Merge remote-tracking branch 'upstream/maint'

19 files changed, 1067 insertions, 829 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 98ebb21f29..00abeb9990 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -142,6 +142,19 @@
   (s)[3] = (char)((i) & 0xff);\
 }
 
+/* This shall correspond to the similar macro in crypto.erl */
+/* Current value is: erlang:system_info(context_reductions) * 10 */
+#define MAX_BYTES_TO_NIF 20000 
+
+#define CONSUME_REDS(NifEnv, Ibin)			\
+do {							\
+    int _cost = ((Ibin).size  * 100) / MAX_BYTES_TO_NIF;\
+    if (_cost) {                                        \
+        (void) enif_consume_timeslice((NifEnv),		\
+	          (_cost > 100) ? 100 : _cost);		\
+    }                                                   \
+ } while (0)
+
 /* NIF interface declarations */
 static int load(ErlNifEnv* env, void** priv_data, ERL_NIF_TERM load_info);
 static int upgrade(ErlNifEnv* env, void** priv_data, void** old_priv_data, ERL_NIF_TERM load_info);
@@ -208,7 +221,7 @@ static ERL_NIF_TERM mod_exp_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
 static ERL_NIF_TERM dss_verify_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM rsa_verify_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM aes_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
-static ERL_NIF_TERM exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM do_exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM rc4_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM rc4_set_key(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM rc4_encrypt_with_state(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
@@ -338,7 +351,7 @@ static ErlNifFunc nif_funcs[] = {
     {"dss_verify_nif", 4, dss_verify_nif},
     {"rsa_verify_nif", 4, rsa_verify_nif},
     {"aes_cbc_crypt", 4, aes_cbc_crypt},
-    {"exor", 2, exor},
+    {"do_exor", 2, do_exor},
     {"rc4_encrypt", 2, rc4_encrypt},
     {"rc4_set_key", 1, rc4_set_key},
     {"rc4_encrypt_with_state", 2, rc4_encrypt_with_state},
@@ -778,6 +791,7 @@ static ERL_NIF_TERM md5(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
     }
     MD5((unsigned char *) ibin.data, ibin.size,
 	enif_make_new_binary(env,MD5_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 }
 static ERL_NIF_TERM md5_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -799,6 +813,7 @@ static ERL_NIF_TERM md5_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     new_ctx = (MD5_CTX*) enif_make_new_binary(env,MD5_CTX_LEN, &ret);
     memcpy(new_ctx, ctx_bin.data, MD5_CTX_LEN);
     MD5_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 static ERL_NIF_TERM md5_final(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -820,10 +835,11 @@ static ERL_NIF_TERM ripemd160(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[
     ERL_NIF_TERM ret;
 
     if (!enif_inspect_iolist_as_binary(env, argv[0], &ibin)) {
-  return enif_make_badarg(env);
+	return enif_make_badarg(env);
     }
     RIPEMD160((unsigned char *) ibin.data, ibin.size,
-  enif_make_new_binary(env,RIPEMD160_LEN, &ret));
+	      enif_make_new_binary(env,RIPEMD160_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 }
 static ERL_NIF_TERM ripemd160_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -838,13 +854,14 @@ static ERL_NIF_TERM ripemd160_update(ErlNifEnv* env, int argc, const ERL_NIF_TER
     ErlNifBinary ctx_bin, data_bin;
     ERL_NIF_TERM ret;
     if (!enif_inspect_binary(env, argv[0], &ctx_bin)
-  || ctx_bin.size != RIPEMD160_CTX_LEN
-  || !enif_inspect_iolist_as_binary(env, argv[1], &data_bin)) {
-  return enif_make_badarg(env);
+	|| ctx_bin.size != RIPEMD160_CTX_LEN
+	|| !enif_inspect_iolist_as_binary(env, argv[1], &data_bin)) {
+	return enif_make_badarg(env);
     }
     new_ctx = (RIPEMD160_CTX*) enif_make_new_binary(env,RIPEMD160_CTX_LEN, &ret);
     memcpy(new_ctx, ctx_bin.data, RIPEMD160_CTX_LEN);
     RIPEMD160_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env, data_bin);
     return ret;
 }
 static ERL_NIF_TERM ripemd160_final(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -853,7 +870,7 @@ static ERL_NIF_TERM ripemd160_final(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     RIPEMD160_CTX ctx_clone;
     ERL_NIF_TERM ret;
     if (!enif_inspect_binary(env, argv[0], &ctx_bin) || ctx_bin.size != RIPEMD160_CTX_LEN) {
-  return enif_make_badarg(env);
+	return enif_make_badarg(env);
     }
     memcpy(&ctx_clone, ctx_bin.data, RIPEMD160_CTX_LEN); /* writable */
     RIPEMD160_Final(enif_make_new_binary(env, RIPEMD160_LEN, &ret), &ctx_clone);
@@ -871,6 +888,7 @@ static ERL_NIF_TERM sha(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
     }
     SHA1((unsigned char *) ibin.data, ibin.size,
 	 enif_make_new_binary(env,SHA_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 }
 static ERL_NIF_TERM sha_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -891,6 +909,7 @@ static ERL_NIF_TERM sha_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     new_ctx = (SHA_CTX*) enif_make_new_binary(env,SHA_CTX_LEN, &ret);
     memcpy(new_ctx, ctx_bin.data, SHA_CTX_LEN);
     SHA1_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 static ERL_NIF_TERM sha_final(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -917,6 +936,7 @@ static ERL_NIF_TERM sha224_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     }
     SHA224((unsigned char *) ibin.data, ibin.size,
 	 enif_make_new_binary(env,SHA224_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 #else
     return atom_notsup;
@@ -945,6 +965,7 @@ static ERL_NIF_TERM sha224_update_nif(ErlNifEnv* env, int argc, const ERL_NIF_TE
     new_ctx = (SHA256_CTX*) enif_make_new_binary(env,sizeof(SHA256_CTX), &ret);
     memcpy(new_ctx, ctx_bin.data, sizeof(SHA256_CTX));
     SHA224_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 #else
     return atom_notsup;
@@ -978,6 +999,7 @@ static ERL_NIF_TERM sha256_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     }
     SHA256((unsigned char *) ibin.data, ibin.size,
 	 enif_make_new_binary(env,SHA256_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 #else
     return atom_notsup;
@@ -1006,6 +1028,7 @@ static ERL_NIF_TERM sha256_update_nif(ErlNifEnv* env, int argc, const ERL_NIF_TE
     new_ctx = (SHA256_CTX*) enif_make_new_binary(env,sizeof(SHA256_CTX), &ret);
     memcpy(new_ctx, ctx_bin.data, sizeof(SHA256_CTX));
     SHA256_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 #else
     return atom_notsup;
@@ -1039,6 +1062,7 @@ static ERL_NIF_TERM sha384_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     }
     SHA384((unsigned char *) ibin.data, ibin.size,
 	 enif_make_new_binary(env,SHA384_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 #else
     return atom_notsup;
@@ -1067,6 +1091,7 @@ static ERL_NIF_TERM sha384_update_nif(ErlNifEnv* env, int argc, const ERL_NIF_TE
     new_ctx = (SHA512_CTX*) enif_make_new_binary(env,sizeof(SHA512_CTX), &ret);
     memcpy(new_ctx, ctx_bin.data, sizeof(SHA512_CTX));
     SHA384_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 #else
     return atom_notsup;
@@ -1100,6 +1125,7 @@ static ERL_NIF_TERM sha512_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     }
     SHA512((unsigned char *) ibin.data, ibin.size,
 	 enif_make_new_binary(env,SHA512_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 #else
     return atom_notsup;
@@ -1128,6 +1154,7 @@ static ERL_NIF_TERM sha512_update_nif(ErlNifEnv* env, int argc, const ERL_NIF_TE
     new_ctx = (SHA512_CTX*) enif_make_new_binary(env,sizeof(SHA512_CTX), &ret);
     memcpy(new_ctx, ctx_bin.data, sizeof(SHA512_CTX));
     SHA512_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 #else
     return atom_notsup;
@@ -1161,6 +1188,7 @@ static ERL_NIF_TERM md4(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
     }
     MD4((unsigned char *) ibin.data, ibin.size,
 	enif_make_new_binary(env,MD4_LEN, &ret));
+    CONSUME_REDS(env,ibin);
     return ret;
 }
 static ERL_NIF_TERM md4_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -1181,6 +1209,7 @@ static ERL_NIF_TERM md4_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv
     new_ctx = (MD4_CTX*) enif_make_new_binary(env,MD4_CTX_LEN, &ret);
     memcpy(new_ctx, ctx_bin.data, MD4_CTX_LEN);
     MD4_Update(new_ctx, data_bin.data, data_bin.size);
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 static ERL_NIF_TERM md4_final(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
@@ -1210,6 +1239,7 @@ static ERL_NIF_TERM md5_mac_n(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[
     }
     hmac_md5(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret), hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 }
 
@@ -1228,6 +1258,7 @@ static ERL_NIF_TERM sha_mac_n(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[
     hmac_sha1(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret),
 	   hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 }
 
@@ -1247,6 +1278,7 @@ static ERL_NIF_TERM sha224_mac_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     hmac_sha224(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret),
 	   hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 #else
     return atom_notsup;
@@ -1269,6 +1301,7 @@ static ERL_NIF_TERM sha256_mac_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     hmac_sha256(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret),
 	   hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 #else
     return atom_notsup;
@@ -1291,6 +1324,7 @@ static ERL_NIF_TERM sha384_mac_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     hmac_sha384(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret),
 	   hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 #else
     return atom_notsup;
@@ -1314,6 +1348,7 @@ static ERL_NIF_TERM sha512_mac_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     hmac_sha512(key.data, key.size, data.data, data.size, hmacbuf);
     memcpy(enif_make_new_binary(env, mac_sz, &ret),
 	   hmacbuf, mac_sz);
+    CONSUME_REDS(env,data);
     return ret;
 #else
     return atom_notsup;
@@ -1371,6 +1406,7 @@ static ERL_NIF_TERM hmac_update(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
     ctx_buf = enif_make_new_binary(env, sizeof(HMAC_CTX), &ret);
     memcpy(ctx_buf, context.data, context.size);
     HMAC_Update((HMAC_CTX *)ctx_buf, data.data, data.size);
+    CONSUME_REDS(env,data);
 
     return ret;
 }
@@ -1427,6 +1463,7 @@ static ERL_NIF_TERM des_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
     DES_set_key((const_DES_cblock*)key.data, &schedule);
     DES_ncbc_encrypt(text.data, enif_make_new_binary(env, text.size, &ret),
 		     text.size, &schedule, &ivec_clone, (argv[3] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 }
 
@@ -1446,6 +1483,7 @@ static ERL_NIF_TERM des_cfb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
     DES_set_key((const_DES_cblock*)key.data, &schedule);
     DES_cfb_encrypt(text.data, enif_make_new_binary(env, text.size, &ret),
 		     8, text.size, &schedule, &ivec_clone, (argv[3] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 }
 
@@ -1462,6 +1500,7 @@ static ERL_NIF_TERM des_ecb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
     DES_ecb_encrypt((const_DES_cblock*)text.data,
 		    (DES_cblock*)enif_make_new_binary(env, 8, &ret),
 		    &schedule, (argv[2] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 }
 
@@ -1488,6 +1527,7 @@ static ERL_NIF_TERM des_ede3_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_T
     DES_ede3_cbc_encrypt(text.data, enif_make_new_binary(env,text.size,&ret), 
 			 text.size, &schedule1, &schedule2, &schedule3,
 			 &ivec_clone, (argv[5] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 }
 
@@ -1514,6 +1554,7 @@ static ERL_NIF_TERM des_ede3_cfb_crypt_nif(ErlNifEnv* env, int argc, const ERL_N
     DES_ede3_cfb_encrypt(text.data, enif_make_new_binary(env,text.size,&ret),
 			 8, text.size, &schedule1, &schedule2, &schedule3,
 			 &ivec_clone, (argv[5] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 #else
     return atom_notsup;
@@ -1540,6 +1581,7 @@ static ERL_NIF_TERM aes_cfb_128_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TE
 		       enif_make_new_binary(env, text.size, &ret), 
 		       text.size, &aes_key, ivec_clone, &new_ivlen,
 		       (argv[3] == atom_true));
+    CONSUME_REDS(env,text);
     return ret;
 }
 
@@ -1565,6 +1607,7 @@ static ERL_NIF_TERM aes_ctr_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     AES_ctr128_encrypt((unsigned char *) text.data,
 		       enif_make_new_binary(env, text.size, &ret), 
 		       text.size, &aes_key, ivec_clone, ecount_buf, &num);
+    CONSUME_REDS(env,text);
 
     /* To do an incremental {en|de}cryption, the state to to keep between calls
 	must include ivec_clone, ecount_buf and num. */
@@ -1608,6 +1651,7 @@ static ERL_NIF_TERM aes_ctr_stream_encrypt(ErlNifEnv* env, int argc, const ERL_N
     num2_term = enif_make_uint(env, num);
     new_state_term = enif_make_tuple4(env, state_term[0], ivec2_term, ecount2_term, num2_term);
     ret = enif_make_tuple2(env, new_state_term, cipher_term);
+    CONSUME_REDS(env,text_bin);
     return ret;
 }
 
@@ -2055,10 +2099,11 @@ static ERL_NIF_TERM aes_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
     ret_ptr = enif_make_new_binary(env, data_bin.size, &ret);
     memcpy(ivec, ivec_bin.data, 16); /* writable copy */
     AES_cbc_encrypt(data_bin.data, ret_ptr, data_bin.size, &aes_key, ivec, i);
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
-static ERL_NIF_TERM exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+static ERL_NIF_TERM do_exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Data1, Data2) */
     ErlNifBinary d1, d2;
     unsigned char* ret_ptr;
@@ -2075,6 +2120,7 @@ static ERL_NIF_TERM exor(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
     for (i=0; i<d1.size; i++) {
 	ret_ptr[i] = d1.data[i] ^ d2.data[i];
     }
+    CONSUME_REDS(env,d1);
     return ret;
 }
 
@@ -2091,6 +2137,7 @@ static ERL_NIF_TERM rc4_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM arg
     RC4_set_key(&rc4_key, key.size, key.data);
     RC4(&rc4_key, data.size, data.data,
 	enif_make_new_binary(env, data.size, &ret));
+    CONSUME_REDS(env,data);
     return ret;
 }   
 
@@ -2123,7 +2170,7 @@ static ERL_NIF_TERM rc4_encrypt_with_state(ErlNifEnv* env, int argc, const ERL_N
     memcpy(rc4_key, state.data, sizeof(RC4_KEY));
     RC4(rc4_key, data.size, data.data,
 	enif_make_new_binary(env, data.size, &new_data));
-
+    CONSUME_REDS(env,data);
     return enif_make_tuple2(env,new_state,new_data);
 }   
 
@@ -2150,6 +2197,7 @@ static ERL_NIF_TERM rc2_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
 		    data_bin.size, &rc2_key,
 		    iv_copy,
 		    (argv[3] == atom_true));
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
@@ -2781,6 +2829,7 @@ static ERL_NIF_TERM bf_cfb64_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM
     BF_cfb64_encrypt(data_bin.data, enif_make_new_binary(env,data_bin.size,&ret),
 		     data_bin.size, &bf_key, bf_tkey, &bf_n,
 		     (argv[3] == atom_true ? BF_ENCRYPT : BF_DECRYPT));
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
@@ -2804,6 +2853,7 @@ static ERL_NIF_TERM bf_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     BF_cbc_encrypt(data_bin.data, enif_make_new_binary(env,data_bin.size,&ret),
 		   data_bin.size, &bf_key, bf_tkey,
 		   (argv[3] == atom_true ? BF_ENCRYPT : BF_DECRYPT));
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
@@ -2821,6 +2871,7 @@ static ERL_NIF_TERM bf_ecb_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     BF_set_key(&bf_key, key_bin.size, key_bin.data);
     BF_ecb_encrypt(data_bin.data, enif_make_new_binary(env,data_bin.size,&ret),
 		   &bf_key, (argv[2] == atom_true ? BF_ENCRYPT : BF_DECRYPT));
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
@@ -2843,6 +2894,7 @@ static ERL_NIF_TERM blowfish_ofb64_encrypt(ErlNifEnv* env, int argc, const ERL_N
     memcpy(bf_tkey, ivec_bin.data, 8);
     BF_ofb64_encrypt(data_bin.data, enif_make_new_binary(env,data_bin.size,&ret),
 		     data_bin.size, &bf_key, bf_tkey, &bf_n);
+    CONSUME_REDS(env,data_bin);
     return ret;
 }
 
diff --git a/lib/crypto/src/crypto.appup.src b/lib/crypto/src/crypto.appup.src
index b39ef734eb..5b4ce5acee 100644
--- a/lib/crypto/src/crypto.appup.src
+++ b/lib/crypto/src/crypto.appup.src
@@ -1,7 +1,8 @@
+%% -*- erlang -*-
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 1999-2009. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2013. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -17,6 +18,11 @@
 %% %CopyrightEnd%
 %%
 {"%VSN%",
- [], 
- []
-}.
+ [
+  {<<"2\\.*">>,  [{restart_application, crypto}]}		
+  {<<"1\\.*">>,  [{restart_application, crypto}]}
+ ],
+ [
+  {<<"2\\.*">>,  [{restart_application, crypto}]}	
+  {<<"1\\.*">>,  [{restart_application, crypto}]}
+ ]}.
diff --git a/lib/crypto/src/crypto.erl b/lib/crypto/src/crypto.erl
index e042545094..a093b45410 100644
--- a/lib/crypto/src/crypto.erl
+++ b/lib/crypto/src/crypto.erl
@@ -35,7 +35,6 @@
 -export([private_encrypt/4, public_decrypt/4]).
 -export([dh_generate_parameters/2, dh_check/1]). %% Testing see
 
-
 %% DEPRECATED
 %% Replaced by hash_*
 -export([md4/1, md4_init/0, md4_update/2, md4_final/1]).
@@ -165,60 +164,8 @@
 -export([info/0]).
 -deprecated({info, 0, next_major_release}).
 
--define(FUNC_LIST, [hash, hash_init, hash_update, hash_final,
-		    hmac, hmac_init, hmac_update, hmac_final, hmac_final_n,
-		    %% deprecated
-		    md4, md4_init, md4_update, md4_final,
-		    md5, md5_init, md5_update, md5_final,
-		    sha, sha_init, sha_update, sha_final,
-		    md5_mac,  md5_mac_96,
-		    sha_mac,  sha_mac_96,
-		    %%
-		    block_encrypt, block_decrypt,
-		    %% deprecated
-		    des_cbc_encrypt, des_cbc_decrypt,
-		    des_cfb_encrypt, des_cfb_decrypt,
-		    des_ecb_encrypt, des_ecb_decrypt,
-		    des3_cbc_encrypt, des3_cbc_decrypt,
-		    des3_cfb_encrypt, des3_cfb_decrypt,
-		    aes_cfb_128_encrypt, aes_cfb_128_decrypt,
-		    rc2_cbc_encrypt, rc2_cbc_decrypt,
-		    rc2_40_cbc_encrypt, rc2_40_cbc_decrypt,
-		    aes_cbc_128_encrypt, aes_cbc_128_decrypt,
-		    aes_cbc_256_encrypt, aes_cbc_256_decrypt,
-		    blowfish_cbc_encrypt, blowfish_cbc_decrypt,
-		    blowfish_cfb64_encrypt, blowfish_cfb64_decrypt,
-		    blowfish_ecb_encrypt, blowfish_ecb_decrypt, blowfish_ofb64_encrypt,
-		    %%
-		    rand_bytes,
-		    strong_rand_bytes,
-		    rand_uniform,
-		    mod_pow,
-		    exor,
-		    %% deprecated
-		    mod_exp,strong_rand_mpint,erlint, mpint,
-		    %%
-		    sign, verify, generate_key, compute_key,
-		    %% deprecated
-		    dss_verify,dss_sign,
-		    rsa_verify,rsa_sign,
-		    rsa_public_encrypt,rsa_private_decrypt, 
-		    rsa_private_encrypt,rsa_public_decrypt,
-		    dh_generate_key, dh_compute_key,
-		    %%
-		    stream_init, stream_encrypt, stream_decrypt,
-		    %% deprecated
-		    rc4_encrypt, rc4_set_key, rc4_encrypt_with_state,
-		    aes_ctr_encrypt, aes_ctr_decrypt,
-                    aes_ctr_stream_init, aes_ctr_stream_encrypt, aes_ctr_stream_decrypt,
-		    %%
-		    next_iv,
-		    %% deprecated
-		    aes_cbc_ivec,
-		    des_cbc_ivec, des_cfb_ivec,
-		    info,
-		    %%
-		    info_lib, supports]).
+%% This should correspond to the similar macro in crypto.c
+-define(MAX_BYTES_TO_NIF, 20000). %%  Current value is: erlang:system_info(context_reductions) * 10
 
 -type mpint() :: binary().
 -type rsa_digest_type() :: 'md5' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'.
@@ -235,76 +182,27 @@
 %%-type ec_curve() :: ec_named_curve() | ec_curve_spec().
 %%-type ec_key() :: {Curve :: ec_curve(), PrivKey :: binary() | undefined, PubKey :: ec_point() | undefined}.
 
--define(nif_stub,nif_stub_error(?LINE)).
-
 -on_load(on_load/0).
-
 -define(CRYPTO_NIF_VSN,201).
 
-on_load() ->
-    LibBaseName = "crypto",
-    PrivDir = code:priv_dir(crypto),
-    LibName = case erlang:system_info(build_type) of
-		  opt ->
-		      LibBaseName;
-		  Type ->
-		      LibTypeName = LibBaseName ++ "."  ++ atom_to_list(Type),
-		      case (filelib:wildcard(
-			      filename:join(
-				[PrivDir,
-				 "lib",
-				 LibTypeName ++ "*"])) /= []) orelse
-			  (filelib:wildcard(
-			     filename:join(
-			       [PrivDir,
-				"lib", 
-				erlang:system_info(system_architecture),
-				LibTypeName ++ "*"])) /= []) of
-			  true -> LibTypeName;
-			  false -> LibBaseName
-		      end
-	      end,
-    Lib = filename:join([PrivDir, "lib", LibName]),
-    Status = case erlang:load_nif(Lib, {?CRYPTO_NIF_VSN,Lib}) of
-		 ok -> ok;
-		 {error, {load_failed, _}}=Error1 ->
-		     ArchLibDir = 
-			 filename:join([PrivDir, "lib", 
-					erlang:system_info(system_architecture)]),
-		     Candidate =
-			 filelib:wildcard(filename:join([ArchLibDir,LibName ++ "*" ])),
-		     case Candidate of
-			 [] -> Error1;
-			 _ ->
-			     ArchLib = filename:join([ArchLibDir, LibName]),
-			     erlang:load_nif(ArchLib, {?CRYPTO_NIF_VSN,ArchLib})
-		     end;
-		 Error1 -> Error1
-	     end,
-    case Status of
-	ok -> ok;
-	{error, {E, Str}} ->
-	    error_logger:error_msg("Unable to load crypto library. Failed with error:~n\"~p, ~s\"~n"
-				   "OpenSSL might not be installed on this system.~n",[E,Str]),
-	    Status
-    end.
-
+-define(nif_stub,nif_stub_error(?LINE)).
 nif_stub_error(Line) ->
     erlang:nif_error({nif_not_loaded,module,?MODULE,line,Line}).
 
+%%--------------------------------------------------------------------
+%%% API
+%%--------------------------------------------------------------------
+%% Crypto app version history:
+%% (no version): Driver implementation
+%% 2.0         : NIF implementation, requires OTP R14
+version() -> ?CRYPTO_VSN.
+
 start() ->
     application:start(crypto).
 
 stop() ->
     application:stop(crypto).
 
-info() ->
-    ?FUNC_LIST.
-
-info_lib() -> ?nif_stub.
-
-algorithms() -> ?nif_stub.
-
 supports()->
     Algs = algorithms(),
     PubKeyAlgs = 
@@ -316,32 +214,20 @@ supports()->
 	end,
     [{hashs, Algs -- [ec]},
      {ciphers, [des_cbc, des_cfb,  des3_cbc, des3_cbf, des_ede3, blowfish_cbc,
-		blowfish_cfb64, blowfish_ofb64, blowfish_ecb, aes_cbc128, aes_cfb128, aes_cbc256, rc2_cbc, aes_ctr, rc4
+		blowfish_cfb64, blowfish_ofb64, blowfish_ecb, aes_cbc128, aes_cfb128,
+		aes_cbc256, rc2_cbc, aes_ctr, rc4
 	       ]},
      PubKeyAlgs
     ].
 
-%% Crypto app version history:
-%% (no version): Driver implementation
-%% 2.0         : NIF implementation, requires OTP R14
-version() -> ?CRYPTO_VSN.
-
-%% Below Key and Data are binaries or IO-lists. IVec is a binary.
-%% Output is always a binary. Context is a binary.
-
-%%
-%%  MESSAGE DIGESTS
-%%
+info_lib() -> ?nif_stub.
 
 -spec hash(_, iodata()) -> binary().
-hash(md5, Data)          -> md5(Data);
-hash(md4, Data)          -> md4(Data);
-hash(sha, Data)          -> sha(Data);
-hash(ripemd160, Data)    -> ripemd160(Data);
-hash(sha224, Data)       -> sha224(Data);
-hash(sha256, Data)       -> sha256(Data);
-hash(sha384, Data)       -> sha384(Data);
-hash(sha512, Data)       -> sha512(Data).
+
+hash(Hash, Data0) ->
+    Data = iolist_to_binary(Data0),
+    MaxByts = max_bytes(),
+    hash(Hash, Data, erlang:byte_size(Data), MaxByts, initial).
 
 -spec hash_init('md5'|'md4'|'ripemd160'|
                 'sha'|'sha224'|'sha256'|'sha384'|'sha512') -> any().
@@ -357,14 +243,10 @@ hash_init(sha512)    -> {sha512, sha512_init()}.
 
 -spec hash_update(_, iodata()) -> any().
 
-hash_update({md5,Context}, Data)       -> {md5, md5_update(Context,Data)};
-hash_update({md4,Context}, Data)       -> {md4, md4_update(Context,Data)};
-hash_update({sha,Context}, Data)       -> {sha, sha_update(Context,Data)};
-hash_update({ripemd160,Context}, Data) -> {ripemd160, ripemd160_update(Context,Data)};
-hash_update({sha224,Context}, Data)    -> {sha224, sha224_update(Context,Data)};
-hash_update({sha256,Context}, Data)    -> {sha256, sha256_update(Context,Data)};
-hash_update({sha384,Context}, Data)    -> {sha384, sha384_update(Context,Data)};
-hash_update({sha512,Context}, Data)    -> {sha512, sha512_update(Context,Data)}.
+hash_update(State, Data0) ->
+    Data = iolist_to_binary(Data0),
+    MaxBytes = max_bytes(),
+    hash_update(State, Data, erlang:byte_size(Data), MaxBytes).
 
 -spec hash_final(_) -> binary().
 
@@ -377,6 +259,457 @@ hash_final({sha256,Context})    -> sha256_final(Context);
 hash_final({sha384,Context})    -> sha384_final(Context);
 hash_final({sha512,Context})    -> sha512_final(Context).
 
+
+-spec hmac(_, iodata(), iodata()) -> binary().
+-spec hmac(_, iodata(), iodata(), integer()) -> binary().
+-spec hmac_init(atom(), iodata()) -> binary().
+-spec hmac_update(binary(), iodata()) -> binary().
+-spec hmac_final(binary()) -> binary().
+-spec hmac_final_n(binary(), integer()) -> binary().
+
+hmac(Type, Key, Data0) ->
+    Data = iolist_to_binary(Data0),
+    hmac(Type, Key, Data, undefined, erlang:byte_size(Data), max_bytes(), initial).
+hmac(Type, Key, Data0, MacSize) ->
+    Data = iolist_to_binary(Data0),
+    hmac(Type, Key, Data, MacSize, erlang:byte_size(Data), max_bytes(), initial).
+
+
+hmac_init(_Type, _Key) -> ?nif_stub.
+
+hmac_update(State, Data0) ->
+    Data = iolist_to_binary(Data0),
+    hmac_update(State, Data, erlang:byte_size(Data), max_bytes()).
+hmac_final(_Context) -> ? nif_stub.
+hmac_final_n(_Context, _HashLen) -> ? nif_stub.
+
+%% Ecrypt/decrypt %%%
+
+-spec block_encrypt(des_cbc | des_cfb | des3_cbc | des3_cbf | des_ede3 | blowfish_cbc |
+		    blowfish_cfb64 | aes_cbc128 | aes_cfb128 | aes_cbc256 | rc2_cbc,
+		    Key::iodata(), Ivec::binary(), Data::iodata()) -> binary().
+
+block_encrypt(des_cbc, Key, Ivec, Data) ->
+    des_cbc_encrypt(Key, Ivec, Data);
+block_encrypt(des_cfb, Key, Ivec, Data) ->
+    des_cfb_encrypt(Key, Ivec, Data);
+block_encrypt(des3_cbc, [Key1, Key2, Key3], Ivec, Data) ->
+    des3_cbc_encrypt(Key1, Key2, Key3, Ivec, Data);
+block_encrypt(des3_cbf, [Key1, Key2, Key3], Ivec, Data) ->
+    des3_cfb_encrypt(Key1, Key2, Key3, Ivec, Data);
+block_encrypt(des_ede3, [Key1, Key2, Key3], Ivec, Data) ->
+    des_ede3_cbc_encrypt(Key1, Key2, Key3, Ivec, Data);
+block_encrypt(blowfish_cbc, Key, Ivec, Data) ->
+    blowfish_cbc_encrypt(Key, Ivec, Data);
+block_encrypt(blowfish_cfb64, Key, Ivec, Data) ->
+    blowfish_cfb64_encrypt(Key, Ivec, Data);
+block_encrypt(blowfish_ofb64, Key, Ivec, Data) ->
+    blowfish_ofb64_encrypt(Key, Ivec, Data);
+block_encrypt(aes_cbc128, Key, Ivec, Data) ->
+    aes_cbc_128_encrypt(Key, Ivec, Data);
+block_encrypt(aes_cbc256, Key, Ivec, Data) ->
+    aes_cbc_256_encrypt(Key, Ivec, Data);
+block_encrypt(aes_cfb128, Key, Ivec, Data) ->
+    aes_cfb_128_encrypt(Key, Ivec, Data);
+block_encrypt(rc2_cbc, Key, Ivec, Data) ->
+    rc2_cbc_encrypt(Key, Ivec, Data).
+
+-spec block_decrypt(des_cbc | des_cfb | des3_cbc | des3_cbf | des_ede3 | blowfish_cbc |
+	      blowfish_cfb64 | blowfish_ofb64  | aes_cbc128 | aes_cbc256 | aes_cfb128 | rc2_cbc,
+	      Key::iodata(), Ivec::binary(), Data::iodata()) -> binary().
+
+block_decrypt(des_cbc, Key, Ivec, Data) ->
+    des_cbc_decrypt(Key, Ivec, Data);
+block_decrypt(des_cfb, Key, Ivec, Data) ->
+    des_cfb_decrypt(Key, Ivec, Data);
+block_decrypt(des3_cbc, [Key1, Key2, Key3], Ivec, Data) ->
+    des3_cbc_decrypt(Key1, Key2, Key3, Ivec, Data);
+block_decrypt(des3_cbf, [Key1, Key2, Key3], Ivec, Data) ->
+    des3_cfb_decrypt(Key1, Key2, Key3, Ivec, Data);
+block_decrypt(des_ede3, [Key1, Key2, Key3], Ivec, Data) ->
+    des_ede3_cbc_decrypt(Key1, Key2, Key3, Ivec, Data);
+block_decrypt(blowfish_cbc, Key, Ivec, Data) ->
+    blowfish_cbc_decrypt(Key, Ivec, Data);
+block_decrypt(blowfish_cfb64, Key, Ivec, Data) ->
+    blowfish_cfb64_decrypt(Key, Ivec, Data);
+block_decrypt(blowfish_ofb64, Key, Ivec, Data) ->
+    blowfish_ofb64_decrypt(Key, Ivec, Data);
+block_decrypt(aes_cbc128, Key, Ivec, Data) ->
+    aes_cbc_128_decrypt(Key, Ivec, Data);
+block_decrypt(aes_cbc256, Key, Ivec, Data) ->
+    aes_cbc_256_decrypt(Key, Ivec, Data);
+block_decrypt(aes_cfb128, Key, Ivec, Data) ->
+    aes_cfb_128_decrypt(Key, Ivec, Data);
+block_decrypt(rc2_cbc, Key, Ivec, Data) ->
+    rc2_cbc_decrypt(Key, Ivec, Data).
+
+-spec block_encrypt(des_ecb | blowfish_ecb, Key::iodata(), Data::iodata()) -> binary().
+
+block_encrypt(des_ecb, Key, Data) ->
+    des_ecb_encrypt(Key, Data);
+block_encrypt(blowfish_ecb, Key, Data) ->
+    blowfish_ecb_encrypt(Key, Data).
+
+-spec block_decrypt(des_ecb | blowfish_ecb, Key::iodata(), Data::iodata()) -> binary().
+
+block_decrypt(des_ecb, Key, Data) ->
+    des_ecb_decrypt(Key, Data);
+block_decrypt(blowfish_ecb, Key, Data) ->
+    blowfish_ecb_decrypt(Key, Data).
+
+-spec next_iv(des_cbc | des3_cbc | aes_cbc, Data::iodata()) -> binary().
+
+next_iv(des_cbc, Data) ->
+    des_cbc_ivec(Data);
+next_iv(des3_cbc, Data) ->
+    des_cbc_ivec(Data);
+next_iv(aes_cbc, Data) ->
+    aes_cbc_ivec(Data).
+
+-spec next_iv(des_cfb, Data::iodata(), Ivec::binary()) -> binary().
+
+next_iv(des_cfb, Data, Ivec) ->
+    des_cfb_ivec(Ivec, Data);
+next_iv(Type, Data, _Ivec) ->
+    next_iv(Type, Data).
+
+stream_init(aes_ctr, Key, Ivec) ->
+    {aes_ctr, aes_ctr_stream_init(Key, Ivec)}.
+stream_init(rc4, Key) ->
+    {rc4, rc4_set_key(Key)}.
+
+stream_encrypt(State, Data0) ->
+    Data = iolist_to_binary(Data0),
+    MaxByts = max_bytes(),
+    stream_crypt(fun do_stream_encrypt/2, State, Data, erlang:byte_size(Data), MaxByts, []).
+
+stream_decrypt(State, Data0) ->
+    Data = iolist_to_binary(Data0),
+    MaxByts = max_bytes(),
+    stream_crypt(fun do_stream_decrypt/2, State, Data, erlang:byte_size(Data), MaxByts, []).
+
+%%
+%% RAND - pseudo random numbers using RN_ functions in crypto lib
+%%
+-spec rand_bytes(non_neg_integer()) -> binary().
+-spec strong_rand_bytes(non_neg_integer()) -> binary().
+-spec rand_uniform(crypto_integer(), crypto_integer()) ->
+			  crypto_integer().
+
+rand_bytes(_Bytes) -> ?nif_stub.
+
+strong_rand_bytes(Bytes) ->
+    case strong_rand_bytes_nif(Bytes) of
+        false -> erlang:error(low_entropy);
+        Bin -> Bin
+    end.
+strong_rand_bytes_nif(_Bytes) -> ?nif_stub.
+
+rand_bytes(_Bytes, _Topmask, _Bottommask) -> ?nif_stub.
+
+
+rand_uniform(From,To) when is_binary(From), is_binary(To) ->
+    case rand_uniform_nif(From,To) of
+	<<Len:32/integer, MSB, Rest/binary>> when MSB > 127 ->
+	    <<(Len + 1):32/integer, 0, MSB, Rest/binary>>;
+	Whatever ->
+	    Whatever
+    end;
+rand_uniform(From,To) when is_integer(From),is_integer(To) ->
+    if From < 0 ->
+	    rand_uniform_pos(0, To - From) + From;
+       true ->
+	    rand_uniform_pos(From, To)
+    end.
+
+rand_uniform_pos(From,To) when From < To ->
+    BinFrom = mpint(From),
+    BinTo = mpint(To),
+    case rand_uniform(BinFrom, BinTo) of
+        Result when is_binary(Result) ->
+            erlint(Result);
+        Other ->
+            Other
+    end;
+rand_uniform_pos(_,_) ->
+    error(badarg).
+
+rand_uniform_nif(_From,_To) -> ?nif_stub.
+
+
+-spec mod_pow(binary()|integer(), binary()|integer(), binary()|integer()) -> binary() | error.
+mod_pow(Base, Exponent, Prime) ->
+    case mod_exp_nif(ensure_int_as_bin(Base), ensure_int_as_bin(Exponent), ensure_int_as_bin(Prime), 0) of
+	<<0>> -> error;
+	R -> R
+    end.
+verify(dss, none, Data, Signature, Key) when is_binary(Data) ->
+    verify(dss, sha, {digest, Data}, Signature, Key);
+verify(Alg, Type, Data, Signature, Key) when is_binary(Data) ->
+    verify(Alg, Type,  {digest, hash(Type, Data)}, Signature, Key);
+verify(dss, Type, Data, Signature, Key) ->
+    dss_verify_nif(Type, Data, Signature, map_ensure_int_as_bin(Key));
+verify(rsa, Type, DataOrDigest, Signature, Key) ->
+    case rsa_verify_nif(Type, DataOrDigest, Signature, map_ensure_int_as_bin(Key)) of
+	notsup -> erlang:error(notsup);
+	Bool -> Bool
+    end;
+verify(ecdsa, Type, DataOrDigest, Signature, [Key, Curve]) ->
+    case ecdsa_verify_nif(Type, DataOrDigest, Signature, term_to_ec_key(Curve, undefined, Key)) of
+	notsup -> erlang:error(notsup);
+	Bool -> Bool
+    end.
+sign(dss, none, Data, Key) when is_binary(Data) ->
+    sign(dss, sha, {digest, Data}, Key);
+sign(Alg, Type, Data, Key) when is_binary(Data) ->
+    sign(Alg, Type, {digest, hash(Type, Data)}, Key);
+sign(rsa, Type, DataOrDigest, Key) ->
+    case rsa_sign_nif(Type, DataOrDigest, map_ensure_int_as_bin(Key)) of
+	error -> erlang:error(badkey, [Type,DataOrDigest,Key]);
+	Sign -> Sign
+    end;
+sign(dss, Type, DataOrDigest, Key) ->
+    case dss_sign_nif(Type, DataOrDigest, map_ensure_int_as_bin(Key)) of
+	error -> erlang:error(badkey, [DataOrDigest, Key]);
+	Sign -> Sign
+    end;
+sign(ecdsa, Type, DataOrDigest, [Key, Curve]) ->
+    case ecdsa_sign_nif(Type, DataOrDigest, term_to_ec_key(Curve, Key, undefined)) of
+	error -> erlang:error(badkey, [Type,DataOrDigest,Key]);
+	Sign -> Sign
+    end.
+
+-spec public_encrypt(rsa, binary(), [binary()], rsa_padding()) ->
+				binary().
+-spec public_decrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
+				binary().
+-spec private_encrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
+				binary().
+-spec private_decrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
+				binary().
+
+public_encrypt(rsa, BinMesg, Key, Padding) ->
+    case rsa_public_crypt(BinMesg,  map_ensure_int_as_bin(Key), Padding, true) of
+	error ->
+	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
+
+%% Binary, Key = [E,N,D]
+private_decrypt(rsa, BinMesg, Key, Padding) ->
+    case rsa_private_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, false) of
+	error ->
+	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
+
+
+%% Binary, Key = [E,N,D]
+private_encrypt(rsa, BinMesg, Key, Padding) ->
+    case rsa_private_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, true) of
+	error ->
+	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
+
+%% Binary, Key = [E,N]
+public_decrypt(rsa, BinMesg, Key, Padding) ->
+    case rsa_public_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, false) of
+	error ->
+	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
+
+%%
+%% XOR - xor to iolists and return a binary
+%% NB doesn't check that they are the same size, just concatenates
+%% them and sends them to the driver
+%%
+-spec exor(iodata(), iodata()) -> binary().
+
+exor(Bin1, Bin2) ->
+    Data1 = iolist_to_binary(Bin1),
+    Data2 = iolist_to_binary(Bin2),
+    MaxBytes = max_bytes(),
+    exor(Data1, Data2, erlang:byte_size(Data1), MaxBytes, []).
+
+generate_key(Type, Params) ->
+    generate_key(Type, Params, undefined).
+
+generate_key(dh, DHParameters, PrivateKey) ->
+    dh_generate_key_nif(ensure_int_as_bin(PrivateKey),
+			map_ensure_int_as_bin(DHParameters), 0);
+
+generate_key(srp, {host, [Verifier, Generator, Prime, Version]}, PrivArg)
+  when is_binary(Verifier), is_binary(Generator), is_binary(Prime), is_atom(Version) ->
+    Private = case PrivArg of
+		  undefined -> random_bytes(32);
+		  _ -> ensure_int_as_bin(PrivArg)
+	      end,
+    host_srp_gen_key(Private, Verifier, Generator, Prime, Version);
+
+generate_key(srp, {user, [Generator, Prime, Version]}, PrivateArg)
+  when is_binary(Generator), is_binary(Prime), is_atom(Version) ->
+    Private = case PrivateArg of
+		  undefined -> random_bytes(32);
+		  _ -> PrivateArg
+	      end,
+    user_srp_gen_key(Private, Generator, Prime);
+
+generate_key(ecdh, Curve, undefined) ->
+    ec_key_to_term_nif(ec_key_generate(Curve)).
+
+
+compute_key(dh, OthersPublicKey, MyPrivateKey, DHParameters) ->
+    case dh_compute_key_nif(ensure_int_as_bin(OthersPublicKey),
+			    ensure_int_as_bin(MyPrivateKey),
+			    map_ensure_int_as_bin(DHParameters)) of
+	error -> erlang:error(computation_failed,
+			      [OthersPublicKey,MyPrivateKey,DHParameters]);
+	Ret -> Ret
+    end;
+
+compute_key(srp, HostPublic, {UserPublic, UserPrivate},
+	    {user, [DerivedKey, Prime, Generator, Version | ScramblerArg]}) when
+      is_binary(Prime),
+      is_binary(Generator),
+      is_atom(Version) ->
+    HostPubBin = ensure_int_as_bin(HostPublic),
+    Multiplier = srp_multiplier(Version, Generator, Prime),
+    Scrambler = case ScramblerArg of
+		    [] -> srp_scrambler(Version, ensure_int_as_bin(UserPublic),
+					HostPubBin, Prime);
+		    [S] -> S
+		end,
+    srp_user_secret_nif(ensure_int_as_bin(UserPrivate), Scrambler, HostPubBin,
+			Multiplier, Generator, DerivedKey, Prime);
+
+compute_key(srp, UserPublic, {HostPublic, HostPrivate},
+	    {host,[Verifier, Prime, Version | ScramblerArg]}) when
+      is_binary(Verifier),
+      is_binary(Prime),
+      is_atom(Version) ->
+    UserPubBin = ensure_int_as_bin(UserPublic),
+    Scrambler = case ScramblerArg of
+		    [] -> srp_scrambler(Version, UserPubBin, ensure_int_as_bin(HostPublic), Prime);
+		    [S] -> S
+		end,
+    srp_host_secret_nif(Verifier, ensure_int_as_bin(HostPrivate), Scrambler,
+			UserPubBin, Prime);
+
+compute_key(ecdh, Others, My, Curve) ->
+    ecdh_compute_key_nif(ensure_int_as_bin(Others),
+			 term_to_ec_key(Curve,My,undefined)).
+
+
+random_bytes(N) ->
+    try strong_rand_bytes(N) of
+	RandBytes ->
+	    RandBytes
+    catch
+	error:low_entropy ->
+	    rand_bytes(N)
+    end.
+
+%%--------------------------------------------------------------------
+%%% On load
+%%--------------------------------------------------------------------
+
+on_load() ->
+    LibBaseName = "crypto",
+    PrivDir = code:priv_dir(crypto),
+    LibName = case erlang:system_info(build_type) of
+		  opt ->
+		      LibBaseName;
+		  Type ->
+		      LibTypeName = LibBaseName ++ "."  ++ atom_to_list(Type),
+		      case (filelib:wildcard(
+			      filename:join(
+				[PrivDir,
+				 "lib",
+				 LibTypeName ++ "*"])) /= []) orelse
+			  (filelib:wildcard(
+			     filename:join(
+			       [PrivDir,
+				"lib",
+				erlang:system_info(system_architecture),
+				LibTypeName ++ "*"])) /= []) of
+			  true -> LibTypeName;
+			  false -> LibBaseName
+		      end
+	      end,
+    Lib = filename:join([PrivDir, "lib", LibName]),
+    Status = case erlang:load_nif(Lib, {?CRYPTO_NIF_VSN,Lib}) of
+		 ok -> ok;
+		 {error, {load_failed, _}}=Error1 ->
+		     ArchLibDir =
+			 filename:join([PrivDir, "lib",
+					erlang:system_info(system_architecture)]),
+		     Candidate =
+			 filelib:wildcard(filename:join([ArchLibDir,LibName ++ "*" ])),
+		     case Candidate of
+			 [] -> Error1;
+			 _ ->
+			     ArchLib = filename:join([ArchLibDir, LibName]),
+			     erlang:load_nif(ArchLib, {?CRYPTO_NIF_VSN,ArchLib})
+		     end;
+		 Error1 -> Error1
+	     end,
+    case Status of
+	ok -> ok;
+	{error, {E, Str}} ->
+	    error_logger:error_msg("Unable to load crypto library. Failed with error:~n\"~p, ~s\"~n"
+				   "OpenSSL might not be installed on this system.~n",[E,Str]),
+	    Status
+    end.
+%%--------------------------------------------------------------------
+%%% Internal functions (some internal API functions are part of the deprecated API)
+%%--------------------------------------------------------------------
+max_bytes() ->
+    ?MAX_BYTES_TO_NIF.
+
+%% HASH --------------------------------------------------------------------
+hash(Hash, Data, Size, Max, initial) when Size =< Max ->
+    do_hash(Hash, Data);
+hash(State0, Data, Size, Max, continue) when Size =< Max ->
+    State = do_hash_update(State0, Data),
+    hash_final(State);
+hash(Hash, Data, _Size, Max, initial) ->
+    <<Increment:Max/binary, Rest/binary>> = Data,
+    State0 = hash_init(Hash),
+    State = do_hash_update(State0, Increment),
+    hash(State, Rest, erlang:byte_size(Rest), max_bytes(), continue);
+hash(State0, Data, _Size, MaxByts, continue) ->
+    <<Increment:MaxByts/binary, Rest/binary>> = Data,
+    State = do_hash_update(State0, Increment),
+    hash(State, Rest, erlang:byte_size(Rest), max_bytes(), continue).
+
+do_hash(md5, Data)          -> md5(Data);
+do_hash(md4, Data)          -> md4(Data);
+do_hash(sha, Data)          -> sha(Data);
+do_hash(ripemd160, Data)    -> ripemd160(Data);
+do_hash(sha224, Data)       -> sha224(Data);
+do_hash(sha256, Data)       -> sha256(Data);
+do_hash(sha384, Data)       -> sha384(Data);
+do_hash(sha512, Data)       -> sha512(Data).
+
+hash_update(State, Data, Size, MaxBytes)  when Size =< MaxBytes ->
+    do_hash_update(State, Data);
+hash_update(State0, Data, _, MaxBytes) ->
+    <<Increment:MaxBytes/binary, Rest/binary>> = Data,
+    State = do_hash_update(State0, Increment),
+    hash_update(State, Rest, erlang:byte_size(Rest), MaxBytes).
+
+do_hash_update({md5,Context}, Data)       -> {md5, md5_update(Context,Data)};
+do_hash_update({md4,Context}, Data)       -> {md4, md4_update(Context,Data)};
+do_hash_update({sha,Context}, Data)       -> {sha, sha_update(Context,Data)};
+do_hash_update({ripemd160,Context}, Data) -> {ripemd160, ripemd160_update(Context,Data)};
+do_hash_update({sha224,Context}, Data)    -> {sha224, sha224_update(Context,Data)};
+do_hash_update({sha256,Context}, Data)    -> {sha256, sha256_update(Context,Data)};
+do_hash_update({sha384,Context}, Data)    -> {sha384, sha384_update(Context,Data)};
+do_hash_update({sha512,Context}, Data)    -> {sha512, sha512_update(Context,Data)}.
+
+
 %%
 %%  MD5
 %%
@@ -567,40 +900,56 @@ sha512_init_nif() -> ?nif_stub.
 sha512_update_nif(_Context, _Data) -> ?nif_stub.
 sha512_final_nif(_Context) -> ?nif_stub.
 
-%%
-%%  MESSAGE AUTHENTICATION CODES
-%%
-
-%%
-%%  HMAC (multiple hash options)
-%%
+%% HMAC --------------------------------------------------------------------
 
--spec hmac(_, iodata(), iodata()) -> binary().
--spec hmac(_, iodata(), iodata(), integer()) -> binary().
--spec hmac_init(atom(), iodata()) -> binary().                             
--spec hmac_update(binary(), iodata()) -> binary().
--spec hmac_final(binary()) -> binary().                             
--spec hmac_final_n(binary(), integer()) -> binary().                             
-
-hmac(md5, Key, Data)    -> md5_mac(Key, Data);
-hmac(sha, Key, Data)    -> sha_mac(Key, Data);
-hmac(sha224, Key, Data) -> sha224_mac(Key, Data);
-hmac(sha256, Key, Data) -> sha256_mac(Key, Data);
-hmac(sha384, Key, Data) -> sha384_mac(Key, Data);
-hmac(sha512, Key, Data) -> sha512_mac(Key, Data).
-
-hmac(md5, Key, Data, Size)    -> md5_mac_n(Key, Data, Size);
-hmac(sha, Key, Data, Size)    -> sha_mac_n(Key, Data, Size);
-hmac(sha224, Key, Data, Size) -> sha224_mac(Key, Data, Size);
-hmac(sha256, Key, Data, Size) -> sha256_mac(Key, Data, Size);
-hmac(sha384, Key, Data, Size) -> sha384_mac(Key, Data, Size);
-hmac(sha512, Key, Data, Size) -> sha512_mac(Key, Data, Size).
+hmac(Type, Key, Data, MacSize, Size, MaxBytes, initial) when Size =< MaxBytes ->
+    case MacSize of
+	undefined ->
+	    do_hmac(Type, Key, Data);
+	_ ->
+	    do_hmac(Type, Key, Data, MacSize)
+    end;
+hmac(Type, Key, Data, MacSize, _, MaxBytes, initial) ->
+    <<Increment:MaxBytes/binary, Rest/binary>> = Data,
+    State0 = hmac_init(Type, Key),
+    State = hmac_update(State0, Increment),
+    hmac(State, Rest, MacSize, erlang:byte_size(Rest), max_bytes(), continue).
+hmac(State0, Data, MacSize, Size, MaxBytes, continue) when Size =< MaxBytes ->
+    State = hmac_update(State0, Data),
+    case MacSize of
+	undefined ->
+	    hmac_final(State);
+	 _ ->
+	    hmac_final_n(State, MacSize)
+	end;
+hmac(State0, Data, MacSize, _Size, MaxBytes, continue) ->
+    <<Increment:MaxBytes/binary, Rest/binary>> = Data,
+    State = hmac_update(State0, Increment),
+    hmac(State, Rest, MacSize, erlang:byte_size(Rest), max_bytes(), continue).
+
+hmac_update(State, Data, Size, MaxBytes)  when Size =< MaxBytes ->
+    do_hmac_update(State, Data);
+hmac_update(State0, Data, _, MaxBytes) ->
+    <<Increment:MaxBytes/binary, Rest/binary>> = Data,
+    State = do_hmac_update(State0, Increment),
+    hmac_update(State, Rest, erlang:byte_size(Rest), MaxBytes).
+
+do_hmac(md5, Key, Data)    -> md5_mac(Key, Data);
+do_hmac(sha, Key, Data)    -> sha_mac(Key, Data);
+do_hmac(sha224, Key, Data) -> sha224_mac(Key, Data);
+do_hmac(sha256, Key, Data) -> sha256_mac(Key, Data);
+do_hmac(sha384, Key, Data) -> sha384_mac(Key, Data);
+do_hmac(sha512, Key, Data) -> sha512_mac(Key, Data).
+
+do_hmac(md5, Key, Data, Size)    -> md5_mac_n(Key, Data, Size);
+do_hmac(sha, Key, Data, Size)    -> sha_mac_n(Key, Data, Size);
+do_hmac(sha224, Key, Data, Size) -> sha224_mac(Key, Data, Size);
+do_hmac(sha256, Key, Data, Size) -> sha256_mac(Key, Data, Size);
+do_hmac(sha384, Key, Data, Size) -> sha384_mac(Key, Data, Size);
+do_hmac(sha512, Key, Data, Size) -> sha512_mac(Key, Data, Size).
+
+do_hmac_update(_Context, _Data) -> ? nif_stub.
 
-hmac_init(_Type, _Key) -> ?nif_stub.
-hmac_update(_Context, _Data) -> ? nif_stub.
-hmac_final(_Context) -> ? nif_stub.
-hmac_final_n(_Context, _HashLen) -> ? nif_stub.
-     
 %%
 %%  MD5_MAC
 %%
@@ -696,172 +1045,7 @@ sha512_mac(Key, Data, MacSz) ->
 
 sha512_mac_nif(_Key,_Data,_MacSz) -> ?nif_stub.
 
-
-%% Ecrypt/decrypt %%%
-
--spec block_encrypt(des_cbc | des_cfb | des3_cbc | des3_cbf | des_ede3 | blowfish_cbc |
-		    blowfish_cfb64 | aes_cbc128 | aes_cfb128 | aes_cbc256 | rc2_cbc,
-		    Key::iodata(), Ivec::binary(), Data::iodata()) -> binary().
-
-block_encrypt(des_cbc, Key, Ivec, Data) ->
-    des_cbc_encrypt(Key, Ivec, Data);
-block_encrypt(des_cfb, Key, Ivec, Data) ->
-    des_cfb_encrypt(Key, Ivec, Data);
-block_encrypt(des3_cbc, [Key1, Key2, Key3], Ivec, Data) ->
-    des3_cbc_encrypt(Key1, Key2, Key3, Ivec, Data);
-block_encrypt(des3_cbf, [Key1, Key2, Key3], Ivec, Data) ->
-    des3_cfb_encrypt(Key1, Key2, Key3, Ivec, Data);
-block_encrypt(des_ede3, [Key1, Key2, Key3], Ivec, Data) ->
-    des_ede3_cbc_encrypt(Key1, Key2, Key3, Ivec, Data);
-block_encrypt(blowfish_cbc, Key, Ivec, Data) ->
-    blowfish_cbc_encrypt(Key, Ivec, Data);
-block_encrypt(blowfish_cfb64, Key, Ivec, Data) ->
-    blowfish_cfb64_encrypt(Key, Ivec, Data);
-block_encrypt(blowfish_ofb64, Key, Ivec, Data) ->
-    blowfish_ofb64_encrypt(Key, Ivec, Data);
-block_encrypt(aes_cbc128, Key, Ivec, Data) ->
-    aes_cbc_128_encrypt(Key, Ivec, Data);
-block_encrypt(aes_cbc256, Key, Ivec, Data) ->
-    aes_cbc_256_encrypt(Key, Ivec, Data);
-block_encrypt(aes_cfb128, Key, Ivec, Data) ->
-    aes_cfb_128_encrypt(Key, Ivec, Data);
-block_encrypt(rc2_cbc, Key, Ivec, Data) ->
-    rc2_cbc_encrypt(Key, Ivec, Data).
-
--spec block_decrypt(des_cbc | des_cfb | des3_cbc | des3_cbf | des_ede3 | blowfish_cbc |
-	      blowfish_cfb64 | blowfish_ofb64  | aes_cbc128 | aes_cbc256 | aes_cfb128 | rc2_cbc,
-	      Key::iodata(), Ivec::binary(), Data::iodata()) -> binary().
-
-block_decrypt(des_cbc, Key, Ivec, Data) ->
-    des_cbc_decrypt(Key, Ivec, Data);
-block_decrypt(des_cfb, Key, Ivec, Data) ->
-    des_cfb_decrypt(Key, Ivec, Data);
-block_decrypt(des3_cbc, [Key1, Key2, Key3], Ivec, Data) ->
-    des3_cbc_decrypt(Key1, Key2, Key3, Ivec, Data);
-block_decrypt(des3_cbf, [Key1, Key2, Key3], Ivec, Data) ->
-    des3_cfb_decrypt(Key1, Key2, Key3, Ivec, Data);
-block_decrypt(des_ede3, [Key1, Key2, Key3], Ivec, Data) ->
-    des_ede3_cbc_decrypt(Key1, Key2, Key3, Ivec, Data);
-block_decrypt(blowfish_cbc, Key, Ivec, Data) ->
-    blowfish_cbc_decrypt(Key, Ivec, Data);
-block_decrypt(blowfish_cfb64, Key, Ivec, Data) ->
-    blowfish_cfb64_decrypt(Key, Ivec, Data);
-block_decrypt(blowfish_ofb64, Key, Ivec, Data) ->
-    blowfish_ofb64_decrypt(Key, Ivec, Data);
-block_decrypt(aes_cbc128, Key, Ivec, Data) ->
-    aes_cbc_128_decrypt(Key, Ivec, Data);
-block_decrypt(aes_cbc256, Key, Ivec, Data) ->
-    aes_cbc_256_decrypt(Key, Ivec, Data);
-block_decrypt(aes_cfb128, Key, Ivec, Data) ->
-    aes_cfb_128_decrypt(Key, Ivec, Data);
-block_decrypt(rc2_cbc, Key, Ivec, Data) ->
-    rc2_cbc_decrypt(Key, Ivec, Data).
-
--spec block_encrypt(des_ecb | blowfish_ecb, Key::iodata(), Data::iodata()) -> binary().
-
-block_encrypt(des_ecb, Key, Data) ->
-    des_ecb_encrypt(Key, Data);
-block_encrypt(blowfish_ecb, Key, Data) ->
-    blowfish_ecb_encrypt(Key, Data).
-
--spec block_decrypt(des_ecb | blowfish_ecb, Key::iodata(), Data::iodata()) -> binary().
-
-block_decrypt(des_ecb, Key, Data) ->
-    des_ecb_decrypt(Key, Data);
-block_decrypt(blowfish_ecb, Key, Data) ->
-    blowfish_ecb_decrypt(Key, Data).
-
--spec next_iv(des_cbc | des3_cbc | aes_cbc, Data::iodata()) -> binary().
-
-next_iv(des_cbc, Data) ->
-    des_cbc_ivec(Data);
-next_iv(des3_cbc, Data) ->
-    des_cbc_ivec(Data);
-next_iv(aes_cbc, Data) ->
-    aes_cbc_ivec(Data).
-
--spec next_iv(des_cfb, Data::iodata(), Ivec::binary()) -> binary().
-
-next_iv(des_cfb, Data, Ivec) ->
-    des_cfb_ivec(Ivec, Data);
-next_iv(Type, Data, _Ivec) ->
-    next_iv(Type, Data).
-
-stream_init(aes_ctr, Key, Ivec) ->
-    {aes_ctr, aes_ctr_stream_init(Key, Ivec)}.
-stream_init(rc4, Key) ->
-    {rc4, rc4_set_key(Key)}.
-stream_encrypt({aes_ctr, State0}, Data) ->
-    {State, Cipher} = aes_ctr_stream_encrypt(State0, Data),
-    {{aes_ctr, State}, Cipher};
-stream_encrypt({rc4, State0}, Data) ->
-    {State, Cipher} = rc4_encrypt_with_state(State0, Data),
-    {{rc4, State}, Cipher}.
-stream_decrypt({aes_ctr, State0}, Data) ->
-    {State, Text} = aes_ctr_stream_decrypt(State0, Data),
-    {{aes_ctr, State}, Text};
-stream_decrypt({rc4, State0}, Data) ->
-    {State, Text} = rc4_encrypt_with_state (State0, Data),
-    {{rc4, State}, Text}.
-
-%%
-%% CRYPTO FUNCTIONS
-%%
-
-%%
-%% DES - in cipher block chaining mode (CBC)
-%%
--spec des_cbc_encrypt(iodata(), binary(), iodata()) -> binary().
--spec des_cbc_decrypt(iodata(), binary(), iodata()) -> binary().
-
-des_cbc_encrypt(Key, IVec, Data) ->
-    des_cbc_crypt(Key, IVec, Data, true).
-
-des_cbc_decrypt(Key, IVec, Data) ->
-    des_cbc_crypt(Key, IVec, Data, false).
-
-des_cbc_crypt(_Key, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
-
-%%
-%% dec_cbc_ivec(Data) -> binary()
-%%
-%% Returns the IVec to be used in the next iteration of 
-%% des_cbc_[encrypt|decrypt].
-%%
--spec des_cbc_ivec(iodata()) -> binary().
-
-des_cbc_ivec(Data) when is_binary(Data) -> 
-    {_, IVec} = split_binary(Data, size(Data) - 8),
-    IVec;
-des_cbc_ivec(Data) when is_list(Data) ->
-    des_cbc_ivec(list_to_binary(Data)).
-
-%%
-%% DES - in 8-bits cipher feedback mode (CFB)
-%%
--spec des_cfb_encrypt(iodata(), binary(), iodata()) -> binary().
--spec des_cfb_decrypt(iodata(), binary(), iodata()) -> binary().
-
-des_cfb_encrypt(Key, IVec, Data) ->
-    des_cfb_crypt(Key, IVec, Data, true).
-
-des_cfb_decrypt(Key, IVec, Data) ->
-    des_cfb_crypt(Key, IVec, Data, false).
-
-des_cfb_crypt(_Key, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
-
-%%
-%% dec_cfb_ivec(IVec, Data) -> binary()
-%%
-%% Returns the IVec to be used in the next iteration of
-%% des_cfb_[encrypt|decrypt].
-%%
--spec des_cfb_ivec(iodata(), iodata()) -> binary().
-
-des_cfb_ivec(IVec, Data) ->
-    IVecAndData = list_to_binary([IVec, Data]),
-    {_, NewIVec} = split_binary(IVecAndData, byte_size(IVecAndData) - 8),
-    NewIVec.
+%% CIPHERS --------------------------------------------------------------------
 
 %%
 %% DES - in electronic codebook mode (ECB)
@@ -973,292 +1157,63 @@ aes_cfb_128_decrypt(Key, IVec, Data) ->
 aes_cfb_128_crypt(_Key, _IVec, _Data, _IsEncrypt) -> ?nif_stub.     
 
 
-%% 
-%% RAND - pseudo random numbers using RN_ functions in crypto lib
 %%
--spec rand_bytes(non_neg_integer()) -> binary().
--spec strong_rand_bytes(non_neg_integer()) -> binary().
--spec rand_uniform(crypto_integer(), crypto_integer()) ->
-			  crypto_integer().
--spec strong_rand_mpint(Bits::non_neg_integer(),
-			Top::-1..1,
-			Bottom::0..1) -> binary().
-
-rand_bytes(_Bytes) -> ?nif_stub.
-
-strong_rand_bytes(Bytes) ->
-    case strong_rand_bytes_nif(Bytes) of
-        false -> erlang:error(low_entropy);
-        Bin -> Bin
-    end.
-strong_rand_bytes_nif(_Bytes) -> ?nif_stub.
-
-rand_bytes(_Bytes, _Topmask, _Bottommask) -> ?nif_stub.
-
-strong_rand_mpint(Bits, Top, Bottom) -> 
-    case strong_rand_mpint_nif(Bits,Top,Bottom) of
-        false -> erlang:error(low_entropy);
-        Bin -> Bin
-    end.
-strong_rand_mpint_nif(_Bits, _Top, _Bottom) -> ?nif_stub.
-
+%% DES - in cipher block chaining mode (CBC)
+%%
+-spec des_cbc_encrypt(iodata(), binary(), iodata()) -> binary().
+-spec des_cbc_decrypt(iodata(), binary(), iodata()) -> binary().
 
-rand_uniform(From,To) when is_binary(From), is_binary(To) ->
-    case rand_uniform_nif(From,To) of
-	<<Len:32/integer, MSB, Rest/binary>> when MSB > 127 ->
-	    <<(Len + 1):32/integer, 0, MSB, Rest/binary>>;
-	Whatever ->
-	    Whatever
-    end;
-rand_uniform(From,To) when is_integer(From),is_integer(To) ->
-    if From < 0 -> 
-	    rand_uniform_pos(0, To - From) + From;
-       true ->
-	    rand_uniform_pos(From, To)
-    end.
+des_cbc_encrypt(Key, IVec, Data) ->
+    des_cbc_crypt(Key, IVec, Data, true).
 
-rand_uniform_pos(From,To) when From < To ->
-    BinFrom = mpint(From),
-    BinTo = mpint(To),
-    case rand_uniform(BinFrom, BinTo) of
-        Result when is_binary(Result) ->
-            erlint(Result);
-        Other ->
-            Other
-    end;
-rand_uniform_pos(_,_) ->
-    error(badarg).
+des_cbc_decrypt(Key, IVec, Data) ->
+    des_cbc_crypt(Key, IVec, Data, false).
 
-rand_uniform_nif(_From,_To) -> ?nif_stub.     
+des_cbc_crypt(_Key, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
 
 %%
-%% mod_exp - utility for rsa generation and SRP
+%% dec_cbc_ivec(Data) -> binary()
 %%
-mod_exp(Base, Exponent, Modulo)
-  when is_integer(Base), is_integer(Exponent), is_integer(Modulo) ->
-    bin_to_int(mod_exp_nif(int_to_bin(Base), int_to_bin(Exponent), int_to_bin(Modulo), 0));
-
-mod_exp(Base, Exponent, Modulo) ->
-    mod_exp_nif(mpint_to_bin(Base),mpint_to_bin(Exponent),mpint_to_bin(Modulo), 4).
-    
--spec mod_pow(binary()|integer(), binary()|integer(), binary()|integer()) -> binary() | error.
-mod_pow(Base, Exponent, Prime) ->
-    case mod_exp_nif(ensure_int_as_bin(Base), ensure_int_as_bin(Exponent), ensure_int_as_bin(Prime), 0) of
-	<<0>> -> error;
-	R -> R
-    end.
-
+%% Returns the IVec to be used in the next iteration of
+%% des_cbc_[encrypt|decrypt].
+%%
+-spec des_cbc_ivec(iodata()) -> binary().
 
-mod_exp_nif(_Base,_Exp,_Mod,_bin_hdr) -> ?nif_stub.    
+des_cbc_ivec(Data) when is_binary(Data) ->
+    {_, IVec} = split_binary(Data, size(Data) - 8),
+    IVec;
+des_cbc_ivec(Data) when is_list(Data) ->
+    des_cbc_ivec(list_to_binary(Data)).
 
 %%
-%% DSS, RSA - verify
+%% DES - in 8-bits cipher feedback mode (CFB)
 %%
--spec dss_verify(data_or_digest(), binary(), [binary()]) -> boolean().
--spec dss_verify(dss_digest_type(), data_or_digest(), binary(), [binary()]) -> boolean().
--spec rsa_verify(data_or_digest(), binary(), [binary()]) -> boolean().
--spec rsa_verify(rsa_digest_type(), data_or_digest(), binary(), [binary()]) ->
-			boolean().
-
-%% Key = [P,Q,G,Y]   P,Q,G=DSSParams  Y=PublicKey
-dss_verify(Data,Signature,Key) ->
-    dss_verify(sha, Data, Signature, Key).
-
-dss_verify(Type,Data,Signature,Key) when is_binary(Data), Type=/=none ->
-    verify(dss,Type,mpint_to_bin(Data),mpint_to_bin(Signature),map_mpint_to_bin(Key));
-dss_verify(Type,Digest,Signature,Key) ->
-    verify(dss,Type,Digest,mpint_to_bin(Signature),map_mpint_to_bin(Key)).
-
-% Key = [E,N]  E=PublicExponent N=PublicModulus
-rsa_verify(Data,Signature,Key) ->
-    rsa_verify(sha, Data,Signature,Key).
-rsa_verify(Type, Data, Signature, Key) when is_binary(Data) ->
-    verify(rsa, Type, mpint_to_bin(Data), mpint_to_bin(Signature), map_mpint_to_bin(Key));
-rsa_verify(Type, Digest, Signature, Key) ->
-    verify(rsa, Type, Digest, mpint_to_bin(Signature), map_mpint_to_bin(Key)).
-
-
-verify(dss, Type, Data, Signature, Key) ->
-    dss_verify_nif(Type, Data, Signature, map_ensure_int_as_bin(Key));
-
-verify(rsa, Type, DataOrDigest, Signature, Key) ->
-    case rsa_verify_nif(Type, DataOrDigest, Signature, map_ensure_int_as_bin(Key)) of
-    	notsup -> erlang:error(notsup);
-	Bool -> Bool
-    end;
-verify(ecdsa, Type, DataOrDigest, Signature, [Key, Curve]) ->
-    case ecdsa_verify_nif(Type, DataOrDigest, Signature, term_to_ec_key(Curve, undefined, Key)) of
-	notsup -> erlang:error(notsup);
-	Bool -> Bool
-    end.
+-spec des_cfb_encrypt(iodata(), binary(), iodata()) -> binary().
+-spec des_cfb_decrypt(iodata(), binary(), iodata()) -> binary().
 
+des_cfb_encrypt(Key, IVec, Data) ->
+    des_cfb_crypt(Key, IVec, Data, true).
 
-dss_verify_nif(_Type, _Data, _Signature, _Key) -> ?nif_stub.
-rsa_verify_nif(_Type, _Data, _Signature, _Key) -> ?nif_stub.
-ecdsa_verify_nif(_Type, _DataOrDigest, _Signature, _Key) -> ?nif_stub.
+des_cfb_decrypt(Key, IVec, Data) ->
+    des_cfb_crypt(Key, IVec, Data, false).
 
+des_cfb_crypt(_Key, _IVec, _Data, _IsEncrypt) -> ?nif_stub.
 
 %%
-%% DSS, RSA - sign
+%% dec_cfb_ivec(IVec, Data) -> binary()
 %%
-%% Key = [P,Q,G,X]   P,Q,G=DSSParams  X=PrivateKey
--spec dss_sign(data_or_digest(), [binary()]) -> binary().
--spec dss_sign(dss_digest_type(), data_or_digest(), [binary()]) -> binary().
--spec rsa_sign(data_or_digest(), [binary()]) -> binary().
--spec rsa_sign(rsa_digest_type(), data_or_digest(), [binary()]) -> binary().
-
-dss_sign(DataOrDigest,Key) ->
-    dss_sign(sha,DataOrDigest,Key).
-dss_sign(Type, Data, Key) when is_binary(Data), Type=/=none ->
-    sign(dss, Type, mpint_to_bin(Data), map_mpint_to_bin(Key));
-dss_sign(Type, Digest, Key) ->
-    sign(dss, Type, Digest, map_mpint_to_bin(Key)).
-
-
-%% Key = [E,N,D]  E=PublicExponent N=PublicModulus  D=PrivateExponent
-rsa_sign(DataOrDigest,Key) ->
-    rsa_sign(sha, DataOrDigest, Key).
-
-rsa_sign(Type, Data, Key) when is_binary(Data) ->
-    sign(rsa, Type, mpint_to_bin(Data), map_mpint_to_bin(Key));
-rsa_sign(Type, Digest, Key) ->
-    sign(rsa, Type, Digest, map_mpint_to_bin(Key)).
-
-map_mpint_to_bin(List) ->
-    lists:map(fun(E) -> mpint_to_bin(E) end, List ).
-
-map_ensure_int_as_bin([H|_]=List) when is_integer(H) ->
-    lists:map(fun(E) -> int_to_bin(E) end, List);
-map_ensure_int_as_bin(List) ->
-    List.
-
-ensure_int_as_bin(Int) when is_integer(Int) ->
-    int_to_bin(Int);
-ensure_int_as_bin(Bin) ->
-    Bin.
-
-map_to_norm_bin([H|_]=List) when is_integer(H) ->
-    lists:map(fun(E) -> int_to_bin(E) end, List);
-map_to_norm_bin(List) ->
-    lists:map(fun(E) -> mpint_to_bin(E) end, List).
-
-
-sign(rsa, Type, DataOrDigest, Key) ->
-    case rsa_sign_nif(Type, DataOrDigest, map_ensure_int_as_bin(Key)) of
-	error -> erlang:error(badkey, [Type,DataOrDigest,Key]);
-	Sign -> Sign
-    end;
-sign(dss, Type, DataOrDigest, Key) ->
-    case dss_sign_nif(Type, DataOrDigest, map_ensure_int_as_bin(Key)) of
-	error -> erlang:error(badkey, [DataOrDigest, Key]);
-	Sign -> Sign
-    end;
-sign(ecdsa, Type, DataOrDigest, [Key, Curve]) ->
-    case ecdsa_sign_nif(Type, DataOrDigest, term_to_ec_key(Curve, Key, undefined)) of
-	error -> erlang:error(badkey, [Type,DataOrDigest,Key]);
-	Sign -> Sign
-    end.
-
-rsa_sign_nif(_Type,_Data,_Key) -> ?nif_stub.
-dss_sign_nif(_Type,_Data,_Key) -> ?nif_stub.
-ecdsa_sign_nif(_Type, _DataOrDigest, _Key) -> ?nif_stub.
-
-
-
-
--spec public_encrypt(rsa, binary(), [binary()], rsa_padding()) ->
-				binary().
--spec public_decrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
-				binary().
--spec private_encrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
-				binary().
--spec private_decrypt(rsa, binary(), [integer() | binary()], rsa_padding()) ->
-				binary().
-
-public_encrypt(rsa, BinMesg, Key, Padding) ->
-    case rsa_public_crypt(BinMesg,  map_ensure_int_as_bin(Key), Padding, true) of
-	error ->
-	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-%% Binary, Key = [E,N,D]
-private_decrypt(rsa, BinMesg, Key, Padding) ->
-    case rsa_private_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, false) of
-	error ->
-	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-
-%% Binary, Key = [E,N,D]
-private_encrypt(rsa, BinMesg, Key, Padding) ->
-    case rsa_private_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, true) of
-	error ->
-	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-%% Binary, Key = [E,N]
-public_decrypt(rsa, BinMesg, Key, Padding) ->
-    case rsa_public_crypt(BinMesg, map_ensure_int_as_bin(Key), Padding, false) of
-	error ->
-	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-
+%% Returns the IVec to be used in the next iteration of
+%% des_cfb_[encrypt|decrypt].
 %%
-%%  rsa_public_encrypt
-%%  rsa_private_decrypt
--type rsa_padding() :: 'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding' | 'rsa_no_padding'.
-
--spec rsa_public_encrypt(binary(), [binary()], rsa_padding()) ->
-				binary().
--spec rsa_public_decrypt(binary(), [integer() | mpint()], rsa_padding()) ->
-				binary().
--spec rsa_private_encrypt(binary(), [integer() | mpint()], rsa_padding()) ->
-				binary().
--spec rsa_private_decrypt(binary(), [integer() | mpint()], rsa_padding()) ->
-				binary().
 
-%% Binary, Key = [E,N]
-rsa_public_encrypt(BinMesg, Key, Padding) ->
-    case rsa_public_crypt(BinMesg, map_to_norm_bin(Key), Padding, true) of
-	error ->
-	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-rsa_public_crypt(_BinMsg, _Key, _Padding, _IsEncrypt) -> ?nif_stub.    
+-spec des_cfb_ivec(iodata(), iodata()) -> binary().
 
-%% Binary, Key = [E,N,D]
-rsa_private_decrypt(BinMesg, Key, Padding) ->
-    case rsa_private_crypt(BinMesg, map_to_norm_bin(Key), Padding, false) of
-	error ->
-	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
+des_cfb_ivec(IVec, Data) ->
+    IVecAndData = list_to_binary([IVec, Data]),
+    {_, NewIVec} = split_binary(IVecAndData, byte_size(IVecAndData) - 8),
+    NewIVec.
 
-rsa_private_crypt(_BinMsg, _Key, _Padding, _IsEncrypt) -> ?nif_stub.    
 
-    
-%% Binary, Key = [E,N,D]
-rsa_private_encrypt(BinMesg, Key, Padding) ->
-    case rsa_private_crypt(BinMesg, map_to_norm_bin(Key), Padding, true) of
-	error ->
-	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-
-%% Binary, Key = [E,N]
-rsa_public_decrypt(BinMesg, Key, Padding) ->
-    case rsa_public_crypt(BinMesg, map_to_norm_bin(Key), Padding, false) of
-	error ->
-	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
-	Sign -> Sign
-    end.
-    
 %%
 %% AES - with 128 or 256 bit key in cipher block chaining mode (CBC)
 %%
@@ -1298,6 +1253,33 @@ aes_cbc_ivec(Data) when is_binary(Data) ->
 aes_cbc_ivec(Data) when is_list(Data) ->
     aes_cbc_ivec(list_to_binary(Data)).
 
+
+%% Stream ciphers --------------------------------------------------------------------
+
+stream_crypt(Fun, State, Data, Size, MaxByts, []) when Size =< MaxByts ->
+    Fun(State, Data);
+stream_crypt(Fun, State0, Data, Size, MaxByts, Acc) when Size =< MaxByts ->
+    {State, Cipher} = Fun(State0, Data),
+    {State, list_to_binary(lists:reverse([Cipher | Acc]))};
+stream_crypt(Fun, State0, Data, _, MaxByts, Acc) ->
+    <<Increment:MaxByts/binary, Rest/binary>> = Data,
+    {State, CipherText} = Fun(State0, Increment),
+    stream_crypt(Fun, State, Rest, erlang:byte_size(Rest), MaxByts, [CipherText | Acc]).
+
+do_stream_encrypt({aes_ctr, State0}, Data) ->
+    {State, Cipher} = aes_ctr_stream_encrypt(State0, Data),
+    {{aes_ctr, State}, Cipher};
+do_stream_encrypt({rc4, State0}, Data) ->
+    {State, Cipher} = rc4_encrypt_with_state(State0, Data),
+    {{rc4, State}, Cipher}.
+
+do_stream_decrypt({aes_ctr, State0}, Data) ->
+    {State, Text} = aes_ctr_stream_decrypt(State0, Data),
+    {{aes_ctr, State}, Text};
+do_stream_decrypt({rc4, State0}, Data) ->
+    {State, Text} = rc4_encrypt_with_state(State0, Data),
+    {{rc4, State}, Text}.
+
 %%
 %% AES - in counter mode (CTR)
 %%
@@ -1305,7 +1287,7 @@ aes_cbc_ivec(Data) when is_list(Data) ->
 				 binary().
 -spec aes_ctr_decrypt(iodata(), binary(), iodata()) ->
 				 binary().
- 
+
 aes_ctr_encrypt(_Key, _IVec, _Data) -> ?nif_stub.
 aes_ctr_decrypt(_Key, _IVec, _Cipher) -> ?nif_stub.
 
@@ -1326,15 +1308,6 @@ aes_ctr_stream_encrypt({_Key, _IVec, _ECount, _Num}=_State, _Data) -> ?nif_stub.
 aes_ctr_stream_decrypt({_Key, _IVec, _ECount, _Num}=_State, _Cipher) -> ?nif_stub.
      
 %%
-%% XOR - xor to iolists and return a binary
-%% NB doesn't check that they are the same size, just concatenates
-%% them and sends them to the driver
-%%
--spec exor(iodata(), iodata()) -> binary().
-
-exor(_A, _B) -> ?nif_stub.
-
-%%
 %% RC4 - symmetric stream cipher
 %%
 -spec rc4_encrypt(iodata(), iodata()) -> binary().
@@ -1363,7 +1336,76 @@ rc2_40_cbc_encrypt(Key, IVec, Data) when erlang:byte_size(Key) == 5 ->
 rc2_40_cbc_decrypt(Key, IVec, Data)  when erlang:byte_size(Key) == 5 ->
     rc2_cbc_crypt(Key,IVec,Data,false).
 
-%%
+
+%% Secure remote password  -------------------------------------------------------------------
+
+user_srp_gen_key(Private, Generator, Prime) ->
+    case mod_pow(Generator, Private, Prime) of
+	error ->
+	    error;
+	Public ->
+	    {Public, Private}
+    end.
+
+host_srp_gen_key(Private, Verifier, Generator, Prime, Version) ->
+ Multiplier = srp_multiplier(Version, Generator, Prime),
+   case srp_value_B_nif(Multiplier, Verifier, Generator, Private, Prime) of
+   error ->
+       error;
+   Public ->
+       {Public, Private}
+   end.
+
+srp_multiplier('6a', Generator, Prime) ->
+    %% k = SHA1(N | PAD(g)) from http://srp.stanford.edu/design.html
+    C0 = sha_init(),
+    C1 = sha_update(C0, Prime),
+    C2 = sha_update(C1, srp_pad_to(erlang:byte_size(Prime), Generator)),
+    sha_final(C2);
+srp_multiplier('6', _, _) ->
+    <<3/integer>>;
+srp_multiplier('3', _, _) ->
+    <<1/integer>>.
+
+srp_scrambler(Version, UserPublic, HostPublic, Prime) when Version == '6'; Version == '6a'->
+    %% SHA1(PAD(A) | PAD(B)) from http://srp.stanford.edu/design.html
+    PadLength = erlang:byte_size(Prime),
+    C0 = sha_init(),
+    C1 = sha_update(C0, srp_pad_to(PadLength, UserPublic)),
+    C2 = sha_update(C1, srp_pad_to(PadLength, HostPublic)),
+    sha_final(C2);
+srp_scrambler('3', _, HostPublic, _Prime) ->
+    %% The parameter u is a 32-bit unsigned integer which takes its value
+    %% from the first 32 bits of the SHA1 hash of B, MSB first.
+    <<U:32/bits, _/binary>> = sha(HostPublic),
+    U.
+
+srp_pad_length(Width, Length) ->
+    (Width - Length rem Width) rem Width.
+
+srp_pad_to(Width, Binary) ->
+    case srp_pad_length(Width, size(Binary)) of
+        0 -> Binary;
+        N -> << 0:(N*8), Binary/binary>>
+    end.
+
+srp_host_secret_nif(_Verifier, _B, _U, _A, _Prime) -> ?nif_stub.
+
+srp_user_secret_nif(_A, _U, _B, _Multiplier, _Generator, _Exponent, _Prime) -> ?nif_stub.
+
+srp_value_B_nif(_Multiplier, _Verifier, _Generator, _Exponent, _Prime) -> ?nif_stub.
+
+
+%% Digital signatures  --------------------------------------------------------------------
+rsa_sign_nif(_Type,_Data,_Key) -> ?nif_stub.
+dss_sign_nif(_Type,_Data,_Key) -> ?nif_stub.
+ecdsa_sign_nif(_Type, _DataOrDigest, _Key) -> ?nif_stub.
+
+dss_verify_nif(_Type, _Data, _Signature, _Key) -> ?nif_stub.
+rsa_verify_nif(_Type, _Data, _Signature, _Key) -> ?nif_stub.
+ecdsa_verify_nif(_Type, _DataOrDigest, _Signature, _Key) -> ?nif_stub.
+
+%% Public Keys  --------------------------------------------------------------------
 %% DH Diffie-Hellman functions
 %% 
 
@@ -1412,80 +1454,10 @@ dh_compute_key(OthersPublicKey, MyPrivateKey, DHParameters) ->
 
 dh_compute_key_nif(_OthersPublicKey, _MyPrivateKey, _DHParameters) -> ?nif_stub.
 
-generate_key(Type, Params) ->
-    generate_key(Type, Params, undefined).
-
-generate_key(dh, DHParameters, PrivateKey) ->
-    dh_generate_key_nif(ensure_int_as_bin(PrivateKey),
-			map_ensure_int_as_bin(DHParameters), 0);
-
-generate_key(srp, {host, [Verifier, Generator, Prime, Version]}, PrivArg)
-  when is_binary(Verifier), is_binary(Generator), is_binary(Prime), is_atom(Version) ->
-    Private = case PrivArg of
-		  undefined -> random_bytes(32);
-		  _ -> ensure_int_as_bin(PrivArg)
-	      end,
-    host_srp_gen_key(Private, Verifier, Generator, Prime, Version);
-
-generate_key(srp, {user, [Generator, Prime, Version]}, PrivateArg)
-  when is_binary(Generator), is_binary(Prime), is_atom(Version) ->
-    Private = case PrivateArg of
-		  undefined -> random_bytes(32);
-		  _ -> PrivateArg
-	      end,
-    user_srp_gen_key(Private, Generator, Prime);
-
-generate_key(ecdh, Curve, undefined) ->
-    ec_key_to_term_nif(ec_key_generate(Curve)).
-
-
 ec_key_generate(_Key) -> ?nif_stub.
 
-
-compute_key(dh, OthersPublicKey, MyPrivateKey, DHParameters) ->
-    case dh_compute_key_nif(ensure_int_as_bin(OthersPublicKey),
-			    ensure_int_as_bin(MyPrivateKey),
-			    map_ensure_int_as_bin(DHParameters)) of
-	error -> erlang:error(computation_failed,
-			      [OthersPublicKey,MyPrivateKey,DHParameters]);
-	Ret -> Ret
-    end;
-
-compute_key(srp, HostPublic, {UserPublic, UserPrivate},
-	    {user, [DerivedKey, Prime, Generator, Version | ScramblerArg]}) when
-      is_binary(Prime),
-      is_binary(Generator),
-      is_atom(Version) ->
-    HostPubBin = ensure_int_as_bin(HostPublic),
-    Multiplier = srp_multiplier(Version, Generator, Prime),
-    Scrambler = case ScramblerArg of
-		    [] -> srp_scrambler(Version, ensure_int_as_bin(UserPublic),
-					HostPubBin, Prime);
-		    [S] -> S
-		end,
-    srp_user_secret_nif(ensure_int_as_bin(UserPrivate), Scrambler, HostPubBin,
-			Multiplier, Generator, DerivedKey, Prime);
-
-compute_key(srp, UserPublic, {HostPublic, HostPrivate},
-	    {host,[Verifier, Prime, Version | ScramblerArg]}) when
-      is_binary(Verifier),
-      is_binary(Prime),
-      is_atom(Version) ->
-    UserPubBin = ensure_int_as_bin(UserPublic),
-    Scrambler = case ScramblerArg of
-		    [] -> srp_scrambler(Version, UserPubBin, ensure_int_as_bin(HostPublic), Prime);
-		    [S] -> S
-		end,
-    srp_host_secret_nif(Verifier, ensure_int_as_bin(HostPrivate), Scrambler,
-			UserPubBin, Prime);
-
-compute_key(ecdh, Others, My, Curve) ->
-    ecdh_compute_key_nif(ensure_int_as_bin(Others),
-			 term_to_ec_key(Curve,My,undefined)).
-
 ecdh_compute_key_nif(_Others, _My) -> ?nif_stub.
 
-
 %%
 %% EC
 %%
@@ -1511,65 +1483,181 @@ term_to_ec_key(Curve, PrivKey, PubKey) ->
 term_to_ec_key_nif(_Curve, _PrivKey, _PubKey) -> ?nif_stub.
 
 
+%% MISC --------------------------------------------------------------------
+
+exor(Data1, Data2, Size, MaxByts, [])  when Size =< MaxByts ->
+    do_exor(Data1, Data2);
+exor(Data1, Data2, Size, MaxByts, Acc) when Size =< MaxByts ->
+    Result = do_exor(Data1, Data2),
+    list_to_binary(lists:reverse([Result | Acc]));
+exor(Data1, Data2, _Size, MaxByts, Acc) ->
+     <<Increment1:MaxByts/binary, Rest1/binary>> = Data1,
+     <<Increment2:MaxByts/binary, Rest2/binary>> = Data2,
+    Result = do_exor(Increment1, Increment2),
+    exor(Rest1, Rest2, erlang:byte_size(Rest1), MaxByts, [Result | Acc]).
+
+do_exor(_A, _B) -> ?nif_stub.
 
-%%  LOCAL FUNCTIONS
+algorithms() -> ?nif_stub.
+
+int_to_bin(X) when X < 0 -> int_to_bin_neg(X, []);
+int_to_bin(X) -> int_to_bin_pos(X, []).
+
+int_to_bin_pos(0,Ds=[_|_]) ->
+    list_to_binary(Ds);
+int_to_bin_pos(X,Ds) ->
+    int_to_bin_pos(X bsr 8, [(X band 255)|Ds]).
+
+int_to_bin_neg(-1, Ds=[MSB|_]) when MSB >= 16#80 ->
+    list_to_binary(Ds);
+int_to_bin_neg(X,Ds) ->
+    int_to_bin_neg(X bsr 8, [(X band 255)|Ds]).
+
+bytes_to_integer(Bin) ->
+    bin_to_int(Bin).
+
+bin_to_int(Bin) when is_binary(Bin) ->
+    Bits = bit_size(Bin),
+    <<Integer:Bits/integer>> = Bin,
+    Integer;
+bin_to_int(undefined) ->
+    undefined.
+
+map_ensure_int_as_bin([H|_]=List) when is_integer(H) ->
+    lists:map(fun(E) -> int_to_bin(E) end, List);
+map_ensure_int_as_bin(List) ->
+    List.
+
+ensure_int_as_bin(Int) when is_integer(Int) ->
+    int_to_bin(Int);
+ensure_int_as_bin(Bin) ->
+    Bin.
+
+map_to_norm_bin([H|_]=List) when is_integer(H) ->
+    lists:map(fun(E) -> int_to_bin(E) end, List);
+map_to_norm_bin(List) ->
+    lists:map(fun(E) -> mpint_to_bin(E) end, List).
+
+%%--------------------------------------------------------------------
+%%% Deprecated
+%%--------------------------------------------------------------------
 %%
+%%  rsa_public_encrypt
+%%  rsa_private_decrypt
+-type rsa_padding() :: 'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding' | 'rsa_no_padding'.
 
-user_srp_gen_key(Private, Generator, Prime) ->
-    case mod_pow(Generator, Private, Prime) of
+-spec rsa_public_encrypt(binary(), [binary()], rsa_padding()) ->
+				binary().
+-spec rsa_public_decrypt(binary(), [integer() | mpint()], rsa_padding()) ->
+				binary().
+-spec rsa_private_encrypt(binary(), [integer() | mpint()], rsa_padding()) ->
+				binary().
+-spec rsa_private_decrypt(binary(), [integer() | mpint()], rsa_padding()) ->
+				binary().
+
+%% Binary, Key = [E,N]
+rsa_public_encrypt(BinMesg, Key, Padding) ->
+    case rsa_public_crypt(BinMesg, map_to_norm_bin(Key), Padding, true) of
 	error ->
-	    error;
-	Public ->
-	    {Public, Private}
+	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
     end.
 
-host_srp_gen_key(Private, Verifier, Generator, Prime, Version) ->
- Multiplier = srp_multiplier(Version, Generator, Prime),
-   case srp_value_B_nif(Multiplier, Verifier, Generator, Private, Prime) of
-   error ->
-       error;
-   Public ->
-       {Public, Private}
-   end.
+rsa_public_crypt(_BinMsg, _Key, _Padding, _IsEncrypt) -> ?nif_stub.
 
-srp_multiplier('6a', Generator, Prime) ->
-    %% k = SHA1(N | PAD(g)) from http://srp.stanford.edu/design.html
-    C0 = sha_init(),
-    C1 = sha_update(C0, Prime),
-    C2 = sha_update(C1, srp_pad_to(erlang:byte_size(Prime), Generator)),
-    sha_final(C2);
-srp_multiplier('6', _, _) ->
-    <<3/integer>>;
-srp_multiplier('3', _, _) ->
-    <<1/integer>>.
+%% Binary, Key = [E,N,D]
+rsa_private_decrypt(BinMesg, Key, Padding) ->
+    case rsa_private_crypt(BinMesg, map_to_norm_bin(Key), Padding, false) of
+	error ->
+	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
 
-srp_scrambler(Version, UserPublic, HostPublic, Prime) when Version == '6'; Version == '6a'->
-    %% SHA1(PAD(A) | PAD(B)) from http://srp.stanford.edu/design.html
-    PadLength = erlang:byte_size(Prime),
-    C0 = sha_init(),
-    C1 = sha_update(C0, srp_pad_to(PadLength, UserPublic)),
-    C2 = sha_update(C1, srp_pad_to(PadLength, HostPublic)),
-    sha_final(C2);
-srp_scrambler('3', _, HostPublic, _Prime) ->
-    %% The parameter u is a 32-bit unsigned integer which takes its value
-    %% from the first 32 bits of the SHA1 hash of B, MSB first.
-    <<U:32/bits, _/binary>> = sha(HostPublic),
-    U.
+rsa_private_crypt(_BinMsg, _Key, _Padding, _IsEncrypt) -> ?nif_stub.
 
-srp_pad_length(Width, Length) ->
-    (Width - Length rem Width) rem Width.
 
-srp_pad_to(Width, Binary) ->
-    case srp_pad_length(Width, size(Binary)) of
-        0 -> Binary;
-        N -> << 0:(N*8), Binary/binary>>
+%% Binary, Key = [E,N,D]
+rsa_private_encrypt(BinMesg, Key, Padding) ->
+    case rsa_private_crypt(BinMesg, map_to_norm_bin(Key), Padding, true) of
+	error ->
+	    erlang:error(encrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
     end.
 
-srp_host_secret_nif(_Verifier, _B, _U, _A, _Prime) -> ?nif_stub.
+%% Binary, Key = [E,N]
+rsa_public_decrypt(BinMesg, Key, Padding) ->
+    case rsa_public_crypt(BinMesg, map_to_norm_bin(Key), Padding, false) of
+	error ->
+	    erlang:error(decrypt_failed, [BinMesg,Key, Padding]);
+	Sign -> Sign
+    end.
 
-srp_user_secret_nif(_A, _U, _B, _Multiplier, _Generator, _Exponent, _Prime) -> ?nif_stub.
+map_mpint_to_bin(List) ->
+    lists:map(fun(E) -> mpint_to_bin(E) end, List ).
+
+%%
+%% DSS, RSA - sign
+%%
+%% Key = [P,Q,G,X]   P,Q,G=DSSParams  X=PrivateKey
+-spec dss_sign(data_or_digest(), [binary()]) -> binary().
+-spec dss_sign(dss_digest_type(), data_or_digest(), [binary()]) -> binary().
+-spec rsa_sign(data_or_digest(), [binary()]) -> binary().
+-spec rsa_sign(rsa_digest_type(), data_or_digest(), [binary()]) -> binary().
+
+dss_sign(DataOrDigest,Key) ->
+    dss_sign(sha,DataOrDigest,Key).
+dss_sign(Type, Data, Key) when is_binary(Data), Type=/=none ->
+    sign(dss, Type, mpint_to_bin(Data), map_mpint_to_bin(Key));
+dss_sign(Type, Digest, Key) ->
+    sign(dss, Type, Digest, map_mpint_to_bin(Key)).
+
+
+%% Key = [E,N,D]  E=PublicExponent N=PublicModulus  D=PrivateExponent
+rsa_sign(DataOrDigest,Key) ->
+    rsa_sign(sha, DataOrDigest, Key).
+
+rsa_sign(Type, Data, Key) when is_binary(Data) ->
+    sign(rsa, Type, mpint_to_bin(Data), map_mpint_to_bin(Key));
+rsa_sign(Type, Digest, Key) ->
+    sign(rsa, Type, Digest, map_mpint_to_bin(Key)).
+
+%%
+%% DSS, RSA - verify
+%%
+-spec dss_verify(data_or_digest(), binary(), [binary()]) -> boolean().
+-spec dss_verify(dss_digest_type(), data_or_digest(), binary(), [binary()]) -> boolean().
+-spec rsa_verify(data_or_digest(), binary(), [binary()]) -> boolean().
+-spec rsa_verify(rsa_digest_type(), data_or_digest(), binary(), [binary()]) ->
+			boolean().
+
+%% Key = [P,Q,G,Y]   P,Q,G=DSSParams  Y=PublicKey
+dss_verify(Data,Signature,Key) ->
+    dss_verify(sha, Data, Signature, Key).
+
+dss_verify(Type,Data,Signature,Key) when is_binary(Data), Type=/=none ->
+    verify(dss,Type,mpint_to_bin(Data),mpint_to_bin(Signature),map_mpint_to_bin(Key));
+dss_verify(Type,Digest,Signature,Key) ->
+    verify(dss,Type,Digest,mpint_to_bin(Signature),map_mpint_to_bin(Key)).
+
+% Key = [E,N]  E=PublicExponent N=PublicModulus
+rsa_verify(Data,Signature,Key) ->
+    rsa_verify(sha, Data,Signature,Key).
+rsa_verify(Type, Data, Signature, Key) when is_binary(Data) ->
+    verify(rsa, Type, mpint_to_bin(Data), mpint_to_bin(Signature), map_mpint_to_bin(Key));
+rsa_verify(Type, Digest, Signature, Key) ->
+    verify(rsa, Type, Digest, mpint_to_bin(Signature), map_mpint_to_bin(Key)).
+
+-spec strong_rand_mpint(Bits::non_neg_integer(),
+			Top::-1..1,
+			Bottom::0..1) -> binary().
+
+strong_rand_mpint(Bits, Top, Bottom) ->
+    case strong_rand_mpint_nif(Bits,Top,Bottom) of
+        false -> erlang:error(low_entropy);
+        Bin -> Bin
+    end.
+strong_rand_mpint_nif(_Bits, _Top, _Bottom) -> ?nif_stub.
 
-srp_value_B_nif(_Multiplier, _Verifier, _Generator, _Exponent, _Prime) -> ?nif_stub.
 
 %% large integer in a binary with 32bit length
 %% MP representaion  (SSH2)
@@ -1594,32 +1682,6 @@ mpint_pos(X) ->
 	    <<?UINT32(Sz), Bin/binary>>
     end.
 
-int_to_bin(X) when X < 0 -> int_to_bin_neg(X, []);
-int_to_bin(X) -> int_to_bin_pos(X, []).
-
-%%int_to_bin_pos(X) when X >= 0 ->
-%%    int_to_bin_pos(X, []).
-
-int_to_bin_pos(0,Ds=[_|_]) ->
-    list_to_binary(Ds);
-int_to_bin_pos(X,Ds) ->
-    int_to_bin_pos(X bsr 8, [(X band 255)|Ds]).
-
-int_to_bin_neg(-1, Ds=[MSB|_]) when MSB >= 16#80 ->
-    list_to_binary(Ds);
-int_to_bin_neg(X,Ds) ->
-    int_to_bin_neg(X bsr 8, [(X band 255)|Ds]).
-
-bytes_to_integer(Bin) ->
-    bin_to_int(Bin).
-
-bin_to_int(Bin) when is_binary(Bin) ->
-    Bits = bit_size(Bin),
-    <<Integer:Bits/integer>> = Bin,
-    Integer;
-bin_to_int(undefined) ->
-    undefined.
-
 %% int from integer in a binary with 32bit length
 erlint(<<MPIntSize:32/integer,MPIntValue/binary>>) ->
     Bits= MPIntSize * 8,
@@ -1629,11 +1691,71 @@ erlint(<<MPIntSize:32/integer,MPIntValue/binary>>) ->
 mpint_to_bin(<<Len:32, Bin:Len/binary>>) ->
     Bin.
 
-random_bytes(N) ->
-    try strong_rand_bytes(N) of
-	RandBytes ->
-	    RandBytes
-    catch
-	error:low_entropy ->
-	    rand_bytes(N)
-    end.
+%%
+%% mod_exp - utility for rsa generation and SRP
+%%
+mod_exp(Base, Exponent, Modulo)
+  when is_integer(Base), is_integer(Exponent), is_integer(Modulo) ->
+    bin_to_int(mod_exp_nif(int_to_bin(Base), int_to_bin(Exponent), int_to_bin(Modulo), 0));
+
+mod_exp(Base, Exponent, Modulo) ->
+    mod_exp_nif(mpint_to_bin(Base),mpint_to_bin(Exponent),mpint_to_bin(Modulo), 4).
+
+mod_exp_nif(_Base,_Exp,_Mod,_bin_hdr) -> ?nif_stub.
+
+-define(FUNC_LIST, [hash, hash_init, hash_update, hash_final,
+		    hmac, hmac_init, hmac_update, hmac_final, hmac_final_n,
+		    %% deprecated
+		    md4, md4_init, md4_update, md4_final,
+		    md5, md5_init, md5_update, md5_final,
+		    sha, sha_init, sha_update, sha_final,
+		    md5_mac,  md5_mac_96,
+		    sha_mac,  sha_mac_96,
+		    %%
+		    block_encrypt, block_decrypt,
+		    %% deprecated
+		    des_cbc_encrypt, des_cbc_decrypt,
+		    des_cfb_encrypt, des_cfb_decrypt,
+		    des_ecb_encrypt, des_ecb_decrypt,
+		    des3_cbc_encrypt, des3_cbc_decrypt,
+		    des3_cfb_encrypt, des3_cfb_decrypt,
+		    aes_cfb_128_encrypt, aes_cfb_128_decrypt,
+		    rc2_cbc_encrypt, rc2_cbc_decrypt,
+		    rc2_40_cbc_encrypt, rc2_40_cbc_decrypt,
+		    aes_cbc_128_encrypt, aes_cbc_128_decrypt,
+		    aes_cbc_256_encrypt, aes_cbc_256_decrypt,
+		    blowfish_cbc_encrypt, blowfish_cbc_decrypt,
+		    blowfish_cfb64_encrypt, blowfish_cfb64_decrypt,
+		    blowfish_ecb_encrypt, blowfish_ecb_decrypt, blowfish_ofb64_encrypt,
+		    %%
+		    rand_bytes,
+		    strong_rand_bytes,
+		    rand_uniform,
+		    mod_pow,
+		    exor,
+		    %% deprecated
+		    mod_exp,strong_rand_mpint,erlint, mpint,
+		    %%
+		    sign, verify, generate_key, compute_key,
+		    %% deprecated
+		    dss_verify,dss_sign,
+		    rsa_verify,rsa_sign,
+		    rsa_public_encrypt,rsa_private_decrypt,
+		    rsa_private_encrypt,rsa_public_decrypt,
+		    dh_generate_key, dh_compute_key,
+		    %%
+		    stream_init, stream_encrypt, stream_decrypt,
+		    %% deprecated
+		    rc4_encrypt, rc4_set_key, rc4_encrypt_with_state,
+		    aes_ctr_encrypt, aes_ctr_decrypt,
+                    aes_ctr_stream_init, aes_ctr_stream_encrypt, aes_ctr_stream_decrypt,
+		    %%
+		    next_iv,
+		    %% deprecated
+		    aes_cbc_ivec,
+		    des_cbc_ivec, des_cfb_ivec,
+		    info,
+		    %%
+		    info_lib, supports]).
+info() ->
+    ?FUNC_LIST.
diff --git a/lib/crypto/test/crypto_SUITE.erl b/lib/crypto/test/crypto_SUITE.erl
index b3bb5dbd17..58aaa78d28 100644
--- a/lib/crypto/test/crypto_SUITE.erl
+++ b/lib/crypto/test/crypto_SUITE.erl
@@ -212,16 +212,8 @@ mod_pow(Config) when is_list(Config) ->
 exor() ->
     [{doc, "Test the exor function"}].
 exor(Config) when is_list(Config) ->
-    B = <<1, 2, 3, 4, 5, 6, 7, 8, 9, 10>>,
-    Z1 = zero_bin(B),
-    Z1 = crypto:exor(B, B),
-    B1 = crypto:rand_bytes(100),
-    B2 = crypto:rand_bytes(100),
-    Z2 = zero_bin(B1),
-    Z2 = crypto:exor(B1, B1),
-    Z2 = crypto:exor(B2, B2),
-    R = xor_bytes(B1, B2),
-    R = crypto:exor(B1, B2).
+    do_exor(<<1, 2, 3, 4, 5, 6, 7, 8, 9, 10>>),
+    do_exor(term_to_binary(lists:seq(1, 1000000))).
 %%--------------------------------------------------------------------
 rand_uniform() ->
     [{doc, "rand_uniform and random_bytes testing"}].
@@ -229,10 +221,10 @@ rand_uniform(Config) when is_list(Config) ->
     rand_uniform_aux_test(10),
     10 = byte_size(crypto:rand_bytes(10)),
     10 = byte_size(crypto:strong_rand_bytes(10)).
+
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
-
 hash(_, [], []) ->
     ok;
 hash(Type, [Msg | RestMsg], [Digest| RestDigest]) ->
@@ -491,7 +483,7 @@ do_block_iolistify({Type, Key, IV, PlainText}) ->
 iolistify(<<"Test With Truncation">>)->
     %% Do not iolistify as it spoils this special case
     <<"Test With Truncation">>;
-iolistify(Msg)->    
+iolistify(Msg) when is_binary(Msg) ->
     Length = erlang:byte_size(Msg),
     Split = Length div 2,
     List0 = binary_to_list(Msg),
@@ -500,7 +492,9 @@ iolistify(Msg)->
 	   [[Element], List1, List2];
        {List1, List2}->
 	   [List1, List2]
-   end.
+   end;
+iolistify(Msg) ->
+    iolistify(list_to_binary(Msg)).
 
 des_iolistify(Msg) ->    
     des_iolist(erlang:byte_size(Msg) div 8, Msg, []).
@@ -540,6 +534,17 @@ ipow(A, B, M, Prod)  ->
 	    ipow(A1, B1, M, (A*Prod) rem M)
     end.
 
+do_exor(B) ->
+    Z1 = zero_bin(B),
+    Z1 = crypto:exor(B, B),
+    B1 = crypto:rand_bytes(100),
+    B2 = crypto:rand_bytes(100),
+    Z2 = zero_bin(B1),
+    Z2 = crypto:exor(B1, B1),
+    Z2 = crypto:exor(B2, B2),
+    R = xor_bytes(B1, B2),
+    R = crypto:exor(B1, B2).
+
 zero_bin(N) when is_integer(N) ->
     N8 = N * 8,
     <<0:N8/integer>>;
@@ -586,20 +591,20 @@ group_config(md4 = Type, Config) ->
 group_config(md5 = Type, Config) ->
     Msgs = rfc_1321_msgs(),
     Digests = rfc_1321_md5_digests(),
-    Keys = rfc_2202_md5_keys(),
-    Data = rfc_2202_msgs(),
-    Hmac = rfc_2202_hmac_md5(),
+    Keys = rfc_2202_md5_keys() ++ [long_hmac_key(md5)],
+    Data = rfc_2202_msgs() ++ [long_msg()],
+    Hmac = rfc_2202_hmac_md5()  ++ [long_hmac(md5)],
     [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}} | Config];
 group_config(ripemd160 = Type, Config) ->
     Msgs = ripemd160_msgs(),
     Digests = ripemd160_digests(),
    [{hash, {Type, Msgs, Digests}} | Config];
 group_config(sha = Type, Config) ->
-    Msgs = [rfc_4634_test1(), rfc_4634_test2_1()], 
-    Digests = rfc_4634_sha_digests(),
-    Keys = rfc_2202_sha_keys(),
-    Data = rfc_2202_msgs(),
-    Hmac = rfc_2202_hmac_sha(),
+    Msgs = [rfc_4634_test1(), rfc_4634_test2_1(),long_msg()],
+    Digests = rfc_4634_sha_digests() ++ [long_sha_digest()],
+    Keys = rfc_2202_sha_keys() ++ [long_hmac_key(sha)],
+    Data = rfc_2202_msgs() ++ [long_msg()],
+    Hmac = rfc_2202_hmac_sha()  ++ [long_hmac(sha)],
     [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}} | Config];
 group_config(sha224 = Type, Config) ->
     Msgs = [rfc_4634_test1(), rfc_4634_test2_1()], 
@@ -609,25 +614,25 @@ group_config(sha224 = Type, Config) ->
     Hmac = rfc4231_hmac_sha224(),
    [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}}  | Config];
 group_config(sha256 = Type, Config) ->
-    Msgs =   [rfc_4634_test1(), rfc_4634_test2_1()], 
-    Digests = rfc_4634_sha256_digests(),
-    Keys = rfc_4231_keys(),
-    Data = rfc_4231_msgs(),
-    Hmac = rfc4231_hmac_sha256(),
+    Msgs =   [rfc_4634_test1(), rfc_4634_test2_1(), long_msg()],
+    Digests = rfc_4634_sha256_digests()  ++ [long_sha256_digest()],
+    Keys = rfc_4231_keys() ++ [long_hmac_key(sha256)],
+    Data = rfc_4231_msgs()  ++ [long_msg()],
+    Hmac = rfc4231_hmac_sha256()  ++ [long_hmac(sha256)],
     [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}}  | Config];
 group_config(sha384 = Type, Config) ->
-    Msgs =  [rfc_4634_test1(), rfc_4634_test2()],
-    Digests = rfc_4634_sha384_digests(),
-    Keys = rfc_4231_keys(),
-    Data = rfc_4231_msgs(),
-    Hmac = rfc4231_hmac_sha384(),
+    Msgs =  [rfc_4634_test1(), rfc_4634_test2(), long_msg()],
+    Digests = rfc_4634_sha384_digests()  ++ [long_sha384_digest()],
+    Keys = rfc_4231_keys() ++ [long_hmac_key(sha384)],
+    Data = rfc_4231_msgs()  ++ [long_msg()],
+    Hmac = rfc4231_hmac_sha384()  ++ [long_hmac(sha384)],
     [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}}  | Config];
 group_config(sha512 = Type, Config) ->
-    Msgs =  [rfc_4634_test1(), rfc_4634_test2()],
-    Digests = rfc_4634_sha512_digests(),
-    Keys = rfc_4231_keys(),
-    Data = rfc_4231_msgs(),
-    Hmac = rfc4231_hmac_sha512(),
+    Msgs =  [rfc_4634_test1(), rfc_4634_test2(), long_msg()],
+    Digests = rfc_4634_sha512_digests() ++ [long_sha512_digest()],
+    Keys = rfc_4231_keys() ++ [long_hmac_key(sha512)],
+    Data = rfc_4231_msgs() ++ [long_msg()],
+    Hmac = rfc4231_hmac_sha512() ++ [long_hmac(sha512)],
     [{hash, {Type, Msgs, Digests}}, {hmac, {Type, Keys, Data, Hmac}}  | Config];
 group_config(rsa = Type, Config) ->
     Msg = rsa_plain(),
@@ -789,6 +794,23 @@ rfc_4634_sha512_digests() ->
 		"454D4423643CE80E2A9AC94FA54CA49F"),
      hexstr2bin("8E959B75DAE313DA8CF4F72814FC143F8F7779C6EB9F7FA17299AEADB6889018501D289E4900F7E4331B99DEC4B5433AC7D329EEB6DD26545E96E55B874BE909")].
 
+long_msg() ->
+    lists:duplicate(1000000, $a).
+
+long_sha_digest() ->
+    hexstr2bin("34aa973c" "d4c4daa4" "f61eeb2b" "dbad2731" "6534016f").
+
+long_sha256_digest() ->
+    hexstr2bin("cdc76e5c" "9914fb92" "81a1c7e2" "84d73e67" "f1809a48" "a497200e" "046d39cc" "c7112cd0").
+
+long_sha384_digest() ->
+    hexstr2bin("9d0e1809716474cb" "086e834e310a4a1c" "ed149e9c00f24852" "7972cec5704c2a5b"
+	       "07b8b3dc38ecc4eb" "ae97ddd87f3d8985").
+
+long_sha512_digest() ->
+    hexstr2bin("e718483d0ce76964" "4e2e42c7bc15b463" "8e1f98b13b204428" "5632a803afa973eb"
+	       "de0ff244877ea60a" "4cb0432ce577c31b" "eb009c5c2c49aa2e" "4eadb217ad8cc09b").
+
 ripemd160_msgs() ->
     [<<"">>,
      <<"a">>,
@@ -852,6 +874,35 @@ hmac_key(_) ->
 hmac_inc(_) ->
     [<<"Sampl">>, <<"e #1">>].
 
+%% https://www.cosic.esat.kuleuven.be/nessie/testvectors/
+long_hmac_key(Type) when Type == sha384;
+			 Type == sha512 ->
+    hexstr2bin("00112233445566778899AABBCCDDEEFF"
+	       "0123456789ABCDEF0011223344556677"
+	       "8899AABBCCDDEEFF0123456789ABCDEF"
+	       "00112233445566778899AABBCCDDEEFF");
+long_hmac_key(_) ->
+    hexstr2bin("0123456789ABCDEF0123456789ABCDEF"
+	       "0123456789ABCDEF0123456789ABCDEF"
+	       "0123456789ABCDEF0123456789ABCDEF"
+	       "0123456789ABCDEF0123456789ABCDEF").
+long_hmac(md5) ->
+    hexstr2bin("82FDDA30202CB6ACC6F24D4F8A50EB7A");
+long_hmac(sha) ->
+    hexstr2bin("61D1D0B6459860755FDA892938C23DD401E54A7E");
+long_hmac(sha256) ->
+    hexstr2bin("50008B8DC7ED3926936347FDC1A01E9D"
+	       "5220C6CC4B038B482C0F28A4CD88CA37");
+long_hmac(sha384) ->
+    hexstr2bin("C1EB08DAFA015833D3FC6B29A387558B"
+	       "3F6FA1524AA1A8EB64798D5A76A39D6E"
+	       "A1465525342E060EE996277B4FFCDDC9");
+long_hmac(sha512) ->
+    hexstr2bin("D116BF471AAE1264854F1906025E846A"
+	       "61618A965FCA30B695220EA2D6E547E3"
+	       "F3B5A4B54E6778928C26D5D3D810498E"
+	       "8DF86CB3CC1E9F66A00419B13B6B0C9A").
+
 rfc_2202_hmac_md5() ->
     [
      hexstr2bin("9294727a3638bb1c13f48ef8158bfc9d"),
@@ -1193,7 +1244,8 @@ blowfish_ofb64() ->
 
 rc4() ->
     [{rc4, <<"apaapa">>, <<"Yo baby yo">>},
-     {rc4, <<"apaapa">>, list_to_binary(lists:seq(0, 255))}
+     {rc4, <<"apaapa">>, list_to_binary(lists:seq(0, 255))},
+     {rc4, <<"apaapa">>, lists:duplicate(1000000, $a)}
     ].
 
 aes_ctr() ->
@@ -1237,7 +1289,11 @@ aes_ctr() ->
 	hexstr2bin("30c81c46a35ce411e5fbc1191a0a52ef")},
        {aes_ctr, hexstr2bin("603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4"), 
 	hexstr2bin("f0f1f2f3f4f5f6f7f8f9fafbfcfdff02"), 
-	hexstr2bin("f69f2445df4f9b17ad2b417be66c3710")}
+	hexstr2bin("f69f2445df4f9b17ad2b417be66c3710")},
+
+       {aes_ctr,  hexstr2bin("603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4"),
+	hexstr2bin("f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"),
+	lists:duplicate(1000000, $a)}
     ].
 
 rsa_plain() ->
diff --git a/lib/crypto/vsn.mk b/lib/crypto/vsn.mk
index 2a0cb57aa9..d5d7c8a128 100644
--- a/lib/crypto/vsn.mk
+++ b/lib/crypto/vsn.mk
@@ -1 +1 @@
-CRYPTO_VSN = 2.3
+CRYPTO_VSN = 3.0
diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 143e41bae4..002f641f1d 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -43,7 +43,8 @@
     <title>public_key</title>
 
     <list type="bulleted">
-      <item>public_key requires the crypto application.</item>
+      <item>public_key requires the crypto and asn1 applications, the latter since R16 (hopefully the runtime dependency on asn1 will
+      be removed again in the future).</item>
 
       <item>Supports <url href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280 </url> -
       Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile </item>
diff --git a/lib/public_key/src/public_key.app.src b/lib/public_key/src/public_key.app.src
index 9f0677606d..736a778a4b 100644
--- a/lib/public_key/src/public_key.app.src
+++ b/lib/public_key/src/public_key.app.src
@@ -11,7 +11,7 @@
 		  'OTP-PUB-KEY',
 		  'PKCS-FRAME'
             ]},
-   {applications, [crypto, kernel, stdlib]},
+   {applications, [asn1, crypto, kernel, stdlib]},
    {registered, []},
    {env, []}  
    ]
diff --git a/lib/public_key/test/pkits_SUITE.erl b/lib/public_key/test/pkits_SUITE.erl
index c490493e13..9180fa968b 100644
--- a/lib/public_key/test/pkits_SUITE.erl
+++ b/lib/public_key/test/pkits_SUITE.erl
@@ -113,12 +113,14 @@ groups() ->
 init_per_suite(Config) ->
     try crypto:start() of
 	ok ->
+	    application:start(asn1),
 	    crypto_support_check(Config)
     catch _:_ ->
 	    {skip, "Crypto did not start"}
     end.
 
 end_per_suite(_Config) ->
+    application:stop(asn1),
     application:stop(crypto).
 
 %%--------------------------------------------------------------------
diff --git a/lib/public_key/test/public_key_SUITE.erl b/lib/public_key/test/public_key_SUITE.erl
index 5a64140c67..f2596e3d85 100644
--- a/lib/public_key/test/public_key_SUITE.erl
+++ b/lib/public_key/test/public_key_SUITE.erl
@@ -58,12 +58,14 @@ groups() ->
 init_per_suite(Config) ->
     try crypto:start() of
 	ok ->
+	    application:start(asn1),
 	    Config
     catch _:_ ->
 	    {skip, "Crypto did not start"}
     end.
 
 end_per_suite(_Config) ->
+    application:stop(asn1),
     application:stop(crypto).
 
 %%-------------------------------------------------------------------
diff --git a/lib/public_key/vsn.mk b/lib/public_key/vsn.mk
index bd20a5546b..b820f24d2a 100644
--- a/lib/public_key/vsn.mk
+++ b/lib/public_key/vsn.mk
@@ -1 +1 @@
-PUBLIC_KEY_VSN = 0.18
+PUBLIC_KEY_VSN = 0.19
diff --git a/lib/ssh/src/ssh.erl b/lib/ssh/src/ssh.erl
index 3a7aa79d16..7d5478c3f6 100644
--- a/lib/ssh/src/ssh.erl
+++ b/lib/ssh/src/ssh.erl
@@ -41,11 +41,13 @@
 %%--------------------------------------------------------------------
 start() ->
     application:start(crypto),
+    application:start(asn1),
     application:start(public_key),
     application:start(ssh).
 
 start(Type) ->
     application:start(crypto, Type),
+    application:start(asn1),
     application:start(public_key, Type),
     application:start(ssh, Type).
 
diff --git a/lib/ssl/src/tls.erl b/lib/ssl/src/tls.erl
index fcecf8196f..bb02695c12 100644
--- a/lib/ssl/src/tls.erl
+++ b/lib/ssl/src/tls.erl
@@ -94,11 +94,13 @@
 %%--------------------------------------------------------------------
 start() ->
     application:start(crypto),
+    application:start(asn1),
     application:start(public_key),
     application:start(ssl).
 
 start(Type) ->
     application:start(crypto, Type),
+    application:start(asn1),
     application:start(public_key, Type),
     application:start(ssl, Type).
 
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index fed590f0ef..b5cf6d1212 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -190,8 +190,7 @@ init_per_suite(Config0) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
-
+	    ssl:start(),
 	    %% make rsa certs using oppenssl
 	    Result =
 		(catch make_certs:all(?config(data_dir, Config0),
diff --git a/lib/ssl/test/ssl_certificate_verify_SUITE.erl b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
index 4e095dc184..f76c55f670 100644
--- a/lib/ssl/test/ssl_certificate_verify_SUITE.erl
+++ b/lib/ssl/test/ssl_certificate_verify_SUITE.erl
@@ -80,8 +80,7 @@ init_per_suite(Config0) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
-	    application:start(ssl),
+	    ssl:start(),
 	    %% make rsa certs using oppenssl
 	    Result =
 		(catch make_certs:all(?config(data_dir, Config0),
diff --git a/lib/ssl/test/ssl_npn_handshake_SUITE.erl b/lib/ssl/test/ssl_npn_handshake_SUITE.erl
index 7b271c4d5d..30c0a67a36 100644
--- a/lib/ssl/test/ssl_npn_handshake_SUITE.erl
+++ b/lib/ssl/test/ssl_npn_handshake_SUITE.erl
@@ -69,7 +69,6 @@ init_per_suite(Config) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
 	    ssl:start(),
 	    Result =
 		(catch make_certs:all(?config(data_dir, Config),
diff --git a/lib/ssl/test/ssl_packet_SUITE.erl b/lib/ssl/test/ssl_packet_SUITE.erl
index 5a374e234d..36f7af784d 100644
--- a/lib/ssl/test/ssl_packet_SUITE.erl
+++ b/lib/ssl/test/ssl_packet_SUITE.erl
@@ -139,7 +139,7 @@ init_per_suite(Config) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
+	    ssl:start(),
 	    Result =
 		(catch make_certs:all(?config(data_dir, Config),
 				      ?config(priv_dir, Config))),
diff --git a/lib/ssl/test/ssl_payload_SUITE.erl b/lib/ssl/test/ssl_payload_SUITE.erl
index 5f5166391f..f95eae51b7 100644
--- a/lib/ssl/test/ssl_payload_SUITE.erl
+++ b/lib/ssl/test/ssl_payload_SUITE.erl
@@ -71,7 +71,6 @@ init_per_suite(Config) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
 	    ssl:start(),
 	    make_certs:all(?config(data_dir, Config), ?config(priv_dir, Config)),
 	    ssl_test_lib:cert_options(Config)
diff --git a/lib/ssl/test/ssl_session_cache_SUITE.erl b/lib/ssl/test/ssl_session_cache_SUITE.erl
index 6cc6c4bdb2..c31f6c2d7d 100644
--- a/lib/ssl/test/ssl_session_cache_SUITE.erl
+++ b/lib/ssl/test/ssl_session_cache_SUITE.erl
@@ -56,9 +56,7 @@ init_per_suite(Config0) ->
     catch crypto:stop(),
     try crypto:start() of
 	ok ->
-	    application:start(public_key),
 	    ssl:start(),
-
 	    %% make rsa certs using oppenssl
 	    Result =
 		(catch make_certs:all(?config(data_dir, Config0),
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 0564b37f1c..019ed58b1b 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -99,7 +99,6 @@ init_per_suite(Config0) ->
 	    catch crypto:stop(),
 	    try crypto:start() of
 		ok ->
-		    application:start(public_key),
 		    ssl:start(),
 		    Result =
 			(catch make_certs:all(?config(data_dir, Config0),