--- openssl-0.9.7/crypto/engine/vendor_defns/ica_openssl_api.h.ibmca	2003-01-17 07:27:00.000000000 -0500
+++ openssl-0.9.7/crypto/engine/vendor_defns/ica_openssl_api.h	2003-01-17 07:27:00.000000000 -0500
@@ -0,0 +1,189 @@
+
+#ifndef __ICA_OPENSSL_API_H__
+#define __ICA_OPENSSL_API_H__
+
+/**
+ ** abstract data types for API
+ **/
+
+#define ICA_ADAPTER_HANDLE int
+
+#if defined(linux) || defined (_AIX)
+#define ICA_CALL 
+#endif
+
+#if defined(WIN32) || defined(_WIN32)
+#define ICA_CALL  __stdcall
+#endif
+
+/*------------------------------------------------*
+ | RSA defines and typedefs                       |
+ *------------------------------------------------*/
+ /*
+ * All data elements of the RSA key are in big-endian format
+ * Modulus-Exponent form of key
+ *
+ */
+ #define MAX_EXP_SIZE 256
+ #define MAX_MODULUS_SIZE 256
+ #define MAX_MODEXP_SIZE  (MAX_EXP_SIZE + MAX_MODULUS_SIZE)
+
+ #define MAX_OPERAND_SIZE  MAX_EXP_SIZE
+
+ typedef unsigned char ICA_KEY_RSA_MODEXPO_REC[MAX_MODEXP_SIZE];
+ /*
+ * All data elements of the RSA key are in big-endian format
+ * Chinese Remainder Thereom(CRT) form of key
+ * Used only for Decrypt, the encrypt form is typically Modulus-Exponent
+ *
+ */
+ #define MAX_BP_SIZE 136
+ #define MAX_BQ_SIZE 128
+ #define MAX_NP_SIZE 136
+ #define MAX_NQ_SIZE 128
+ #define MAX_QINV_SIZE 136
+ #define MAX_RSACRT_SIZE (MAX_BP_SIZE+MAX_BQ_SIZE+MAX_NP_SIZE+MAX_NQ_SIZE+MAX_QINV_SIZE)
+
+#define RSA_GEN_OPERAND_MAX   256 /* bytes */
+
+typedef unsigned char ICA_KEY_RSA_CRT_REC[MAX_RSACRT_SIZE];
+/*------------------------------------------------*
+ | RSA key token types                            |
+ *------------------------------------------------*/
+
+#define  RSA_PUBLIC_MODULUS_EXPONENT        3
+#define  RSA_PKCS_PRIVATE_CHINESE_REMAINDER 6
+
+#define KEYTYPE_MODEXPO         1
+#define KEYTYPE_PKCSCRT         2
+
+
+/*------------------------------------------------*
+ | RSA Key Token format                           |
+ *------------------------------------------------*/
+
+/*
+ * NOTE:  All the fields in the ICA_KEY_RSA_MODEXPO structure
+ *        (lengths, offsets, exponents, modulus, etc.) are
+ *        stored in big-endian format
+ */
+
+typedef struct _ICA_KEY_RSA_MODEXPO
+{   unsigned int  keyType;             /* RSA key type.               */
+    unsigned int  keyLength;           /* Total length of the token.  */
+    unsigned int  modulusBitLength;    /* Modulus n bit length.       */
+                                       /* -- Start of the data length.*/
+    unsigned int  nLength;             /* Modulus n = p * q           */
+    unsigned int  expLength;           /* exponent (public or private)*/
+                                       /*   e = 1/d * mod(p-1)(q-1)   */
+                                       /* -- Start of the data offsets*/
+    unsigned int  nOffset;             /* Modulus n .                 */
+    unsigned int  expOffset;           /* exponent (public or private)*/
+    unsigned char reserved[112];       /* reserved area               */
+                                       /* -- Start of the variable -- */
+                                       /* -- length token data.    -- */
+    ICA_KEY_RSA_MODEXPO_REC keyRecord;
+} ICA_KEY_RSA_MODEXPO;
+#define SZ_HEADER_MODEXPO (sizeof(ICA_KEY_RSA_MODEXPO) - sizeof(ICA_KEY_RSA_MODEXPO_REC))
+
+/*
+ * NOTE:  All the fields in the ICA_KEY_RSA_CRT structure
+ *        (lengths, offsets, exponents, modulus, etc.) are
+ *        stored in big-endian format
+ */
+
+typedef struct _ICA_KEY_RSA_CRT
+{   unsigned int  keyType;             /* RSA key type.               */
+    unsigned int  keyLength;           /* Total length of the token.  */
+    unsigned int  modulusBitLength;    /* Modulus n bit length.       */
+                                       /* -- Start of the data length.*/
+#if _AIX
+    unsigned int  nLength;             /* Modulus n = p * q           */
+#endif
+    unsigned int  pLength;             /* Prime number p .            */
+    unsigned int  qLength;             /* Prime number q .            */
+    unsigned int  dpLength;            /* dp = d * mod(p-1) .         */
+    unsigned int  dqLength;            /* dq = d * mod(q-1) .         */
+    unsigned int  qInvLength;          /* PKCS: qInv = Ap/q           */
+                                       /* -- Start of the data offsets*/
+#if _AIX
+    unsigned int  nOffset;             /* Modulus n .                 */
+#endif
+    unsigned int  pOffset;             /* Prime number p .            */
+    unsigned int  qOffset;             /* Prime number q .            */
+    unsigned int  dpOffset;            /* dp .                        */
+    unsigned int  dqOffset;            /* dq .                        */
+    unsigned int  qInvOffset;          /* qInv for PKCS               */
+#if _AIX
+    unsigned char reserved[80];        /* reserved area               */
+#else
+    unsigned char reserved[88];        /* reserved area               */
+#endif
+                                       /* -- Start of the variable -- */
+                                       /* -- length token data.    -- */
+    ICA_KEY_RSA_CRT_REC keyRecord;
+} ICA_KEY_RSA_CRT;
+#define SZ_HEADER_CRT (sizeof(ICA_KEY_RSA_CRT) - sizeof(ICA_KEY_RSA_CRT_REC))
+
+unsigned int
+icaOpenAdapter( unsigned int        adapterId,
+	        ICA_ADAPTER_HANDLE *pAdapterHandle );
+
+unsigned int
+icaCloseAdapter( ICA_ADAPTER_HANDLE adapterHandle );
+
+unsigned int
+icaRsaModExpo( ICA_ADAPTER_HANDLE    hAdapterHandle,
+	       unsigned int          inputDataLength,
+	       unsigned char        *pInputData,
+	       ICA_KEY_RSA_MODEXPO  *pKeyModExpo,
+	       unsigned int         *pOutputDataLength,
+	       unsigned char        *pOutputData );
+
+unsigned int
+icaRsaCrt( ICA_ADAPTER_HANDLE     hAdapterHandle,
+	   unsigned int           inputDataLength,
+	   unsigned char         *pInputData,
+	   ICA_KEY_RSA_CRT       *pKeyCrt,
+	   unsigned int          *pOutputDataLength,
+	   unsigned char         *pOutputData );
+
+unsigned int
+icaRandomNumberGenerate( ICA_ADAPTER_HANDLE  hAdapterHandle,
+			 unsigned int        outputDataLength,
+			 unsigned char      *pOutputData );
+
+/* Specific macros and definitions to not have IFDEF;s all over the
+   main code */
+
+#if (_AIX)
+static const char *IBMCA_LIBNAME = "/lib/libica.a(shr.o)";
+#elif (WIN32)
+static const char *IBMCA_LIBNAME = "cryptica";
+#else
+static const char *IBMCA_LIBNAME = "ica";
+#endif
+
+#if (WIN32)
+/*
+ The ICA_KEY_RSA_MODEXPO & ICA_KEY_RSA_CRT lengths and
+ offsets must be in big-endian format.
+
+*/
+#define CORRECT_ENDIANNESS(b) (  \
+                             (((unsigned long) (b) & 0x000000ff) << 24) |  \
+                             (((unsigned long) (b) & 0x0000ff00) <<  8) |  \
+                             (((unsigned long) (b) & 0x00ff0000) >>  8) |  \
+                             (((unsigned long) (b) & 0xff000000) >> 24)    \
+                             )
+#define CRT_KEY_TYPE   RSA_PKCS_PRIVATE_CHINESE_REMAINDER
+#define ME_KEY_TYPE    RSA_PUBLIC_MODULUS_EXPONENT
+#else
+#define CORRECT_ENDIANNESS(b) (b)
+#define CRT_KEY_TYPE       KEYTYPE_PKCSCRT
+#define ME_KEY_TYPE        KEYTYPE_MODEXPO
+#endif
+
+
+
+#endif   /* __ICA_OPENSSL_API_H__ */
--- openssl-0.9.7/crypto/engine/Makefile.ssl.ibmca	2002-10-11 08:23:49.000000000 -0400
+++ openssl-0.9.7/crypto/engine/Makefile.ssl	2003-01-17 07:28:57.000000000 -0500
@@ -28,13 +28,13 @@
 	tb_rsa.c tb_dsa.c tb_dh.c tb_rand.c tb_cipher.c tb_digest.c \
 	eng_openssl.c eng_dyn.c eng_cnf.c \
 	hw_atalla.c hw_cswift.c hw_ncipher.c hw_nuron.c hw_ubsec.c \
-	hw_cryptodev.c hw_aep.c hw_sureware.c hw_4758_cca.c
+	hw_cryptodev.c hw_aep.c hw_sureware.c hw_4758_cca.c hw_ibmca.c
 LIBOBJ= eng_err.o eng_lib.o eng_list.o eng_init.o eng_ctrl.o \
 	eng_table.o eng_pkey.o eng_fat.o eng_all.o \
 	tb_rsa.o tb_dsa.o tb_dh.o tb_rand.o tb_cipher.o tb_digest.o \
 	eng_openssl.o eng_dyn.o eng_cnf.o \
 	hw_atalla.o hw_cswift.o hw_ncipher.o hw_nuron.o hw_ubsec.o \
-	hw_cryptodev.o hw_aep.o hw_sureware.o hw_4758_cca.o
+	hw_cryptodev.o hw_aep.o hw_sureware.o hw_4758_cca.o hw_ibmca.o
 
 SRC= $(LIBSRC)
 
--- openssl-0.9.7/crypto/engine/eng_all.c.ibmca	2002-10-01 20:18:47.000000000 -0400
+++ openssl-0.9.7/crypto/engine/eng_all.c	2003-01-17 07:27:00.000000000 -0500
@@ -89,6 +89,9 @@
 #ifndef OPENSSL_NO_HW_AEP
 	ENGINE_load_aep();
 #endif
+#ifndef OPENSSL_NO_HW_IBMCA
+	ENGINE_load_ibmca();
+#endif
 #ifndef OPENSSL_NO_HW_SUREWARE
 	ENGINE_load_sureware();
 #endif
--- openssl-0.9.7/crypto/engine/eng_err.c.ibmca	2002-10-15 21:32:35.000000000 -0400
+++ openssl-0.9.7/crypto/engine/eng_err.c	2003-01-17 07:30:05.000000000 -0500
@@ -97,6 +97,12 @@
 {ERR_PACK(0,ENGINE_F_ENGINE_TABLE_REGISTER,0),	"ENGINE_TABLE_REGISTER"},
 {ERR_PACK(0,ENGINE_F_ENGINE_UNLOAD_KEY,0),	"ENGINE_UNLOAD_KEY"},
 {ERR_PACK(0,ENGINE_F_ENGINE_UP_REF,0),	"ENGINE_up_ref"},
+{ERR_PACK(0,ENGINE_F_IBMCA_FINISH,0), "IBMCA_FINISH"},
+{ERR_PACK(0,ENGINE_F_IBMCA_INIT,0),   "IBMCA_INIT"},
+{ERR_PACK(0,ENGINE_F_IBMCA_MOD_EXP,0),        "IBMCA_MOD_EXP"},
+{ERR_PACK(0,ENGINE_F_IBMCA_MOD_EXP_CRT,0),    "IBMCA_MOD_EXP_CRT"},
+{ERR_PACK(0,ENGINE_F_IBMCA_RAND_BYTES,0),     "IBMCA_RAND_BYTES"},
+{ERR_PACK(0,ENGINE_F_IBMCA_RSA_MOD_EXP,0),    "IBMCA_RSA_MOD_EXP"},
 {ERR_PACK(0,ENGINE_F_INT_CTRL_HELPER,0),	"INT_CTRL_HELPER"},
 {ERR_PACK(0,ENGINE_F_INT_ENGINE_CONFIGURE,0),	"INT_ENGINE_CONFIGURE"},
 {ERR_PACK(0,ENGINE_F_LOG_MESSAGE,0),	"LOG_MESSAGE"},
@@ -108,6 +114,8 @@
 	{
 {ENGINE_R_ALREADY_LOADED                 ,"already loaded"},
 {ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER       ,"argument is not a number"},
+{ENGINE_R_BN_CTX_FULL                    ,"bn ctx full"},
+{ENGINE_R_BN_EXPAND_FAIL                 ,"bn expand fail"},
 {ENGINE_R_CMD_NOT_EXECUTABLE             ,"cmd not executable"},
 {ENGINE_R_COMMAND_TAKES_INPUT            ,"command takes input"},
 {ENGINE_R_COMMAND_TAKES_NO_INPUT         ,"command takes no input"},
@@ -132,6 +140,7 @@
 {ENGINE_R_INVALID_CMD_NUMBER             ,"invalid cmd number"},
 {ENGINE_R_INVALID_INIT_VALUE             ,"invalid init value"},
 {ENGINE_R_INVALID_STRING                 ,"invalid string"},
+{ENGINE_R_MISSING_KEY_COMPONENTS         ,"missing key components"},
 {ENGINE_R_NOT_INITIALISED                ,"not initialised"},
 {ENGINE_R_NOT_LOADED                     ,"not loaded"},
 {ENGINE_R_NO_CONTROL_FUNCTION            ,"no control function"},
@@ -141,9 +150,11 @@
 {ENGINE_R_NO_SUCH_ENGINE                 ,"no such engine"},
 {ENGINE_R_NO_UNLOAD_FUNCTION             ,"no unload function"},
 {ENGINE_R_PROVIDE_PARAMETERS             ,"provide parameters"},
+{ENGINE_R_REQUEST_FAILED                 ,"request failed"},
 {ENGINE_R_RSA_NOT_IMPLEMENTED            ,"rsa not implemented"},
 {ENGINE_R_UNIMPLEMENTED_CIPHER           ,"unimplemented cipher"},
 {ENGINE_R_UNIMPLEMENTED_DIGEST           ,"unimplemented digest"},
+{ENGINE_R_UNIT_FAILURE                   ,"unit failure"},
 {ENGINE_R_VERSION_INCOMPATIBILITY        ,"version incompatibility"},
 {0,NULL}
 	};
--- openssl-0.9.7/crypto/engine/engine.h.ibmca	2003-01-17 07:26:59.000000000 -0500
+++ openssl-0.9.7/crypto/engine/engine.h	2003-01-17 07:31:31.000000000 -0500
@@ -305,6 +305,7 @@
 void ENGINE_load_nuron(void);
 void ENGINE_load_ubsec(void);
 void ENGINE_load_aep(void);
+void ENGINE_load_ibmca(void);
 void ENGINE_load_sureware(void);
 void ENGINE_load_4758cca(void);
 void ENGINE_load_cryptodev(void);
@@ -664,6 +665,12 @@
 #define ENGINE_F_ENGINE_TABLE_REGISTER			 184
 #define ENGINE_F_ENGINE_UNLOAD_KEY			 152
 #define ENGINE_F_ENGINE_UP_REF				 190
+#define ENGINE_F_IBMCA_FINISH                          191
+#define ENGINE_F_IBMCA_INIT                            192
+#define ENGINE_F_IBMCA_MOD_EXP                                 193
+#define ENGINE_F_IBMCA_MOD_EXP_CRT                     194
+#define ENGINE_F_IBMCA_RAND_BYTES                      195
+#define ENGINE_F_IBMCA_RSA_MOD_EXP                     196
 #define ENGINE_F_INT_CTRL_HELPER			 172
 #define ENGINE_F_INT_ENGINE_CONFIGURE			 188
 #define ENGINE_F_LOG_MESSAGE				 141
@@ -672,6 +679,8 @@
 /* Reason codes. */
 #define ENGINE_R_ALREADY_LOADED				 100
 #define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER		 133
+#define ENGINE_R_BN_CTX_FULL				 151
+#define ENGINE_R_BN_EXPAND_FAIL				 152
 #define ENGINE_R_CMD_NOT_EXECUTABLE			 134
 #define ENGINE_R_COMMAND_TAKES_INPUT			 135
 #define ENGINE_R_COMMAND_TAKES_NO_INPUT			 136
@@ -696,6 +705,7 @@
 #define ENGINE_R_INVALID_CMD_NUMBER			 138
 #define ENGINE_R_INVALID_INIT_VALUE			 151
 #define ENGINE_R_INVALID_STRING				 150
+#define ENGINE_R_MISSING_KEY_COMPONENTS			 153
 #define ENGINE_R_NOT_INITIALISED			 117
 #define ENGINE_R_NOT_LOADED				 112
 #define ENGINE_R_NO_CONTROL_FUNCTION			 120
@@ -705,9 +715,11 @@
 #define ENGINE_R_NO_SUCH_ENGINE				 116
 #define ENGINE_R_NO_UNLOAD_FUNCTION			 126
 #define ENGINE_R_PROVIDE_PARAMETERS			 113
+#define ENGINE_R_REQUEST_FAILED				 154
 #define ENGINE_R_RSA_NOT_IMPLEMENTED			 141
 #define ENGINE_R_UNIMPLEMENTED_CIPHER			 146
 #define ENGINE_R_UNIMPLEMENTED_DIGEST			 147
+#define ENGINE_R_UNIT_FAILURE				 155
 #define ENGINE_R_VERSION_INCOMPATIBILITY		 145
 
 #ifdef  __cplusplus
--- openssl-0.9.7/crypto/engine/hw_ibmca.c.ibmca	2003-01-17 07:27:00.000000000 -0500
+++ openssl-0.9.7/crypto/engine/hw_ibmca.c	2003-01-17 07:27:00.000000000 -0500
@@ -0,0 +1,824 @@
+/* crypto/engine/hw_ibmca.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* (C) COPYRIGHT International Business Machines Corp. 2001 */
+
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include "cryptlib.h"
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_IBMCA
+
+#ifdef FLAT_INC
+#include "ica_openssl_api.h"
+#else
+#include "vendor_defns/ica_openssl_api.h"
+#endif
+
+#define IBMCA_LIB_NAME "ibmca engine"
+#include "hw_ibmca_err.c"
+
+static int ibmca_destroy(ENGINE *e);
+static int ibmca_init(ENGINE *e);
+static int ibmca_finish(ENGINE *e);
+static int ibmca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+
+static const char *IBMCA_F1 = "icaOpenAdapter";
+static const char *IBMCA_F2 = "icaCloseAdapter";
+static const char *IBMCA_F3 = "icaRsaModExpo";
+static const char *IBMCA_F4 = "icaRandomNumberGenerate";
+static const char *IBMCA_F5 = "icaRsaCrt";
+
+ICA_ADAPTER_HANDLE handle=0;
+
+/* BIGNUM stuff */
+static int ibmca_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx);
+
+static int ibmca_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+        const BIGNUM *iqmp, BN_CTX *ctx);
+
+#ifndef OPENSSL_NO_RSA  
+/* RSA stuff */
+static int ibmca_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int ibmca_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+#ifndef OPENSSL_NO_DSA 
+/* DSA stuff */
+static int ibmca_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+        BN_CTX *ctx, BN_MONT_CTX *in_mont);
+static int ibmca_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx);
+#endif
+
+#ifndef OPENSSL_NO_DH 
+/* DH stuff */
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int ibmca_mod_exp_dh(const DH *dh, BIGNUM *r, 
+	const BIGNUM *a, const BIGNUM *p,
+	const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* RAND stuff */
+static int ibmca_rand_bytes(unsigned char *buf, int num);
+static int ibmca_rand_status(void);
+
+
+/* WJH - check for more commands, like in nuron */
+
+/* The definitions for control commands specific to this engine */
+#define IBMCA_CMD_SO_PATH		ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN ibmca_cmd_defns[] = {
+	{IBMCA_CMD_SO_PATH,
+		"SO_PATH",
+		"Specifies the path to the 'atasi' shared library",
+		ENGINE_CMD_FLAG_STRING},
+	{0, NULL, NULL, 0}
+	};
+
+#ifndef OPENSSL_NO_RSA  
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD ibmca_rsa =
+        {
+        "Ibmca RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        ibmca_rsa_mod_exp,
+        ibmca_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD ibmca_dsa =
+        {
+        "Ibmca DSA method",
+        NULL, /* dsa_do_sign */
+        NULL, /* dsa_sign_setup */
+        NULL, /* dsa_do_verify */
+        ibmca_dsa_mod_exp, /* dsa_mod_exp */
+        ibmca_mod_exp_dsa, /* bn_mod_exp */
+        NULL, /* init */
+        NULL, /* finish */
+        0, /* flags */
+        NULL /* app_data */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD ibmca_dh =
+        {
+        "Ibmca DH method",
+        NULL,
+        NULL,
+        ibmca_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL
+        };
+#endif
+
+static RAND_METHOD ibmca_rand =
+        {
+        /* "IBMCA RAND method", */
+        NULL,
+        ibmca_rand_bytes,
+        NULL,
+        NULL,
+        ibmca_rand_bytes,
+        ibmca_rand_status,
+        };
+
+/* Constants used when creating the ENGINE */
+static const char *engine_ibmca_id = "ibmca";
+static const char *engine_ibmca_name = "Ibmca hardware engine support";
+
+/* This internal function is used by ENGINE_ibmca() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+	{
+#ifndef OPENSSL_NO_RSA
+	const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+	const DSA_METHOD *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+	const DH_METHOD *meth3;
+#endif
+	if(!ENGINE_set_id(e, engine_ibmca_id) ||
+		!ENGINE_set_name(e, engine_ibmca_name) ||
+#ifndef OPENSSL_NO_RSA
+		!ENGINE_set_RSA(e, &ibmca_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+		!ENGINE_set_DSA(e, &ibmca_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+		!ENGINE_set_DH(e, &ibmca_dh) ||
+#endif
+		!ENGINE_set_RAND(e, &ibmca_rand) ||
+		!ENGINE_set_destroy_function(e, ibmca_destroy) ||
+		!ENGINE_set_init_function(e, ibmca_init) ||
+		!ENGINE_set_finish_function(e, ibmca_finish) ||
+		!ENGINE_set_ctrl_function(e, ibmca_ctrl) ||
+		!ENGINE_set_cmd_defns(e, ibmca_cmd_defns))
+		return 0;
+
+#ifndef OPENSSL_NO_RSA
+	/* We know that the "PKCS1_SSLeay()" functions hook properly
+	 * to the ibmca-specific mod_exp and mod_exp_crt so we use
+	 * those functions. NB: We don't use ENGINE_openssl() or
+	 * anything "more generic" because something like the RSAref
+	 * code may not hook properly, and if you own one of these
+	 * cards then you have the right to do RSA operations on it
+	 * anyway! */ 
+	meth1 = RSA_PKCS1_SSLeay();
+	ibmca_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+	ibmca_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+	ibmca_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+	ibmca_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+	/* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+	 * bits. */
+	meth2 = DSA_OpenSSL();
+	ibmca_dsa.dsa_do_sign = meth2->dsa_do_sign;
+	ibmca_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
+	ibmca_dsa.dsa_do_verify = meth2->dsa_do_verify;
+#endif
+
+#ifndef OPENSSL_NO_DH
+	/* Much the same for Diffie-Hellman */
+	meth3 = DH_OpenSSL();
+	ibmca_dh.generate_key = meth3->generate_key;
+	ibmca_dh.compute_key = meth3->compute_key;
+#endif
+
+	/* Ensure the ibmca error handling is set up */
+	ERR_load_IBMCA_strings(); 
+	return 1;
+	}
+
+static ENGINE *engine_ibmca(void)
+	{
+	ENGINE *ret = ENGINE_new();
+	if(!ret)
+		return NULL;
+	if(!bind_helper(ret))
+		{
+		ENGINE_free(ret);
+		return NULL;
+		}
+	return ret;
+	}
+
+void ENGINE_load_ibmca(void)
+	{
+	/* Copied from eng_[openssl|dyn].c */
+	ENGINE *toadd = engine_ibmca();
+	if(!toadd) return;
+	ENGINE_add(toadd);
+	ENGINE_free(toadd);
+	ERR_clear_error();
+	}
+
+/* Destructor (complements the "ENGINE_ibmca()" constructor) */
+static int ibmca_destroy(ENGINE *e)
+	{
+	/* Unload the ibmca error strings so any error state including our
+	 * functs or reasons won't lead to a segfault (they simply get displayed
+	 * without corresponding string data because none will be found). */
+        ERR_unload_IBMCA_strings(); 
+	return 1;
+	}
+
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Ibmca library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+
+static DSO *ibmca_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+
+static unsigned int    (ICA_CALL *p_icaOpenAdapter)();
+static unsigned int    (ICA_CALL *p_icaCloseAdapter)();
+static unsigned int    (ICA_CALL *p_icaRsaModExpo)();
+static unsigned int    (ICA_CALL *p_icaRandomNumberGenerate)();
+static unsigned int    (ICA_CALL *p_icaRsaCrt)();
+
+/* utility function to obtain a context */
+static int get_context(ICA_ADAPTER_HANDLE *p_handle)
+        {
+        unsigned int status=0;
+
+        status = p_icaOpenAdapter(0, p_handle);
+        if(status != 0)
+                return 0;
+        return 1;
+        }
+
+/* similarly to release one. */
+static void release_context(ICA_ADAPTER_HANDLE handle)
+        {
+        p_icaCloseAdapter(handle);
+        }
+
+/* (de)initialisation functions. */
+static int ibmca_init(ENGINE *e)
+        {
+
+        void          (*p1)();
+        void          (*p2)();
+        void          (*p3)();
+        void          (*p4)();
+        void          (*p5)();
+
+        if(ibmca_dso != NULL)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_INIT,ENGINE_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* Attempt to load libatasi.so/atasi.dll/whatever. Needs to be
+         * changed unfortunately because the Ibmca drivers don't have
+         * standard library names that can be platform-translated well. */
+        /* TODO: Work out how to actually map to the names the Ibmca
+         * drivers really use - for now a symbollic link needs to be
+         * created on the host system from libatasi.so to atasi.so on
+         * unix variants. */
+
+	/* WJH XXX check name translation */
+
+        ibmca_dso = DSO_load(NULL, IBMCA_LIBNAME, NULL,
+			     /* DSO_FLAG_NAME_TRANSLATION */ 0);
+        if(ibmca_dso == NULL)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_INIT,ENGINE_R_DSO_FAILURE);
+                goto err;
+                }
+
+        if(!(p1 = DSO_bind_func(
+                ibmca_dso, IBMCA_F1)) ||
+                !(p2 = DSO_bind_func(
+                        ibmca_dso, IBMCA_F2)) ||
+                !(p3 = DSO_bind_func(
+                        ibmca_dso, IBMCA_F3)) ||
+                !(p4 = DSO_bind_func(
+                        ibmca_dso, IBMCA_F4)) ||
+                !(p5 = DSO_bind_func(
+                        ibmca_dso, IBMCA_F5)))
+                {
+                IBMCAerr(ENGINE_F_IBMCA_INIT,ENGINE_R_DSO_FAILURE);
+                goto err;
+                }
+
+        /* Copy the pointers */
+
+	p_icaOpenAdapter =           (unsigned int (ICA_CALL *)())p1;
+	p_icaCloseAdapter =          (unsigned int (ICA_CALL *)())p2;
+	p_icaRsaModExpo =            (unsigned int (ICA_CALL *)())p3;
+	p_icaRandomNumberGenerate =  (unsigned int (ICA_CALL *)())p4;
+	p_icaRsaCrt =                (unsigned int (ICA_CALL *)())p5;
+
+        if(!get_context(&handle))
+                {
+                IBMCAerr(ENGINE_F_IBMCA_INIT,ENGINE_R_UNIT_FAILURE);
+                goto err;
+                }
+
+        return 1;
+ err:
+        if(ibmca_dso)
+                DSO_free(ibmca_dso);
+
+        p_icaOpenAdapter = NULL;
+        p_icaCloseAdapter = NULL;
+        p_icaRsaModExpo = NULL;
+        p_icaRandomNumberGenerate = NULL;
+
+        return 0;
+        }
+
+static int ibmca_finish(ENGINE *e)
+        {
+        if(ibmca_dso == NULL)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_FINISH,ENGINE_R_NOT_LOADED);
+                return 0;
+                }
+        release_context(handle);
+        if(!DSO_free(ibmca_dso))
+                {
+                IBMCAerr(ENGINE_F_IBMCA_FINISH,ENGINE_R_DSO_FAILURE);
+                return 0;
+                }
+        ibmca_dso = NULL;
+
+        return 1;
+        }
+
+static int ibmca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+	{
+	int initialised = ((ibmca_dso == NULL) ? 0 : 1);
+	switch(cmd)
+		{
+	case IBMCA_CMD_SO_PATH:
+		if(p == NULL)
+			{
+			IBMCAerr(IBMCA_F_IBMCA_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+			return 0;
+			}
+		if(initialised)
+			{
+			IBMCAerr(IBMCA_F_IBMCA_CTRL,IBMCA_R_ALREADY_LOADED);
+			return 0;
+			}
+		IBMCA_LIBNAME = (const char *)p;
+		return 1;
+	default:
+		break;
+		}
+	IBMCAerr(IBMCA_F_IBMCA_CTRL,IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+	return 0;
+	}
+
+
+static int ibmca_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx)
+        {
+        /* I need somewhere to store temporary serialised values for
+         * use with the Ibmca API calls. A neat cheat - I'll use
+         * BIGNUMs from the BN_CTX but access their arrays directly as
+         * byte arrays <grin>. This way I don't have to clean anything
+         * up. */
+
+        BIGNUM *argument=NULL;
+        BIGNUM *result=NULL;
+        BIGNUM *key=NULL;
+        int to_return;
+	int inLen, outLen, tmpLen;
+
+
+        ICA_KEY_RSA_MODEXPO *publKey=NULL;
+        unsigned int rc;
+
+        to_return = 0; /* expect failure */
+
+        if(!ibmca_dso)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP,ENGINE_R_NOT_LOADED);
+                goto err;
+                }
+        /* Prepare the params */
+	BN_CTX_start(ctx);
+        argument = BN_CTX_get(ctx);
+        result = BN_CTX_get(ctx);
+        key = BN_CTX_get(ctx);
+
+        if( !argument || !result || !key)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP,ENGINE_R_BN_CTX_FULL);
+                goto err;
+                }
+
+
+	if(!bn_wexpand(argument, m->top) || !bn_wexpand(result, m->top) ||
+                !bn_wexpand(key, sizeof(*publKey)/BN_BYTES))
+
+                {
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP,ENGINE_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+
+        publKey = (ICA_KEY_RSA_MODEXPO *)key->d;
+
+        if (publKey == NULL)
+                {
+                goto err;
+                }
+        memset(publKey, 0, sizeof(ICA_KEY_RSA_MODEXPO));
+
+        publKey->keyType   =  CORRECT_ENDIANNESS(ME_KEY_TYPE);
+        publKey->keyLength =  CORRECT_ENDIANNESS(sizeof(ICA_KEY_RSA_MODEXPO));
+        publKey->expOffset =  (char *) publKey->keyRecord - (char *) publKey;
+
+        /* A quirk of the card: the exponent length has to be the same
+     as the modulus (key) length */
+
+	outLen = BN_num_bytes(m);
+
+	publKey->expLength = publKey->nLength = outLen;
+        BN_bn2bin(p, &publKey->keyRecord[publKey->expLength -
+                BN_num_bytes(p)]);
+        BN_bn2bin(m, &publKey->keyRecord[publKey->expLength]);
+
+
+
+        publKey->modulusBitLength = CORRECT_ENDIANNESS(publKey->nLength * 8);
+        publKey->nOffset   = CORRECT_ENDIANNESS(publKey->expOffset + 
+						publKey->expLength);
+
+        publKey->expOffset = CORRECT_ENDIANNESS((char *) publKey->keyRecord - 
+						(char *) publKey);
+
+	tmpLen = outLen;
+	publKey->expLength = publKey->nLength = CORRECT_ENDIANNESS(tmpLen);
+
+  /* Prepare the argument */
+
+	memset(argument->d, 0, outLen);
+	BN_bn2bin(a, (unsigned char *)argument->d + outLen -
+                 BN_num_bytes(a));
+
+	inLen = outLen;
+
+  /* Perform the operation */
+
+          if( (rc = p_icaRsaModExpo(handle, inLen,(unsigned char *)argument->d,
+                publKey, &outLen, (unsigned char *)result->d))
+                !=0 )
+
+                {
+                printf("rc = %d\n", rc);
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP,ENGINE_R_REQUEST_FAILED);
+                goto err;
+                }
+
+
+        /* Convert the response */
+        BN_bin2bn((unsigned char *)result->d, outLen, r);
+        to_return = 1;
+ err:
+	BN_CTX_end(ctx);
+        return to_return;
+        }
+
+#ifndef OPENSSL_NO_RSA 
+static int ibmca_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+        {
+        BN_CTX *ctx;
+        int to_return = 0;
+
+        if((ctx = BN_CTX_new()) == NULL)
+                goto err;
+        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+                {
+                if(!rsa->d || !rsa->n)
+                        {
+                        IBMCAerr(ENGINE_F_IBMCA_RSA_MOD_EXP,
+                                ENGINE_R_MISSING_KEY_COMPONENTS);
+                        goto err;
+                        }
+                to_return = ibmca_mod_exp(r0, I, rsa->d, rsa->n, ctx);
+                }
+        else
+                {
+                to_return = ibmca_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
+                        rsa->dmq1, rsa->iqmp, ctx);
+                }
+ err:
+        if(ctx)
+                BN_CTX_free(ctx);
+        return to_return;
+        }
+#endif
+
+/* Ein kleines chinesisches "Restessen"  */
+static int ibmca_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *q, const BIGNUM *dmp1,
+        const BIGNUM *dmq1, const BIGNUM *iqmp, BN_CTX *ctx)
+        {
+
+        BIGNUM *argument = NULL;
+        BIGNUM *result = NULL;
+        BIGNUM *key = NULL;
+
+        int to_return = 0; /* expect failure */
+
+        char                *pkey=NULL;
+        ICA_KEY_RSA_CRT     *privKey=NULL;
+        int inLen, outLen;
+
+        int rc;
+        unsigned int        offset, pSize, qSize;
+
+        /* Prepare the params */
+
+	BN_CTX_start(ctx);
+        argument = BN_CTX_get(ctx);
+        result = BN_CTX_get(ctx);
+        key = BN_CTX_get(ctx);
+
+        if(!argument || !result || !key)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP_CRT,ENGINE_R_BN_CTX_FULL);
+                goto err;
+                }
+
+	if(!bn_wexpand(argument, p->top + q->top) ||
+                !bn_wexpand(result, p->top + q->top) ||
+                !bn_wexpand(key, sizeof(*privKey)/BN_BYTES ))
+                {
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP_CRT,ENGINE_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+
+        privKey = (ICA_KEY_RSA_CRT *)key->d;
+        memset(privKey, 0, sizeof(ICA_KEY_RSA_CRT));
+        privKey->keyType =  CORRECT_ENDIANNESS(CRT_KEY_TYPE);
+        privKey->keyLength = CORRECT_ENDIANNESS(sizeof(ICA_KEY_RSA_CRT));
+        privKey->modulusBitLength = 
+	  CORRECT_ENDIANNESS(BN_num_bytes(q) * 2 * 8);
+
+        /*
+         * p,dp & qInv are 1 QWORD Larger
+         */
+        privKey->pLength = CORRECT_ENDIANNESS(BN_num_bytes(p)+8);
+        privKey->qLength = CORRECT_ENDIANNESS(BN_num_bytes(q));
+        privKey->dpLength = CORRECT_ENDIANNESS(BN_num_bytes(dmp1)+8);
+        privKey->dqLength = CORRECT_ENDIANNESS(BN_num_bytes(dmq1));
+        privKey->qInvLength = CORRECT_ENDIANNESS(BN_num_bytes(iqmp)+8);
+
+        offset = (char *) privKey->keyRecord
+                  - (char *) privKey;
+
+        qSize = BN_num_bytes(q);
+        pSize = qSize + 8;   /*  1 QWORD larger */
+
+        privKey->dpOffset = CORRECT_ENDIANNESS(offset);
+
+	offset += pSize;
+	privKey->dqOffset = CORRECT_ENDIANNESS(offset);
+
+	offset += qSize;
+	privKey->pOffset = CORRECT_ENDIANNESS(offset);
+
+	offset += pSize;
+	privKey->qOffset = CORRECT_ENDIANNESS(offset);
+
+	offset += qSize;
+	privKey->qInvOffset = CORRECT_ENDIANNESS(offset);
+
+        pkey = (char *) privKey->keyRecord;
+        pkey += pSize - BN_num_bytes(p);
+        BN_bn2bin(dmp1, pkey);
+        pkey += BN_num_bytes(dmp1);
+        BN_bn2bin(dmq1, pkey);
+        pkey += qSize + pSize - BN_num_bytes(p);
+        BN_bn2bin(p, pkey);
+        pkey += BN_num_bytes(p);
+        BN_bn2bin(q, pkey);
+        pkey += qSize + pSize - BN_num_bytes(iqmp);
+        BN_bn2bin(iqmp, pkey);
+
+        /* Prepare the argument and response */
+
+	outLen = CORRECT_ENDIANNESS(privKey->qLength) * 2;
+        BN_bn2bin(a, (unsigned char *)argument->d + outLen -
+                          BN_num_bytes(a));
+        inLen = outLen;
+
+        memset(result->d, 0, outLen);
+
+        /* Perform the operation */
+
+        if ( (rc = p_icaRsaCrt(handle, inLen, (unsigned char *)argument->d,
+                privKey, &outLen, (unsigned char *)result->d)) != 0)
+                {
+                printf("rc = %d\n", rc);
+                IBMCAerr(ENGINE_F_IBMCA_MOD_EXP_CRT,ENGINE_R_REQUEST_FAILED);
+                goto err;
+                }
+
+        /* Convert the response */
+
+        BN_bin2bn((unsigned char *)result->d, outLen, r);
+        to_return = 1;
+
+ err:
+	BN_CTX_end(ctx);
+        return to_return;
+
+        }
+
+#ifndef OPENSSL_NO_DSA
+/* This code was liberated and adapted from the commented-out code in
+ * dsa_ossl.c. Because of the unoptimised form of the Ibmca acceleration
+ * (it doesn't have a CRT form for RSA), this function means that an
+ * Ibmca system running with a DSA server certificate can handshake
+ * around 5 or 6 times faster/more than an equivalent system running with
+ * RSA. Just check out the "signs" statistics from the RSA and DSA parts
+ * of "openssl speed -engine ibmca dsa1024 rsa1024". */
+static int ibmca_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+        BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int to_return = 0;
+
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!ibmca_mod_exp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!ibmca_mod_exp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        to_return = 1;
+ end:
+        BN_free(&t);
+        return to_return;
+        }
+
+
+static int ibmca_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx)
+        {
+        return ibmca_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int ibmca_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return ibmca_mod_exp(r, a, p, m, ctx);
+        }
+
+#ifndef OPENSSL_NO_DH 
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int ibmca_mod_exp_dh(DH const *dh, BIGNUM *r, 
+	const BIGNUM *a, const BIGNUM *p, 
+	const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return ibmca_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* Random bytes are good */
+static int ibmca_rand_bytes(unsigned char *buf, int num)
+        {
+        int to_return = 0; /* assume failure */
+        unsigned int ret;
+
+
+        if(handle == 0)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_RAND_BYTES,ENGINE_R_NOT_INITIALISED);
+                goto err;
+                }
+
+        ret = p_icaRandomNumberGenerate(handle, num, buf);
+        if (ret < 0)
+                {
+                IBMCAerr(ENGINE_F_IBMCA_RAND_BYTES,ENGINE_R_REQUEST_FAILED);
+                goto err;
+                }
+        to_return = 1;
+ err:
+        return to_return;
+        }
+
+static int ibmca_rand_status(void)
+        {
+        return 1;
+        }
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_fn(ENGINE *e, const char *id)
+	{
+	  if(id && (strcmp(id, engine_ibmca_id) != 0))  /* WJH XXX */
+		return 0;
+	if(!bind_helper(e))
+		return 0;
+	return 1;
+	}
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+
+
+#endif /* !OPENSSL_NO_HW_IBMCA */
+#endif /* !OPENSSL_NO_HW */
--- openssl-0.9.7/crypto/engine/hw_ibmca_err.c.ibmca	2003-01-17 07:27:00.000000000 -0500
+++ openssl-0.9.7/crypto/engine/hw_ibmca_err.c	2003-01-17 07:27:00.000000000 -0500
@@ -0,0 +1,145 @@
+/* hw_ibmca_err.c */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_ibmca_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA IBMCA_str_functs[]=
+	{
+{ERR_PACK(0,IBMCA_F_IBMCA_CTRL,0),	"IBMCA_CTRL"},
+{ERR_PACK(0,IBMCA_F_IBMCA_FINISH,0),	"IBMCA_FINISH"},
+{ERR_PACK(0,IBMCA_F_IBMCA_INIT,0),	"IBMCA_INIT"},
+{ERR_PACK(0,IBMCA_F_IBMCA_MOD_EXP,0),	"IBMCA_MOD_EXP"},
+{ERR_PACK(0,IBMCA_F_IBMCA_RSA_MOD_EXP,0),	"IBMCA_RSA_MOD_EXP"},
+{0,NULL}
+	};
+
+static ERR_STRING_DATA IBMCA_str_reasons[]=
+	{
+{IBMCA_R_ALREADY_LOADED                 ,"already loaded"},
+{IBMCA_R_BN_CTX_FULL                    ,"bn ctx full"},
+{IBMCA_R_BN_EXPAND_FAIL                 ,"bn expand fail"},
+{IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
+{IBMCA_R_MISSING_KEY_COMPONENTS         ,"missing key components"},
+{IBMCA_R_NOT_LOADED                     ,"not loaded"},
+{IBMCA_R_REQUEST_FAILED                 ,"request failed"},
+{IBMCA_R_UNIT_FAILURE                   ,"unit failure"},
+{0,NULL}
+	};
+
+#endif
+
+#ifdef IBMCA_LIB_NAME
+static ERR_STRING_DATA IBMCA_lib_name[]=
+        {
+{0	,IBMCA_LIB_NAME},
+{0,NULL}
+	};
+#endif
+
+
+static int IBMCA_lib_error_code=0;
+static int IBMCA_error_init=1;
+
+static void ERR_load_IBMCA_strings(void)
+	{
+	if (IBMCA_lib_error_code == 0)
+		IBMCA_lib_error_code=ERR_get_next_error_library();
+
+	if (IBMCA_error_init)
+		{
+		IBMCA_error_init=0;
+#ifndef OPENSSL_NO_ERR
+		ERR_load_strings(IBMCA_lib_error_code,IBMCA_str_functs);
+		ERR_load_strings(IBMCA_lib_error_code,IBMCA_str_reasons);
+#endif
+
+#ifdef IBMCA_LIB_NAME
+		IBMCA_lib_name->error = ERR_PACK(IBMCA_lib_error_code,0,0);
+		ERR_load_strings(0,IBMCA_lib_name);
+#endif
+		}
+	}
+
+static void ERR_unload_IBMCA_strings(void)
+	{
+	if (IBMCA_error_init == 0)
+		{
+#ifndef OPENSSL_NO_ERR
+		ERR_unload_strings(IBMCA_lib_error_code,IBMCA_str_functs);
+		ERR_unload_strings(IBMCA_lib_error_code,IBMCA_str_reasons);
+#endif
+
+#ifdef IBMCA_LIB_NAME
+		ERR_unload_strings(0,IBMCA_lib_name);
+#endif
+		IBMCA_error_init=1;
+		}
+	}
+
+static void ERR_IBMCA_error(int function, int reason, char *file, int line)
+	{
+	if (IBMCA_lib_error_code == 0)
+		IBMCA_lib_error_code=ERR_get_next_error_library();
+	ERR_PUT_error(IBMCA_lib_error_code,function,reason,file,line);
+	}
--- openssl-0.9.7/crypto/engine/hw_ibmca_err.h.ibmca	2003-01-17 07:27:00.000000000 -0500
+++ openssl-0.9.7/crypto/engine/hw_ibmca_err.h	2003-01-17 07:27:00.000000000 -0500
@@ -0,0 +1,89 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_IBMCA_ERR_H
+#define HEADER_IBMCA_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_IBMCA_strings(void);
+static void ERR_unload_IBMCA_strings(void);
+static void ERR_IBMCA_error(int function, int reason, char *file, int line);
+#define IBMCAerr(f,r) ERR_IBMCA_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the IBMCA functions. */
+
+/* Function codes. */
+#define IBMCA_F_IBMCA_CTRL				 100
+#define IBMCA_F_IBMCA_FINISH				 101
+#define IBMCA_F_IBMCA_INIT				 102
+#define IBMCA_F_IBMCA_MOD_EXP				 103
+#define IBMCA_F_IBMCA_RSA_MOD_EXP			 104
+
+/* Reason codes. */
+#define IBMCA_R_ALREADY_LOADED				 100
+#define IBMCA_R_BN_CTX_FULL				 101
+#define IBMCA_R_BN_EXPAND_FAIL				 102
+#define IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED		 103
+#define IBMCA_R_MISSING_KEY_COMPONENTS			 104
+#define IBMCA_R_NOT_LOADED				 105
+#define IBMCA_R_REQUEST_FAILED				 106
+#define IBMCA_R_UNIT_FAILURE				 107
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
