTO_LIST
+  ((unsigned char *, unsigned int, UINT2 *, unsigned int));
+unsigned int BigU PROTO_LIST ((unsigned int));
+int BigUnexp PROTO_LIST
+  ((UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *, UINT2 *,
+    unsigned int, A_SURRENDER_CTX *));
+int CanonicalToBig PROTO_LIST
+  ((UINT2 *, unsigned int, unsigned char *, unsigned int));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/lib/dns/sec/dnssafe/bigmaxes.h
+++ b/lib/dns/sec/dnssafe/bigmaxes.h
@@ -0,0 +1,47 @@
+/* Copyright (C) RSA Data Security, Inc. created 1993, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#ifndef _BIGMAXES_H_
+#define _BIGMAXES_H_ 1
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MAX_RSA_MODULUS_BITS 1024
+
+#define BITS_TO_LEN(modulusBits) (((modulusBits) + 7) / 8)
+#define RSA_PRIME_BITS(modulusBits) (((modulusBits) + 1) / 2)
+#define RSA_PRIME_LEN(modulusBits) ((RSA_PRIME_BITS (modulusBits) + 7) / 8)
+#define BITS_TO_WORDS(bits) ((bits >> 4) + 1)
+#define LEN_TO_WORDS(len) ((len >> 1) + 1)
+
+/* MAX_RSA_PRIME_BITS -- length in bits of the maximum allowed RSA prime
+   MAX_RSA_MODULUS_LEN -- length in bytes of the maximum allowed RSA modulus,
+                          in canonical format (no sign bit)
+   MAX_RSA_PRIME_LEN -- length in bytes of the maximum allowed RSA prime, in
+                        canonical format (no sign bit)
+ */
+#define MAX_RSA_PRIME_BITS RSA_PRIME_BITS (MAX_RSA_MODULUS_BITS)
+#define MAX_RSA_PRIME_LEN RSA_PRIME_LEN (MAX_RSA_MODULUS_BITS)
+#define MAX_RSA_MODULUS_LEN BITS_TO_LEN (MAX_RSA_MODULUS_BITS)
+
+/* MAX_RSA_MODULUS_WORDS -- length in 16-bit words of the maximum allowed RSA
+                            modulus, in bignum format (including sign bit)
+   MAX_RSA_PRIME_WORDS -- length in 16-bit words of the maximum allowed RSA
+                          prime, in bignum format (including sign bit)
+ */
+
+#define MAX_RSA_MODULUS_WORDS BITS_TO_WORDS (MAX_RSA_MODULUS_BITS)
+#define MAX_RSA_PRIME_WORDS BITS_TO_WORDS (MAX_RSA_PRIME_BITS)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/lib/dns/sec/dnssafe/bigmodx.c
+++ b/lib/dns/sec/dnssafe/bigmodx.c
@@ -0,0 +1,25 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigModx (a, b, c, cInv, n) -- compute a as (b mod c).
+     -- assumes a and c of length n, cInv of length n + 2, b of length 2n.
+     -- assumes cInv computed with BigInv, and that b < c**2.
+ */
+void BigModx (a, b, c, cInv, n)
+UINT2 *a, *b, *c, *cInv;
+unsigned int n;
+{
+  UINT2 q[MAX_RSA_MODULUS_WORDS];
+
+  BigQrx (q, a, b, c, cInv, n);
+
+  T_memset ((POINTER)q, 0, sizeof (q));
+}
--- a/lib/dns/sec/dnssafe/bigmpy.c
+++ b/lib/dns/sec/dnssafe/bigmpy.c
@@ -0,0 +1,36 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigMpy (a, b, c, n) -- a = b * c
+     -- assumes b and c have n words, a has 2*n words
+     -- inputs may be positive or negative.
+ */
+void BigMpy (a, b, c, n)
+UINT2 *a, *b, *c;
+unsigned int n;
+{
+  UINT2 prod[2 * MAX_RSA_PRIME_WORDS], absb[MAX_RSA_PRIME_WORDS], 
+    absc[MAX_RSA_PRIME_WORDS];
+  int bSign = BigSign (b, n), cSign = BigSign (c, n);
+  
+  BigAbs (absb, b, n);
+  BigAbs (absc, c, n);
+  BigPmpy (prod, absb, absc, n);
+
+  if (bSign * cSign >= 0)
+    BigCopy (a, prod, 2 * n);
+  else 
+    BigNeg (a, prod, 2 * n);
+
+  T_memset ((POINTER)prod, 0, sizeof (prod));
+  T_memset ((POINTER)absb, 0, sizeof (absb));
+  T_memset ((POINTER)absc, 0, sizeof (absc));
+}
--- a/lib/dns/sec/dnssafe/bigpdiv.c
+++ b/lib/dns/sec/dnssafe/bigpdiv.c
@@ -0,0 +1,159 @@
+/* Copyright (C) RSA Data Security, Inc. created 1986, 1996.  This is an
+   unpublished work protected as such under copyright law.  This work
+   contains proprietary, confidential, and trade secret information of
+   RSA Data Security, Inc.  Use, disclosure or reproduction without the
+   express written authorization of RSA Data Security, Inc. is
+   prohibited.
+ */
+
+#include "global.h"
+#include "bigmath.h"
+
+/* BigPdiv          POSITIVE DIVIDE
+     uu=vv * qi+ri
+     uu in reg of ll cells
+     vv in reg of kk cells
+     qi assumed to be ll cells
+     ri assumed to be kk cells
+     restriction uu>=0, vv>0
+       
+     input  uu in reg of ll cells
+     input  vv in reg of kk cells
+     output qi assumed to be ll cells
+     output ri assumed to be kk cells
+     restriction uu>=0, vv>0
+     uu=vv * qi+ri
+ */
+#define UJN (u[(j+n)/2] & mk[(j+n)%2])
+#define VN (v[n/2] & mk[n%2])
+#define UT (u[t/2] & mk[t%2])
+void BigPdiv (qi, ri, uu, vv, ll, kk)
+UINT2 *qi, *ri, *uu, *vv;
+unsigned int ll, kk;
+{
+  UINT2 u[2 * MAX_RSA_PRIME_WORDS + 2], us[2 * MAX_RSA_PRIME_WORDS + 2], 
+    v[2 * MAX_RSA_PRIME_WORDS + 2], vs[2 * MAX_RSA_PRIME_WORDS + 2],
+    q[2 * MAX_RSA_PRIME_WORDS + 2], r[2 * MAX_RSA_PRIME_WORDS + 2],
+    t1[2 * MAX_RSA_PRIME_WORDS + 2], t2[2 * MAX_RSA_PRIME_WORDS + 2],
+    t3[2 * MAX_RSA_PRIME_WORDS + 2], mk[2];
+  int j, l, n, m, t, x;
+  unsigned int a, b, c, d, e, vh, qq;
+
+  if (ll >= kk)
+    l = ll + 2;
+  else
+    l = kk + 2;
+  
+  mk[0] = 0x00FF;
+  mk[1] = 0xFF00;
+  b = 0x0100;
+
+  BigConst (u, 0, l);
+  BigConst (v, 0, l);
+  BigCopy (u, uu, ll);
+  BigCopy (us, u, l);
+  BigCopy (v, vv, kk);
+  BigCopy (vs, v, l);
+
+  /* zero q */
+  BigConst (q, 0, l);
+
+  /* Calculate len of v=n.
+   */
+  for (n = (2 * l) - 1; n >= 0; n--) {
+    if (VN == 0)
+      continue;
+    break;
+  }
+
+  /* Normalize.
+   */
+  a = VN;
+  if (n % 2 == 1)
+    a = a >> 8;
+  d = b / (a+1);
+  BigConst (t1, d, l);
+  BigPmpyl (t2, t1, v, l);
+  BigCopy (v, t2, l);
+  
+  /* vh=high order digit of normalized v */
+  vh = VN;
+  if (n % 2 == 1)
+    vh = vh >> 8;
+  BigPmpyl (t2, t1, u, l);
+  BigCopy (u, t2, l);
+
+  /* Calculate len of u=t.
+   */
+  for (t = (2 * l)-1; t >= 0; t--) {
+    if (UT == 0)
+      continue;
+    break;
+  }
+  
+  /* calc t = n + m */
+  m = t - n;
+
+  /* Divide u by v.
+   */
+  for (j = m + 1 + n; j > n; j--) {
+    if (j % 2 == 1)
+      c = u[j / 2];
+    else {
+      a = u[j/2];
+      a = a << 8;
+      e = u[(j - 1) / 2];
+      e = e >> 8;
+      c = a + e;
+    }
+    a = c >> 8;
+    if (vh == a)
+      qq = b - 1;
+    else
+      qq = c / vh;
+
+    BigConst (t1, qq, l);
+    BigPmpyl (t2, v, t1, l);
+    Big2Exp (t3, (j - 1 - n) * 8, l);
+    BigPmpyl (t1, t3, t2, l);
+    BigSub (t2, u, t1, l);
+
+    /* Adjust q.
+     */
+    for (x = 0; ; qq --, x ++) {
+      if (BigSign (t2, l) != -1)
+        break;
+      BigPmpyl (t1, t3, v, l);
+      BigAdd (t2, t2, t1, l);
+    }
+
+    BigCopy (u, t2, l);
+    BigConst (t3, qq, l);
+    Big2Exp (t2, 8, l);
+    BigPmpyl (t1, q, t2, l);
+    BigAdd (q, t3, t1, l);
+  }
+  
+  /* Check result.
+   */
+
+  BigPmpyl (t1, vs, q, l);
+  /* t2 has remainder */
+  BigSub (t2, us, t1, l);
+
+  BigSub (t3, vs, t2, l);
+
+  /* transfer results to input registers  */
+  BigCopy (qi, q, ll);
+  BigCopy (ri, t2, kk);
+  
+  T_memset ((POINTER)u, 0, sizeof (u));
+  T_memset ((POINTER)us, 0, sizeof (us));
+  T_memset ((POINTER)v, 0, sizeof (v));
+  T_memset ((POINTER)vs, 0, sizeof (vs));
+  T_memset ((POINTER)q, 0, sizeof (q));
+  T_memset ((POINTER)r, 0, sizeof (r));
+  T_memset ((POINTER)t1, 0, sizeof (t1));
+  T_memset ((POINTER)t2, 0, sizeof (t2));
+  T_memset ((POINTER)t3, 0, sizeof (t3));
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`test. IN KEY 257 3 1 AQPQjwSpaVzxIgRCpiUoozUQKGh2oX8NIFKDOvtxK+tn536OZg2cROKTlgGEHXJK9YHfW/6nzQULTVpb63P+SQMmjCCidb8IYyhItixRztVeJQ==`
				`@@ -0,0 +1 @@`
				`test. IN KEY 16641 3 3 ANp1//lqDlEfTavcFI+cyudNfgEz73V/K7fSDvkA0eDYcGg/kSvEjAEO/oLWCERltkuC55ZcM/mSv17WF1d/wR6kww/pLI9eXwkjftAYqs5sNxk+mbEGl6zwve9wq5z7IoTY5/J4l7XLCKftg/wGvrzXQhggIkRvEh3myhxd+ouILcpfvTIthWlTKiH59tSJpmgmiSMTE7nDYaf10iVRWN6DMSprgejiH05/fpmyZAt44tyAh4m1wXS5u4tam1PXDJYJozn7EfQ8e2weIv1yC+t6PHSx`