Adding upstream version 3.7.9.upstream/3.7.9upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

19 files changed, 4059 insertions, 0 deletions

diff --git a/lib/nettle/int/block8.h b/lib/nettle/int/block8.h
new file mode 100644
index 0000000..a1f6efe
--- /dev/null
+++ b/lib/nettle/int/block8.h
@@ -0,0 +1,61 @@
+/* nettle-types.h
+
+   Copyright (C) 2005, 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef GNUTLS_LIB_NETTLE_BLOCK8_H
+#define GNUTLS_LIB_NETTLE_BLOCK8_H
+
+#include "config.h"
+
+#ifndef HAVE_UNION_NETTLE_BLOCK8
+
+/* An aligned 16-byte block. */
+union gnutls_nettle_backport_nettle_block16
+{
+  uint8_t b[16];
+  unsigned long w[16 / sizeof(unsigned long)];
+  uint64_t u64[2];
+};
+
+union gnutls_nettle_backport_nettle_block8
+{
+  uint8_t b[8];
+  uint64_t u64;
+};
+
+#undef nettle_block16
+#undef nettle_block8
+
+#define nettle_block16 gnutls_nettle_backport_nettle_block16
+#define nettle_block8 gnutls_nettle_backport_nettle_block8
+
+#endif
+
+#endif /* GNUTLS_LIB_NETTLE_BLOCK8_H */
diff --git a/lib/nettle/int/drbg-aes-self-test.c b/lib/nettle/int/drbg-aes-self-test.c
new file mode 100644
index 0000000..0ac1c19
--- /dev/null
+++ b/lib/nettle/int/drbg-aes-self-test.c
@@ -0,0 +1,225 @@
+/* nettle, low-level cryptographics library
+ *
+ * Copyright (C) 2013 Red Hat
+ * Copyright (C) 2008  Free Software Foundation, Inc.
+ *  
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * Libgcrypt is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+/* This is a known-answer test for the DRBG-CTR-AES. 
+ */
+
+#include <config.h>
+#include "errors.h"
+#include <drbg-aes.h>
+#include <string.h>
+#include <stdio.h>
+
+struct self_test_st {
+	const uint8_t entropy[DRBG_AES_SEED_SIZE];
+	const uint8_t pstring[32];
+	const uint8_t reseed[DRBG_AES_SEED_SIZE];
+	const uint8_t addtl[3][32];
+	const uint8_t res[64];
+};
+
+struct priv_st {
+	struct drbg_aes_ctx *ctx;
+};
+
+/* Run a Know-Answer-Test using a dedicated test context. */
+int drbg_aes_self_test(void)
+{
+	static const struct self_test_st tv[] = {
+		/*
+		 * Test vector from NIST ACVP test framework that was
+		 * successfully validated by ACVP server.
+		 */
+		{
+		 .entropy = { 0xBE, 0x36, 0xDA, 0x22, 0xC5, 0xEE, 0xC2, 0x46,
+			      0x88, 0xAF, 0xD5, 0xFB, 0xC7, 0x12, 0x98, 0x58,
+			      0x32, 0xD0, 0x35, 0x89, 0x33, 0xF0, 0xFA, 0x2B,
+			      0x1B, 0x0D, 0x02, 0xE9, 0x3A, 0x28, 0x5F, 0x06,
+			      0x04, 0x3B, 0x97, 0x5F, 0xED, 0xD6, 0x2D, 0xC5,
+			      0xD9, 0x76, 0x42, 0x06, 0xEC, 0x80, 0x55, 0xFB },
+		 .pstring = { 0x50, 0xF9, 0x47, 0x14, 0x27, 0xF4, 0xA0, 0xAF,
+			      0x30, 0x08, 0x74, 0x85, 0xC7, 0x94, 0xA3, 0x5D,
+			      0x8F, 0x4F, 0x43, 0x52, 0x0C, 0xC0, 0x64, 0x47,
+			      0xF8, 0xAD, 0xC7, 0xB2, 0x6C, 0x7F, 0x26, 0x6E },
+		 .reseed = {  0x64, 0xDB, 0x9E, 0xC3, 0x45, 0x88, 0xED, 0x33,
+			      0xC8, 0x4C, 0xE2, 0x87, 0x12, 0x9C, 0xCA, 0x02,
+			      0x16, 0x41, 0xB5, 0x3B, 0xCB, 0x5F, 0x01, 0xAE,
+			      0xA0, 0x01, 0xBB, 0x16, 0x44, 0x1B, 0x99, 0x82,
+			      0x97, 0x84, 0x5B, 0x16, 0x58, 0xF3, 0xBD, 0xBE,
+			      0x9A, 0xAB, 0x9F, 0xB7, 0xB2, 0x93, 0xBE, 0xA5 },
+		 .addtl = {
+			   {  0x10, 0xDD, 0xBC, 0x33, 0x29, 0x10, 0x53, 0x4C,
+			      0xA0, 0x10, 0x72, 0xBF, 0x4C, 0x55, 0xDD, 0x7C,
+			      0x08, 0x5F, 0xDF, 0x40, 0xB6, 0x03, 0xF2, 0xBC,
+			      0xEA, 0xAE, 0x08, 0x46, 0x61, 0x68, 0x91, 0xC9 },
+			   {  0x00, 0xB6, 0x84, 0xF7, 0xF3, 0x14, 0xC7, 0x80,
+			      0x57, 0xA4, 0x8F, 0x48, 0xE5, 0xC9, 0x7F, 0x8D,
+			      0x54, 0x88, 0x96, 0xDF, 0x94, 0x55, 0xB1, 0x1C,
+			      0xFA, 0xCF, 0xE0, 0x4D, 0xAA, 0x01, 0xFA, 0x25 },
+			   {  0x97, 0x02, 0xDB, 0xCB, 0x85, 0x2A, 0xAA, 0x55,
+			      0x96, 0xC7, 0xF8, 0xF3, 0xB3, 0x9B, 0xBC, 0xCA,
+			      0xB5, 0xC1, 0x7C, 0x1C, 0x0D, 0x2F, 0x5B, 0x0E,
+			      0x9B, 0xBA, 0xB4, 0xDD, 0x45, 0x90, 0xF2, 0x14 },
+			  },
+		 .res = {     0xfe, 0x78, 0x3c, 0x64, 0x98, 0xb8, 0x69, 0x1d,
+			      0xb7, 0xd4, 0xfb, 0x71, 0xdb, 0x58, 0xd2, 0xee,
+			      0x32, 0x63, 0xfd, 0xed, 0x78, 0xe7, 0x93, 0x13,
+			      0x65, 0xd7, 0xf8, 0x6b, 0x71, 0x90, 0xfc, 0xf4,
+			      0xa3, 0x29, 0xae, 0x0b, 0xca, 0x40, 0x23, 0x61,
+			      0x6c, 0xa3, 0xf8, 0xc6, 0x75, 0x15, 0x38, 0x36,
+			      0x11, 0x5c, 0xc0, 0x87, 0x8a, 0x9b, 0x91, 0xdb,
+			      0x56, 0xb9, 0x06, 0x98, 0xc5, 0x78, 0x1a, 0x3a }
+		 },
+	};
+	unsigned i, j;
+	struct drbg_aes_ctx test_ctx;
+	struct drbg_aes_ctx test_ctx2;
+	struct priv_st priv;
+	int ret, saved;
+	uint8_t *tmp;
+	unsigned char result[64];
+
+	memset(&priv, 0, sizeof(priv));
+	priv.ctx = &test_ctx;
+
+	/* Test the error handling of drbg_aes_init */
+	ret =
+	    drbg_aes_init(&test_ctx, DRBG_AES_SEED_SIZE, tv[0].entropy,
+			  DRBG_AES_SEED_SIZE*2, (void*)tv);
+	if (ret != 0) {
+		gnutls_assert();
+		return 0;
+	}
+
+	tmp = gnutls_malloc(MAX_DRBG_AES_GENERATE_SIZE+1);
+	if (tmp == NULL) {
+		gnutls_assert();
+		return 0;
+	}
+
+	for (i = 0; i < sizeof(tv) / sizeof(tv[0]); i++) {
+		/* CAVP test step 1: initialization with perso string */
+		ret = drbg_aes_init(&test_ctx,
+				    sizeof(tv[i].entropy), tv[i].entropy,
+				    sizeof(tv[i].pstring), tv[i].pstring);
+		if (ret == 0)
+			goto fail;
+
+		if (drbg_aes_is_seeded(&test_ctx) == 0)
+			goto fail;
+
+		/* CAVP test step 2: reseed with addtl information */
+		ret = drbg_aes_reseed(&test_ctx,
+				      sizeof(tv[i].reseed), tv[i].reseed,
+				      sizeof(tv[i].addtl[0]), tv[i].addtl[0]);
+		if (ret == 0)
+			goto fail;
+
+		/* CAVP test step 3: generate with addtl info, discard result */
+		if (drbg_aes_generate(&test_ctx, sizeof(result), result,
+				      sizeof(tv[i].addtl[1]),
+				      tv[i].addtl[1]) == 0)
+			goto fail;
+
+		/* CAVP test step 4: generate with addtl info */
+		if (drbg_aes_generate(&test_ctx, sizeof(result), result,
+				      sizeof(tv[i].addtl[2]),
+				      tv[i].addtl[2]) == 0)
+			goto fail;
+
+		if (memcmp(result, tv[i].res, sizeof(result)) != 0) {
+			goto fail;
+		}
+
+		/* test the error handling of drbg_aes_random() */
+		saved = test_ctx.reseed_counter;
+		test_ctx.reseed_counter = DRBG_AES_RESEED_TIME+1;
+		if (drbg_aes_random(&test_ctx, 16, result) != 0) {
+			gnutls_assert();
+			goto fail;
+		}
+		test_ctx.reseed_counter = saved;
+
+		ret = drbg_aes_random(&test_ctx, MAX_DRBG_AES_GENERATE_SIZE+1, tmp);
+		if (ret == 0) {
+			gnutls_assert();
+			goto fail;
+		}
+
+		/* test the low-level function */
+		ret = drbg_aes_generate(&test_ctx, MAX_DRBG_AES_GENERATE_SIZE+1, tmp, 0, NULL);
+		if (ret != 0) {
+			gnutls_assert();
+			goto fail;
+		}
+
+		/* Test of the reseed function for error handling */
+		ret =
+		    drbg_aes_reseed(&test_ctx, DRBG_AES_SEED_SIZE*2,
+				    (uint8_t*)tv, 0, NULL);
+		if (ret != 0)
+			goto fail;
+
+		ret =
+		    drbg_aes_reseed(&test_ctx, DRBG_AES_SEED_SIZE,
+				    tv[i].entropy, DRBG_AES_SEED_SIZE*2, (uint8_t*)tv);
+		if (ret != 0)
+			goto fail;
+
+		/* check whether reseed detection works */
+		if (i==0) {
+			ret =
+			    drbg_aes_reseed(&test_ctx, DRBG_AES_SEED_SIZE,
+					    tv[i].entropy, 0, NULL);
+			if (ret == 0)
+				goto fail;
+
+			saved = test_ctx.reseed_counter;
+			test_ctx.reseed_counter = DRBG_AES_RESEED_TIME-4;
+			for (j=0;j<5;j++) {
+				if (drbg_aes_random(&test_ctx, 1, result) == 0) {
+					gnutls_assert();
+					goto fail;
+				}
+			}
+			/* that should fail */
+			if (drbg_aes_random(&test_ctx, 1, result) != 0) {
+				gnutls_assert();
+				goto fail;
+			}
+			test_ctx.reseed_counter = saved;
+		}
+
+		/* test deinit, which is zeroize_key() */
+		memcpy(&test_ctx2, &test_ctx, sizeof(test_ctx));
+		zeroize_key(&test_ctx, sizeof(test_ctx));
+		if (memcmp(&test_ctx, &test_ctx2, sizeof(test_ctx)) == 0) {
+			gnutls_assert();
+			goto fail;
+		}
+
+
+	}
+
+	gnutls_free(tmp);
+	return 1;
+ fail:
+	free(tmp);
+	return 0;
+}
diff --git a/lib/nettle/int/drbg-aes.c b/lib/nettle/int/drbg-aes.c
new file mode 100644
index 0000000..af8b347
--- /dev/null
+++ b/lib/nettle/int/drbg-aes.c
@@ -0,0 +1,171 @@
+/* drbg-aes.c */
+
+/* Copyright (C) 2013-2018 Red Hat
+ *
+ * This file is part of GnuTLS.
+ *  
+ * The GnuTLS library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ */
+
+#include <config.h>
+#include <drbg-aes.h>
+#include <nettle/memxor.h>
+#include <nettle/aes.h>
+#include <minmax.h>
+#include <string.h>
+#include <stdio.h>
+#include <fips.h>
+#include <assert.h>
+
+int
+drbg_aes_init(struct drbg_aes_ctx *ctx,
+	      unsigned entropy_size, const uint8_t * entropy,
+	      unsigned pstring_size, const uint8_t * pstring)
+{
+	uint8_t tmp[AES256_KEY_SIZE];
+
+	assert(AES256_KEY_SIZE == DRBG_AES_KEY_SIZE);
+	memset(ctx, 0, sizeof(*ctx));
+	memset(tmp, 0, sizeof(tmp));
+
+	aes256_set_encrypt_key(&ctx->key, tmp);
+
+	return drbg_aes_reseed(ctx, entropy_size, entropy,
+			       pstring_size, pstring);
+}
+
+/* Sets V and key based on pdata */
+static void
+drbg_aes_update(struct drbg_aes_ctx *ctx,
+		const uint8_t pdata[DRBG_AES_SEED_SIZE])
+{
+	unsigned len = 0;
+	uint8_t tmp[DRBG_AES_SEED_SIZE];
+	uint8_t *t = tmp;
+
+	while (len < DRBG_AES_SEED_SIZE) {
+		INCREMENT(sizeof(ctx->v), ctx->v);
+		aes256_encrypt(&ctx->key, AES_BLOCK_SIZE, t, ctx->v);
+		t += AES_BLOCK_SIZE;
+		len += AES_BLOCK_SIZE;
+	}
+
+	memxor(tmp, pdata, DRBG_AES_SEED_SIZE);
+
+	aes256_set_encrypt_key(&ctx->key, tmp);
+
+	memcpy(ctx->v, &tmp[DRBG_AES_KEY_SIZE], AES_BLOCK_SIZE);
+
+	ctx->seeded = 1;
+}
+
+int
+drbg_aes_reseed(struct drbg_aes_ctx *ctx,
+		unsigned entropy_size, const uint8_t * entropy,
+		unsigned add_size, const uint8_t * add)
+{
+	uint8_t tmp[DRBG_AES_SEED_SIZE];
+	unsigned len = 0;
+
+	if (add_size > DRBG_AES_SEED_SIZE || entropy_size != DRBG_AES_SEED_SIZE)
+		return 0;
+
+	if (add_size <= DRBG_AES_SEED_SIZE && add_size > 0) {
+		memcpy(tmp, add, add_size);
+		len = add_size;
+	}
+
+	if (len != DRBG_AES_SEED_SIZE)
+		memset(&tmp[len], 0, DRBG_AES_SEED_SIZE - len);
+
+	memxor(tmp, entropy, entropy_size);
+
+	drbg_aes_update(ctx, tmp);
+	ctx->reseed_counter = 1;
+
+	return 1;
+}
+
+int drbg_aes_random(struct drbg_aes_ctx *ctx, unsigned length, uint8_t * dst)
+{
+	unsigned p_len;
+	int left = length;
+	uint8_t *p = dst;
+	int ret;
+
+	while(left > 0) {
+		p_len = MIN(MAX_DRBG_AES_GENERATE_SIZE, left);
+		ret = drbg_aes_generate(ctx, p_len, p, 0, 0);
+		if (ret == 0)
+			return ret;
+
+		p += p_len;
+		left -= p_len;
+	}
+
+	return 1;
+}
+
+/* we don't use additional input */
+int drbg_aes_generate(struct drbg_aes_ctx *ctx, unsigned length, uint8_t * dst,
+			unsigned add_size, const uint8_t *add)
+{
+	uint8_t tmp[AES_BLOCK_SIZE];
+	uint8_t seed[DRBG_AES_SEED_SIZE];
+	unsigned left;
+
+	if (ctx->seeded == 0)
+		return gnutls_assert_val(0);
+
+	if (length > MAX_DRBG_AES_GENERATE_SIZE)
+		return gnutls_assert_val(0);
+
+	if (add_size > 0) {
+		if (add_size > DRBG_AES_SEED_SIZE)
+			return gnutls_assert_val(0);
+		memcpy(seed, add, add_size);
+		if (add_size != DRBG_AES_SEED_SIZE)
+			memset(&seed[add_size], 0, DRBG_AES_SEED_SIZE - add_size);
+
+		drbg_aes_update(ctx, seed);
+	} else {
+		memset(seed, 0, DRBG_AES_SEED_SIZE);
+	}
+
+	/* Perform the actual encryption */
+	for (left = length; left >= AES_BLOCK_SIZE;
+	     left -= AES_BLOCK_SIZE, dst += AES_BLOCK_SIZE) {
+		INCREMENT(sizeof(ctx->v), ctx->v);
+		aes256_encrypt(&ctx->key, AES_BLOCK_SIZE, dst, ctx->v);
+	}
+
+	if (left > 0) {		/* partial fill */
+		INCREMENT(sizeof(ctx->v), ctx->v);
+		aes256_encrypt(&ctx->key, AES_BLOCK_SIZE, tmp, ctx->v);
+		memcpy(dst, tmp, left);
+	}
+
+	if (ctx->reseed_counter > DRBG_AES_RESEED_TIME)
+		return gnutls_assert_val(0);
+	ctx->reseed_counter++;
+
+	drbg_aes_update(ctx, seed);
+
+	return 1;
+}
+
+int drbg_aes_is_seeded(struct drbg_aes_ctx *ctx)
+{
+	return ctx->seeded;
+}
diff --git a/lib/nettle/int/drbg-aes.h b/lib/nettle/int/drbg-aes.h
new file mode 100644
index 0000000..ac2b858
--- /dev/null
+++ b/lib/nettle/int/drbg-aes.h
@@ -0,0 +1,93 @@
+/* drbg-aes.h
+ *
+ * The CTR-AES-256-based random-number generator from SP800-90A.
+ */
+
+/* Copyright (C) 2013 Red Hat
+ *  
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#ifndef GNUTLS_LIB_NETTLE_INT_DRBG_AES_H
+#define GNUTLS_LIB_NETTLE_INT_DRBG_AES_H
+
+#include <config.h>
+#include <nettle/aes.h>
+
+/* This is nettle's increment macro */
+/* Requires that size > 0 */
+#define INCREMENT(size, ctr)                    \
+  do {                                          \
+    unsigned increment_i = (size) - 1;          \
+    if (++(ctr)[increment_i] == 0)              \
+      while (increment_i > 0                    \
+             && ++(ctr)[--increment_i] == 0 )   \
+        ;                                       \
+  } while (0)
+
+#define DRBG_AES_KEY_SIZE AES256_KEY_SIZE
+#define DRBG_AES_SEED_SIZE (AES_BLOCK_SIZE+DRBG_AES_KEY_SIZE)
+
+/* This is the CTR-AES-256-based random-number generator from SP800-90A.
+ */
+struct drbg_aes_ctx {
+	unsigned seeded;
+	/* The current key */
+	struct aes256_ctx key;
+
+	uint8_t v[AES_BLOCK_SIZE];
+
+	unsigned reseed_counter;
+};
+
+/* max_number_of_bits_per_request */
+#define MAX_DRBG_AES_GENERATE_SIZE 65536 /* 2^19 */
+
+/* This DRBG should be reseeded if reseed_counter exceeds
+ * that number. Otherwise drbg_aes_random() will fail.
+ */
+#define DRBG_AES_RESEED_TIME 16777216
+
+/* The entropy provided in these functions should be of
+ * size DRBG_AES_SEED_SIZE. Additional data and pers.
+ * string may be <= DRBG_AES_SEED_SIZE.
+ */
+int
+drbg_aes_init(struct drbg_aes_ctx *ctx, 
+	unsigned entropy_size, const uint8_t *entropy, 
+	unsigned pstring_size, const uint8_t* pstring);
+
+int
+drbg_aes_reseed(struct drbg_aes_ctx *ctx, 
+	unsigned entropy_size, const uint8_t *entropy, 
+	unsigned add_size, const uint8_t* add);
+
+/* our wrapper for the low-level drbg_aes_generate */
+int
+drbg_aes_random(struct drbg_aes_ctx *ctx, unsigned length,
+		uint8_t * dst);
+
+int
+drbg_aes_generate(struct drbg_aes_ctx *ctx, unsigned length,
+		uint8_t * dst, unsigned add_size, const uint8_t* add);
+
+/* For deinitialization use zeroize_key() on the context */
+
+int drbg_aes_is_seeded(struct drbg_aes_ctx *ctx);
+
+int drbg_aes_self_test(void);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_DRBG_AES_H */
diff --git a/lib/nettle/int/dsa-compute-k.c b/lib/nettle/int/dsa-compute-k.c
new file mode 100644
index 0000000..3f5105a
--- /dev/null
+++ b/lib/nettle/int/dsa-compute-k.c
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2019 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "dsa-compute-k.h"
+
+#include "gnutls_int.h"
+#include "mem.h"
+#include "mpn-base256.h"
+#include <string.h>
+
+#define BITS_TO_LIMBS(bits) (((bits) + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
+
+/* The maximum size of q, chosen from the fact that we support
+ * 521-bit elliptic curve generator and 512-bit DSA subgroup at
+ * maximum. */
+#define MAX_Q_BITS 521
+#define MAX_Q_SIZE ((MAX_Q_BITS + 7) / 8)
+#define MAX_Q_LIMBS BITS_TO_LIMBS(MAX_Q_BITS)
+
+#define MAX_HASH_BITS (MAX_HASH_SIZE * 8)
+#define MAX_HASH_LIMBS BITS_TO_LIMBS(MAX_HASH_BITS)
+
+int
+_gnutls_dsa_compute_k(mpz_t k,
+		      const mpz_t q,
+		      const mpz_t x,
+		      gnutls_mac_algorithm_t mac,
+		      const uint8_t *digest,
+		      size_t length)
+{
+	uint8_t V[MAX_HASH_SIZE];
+	uint8_t K[MAX_HASH_SIZE];
+	uint8_t xp[MAX_Q_SIZE];
+	uint8_t tp[MAX_Q_SIZE];
+	mp_limb_t h[MAX(MAX_Q_LIMBS, MAX_HASH_LIMBS)];
+	mp_bitcnt_t q_bits = mpz_sizeinbase (q, 2);
+	mp_size_t qn = mpz_size(q);
+	mp_bitcnt_t h_bits = length * 8;
+	mp_size_t hn = BITS_TO_LIMBS(h_bits);
+	size_t nbytes = (q_bits + 7) / 8;
+	const uint8_t c0 = 0x00;
+	const uint8_t c1 = 0x01;
+	mp_limb_t cy;
+	gnutls_hmac_hd_t hd;
+	int ret = 0;
+
+	if (unlikely(q_bits > MAX_Q_BITS))
+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+	if (unlikely(length > MAX_HASH_SIZE))
+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+
+	/* int2octets(x) */
+	mpn_get_base256(xp, nbytes, mpz_limbs_read(x), qn);
+
+	/* bits2octets(h) */
+	mpn_set_base256(h, hn, digest, length);
+
+	if (hn < qn)
+		/* qlen > blen: add zero bits to the left */
+		mpn_zero(&h[hn], qn - hn);
+	else if (h_bits > q_bits) {
+		/* qlen < blen: keep the leftmost qlen bits.  We do this in 2
+		 * steps because mpn_rshift only accepts shift count in the
+		 * range 1 to mp_bits_per_limb-1.
+		 */
+		mp_bitcnt_t shift = h_bits - q_bits;
+
+		if (shift / GMP_NUMB_BITS > 0) {
+			mpn_copyi(h, &h[shift / GMP_NUMB_BITS], qn);
+			hn -= shift / GMP_NUMB_BITS;
+		}
+
+		if (shift % GMP_NUMB_BITS > 0)
+			mpn_rshift(h, h, hn, shift % GMP_NUMB_BITS);
+	}
+
+	cy = mpn_sub_n(h, h, mpz_limbs_read(q), qn);
+	/* Fall back to addmul_1, if nettle is linked with mini-gmp. */
+#ifdef mpn_cnd_add_n
+	mpn_cnd_add_n(cy, h, h, mpz_limbs_read(q), qn);
+#else
+	mpn_addmul_1(h, mpz_limbs_read(q), qn, cy != 0);
+#endif
+	mpn_get_base256(tp, nbytes, h, qn);
+
+	/* Step b */
+	memset(V, c1, length);
+
+	/* Step c */
+	memset(K, c0, length);
+
+	/* Step d */
+	ret = gnutls_hmac_init(&hd, mac, K, length);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, V, length);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, &c0, 1);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, xp, nbytes);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, tp, nbytes);
+	if (ret < 0)
+		goto out;
+	gnutls_hmac_deinit(hd, K);
+
+	/* Step e */
+	ret = gnutls_hmac_fast(mac, K, length, V, length, V);
+	if (ret < 0)
+		goto out;
+
+	/* Step f */
+	ret = gnutls_hmac_init(&hd, mac, K, length);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, V, length);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, &c1, 1);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, xp, nbytes);
+	if (ret < 0)
+		goto out;
+	ret = gnutls_hmac(hd, tp, nbytes);
+	if (ret < 0)
+		goto out;
+	gnutls_hmac_deinit(hd, K);
+
+	/* Step g */
+	ret = gnutls_hmac_fast(mac, K, length, V, length, V);
+	if (ret < 0)
+		goto out;
+
+	/* Step h */
+	for (;;) {
+		/* Step 1 */
+		size_t tlen = 0;
+
+		/* Step 2 */
+		while (tlen < nbytes) {
+			size_t remaining = MIN(nbytes - tlen, length);
+			ret = gnutls_hmac_fast(mac, K, length, V, length, V);
+			if (ret < 0)
+				goto out;
+			memcpy (&tp[tlen], V, remaining);
+			tlen += remaining;
+		}
+
+		/* Step 3 */
+		mpn_set_base256 (h, qn, tp, tlen);
+		if (tlen * 8 > q_bits)
+			mpn_rshift (h, h, qn, tlen * 8 - q_bits);
+		/* Check if k is in [1,q-1] */
+		if (!mpn_zero_p (h, qn) &&
+		    mpn_cmp (h, mpz_limbs_read(q), qn) < 0) {
+			mpn_copyi(mpz_limbs_write(k, qn), h, qn);
+			mpz_limbs_finish(k, qn);
+			break;
+		}
+
+		ret = gnutls_hmac_init(&hd, mac, K, length);
+		if (ret < 0)
+			goto out;
+		ret = gnutls_hmac(hd, V, length);
+		if (ret < 0)
+			goto out;
+		ret = gnutls_hmac(hd, &c0, 1);
+		if (ret < 0)
+			goto out;
+		gnutls_hmac_deinit(hd, K);
+
+		ret = gnutls_hmac_fast(mac, K, length, V, length, V);
+		if (ret < 0)
+			goto out;
+	}
+
+ out:
+	zeroize_key(xp, sizeof(xp));
+	zeroize_key(tp, sizeof(tp));
+
+	return ret;
+}
diff --git a/lib/nettle/int/dsa-compute-k.h b/lib/nettle/int/dsa-compute-k.h
new file mode 100644
index 0000000..64e90e0
--- /dev/null
+++ b/lib/nettle/int/dsa-compute-k.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2019 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef GNUTLS_LIB_NETTLE_INT_DSA_COMPUTE_K_H
+#define GNUTLS_LIB_NETTLE_INT_DSA_COMPUTE_K_H
+
+#include <gnutls/gnutls.h>
+#include <nettle/bignum.h> /* includes gmp.h */
+
+int
+_gnutls_dsa_compute_k(mpz_t k,
+		      const mpz_t q,
+		      const mpz_t x,
+		      gnutls_mac_algorithm_t mac,
+		      const uint8_t *digest,
+		      size_t length);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_DSA_COMPUTE_K_H */
diff --git a/lib/nettle/int/dsa-fips.h b/lib/nettle/int/dsa-fips.h
new file mode 100644
index 0000000..351e856
--- /dev/null
+++ b/lib/nettle/int/dsa-fips.h
@@ -0,0 +1,128 @@
+/* dsa.h
+ *
+ * The DSA publickey algorithm.
+ */
+
+/* Copyright (C) 2013 Red Hat
+ *  
+ * The gnutls library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+ 
+#ifndef GNUTLS_LIB_NETTLE_INT_DSA_FIPS_H
+#define GNUTLS_LIB_NETTLE_INT_DSA_FIPS_H
+
+#include <nettle/bignum.h> /* includes gmp.h */
+#include <nettle/dsa.h>
+#include <nettle/sha2.h>
+#include <fips.h>
+
+#define div_ceil(x,y) ((x+(y)-1)/(y))
+
+struct dss_params_validation_seeds {
+	unsigned seed_length; /* first seed */
+	uint8_t seed[MAX_PVP_SEED_SIZE+1];
+	
+	unsigned pseed_length;
+	uint8_t pseed[MAX_PVP_SEED_SIZE+1];
+	unsigned qseed_length;
+	uint8_t qseed[MAX_PVP_SEED_SIZE+1];
+	unsigned pgen_counter;
+	unsigned qgen_counter;
+};
+
+int
+st_provable_prime (mpz_t p,
+			  unsigned *prime_seed_length, void *prime_seed,
+			  unsigned *prime_gen_counter,
+			  unsigned bits,
+			  unsigned seed_length, const void *seed,
+			  void *progress_ctx, nettle_progress_func * progress);
+
+int
+dsa_generate_dss_pqg(struct dsa_params *params,
+		     struct dss_params_validation_seeds* cert,
+		     unsigned index,
+		     void *random_ctx, nettle_random_func *random,
+		     void *progress_ctx, nettle_progress_func *progress,
+		     unsigned p_bits /* = L */, unsigned q_bits /* = N */);
+
+int
+_dsa_generate_dss_pqg(struct dsa_params *params,
+			 struct dss_params_validation_seeds *cert,
+			 unsigned index,
+			 unsigned seed_size, void *seed,
+			 void *progress_ctx, nettle_progress_func * progress,
+			 unsigned p_bits /* = L */ , unsigned q_bits /* = N */ );
+
+int
+dsa_generate_dss_keypair(struct dsa_params *params,
+		     mpz_t y,
+		     mpz_t x,
+		     void *random_ctx, nettle_random_func *random,
+		     void *progress_ctx, nettle_progress_func *progress);
+
+int
+dsa_validate_dss_pqg(struct dsa_params *pub,
+		     struct dss_params_validation_seeds* cert,
+		     unsigned index);
+
+int
+_dsa_validate_dss_pq(struct dsa_params *pub,
+		     struct dss_params_validation_seeds* cert);
+
+int
+_dsa_validate_dss_g(struct dsa_params *pub,
+		    unsigned domain_seed_size, const uint8_t *domain_seed, unsigned index);
+
+unsigned _dsa_check_qp_sizes(unsigned q_bits, unsigned p_bits, unsigned generate);
+
+/* The following low-level functions can be used for DH key exchange as well 
+ */
+int
+_dsa_generate_dss_pq(struct dsa_params *pub,
+		     struct dss_params_validation_seeds* cert,
+		     unsigned seed_length, void* seed,
+		     void *progress_ctx, nettle_progress_func *progress,
+		     unsigned p_bits, unsigned q_bits);
+
+int
+_dsa_generate_dss_g(struct dsa_params *pub,
+		    unsigned domain_seed_size, const uint8_t* domain_seed,
+		    void *progress_ctx, nettle_progress_func * progress,
+		    unsigned index);
+
+void
+_dsa_generate_dss_xy(struct dsa_params *pub,
+		     mpz_t y,
+		     mpz_t x,
+		     void *random_ctx, nettle_random_func *random);
+
+#define DIGEST_SIZE SHA384_DIGEST_SIZE
+inline static void
+hash (uint8_t digest[DIGEST_SIZE], unsigned length, void *data)
+{
+  struct sha384_ctx ctx;
+
+  sha384_init (&ctx);
+  sha384_update (&ctx, length, data);
+  sha384_digest (&ctx, DIGEST_SIZE, digest);
+
+  return;
+}
+
+unsigned mpz_seed_sizeinbase_256_u(mpz_t s, unsigned nominal);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_DSA_FIPS_H */
diff --git a/lib/nettle/int/dsa-keygen-fips186.c b/lib/nettle/int/dsa-keygen-fips186.c
new file mode 100644
index 0000000..69f7f8c
--- /dev/null
+++ b/lib/nettle/int/dsa-keygen-fips186.c
@@ -0,0 +1,466 @@
+/* dsa-keygen.c
+ *
+ * Generation of DSA keypairs
+ */
+
+/* nettle, low-level cryptographics library
+ *
+ * Copyright (C) 2013, 2014 Red Hat
+ *  
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <nettle/dsa.h>
+#include <dsa-fips.h>
+
+#include <nettle/bignum.h>
+
+unsigned _dsa_check_qp_sizes(unsigned q_bits, unsigned p_bits, unsigned generate)
+{
+	switch (q_bits) {
+	case 160:
+		FIPS_RULE(generate != 0, 0, "DSA 160-bit generation\n");
+
+		if (p_bits != 1024)
+			return 0;
+		break;
+	case 224:
+		if (p_bits != 2048)
+			return 0;
+		break;
+	case 256:
+		if (p_bits != 2048 && p_bits != 3072)
+			return 0;
+		break;
+	default:
+		return 0;
+	}
+	return 1;
+}
+
+/* This generates p,q params using the A.1.2.1 algorithm in FIPS 186-4.
+ * 
+ * The hash function used is SHA384.
+ */
+int
+_dsa_generate_dss_pq(struct dsa_params *params,
+		     struct dss_params_validation_seeds *cert,
+		     unsigned seed_length, void *seed,
+		     void *progress_ctx, nettle_progress_func * progress,
+		     unsigned p_bits /* = L */ , unsigned q_bits /* = N */ )
+{
+	mpz_t r, p0, t, z, s, tmp, dp0;
+	int ret;
+	unsigned iterations, old_counter, i;
+	uint8_t *storage = NULL;
+	unsigned storage_length = 0;
+
+	ret = _dsa_check_qp_sizes(q_bits, p_bits, 1);
+	if (ret == 0) {
+		return 0;
+	}
+
+	if (seed_length < q_bits / 8) {
+		_gnutls_debug_log("Seed length must be larger than %d bytes (it is %d)\n", q_bits/8, seed_length);
+		return 0;
+	}
+
+	mpz_init(p0);
+	mpz_init(dp0);
+	mpz_init(r);
+	mpz_init(t);
+	mpz_init(z);
+	mpz_init(s);
+	mpz_init(tmp);
+
+	/* firstseed < 2^(N-1) */
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, q_bits - 1);
+
+	nettle_mpz_set_str_256_u(s, seed_length, seed);
+	if (mpz_cmp(s, r) < 0) {
+		goto fail;
+	}
+
+	cert->qseed_length = sizeof(cert->qseed);
+	cert->pseed_length = sizeof(cert->pseed);
+
+	ret = st_provable_prime(params->q,
+				&cert->qseed_length, cert->qseed,
+				&cert->qgen_counter,
+				q_bits,
+				seed_length, seed, progress_ctx, progress);
+	if (ret == 0) {
+		goto fail;
+	}
+
+	if (progress)
+		progress(progress_ctx, 'q');
+
+	ret = st_provable_prime(p0,
+				&cert->pseed_length, cert->pseed,
+				&cert->pgen_counter,
+				1 + div_ceil(p_bits, 2),
+				cert->qseed_length, cert->qseed,
+				progress_ctx, progress);
+	if (ret == 0) {
+		goto fail;
+	}
+
+	iterations = div_ceil(p_bits, DIGEST_SIZE*8);
+	old_counter = cert->pgen_counter;
+
+	if (iterations > 0) {
+		storage_length = iterations * DIGEST_SIZE;
+		storage = malloc(storage_length);
+		if (storage == NULL) {
+			goto fail;
+		}
+
+		nettle_mpz_set_str_256_u(s, cert->pseed_length, cert->pseed);
+		for (i = 0; i < iterations; i++) {
+			cert->pseed_length = nettle_mpz_sizeinbase_256_u(s);
+			nettle_mpz_get_str_256(cert->pseed_length, cert->pseed, s);
+
+			hash(&storage[(iterations - i - 1) * DIGEST_SIZE],
+			     cert->pseed_length, cert->pseed);
+			mpz_add_ui(s, s, 1);
+		}
+
+		/* x = 2^(p_bits-1) + (x mod 2^(p_bits-1)) */
+		nettle_mpz_set_str_256_u(tmp, storage_length, storage);
+	}
+
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, p_bits - 1);
+
+	mpz_fdiv_r_2exp(tmp, tmp, p_bits - 1);
+	mpz_add(tmp, tmp, r);
+
+	/* Generate candidate prime p in [2^(bits-1), 2^bits] */
+
+	/* t = u[x/2c0] */
+	mpz_mul_2exp(dp0, p0, 1);	/* dp0 = 2*p0 */
+	mpz_mul(dp0, dp0, params->q);	/* dp0 = 2*p0*q */
+
+	mpz_cdiv_q(t, tmp, dp0);
+
+ retry:
+	/* c = 2p0*q*t + 1 */
+	mpz_mul(params->p, dp0, t);
+	mpz_add_ui(params->p, params->p, 1);
+
+	if (mpz_sizeinbase(params->p, 2) > p_bits) {
+		/* t = 2^(bits-1)/2qp0 */
+		mpz_set_ui(tmp, 1);
+		mpz_mul_2exp(tmp, tmp, p_bits - 1);
+		mpz_cdiv_q(t, tmp, dp0);
+
+		/* p = t* 2tq p0 + 1 */
+		mpz_mul(params->p, dp0, t);
+		mpz_add_ui(params->p, params->p, 1);
+	}
+
+	cert->pgen_counter++;
+
+	mpz_set_ui(r, 0);
+
+	if (iterations > 0) {
+		for (i = 0; i < iterations; i++) {
+			cert->pseed_length = nettle_mpz_sizeinbase_256_u(s);
+			nettle_mpz_get_str_256(cert->pseed_length, cert->pseed, s);
+
+			hash(&storage[(iterations - i - 1) * DIGEST_SIZE],
+			     cert->pseed_length, cert->pseed);
+			mpz_add_ui(s, s, 1);
+		}
+
+		/* r = a */
+		nettle_mpz_set_str_256_u(r, storage_length, storage);
+	}
+
+	cert->pseed_length = nettle_mpz_sizeinbase_256_u(s);
+	nettle_mpz_get_str_256(cert->pseed_length, cert->pseed, s);
+
+	/* a = 2 + (a mod (p-3)) */
+	mpz_sub_ui(tmp, params->p, 3);	/* c is too large to worry about negatives */
+	mpz_mod(r, r, tmp);
+	mpz_add_ui(r, r, 2);
+
+	/* z = a^(2tq) mod p */
+	mpz_mul_2exp(tmp, t, 1);	/* tmp = 2t */
+	mpz_mul(tmp, tmp, params->q);	/* tmp = 2tq */
+	mpz_powm(z, r, tmp, params->p);
+
+	mpz_sub_ui(tmp, z, 1);
+
+	mpz_gcd(tmp, tmp, params->p);
+	if (mpz_cmp_ui(tmp, 1) == 0) {
+		mpz_powm(tmp, z, p0, params->p);
+		if (mpz_cmp_ui(tmp, 1) == 0) {
+			goto success;
+		}
+	}
+
+	if (progress)
+		progress(progress_ctx, 'x');
+
+	if (cert->pgen_counter >= (4 * p_bits + old_counter))
+		return 0;
+
+	mpz_add_ui(t, t, 1);
+	goto retry;
+
+ success:
+	if (progress)
+		progress(progress_ctx, 'p');
+
+	ret = 1;
+	goto finish;
+
+ fail:
+	ret = 0;
+
+ finish:
+	mpz_clear(dp0);
+	mpz_clear(p0);
+	mpz_clear(tmp);
+	mpz_clear(t);
+	mpz_clear(z);
+	mpz_clear(s);
+	mpz_clear(r);
+	free(storage);
+	return ret;
+}
+
+int
+_dsa_generate_dss_g(struct dsa_params *params,
+		    unsigned domain_seed_size, const uint8_t* domain_seed,
+		    void *progress_ctx, nettle_progress_func * progress,
+		    unsigned index)
+{
+	mpz_t e, w;
+	uint16_t count;
+	uint8_t *dseed = NULL;
+	unsigned dseed_size;
+	unsigned pos;
+	uint8_t digest[DIGEST_SIZE];
+	int ret;
+
+	if (index > 255 || domain_seed_size == 0)
+		return 0;
+
+	dseed_size = domain_seed_size + 4 + 1 + 2;
+	dseed = malloc(dseed_size);
+	if (dseed == NULL)
+		return 0;
+
+	mpz_init(e);
+	mpz_init(w);
+
+	memcpy(dseed, domain_seed, domain_seed_size);
+	pos = domain_seed_size;
+
+	memcpy(dseed + pos, "\x67\x67\x65\x6e", 4);
+	pos += 4;
+
+	*(dseed + pos) = (uint8_t) index;
+	pos += 1;
+
+	mpz_sub_ui(e, params->p, 1);
+	mpz_fdiv_q(e, e, params->q);
+
+	for (count = 1; count < 65535; count++) {
+		*(dseed + pos) = (count >> 8) & 0xff;
+		*(dseed + pos + 1) = count & 0xff;
+
+		hash(digest, dseed_size, dseed);
+
+		nettle_mpz_set_str_256_u(w, DIGEST_SIZE, digest);
+
+		mpz_powm(params->g, w, e, params->p);
+
+		if (mpz_cmp_ui(params->g, 2) >= 0) {
+			/* found */
+			goto success;
+		}
+		if (progress)
+			progress(progress_ctx, 'x');
+	}
+
+	/* if we're here we failed */
+	if (progress)
+		progress(progress_ctx, 'X');
+	ret = 0;
+	goto finish;
+
+ success:
+	if (progress)
+		progress(progress_ctx, 'g');
+
+	ret = 1;
+
+ finish:
+	free(dseed);
+	mpz_clear(e);
+	mpz_clear(w);
+	return ret;
+
+}
+
+/* Generates the public and private DSA (or DH) keys
+ */
+void
+_dsa_generate_dss_xy(struct dsa_params *params,
+		     mpz_t y, mpz_t x,
+		     void *random_ctx, nettle_random_func * random)
+{
+	mpz_t r;
+
+	mpz_init(r);
+	mpz_set(r, params->q);
+	mpz_sub_ui(r, r, 2);
+	nettle_mpz_random(x, random_ctx, random, r);
+	mpz_add_ui(x, x, 1);
+
+	mpz_powm(y, params->g, x, params->p);
+
+	mpz_clear(r);
+}
+
+/* This generates p, q, g params using the algorithms from FIPS 186-4.
+ * For p, q, the Shawe-Taylor algorithm is used.
+ * For g, the verifiable canonical generation of the generator is used.
+ * 
+ * The hash function used is SHA384.
+ * 
+ * pub: The output public key
+ * key: The output private key
+ * cert: A certificate that can be used to verify the generated parameters
+ * index: 1 for digital signatures (DSA), 2 for key establishment (DH)
+ * p_bits: The requested size of p
+ * q_bits: The requested size of q
+ * 
+ */
+int
+dsa_generate_dss_pqg(struct dsa_params *params,
+			 struct dss_params_validation_seeds *cert,
+			 unsigned index,
+			 void *random_ctx, nettle_random_func * random,
+			 void *progress_ctx, nettle_progress_func * progress,
+			 unsigned p_bits /* = L */ , unsigned q_bits /* = N */ )
+{
+	int ret;
+	uint8_t domain_seed[MAX_PVP_SEED_SIZE*3];
+	unsigned domain_seed_size = 0;
+
+	ret = _dsa_check_qp_sizes(q_bits, p_bits, 1);
+	if (ret == 0)
+		return 0;
+
+	cert->seed_length = 2 * (q_bits / 8) + 1;
+
+	if (cert->seed_length > sizeof(cert->seed))
+		return 0;
+
+	random(random_ctx, cert->seed_length, cert->seed);
+
+	ret = _dsa_generate_dss_pq(params, cert, cert->seed_length, cert->seed,
+				   progress_ctx, progress, p_bits, q_bits);
+	if (ret == 0)
+		return 0;
+
+	domain_seed_size = cert->seed_length + cert->qseed_length + cert->pseed_length;
+	memcpy(domain_seed, cert->seed, cert->seed_length);
+	memcpy(&domain_seed[cert->seed_length], cert->pseed, cert->pseed_length);
+	memcpy(&domain_seed[cert->seed_length+cert->pseed_length], cert->qseed, cert->qseed_length);
+	ret = _dsa_generate_dss_g(params, domain_seed_size, domain_seed,
+				  progress_ctx, progress, index);
+	if (ret == 0)
+		return 0;
+
+	return 1;
+}
+
+int
+_dsa_generate_dss_pqg(struct dsa_params *params,
+			 struct dss_params_validation_seeds *cert,
+			 unsigned index,
+			 unsigned seed_size, void *seed,
+			 void *progress_ctx, nettle_progress_func * progress,
+			 unsigned p_bits /* = L */ , unsigned q_bits /* = N */ )
+{
+	int ret;
+	uint8_t domain_seed[MAX_PVP_SEED_SIZE*3];
+	unsigned domain_seed_size = 0;
+
+	ret = _dsa_check_qp_sizes(q_bits, p_bits, 1);
+	if (ret == 0)
+		return 0;
+
+	if (_gnutls_fips_mode_enabled() != 0) {
+		cert->seed_length = 2 * (q_bits / 8) + 1;
+
+		FIPS_RULE(cert->seed_length != seed_size, 0, "unsupported DSA seed length (is %d, should be %d)\n", seed_size, cert->seed_length);
+	} else {
+		cert->seed_length = seed_size;
+	}
+
+	if (cert->seed_length > sizeof(cert->seed))
+		return 0;
+
+
+	memcpy(cert->seed, seed, cert->seed_length);
+
+	ret = _dsa_generate_dss_pq(params, cert, cert->seed_length, cert->seed,
+				   progress_ctx, progress, p_bits, q_bits);
+	if (ret == 0)
+		return 0;
+
+	domain_seed_size = cert->seed_length + cert->qseed_length + cert->pseed_length;
+	memcpy(domain_seed, cert->seed, cert->seed_length);
+	memcpy(&domain_seed[cert->seed_length], cert->pseed, cert->pseed_length);
+	memcpy(&domain_seed[cert->seed_length+cert->pseed_length], cert->qseed, cert->qseed_length);
+	ret = _dsa_generate_dss_g(params, domain_seed_size, domain_seed,
+				  progress_ctx, progress, index);
+	if (ret == 0)
+		return 0;
+
+	return 1;
+}
+
+int
+dsa_generate_dss_keypair(struct dsa_params *params,
+			 mpz_t y,
+			 mpz_t x,
+			 void *random_ctx, nettle_random_func * random,
+			 void *progress_ctx, nettle_progress_func * progress)
+{
+	_dsa_generate_dss_xy(params, y, x, random_ctx, random);
+
+	if (progress)
+		progress(progress_ctx, '\n');
+
+	return 1;
+
+}
diff --git a/lib/nettle/int/dsa-validate.c b/lib/nettle/int/dsa-validate.c
new file mode 100644
index 0000000..6930705
--- /dev/null
+++ b/lib/nettle/int/dsa-validate.c
@@ -0,0 +1,242 @@
+/* dsa-keygen.c
+ *
+ * Generation of DSA keypairs
+ */
+
+/* nettle, low-level cryptographics library
+ *
+ * Copyright (C) 2013 Red Hat
+ *  
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <nettle/dsa.h>
+#include <dsa-fips.h>
+
+#include <nettle/bignum.h>
+
+/* This validates the given p, q, g params using the provided
+ * dss_params_validation_seeds.
+ * 
+ * The hash function used is SHA384.
+ * 
+ * pub: The output public key
+ * key: The output private key
+ * cert: A certificate that can be used to verify the generated parameters
+ * index: 1 for digital signatures (DSA), 2 for key establishment (DH)
+ * 
+ */
+int
+dsa_validate_dss_pqg(struct dsa_params *pub,
+		     struct dss_params_validation_seeds *cert, unsigned index)
+{
+	int ret;
+	uint8_t domain_seed[MAX_PVP_SEED_SIZE*3];
+	unsigned domain_seed_size = 0;
+
+	ret = _dsa_validate_dss_pq(pub, cert);
+	if (ret == 0)
+		return 0;
+
+	domain_seed_size = cert->seed_length + cert->qseed_length + cert->pseed_length;
+	memcpy(domain_seed, cert->seed, cert->seed_length);
+	memcpy(&domain_seed[cert->seed_length], cert->pseed, cert->pseed_length);
+	memcpy(&domain_seed[cert->seed_length+cert->pseed_length], cert->qseed, cert->qseed_length);
+
+	ret = _dsa_validate_dss_g(pub, domain_seed_size, domain_seed, index);
+	if (ret == 0)
+		return 0;
+
+	return 1;
+}
+
+int
+_dsa_validate_dss_g(struct dsa_params *pub,
+		    unsigned domain_seed_size, const uint8_t *domain_seed, unsigned index)
+{
+	int ret;
+	unsigned p_bits, q_bits;
+	struct dsa_params pub2;
+	mpz_t r;
+
+	p_bits = mpz_sizeinbase(pub->p, 2);
+	q_bits = mpz_sizeinbase(pub->q, 2);
+
+	ret = _dsa_check_qp_sizes(q_bits, p_bits, 0);
+	if (ret == 0) {
+		return 0;
+	}
+
+	mpz_init(r);
+	dsa_params_init(&pub2);
+
+	mpz_set(pub2.p, pub->p);
+	mpz_set(pub2.q, pub->q);
+
+	/* verify g */
+	if (index > 255) {
+		goto fail;
+	}
+
+	/* 2<= g <= p-1 */
+	mpz_set(r, pub->p);
+	mpz_sub_ui(r, r, 1);
+	if (mpz_cmp_ui(pub->g, 2) < 0 || mpz_cmp(pub->g, r) >= 0) {
+		goto fail;
+	}
+
+	/* g^q == 1 mod p */
+	mpz_powm(r, pub->g, pub->q, pub->p);
+	if (mpz_cmp_ui(r, 1) != 0) {
+		goto fail;
+	}
+
+	/* repeat g generation */
+	ret = _dsa_generate_dss_g(&pub2,
+				  domain_seed_size, domain_seed,
+				  NULL, NULL, index);
+	if (ret == 0) {
+		goto fail;
+	}
+
+	if (mpz_cmp(pub->g, pub2.g) != 0) {
+		goto fail;
+	}
+
+	/* everything looks ok */
+	ret = 1;
+	goto finish;
+
+ fail:
+	ret = 0;
+
+ finish:
+	dsa_params_clear(&pub2);
+	mpz_clear(r);
+
+	return ret;
+}
+
+int
+_dsa_validate_dss_pq(struct dsa_params *pub,
+		     struct dss_params_validation_seeds *cert)
+{
+	int ret;
+	unsigned p_bits, q_bits;
+	struct dsa_params pub2;
+	struct dss_params_validation_seeds cert2;
+	mpz_t r, s;
+
+	p_bits = mpz_sizeinbase(pub->p, 2);
+	q_bits = mpz_sizeinbase(pub->q, 2);
+
+	ret = _dsa_check_qp_sizes(q_bits, p_bits, 0);
+	if (ret == 0) {
+		return 0;
+	}
+
+	mpz_init(r);
+	mpz_init(s);
+	dsa_params_init(&pub2);
+
+	nettle_mpz_set_str_256_u(s, cert->seed_length, cert->seed);
+
+	/* firstseed < 2^(N-1) */
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, q_bits - 1);
+
+	if (mpz_cmp(s, r) < 0) {
+		goto fail;
+	}
+
+	/* 2^N <= q */
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, q_bits);
+
+	if (mpz_cmp(r, pub->q) <= 0) {
+		goto fail;
+	}
+
+	/* 2^L <= p */
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, p_bits);
+
+	if (mpz_cmp(r, pub->p) <= 0) {
+		goto fail;
+	}
+
+	/* p-1 mod q != 0 */
+	mpz_set(r, pub->p);
+	mpz_sub_ui(r, r, 1);
+
+	mpz_mod(r, r, pub->q);
+	if (mpz_cmp_ui(r, 0) != 0) {
+		goto fail;
+	}
+
+	/* replay the construction */
+	ret = _dsa_generate_dss_pq(&pub2, &cert2, cert->seed_length, cert->seed,
+				   NULL, NULL, p_bits, q_bits);
+	if (ret == 0) {
+		goto fail;
+	}
+
+	if ((cert->pseed_length > 0 && cert->pseed_length != cert2.pseed_length)
+	    || (cert->qseed_length > 0
+		&& cert->qseed_length != cert2.qseed_length)
+	    || (cert->pgen_counter > 0
+		&& cert->pgen_counter != cert2.pgen_counter)
+	    || (cert->qgen_counter > 0
+		&& cert->qgen_counter != cert2.qgen_counter)
+	    || (cert->qseed_length > 0
+		&& memcmp(cert->qseed, cert2.qseed, cert2.qseed_length) != 0)
+	    || (cert->pseed_length > 0
+		&& memcmp(cert->pseed, cert2.pseed, cert2.pseed_length) != 0)) {
+		goto fail;
+	}
+
+	if (mpz_cmp(pub->q, pub2.q) != 0) {
+		goto fail;
+	}
+
+	if (mpz_cmp(pub->p, pub2.p) != 0) {
+		goto fail;
+	}
+
+	if (mpz_sizeinbase(s, 2) < q_bits - 1) {
+		goto fail;
+	}
+
+	ret = 1;
+	goto finish;
+
+ fail:
+	ret = 0;
+
+ finish:
+	dsa_params_clear(&pub2);
+	mpz_clear(r);
+	mpz_clear(s);
+
+	return ret;
+}
diff --git a/lib/nettle/int/ecdsa-compute-k.c b/lib/nettle/int/ecdsa-compute-k.c
new file mode 100644
index 0000000..94914eb
--- /dev/null
+++ b/lib/nettle/int/ecdsa-compute-k.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2019 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ecdsa-compute-k.h"
+
+#include "dsa-compute-k.h"
+#include "gnutls_int.h"
+
+static inline int
+_gnutls_ecc_curve_to_dsa_q(mpz_t *q, gnutls_ecc_curve_t curve)
+{
+	switch (curve) {
+#ifdef ENABLE_NON_SUITEB_CURVES
+	case GNUTLS_ECC_CURVE_SECP192R1:
+		mpz_init_set_str(*q,
+				 "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836"
+				 "146BC9B1B4D22831",
+				 16);
+		return 0;
+	case GNUTLS_ECC_CURVE_SECP224R1:
+		mpz_init_set_str(*q,
+				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2"
+				 "E0B8F03E13DD29455C5C2A3D",
+				 16);
+		return 0;
+#endif
+	case GNUTLS_ECC_CURVE_SECP256R1:
+		mpz_init_set_str(*q,
+				 "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
+				 "BCE6FAADA7179E84F3B9CAC2FC632551",
+				 16);
+		return 0;
+	case GNUTLS_ECC_CURVE_SECP384R1:
+		mpz_init_set_str(*q,
+				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+				 "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
+				 "581A0DB248B0A77AECEC196ACCC52973",
+				 16);
+		return 0;
+	case GNUTLS_ECC_CURVE_SECP521R1:
+		mpz_init_set_str(*q,
+				 "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+				 "FFA51868783BF2F966B7FCC0148F709A"
+				 "5D03BB5C9B8899C47AEBB6FB71E91386"
+				 "409",
+				 16);
+		return 0;
+	default:
+		return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM);
+	}
+}
+
+int
+_gnutls_ecdsa_compute_k (mpz_t k,
+			 gnutls_ecc_curve_t curve,
+			 const mpz_t x,
+			 gnutls_mac_algorithm_t mac,
+			 const uint8_t *digest,
+			 size_t length)
+{
+	mpz_t q;
+	int ret;
+
+	ret = _gnutls_ecc_curve_to_dsa_q(&q, curve);
+	if (ret < 0)
+		return gnutls_assert_val(ret);
+
+	ret = _gnutls_dsa_compute_k (k, q, x, mac, digest, length);
+	mpz_clear(q);
+	return ret;
+}
diff --git a/lib/nettle/int/ecdsa-compute-k.h b/lib/nettle/int/ecdsa-compute-k.h
new file mode 100644
index 0000000..7ca401d
--- /dev/null
+++ b/lib/nettle/int/ecdsa-compute-k.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2019 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef GNUTLS_LIB_NETTLE_INT_ECDSA_COMPUTE_K_H
+#define GNUTLS_LIB_NETTLE_INT_ECDSA_COMPUTE_K_H
+
+#include <gnutls/gnutls.h>
+#include <nettle/bignum.h> /* includes gmp.h */
+
+int
+_gnutls_ecdsa_compute_k (mpz_t k,
+			 gnutls_ecc_curve_t curve,
+			 const mpz_t x,
+			 gnutls_mac_algorithm_t mac,
+			 const uint8_t *digest,
+			 size_t length);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_ECDSA_COMPUTE_K_H */
diff --git a/lib/nettle/int/mpn-base256.c b/lib/nettle/int/mpn-base256.c
new file mode 100644
index 0000000..88dd00b
--- /dev/null
+++ b/lib/nettle/int/mpn-base256.c
@@ -0,0 +1,97 @@
+/* gmp-glue.c
+
+   Copyright (C) 2013 Niels Möller
+   Copyright (C) 2013 Red Hat
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "mpn-base256.h"
+
+void
+mpn_set_base256 (mp_limb_t *rp, mp_size_t rn,
+		 const uint8_t *xp, size_t xn)
+{
+  size_t xi;
+  mp_limb_t out;
+  unsigned bits;
+  for (xi = xn, out = bits = 0; xi > 0 && rn > 0; )
+    {
+      mp_limb_t in = xp[--xi];
+      out |= (in << bits) & GMP_NUMB_MASK;
+      bits += 8;
+      if (bits >= GMP_NUMB_BITS)
+	{
+	  *rp++ = out;
+	  rn--;
+
+	  bits -= GMP_NUMB_BITS;
+	  out = in >> (8 - bits);
+	}
+    }
+  if (rn > 0)
+    {
+      *rp++ = out;
+      if (--rn > 0)
+	mpn_zero (rp, rn);
+    }
+}
+
+void
+mpn_get_base256 (uint8_t *rp, size_t rn,
+		 const mp_limb_t *xp, mp_size_t xn)
+{
+  unsigned bits;
+  mp_limb_t in;
+  for (bits = in = 0; xn > 0 && rn > 0; )
+    {
+      if (bits >= 8)
+	{
+	  rp[--rn] = in;
+	  in >>= 8;
+	  bits -= 8;
+	}
+      else
+	{
+	  uint8_t old = in;
+	  in = *xp++;
+	  xn--;
+	  rp[--rn] = old | (in << bits);
+	  in >>= (8 - bits);
+	  bits += GMP_NUMB_BITS - 8;
+	}
+    }
+  while (rn > 0)
+    {
+      rp[--rn] = in;
+      in >>= 8;
+    }
+}
diff --git a/lib/nettle/int/mpn-base256.h b/lib/nettle/int/mpn-base256.h
new file mode 100644
index 0000000..b5ca4af
--- /dev/null
+++ b/lib/nettle/int/mpn-base256.h
@@ -0,0 +1,48 @@
+/* gmp-glue.h
+
+   Copyright (C) 2013 Niels Möller
+   Copyright (C) 2013 Red Hat
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_GMP_GLUE_H_INCLUDED
+#define NETTLE_GMP_GLUE_H_INCLUDED
+
+#include <nettle/bignum.h>
+
+/* Like mpn_set_str, but always writes rn limbs. If input is larger,
+   higher bits are ignored. */
+void
+mpn_set_base256 (mp_limb_t *rp, mp_size_t rn,
+		 const uint8_t *xp, size_t xn);
+
+void
+mpn_get_base256 (uint8_t *rp, size_t rn,
+	         const mp_limb_t *xp, mp_size_t xn);
+
+#endif /* NETTLE_GMP_GLUE_H_INCLUDED */
diff --git a/lib/nettle/int/provable-prime.c b/lib/nettle/int/provable-prime.c
new file mode 100644
index 0000000..585cd03
--- /dev/null
+++ b/lib/nettle/int/provable-prime.c
@@ -0,0 +1,1313 @@
+/* bignum-random-prime.c
+ *
+ * Generation of random provable primes.
+ */
+
+/* Copyright (C) 2013 Red Hat
+ *
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#if HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <assert.h>
+#include <stdlib.h>
+#include <nettle/memxor.h>
+#include <nettle/bignum.h>
+#include <dsa-fips.h>
+
+#include <nettle/macros.h>
+
+static const uint16_t primes[] = {
+	3, 5, 7, 11, 13, 17, 19,
+	23, 29, 31, 37, 41, 43, 47,
+	53, 59, 61, 67, 71, 73, 79,
+	83, 89, 97, 101, 103, 107, 109,
+	113, 127, 131, 137, 139, 149, 151,
+	157, 163, 167, 173, 179, 181, 191,
+	193, 197, 199, 211, 223, 227, 229,
+	233, 239, 241, 251, 257, 263, 269,
+	271, 277, 281, 283, 293, 307, 311,
+	313, 317, 331, 337, 347, 349, 353,
+	359, 367, 373, 379, 383, 389, 397,
+	401, 409, 419, 421, 431, 433, 439,
+	443, 449, 457, 461, 463, 467, 479,
+	487, 491, 499, 503, 509, 521, 523,
+	541, 547, 557, 563, 569, 571, 577,
+	587, 593, 599, 601, 607, 613, 617,
+	619, 631, 641, 643, 647, 653, 659,
+	661, 673, 677, 683, 691, 701, 709,
+	719, 727, 733, 739, 743, 751, 757,
+	761, 769, 773, 787, 797, 809, 811,
+	821, 823, 827, 829, 839, 853, 857,
+	859, 863, 877, 881, 883, 887, 907,
+	911, 919, 929, 937, 941, 947, 953,
+	967, 971, 977, 983, 991, 997, 1009,
+	1013, 1019, 1021, 1031, 1033, 1039, 1049,
+	1051, 1061, 1063, 1069, 1087, 1091, 1093,
+	1097, 1103, 1109, 1117, 1123, 1129, 1151,
+	1153, 1163, 1171, 1181, 1187, 1193, 1201,
+	1213, 1217, 1223, 1229, 1231, 1237, 1249,
+	1259, 1277, 1279, 1283, 1289, 1291, 1297,
+	1301, 1303, 1307, 1319, 1321, 1327, 1361,
+	1367, 1373, 1381, 1399, 1409, 1423, 1427,
+	1429, 1433, 1439, 1447, 1451, 1453, 1459,
+	1471, 1481, 1483, 1487, 1489, 1493, 1499,
+	1511, 1523, 1531, 1543, 1549, 1553, 1559,
+	1567, 1571, 1579, 1583, 1597, 1601, 1607,
+	1609, 1613, 1619, 1621, 1627, 1637, 1657,
+	1663, 1667, 1669, 1693, 1697, 1699, 1709,
+	1721, 1723, 1733, 1741, 1747, 1753, 1759,
+	1777, 1783, 1787, 1789, 1801, 1811, 1823,
+	1831, 1847, 1861, 1867, 1871, 1873, 1877,
+	1879, 1889, 1901, 1907, 1913, 1931, 1933,
+	1949, 1951, 1973, 1979, 1987, 1993, 1997,
+	1999, 2003, 2011, 2017, 2027, 2029, 2039,
+	2053, 2063, 2069, 2081, 2083, 2087, 2089,
+	2099, 2111, 2113, 2129, 2131, 2137, 2141,
+	2143, 2153, 2161, 2179, 2203, 2207, 2213,
+	2221, 2237, 2239, 2243, 2251, 2267, 2269,
+	2273, 2281, 2287, 2293, 2297, 2309, 2311,
+	2333, 2339, 2341, 2347, 2351, 2357, 2371,
+	2377, 2381, 2383, 2389, 2393, 2399, 2411,
+	2417, 2423, 2437, 2441, 2447, 2459, 2467,
+	2473, 2477, 2503, 2521, 2531, 2539, 2543,
+	2549, 2551, 2557, 2579, 2591, 2593, 2609,
+	2617, 2621, 2633, 2647, 2657, 2659, 2663,
+	2671, 2677, 2683, 2687, 2689, 2693, 2699,
+	2707, 2711, 2713, 2719, 2729, 2731, 2741,
+	2749, 2753, 2767, 2777, 2789, 2791, 2797,
+	2801, 2803, 2819, 2833, 2837, 2843, 2851,
+	2857, 2861, 2879, 2887, 2897, 2903, 2909,
+	2917, 2927, 2939, 2953, 2957, 2963, 2969,
+	2971, 2999, 3001, 3011, 3019, 3023, 3037,
+	3041, 3049, 3061, 3067, 3079, 3083, 3089,
+	3109, 3119, 3121, 3137, 3163, 3167, 3169,
+	3181, 3187, 3191, 3203, 3209, 3217, 3221,
+	3229, 3251, 3253, 3257, 3259, 3271, 3299,
+	3301, 3307, 3313, 3319, 3323, 3329, 3331,
+	3343, 3347, 3359, 3361, 3371, 3373, 3389,
+	3391, 3407, 3413, 3433, 3449, 3457, 3461,
+	3463, 3467, 3469, 3491, 3499, 3511, 3517,
+	3527, 3529, 3533, 3539, 3541, 3547, 3557,
+	3559, 3571, 3581, 3583, 3593, 3607, 3613,
+	3617, 3623, 3631, 3637, 3643, 3659, 3671,
+	3673, 3677, 3691, 3697, 3701, 3709, 3719,
+	3727, 3733, 3739, 3761, 3767, 3769, 3779,
+	3793, 3797, 3803, 3821, 3823, 3833, 3847,
+	3851, 3853, 3863, 3877, 3881, 3889, 3907,
+	3911, 3917, 3919, 3923, 3929, 3931, 3943,
+	3947, 3967, 3989, 4001, 4003, 4007, 4013,
+	4019, 4021, 4027, 4049, 4051, 4057, 4073,
+	4079, 4091, 4093, 4099, 4111, 4127, 4129,
+	4133, 4139, 4153, 4157, 4159, 4177, 4201,
+	4211, 4217, 4219, 4229, 4231, 4241, 4243,
+	4253, 4259, 4261, 4271, 4273, 4283, 4289,
+	4297, 4327, 4337, 4339, 4349, 4357, 4363,
+	4373, 4391, 4397, 4409, 4421, 4423, 4441,
+	4447, 4451, 4457, 4463, 4481, 4483, 4493,
+	4507, 4513, 4517, 4519, 4523, 4547, 4549,
+	4561, 4567, 4583, 4591, 4597, 4603, 4621,
+	4637, 4639, 4643, 4649, 4651, 4657, 4663,
+	4673, 4679, 4691, 4703, 4721, 4723, 4729,
+	4733, 4751, 4759, 4783, 4787, 4789, 4793,
+	4799, 4801, 4813, 4817, 4831, 4861, 4871,
+	4877, 4889, 4903, 4909, 4919, 4931, 4933,
+	4937, 4943, 4951, 4957, 4967, 4969, 4973,
+	4987, 4993, 4999, 5003, 5009, 5011, 5021,
+	5023, 5039, 5051, 5059, 5077, 5081, 5087,
+	5099, 5101, 5107, 5113, 5119, 5147, 5153,
+	5167, 5171, 5179, 5189, 5197, 5209, 5227,
+	5231, 5233, 5237, 5261, 5273, 5279, 5281,
+	5297, 5303, 5309, 5323, 5333, 5347, 5351,
+	5381, 5387, 5393, 5399, 5407, 5413, 5417,
+	5419, 5431, 5437, 5441, 5443, 5449, 5471,
+	5477, 5479, 5483, 5501, 5503, 5507, 5519,
+	5521, 5527, 5531, 5557, 5563, 5569, 5573,
+	5581, 5591, 5623, 5639, 5641, 5647, 5651,
+	5653, 5657, 5659, 5669, 5683, 5689, 5693,
+	5701, 5711, 5717, 5737, 5741, 5743, 5749,
+	5779, 5783, 5791, 5801, 5807, 5813, 5821,
+	5827, 5839, 5843, 5849, 5851, 5857, 5861,
+	5867, 5869, 5879, 5881, 5897, 5903, 5923,
+	5927, 5939, 5953, 5981, 5987, 6007, 6011,
+	6029, 6037, 6043, 6047, 6053, 6067, 6073,
+	6079, 6089, 6091, 6101, 6113, 6121, 6131,
+	6133, 6143, 6151, 6163, 6173, 6197, 6199,
+	6203, 6211, 6217, 6221, 6229, 6247, 6257,
+	6263, 6269, 6271, 6277, 6287, 6299, 6301,
+	6311, 6317, 6323, 6329, 6337, 6343, 6353,
+	6359, 6361, 6367, 6373, 6379, 6389, 6397,
+	6421, 6427, 6449, 6451, 6469, 6473, 6481,
+	6491, 6521, 6529, 6547, 6551, 6553, 6563,
+	6569, 6571, 6577, 6581, 6599, 6607, 6619,
+	6637, 6653, 6659, 6661, 6673, 6679, 6689,
+	6691, 6701, 6703, 6709, 6719, 6733, 6737,
+	6761, 6763, 6779, 6781, 6791, 6793, 6803,
+	6823, 6827, 6829, 6833, 6841, 6857, 6863,
+	6869, 6871, 6883, 6899, 6907, 6911, 6917,
+	6947, 6949, 6959, 6961, 6967, 6971, 6977,
+	6983, 6991, 6997, 7001, 7013, 7019, 7027,
+	7039, 7043, 7057, 7069, 7079, 7103, 7109,
+	7121, 7127, 7129, 7151, 7159, 7177, 7187,
+	7193, 7207, 7211, 7213, 7219, 7229, 7237,
+	7243, 7247, 7253, 7283, 7297, 7307, 7309,
+	7321, 7331, 7333, 7349, 7351, 7369, 7393,
+	7411, 7417, 7433, 7451, 7457, 7459, 7477,
+	7481, 7487, 7489, 7499, 7507, 7517, 7523,
+	7529, 7537, 7541, 7547, 7549, 7559, 7561,
+	7573, 7577, 7583, 7589, 7591, 7603, 7607,
+	7621, 7639, 7643, 7649, 7669, 7673, 7681,
+	7687, 7691, 7699, 7703, 7717, 7723, 7727,
+	7741, 7753, 7757, 7759, 7789, 7793, 7817,
+	7823, 7829, 7841, 7853, 7867, 7873, 7877,
+	7879, 7883, 7901, 7907, 7919, 7927, 7933,
+	7937, 7949, 7951, 7963, 7993, 8009, 8011,
+	8017, 8039, 8053, 8059, 8069, 8081, 8087,
+	8089, 8093, 8101, 8111, 8117, 8123, 8147,
+	8161, 8167, 8171, 8179, 8191, 8209, 8219,
+	8221, 8231, 8233, 8237, 8243, 8263, 8269,
+	8273, 8287, 8291, 8293, 8297, 8311, 8317,
+	8329, 8353, 8363, 8369, 8377, 8387, 8389,
+	8419, 8423, 8429, 8431, 8443, 8447, 8461,
+	8467, 8501, 8513, 8521, 8527, 8537, 8539,
+	8543, 8563, 8573, 8581, 8597, 8599, 8609,
+	8623, 8627, 8629, 8641, 8647, 8663, 8669,
+	8677, 8681, 8689, 8693, 8699, 8707, 8713,
+	8719, 8731, 8737, 8741, 8747, 8753, 8761,
+	8779, 8783, 8803, 8807, 8819, 8821, 8831,
+	8837, 8839, 8849, 8861, 8863, 8867, 8887,
+	8893, 8923, 8929, 8933, 8941, 8951, 8963,
+	8969, 8971, 8999, 9001, 9007, 9011, 9013,
+	9029, 9041, 9043, 9049, 9059, 9067, 9091,
+	9103, 9109, 9127, 9133, 9137, 9151, 9157,
+	9161, 9173, 9181, 9187, 9199, 9203, 9209,
+	9221, 9227, 9239, 9241, 9257, 9277, 9281,
+	9283, 9293, 9311, 9319, 9323, 9337, 9341,
+	9343, 9349, 9371, 9377, 9391, 9397, 9403,
+	9413, 9419, 9421, 9431, 9433, 9437, 9439,
+	9461, 9463, 9467, 9473, 9479, 9491, 9497,
+	9511, 9521, 9533, 9539, 9547, 9551, 9587,
+	9601, 9613, 9619, 9623, 9629, 9631, 9643,
+	9649, 9661, 9677, 9679, 9689, 9697, 9719,
+	9721, 9733, 9739, 9743, 9749, 9767, 9769,
+	9781, 9787, 9791, 9803, 9811, 9817, 9829,
+	9833, 9839, 9851, 9857, 9859, 9871, 9883,
+	9887, 9901, 9907, 9923, 9929, 9931, 9941,
+	9949, 9967, 9973, 10007, 10009, 10037, 10039,
+	10061, 10067, 10069, 10079, 10091, 10093, 10099,
+	10103, 10111, 10133, 10139, 10141, 10151, 10159,
+	10163, 10169, 10177, 10181, 10193, 10211, 10223,
+	10243, 10247, 10253, 10259, 10267, 10271, 10273,
+	10289, 10301, 10303, 10313, 10321, 10331, 10333,
+	10337, 10343, 10357, 10369, 10391, 10399, 10427,
+	10429, 10433, 10453, 10457, 10459, 10463, 10477,
+	10487, 10499, 10501, 10513, 10529, 10531, 10559,
+	10567, 10589, 10597, 10601, 10607, 10613, 10627,
+	10631, 10639, 10651, 10657, 10663, 10667, 10687,
+	10691, 10709, 10711, 10723, 10729, 10733, 10739,
+	10753, 10771, 10781, 10789, 10799, 10831, 10837,
+	10847, 10853, 10859, 10861, 10867, 10883, 10889,
+	10891, 10903, 10909, 10937, 10939, 10949, 10957,
+	10973, 10979, 10987, 10993, 11003, 11027, 11047,
+	11057, 11059, 11069, 11071, 11083, 11087, 11093,
+	11113, 11117, 11119, 11131, 11149, 11159, 11161,
+	11171, 11173, 11177, 11197, 11213, 11239, 11243,
+	11251, 11257, 11261, 11273, 11279, 11287, 11299,
+	11311, 11317, 11321, 11329, 11351, 11353, 11369,
+	11383, 11393, 11399, 11411, 11423, 11437, 11443,
+	11447, 11467, 11471, 11483, 11489, 11491, 11497,
+	11503, 11519, 11527, 11549, 11551, 11579, 11587,
+	11593, 11597, 11617, 11621, 11633, 11657, 11677,
+	11681, 11689, 11699, 11701, 11717, 11719, 11731,
+	11743, 11777, 11779, 11783, 11789, 11801, 11807,
+	11813, 11821, 11827, 11831, 11833, 11839, 11863,
+	11867, 11887, 11897, 11903, 11909, 11923, 11927,
+	11933, 11939, 11941, 11953, 11959, 11969, 11971,
+	11981, 11987, 12007, 12011, 12037, 12041, 12043,
+	12049, 12071, 12073, 12097, 12101, 12107, 12109,
+	12113, 12119, 12143, 12149, 12157, 12161, 12163,
+	12197, 12203, 12211, 12227, 12239, 12241, 12251,
+	12253, 12263, 12269, 12277, 12281, 12289, 12301,
+	12323, 12329, 12343, 12347, 12373, 12377, 12379,
+	12391, 12401, 12409, 12413, 12421, 12433, 12437,
+	12451, 12457, 12473, 12479, 12487, 12491, 12497,
+	12503, 12511, 12517, 12527, 12539, 12541, 12547,
+	12553, 12569, 12577, 12583, 12589, 12601, 12611,
+	12613, 12619, 12637, 12641, 12647, 12653, 12659,
+	12671, 12689, 12697, 12703, 12713, 12721, 12739,
+	12743, 12757, 12763, 12781, 12791, 12799, 12809,
+	12821, 12823, 12829, 12841, 12853, 12889, 12893,
+	12899, 12907, 12911, 12917, 12919, 12923, 12941,
+	12953, 12959, 12967, 12973, 12979, 12983, 13001,
+	13003, 13007, 13009, 13033, 13037, 13043, 13049,
+	13063, 13093, 13099, 13103, 13109, 13121, 13127,
+	13147, 13151, 13159, 13163, 13171, 13177, 13183,
+	13187, 13217, 13219, 13229, 13241, 13249, 13259,
+	13267, 13291, 13297, 13309, 13313, 13327, 13331,
+	13337, 13339, 13367, 13381, 13397, 13399, 13411,
+	13417, 13421, 13441, 13451, 13457, 13463, 13469,
+	13477, 13487, 13499, 13513, 13523, 13537, 13553,
+	13567, 13577, 13591, 13597, 13613, 13619, 13627,
+	13633, 13649, 13669, 13679, 13681, 13687, 13691,
+	13693, 13697, 13709, 13711, 13721, 13723, 13729,
+	13751, 13757, 13759, 13763, 13781, 13789, 13799,
+	13807, 13829, 13831, 13841, 13859, 13873, 13877,
+	13879, 13883, 13901, 13903, 13907, 13913, 13921,
+	13931, 13933, 13963, 13967, 13997, 13999, 14009,
+	14011, 14029, 14033, 14051, 14057, 14071, 14081,
+	14083, 14087, 14107, 14143, 14149, 14153, 14159,
+	14173, 14177, 14197, 14207, 14221, 14243, 14249,
+	14251, 14281, 14293, 14303, 14321, 14323, 14327,
+	14341, 14347, 14369, 14387, 14389, 14401, 14407,
+	14411, 14419, 14423, 14431, 14437, 14447, 14449,
+	14461, 14479, 14489, 14503, 14519, 14533, 14537,
+	14543, 14549, 14551, 14557, 14561, 14563, 14591,
+	14593, 14621, 14627, 14629, 14633, 14639, 14653,
+	14657, 14669, 14683, 14699, 14713, 14717, 14723,
+	14731, 14737, 14741, 14747, 14753, 14759, 14767,
+	14771, 14779, 14783, 14797, 14813, 14821, 14827,
+	14831, 14843, 14851, 14867, 14869, 14879, 14887,
+	14891, 14897, 14923, 14929, 14939, 14947, 14951,
+	14957, 14969, 14983, 15013, 15017, 15031, 15053,
+	15061, 15073, 15077, 15083, 15091, 15101, 15107,
+	15121, 15131, 15137, 15139, 15149, 15161, 15173,
+	15187, 15193, 15199, 15217, 15227, 15233, 15241,
+	15259, 15263, 15269, 15271, 15277, 15287, 15289,
+	15299, 15307, 15313, 15319, 15329, 15331, 15349,
+	15359, 15361, 15373, 15377, 15383, 15391, 15401,
+	15413, 15427, 15439, 15443, 15451, 15461, 15467,
+	15473, 15493, 15497, 15511, 15527, 15541, 15551,
+	15559, 15569, 15581, 15583, 15601, 15607, 15619,
+	15629, 15641, 15643, 15647, 15649, 15661, 15667,
+	15671, 15679, 15683, 15727, 15731, 15733, 15737,
+	15739, 15749, 15761, 15767, 15773, 15787, 15791,
+	15797, 15803, 15809, 15817, 15823, 15859, 15877,
+	15881, 15887, 15889, 15901, 15907, 15913, 15919,
+	15923, 15937, 15959, 15971, 15973, 15991, 16001,
+	16007, 16033, 16057, 16061, 16063, 16067, 16069,
+	16073, 16087, 16091, 16097, 16103, 16111, 16127,
+	16139, 16141, 16183, 16187, 16189, 16193, 16217,
+	16223, 16229, 16231, 16249, 16253, 16267, 16273,
+	16301, 16319, 16333, 16339, 16349, 16361, 16363,
+	16369, 16381, 16411, 16417, 16421, 16427, 16433,
+	16447, 16451, 16453, 16477, 16481, 16487, 16493,
+	16519, 16529, 16547, 16553, 16561, 16567, 16573,
+	16603, 16607, 16619, 16631, 16633, 16649, 16651,
+	16657, 16661, 16673, 16691, 16693, 16699, 16703,
+	16729, 16741, 16747, 16759, 16763, 16787, 16811,
+	16823, 16829, 16831, 16843, 16871, 16879, 16883,
+	16889, 16901, 16903, 16921, 16927, 16931, 16937,
+	16943, 16963, 16979, 16981, 16987, 16993, 17011,
+	17021, 17027, 17029, 17033, 17041, 17047, 17053,
+	17077, 17093, 17099, 17107, 17117, 17123, 17137,
+	17159, 17167, 17183, 17189, 17191, 17203, 17207,
+	17209, 17231, 17239, 17257, 17291, 17293, 17299,
+	17317, 17321, 17327, 17333, 17341, 17351, 17359,
+	17377, 17383, 17387, 17389, 17393, 17401, 17417,
+	17419, 17431, 17443, 17449, 17467, 17471, 17477,
+	17483, 17489, 17491, 17497, 17509, 17519, 17539,
+	17551, 17569, 17573, 17579, 17581, 17597, 17599,
+	17609, 17623, 17627, 17657, 17659, 17669, 17681,
+	17683, 17707, 17713, 17729, 17737, 17747, 17749,
+	17761, 17783, 17789, 17791, 17807, 17827, 17837,
+	17839, 17851, 17863, 17881, 17891, 17903, 17909,
+	17911, 17921, 17923, 17929, 17939, 17957, 17959,
+	17971, 17977, 17981, 17987, 17989, 18013, 18041,
+	18043, 18047, 18049, 18059, 18061, 18077, 18089,
+	18097, 18119, 18121, 18127, 18131, 18133, 18143,
+	18149, 18169, 18181, 18191, 18199, 18211, 18217,
+	18223, 18229, 18233, 18251, 18253, 18257, 18269,
+	18287, 18289, 18301, 18307, 18311, 18313, 18329,
+	18341, 18353, 18367, 18371, 18379, 18397, 18401,
+	18413, 18427, 18433, 18439, 18443, 18451, 18457,
+	18461, 18481, 18493, 18503, 18517, 18521, 18523,
+	18539, 18541, 18553, 18583, 18587, 18593, 18617,
+	18637, 18661, 18671, 18679, 18691, 18701, 18713,
+	18719, 18731, 18743, 18749, 18757, 18773, 18787,
+	18793, 18797, 18803, 18839, 18859, 18869, 18899,
+	18911, 18913, 18917, 18919, 18947, 18959, 18973,
+	18979, 19001, 19009, 19013, 19031, 19037, 19051,
+	19069, 19073, 19079, 19081, 19087, 19121, 19139,
+	19141, 19157, 19163, 19181, 19183, 19207, 19211,
+	19213, 19219, 19231, 19237, 19249, 19259, 19267,
+	19273, 19289, 19301, 19309, 19319, 19333, 19373,
+	19379, 19381, 19387, 19391, 19403, 19417, 19421,
+	19423, 19427, 19429, 19433, 19441, 19447, 19457,
+	19463, 19469, 19471, 19477, 19483, 19489, 19501,
+	19507, 19531, 19541, 19543, 19553, 19559, 19571,
+	19577, 19583, 19597, 19603, 19609, 19661, 19681,
+	19687, 19697, 19699, 19709, 19717, 19727, 19739,
+	19751, 19753, 19759, 19763, 19777, 19793, 19801,
+	19813, 19819, 19841, 19843, 19853, 19861, 19867,
+	19889, 19891, 19913, 19919, 19927, 19937, 19949,
+	19961, 19963, 19973, 19979, 19991, 19993, 19997,
+	20011, 20021, 20023, 20029, 20047, 20051, 20063,
+	20071, 20089, 20101, 20107, 20113, 20117, 20123,
+	20129, 20143, 20147, 20149, 20161, 20173, 20177,
+	20183, 20201, 20219, 20231, 20233, 20249, 20261,
+	20269, 20287, 20297, 20323, 20327, 20333, 20341,
+	20347, 20353, 20357, 20359, 20369, 20389, 20393,
+	20399, 20407, 20411, 20431, 20441, 20443, 20477,
+	20479, 20483, 20507, 20509, 20521, 20533, 20543,
+	20549, 20551, 20563, 20593, 20599, 20611, 20627,
+	20639, 20641, 20663, 20681, 20693, 20707, 20717,
+	20719, 20731, 20743, 20747, 20749, 20753, 20759,
+	20771, 20773, 20789, 20807, 20809, 20849, 20857,
+	20873, 20879, 20887, 20897, 20899, 20903, 20921,
+	20929, 20939, 20947, 20959, 20963, 20981, 20983,
+	21001, 21011, 21013, 21017, 21019, 21023, 21031,
+	21059, 21061, 21067, 21089, 21101, 21107, 21121,
+	21139, 21143, 21149, 21157, 21163, 21169, 21179,
+	21187, 21191, 21193, 21211, 21221, 21227, 21247,
+	21269, 21277, 21283, 21313, 21317, 21319, 21323,
+	21341, 21347, 21377, 21379, 21383, 21391, 21397,
+	21401, 21407, 21419, 21433, 21467, 21481, 21487,
+	21491, 21493, 21499, 21503, 21517, 21521, 21523,
+	21529, 21557, 21559, 21563, 21569, 21577, 21587,
+	21589, 21599, 21601, 21611, 21613, 21617, 21647,
+	21649, 21661, 21673, 21683, 21701, 21713, 21727,
+	21737, 21739, 21751, 21757, 21767, 21773, 21787,
+	21799, 21803, 21817, 21821, 21839, 21841, 21851,
+	21859, 21863, 21871, 21881, 21893, 21911, 21929,
+	21937, 21943, 21961, 21977, 21991, 21997, 22003,
+	22013, 22027, 22031, 22037, 22039, 22051, 22063,
+	22067, 22073, 22079, 22091, 22093, 22109, 22111,
+	22123, 22129, 22133, 22147, 22153, 22157, 22159,
+	22171, 22189, 22193, 22229, 22247, 22259, 22271,
+	22273, 22277, 22279, 22283, 22291, 22303, 22307,
+	22343, 22349, 22367, 22369, 22381, 22391, 22397,
+	22409, 22433, 22441, 22447, 22453, 22469, 22481,
+	22483, 22501, 22511, 22531, 22541, 22543, 22549,
+	22567, 22571, 22573, 22613, 22619, 22621, 22637,
+	22639, 22643, 22651, 22669, 22679, 22691, 22697,
+	22699, 22709, 22717, 22721, 22727, 22739, 22741,
+	22751, 22769, 22777, 22783, 22787, 22807, 22811,
+	22817, 22853, 22859, 22861, 22871, 22877, 22901,
+	22907, 22921, 22937, 22943, 22961, 22963, 22973,
+	22993, 23003, 23011, 23017, 23021, 23027, 23029,
+	23039, 23041, 23053, 23057, 23059, 23063, 23071,
+	23081, 23087, 23099, 23117, 23131, 23143, 23159,
+	23167, 23173, 23189, 23197, 23201, 23203, 23209,
+	23227, 23251, 23269, 23279, 23291, 23293, 23297,
+	23311, 23321, 23327, 23333, 23339, 23357, 23369,
+	23371, 23399, 23417, 23431, 23447, 23459, 23473,
+	23497, 23509, 23531, 23537, 23539, 23549, 23557,
+	23561, 23563, 23567, 23581, 23593, 23599, 23603,
+	23609, 23623, 23627, 23629, 23633, 23663, 23669,
+	23671, 23677, 23687, 23689, 23719, 23741, 23743,
+	23747, 23753, 23761, 23767, 23773, 23789, 23801,
+	23813, 23819, 23827, 23831, 23833, 23857, 23869,
+	23873, 23879, 23887, 23893, 23899, 23909, 23911,
+	23917, 23929, 23957, 23971, 23977, 23981, 23993,
+	24001, 24007, 24019, 24023, 24029, 24043, 24049,
+	24061, 24071, 24077, 24083, 24091, 24097, 24103,
+	24107, 24109, 24113, 24121, 24133, 24137, 24151,
+	24169, 24179, 24181, 24197, 24203, 24223, 24229,
+	24239, 24247, 24251, 24281, 24317, 24329, 24337,
+	24359, 24371, 24373, 24379, 24391, 24407, 24413,
+	24419, 24421, 24439, 24443, 24469, 24473, 24481,
+	24499, 24509, 24517, 24527, 24533, 24547, 24551,
+	24571, 24593, 24611, 24623, 24631, 24659, 24671,
+	24677, 24683, 24691, 24697, 24709, 24733, 24749,
+	24763, 24767, 24781, 24793, 24799, 24809, 24821,
+	24841, 24847, 24851, 24859, 24877, 24889, 24907,
+	24917, 24919, 24923, 24943, 24953, 24967, 24971,
+	24977, 24979, 24989, 25013, 25031, 25033, 25037,
+	25057, 25073, 25087, 25097, 25111, 25117, 25121,
+	25127, 25147, 25153, 25163, 25169, 25171, 25183,
+	25189, 25219, 25229, 25237, 25243, 25247, 25253,
+	25261, 25301, 25303, 25307, 25309, 25321, 25339,
+	25343, 25349, 25357, 25367, 25373, 25391, 25409,
+	25411, 25423, 25439, 25447, 25453, 25457, 25463,
+	25469, 25471, 25523, 25537, 25541, 25561, 25577,
+	25579, 25583, 25589, 25601, 25603, 25609, 25621,
+	25633, 25639, 25643, 25657, 25667, 25673, 25679,
+	25693, 25703, 25717, 25733, 25741, 25747, 25759,
+	25763, 25771, 25793, 25799, 25801, 25819, 25841,
+	25847, 25849, 25867, 25873, 25889, 25903, 25913,
+	25919, 25931, 25933, 25939, 25943, 25951, 25969,
+	25981, 25997, 25999, 26003, 26017, 26021, 26029,
+	26041, 26053, 26083, 26099, 26107, 26111, 26113,
+	26119, 26141, 26153, 26161, 26171, 26177, 26183,
+	26189, 26203, 26209, 26227, 26237, 26249, 26251,
+	26261, 26263, 26267, 26293, 26297, 26309, 26317,
+	26321, 26339, 26347, 26357, 26371, 26387, 26393,
+	26399, 26407, 26417, 26423, 26431, 26437, 26449,
+	26459, 26479, 26489, 26497, 26501, 26513, 26539,
+	26557, 26561, 26573, 26591, 26597, 26627, 26633,
+	26641, 26647, 26669, 26681, 26683, 26687, 26693,
+	26699, 26701, 26711, 26713, 26717, 26723, 26729,
+	26731, 26737, 26759, 26777, 26783, 26801, 26813,
+	26821, 26833, 26839, 26849, 26861, 26863, 26879,
+	26881, 26891, 26893, 26903, 26921, 26927, 26947,
+	26951, 26953, 26959, 26981, 26987, 26993, 27011,
+	27017, 27031, 27043, 27059, 27061, 27067, 27073,
+	27077, 27091, 27103, 27107, 27109, 27127, 27143,
+	27179, 27191, 27197, 27211, 27239, 27241, 27253,
+	27259, 27271, 27277, 27281, 27283, 27299, 27329,
+	27337, 27361, 27367, 27397, 27407, 27409, 27427,
+	27431, 27437, 27449, 27457, 27479, 27481, 27487,
+	27509, 27527, 27529, 27539, 27541, 27551, 27581,
+	27583, 27611, 27617, 27631, 27647, 27653, 27673,
+	27689, 27691, 27697, 27701, 27733, 27737, 27739,
+	27743, 27749, 27751, 27763, 27767, 27773, 27779,
+	27791, 27793, 27799, 27803, 27809, 27817, 27823,
+	27827, 27847, 27851, 27883, 27893, 27901, 27917,
+	27919, 27941, 27943, 27947, 27953, 27961, 27967,
+	27983, 27997, 28001, 28019, 28027, 28031, 28051,
+	28057, 28069, 28081, 28087, 28097, 28099, 28109,
+	28111, 28123, 28151, 28163, 28181, 28183, 28201,
+	28211, 28219, 28229, 28277, 28279, 28283, 28289,
+	28297, 28307, 28309, 28319, 28349, 28351, 28387,
+	28393, 28403, 28409, 28411, 28429, 28433, 28439,
+	28447, 28463, 28477, 28493, 28499, 28513, 28517,
+	28537, 28541, 28547, 28549, 28559, 28571, 28573,
+	28579, 28591, 28597, 28603, 28607, 28619, 28621,
+	28627, 28631, 28643, 28649, 28657, 28661, 28663,
+	28669, 28687, 28697, 28703, 28711, 28723, 28729,
+	28751, 28753, 28759, 28771, 28789, 28793, 28807,
+	28813, 28817, 28837, 28843, 28859, 28867, 28871,
+	28879, 28901, 28909, 28921, 28927, 28933, 28949,
+	28961, 28979, 29009, 29017, 29021, 29023, 29027,
+	29033, 29059, 29063, 29077, 29101, 29123, 29129,
+	29131, 29137, 29147, 29153, 29167, 29173, 29179,
+	29191, 29201, 29207, 29209, 29221, 29231, 29243,
+	29251, 29269, 29287, 29297, 29303, 29311, 29327,
+	29333, 29339, 29347, 29363, 29383, 29387, 29389,
+	29399, 29401, 29411, 29423, 29429, 29437, 29443,
+	29453, 29473, 29483, 29501, 29527, 29531, 29537,
+	29567, 29569, 29573, 29581, 29587, 29599, 29611,
+	29629, 29633, 29641, 29663, 29669, 29671, 29683,
+	29717, 29723, 29741, 29753, 29759, 29761, 29789,
+	29803, 29819, 29833, 29837, 29851, 29863, 29867,
+	29873, 29879, 29881, 29917, 29921, 29927, 29947,
+	29959, 29983, 29989, 30011, 30013, 30029, 30047,
+	30059, 30071, 30089, 30091, 30097, 30103, 30109,
+	30113, 30119, 30133, 30137, 30139, 30161, 30169,
+	30181, 30187, 30197, 30203, 30211, 30223, 30241,
+	30253, 30259, 30269, 30271, 30293, 30307, 30313,
+	30319, 30323, 30341, 30347, 30367, 30389, 30391,
+	30403, 30427, 30431, 30449, 30467, 30469, 30491,
+	30493, 30497, 30509, 30517, 30529, 30539, 30553,
+	30557, 30559, 30577, 30593, 30631, 30637, 30643,
+	30649, 30661, 30671, 30677, 30689, 30697, 30703,
+	30707, 30713, 30727, 30757, 30763, 30773, 30781,
+	30803, 30809, 30817, 30829, 30839, 30841, 30851,
+	30853, 30859, 30869, 30871, 30881, 30893, 30911,
+	30931, 30937, 30941, 30949, 30971, 30977, 30983,
+	31013, 31019, 31033, 31039, 31051, 31063, 31069,
+	31079, 31081, 31091, 31121, 31123, 31139, 31147,
+	31151, 31153, 31159, 31177, 31181, 31183, 31189,
+	31193, 31219, 31223, 31231, 31237, 31247, 31249,
+	31253, 31259, 31267, 31271, 31277, 31307, 31319,
+	31321, 31327, 31333, 31337, 31357, 31379, 31387,
+	31391, 31393, 31397, 31469, 31477, 31481, 31489,
+	31511, 31513, 31517, 31531, 31541, 31543, 31547,
+	31567, 31573, 31583, 31601, 31607, 31627, 31643,
+	31649, 31657, 31663, 31667, 31687, 31699, 31721,
+	31723, 31727, 31729, 31741, 31751, 31769, 31771,
+	31793, 31799, 31817, 31847, 31849, 31859, 31873,
+	31883, 31891, 31907, 31957, 31963, 31973, 31981,
+	31991, 32003, 32009, 32027, 32029, 32051, 32057,
+	32059, 32063, 32069, 32077, 32083, 32089, 32099,
+	32117, 32119, 32141, 32143, 32159, 32173, 32183,
+	32189, 32191, 32203, 32213, 32233, 32237, 32251,
+	32257, 32261, 32297, 32299, 32303, 32309, 32321,
+	32323, 32327, 32341, 32353, 32359, 32363, 32369,
+	32371, 32377, 32381, 32401, 32411, 32413, 32423,
+	32429, 32441, 32443, 32467, 32479, 32491, 32497,
+	32503, 32507, 32531, 32533, 32537, 32561, 32563,
+	32569, 32573, 32579, 32587, 32603, 32609, 32611,
+	32621, 32633, 32647, 32653, 32687, 32693, 32707,
+	32713, 32717, 32719, 32749, 32771, 32779, 32783,
+	32789, 32797, 32801, 32803, 32831, 32833, 32839,
+	32843, 32869, 32887, 32909, 32911, 32917, 32933,
+	32939, 32941, 32957, 32969, 32971, 32983, 32987,
+	32993, 32999, 33013, 33023, 33029, 33037, 33049,
+	33053, 33071, 33073, 33083, 33091, 33107, 33113,
+	33119, 33149, 33151, 33161, 33179, 33181, 33191,
+	33199, 33203, 33211, 33223, 33247, 33287, 33289,
+	33301, 33311, 33317, 33329, 33331, 33343, 33347,
+	33349, 33353, 33359, 33377, 33391, 33403, 33409,
+	33413, 33427, 33457, 33461, 33469, 33479, 33487,
+	33493, 33503, 33521, 33529, 33533, 33547, 33563,
+	33569, 33577, 33581, 33587, 33589, 33599, 33601,
+	33613, 33617, 33619, 33623, 33629, 33637, 33641,
+	33647, 33679, 33703, 33713, 33721, 33739, 33749,
+	33751, 33757, 33767, 33769, 33773, 33791, 33797,
+	33809, 33811, 33827, 33829, 33851, 33857, 33863,
+	33871, 33889, 33893, 33911, 33923, 33931, 33937,
+	33941, 33961, 33967, 33997, 34019, 34031, 34033,
+	34039, 34057, 34061, 34123, 34127, 34129, 34141,
+	34147, 34157, 34159, 34171, 34183, 34211, 34213,
+	34217, 34231, 34253, 34259, 34261, 34267, 34273,
+	34283, 34297, 34301, 34303, 34313, 34319, 34327,
+	34337, 34351, 34361, 34367, 34369, 34381, 34403,
+	34421, 34429, 34439, 34457, 34469, 34471, 34483,
+	34487, 34499, 34501, 34511, 34513, 34519, 34537,
+	34543, 34549, 34583, 34589, 34591, 34603, 34607,
+	34613, 34631, 34649, 34651, 34667, 34673, 34679,
+	34687, 34693, 34703, 34721, 34729, 34739, 34747,
+	34757, 34759, 34763, 34781, 34807, 34819, 34841,
+	34843, 34847, 34849, 34871, 34877, 34883, 34897,
+	34913, 34919, 34939, 34949, 34961, 34963, 34981,
+	35023, 35027, 35051, 35053, 35059, 35069, 35081,
+	35083, 35089, 35099, 35107, 35111, 35117, 35129,
+	35141, 35149, 35153, 35159, 35171, 35201, 35221,
+	35227, 35251, 35257, 35267, 35279, 35281, 35291,
+	35311, 35317, 35323, 35327, 35339, 35353, 35363,
+	35381, 35393, 35401, 35407, 35419, 35423, 35437,
+	35447, 35449, 35461, 35491, 35507, 35509, 35521,
+	35527, 35531, 35533, 35537, 35543, 35569, 35573,
+	35591, 35593, 35597, 35603, 35617, 35671, 35677,
+	35729, 35731, 35747, 35753, 35759, 35771, 35797,
+	35801, 35803, 35809, 35831, 35837, 35839, 35851,
+	35863, 35869, 35879, 35897, 35899, 35911, 35923,
+	35933, 35951, 35963, 35969, 35977, 35983, 35993,
+	35999, 36007, 36011, 36013, 36017, 36037, 36061,
+	36067, 36073, 36083, 36097, 36107, 36109, 36131,
+	36137, 36151, 36161, 36187, 36191, 36209, 36217,
+	36229, 36241, 36251, 36263, 36269, 36277, 36293,
+	36299, 36307, 36313, 36319, 36341, 36343, 36353,
+	36373, 36383, 36389, 36433, 36451, 36457, 36467,
+	36469, 36473, 36479, 36493, 36497, 36523, 36527,
+	36529, 36541, 36551, 36559, 36563, 36571, 36583,
+	36587, 36599, 36607, 36629, 36637, 36643, 36653,
+	36671, 36677, 36683, 36691, 36697, 36709, 36713,
+	36721, 36739, 36749, 36761, 36767, 36779, 36781,
+	36787, 36791, 36793, 36809, 36821, 36833, 36847,
+	36857, 36871, 36877, 36887, 36899, 36901, 36913,
+	36919, 36923, 36929, 36931, 36943, 36947, 36973,
+	36979, 36997, 37003, 37013, 37019, 37021, 37039,
+	37049, 37057, 37061, 37087, 37097, 37117, 37123,
+	37139, 37159, 37171, 37181, 37189, 37199, 37201,
+	37217, 37223, 37243, 37253, 37273, 37277, 37307,
+	37309, 37313, 37321, 37337, 37339, 37357, 37361,
+	37363, 37369, 37379, 37397, 37409, 37423, 37441,
+	37447, 37463, 37483, 37489, 37493, 37501, 37507,
+	37511, 37517, 37529, 37537, 37547, 37549, 37561,
+	37567, 37571, 37573, 37579, 37589, 37591, 37607,
+	37619, 37633, 37643, 37649, 37657, 37663, 37691,
+	37693, 37699, 37717, 37747, 37781, 37783, 37799,
+	37811, 37813, 37831, 37847, 37853, 37861, 37871,
+	37879, 37889, 37897, 37907, 37951, 37957, 37963,
+	37967, 37987, 37991, 37993, 37997, 38011, 38039,
+	38047, 38053, 38069, 38083, 38113, 38119, 38149,
+	38153, 38167, 38177, 38183, 38189, 38197, 38201,
+	38219, 38231, 38237, 38239, 38261, 38273, 38281,
+	38287, 38299, 38303, 38317, 38321, 38327, 38329,
+	38333, 38351, 38371, 38377, 38393, 38431, 38447,
+	38449, 38453, 38459, 38461, 38501, 38543, 38557,
+	38561, 38567, 38569, 38593, 38603, 38609, 38611,
+	38629, 38639, 38651, 38653, 38669, 38671, 38677,
+	38693, 38699, 38707, 38711, 38713, 38723, 38729,
+	38737, 38747, 38749, 38767, 38783, 38791, 38803,
+	38821, 38833, 38839, 38851, 38861, 38867, 38873,
+	38891, 38903, 38917, 38921, 38923, 38933, 38953,
+	38959, 38971, 38977, 38993, 39019, 39023, 39041,
+	39043, 39047, 39079, 39089, 39097, 39103, 39107,
+	39113, 39119, 39133, 39139, 39157, 39161, 39163,
+	39181, 39191, 39199, 39209, 39217, 39227, 39229,
+	39233, 39239, 39241, 39251, 39293, 39301, 39313,
+	39317, 39323, 39341, 39343, 39359, 39367, 39371,
+	39373, 39383, 39397, 39409, 39419, 39439, 39443,
+	39451, 39461, 39499, 39503, 39509, 39511, 39521,
+	39541, 39551, 39563, 39569, 39581, 39607, 39619,
+	39623, 39631, 39659, 39667, 39671, 39679, 39703,
+	39709, 39719, 39727, 39733, 39749, 39761, 39769,
+	39779, 39791, 39799, 39821, 39827, 39829, 39839,
+	39841, 39847, 39857, 39863, 39869, 39877, 39883,
+	39887, 39901, 39929, 39937, 39953, 39971, 39979,
+	39983, 39989, 40009, 40013, 40031, 40037, 40039,
+	40063, 40087, 40093, 40099, 40111, 40123, 40127,
+	40129, 40151, 40153, 40163, 40169, 40177, 40189,
+	40193, 40213, 40231, 40237, 40241, 40253, 40277,
+	40283, 40289, 40343, 40351, 40357, 40361, 40387,
+	40423, 40427, 40429, 40433, 40459, 40471, 40483,
+	40487, 40493, 40499, 40507, 40519, 40529, 40531,
+	40543, 40559, 40577, 40583, 40591, 40597, 40609,
+	40627, 40637, 40639, 40693, 40697, 40699, 40709,
+	40739, 40751, 40759, 40763, 40771, 40787, 40801,
+	40813, 40819, 40823, 40829, 40841, 40847, 40849,
+	40853, 40867, 40879, 40883, 40897, 40903, 40927,
+	40933, 40939, 40949, 40961, 40973, 40993, 41011,
+	41017, 41023, 41039, 41047, 41051, 41057, 41077,
+	41081, 41113, 41117, 41131, 41141, 41143, 41149,
+	41161, 41177, 41179, 41183, 41189, 41201, 41203,
+	41213, 41221, 41227, 41231, 41233, 41243, 41257,
+	41263, 41269, 41281, 41299, 41333, 41341, 41351,
+	41357, 41381, 41387, 41389, 41399, 41411, 41413,
+	41443, 41453, 41467, 41479, 41491, 41507, 41513,
+	41519, 41521, 41539, 41543, 41549, 41579, 41593,
+	41597, 41603, 41609, 41611, 41617, 41621, 41627,
+	41641, 41647, 41651, 41659, 41669, 41681, 41687,
+	41719, 41729, 41737, 41759, 41761, 41771, 41777,
+	41801, 41809, 41813, 41843, 41849, 41851, 41863,
+	41879, 41887, 41893, 41897, 41903, 41911, 41927,
+	41941, 41947, 41953, 41957, 41959, 41969, 41981,
+	41983, 41999, 42013, 42017, 42019, 42023, 42043,
+	42061, 42071, 42073, 42083, 42089, 42101, 42131,
+	42139, 42157, 42169, 42179, 42181, 42187, 42193,
+	42197, 42209, 42221, 42223, 42227, 42239, 42257,
+	42281, 42283, 42293, 42299, 42307, 42323, 42331,
+	42337, 42349, 42359, 42373, 42379, 42391, 42397,
+	42403, 42407, 42409, 42433, 42437, 42443, 42451,
+	42457, 42461, 42463, 42467, 42473, 42487, 42491,
+	42499, 42509, 42533, 42557, 42569, 42571, 42577,
+	42589, 42611, 42641, 42643, 42649, 42667, 42677,
+	42683, 42689, 42697, 42701, 42703, 42709, 42719,
+	42727, 42737, 42743, 42751, 42767, 42773, 42787,
+	42793, 42797, 42821, 42829, 42839, 42841, 42853,
+	42859, 42863, 42899, 42901, 42923, 42929, 42937,
+	42943, 42953, 42961, 42967, 42979, 42989, 43003,
+	43013, 43019, 43037, 43049, 43051, 43063, 43067,
+	43093, 43103, 43117, 43133, 43151, 43159, 43177,
+	43189, 43201, 43207, 43223, 43237, 43261, 43271,
+	43283, 43291, 43313, 43319, 43321, 43331, 43391,
+	43397, 43399, 43403, 43411, 43427, 43441, 43451,
+	43457, 43481, 43487, 43499, 43517, 43541, 43543,
+	43573, 43577, 43579, 43591, 43597, 43607, 43609,
+	43613, 43627, 43633, 43649, 43651, 43661, 43669,
+	43691, 43711, 43717, 43721, 43753, 43759, 43777,
+	43781, 43783, 43787, 43789, 43793, 43801, 43853,
+	43867, 43889, 43891, 43913, 43933, 43943, 43951,
+	43961, 43963, 43969, 43973, 43987, 43991, 43997,
+	44017, 44021, 44027, 44029, 44041, 44053, 44059,
+	44071, 44087, 44089, 44101, 44111, 44119, 44123,
+	44129, 44131, 44159, 44171, 44179, 44189, 44201,
+	44203, 44207, 44221, 44249, 44257, 44263, 44267,
+	44269, 44273, 44279, 44281, 44293, 44351, 44357,
+	44371, 44381, 44383, 44389, 44417, 44449, 44453,
+	44483, 44491, 44497, 44501, 44507, 44519, 44531,
+	44533, 44537, 44543, 44549, 44563, 44579, 44587,
+	44617, 44621, 44623, 44633, 44641, 44647, 44651,
+	44657, 44683, 44687, 44699, 44701, 44711, 44729,
+	44741, 44753, 44771, 44773, 44777, 44789, 44797,
+	44809, 44819, 44839, 44843, 44851, 44867, 44879,
+	44887, 44893, 44909, 44917, 44927, 44939, 44953,
+	44959, 44963, 44971, 44983, 44987, 45007, 45013,
+	45053, 45061, 45077, 45083, 45119, 45121, 45127,
+	45131, 45137, 45139, 45161, 45179, 45181, 45191,
+	45197, 45233, 45247, 45259, 45263, 45281, 45289,
+	45293, 45307, 45317, 45319, 45329, 45337, 45341,
+	45343, 45361, 45377, 45389, 45403, 45413, 45427,
+	45433, 45439, 45481, 45491, 45497, 45503, 45523,
+	45533, 45541, 45553, 45557, 45569, 45587, 45589,
+	45599, 45613, 45631, 45641, 45659, 45667, 45673,
+	45677, 45691, 45697, 45707, 45737, 45751, 45757,
+	45763, 45767, 45779, 45817, 45821, 45823, 45827,
+	45833, 45841, 45853, 45863, 45869, 45887, 45893,
+	45943, 45949, 45953, 45959, 45971, 45979, 45989,
+	46021, 46027, 46049, 46051, 46061, 46073, 46091,
+	46093, 46099, 46103, 46133, 46141, 46147, 46153,
+	46171, 46181, 46183, 46187, 46199, 46219, 46229,
+	46237, 46261, 46271, 46273, 46279, 46301, 46307,
+	46309, 46327, 46337, 46349, 46351, 46381, 46399,
+	46411, 46439, 46441, 46447, 46451, 46457, 46471,
+	46477, 46489, 46499, 46507, 46511, 46523, 46549,
+	46559, 46567, 46573, 46589, 46591, 46601, 46619,
+	46633, 46639, 46643, 46649, 46663, 46679, 46681,
+	46687, 46691, 46703, 46723, 46727, 46747, 46751,
+	46757, 46769, 46771, 46807, 46811, 46817, 46819,
+	46829, 46831, 46853, 46861, 46867, 46877, 46889,
+	46901, 46919, 46933, 46957, 46993, 46997, 47017,
+	47041, 47051, 47057, 47059, 47087, 47093, 47111,
+	47119, 47123, 47129, 47137, 47143, 47147, 47149,
+	47161, 47189, 47207, 47221, 47237, 47251, 47269,
+	47279, 47287, 47293, 47297, 47303, 47309, 47317,
+	47339, 47351, 47353, 47363, 47381, 47387, 47389,
+	47407, 47417, 47419, 47431, 47441, 47459, 47491,
+	47497, 47501, 47507, 47513, 47521, 47527, 47533,
+	47543, 47563, 47569, 47581, 47591, 47599, 47609,
+	47623, 47629, 47639, 47653, 47657, 47659, 47681,
+	47699, 47701, 47711, 47713, 47717, 47737, 47741,
+	47743, 47777, 47779, 47791, 47797, 47807, 47809,
+	47819, 47837, 47843, 47857, 47869, 47881, 47903,
+	47911, 47917, 47933, 47939, 47947, 47951, 47963,
+	47969, 47977, 47981, 48017, 48023, 48029, 48049,
+	48073, 48079, 48091, 48109, 48119, 48121, 48131,
+	48157, 48163, 48179, 48187, 48193, 48197, 48221,
+	48239, 48247, 48259, 48271, 48281, 48299, 48311,
+	48313, 48337, 48341, 48353, 48371, 48383, 48397,
+	48407, 48409, 48413, 48437, 48449, 48463, 48473,
+	48479, 48481, 48487, 48491, 48497, 48523, 48527,
+	48533, 48539, 48541, 48563, 48571, 48589, 48593,
+	48611, 48619, 48623, 48647, 48649, 48661, 48673,
+	48677, 48679, 48731, 48733, 48751, 48757, 48761,
+	48767, 48779, 48781, 48787, 48799, 48809, 48817,
+	48821, 48823, 48847, 48857, 48859, 48869, 48871,
+	48883, 48889, 48907, 48947, 48953, 48973, 48989,
+	48991, 49003, 49009, 49019, 49031, 49033, 49037,
+	49043, 49057, 49069, 49081, 49103, 49109, 49117,
+	49121, 49123, 49139, 49157, 49169, 49171, 49177,
+	49193, 49199, 49201, 49207, 49211, 49223, 49253,
+	49261, 49277, 49279, 49297, 49307, 49331, 49333,
+	49339, 49363, 49367, 49369, 49391, 49393, 49409,
+	49411, 49417, 49429, 49433, 49451, 49459, 49463,
+	49477, 49481, 49499, 49523, 49529, 49531, 49537,
+	49547, 49549, 49559, 49597, 49603, 49613, 49627,
+	49633, 49639, 49663, 49667, 49669, 49681, 49697,
+	49711, 49727, 49739, 49741, 49747, 49757, 49783,
+	49787, 49789, 49801, 49807, 49811, 49823, 49831,
+	49843, 49853, 49871, 49877, 49891, 49919, 49921,
+	49927, 49937, 49939, 49943, 49957, 49991, 49993,
+	49999, 50021, 50023, 50033, 50047, 50051, 50053,
+	50069, 50077, 50087, 50093, 50101, 50111, 50119,
+	50123, 50129, 50131, 50147, 50153, 50159, 50177,
+	50207, 50221, 50227, 50231, 50261, 50263, 50273,
+	50287, 50291, 50311, 50321, 50329, 50333, 50341,
+	50359, 50363, 50377, 50383, 50387, 50411, 50417,
+	50423, 50441, 50459, 50461, 50497, 50503, 50513,
+	50527, 50539, 50543, 50549, 50551, 50581, 50587,
+	50591, 50593, 50599, 50627, 50647, 50651, 50671,
+	50683, 50707, 50723, 50741, 50753, 50767, 50773,
+	50777, 50789, 50821, 50833, 50839, 50849, 50857,
+	50867, 50873, 50891, 50893, 50909, 50923, 50929,
+	50951, 50957, 50969, 50971, 50989, 50993, 51001,
+	51031, 51043, 51047, 51059, 51061, 51071, 51109,
+	51131, 51133, 51137, 51151, 51157, 51169, 51193,
+	51197, 51199, 51203, 51217, 51229, 51239, 51241,
+	51257, 51263, 51283, 51287, 51307, 51329, 51341,
+	51343, 51347, 51349, 51361, 51383, 51407, 51413,
+	51419, 51421, 51427, 51431, 51437, 51439, 51449,
+	51461, 51473, 51479, 51481, 51487, 51503, 51511,
+	51517, 51521, 51539, 51551, 51563, 51577, 51581,
+	51593, 51599, 51607, 51613, 51631, 51637, 51647,
+	51659, 51673, 51679, 51683, 51691, 51713, 51719,
+	51721, 51749, 51767, 51769, 51787, 51797, 51803,
+	51817, 51827, 51829, 51839, 51853, 51859, 51869,
+	51871, 51893, 51899, 51907, 51913, 51929, 51941,
+	51949, 51971, 51973, 51977, 51991, 52009, 52021,
+	52027, 52051, 52057, 52067, 52069, 52081, 52103,
+	52121, 52127, 52147, 52153, 52163, 52177, 52181,
+	52183, 52189, 52201, 52223, 52237, 52249, 52253,
+	52259, 52267, 52289, 52291, 52301, 52313, 52321,
+	52361, 52363, 52369, 52379, 52387, 52391, 52433,
+	52453, 52457, 52489, 52501, 52511, 52517, 52529,
+	52541, 52543, 52553, 52561, 52567, 52571, 52579,
+	52583, 52609, 52627, 52631, 52639, 52667, 52673,
+	52691, 52697, 52709, 52711, 52721, 52727, 52733,
+	52747, 52757, 52769, 52783, 52807, 52813, 52817,
+	52837, 52859, 52861, 52879, 52883, 52889, 52901,
+	52903, 52919, 52937, 52951, 52957, 52963, 52967,
+	52973, 52981, 52999, 53003, 53017, 53047, 53051,
+	53069, 53077, 53087, 53089, 53093, 53101, 53113,
+	53117, 53129, 53147, 53149, 53161, 53171, 53173,
+	53189, 53197, 53201, 53231, 53233, 53239, 53267,
+	53269, 53279, 53281, 53299, 53309, 53323, 53327,
+	53353, 53359, 53377, 53381, 53401, 53407, 53411,
+	53419, 53437, 53441, 53453, 53479, 53503, 53507,
+	53527, 53549, 53551, 53569, 53591, 53593, 53597,
+	53609, 53611, 53617, 53623, 53629, 53633, 53639,
+	53653, 53657, 53681, 53693, 53699, 53717, 53719,
+	53731, 53759, 53773, 53777, 53783, 53791, 53813,
+	53819, 53831, 53849, 53857, 53861, 53881, 53887,
+	53891, 53897, 53899, 53917, 53923, 53927, 53939,
+	53951, 53959, 53987, 53993, 54001, 54011, 54013,
+	54037, 54049, 54059, 54083, 54091, 54101, 54121,
+	54133, 54139, 54151, 54163, 54167, 54181, 54193,
+	54217, 54251, 54269, 54277, 54287, 54293, 54311,
+	54319, 54323, 54331, 54347, 54361, 54367, 54371,
+	54377, 54401, 54403, 54409, 54413, 54419, 54421,
+	54437, 54443, 54449, 54469, 54493, 54497, 54499,
+	54503, 54517, 54521, 54539, 54541, 54547, 54559,
+	54563, 54577, 54581, 54583, 54601, 54617, 54623,
+	54629, 54631, 54647, 54667, 54673, 54679, 54709,
+	54713, 54721, 54727, 54751, 54767, 54773, 54779,
+	54787, 54799, 54829, 54833, 54851, 54869, 54877,
+	54881, 54907, 54917, 54919, 54941, 54949, 54959,
+	54973, 54979, 54983, 55001, 55009, 55021, 55049,
+	55051, 55057, 55061, 55073, 55079, 55103, 55109,
+	55117, 55127, 55147, 55163, 55171, 55201, 55207,
+	55213, 55217, 55219, 55229, 55243, 55249, 55259,
+	55291, 55313, 55331, 55333, 55337, 55339, 55343,
+	55351, 55373, 55381, 55399, 55411, 55439, 55441,
+	55457, 55469, 55487, 55501, 55511, 55529, 55541,
+	55547, 55579, 55589, 55603, 55609, 55619, 55621,
+	55631, 55633, 55639, 55661, 55663, 55667, 55673,
+	55681, 55691, 55697, 55711, 55717, 55721, 55733,
+	55763, 55787, 55793, 55799, 55807, 55813, 55817,
+	55819, 55823, 55829, 55837, 55843, 55849, 55871,
+	55889, 55897, 55901, 55903, 55921, 55927, 55931,
+	55933, 55949, 55967, 55987, 55997, 56003, 56009,
+	56039, 56041, 56053, 56081, 56087, 56093, 56099,
+	56101, 56113, 56123, 56131, 56149, 56167, 56171,
+	56179, 56197, 56207, 56209, 56237, 56239, 56249,
+	56263, 56267, 56269, 56299, 56311, 56333, 56359,
+	56369, 56377, 56383, 56393, 56401, 56417, 56431,
+	56437, 56443, 56453, 56467, 56473, 56477, 56479,
+	56489, 56501, 56503, 56509, 56519, 56527, 56531,
+	56533, 56543, 56569, 56591, 56597, 56599, 56611,
+	56629, 56633, 56659, 56663, 56671, 56681, 56687,
+	56701, 56711, 56713, 56731, 56737, 56747, 56767,
+	56773, 56779, 56783, 56807, 56809, 56813, 56821,
+	56827, 56843, 56857, 56873, 56891, 56893, 56897,
+	56909, 56911, 56921, 56923, 56929, 56941, 56951,
+	56957, 56963, 56983, 56989, 56993, 56999, 57037,
+	57041, 57047, 57059, 57073, 57077, 57089, 57097,
+	57107, 57119, 57131, 57139, 57143, 57149, 57163,
+	57173, 57179, 57191, 57193, 57203, 57221, 57223,
+	57241, 57251, 57259, 57269, 57271, 57283, 57287,
+	57301, 57329, 57331, 57347, 57349, 57367, 57373,
+	57383, 57389, 57397, 57413, 57427, 57457, 57467,
+	57487, 57493, 57503, 57527, 57529, 57557, 57559,
+	57571, 57587, 57593, 57601, 57637, 57641, 57649,
+	57653, 57667, 57679, 57689, 57697, 57709, 57713,
+	57719, 57727, 57731, 57737, 57751, 57773, 57781,
+	57787, 57791, 57793, 57803, 57809, 57829, 57839,
+	57847, 57853, 57859, 57881, 57899, 57901, 57917,
+	57923, 57943, 57947, 57973, 57977, 57991, 58013,
+	58027, 58031, 58043, 58049, 58057, 58061, 58067,
+	58073, 58099, 58109, 58111, 58129, 58147, 58151,
+	58153, 58169, 58171, 58189, 58193, 58199, 58207,
+	58211, 58217, 58229, 58231, 58237, 58243, 58271,
+	58309, 58313, 58321, 58337, 58363, 58367, 58369,
+	58379, 58391, 58393, 58403, 58411, 58417, 58427,
+	58439, 58441, 58451, 58453, 58477, 58481, 58511,
+	58537, 58543, 58549, 58567, 58573, 58579, 58601,
+	58603, 58613, 58631, 58657, 58661, 58679, 58687,
+	58693, 58699, 58711, 58727, 58733, 58741, 58757,
+	58763, 58771, 58787, 58789, 58831, 58889, 58897,
+	58901, 58907, 58909, 58913, 58921, 58937, 58943,
+	58963, 58967, 58979, 58991, 58997, 59009, 59011,
+	59021, 59023, 59029, 59051, 59053, 59063, 59069,
+	59077, 59083, 59093, 59107, 59113, 59119, 59123,
+	59141, 59149, 59159, 59167, 59183, 59197, 59207,
+	59209, 59219, 59221, 59233, 59239, 59243, 59263,
+	59273, 59281, 59333, 59341, 59351, 59357, 59359,
+	59369, 59377, 59387, 59393, 59399, 59407, 59417,
+	59419, 59441, 59443, 59447, 59453, 59467, 59471,
+	59473, 59497, 59509, 59513, 59539, 59557, 59561,
+	59567, 59581, 59611, 59617, 59621, 59627, 59629,
+	59651, 59659, 59663, 59669, 59671, 59693, 59699,
+	59707, 59723, 59729, 59743, 59747, 59753, 59771,
+	59779, 59791, 59797, 59809, 59833, 59863, 59879,
+	59887, 59921, 59929, 59951, 59957, 59971, 59981,
+	59999, 60013, 60017, 60029, 60037, 60041, 60077,
+	60083, 60089, 60091, 60101, 60103, 60107, 60127,
+	60133, 60139, 60149, 60161, 60167, 60169, 60209,
+	60217, 60223, 60251, 60257, 60259, 60271, 60289,
+	60293, 60317, 60331, 60337, 60343, 60353, 60373,
+	60383, 60397, 60413, 60427, 60443, 60449, 60457,
+	60493, 60497, 60509, 60521, 60527, 60539, 60589,
+	60601, 60607, 60611, 60617, 60623, 60631, 60637,
+	60647, 60649, 60659, 60661, 60679, 60689, 60703,
+	60719, 60727, 60733, 60737, 60757, 60761, 60763,
+	60773, 60779, 60793, 60811, 60821, 60859, 60869,
+	60887, 60889, 60899, 60901, 60913, 60917, 60919,
+	60923, 60937, 60943, 60953, 60961, 61001, 61007,
+	61027, 61031, 61043, 61051, 61057, 61091, 61099,
+	61121, 61129, 61141, 61151, 61153, 61169, 61211,
+	61223, 61231, 61253, 61261, 61283, 61291, 61297,
+	61331, 61333, 61339, 61343, 61357, 61363, 61379,
+	61381, 61403, 61409, 61417, 61441, 61463, 61469,
+	61471, 61483, 61487, 61493, 61507, 61511, 61519,
+	61543, 61547, 61553, 61559, 61561, 61583, 61603,
+	61609, 61613, 61627, 61631, 61637, 61643, 61651,
+	61657, 61667, 61673, 61681, 61687, 61703, 61717,
+	61723, 61729, 61751, 61757, 61781, 61813, 61819,
+	61837, 61843, 61861, 61871, 61879, 61909, 61927,
+	61933, 61949, 61961, 61967, 61979, 61981, 61987,
+	61991, 62003, 62011, 62017, 62039, 62047, 62053,
+	62057, 62071, 62081, 62099, 62119, 62129, 62131,
+	62137, 62141, 62143, 62171, 62189, 62191, 62201,
+	62207, 62213, 62219, 62233, 62273, 62297, 62299,
+	62303, 62311, 62323, 62327, 62347, 62351, 62383,
+	62401, 62417, 62423, 62459, 62467, 62473, 62477,
+	62483, 62497, 62501, 62507, 62533, 62539, 62549,
+	62563, 62581, 62591, 62597, 62603, 62617, 62627,
+	62633, 62639, 62653, 62659, 62683, 62687, 62701,
+	62723, 62731, 62743, 62753, 62761, 62773, 62791,
+	62801, 62819, 62827, 62851, 62861, 62869, 62873,
+	62897, 62903, 62921, 62927, 62929, 62939, 62969,
+	62971, 62981, 62983, 62987, 62989, 63029, 63031,
+	63059, 63067, 63073, 63079, 63097, 63103, 63113,
+	63127, 63131, 63149, 63179, 63197, 63199, 63211,
+	63241, 63247, 63277, 63281, 63299, 63311, 63313,
+	63317, 63331, 63337, 63347, 63353, 63361, 63367,
+	63377, 63389, 63391, 63397, 63409, 63419, 63421,
+	63439, 63443, 63463, 63467, 63473, 63487, 63493,
+	63499, 63521, 63527, 63533, 63541, 63559, 63577,
+	63587, 63589, 63599, 63601, 63607, 63611, 63617,
+	63629, 63647, 63649, 63659, 63667, 63671, 63689,
+	63691, 63697, 63703, 63709, 63719, 63727, 63737,
+	63743, 63761, 63773, 63781, 63793, 63799, 63803,
+	63809, 63823, 63839, 63841, 63853, 63857, 63863,
+	63901, 63907, 63913, 63929, 63949, 63977, 63997,
+	64007, 64013, 64019, 64033, 64037, 64063, 64067,
+	64081, 64091, 64109, 64123, 64151, 64153, 64157,
+	64171, 64187, 64189, 64217, 64223, 64231, 64237,
+	64271, 64279, 64283, 64301, 64303, 64319, 64327,
+	64333, 64373, 64381, 64399, 64403, 64433, 64439,
+	64451, 64453, 64483, 64489, 64499, 64513, 64553,
+	64567, 64577, 64579, 64591, 64601, 64609, 64613,
+	64621, 64627, 64633, 64661, 64663, 64667, 64679,
+	64693, 64709, 64717, 64747, 64763, 64781, 64783,
+	64793, 64811, 64817, 64849, 64853, 64871, 64877,
+	64879, 64891, 64901, 64919, 64921, 64927, 64937,
+	64951, 64969, 64997, 65003, 65011, 65027, 65029,
+	65033, 65053, 65063, 65071, 65089, 65099, 65101,
+	65111, 65119, 65123, 65129, 65141, 65147, 65167,
+	65171, 65173, 65179, 65183, 65203, 65213, 65239,
+	65257, 65267, 65269, 65287, 65293, 65309, 65323,
+	65327, 65353, 65357, 65371, 65381, 65393, 65407,
+	65413, 65419, 65423, 65437, 65447, 65449, 65479,
+	65497, 65519, 65521, 0
+};
+
+/* Tests if the (small) number provided is a prime.
+ */
+static unsigned small_prime_check(unsigned x)
+{
+	unsigned j, t, square, prime;
+
+	for (j = 0; primes[j] > 0; j++) {
+		prime = primes[j];
+		square = prime * prime;
+
+		if (square > x)
+			break;
+
+		t = x / prime;
+		if (t * prime == x)
+			return 0;
+	}
+
+	return 1;
+}
+
+/* The seed in FIPS186-3 is used either as an integer or blob,
+ * but when used as an integer it must not be trunacated below
+ * the "nominal" seed size. This function returns the size
+ * that way. */
+unsigned mpz_seed_sizeinbase_256_u(mpz_t s, unsigned nominal)
+{
+	unsigned ret = nettle_mpz_sizeinbase_256_u(s);
+	if (ret < nominal)
+		return nominal;
+	return ret;
+}
+
+static int st_provable_prime_small(mpz_t p,
+				   unsigned *prime_seed_length,
+				   void *prime_seed,
+				   unsigned *prime_gen_counter, unsigned bits,
+				   unsigned seed_length, const void *seed,
+				   void *progress_ctx,
+				   nettle_progress_func * progress)
+{
+	unsigned gen_counter = 0;
+	unsigned tseed_length;
+	uint8_t tseed[MAX_PVP_SEED_SIZE+1];
+	uint8_t h1[DIGEST_SIZE];
+	uint8_t h2[DIGEST_SIZE];
+	uint32_t c;
+	mpz_t s;
+	unsigned highbit;
+
+	assert(bits >= 2 && bits <= 32);
+
+	mpz_init(s);
+
+	/* seed is handled as mpz_t instead of simply using INCREMENT
+	 * for the few (unlikely) cases where seed overflows. */
+	nettle_mpz_set_str_256_u(s, seed_length, seed);
+
+ retry:
+	tseed_length = mpz_seed_sizeinbase_256_u(s, seed_length);
+	if (tseed_length > sizeof(tseed)) {
+		goto fail;
+	}
+
+	/* c = Hash(seed) XOR Hash(seed+1) */
+	nettle_mpz_get_str_256(tseed_length, tseed, s);
+
+	hash(h1, tseed_length, tseed);
+
+	mpz_add_ui(s, s, 1);
+
+	tseed_length = mpz_seed_sizeinbase_256_u(s, seed_length);
+	if (tseed_length > sizeof(tseed))
+		goto fail;
+
+	nettle_mpz_get_str_256(tseed_length, tseed, s);
+
+	hash(h2, tseed_length, tseed);
+
+	memxor(h1, h2, DIGEST_SIZE);
+
+	/* c = 2^(bits-1) + (c mod 2^(bits-1)) */
+	highbit = 1L << (bits - 1);
+
+	c = READ_UINT32(&h1[DIGEST_SIZE - 4]);
+
+	c &= highbit - 1;
+
+	/* Make sure c is odd and high bit is set */
+	c |= highbit | 1;
+
+	gen_counter++;
+
+	/* seed++ */
+	mpz_add_ui(s, s, 1);
+
+	/* deterministic primality check on c */
+	if (small_prime_check(c) == 0) {
+		/* not a prime */
+		if (gen_counter >= 4 * bits)
+			goto fail;	/* failed */
+
+		if (progress)
+			progress(progress_ctx, 'x');
+
+		goto retry;
+	}
+
+	/* success */
+	mpz_set_ui(p, c);
+
+	if (prime_seed != NULL) {
+		tseed_length = mpz_seed_sizeinbase_256_u(s, tseed_length);
+		if (*prime_seed_length < tseed_length)
+			goto fail;
+
+		nettle_mpz_get_str_256(tseed_length, prime_seed, s);
+		*prime_seed_length = tseed_length;
+	}
+
+	if (prime_gen_counter)
+		*prime_gen_counter = gen_counter;
+
+	mpz_clear(s);
+	return 1;
+
+ fail:
+	mpz_clear(s);
+	return 0;
+}
+
+/* The Shawe-Taylor algorithm described in FIPS 186-4.
+ *
+ * p: (output) the prime
+ * prime_seed_length: (output) the length of prime_seed. Initially
+ *   must hold the maximum size of prime_seed. The size should be a
+ *   byte more than seed_length.
+ * prime_seed: (output) the prime_seed (may be NULL)
+ * prime_gen_counter: A counter determined during the prime generation
+ * bits: The requested number of bits for prime
+ * seed_length: The length of seed. It is limited by MAX_PVP_SEED_SIZE.
+ * seed: The initial seed
+ *
+ * Returns non zero on success.
+ */
+int
+st_provable_prime(mpz_t p,
+		  unsigned *prime_seed_length, void *prime_seed,
+		  unsigned *prime_gen_counter,
+		  unsigned bits,
+		  unsigned seed_length, const void *seed,
+		  void *progress_ctx, nettle_progress_func * progress)
+{
+	unsigned gen_counter;
+	unsigned tseed_length;
+	uint8_t tseed[MAX_PVP_SEED_SIZE+1];
+	int ret;
+	unsigned pseed_length, iterations;
+	uint8_t *pseed;
+	unsigned old_counter, i;
+	mpz_t s, tmp, r, dc0, c0, c, t, z;
+	uint8_t *storage = NULL;
+	unsigned storage_length = 0;
+
+	if (bits < 33) {
+		return st_provable_prime_small(p, prime_seed_length, prime_seed,
+					       prime_gen_counter, bits,
+					       seed_length, seed, progress_ctx,
+					       progress);
+	}
+
+	mpz_init(s);
+	mpz_init(tmp);
+	mpz_init(r);
+	mpz_init(c);
+	mpz_init(z);
+	mpz_init(t);
+	mpz_init(c0);
+	mpz_init(dc0);
+
+	pseed_length = seed_length + 2;
+
+	pseed = gnutls_malloc(pseed_length);
+	if (pseed == NULL)
+		goto fail;
+
+	ret = st_provable_prime(c0, &pseed_length, pseed, &gen_counter,
+				1+div_ceil(bits, 2), seed_length, seed,
+				progress_ctx, progress);
+	if (ret == 0)
+		goto fail;
+
+	nettle_mpz_set_str_256_u(s, pseed_length, pseed);
+
+	/* the spec says to remove 1 here */
+	iterations = div_ceil(bits, DIGEST_SIZE * 8);
+	old_counter = gen_counter;
+
+	mpz_set_ui(tmp, 0);	/* x = 0 */
+	if (iterations > 0) {
+		storage_length = iterations * DIGEST_SIZE;
+
+		storage = malloc(storage_length);
+		if (storage == NULL)
+			goto fail;
+
+		for (i = 0; i < iterations; i++) {
+			tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+			if (tseed_length > sizeof(tseed))
+				goto fail;
+			nettle_mpz_get_str_256(tseed_length, tseed, s);
+
+			hash(&storage
+			     [(iterations - i - 1) * DIGEST_SIZE],
+			     tseed_length, tseed);
+			mpz_add_ui(s, s, 1);
+		}
+
+		nettle_mpz_set_str_256_u(tmp, storage_length, storage);
+	}
+
+	/* tmp = 2^(bits-1) + (tmp mod 2^(bits-1)) */
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, bits - 1);	/* r = 2^(bits-1) */
+
+	mpz_fdiv_r_2exp(tmp, tmp, bits - 1);
+	mpz_add(tmp, tmp, r);	/* tmp = x */
+
+	/* Generate candidate prime c in [2^(bits-1), 2^bits] */
+
+	/* t = u[x/2c0] */
+	mpz_mul_2exp(dc0, c0, 1);	/* dc0 = 2*c0 */
+	mpz_cdiv_q(t, tmp, dc0);
+
+ retry:
+	/* c = t*(2c0) + 1 */
+	mpz_mul(c, dc0, t);
+	mpz_add_ui(c, c, 1);
+
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, bits);	/* r = 2^(bits) */
+
+	/* if 2tc0+1 > 2^bits */
+	if (mpz_cmp(c, r) > 0) {
+		/* t = 2^(bits-1)/2c0 */
+
+		mpz_fdiv_q_2exp(r, r, 1); /* r = 2^(bits-1) */
+		mpz_cdiv_q(t, r, dc0);
+
+		/* c = t* 2c0 + 1 */
+		mpz_mul(c, dc0, t);
+		mpz_add_ui(c, c, 1);
+	}
+
+	gen_counter++;
+
+	mpz_set_ui(r, 0); /* a = 0 */
+	if (iterations > 0) {
+		for (i = 0; i < iterations; i++) {
+			tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+			if (tseed_length > sizeof(tseed))
+				goto fail;
+
+			nettle_mpz_get_str_256(tseed_length, tseed, s);
+
+			hash(&storage
+			     [(iterations - i - 1) * DIGEST_SIZE],
+			     tseed_length, tseed);
+			mpz_add_ui(s, s, 1);
+		}
+
+		/* r = a */
+		nettle_mpz_set_str_256_u(r, storage_length, storage);
+	}
+
+	/* a = 2 + (a mod (c-3)) */
+	mpz_sub_ui(tmp, c, 3);	/* c is too large to worry about negatives */
+	mpz_mod(r, r, tmp);
+	mpz_add_ui(r, r, 2);
+
+	/* z = a^(2t) mod c */
+	mpz_mul_2exp(tmp, t, 1); /* tmp = 2t */
+	mpz_powm(z, r, tmp, c);
+
+	mpz_sub_ui(tmp, z, 1);
+
+	mpz_gcd(r, tmp, c);
+
+	if (mpz_cmp_ui(r, 1) == 0) {
+		mpz_powm(tmp, z, c0, c);
+		if (mpz_cmp_ui(tmp, 1) == 0) {
+			mpz_set(p, c);
+
+			if (prime_seed != NULL) {
+				tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+				if (*prime_seed_length < tseed_length)
+					goto fail;
+
+				nettle_mpz_get_str_256(tseed_length,
+						       prime_seed, s);
+				*prime_seed_length = tseed_length;
+			}
+
+			if (prime_gen_counter)
+				*prime_gen_counter = gen_counter;
+
+			goto success;
+		}
+	}
+
+	if (progress)
+		progress(progress_ctx, 'x');
+
+	if (gen_counter >= (4 * bits + old_counter)) {
+		goto fail;
+	}
+
+	mpz_add_ui(t, t, 1);
+	goto retry;
+
+ success:
+	ret = 1;
+	goto finish;
+
+ fail:
+	ret = 0;
+
+ finish:
+	mpz_clear(c0);
+	mpz_clear(dc0);
+	mpz_clear(r);
+	mpz_clear(s);
+	mpz_clear(z);
+	mpz_clear(t);
+	mpz_clear(tmp);
+	mpz_clear(c);
+	free(pseed);
+	free(storage);
+	return ret;
+}
diff --git a/lib/nettle/int/rsa-fips.h b/lib/nettle/int/rsa-fips.h
new file mode 100644
index 0000000..a2a418a
--- /dev/null
+++ b/lib/nettle/int/rsa-fips.h
@@ -0,0 +1,49 @@
+/* rsa-fips.h
+ *
+ * The RSA publickey algorithm.
+ */
+
+/* Copyright (C) 2014 Red Hat
+ *  
+ * The gnutls library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#ifndef GNUTLS_LIB_NETTLE_INT_RSA_FIPS_H
+#define GNUTLS_LIB_NETTLE_INT_RSA_FIPS_H
+
+#include <nettle/rsa.h>
+
+int
+_rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
+				struct rsa_private_key *key,
+				unsigned seed_length, uint8_t * seed,
+				void *progress_ctx,
+				nettle_progress_func * progress,
+				/* Desired size of modulo, in bits */
+				unsigned n_size);
+
+int
+rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
+			       struct rsa_private_key *key,
+			       void *random_ctx, nettle_random_func * random,
+			       void *progress_ctx,
+			       nettle_progress_func * progress,
+			       unsigned *rseed_size,
+			       void *rseed,
+			       /* Desired size of modulo, in bits */
+			       unsigned n_size);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_RSA_FIPS_H */
diff --git a/lib/nettle/int/rsa-keygen-fips186.c b/lib/nettle/int/rsa-keygen-fips186.c
new file mode 100644
index 0000000..c6f7e67
--- /dev/null
+++ b/lib/nettle/int/rsa-keygen-fips186.c
@@ -0,0 +1,457 @@
+/*
+ * Generation of RSA keypairs.
+ */
+
+/* nettle, low-level cryptographics library
+ *
+ * Copyright (C) 2002 Niels Möller
+ * Copyright (C) 2014 Red Hat
+ *  
+ * The nettle library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ * 
+ * The nettle library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the nettle library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02111-1301, USA.
+ */
+
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <assert.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <nettle/rsa.h>
+#include <dsa-fips.h>
+#include <rsa-fips.h>
+
+#include <nettle/bignum.h>
+
+static int
+rsa_provable_prime (mpz_t p,
+			  unsigned *prime_seed_length, void *prime_seed,
+			  unsigned bits,
+			  unsigned seed_length, const void *seed,
+			  mpz_t e,
+			  void *progress_ctx, nettle_progress_func * progress)
+{
+mpz_t x, t, s, r1, r2, p0, sq;
+int ret;
+unsigned pcounter = 0;
+unsigned iterations;
+unsigned storage_length = 0, i;
+uint8_t *storage = NULL;
+uint8_t pseed[MAX_PVP_SEED_SIZE+1];
+unsigned pseed_length = sizeof(pseed), tseed_length;
+unsigned max = bits*5;
+
+	mpz_init(p0);
+	mpz_init(sq);
+	mpz_init(x);
+	mpz_init(t);
+	mpz_init(s);
+	mpz_init(r1);
+	mpz_init(r2);
+
+	/* p1 = p2 = 1 */
+
+	ret = st_provable_prime(p0, &pseed_length, pseed,
+				NULL, 1+div_ceil(bits,2), seed_length,
+				seed, progress_ctx, progress);
+	if (ret == 0) {
+		goto cleanup;
+	}
+
+	iterations = div_ceil(bits, DIGEST_SIZE*8);
+	mpz_set_ui(x, 0);
+
+	if (iterations > 0) {
+		storage_length = iterations * DIGEST_SIZE;
+		storage = malloc(storage_length);
+		if (storage == NULL) {
+			goto fail;
+		}
+
+		nettle_mpz_set_str_256_u(s, pseed_length, pseed);
+		for (i = 0; i < iterations; i++) {
+			tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+			if (tseed_length > sizeof(pseed))
+				goto fail;
+			nettle_mpz_get_str_256(tseed_length, pseed, s);
+
+			hash(&storage[(iterations - i - 1) * DIGEST_SIZE],
+			     tseed_length, pseed);
+			mpz_add_ui(s, s, 1);
+		}
+
+		nettle_mpz_set_str_256_u(x, storage_length, storage);
+	}
+
+	/* x = sqrt(2)*2^(bits-1) + (x mod 2^(bits) - sqrt(2)*2(bits-1)) */
+
+	/* sq = sqrt(2)*2^(bits-1) */
+	mpz_set_ui(r1, 1);
+	mpz_mul_2exp(r1, r1, 2*bits-1);
+	mpz_sqrt(sq, r1);
+
+	/* r2 = 2^bits - sq */
+	mpz_set_ui(r2, 1);
+	mpz_mul_2exp(r2, r2, bits);
+	mpz_sub(r2, r2, sq);
+
+	/* x =  sqrt(2)*2^(bits-1) + (x mod (2^L - sqrt(2)*2^(bits-1)) */
+	mpz_mod(x, x, r2);
+	mpz_add(x, x, sq);
+
+	/* y = p2 = p1 = 1 */
+
+	/* r1 = (2 y p0 p1) */
+	mpz_mul_2exp(r1, p0, 1);
+
+	/* r2 = 2 p0 p1 p2 (p2=y=1) */
+	mpz_set(r2, r1);
+
+	/* r1 = (2 y p0 p1) + x */
+	mpz_add(r1, r1, x);
+
+	/* t = ((2 y p0 p1) + x) / (2 p0 p1 p2) */
+	mpz_cdiv_q(t, r1, r2);
+
+ retry:
+	/* p = t p2 - y = t - 1 */
+	mpz_sub_ui(p, t, 1);
+
+	/* p = 2(tp2-y)p0p1 */
+	mpz_mul(p, p, p0);
+	mpz_mul_2exp(p, p, 1);
+
+	/* p = 2(tp2-y)p0p1 + 1*/
+	mpz_add_ui(p, p, 1);
+
+	mpz_set_ui(r2, 1);
+	mpz_mul_2exp(r2, r2, bits);
+
+	if (mpz_cmp(p, r2) > 0) {
+		/* t = (2 y p0 p1) + sqrt(2)*2^(bits-1) / (2p0p1p2) */
+		mpz_set(r1, p0);
+		/* r1 = (2 y p0 p1) */
+		mpz_mul_2exp(r1, r1, 1);
+
+		/* sq =  sqrt(2)*2^(bits-1) */
+
+		/* r1 = (2 y p0 p1) + sq */
+		mpz_add(r1, r1, sq);
+
+		/* r2 = 2 p0 p1 p2 */
+		mpz_mul_2exp(r2, p0, 1);
+
+		/* t = ((2 y p0 p1) + sq) / (2 p0 p1 p2) */
+		mpz_cdiv_q(t, r1, r2);
+	}
+
+	pcounter++;
+
+	/* r2 = p - 1 */
+	mpz_sub_ui(r2, p, 1);
+
+	/* r1 = GCD(p1, e) */
+	mpz_gcd(r1, e, r2);
+
+	if (mpz_cmp_ui(r1, 1) == 0) {
+		mpz_set_ui(x, 0); /* a = 0 */
+		if (iterations > 0) {
+			for (i = 0; i < iterations; i++) {
+				tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+				if (tseed_length > sizeof(pseed))
+					goto fail;
+				nettle_mpz_get_str_256(tseed_length, pseed, s);
+
+				hash(&storage[(iterations - i - 1) * DIGEST_SIZE],
+				     tseed_length, pseed);
+				mpz_add_ui(s, s, 1);
+			}
+
+			nettle_mpz_set_str_256_u(x, storage_length, storage);
+		}
+
+		/* a = 2 + a mod p-3 */
+		mpz_sub_ui(r1, p, 3);	/* p is too large to worry about negatives */
+		mpz_mod(x, x, r1);
+		mpz_add_ui(x, x, 2);
+
+		/* z = a^(2(tp2-y)p1) mod p */
+
+		/* r1 = (tp2-y) */
+		mpz_sub_ui(r1, t, 1);
+		/* r1 = 2(tp2-y)p1 */
+		mpz_mul_2exp(r1, r1, 1);
+
+		/* z = r2 = a^r1 mod p */
+		mpz_powm(r2, x, r1, p);
+
+		mpz_sub_ui(r1, r2, 1);
+		mpz_gcd(x, r1, p);
+
+		if (mpz_cmp_ui(x, 1) == 0) {
+			mpz_powm(r1, r2, p0, p);
+			if (mpz_cmp_ui(r1, 1) == 0) {
+				if (prime_seed_length != NULL) {
+					tseed_length = mpz_seed_sizeinbase_256_u(s, pseed_length);
+					if (tseed_length > sizeof(pseed))
+						goto fail;
+
+					nettle_mpz_get_str_256(tseed_length, pseed, s);
+
+					if (*prime_seed_length < tseed_length) {
+						*prime_seed_length = tseed_length;
+						goto fail;
+					}
+					*prime_seed_length = tseed_length;
+					if (prime_seed != NULL)
+						memcpy(prime_seed, pseed, tseed_length);
+				}
+				ret = 1;
+				goto cleanup;
+			}
+		}
+	}
+
+	if (pcounter >= max) {
+		goto fail;
+	}
+
+	mpz_add_ui(t, t, 1);
+	goto retry;
+
+fail:
+	ret = 0;
+cleanup:
+	free(storage);
+	mpz_clear(p0);
+	mpz_clear(sq);
+	mpz_clear(r1);
+	mpz_clear(r2);
+	mpz_clear(x);
+	mpz_clear(t);
+	mpz_clear(s);
+
+	return ret;
+}
+
+/* Return the pre-defined seed length for modulus size, or 0 when the
+ * modulus size is unsupported.
+ */
+static inline unsigned
+seed_length_for_modulus_size(unsigned modulus_size)
+{
+	switch (modulus_size) {
+	case 2048:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
+		return 14 * 2;
+	case 3072:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
+		return 16 * 2;
+	case 4096:      /* SP 800-56B rev 2 Appendix D */
+		return 19 * 2;
+	case 6144:      /* SP 800-56B rev 2 Appendix D */
+		return 22 * 2;
+	case 7680:      /* FIPS 140-2 IG 7.5 */
+		return 24 * 2;
+	case 8192:      /* SP 800-56B rev 2 Appendix D */
+		return 25 * 2;
+	case 15360:     /* FIPS 140-2 IG 7.5 */
+		return 32 * 2;
+	default:
+		return 0;
+	}
+
+}
+
+/* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4.
+ * 
+ * The hash function used is SHA384.
+ * The exponent e used is the value in pub->e.
+ */
+int
+_rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
+				struct rsa_private_key *key,
+				unsigned seed_length, uint8_t * seed,
+				void *progress_ctx,
+				nettle_progress_func * progress,
+				/* Desired size of modulo, in bits */
+				unsigned n_size)
+{
+	mpz_t t, r, p1, q1, lcm;
+	int ret;
+	struct dss_params_validation_seeds cert;
+	unsigned l = n_size / 2;
+	unsigned s = seed_length_for_modulus_size(n_size);
+
+	if (!s) {
+		FIPS_RULE(false, 0, "unsupported modulus size\n");
+	}
+
+	FIPS_RULE(seed_length != s, 0,
+		  "seed length other than %u bytes\n", s);
+
+	if (!mpz_tstbit(pub->e, 0)) {
+		_gnutls_debug_log("Unacceptable e (it is even)\n");
+		return 0;
+	}
+
+	if (mpz_cmp_ui(pub->e, 65536) <= 0) {
+		_gnutls_debug_log("Unacceptable e\n");
+		return 0;
+	}
+
+	mpz_init(p1);
+	mpz_init(q1);
+	mpz_init(lcm);
+	mpz_init(t);
+	mpz_init(r);
+
+	mpz_set_ui(t, 1);
+	mpz_mul_2exp(t, t, 256);
+
+	if (mpz_cmp(pub->e, t) >= 0) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	cert.pseed_length = sizeof(cert.pseed);
+	ret = rsa_provable_prime(key->p, &cert.pseed_length, cert.pseed,
+				l, seed_length,
+				seed, pub->e, progress_ctx, progress);
+	if (ret == 0) {
+		goto cleanup;
+	}
+
+	mpz_set_ui(r, 1);
+	mpz_mul_2exp(r, r, (l) - 100);
+
+	do {
+		cert.qseed_length = sizeof(cert.qseed);
+		ret = rsa_provable_prime(key->q, &cert.qseed_length, cert.qseed,
+					l, cert.pseed_length, cert.pseed,
+					pub->e,
+					progress_ctx, progress);
+		if (ret == 0) {
+			goto cleanup;
+		}
+
+
+		cert.pseed_length = cert.qseed_length;
+		memcpy(cert.pseed, cert.qseed, cert.qseed_length);
+
+
+		if (mpz_cmp(key->p, key->q) > 0)
+			mpz_sub(t, key->p, key->q);
+		else
+			mpz_sub(t, key->q, key->p);
+	} while (mpz_cmp(t, r) <= 0);
+
+	memset(&cert, 0, sizeof(cert));
+
+	mpz_mul(pub->n, key->p, key->q);
+
+	if (mpz_sizeinbase(pub->n, 2) != n_size) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	/* c = q^{-1} (mod p) */
+	if (mpz_invert(key->c, key->q, key->p) == 0) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	mpz_sub_ui(p1, key->p, 1);
+	mpz_sub_ui(q1, key->q, 1);
+
+	mpz_lcm(lcm, p1, q1);
+
+	if (mpz_invert(key->d, pub->e, lcm) == 0) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	/* check whether d > 2^(nlen/2) -- FIPS186-4 5.3.1 */
+	if (mpz_sizeinbase(key->d, 2) < n_size/2) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	/* Done! Almost, we must compute the auxiliary private values. */
+	/* a = d % (p-1) */
+	mpz_fdiv_r(key->a, key->d, p1);
+
+	/* b = d % (q-1) */
+	mpz_fdiv_r(key->b, key->d, q1);
+
+	/* c was computed earlier */
+
+	pub->size = key->size = (n_size + 7) / 8;
+	if (pub->size < RSA_MINIMUM_N_OCTETS) {
+		ret = 0;
+		goto cleanup;
+	}
+
+	ret = 1;
+ cleanup:
+	mpz_clear(p1);
+	mpz_clear(q1);
+	mpz_clear(lcm);
+	mpz_clear(t);
+	mpz_clear(r);
+	return ret;
+}
+
+/* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4.
+ * 
+ * The hash function used is SHA384.
+ * The exponent e used is the value in pub->e.
+ */
+int
+rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
+			       struct rsa_private_key *key,
+			       void *random_ctx, nettle_random_func * random,
+			       void *progress_ctx,
+			       nettle_progress_func * progress,
+			       unsigned *rseed_size,
+			       void *rseed,
+			       /* Desired size of modulo, in bits */
+			       unsigned n_size)
+{
+	uint8_t seed[128];
+	unsigned seed_length;
+	int ret;
+
+	seed_length = seed_length_for_modulus_size(n_size);
+	FIPS_RULE(!seed_length, 0, "unsupported modulus size\n");
+
+	assert(seed_length <= sizeof(seed));
+
+	random(random_ctx, seed_length, seed);
+
+	if (rseed && rseed_size) {
+		if (*rseed_size < seed_length) {
+			return 0;
+		}
+		memcpy(rseed, seed, seed_length);
+		*rseed_size = seed_length;
+	}
+
+	ret = _rsa_generate_fips186_4_keypair(pub, key, seed_length, seed,
+					       progress_ctx, progress, n_size);
+	gnutls_memset(seed, 0, seed_length);
+	return ret;
+}
diff --git a/lib/nettle/int/rsa-pad.c b/lib/nettle/int/rsa-pad.c
new file mode 100644
index 0000000..401bad3
--- /dev/null
+++ b/lib/nettle/int/rsa-pad.c
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2021 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "gnutls_int.h"
+
+#include <nettle/pkcs1.h>
+#include <nettle/pss.h>
+#include <nettle/sha2.h>
+
+/* These are helper functions to perform RSA padding before signing, only used
+ * for the crypto backends that do not support RSA-PKCS1/PSS natively for the
+ * use with TLS (such as TPM2); not recommended for general usage.
+ */
+
+int
+_gnutls_rsa_pkcs1_sign_pad(size_t key_bits,
+			   const gnutls_datum_t *data,
+			   unsigned char *buffer, size_t buffer_size)
+{
+	size_t key_size = (key_bits + 7) / 8;
+	size_t size;
+	mpz_t m;
+	int ret = 0;
+
+	mpz_init(m);
+	if (!pkcs1_rsa_digest_encode(m, key_size, data->size, data->data)) {
+		ret = gnutls_assert_val(GNUTLS_E_PK_SIGN_FAILED);
+		goto out;
+	}
+
+	size = nettle_mpz_sizeinbase_256_u(m);
+	if (size > buffer_size) {
+		ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
+		goto out;
+	}
+	nettle_mpz_get_str_256(buffer_size, buffer, m);
+
+ out:
+	mpz_clear(m);
+	return ret;
+}
+
+int
+_gnutls_rsa_pss_sign_pad(gnutls_x509_spki_st *params,
+			 size_t key_bits,
+			 const gnutls_datum_t *data,
+			 unsigned char *buffer, size_t buffer_size)
+{
+	mpz_t m;
+	int ret = 0;
+	const struct nettle_hash *hash;
+	uint8_t salt[SHA512_DIGEST_SIZE];
+	size_t size;
+
+	mpz_init(m);
+
+	switch (params->rsa_pss_dig) {
+	case GNUTLS_DIG_SHA256:
+		hash = &nettle_sha256;
+		break;
+	case GNUTLS_DIG_SHA384:
+		hash = &nettle_sha384;
+		break;
+	case GNUTLS_DIG_SHA512:
+		hash = &nettle_sha512;
+		break;
+	default:
+		ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+		goto out;
+	}
+
+	if (data->size != hash->digest_size) {
+		ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+		goto out;
+	}
+
+	ret = gnutls_rnd(GNUTLS_RND_NONCE, salt, params->salt_size);
+	if (ret < 0) {
+		goto out;
+	}
+
+	/* The emBits for EMSA-PSS encoding is actually one *fewer*
+	 * bit than the RSA modulus. */
+	if (!pss_encode_mgf1(m, key_bits - 1, hash, params->salt_size, salt,
+			     data->data)) {
+		ret = gnutls_assert_val(GNUTLS_E_PK_SIGN_FAILED);
+		goto out;
+	}
+
+	size = nettle_mpz_sizeinbase_256_u(m);
+	if (size > buffer_size) {
+		ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
+		goto out;
+	}
+	nettle_mpz_get_str_256(buffer_size, buffer, m);
+
+ out:
+	mpz_clear(m);
+	return ret;
+}
diff --git a/lib/nettle/int/tls1-prf.c b/lib/nettle/int/tls1-prf.c
new file mode 100644
index 0000000..19ca5d3
--- /dev/null
+++ b/lib/nettle/int/tls1-prf.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+/* Functions for the TLS PRF handling.
+ */
+
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <gnutls_int.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <nettle/hmac.h>
+#include <nettle/memxor.h>
+#include "int/tls1-prf.h"
+#include <nettle/sha1.h>
+#include <nettle/md5.h>
+
+
+/* The RFC2246 P_hash() function. The mac_ctx is expected to
+ * be initialized and key set to be the secret key.
+ */
+static void
+P_hash( void *mac_ctx,
+	nettle_hash_update_func *update,
+	nettle_hash_digest_func *digest,
+	size_t digest_size,
+	size_t seed_size, const uint8_t *seed,
+	size_t label_size, const char *label,
+	size_t dst_length,
+	uint8_t *dst)
+{
+	uint8_t Atmp[MAX_HASH_SIZE];
+	ssize_t left;
+	unsigned started = 0;
+
+	/* round up */
+	left = dst_length;
+
+	while(left > 0) {
+		if (started == 0) { /* A(0) */
+		        update(mac_ctx, label_size, (const uint8_t *)label); /* hash label */
+			update(mac_ctx, seed_size, seed);
+			started = 1;
+		} else {
+			update(mac_ctx, digest_size, Atmp);
+		}
+		digest(mac_ctx, digest_size, Atmp); /* store A(i) */
+
+		update(mac_ctx, digest_size, Atmp); /* hash A(i) */
+		update(mac_ctx, label_size, (const uint8_t *)label); /* hash label */
+		update(mac_ctx, seed_size, seed); /* hash seed */
+
+		if (left < (ssize_t)digest_size)
+			digest_size = left;
+
+		digest(mac_ctx, digest_size, dst);
+
+		left -= digest_size;
+		dst += digest_size;
+	}
+
+	return;
+}
+
+int
+tls10_prf(size_t secret_size, const uint8_t *secret,
+	  size_t label_size, const char *label,
+	  size_t seed_size, const uint8_t *seed,
+	  size_t length, uint8_t *dst)
+{
+	int l_s;
+	const uint8_t *s1, *s2;
+	struct hmac_md5_ctx md5_ctx;
+	struct hmac_sha1_ctx sha1_ctx;
+	uint8_t o1[MAX_PRF_BYTES];
+
+	if (length > MAX_PRF_BYTES)
+		return 0;
+
+	l_s = secret_size / 2;
+	s1 = &secret[0];
+	s2 = &secret[l_s];
+	if (secret_size % 2 != 0) {
+		l_s++;
+	}
+
+	hmac_md5_set_key(&md5_ctx, l_s, s1);
+
+	P_hash(&md5_ctx, (nettle_hash_update_func*)hmac_md5_update,
+		(nettle_hash_digest_func*)hmac_md5_digest,
+		MD5_DIGEST_SIZE,
+		seed_size, seed, label_size, label, length, o1);
+
+	hmac_sha1_set_key(&sha1_ctx, l_s, s2);
+
+	P_hash(&sha1_ctx, (nettle_hash_update_func*)hmac_sha1_update,
+		(nettle_hash_digest_func*)hmac_sha1_digest,
+		SHA1_DIGEST_SIZE,
+		seed_size, seed, label_size, label, length, dst);
+
+	memxor(dst, o1, length);
+
+	return 1;
+}
+
+/*-
+ * tls12_prf:
+ * @mac_ctx: a MAC context initialized with key being the secret
+ * @update: a MAC update function
+ * @digest: a MAC digest function
+ * @digest_size: the MAC output size
+ * @label_size: the size of the label
+ * @label: the label to apply
+ * @seed_size: the seed size
+ * @seed: the seed
+ * @length: size of desired PRF output
+ * @dst: the location to store output
+ *
+ * The TLS 1.2 Pseudo-Random-Function (PRF).
+ *
+ * Returns: zero on failure, non zero on success.
+ -*/
+int
+tls12_prf(void *mac_ctx,
+	  nettle_hash_update_func *update,
+	  nettle_hash_digest_func *digest,
+	  size_t digest_size,
+	  size_t label_size, const char *label,
+	  size_t seed_size, const uint8_t *seed,
+	  size_t length, uint8_t *dst)
+{
+	P_hash(mac_ctx, update, digest, digest_size,
+		seed_size, seed, label_size, label, length, dst);
+
+	return 1;
+}
diff --git a/lib/nettle/int/tls1-prf.h b/lib/nettle/int/tls1-prf.h
new file mode 100644
index 0000000..e79d1c8
--- /dev/null
+++ b/lib/nettle/int/tls1-prf.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+#ifndef GNUTLS_LIB_NETTLE_INT_TLS1_PRF_H
+#define GNUTLS_LIB_NETTLE_INT_TLS1_PRF_H
+
+#include <nettle/nettle-meta.h>
+
+#define MAX_PRF_BYTES 200
+
+/* Namespace mangling */
+#define tls10_prf nettle_tls10_prf
+#define tls12_prf nettle_tls12_prf
+
+int
+tls10_prf(size_t secret_size, const uint8_t *secret,
+	  size_t label_size, const char *label,
+	  size_t seed_size, const uint8_t *seed,
+	  size_t length, uint8_t *dst);
+
+int
+tls12_prf(void *mac_ctx,
+	  nettle_hash_update_func *update,
+	  nettle_hash_digest_func *digest,
+	  size_t digest_size,
+	  size_t label_size, const char *label,
+	  size_t seed_size, const uint8_t *seed,
+	  size_t length, uint8_t *dst);
+
+#endif /* GNUTLS_LIB_NETTLE_INT_TLS1_PRF_H */