Add sm9 and paillier pem support

2026-08-12 17:03:37 +08:00 · 2018-11-16 15:26:30 +08:00
parent 5baad7e043
commit 9a999ae907
38 changed files with 7956 additions and 6992 deletions
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -538,7 +538,7 @@ typedef enum OPTION_choice {
    OPT_SRPUSER, OPT_SRPPASS, OPT_SRP_STRENGTH, OPT_SRP_LATEUSER,
    OPT_SRP_MOREGROUPS,
 #endif
-    OPT_SSL3, OPT_SSL_CONFIG,
+    OPT_SSL3, OPT_CONFIG, OPT_SSL_CONFIG,
    OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
    OPT_GMTLS,
    OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM, OPT_PASS,
@@ -659,7 +659,8 @@ OPTIONS s_client_options[] = {
    {"alpn", OPT_ALPN, 's',
     "Enable ALPN extension, considering named protocols supported (comma-separated list)"},
    {"async", OPT_ASYNC, '-', "Support asynchronous operation"},
-    {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"},
+    {"config", OPT_CONFIG, 's', "Use configuration file"},
+    {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration section"},
    {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n',
     "Size used to split data for encrypt pipelines"},
    {"max_pipelines", OPT_MAX_PIPELINES, 'n',
@@ -726,7 +727,7 @@ OPTIONS s_client_options[] = {
     "Specify engine to be used for client certificate operations"},
 #endif
 #ifndef OPENSSL_NO_CT
-    {"ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapling)"},
+    {"ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapsection)"},
    {"noct", OPT_NOCT, '-', "Do not request or parse SCTs (default)"},
    {"ctlogfile", OPT_CTLOG_FILE, '<', "CT log list CONF file"},
 #endif
@@ -838,6 +839,8 @@ int s_client_main(int argc, char **argv)
    char *servername = NULL;
    const char *alpn_in = NULL;
    tlsextctx tlsextcbp = { NULL, 0 };
+    CONF *conf = NULL;
+    const char *configfile = default_config_file;
    const char *ssl_config = NULL;
 #define MAX_SI_TYPES 100
    unsigned short serverinfo_types[MAX_SI_TYPES];
@@ -1152,6 +1155,9 @@ int s_client_main(int argc, char **argv)
                min_version = TLS1_VERSION;
            break;
 #endif
+        case OPT_CONFIG:
+            configfile = opt_arg();
+            break;
        case OPT_SSL_CONFIG:
            ssl_config = opt_arg();
            break;
@@ -1347,6 +1353,13 @@ int s_client_main(int argc, char **argv)
    if (argc != 0)
        goto opthelp;

+    if (e)
+        BIO_printf(bio_err, "Using configuration from %s\n", configfile);
+    if ((conf = app_load_config(configfile)) == NULL)
+        goto end;
+    if (configfile != default_config_file && !app_load_modules(conf))
+        goto end;
+
    if (proxystr) {
        int res;
        char *tmp_host = host, *tmp_port = port;
@@ -2522,6 +2535,7 @@ int s_client_main(int argc, char **argv)
    bio_c_out = NULL;
    BIO_free(bio_c_msg);
    bio_c_msg = NULL;
+    NCONF_free(conf);
    return (ret);
 }

--- a/crypto/asn1/ameth_lib.c
+++ b/crypto/asn1/ameth_lib.c
@@ -44,7 +44,14 @@ static const EVP_PKEY_ASN1_METHOD *standard_methods[] = {
    &dhx_asn1_meth,
 #endif
 #ifndef OPENSSL_NO_EC
-    &ecx25519_asn1_meth
+    &ecx25519_asn1_meth,
+#endif
+#ifndef OPENSSL_NO_SM9
+    &sm9_asn1_meth,
+    &sm9_master_asn1_meth,
+#endif
+#ifndef OPENSSL_NO_PAILLIER
+    &paillier_asn1_meth,
 #endif
 };

--- a/crypto/asn1/asn1_err.c
+++ b/crypto/asn1/asn1_err.c
@@ -1,6 +1,6 @@
 /*
 * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
@@ -99,6 +99,8 @@ static ERR_STRING_DATA ASN1_str_functs[] = {
    {ERR_FUNC(ASN1_F_I2D_PRIVATEKEY), "i2d_PrivateKey"},
    {ERR_FUNC(ASN1_F_I2D_PUBLICKEY), "i2d_PublicKey"},
    {ERR_FUNC(ASN1_F_I2D_RSA_PUBKEY), "i2d_RSA_PUBKEY"},
+    {ERR_FUNC(ASN1_F_I2D_SM9_MASTER_PUBKEY), "i2d_SM9_MASTER_PUBKEY"},
+    {ERR_FUNC(ASN1_F_I2D_SM9_PUBKEY), "i2d_SM9_PUBKEY"},
    {ERR_FUNC(ASN1_F_LONG_C2I), "long_c2i"},
    {ERR_FUNC(ASN1_F_OID_MODULE_INIT), "oid_module_init"},
    {ERR_FUNC(ASN1_F_PARSE_TAGGING), "parse_tagging"},
--- a/crypto/cpk/cpk_err.c
+++ b/crypto/cpk/cpk_err.c
@@ -55,6 +55,7 @@ static ERR_STRING_DATA CPK_str_reasons[] = {
    {ERR_REASON(CPK_R_BAD_DATA), "bad data"},
    {ERR_REASON(CPK_R_INVALID_ALGORITHM), "invalid algorithm"},
    {ERR_REASON(CPK_R_INVALID_ARGUMENT), "invalid argument"},
+    {ERR_REASON(CPK_R_INVALID_CURVE), "invalid curve"},
    {ERR_REASON(CPK_R_INVALID_ID_LENGTH), "invalid id length"},
    {ERR_REASON(CPK_R_INVALID_MAP_ALGOR), "invalid map algor"},
    {ERR_REASON(CPK_R_INVALID_PKEY_TYPE), "invalid pkey type"},
--- a/crypto/evp/evp_err.c
+++ b/crypto/evp/evp_err.c
@@ -1,6 +1,6 @@
 /*
 * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
@@ -70,6 +70,12 @@ static ERR_STRING_DATA EVP_str_functs[] = {
    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_HMAC), "EVP_PKEY_get0_hmac"},
    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_PAILLIER), "EVP_PKEY_get0_PAILLIER"},
    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_RSA), "EVP_PKEY_get0_RSA"},
+    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_SM9), "EVP_PKEY_get0_SM9"},
+    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_SM9MASTERSECRET),
+     "EVP_PKEY_get0_SM9MasterSecret"},
+    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_SM9PUBLICPARAMETERS),
+     "EVP_PKEY_get0_SM9PublicParameters"},
+    {ERR_FUNC(EVP_F_EVP_PKEY_GET0_SM9_MASTER), "EVP_PKEY_get0_SM9_MASTER"},
    {ERR_FUNC(EVP_F_EVP_PKEY_KEYGEN), "EVP_PKEY_keygen"},
    {ERR_FUNC(EVP_F_EVP_PKEY_KEYGEN_INIT), "EVP_PKEY_keygen_init"},
    {ERR_FUNC(EVP_F_EVP_PKEY_NEW), "EVP_PKEY_new"},
@@ -120,6 +126,11 @@ static ERR_STRING_DATA EVP_str_reasons[] = {
    {ERR_REASON(EVP_R_EXPECTING_A_DSA_KEY), "expecting a dsa key"},
    {ERR_REASON(EVP_R_EXPECTING_A_EC_KEY), "expecting a ec key"},
    {ERR_REASON(EVP_R_EXPECTING_A_PAILLIER), "expecting a paillier"},
+    {ERR_REASON(EVP_R_EXPECTING_A_SM9_KEY), "expecting a sm9 key"},
+    {ERR_REASON(EVP_R_EXPECTING_A_SM9_MASTER_KEY),
+     "expecting a sm9 master key"},
+    {ERR_REASON(EVP_R_EXPECTING_A_SM9_MASTER_SECRET),
+     "expecting a sm9 master secret"},
    {ERR_REASON(EVP_R_FIPS_MODE_NOT_SUPPORTED), "fips mode not supported"},
    {ERR_REASON(EVP_R_ILLEGAL_SCRYPT_PARAMETERS),
     "illegal scrypt parameters"},
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -370,6 +370,60 @@ PAILLIER *EVP_PKEY_get1_PAILLIER(EVP_PKEY *pkey)
 }
 #endif

+#ifndef OPENSSL_NO_SM9
+
+int EVP_PKEY_set1_SM9_MASTER(EVP_PKEY *pkey, SM9_MASTER_KEY *key)
+{
+    int ret = EVP_PKEY_assign_SM9_MASTER(pkey, key);
+    if (ret)
+        SM9_MASTER_KEY_up_ref(key);
+    return ret;
+}
+
+SM9_MASTER_KEY *EVP_PKEY_get0_SM9_MASTER(EVP_PKEY *pkey)
+{
+    if (pkey->type != EVP_PKEY_SM9_MASTER) {
+        EVPerr(EVP_F_EVP_PKEY_GET0_SM9_MASTER, EVP_R_EXPECTING_A_SM9_MASTER_KEY);
+        return NULL;
+    }
+    return pkey->pkey.sm9_master;
+}
+
+SM9_MASTER_KEY *EVP_PKEY_get1_SM9_MASTER(EVP_PKEY *pkey)
+{
+    SM9_MASTER_KEY *ret = EVP_PKEY_get0_SM9_MASTER(pkey);
+    if (ret != NULL)
+        SM9_MASTER_KEY_up_ref(ret);
+    return ret;
+}
+
+int EVP_PKEY_set1_SM9(EVP_PKEY *pkey, SM9_KEY *key)
+{
+	int ret = EVP_PKEY_assign_SM9(pkey, key);
+	if (ret)
+		SM9_KEY_up_ref(key);
+	return ret;
+}
+
+SM9_KEY *EVP_PKEY_get0_SM9(EVP_PKEY *pkey)
+{
+	if (pkey->type != EVP_PKEY_SM9) {
+		EVPerr(EVP_F_EVP_PKEY_GET0_SM9, EVP_R_EXPECTING_A_SM9_KEY);
+		return NULL;
+	}
+	return pkey->pkey.sm9;
+}
+
+SM9_KEY *EVP_PKEY_get1_SM9(EVP_PKEY *pkey)
+{
+	SM9_KEY *ret = EVP_PKEY_get0_SM9(pkey);
+	if (ret != NULL)
+		SM9_KEY_up_ref(ret);
+	return ret;
+}
+
+#endif
+
 #ifndef OPENSSL_NO_DH

 int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
--- a/crypto/include/internal/asn1_int.h
+++ b/crypto/include/internal/asn1_int.h
@@ -64,6 +64,13 @@ extern const EVP_PKEY_ASN1_METHOD eckey_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD hmac_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[2];
+#ifndef OPENSSL_NO_PAILLIER
+extern const EVP_PKEY_ASN1_METHOD paillier_asn1_meth;
+#endif
+#ifndef OPENSSL_NO_SM9
+extern const EVP_PKEY_ASN1_METHOD sm9_master_asn1_meth;
+extern const EVP_PKEY_ASN1_METHOD sm9_asn1_meth;
+#endif

 /*
 * These are used internally in the ASN1_OBJECT to keep track of whether the
--- a/crypto/include/internal/evp_int.h
+++ b/crypto/include/internal/evp_int.h
@@ -370,8 +370,15 @@ struct evp_pkey_st {
 # ifndef OPENSSL_NO_EC
        struct ec_key_st *ec;   /* ECC */
 # endif
-# ifndef OPENSSL_NO_PAILLIER
+# ifndef OPENSSL_NO_PAILLIER	/* PAILLIER */
        struct paillier_st *paillier;
+# endif
+# ifndef OPENSSL_NO_SM9         /* SM9 */
+        struct SM9_MASTER_KEY_st *sm9_master;
+        struct SM9_KEY_st *sm9;
+# endif
+# ifndef OPENSSL_NO_CPK         /* CPK */
+        struct CPK_MASTER_SECERT *cpk;
 # endif
    } pkey;
    int save_parameters;
--- a/crypto/objects/obj_dat.h
+++ b/crypto/objects/obj_dat.h
--- a/crypto/objects/obj_mac.num
+++ b/crypto/objects/obj_mac.num
@@ -1080,143 +1080,129 @@ cmac_aes128_ecies		1079
 cmac_aes192_ecies		1080
 cmac_aes256_ecies		1081
 cbc_mac		1082
-ISO_CN		1083
-oscca		1084
-sm_scheme		1085
-sm6_ecb		1086
-sm6_cbc		1087
-sm6_ofb128		1088
-sm6_cfb128		1089
-sm1_ecb		1090
-sm1_cbc		1091
-sm1_ofb128		1092
-sm1_cfb128		1093
-sm1_cfb1		1094
-sm1_cfb8		1095
-ssf33_ecb		1096
-ssf33_cbc		1097
-ssf33_ofb128		1098
-ssf33_cfb128		1099
-ssf33_cfb1		1100
-ssf33_cfb8		1101
-sms4_ecb		1102
-sms4_cbc		1103
-sms4_ofb128		1104
-sms4_cfb128		1105
-sms4_cfb1		1106
-sms4_cfb8		1107
-sms4_ctr		1108
-sms4_gcm		1109
-sms4_ccm		1110
-sms4_xts		1111
-sms4_wrap		1112
-sms4_wrap_pad		1113
-sms4_ocb		1114
-sm5		1115
-sm2p256v1		1116
-sm2sign		1117
-sm2keyagreement		1118
-sm2encrypt		1119
-sm2encrypt_recommendedParameters		1120
-sm2encrypt_specifiedParameters		1121
-id_sm9PublicKey		1122
-sm9sign		1123
-sm9keyagreement		1124
-sm9encrypt		1125
-sm3		1126
-hmac_sm3		1127
-sm2sign_with_sm3		1128
-sm2sign_with_sha1		1129
-sm2sign_with_sha256		1130
-sm2sign_with_sha512		1131
-sm2sign_with_sha224		1132
-sm2sign_with_sha384		1133
-sm2sign_with_rmd160		1134
-wapip192v1		1135
-zuc		1136
-bfibe		1137
-bb1		1138
-type1curve		1139
-type2curve		1140
-type3curve		1141
-type4curve		1142
-tate_pairing		1143
-weil_pairing		1144
-ate_pairing		1145
-r_ate_pairing		1146
-cpk		1147
-paillier		1148
-sm2exchange		1149
-GmSSL		1150
-cpk_map		1151
-cpk_sha1_map		1152
-cpk_sha256_map		1153
-cpk_sm3_map		1154
-sm2encrypt_with_sm3		1155
-sm2encrypt_with_sha1		1156
-sm2encrypt_with_sha224		1157
-sm2encrypt_with_sha256		1158
-sm2encrypt_with_sha384		1159
-sm2encrypt_with_sha512		1160
-sm2encrypt_with_rmd160		1161
-sm2encrypt_with_whirlpool		1162
-sm2encrypt_with_blake2b512		1163
-sm2encrypt_with_blake2s256		1164
-sm2encrypt_with_md5		1165
-sm2sign_with_whirlpool		1166
-sm2sign_with_blake2b512		1167
-sm2sign_with_blake2s256		1168
-ecies_with_x9_63_sha1_xor_hmac		1169
-ecies_with_x9_63_sha256_xor_hmac		1170
-ecies_with_x9_63_sha512_xor_hmac		1171
-ecies_with_x9_63_sha1_aes128_cbc_hmac		1172
-ecies_with_x9_63_sha256_aes128_cbc_hmac		1173
-ecies_with_x9_63_sha512_aes256_cbc_hmac		1174
-ecies_with_x9_63_sha256_aes128_ctr_hmac		1175
-ecies_with_x9_63_sha512_aes256_ctr_hmac		1176
-ecies_with_x9_63_sha256_aes128_cbc_hmac_half		1177
-ecies_with_x9_63_sha512_aes256_cbc_hmac_half		1178
-ecies_with_x9_63_sha256_aes128_ctr_hmac_half		1179
-ecies_with_x9_63_sha512_aes256_ctr_hmac_half		1180
-ecies_with_x9_63_sha1_aes128_cbc_cmac		1181
-ecies_with_x9_63_sha256_aes128_cbc_cmac		1182
-ecies_with_x9_63_sha512_aes256_cbc_cmac		1183
-ecies_with_x9_63_sha256_aes128_ctr_cmac		1184
-ecies_with_x9_63_sha512_aes256_ctr_cmac		1185
-kx_sm2		1186
-auth_sm2		1187
-kx_sm9		1188
-auth_sm9		1189
-kx_sm2dhe		1190
-kx_sm2_psk		1191
-kx_sm9dhe		1192
-zuc_128eea3		1193
-zuc_128eia3		1194
-pbe_WithSM3AndSMS4_CBC		1195
-bwips		1196
-wapi_crypto		1197
-wapi_ec		1198
-wapi_ecdsa192_sha256		1199
-sm9bn256v1		1200
-sm9hash1		1201
-sm9hash1_with_sm3		1202
-sm9hash1_with_sha256		1203
-sm9sign_with_sm3		1204
-sm9sign_with_sha256		1205
-sm9encrypt_with_sm3_xor		1206
-sm9encrypt_with_sm3_sms4_cbc		1207
-sm9encrypt_with_sm3_sms4_ctr		1208
-sm9kdf		1209
-sm9kdf_with_sm3		1210
-sm9kdf_with_sha256		1211
-cpk_map32x32_sha1		1212
-cpk_map32x256_sha256		1213
-cpk_map32x256_sm3		1214
-cpk_map_with_sha1		1215
-cpk_map_with_sha256		1216
-cpk_map_with_sm3		1217
-cpk_map_sha1		1218
-cpk_map_sha256		1219
-cpk_map_sm3		1220
-cpk_map_sha384		1221
-cpk_map_sha512		1222
+pbe_WithSM3AndSMS4_CBC		1083
+ecies_with_x9_63_sha1_xor_hmac		1084
+ecies_with_x9_63_sha256_xor_hmac		1085
+ecies_with_x9_63_sha512_xor_hmac		1086
+ecies_with_x9_63_sha1_aes128_cbc_hmac		1087
+ecies_with_x9_63_sha256_aes128_cbc_hmac		1088
+ecies_with_x9_63_sha512_aes256_cbc_hmac		1089
+ecies_with_x9_63_sha256_aes128_ctr_hmac		1090
+ecies_with_x9_63_sha512_aes256_ctr_hmac		1091
+ecies_with_x9_63_sha256_aes128_cbc_hmac_half		1092
+ecies_with_x9_63_sha512_aes256_cbc_hmac_half		1093
+ecies_with_x9_63_sha256_aes128_ctr_hmac_half		1094
+ecies_with_x9_63_sha512_aes256_ctr_hmac_half		1095
+ecies_with_x9_63_sha1_aes128_cbc_cmac		1096
+ecies_with_x9_63_sha256_aes128_cbc_cmac		1097
+ecies_with_x9_63_sha512_aes256_cbc_cmac		1098
+ecies_with_x9_63_sha256_aes128_ctr_cmac		1099
+ecies_with_x9_63_sha512_aes256_ctr_cmac		1100
+ibcs1		1101
+type1curve		1102
+bfibe		1103
+bb1ibe		1104
+ISO_CN		1105
+oscca		1106
+sm_scheme		1107
+ssf33_ecb		1108
+ssf33_cbc		1109
+ssf33_ofb128		1110
+ssf33_cfb128		1111
+ssf33_cfb1		1112
+ssf33_cfb8		1113
+ssf33_cbc_mac		1114
+sm1_ecb		1115
+sm1_cbc		1116
+sm1_ofb128		1117
+sm1_cfb128		1118
+sm1_cfb1		1119
+sm1_cfb8		1120
+sm2p256v1		1121
+sm2sign		1122
+sm2exchange		1123
+sm2encrypt		1124
+sm2sign_with_sm3		1125
+sm2sign_with_sha1		1126
+sm2sign_with_sha256		1127
+sm2sign_with_sha512		1128
+sm2sign_with_sha224		1129
+sm2sign_with_sha384		1130
+sm2sign_with_rmd160		1131
+sm2sign_with_whirlpool		1132
+sm2sign_with_blake2b512		1133
+sm2sign_with_blake2s256		1134
+sm2encrypt_recommendedParameters		1135
+sm2encrypt_specifiedParameters		1136
+sm2encrypt_with_sm3		1137
+sm2encrypt_with_sha1		1138
+sm2encrypt_with_sha224		1139
+sm2encrypt_with_sha256		1140
+sm2encrypt_with_sha384		1141
+sm2encrypt_with_sha512		1142
+sm2encrypt_with_rmd160		1143
+sm2encrypt_with_whirlpool		1144
+sm2encrypt_with_blake2b512		1145
+sm2encrypt_with_blake2s256		1146
+sm2encrypt_with_md5		1147
+sm3		1148
+hmac_sm3		1149
+sms4_ecb		1150
+sms4_cbc		1151
+sms4_ofb128		1152
+sms4_cfb128		1153
+sms4_cfb1		1154
+sms4_cfb8		1155
+sms4_ctr		1156
+sms4_gcm		1157
+sms4_ccm		1158
+sms4_xts		1159
+sms4_wrap		1160
+sms4_wrap_pad		1161
+sms4_ocb		1162
+sm5		1163
+sm6_ecb		1164
+sm6_cbc		1165
+sm6_ofb128		1166
+sm6_cfb128		1167
+id_sm9PublicKey		1168
+sm9sign		1169
+sm9keyagreement		1170
+sm9encrypt		1171
+sm9hash1		1172
+sm9kdf		1173
+id_sm9MasterSecret		1174
+sm9bn256v1		1175
+sm9sign_with_sm3		1176
+sm9sign_with_sha256		1177
+sm9encrypt_with_sm3_xor		1178
+sm9encrypt_with_sm3_sms4_cbc		1179
+sm9encrypt_with_sm3_sms4_ctr		1180
+sm9hash1_with_sm3		1181
+sm9hash1_with_sha256		1182
+sm9kdf_with_sm3		1183
+sm9kdf_with_sha256		1184
+zuc		1185
+zuc_128eea3		1186
+zuc_128eia3		1187
+bwips		1188
+wapi_crypto		1189
+wapi_ec		1190
+wapi_ecdsa192_sha256		1191
+wapip192v1		1192
+kx_sm2		1193
+kx_sm2dhe		1194
+kx_sm2_psk		1195
+kx_sm9		1196
+kx_sm9dhe		1197
+auth_sm2		1198
+auth_sm9		1199
+GmSSL		1200
+cpk		1201
+cpk_map		1202
+cpk_map_sha1		1203
+cpk_map_sha256		1204
+cpk_map_sm3		1205
+cpk_map_sha384		1206
+cpk_map_sha512		1207
+paillier		1208
--- a/crypto/objects/objects.txt
+++ b/crypto/objects/objects.txt
@@ -1480,11 +1480,6 @@ id-pkinit 5                     : pkInitKDC             : Signing KDC Response
                            : KxPSK        : kx-psk
                            : KxSRP        : kx-srp
                            : KxGOST       : kx-gost
-                            : KxSM2        : kx-sm2
-                            : KxSM2DHE     : kx-sm2dhe
-                            : KxSM2-PSK    : kx-sm2-psk
-                            : KxSM9        : kx-sm9
-                            : KxSM9DHE     : kx-sm9dhe

 # NIDs for cipher authentication
                            : AuthRSA      : auth-rsa
@@ -1495,10 +1490,8 @@ id-pkinit 5                     : pkInitKDC             : Signing KDC Response
                            : AuthGOST12   : auth-gost12
                            : AuthSRP      : auth-srp
                            : AuthNULL     : auth-null
-                            : AuthSM2      : auth-sm2
-                            : AuthSM9      : auth-sm9

-# GmSSL SECG ECIES OID
+# SECG ECIES OID
 secg-scheme 7		: ecies-recommendedParameters
 secg-scheme 8		: ecies-specifiedParameters
 secg-scheme 17 0	: x9-63-kdf
@@ -1518,8 +1511,6 @@ secg-scheme 23		: hmac-half-ecies
 secg-scheme 24 0	: cmac-aes128-ecies
 secg-scheme 24 1	: cmac-aes192-ecies
 secg-scheme 24 2	: cmac-aes256-ecies
-
-
 ecies-specifiedParameters 1	: ecies-with-x9-63-sha1-xor-hmac
 ecies-specifiedParameters 2	: ecies-with-x9-63-sha256-xor-hmac
 ecies-specifiedParameters 3	: ecies-with-x9-63-sha512-xor-hmac
@@ -1538,18 +1529,27 @@ ecies-specifiedParameters 15	: ecies-with-x9-63-sha512-aes256-cbc-cmac
 ecies-specifiedParameters 16	: ecies-with-x9-63-sha256-aes128-ctr-cmac
 ecies-specifiedParameters 17	: ecies-with-x9-63-sha512-aes256-ctr-cmac

+# RFC 5091 IBCS #1
+!Alias ibcs ISO-US 1 114334 1
+ibcs 1		: ibcs1
+ibcs1 1 1	: type1curve
+ibcs1 2 1	: bfibe
+ibcs1 2 2	: bb1ibe

-# GmSSL SM OID
+# GM/T
 member-body 156		: ISO-CN		: ISO CN Member Body
 ISO-CN 10197		: oscca
 oscca 1			: sm-scheme

-sm-scheme 101 1		: SM6-ECB		: sm6-ecb
-sm-scheme 101 2		: SM6-CBC		: sm6-cbc
-!Cname sm6-ofb128
-sm-scheme 101 3		: SM6-OFB		: sm6-ofb
-!Cname sm6-cfb128
-sm-scheme 101 4		: SM6-CFB		: sm6-cfb
+sm-scheme 103 1		: SSF33-ECB		: ssf33-ecb
+sm-scheme 103 2		: SSF33-CBC		: ssf33-cbc
+!Cname ssf33-ofb128
+sm-scheme 103 3		: SSF33-OFB		: ssf33-ofb
+!Cname ssf33-cfb128
+sm-scheme 103 4		: SSF33-CFB		: ssf33-cfb
+sm-scheme 103 5		: SSF33-CFB1		: ssf33-cfb1
+sm-scheme 103 6		: SSF33-CFB8		: ssf33-cfb8
+sm-scheme 103 7		: SSF33-CBC-MAC		: ssf33-cbc-mac

 sm-scheme 102 1		: SM1-ECB		: sm1-ecb
 sm-scheme 102 2		: SM1-CBC		: sm1-cbc
@@ -1560,15 +1560,43 @@ sm-scheme 102 4		: SM1-CFB		: sm1-cfb
 sm-scheme 102 5		: SM1-CFB1		: sm1-cfb1
 sm-scheme 102 6		: SM1-CFB8		: sm1-cfb8

-sm-scheme 103 1		: SSF33-ECB		: ssf33-ecb
-sm-scheme 103 2		: SSF33-CBC		: ssf33-cbc
-!Cname ssf33-ofb128
-sm-scheme 103 3		: SSF33-OFB		: ssf33-ofb
-!Cname ssf33-cfb128
-sm-scheme 103 4		: SSF33-CFB		: ssf33-cfb
-sm-scheme 103 5		: SSF33-CFB1		: ssf33-cfb1
-sm-scheme 103 6		: SSF33-CFB8		: ssf33-cfb8

+# SM2 OIDs
+sm-scheme 301		: sm2p256v1
+sm-scheme 301 1		: sm2sign
+sm-scheme 301 2		: sm2exchange
+sm-scheme 301 3		: sm2encrypt
+
+sm-scheme 501		: SM2Sign-with-SM3	: sm2sign-with-sm3
+sm-scheme 502		: SM2Sign-with-SHA1 	: sm2sign-with-sha1
+sm-scheme 503		: SM2Sign-with-SHA256	: sm2sign-with-sha256
+sm-scheme 504		: SM2Sign-with-SHA511	: sm2sign-with-sha512
+sm-scheme 505		: SM2Sign-with-SHA224	: sm2sign-with-sha224
+sm-scheme 506		: SM2Sign-with-SHA384	: sm2sign-with-sha384
+sm-scheme 507		: SM2Sign-with-RMD160	: sm2sign-with-rmd160
+sm-scheme 520		: SM2Sign-with-Whirlpool : sm2sign-with-whirlpool
+sm-scheme 521		: SM2Sign-with-Blake2b512 : sm2sign-with-blake2b512
+sm-scheme 522		: SM2Sign-with-Blake2s256 : sm2sign-with-blake2s256
+
+sm2encrypt 1		: sm2encrypt-recommendedParameters
+sm2encrypt 2		: sm2encrypt-specifiedParameters
+sm2encrypt 2 1		: sm2encrypt-with-sm3
+sm2encrypt 2 2		: sm2encrypt-with-sha1
+sm2encrypt 2 3		: sm2encrypt-with-sha224
+sm2encrypt 2 4		: sm2encrypt-with-sha256
+sm2encrypt 2 5		: sm2encrypt-with-sha384
+sm2encrypt 2 6		: sm2encrypt-with-sha512
+sm2encrypt 2 7		: sm2encrypt-with-rmd160
+sm2encrypt 2 8		: sm2encrypt-with-whirlpool
+sm2encrypt 2 9		: sm2encrypt-with-blake2b512
+sm2encrypt 2 10		: sm2encrypt-with-blake2s256
+sm2encrypt 2 11		: sm2encrypt-with-md5
+
+# SM3
+sm-scheme 401		: SM3			: sm3
+sm-scheme 401 2		: HMAC-SM3		: hmac-sm3
+
+# SM4
 sm-scheme 104 1		: SMS4-ECB		: sms4-ecb
 sm-scheme 104 2		: SMS4-CBC		: sms4-cbc
 !Cname sms4-ofb128
@@ -1585,98 +1613,41 @@ sm-scheme 104 11	: SMS4-WRAP		: sms4-wrap
 sm-scheme 104 12	: SMS4-WRAP-PAD		: sms4-wrap-pad
 sm-scheme 104 100	: SMS4-OCB		: sms4-ocb

+# SM5/6/7/8
+sm-scheme 201		: SM5			: sm5
+sm-scheme 101 1		: SM6-ECB		: sm6-ecb
+sm-scheme 101 2		: SM6-CBC		: sm6-cbc
+!Cname sm6-ofb128
+sm-scheme 101 3		: SM6-OFB		: sm6-ofb
+!Cname sm6-cfb128
+sm-scheme 101 4		: SM6-CFB		: sm6-cfb
 !Alias sm7 sm-scheme 105
-
 !Alias sm8 sm-scheme 106

-sm-scheme 201		: SM5			: sm5
-
-sm-scheme 301		: sm2p256v1
-sm-scheme 301 1		: sm2sign
-sm-scheme 301 2		: sm2exchange
-sm-scheme 301 3		: sm2encrypt
-#sm-scheme 301 101	: wapip192v1
-
-sm2encrypt 1		: sm2encrypt-recommendedParameters
-sm2encrypt 2		: sm2encrypt-specifiedParameters
-sm2encrypt 2 1		: sm2encrypt-with-sm3
-sm2encrypt 2 2		: sm2encrypt-with-sha1
-sm2encrypt 2 3		: sm2encrypt-with-sha224
-sm2encrypt 2 4		: sm2encrypt-with-sha256
-sm2encrypt 2 5		: sm2encrypt-with-sha384
-sm2encrypt 2 6		: sm2encrypt-with-sha512
-sm2encrypt 2 7		: sm2encrypt-with-rmd160
-sm2encrypt 2 8		: sm2encrypt-with-whirlpool
-sm2encrypt 2 9		: sm2encrypt-with-blake2b512
-sm2encrypt 2 10		: sm2encrypt-with-blake2s256
-sm2encrypt 2 11		: sm2encrypt-with-md5
-
+# SM9
 sm-scheme 302		: id-sm9PublicKey
 sm-scheme 302 1		: sm9sign
-sm9sign 1		: sm9sign-with-sm3
-sm9sign 2		: sm9sign-with-sha256
 sm-scheme 302 2		: sm9keyagreement
 sm-scheme 302 3		: sm9encrypt
+sm-scheme 302 4		: sm9hash1
+sm-scheme 302 5		: sm9kdf
+sm-scheme 302 6		: id-sm9MasterSecret
+sm-scheme 302 6	1 	: sm9bn256v1
+sm9sign 1		: sm9sign-with-sm3
+sm9sign 2		: sm9sign-with-sha256
 sm9encrypt 1		: sm9encrypt-with-sm3-xor
 sm9encrypt 2		: sm9encrypt-with-sm3-sms4-cbc
 sm9encrypt 3		: sm9encrypt-with-sm3-sms4-ctr
-sm-scheme 302 4		: sm9hash1
-sm-scheme 302 5		: sm9kdf
 sm9hash1 1		: sm9hash1-with-sm3
 sm9hash1 2		: sm9hash1-with-sha256
 sm9kdf 1		: sm9kdf-with-sm3
 sm9kdf 2		: sm9kdf-with-sha256

-sm-scheme 401		: SM3			: sm3
-sm-scheme 401 2		: HMAC-SM3		: hmac-sm3
-
-sm-scheme 501		: SM2Sign-with-SM3	: sm2sign-with-sm3
-sm-scheme 502		: SM2Sign-with-SHA1 	: sm2sign-with-sha1
-sm-scheme 503		: SM2Sign-with-SHA256	: sm2sign-with-sha256
-sm-scheme 504		: SM2Sign-with-SHA511	: sm2sign-with-sha512
-sm-scheme 505		: SM2Sign-with-SHA224	: sm2sign-with-sha224
-sm-scheme 506		: SM2Sign-with-SHA384	: sm2sign-with-sha384
-sm-scheme 507		: SM2Sign-with-RMD160	: sm2sign-with-rmd160
-sm-scheme 520		: SM2Sign-with-Whirlpool : sm2sign-with-whirlpool
-sm-scheme 521		: SM2Sign-with-Blake2b512 : sm2sign-with-blake2b512
-sm-scheme 522		: SM2Sign-with-Blake2s256 : sm2sign-with-blake2s256
-
-# GmSSL ZUC OID
+# ZUC
 sm-scheme 800	: ZUC	: zuc
 zuc 1		: zuc-128eea3
 zuc 2		: zuc-128eia3

-# IBCS1
-!Alias ibcs1 ISO-US 1 114334 1
-ibcs1 2 1		: bfibe
-ibcs1 2 2		: bb1
-# 1 tate, 2 weil, 3 ate, 4 r-ate
-ibcs1 1 1		: type1curve
-ibcs1 1 2		: type2curve
-ibcs1 1 3		: type3curve
-ibcs1 1 4		: type4curve
-
-ibcs1 3 1		: tate-pairing
-ibcs1 3 2		: weil-pairing
-ibcs1 3 3		: ate-pairing
-ibcs1 3 4		: r-ate-pairing
-
-# GmSSL
-
-Enterprises 49549	: gmssl		: GmSSL
-
-GmSSL 1			: CPK		: cpk
-
-# map algorithms
-cpk 1			: cpk-map
-cpk-map 1		: cpk-map-sha1
-cpk-map 2		: cpk-map-sha256
-cpk-map 3		: cpk-map-sm3
-cpk-map 4		: cpk-map-sha384
-cpk-map 5		: cpk-map-sha512
-
-GmSSL 21		: paillier
-
 # WAPI (GB 15629.11-2003-XG1-2006)
 ISO-CN 11235	: bwips
 bwips 1		: wapi-crypto
@@ -1684,5 +1655,30 @@ wapi-crypto 1		: wapi-ec
 wapi-ec 1	: wapi-ecdsa192-sha256
 wapi-ec 2 1	: wapip192v1

-# SM9 curve
-GmSSL 9 1		: sm9bn256v1
+# NIDs for cipher key exchange
+                            : KxSM2        : kx-sm2
+                            : KxSM2DHE     : kx-sm2dhe
+                            : KxSM2-PSK    : kx-sm2-psk
+                            : KxSM9        : kx-sm9
+                            : KxSM9DHE     : kx-sm9dhe
+
+# NIDs for cipher authentication
+                            : AuthSM2      : auth-sm2
+                            : AuthSM9      : auth-sm9
+
+
+# gmssl.org
+Enterprises 49549	: gmssl		: GmSSL
+
+# CPK
+GmSSL 1			: CPK		: cpk
+cpk 1			: cpk-map
+cpk-map 1		: cpk-map-sha1
+cpk-map 2		: cpk-map-sha256
+cpk-map 3		: cpk-map-sm3
+cpk-map 4		: cpk-map-sha384
+cpk-map 5		: cpk-map-sha512
+
+# paillier
+GmSSL 21		: paillier
+
--- a/crypto/paillier/build.info
+++ b/crypto/paillier/build.info
@@ -1,2 +1,2 @@
 LIBS=../../libcrypto
-SOURCE[../../libcrypto]=pai_lib.c pai_err.c pai_asn1.c
+SOURCE[../../libcrypto]=pai_lib.c pai_err.c pai_asn1.c pai_ameth.c
--- a/crypto/paillier/pai_ameth.c
+++ b/crypto/paillier/pai_ameth.c
@@ -48,11 +48,16 @@
 */

 #include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
 #include <openssl/asn1t.h>
+#include <openssl/objects.h>
 #include <openssl/paillier.h>
 #include "internal/cryptlib.h"
 #include "internal/asn1_int.h"
 #include "internal/evp_int.h"
+#include "pai_lcl.h"


 static int paillier_pub_encode(X509_PUBKEY *pubkey, const EVP_PKEY *pkey)
@@ -60,7 +65,7 @@ static int paillier_pub_encode(X509_PUBKEY *pubkey, const EVP_PKEY *pkey)
 	unsigned char *penc = NULL;
 	int penclen;

-	if ((penclen = i2d_PAILLIER_PUBLIC_KEY(pkey->pkey.paillier, &penc)) < = 0) {
+	if ((penclen = i2d_PaillierPublicKey(pkey->pkey.paillier, &penc)) <= 0) {
 		return 0;
 	}
 	if (X509_PUBKEY_set0_param(pubkey, OBJ_nid2obj(EVP_PKEY_PAILLIER),
@@ -81,8 +86,7 @@ static int paillier_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
 	if (!X509_PUBKEY_get0_param(NULL, &cp, &len, NULL, pubkey)) {
 		return 0;
 	}
-
-	if (!(paillier = d2i_PAILLIER_PUBLIC_KEY(NULL, &cp, len))) {
+	if (!(paillier = d2i_PaillierPublicKey(NULL, &cp, len))) {
 		PAILLIERerr(PAILLIER_F_PAILLIER_PUB_DECODE, ERR_R_PAILLIER_LIB);
 		return 0;
 	}
@@ -93,7 +97,131 @@ static int paillier_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)

 static int paillier_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 {
-	return -1;
+	if (BN_cmp(a->pkey.paillier->n, b->pkey.paillier->n) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+static int do_paillier_print(BIO *bp, const PAILLIER *x, int off, int priv)
+{
+	char *str;
+	int ret = 0;
+	if (!BIO_indent(bp, off, 128))
+		goto end;
+
+	if (priv && x->lambda) {
+		if (BIO_printf(bp, "Private-Key: (%d bit)\n", x->bits) <= 0)
+			goto end;
+		str = "modulus";
+	} else {
+		if (BIO_printf(bp, "Public-Key: (%d bit)\n", x->bits) <= 0)
+			goto end;
+		str = "Modulus";
+	}
+
+	if (!ASN1_bn_print(bp, str, x->n, NULL, off))
+		goto end;
+	if (priv) {
+		if (!ASN1_bn_print(bp, "lambda:", x->lambda, NULL, off))
+			goto end;
+		if (!ASN1_bn_print(bp, "x:", x->x, NULL, off))
+			goto end;
+	}
+	ret = 1;
+
+end:
+	return ret;
+}
+
+static int paillier_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_paillier_print(bp, pkey->pkey.paillier, indent, 0);
+}
+
+static int paillier_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_paillier_print(bp, pkey->pkey.paillier, indent, 1);
+}
+
+static int paillier_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
+{
+	const unsigned char *p;
+	int pklen;
+	PAILLIER *paillier;
+
+	if (!PKCS8_pkey_get0(NULL, &p, &pklen, NULL, p8))
+		return 0;
+	if (!(paillier = d2i_PaillierPrivateKey(NULL, &p, pklen))) {
+		PAILLIERerr(PAILLIER_F_PAILLIER_PRIV_DECODE, ERR_R_PAILLIER_LIB);
+		return 0;
+	}
+	EVP_PKEY_assign_PAILLIER(pkey, paillier);
+	return 1;
+}
+
+static int paillier_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+{
+	unsigned char *rk = NULL;
+	int rklen;
+
+	if ((rklen = i2d_PaillierPrivateKey(pkey->pkey.paillier, &rk)) <= 0) {
+		PAILLIERerr(PAILLIER_F_PAILLIER_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_paillier), 0, V_ASN1_NULL, NULL,
+		rk, rklen)) {
+		PAILLIERerr(PAILLIER_F_PAILLIER_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	return 1;
+}
+
+static int int_paillier_size(const EVP_PKEY *pkey)
+{
+	return PAILLIER_size(pkey->pkey.paillier);
+}
+
+static int paillier_bits(const EVP_PKEY *pkey)
+{
+	return pkey->pkey.paillier->bits;
+}
+
+static int paillier_security_bits(const EVP_PKEY *pkey)
+{
+	return PAILLIER_security_bits(pkey->pkey.paillier);
+}
+
+static void int_paillier_free(EVP_PKEY *pkey)
+{
+	PAILLIER_free(pkey->pkey.paillier);
+}
+
+static int paillier_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
+{
+	return -2;
+}
+
+static int old_paillier_priv_decode(EVP_PKEY *pkey,
+	const unsigned char **pder, int derlen)
+{
+	PAILLIER *pai;
+	if ((pai = d2i_PaillierPrivateKey(NULL, pder, derlen)) == NULL) {
+		PAILLIERerr(PAILLIER_F_OLD_PAILLIER_PRIV_DECODE,
+			PAILLIER_R_DECODE_ERROR);
+		return 0;
+	}
+	EVP_PKEY_assign_PAILLIER(pkey, pai);
+	return 1;
+}
+
+static int old_paillier_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
+	return i2d_PaillierPrivateKey(pkey->pkey.paillier, pder);
 }

 const EVP_PKEY_ASN1_METHOD paillier_asn1_meth = {
--- a/crypto/paillier/pai_err.c
+++ b/crypto/paillier/pai_err.c
@@ -1,6 +1,6 @@
 /*
 * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
@@ -19,6 +19,8 @@
 # define ERR_REASON(reason) ERR_PACK(ERR_LIB_PAILLIER,0,reason)

 static ERR_STRING_DATA PAILLIER_str_functs[] = {
+    {ERR_FUNC(PAILLIER_F_OLD_PAILLIER_PRIV_DECODE),
+     "old_paillier_priv_decode"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_CHECK_KEY), "PAILLIER_check_key"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_CIPHERTEXT_ADD), "PAILLIER_ciphertext_add"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_CIPHERTEXT_SCALAR_MUL),
@@ -27,6 +29,8 @@ static ERR_STRING_DATA PAILLIER_str_functs[] = {
    {ERR_FUNC(PAILLIER_F_PAILLIER_ENCRYPT), "PAILLIER_encrypt"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_GENERATE_KEY), "PAILLIER_generate_key"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_NEW), "PAILLIER_new"},
+    {ERR_FUNC(PAILLIER_F_PAILLIER_PRIV_DECODE), "paillier_priv_decode"},
+    {ERR_FUNC(PAILLIER_F_PAILLIER_PRIV_ENCODE), "paillier_priv_encode"},
    {ERR_FUNC(PAILLIER_F_PAILLIER_PUB_DECODE), "paillier_pub_decode"},
    {ERR_FUNC(PAILLIER_F_PKEY_PAILLIER_DECRYPT), "pkey_paillier_decrypt"},
    {ERR_FUNC(PAILLIER_F_PKEY_PAILLIER_ENCRYPT), "pkey_paillier_encrypt"},
@@ -35,6 +39,7 @@ static ERR_STRING_DATA PAILLIER_str_functs[] = {

 static ERR_STRING_DATA PAILLIER_str_reasons[] = {
    {ERR_REASON(PAILLIER_R_BUFFER_TOO_SMALL), "buffer too small"},
+    {ERR_REASON(PAILLIER_R_DECODE_ERROR), "decode error"},
    {ERR_REASON(PAILLIER_R_GENERATE_PRIME_FAILED), "generate prime failed"},
    {ERR_REASON(PAILLIER_R_INVALID_PLAINTEXT), "invalid plaintext"},
    {ERR_REASON(PAILLIER_R_MALLOC_FAILED), "malloc failed"},
--- a/crypto/paillier/pai_lib.c
+++ b/crypto/paillier/pai_lib.c
@@ -45,7 +45,6 @@
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
- *
 */

 #include <stdio.h>
@@ -70,7 +69,6 @@ PAILLIER *PAILLIER_new(void)

 void PAILLIER_free(PAILLIER *key)
 {
-
 	if (key) {
 		BN_free(key->n);
 		BN_free(key->lambda);
@@ -81,6 +79,16 @@ void PAILLIER_free(PAILLIER *key)
 	OPENSSL_clear_free(key, sizeof(*key));
 }

+int PAILLIER_size(const PAILLIER *key)
+{
+	return BN_num_bits(key->n)/8;
+}
+
+int PAILLIER_security_bits(const PAILLIER *key)
+{
+	return BN_security_bits(BN_num_bits(key->n)/2, -1);
+}
+
 int PAILLIER_generate_key(PAILLIER *key, int bits)
 {
 	int ret = 0;
--- a/crypto/paillier/pai_pmeth.c
+++ b/crypto/paillier/pai_pmeth.c
@@ -70,9 +70,6 @@ static void pkey_paillier_cleanup(EVP_PKEY_CTX *ctx)
 {
 }

-//FIXME keygen
-
-
 static int pkey_paillier_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen,
 	const unsigned char *in, size_t inlen)
 {
--- a/crypto/pem/pem3.c
+++ b/crypto/pem/pem3.c
@@ -56,16 +56,13 @@
 # include <openssl/pkcs7.h>
 #endif
 #include <openssl/pem.h>
-#include <openssl/pem3.h>
 #ifndef OPENSSL_NO_PAILLIER
 # include <openssl/paillier.h>
 #endif
+#ifndef OPENSSL_NO_SM9
+# include <openssl/sm9.h>
+#endif

-/*
-extern PAILLIER *EVP_PKEY_get1_PAILLIER(EVP_PKEY *key);
-extern int i2d_PAILLIER_PUBKEY(PAILLIER *a, unsigned char **p);
-extern PAILLIER *d2i_PAILLIER_PUBKEY(PAILLIER **a, const unsigned char **p, long len);
-*/

 #ifndef OPENSSL_NO_PAILLIER
 static PAILLIER *pkey_get_paillier(EVP_PKEY *key, PAILLIER **paillier)
@@ -109,4 +106,87 @@ IMPLEMENT_PEM_rw_const(PaillierPublicKey, PAILLIER, PEM_STRING_PAILLIER_PUBLIC,
 	PaillierPublicKey)
 IMPLEMENT_PEM_rw(PAILLIER_PUBKEY, PAILLIER, PEM_STRING_PUBLIC, PAILLIER_PUBKEY)

-#endif
+#endif /* OPENSSL_NO_PAILLIER */
+
+#ifndef OPENSSL_NO_SM9
+static SM9_MASTER_KEY *pkey_get_sm9_master(EVP_PKEY *key, SM9_MASTER_KEY **sm9_master)
+{
+	SM9_MASTER_KEY *rtmp;
+	if (!key)
+		return NULL;
+	rtmp = EVP_PKEY_get1_SM9_MASTER(key);
+	EVP_PKEY_free(key);
+	if (!rtmp)
+		return NULL;
+	if (sm9_master) {
+		SM9_MASTER_KEY_free(*sm9_master);
+		*sm9_master = rtmp;
+	}
+	return rtmp;
+}
+
+SM9_MASTER_KEY *PEM_read_bio_SM9MasterSecret(BIO *bp, SM9_MASTER_KEY **sm9_master,
+	pem_password_cb *cb, void *u)
+{
+	EVP_PKEY *pktmp;
+	pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+	return pkey_get_sm9_master(pktmp, sm9_master);
+}
+
+static SM9_KEY *pkey_get_sm9(EVP_PKEY *key, SM9_KEY **sm9)
+{
+	SM9_KEY *rtmp;
+	if (!key)
+		return NULL;
+	rtmp = EVP_PKEY_get1_SM9(key);
+	EVP_PKEY_free(key);
+	if (!rtmp)
+		return NULL;
+	if (sm9) {
+		SM9_KEY_free(*sm9);
+		*sm9 = rtmp;
+	}
+	return rtmp;
+}
+
+SM9_KEY *PEM_read_bio_SM9PrivateKey(BIO *bp, SM9_KEY **sm9,
+	pem_password_cb *cb, void *u)
+{
+	EVP_PKEY *pktmp;
+	pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+	return pkey_get_sm9(pktmp, sm9);
+}
+
+# ifndef OPENSSL_NO_STDIO
+SM9_MASTER_KEY *PEM_read_SM9MasterSecret(FILE *fp, SM9_MASTER_KEY **sm9_master,
+	pem_password_cb *cb, void *u)
+{
+	EVP_PKEY *pktmp;
+	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+	return pkey_get_sm9_master(pktmp, sm9_master);
+}
+
+SM9_KEY *PEM_read_SM9PrivateKey(FILE *fp, SM9_KEY **sm9,
+	pem_password_cb *cb, void *u)
+{
+	EVP_PKEY *pktmp;
+	pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+	return pkey_get_sm9(pktmp, sm9);
+}
+# endif
+
+IMPLEMENT_PEM_write_cb_const(SM9MasterSecret, SM9_MASTER_KEY,
+	PEM_STRING_SM9_MASTER, SM9MasterSecret)
+IMPLEMENT_PEM_rw_const(SM9PublicParameters, SM9_MASTER_KEY,
+	PEM_STRING_SM9_MASTER_PUBLIC, SM9PublicParameters)
+IMPLEMENT_PEM_rw(SM9_MASTER_PUBKEY, SM9_MASTER_KEY,
+	PEM_STRING_PUBLIC, SM9_MASTER_PUBKEY)
+
+IMPLEMENT_PEM_write_cb_const(SM9PrivateKey, SM9_KEY,
+	PEM_STRING_SM9, SM9PrivateKey)
+IMPLEMENT_PEM_rw_const(SM9PublicKey, SM9_KEY,
+	PEM_STRING_SM9_PUBLIC, SM9PublicKey)
+IMPLEMENT_PEM_rw(SM9_PUBKEY, SM9_KEY,
+	PEM_STRING_PUBLIC, SM9_PUBKEY)
+
+#endif /* OPENSSL_NO_SM9 */
--- a/crypto/sm9/build.info
+++ b/crypto/sm9/build.info
@@ -1,3 +1,4 @@
 LIBS=../../libcrypto
 SOURCE[../../libcrypto]=sm9_lib.c sm9_err.c sm9_asn1.c sm9_params.c \
-	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_exch.c sm9_rate.c
+	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_exch.c sm9_rate.c \
+	sm9_ameth.c
--- a/crypto/sm9/sm9_ameth.c
+++ b/crypto/sm9/sm9_ameth.c
@@ -0,0 +1,411 @@
+/* ====================================================================
+ * Copyright (c) 2015 - 2018 The GmSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the GmSSL Project.
+ *    (http://gmssl.org/)"
+ *
+ * 4. The name "GmSSL Project" must not be used to endorse or promote
+ *    products derived from this software without prior written
+ *    permission. For written permission, please contact
+ *    guanzhi1980@gmail.com.
+ *
+ * 5. Products derived from this software may not be called "GmSSL"
+ *    nor may "GmSSL" appear in their names without prior written
+ *    permission of the GmSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the GmSSL Project
+ *    (http://gmssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE GmSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <stdio.h>
+#include <openssl/sm9.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/asn1t.h>
+#include <openssl/objects.h>
+#include "internal/cryptlib.h"
+#include "internal/asn1_int.h"
+#include "internal/evp_int.h"
+#include "sm9_lcl.h"
+
+
+static int sm9_params_encode(X509_PUBKEY *pubkey, const EVP_PKEY *pkey)
+{
+	unsigned char *penc = NULL;
+	int penclen;
+
+	if ((penclen = i2d_SM9PublicParameters(pkey->pkey.sm9_master, &penc)) <= 0) {
+		return 0;
+	}
+	printf("penclen = %d\n", penclen);
+	printf("penc == NULL: %d\n", penc == NULL);
+	printf("%lu\n", OBJ_nid2obj(EVP_PKEY_SM9_MASTER));
+
+	OPENSSL_assert(pubkey);
+
+	if (X509_PUBKEY_set0_param(pubkey, OBJ_nid2obj(EVP_PKEY_SM9_MASTER),
+		V_ASN1_NULL, NULL, penc, penclen)) {
+		return 1;
+	}
+
+	OPENSSL_free(penc);
+	return 0;
+}
+
+static int sm9_params_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+{
+	const unsigned char *cp;
+	int len;
+	SM9PublicParameters *sm9_params = NULL;
+
+	if (!X509_PUBKEY_get0_param(NULL, &cp, &len, NULL, pubkey)) {
+		return 0;
+	}
+	if (!(sm9_params = d2i_SM9PublicParameters(NULL, &cp, len))) {
+		SM9err(SM9_F_SM9_PARAMS_DECODE, ERR_R_SM9_LIB);
+		return 0;
+	}
+
+	EVP_PKEY_assign_SM9PublicParameters(pkey, sm9_params);
+	return 1;
+}
+
+static int sm9_params_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+{
+	/*
+	if (OBJ_cmp(a->pkey.sm9_master->pairing, b->pkey.sm9_master->pairing) != 0
+		|| OBJ_cmp(a->pkey.sm9_master->scheme, b->pkey.sm9_master->scheme) != 0
+		|| OBJ_cmp(a->pkey.sm9_master->hash1, b->pkey.sm9_master->hash1) != 0
+		|| ASN1_OCTET_STRING_cmp(a->pkey.sm9_master->pointPpub,
+			b->pkey.sm9_master->pointPpub) != 0) {
+		return 0;
+	}
+	*/
+	return 1;
+}
+
+static int do_sm9_master_print(BIO *bp, const SM9MasterSecret *x, int off, int priv)
+{
+	return -2;
+}
+
+static int sm9_params_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_sm9_master_print(bp, pkey->pkey.sm9_master, indent, 0);
+}
+
+static int sm9_master_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_sm9_master_print(bp, pkey->pkey.sm9_master, indent, 1);
+}
+
+static int sm9_master_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
+{
+	const unsigned char *p;
+	int pklen;
+	SM9MasterSecret *sm9_master;
+
+	if (!PKCS8_pkey_get0(NULL, &p, &pklen, NULL, p8))
+		return 0;
+	if (!(sm9_master = d2i_SM9MasterSecret(NULL, &p, pklen))) {
+		SM9err(SM9_F_SM9_MASTER_DECODE, ERR_R_SM9_LIB);
+		return 0;
+	}
+	EVP_PKEY_assign_SM9MasterSecret(pkey, sm9_master);
+	return 1;
+}
+
+static int sm9_master_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+{
+	unsigned char *rk = NULL;
+	int rklen;
+fprintf(stderr, "%s %d: %s\n", __FILE__, __LINE__, __FUNCTION__);
+
+	if ((rklen = i2d_SM9MasterSecret(pkey->pkey.sm9_master, &rk)) <= 0) {
+		SM9err(SM9_F_SM9_MASTER_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(EVP_PKEY_SM9_MASTER), 0,
+		V_ASN1_NULL, NULL, rk, rklen)) {
+		SM9err(SM9_F_SM9_MASTER_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	return 1;
+}
+
+static int int_sm9_size(const EVP_PKEY *pkey)
+{
+	return 32 * 12;
+}
+
+static int sm9_bits(const EVP_PKEY *pkey)
+{
+	return 256 * 12;
+}
+
+static int sm9_security_bits(const EVP_PKEY *pkey)
+{
+	return 256/2;
+}
+
+static void int_sm9_master_free(EVP_PKEY *pkey)
+{
+	SM9MasterSecret_free(pkey->pkey.sm9_master);
+}
+
+static int sm9_master_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
+{
+	return -2;
+}
+
+static int old_sm9_master_decode(EVP_PKEY *pkey,
+	const unsigned char **pder, int derlen)
+{
+	SM9MasterSecret *sm9_master;
+	if ((sm9_master = d2i_SM9MasterSecret(NULL, pder, derlen)) == NULL) {
+		SM9err(SM9_F_OLD_SM9_MASTER_DECODE, SM9_R_DECODE_ERROR);
+		return 0;
+	}
+	EVP_PKEY_assign_SM9MasterSecret(pkey, sm9_master);
+	return 1;
+}
+
+static int old_sm9_master_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
+fprintf(stderr, "%s %d: %s\n", __FILE__, __LINE__, __FUNCTION__);
+	return i2d_SM9MasterSecret(pkey->pkey.sm9_master, pder);
+}
+
+const EVP_PKEY_ASN1_METHOD sm9_master_asn1_meth = {
+	EVP_PKEY_SM9_MASTER,	/* pkey_id */
+	EVP_PKEY_SM9_MASTER,	/* pkey_base_id */
+	0,			/* pkey_flags */
+	"SM9 MASTER",		/* pem_str */
+	"GmSSL SM9 algorithm",	/* info */
+	sm9_params_decode,	/* pub_decode */
+	sm9_params_encode,	/* pub_encode */
+	sm9_params_cmp,		/* pub_cmp */
+	sm9_params_print,	/* pub_print */
+	sm9_master_decode,	/* priv_decode */
+	sm9_master_encode,	/* priv_encode */
+	sm9_master_print,	/* priv_print */
+	int_sm9_size,		/* pkey_size */
+	sm9_bits,		/* pkey_bits */
+	sm9_security_bits,	/* pkey_security_bits */
+	NULL,			/* param_decode */
+	NULL,			/* param_encode */
+	NULL,			/* param_missing */
+	NULL,			/* param_copy */
+	NULL,			/* param_cmp */
+	NULL,			/* param_print */
+	NULL,			/* sig_print */
+	int_sm9_master_free,	/* pkey_free */
+	sm9_master_pkey_ctrl,	/* pkey_ctrl */
+	old_sm9_master_decode,	/* old_priv_decode */
+	old_sm9_master_encode,	/* old_priv_encode */
+	NULL,			/* item_verify */
+	NULL,			/* item_sign */
+};
+
+
+static int sm9_pub_encode(X509_PUBKEY *pubkey, const EVP_PKEY *pkey)
+{
+	unsigned char *penc = NULL;
+	int penclen;
+
+	if ((penclen = i2d_SM9PublicKey(pkey->pkey.sm9, &penc)) <= 0) {
+		return 0;
+	}
+	if (X509_PUBKEY_set0_param(pubkey, OBJ_nid2obj(EVP_PKEY_SM9),
+				   V_ASN1_NULL, NULL, penc, penclen)) {
+		return 1;
+	}
+
+	OPENSSL_free(penc);
+	return 0;
+}
+
+static int sm9_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+{
+	const unsigned char *cp;
+	int len;
+	SM9PublicKey *sm9 = NULL;
+
+	if (!X509_PUBKEY_get0_param(NULL, &cp, &len, NULL, pubkey)) {
+		return 0;
+	}
+	if (!(sm9 = d2i_SM9PublicKey(NULL, &cp, len))) {
+		SM9err(SM9_F_SM9_PUB_DECODE, ERR_R_SM9_LIB);
+		return 0;
+	}
+
+	EVP_PKEY_assign_SM9PublicKey(pkey, sm9);
+	return 1;
+}
+
+static int sm9_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+{
+	const SM9PublicKey *ax = a->pkey.sm9;
+	const SM9PublicKey *bx = b->pkey.sm9;
+	if (OBJ_cmp(ax->pairing, bx->pairing)
+		|| OBJ_cmp(ax->scheme, bx->scheme)
+		|| OBJ_cmp(ax->hash1, bx->hash1)
+		/* FIXME: decode point then compare to support point compression */
+		|| ASN1_OCTET_STRING_cmp(ax->pointPpub, bx->pointPpub)
+		|| ASN1_OCTET_STRING_cmp(ax->identity, bx->identity)
+		|| ASN1_OCTET_STRING_cmp(ax->publicPoint, bx->publicPoint)) {
+		return 0;
+	}
+	return 1;
+}
+
+static int do_sm9_print(BIO *bp, const SM9PrivateKey *x, int off, int priv)
+{
+	return -2;
+}
+
+static int sm9_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_sm9_print(bp, pkey->pkey.sm9, indent, 0);
+}
+
+static int sm9_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+	ASN1_PCTX *ctx)
+{
+	return do_sm9_print(bp, pkey->pkey.sm9, indent, 1);
+}
+
+static int sm9_priv_decode(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8)
+{
+	const unsigned char *p;
+	int pklen;
+	SM9PrivateKey *sm9;
+
+	if (!PKCS8_pkey_get0(NULL, &p, &pklen, NULL, p8))
+		return 0;
+	if (!(sm9 = d2i_SM9PrivateKey(NULL, &p, pklen))) {
+		SM9err(SM9_F_SM9_PRIV_DECODE, ERR_R_SM9_LIB);
+		return 0;
+	}
+	EVP_PKEY_assign_SM9PrivateKey(pkey, sm9);
+	return 1;
+}
+
+static int sm9_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+{
+	unsigned char *rk = NULL;
+	int rklen;
+
+/*
+fprintf(stderr, "%s %d: %s\n", __FILE__, __LINE__, __FUNCTION__);
+fprintf(stderr, "%s %s: %d\n", __FILE__, __LINE__, pkey->pkey.sm9->privatePoint != NULL);
+*/
+
+	if ((rklen = i2d_SM9PrivateKey(pkey->pkey.sm9, &rk)) <= 0) {
+		SM9err(SM9_F_SM9_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(EVP_PKEY_SM9), 0,
+			     V_ASN1_NULL, NULL, rk, rklen)) {
+		SM9err(SM9_F_SM9_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
+		return 0;
+	}
+
+	return 1;
+}
+
+static void int_sm9_free(EVP_PKEY *pkey)
+{
+	SM9PrivateKey_free(pkey->pkey.sm9);
+}
+
+static int sm9_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
+{
+	return -2;
+}
+
+static int old_sm9_priv_decode(EVP_PKEY *pkey,
+	const unsigned char **pder, int derlen)
+{
+	SM9PrivateKey *sm9;
+	if ((sm9 = d2i_SM9PrivateKey(NULL, pder, derlen)) == NULL) {
+		SM9err(SM9_F_OLD_SM9_PRIV_DECODE, SM9_R_DECODE_ERROR);
+		return 0;
+	}
+	EVP_PKEY_assign_SM9PrivateKey(pkey, sm9);
+	return 1;
+}
+
+static int old_sm9_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
+fprintf(stderr, "%s %d: %s\n", __FILE__, __LINE__, __FUNCTION__);
+	return i2d_SM9PrivateKey(pkey->pkey.sm9, pder);
+}
+
+const EVP_PKEY_ASN1_METHOD sm9_asn1_meth = {
+	EVP_PKEY_SM9,		/* pkey_id */
+	EVP_PKEY_SM9,		/* pkey_base_id */
+	0,			/* pkey_flags */
+	"SM9",			/* pem_str */
+	"GmSSL SM9 algorithm",	/* info */
+	sm9_pub_decode,		/* pub_decode */
+	sm9_pub_encode,		/* pub_encode */
+	sm9_pub_cmp,		/* pub_cmp */
+	sm9_pub_print,		/* pub_print */
+	sm9_priv_decode,	/* priv_decode */
+	sm9_priv_encode,	/* priv_encode */
+	sm9_priv_print,		/* priv_print */
+	int_sm9_size,		/* pkey_size */
+	sm9_bits,		/* pkey_bits */
+	sm9_security_bits,	/* pkey_security_bits */
+	NULL,			/* param_decode */
+	NULL,			/* param_encode */
+	NULL,			/* param_missing */
+	NULL,			/* param_copy */
+	NULL,			/* param_cmp */
+	NULL,			/* param_print */
+	NULL,			/* sig_print */
+	int_sm9_free,		/* pkey_free */
+	sm9_pkey_ctrl,		/* pkey_ctrl */
+	old_sm9_priv_decode,	/* old_priv_decode */
+	old_sm9_priv_encode,	/* old_priv_encode */
+	NULL,			/* item_verify */
+	NULL,			/* item_sign */
+};
--- a/crypto/sm9/sm9_asn1.c
+++ b/crypto/sm9/sm9_asn1.c
@@ -55,47 +55,76 @@
 #include <openssl/sm9.h>
 #include "sm9_lcl.h"

-ASN1_SEQUENCE(SM9MasterSecret) = {
-	ASN1_SIMPLE(SM9MasterSecret, pairing, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9MasterSecret, scheme, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9MasterSecret, hash1, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9MasterSecret, pointPpub, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9MasterSecret, masterSecret, BIGNUM)
-} ASN1_SEQUENCE_END(SM9MasterSecret)
-IMPLEMENT_ASN1_FUNCTIONS(SM9MasterSecret)
-IMPLEMENT_ASN1_DUP_FUNCTION(SM9MasterSecret)
+static int sm9_master_key_cb(int operation, ASN1_VALUE **pval,
+	const ASN1_ITEM *it, void *exarg)
+{
+	if (operation == ASN1_OP_NEW_PRE) {
+		*pval = (ASN1_VALUE *)SM9_MASTER_KEY_new();
+		if (*pval)
+			return 2;
+		return 0;
+	} else if (operation == ASN1_OP_FREE_PRE) {
+		SM9_MASTER_KEY_free((SM9_MASTER_KEY *)*pval);
+		*pval = NULL;
+		return 2;
+	}
+	return 1;
+}

-ASN1_SEQUENCE(SM9PublicParameters) = {
-	ASN1_SIMPLE(SM9PublicParameters, pairing, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicParameters, scheme, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicParameters, hash1, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicParameters, pointPpub, ASN1_OCTET_STRING)
-} ASN1_SEQUENCE_END(SM9PublicParameters)
-IMPLEMENT_ASN1_FUNCTIONS(SM9PublicParameters)
-IMPLEMENT_ASN1_DUP_FUNCTION(SM9PublicParameters)
+ASN1_SEQUENCE_cb(SM9MasterSecret, sm9_master_key_cb) = {
+	ASN1_SIMPLE(SM9_MASTER_KEY, pairing, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, scheme, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, hash1, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, pointPpub, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_MASTER_KEY, masterSecret, BIGNUM)
+} ASN1_SEQUENCE_END_cb(SM9_MASTER_KEY, SM9MasterSecret)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(SM9_MASTER_KEY,SM9MasterSecret,SM9MasterSecret)

-ASN1_SEQUENCE(SM9PrivateKey) = {
-	ASN1_SIMPLE(SM9PrivateKey, pairing, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PrivateKey, scheme, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PrivateKey, hash1, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PrivateKey, pointPpub, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9PrivateKey, identity, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9PrivateKey, publicPoint, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9PrivateKey, privatePoint, ASN1_OCTET_STRING)
-} ASN1_SEQUENCE_END(SM9PrivateKey)
-IMPLEMENT_ASN1_FUNCTIONS(SM9PrivateKey)
-IMPLEMENT_ASN1_DUP_FUNCTION(SM9PrivateKey)
+ASN1_SEQUENCE_cb(SM9PublicParameters, sm9_master_key_cb) = {
+	ASN1_SIMPLE(SM9_MASTER_KEY, pairing, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, scheme, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, hash1, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_MASTER_KEY, pointPpub, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END_cb(SM9_MASTER_KEY, SM9PublicParameters)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(SM9_MASTER_KEY,SM9PublicParameters,SM9PublicParameters)

-ASN1_SEQUENCE(SM9PublicKey) = {
-	ASN1_SIMPLE(SM9PublicKey, pairing, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicKey, scheme, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicKey, hash1, ASN1_OBJECT),
-	ASN1_SIMPLE(SM9PublicKey, pointPpub, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9PublicKey, identity, ASN1_OCTET_STRING),
-	ASN1_SIMPLE(SM9PublicKey, publicPoint, ASN1_OCTET_STRING)
-} ASN1_SEQUENCE_END(SM9PublicKey)
-IMPLEMENT_ASN1_FUNCTIONS(SM9PublicKey)
-IMPLEMENT_ASN1_DUP_FUNCTION(SM9PublicKey)
+
+static int sm9_key_cb(int operation, ASN1_VALUE **pval,
+	const ASN1_ITEM *it, void *exarg)
+{
+	if (operation == ASN1_OP_NEW_PRE) {
+		*pval = (ASN1_VALUE *)SM9_KEY_new();
+		if (*pval)
+			return 2;
+		return 0;
+	} else if (operation == ASN1_OP_FREE_PRE) {
+		SM9_KEY_free((SM9_KEY *)*pval);
+		*pval = NULL;
+		return 2;
+	}
+	return 1;
+}
+
+ASN1_SEQUENCE_cb(SM9PrivateKey, sm9_key_cb) = {
+	ASN1_SIMPLE(SM9_KEY, pairing, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, scheme, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, hash1, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, pointPpub, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_KEY, identity, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_KEY, publicPoint, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_KEY, privatePoint, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END_cb(SM9_KEY, SM9PrivateKey)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(SM9_KEY,SM9PrivateKey,SM9PrivateKey)
+
+ASN1_SEQUENCE_cb(SM9PublicKey, sm9_key_cb) = {
+	ASN1_SIMPLE(SM9_KEY, pairing, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, scheme, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, hash1, ASN1_OBJECT),
+	ASN1_SIMPLE(SM9_KEY, pointPpub, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_KEY, identity, ASN1_OCTET_STRING),
+	ASN1_SIMPLE(SM9_KEY, publicPoint, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END_cb(SM9_KEY, SM9PublicKey)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(SM9_KEY,SM9PublicKey,SM9PublicKey)

 ASN1_SEQUENCE(SM9Ciphertext) = {
 	ASN1_SIMPLE(SM9Ciphertext, pointC1, ASN1_OCTET_STRING),
--- a/crypto/sm9/sm9_err.c
+++ b/crypto/sm9/sm9_err.c
@@ -19,6 +19,8 @@
 # define ERR_REASON(reason) ERR_PACK(ERR_LIB_SM9,0,reason)

 static ERR_STRING_DATA SM9_str_functs[] = {
+    {ERR_FUNC(SM9_F_OLD_SM9_MASTER_DECODE), "old_sm9_master_decode"},
+    {ERR_FUNC(SM9_F_OLD_SM9_PRIV_DECODE), "old_sm9_priv_decode"},
    {ERR_FUNC(SM9_F_SM9CIPHERTEXT_CHECK), "SM9Ciphertext_check"},
    {ERR_FUNC(SM9_F_SM9ENCPARAMETERS_DECRYPT), "SM9EncParameters_decrypt"},
    {ERR_FUNC(SM9_F_SM9ENCPARAMETERS_ENCRYPT), "SM9EncParameters_encrypt"},
@@ -40,6 +42,16 @@ static ERR_STRING_DATA SM9_str_functs[] = {
    {ERR_FUNC(SM9_F_SM9_GENERATE_KEY_EXCHANGE), "SM9_generate_key_exchange"},
    {ERR_FUNC(SM9_F_SM9_GENERATE_MASTER_SECRET),
     "SM9_generate_master_secret"},
+    {ERR_FUNC(SM9_F_SM9_KEY_NEW), "SM9_KEY_new"},
+    {ERR_FUNC(SM9_F_SM9_MASTER_DECODE), "sm9_master_decode"},
+    {ERR_FUNC(SM9_F_SM9_MASTER_ENCODE), "sm9_master_encode"},
+    {ERR_FUNC(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY),
+     "SM9_MASTER_KEY_extract_key"},
+    {ERR_FUNC(SM9_F_SM9_MASTER_KEY_NEW), "SM9_MASTER_KEY_new"},
+    {ERR_FUNC(SM9_F_SM9_PARAMS_DECODE), "sm9_params_decode"},
+    {ERR_FUNC(SM9_F_SM9_PRIV_DECODE), "sm9_priv_decode"},
+    {ERR_FUNC(SM9_F_SM9_PRIV_ENCODE), "sm9_priv_encode"},
+    {ERR_FUNC(SM9_F_SM9_PUB_DECODE), "sm9_pub_decode"},
    {ERR_FUNC(SM9_F_SM9_SIGN), "SM9_sign"},
    {ERR_FUNC(SM9_F_SM9_SIGNFINAL), "SM9_SignFinal"},
    {ERR_FUNC(SM9_F_SM9_SIGNINIT), "SM9_SignInit"},
@@ -53,6 +65,7 @@ static ERR_STRING_DATA SM9_str_functs[] = {

 static ERR_STRING_DATA SM9_str_reasons[] = {
    {ERR_REASON(SM9_R_BUFFER_TOO_SMALL), "buffer too small"},
+    {ERR_REASON(SM9_R_DECODE_ERROR), "decode error"},
    {ERR_REASON(SM9_R_DIGEST_FAILURE), "digest failure"},
    {ERR_REASON(SM9_R_EC_LIB), "ec lib"},
    {ERR_REASON(SM9_R_EXTENSION_FIELD_ERROR), "extension field error"},
@@ -80,6 +93,7 @@ static ERR_STRING_DATA SM9_str_reasons[] = {
    {ERR_REASON(SM9_R_INVALID_SIGNATURE_FORMAT), "invalid signature format"},
    {ERR_REASON(SM9_R_INVALID_TYPE1CURVE), "invalid type1curve"},
    {ERR_REASON(SM9_R_KDF_FAILURE), "kdf failure"},
+    {ERR_REASON(SM9_R_NO_MASTER_SECRET), "no master secret"},
    {ERR_REASON(SM9_R_PAIRING_ERROR), "pairing error"},
    {ERR_REASON(SM9_R_RATE_PAIRING_ERROR), "rate pairing error"},
    {ERR_REASON(SM9_R_TWIST_CURVE_ERROR), "twist curve error"},
--- a/crypto/sm9/sm9_keygen.c
+++ b/crypto/sm9/sm9_keygen.c
@@ -54,30 +54,6 @@
 #include <openssl/bn_hash.h>
 #include "sm9_lcl.h"

-#if 0
-int SM9_hash1(const EVP_MD *md, BIGNUM **r,
-	const char *id, size_t idlen,
-	unsigned char hid,
-	const BIGNUM *range,
-	BN_CTX *ctx)
-{
-	unsigned char *buf;
-
-	if (!(buf = OPENSSL_malloc(idlen + 1))) {
-		return 0;
-	}
-	memcpy(buf, id, idlen);
-	buf[idlen] = hid;
-
-	if (!BN_hash_to_range(md, r, buf, idlen + 1, range, ctx)) {
-		OPENSSL_free(buf);
-		return 0;
-	}
-
-	OPENSSL_free(buf);
-	return 1;
-}
-#endif

 int SM9_hash1(const EVP_MD *md, BIGNUM **r, const char *id, size_t idlen,
 	unsigned char hid, const BIGNUM *n, BN_CTX *ctx)
@@ -130,12 +106,12 @@ end:
 	return ret;
 }

-
-SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
-	const char *id, size_t idlen)
+SM9_KEY *SM9_MASTER_KEY_extract_key(SM9_MASTER_KEY *master,
+	const char *id, size_t idlen, int priv)
 {
 	SM9PrivateKey *ret = NULL;
 	SM9PrivateKey *sk = NULL;
+	EC_GROUP *group = NULL;
 	const BIGNUM *p = SM9_get0_prime();
 	const BIGNUM *n = SM9_get0_order();
 	int scheme;
@@ -148,24 +124,24 @@ SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
 	size_t len = sizeof(buf);

 	/* check args */
-	if (!msk || !id) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY,
+	if (!master || !id) {
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY,
 			ERR_R_PASSED_NULL_PARAMETER);
 		return NULL;
 	}
 	if (strlen(id) != idlen || idlen <= 0 || idlen > SM9_MAX_ID_LENGTH) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY,
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY,
 			SM9_R_INVALID_ID);
 		return NULL;
 	}

 	/* check pairing */
-	if (OBJ_obj2nid(msk->pairing) != NID_sm9bn256v1) {
+	if (OBJ_obj2nid(master->pairing) != NID_sm9bn256v1) {
 		return NULL;
 	}

 	/* check scheme */
-	scheme = OBJ_obj2nid(msk->scheme);
+	scheme = OBJ_obj2nid(master->scheme);
 	switch (scheme) {
 	case NID_sm9sign:
 		hid = SM9_HID_SIGN;
@@ -180,9 +156,14 @@ SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
 		return NULL;
 	}

+	/* check if master */
+	if (priv && master->masterSecret == NULL) {
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, SM9_R_NO_MASTER_SECRET);
+		return NULL;
+	}

 	/* check hash1 and set hash1 md */
-	switch (OBJ_obj2nid(msk->hash1)) {
+	switch (OBJ_obj2nid(master->hash1)) {
 	case NID_sm9hash1_with_sm3:
 		md = EVP_sm3();
 		break;
@@ -190,102 +171,140 @@ SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
 		md = EVP_sha256();
 		break;
 	default:
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, SM9_R_INVALID_HASH1);
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, SM9_R_INVALID_HASH1);
 		return NULL;
 	}

 	/* malloc */
 	if (!(sk = SM9PrivateKey_new())
+		|| !(group = EC_GROUP_new_by_curve_name(NID_sm9bn256v1))
 		|| !(ctx = BN_CTX_new())) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY,
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY,
 			ERR_R_MALLOC_FAILURE);
 		goto end;
 	}
 	BN_CTX_start(ctx);

-	/* t1 = H1(ID||hid) + msk (mod n) */
-	if (!SM9_hash1(md, &t, id, idlen, hid, n, ctx)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, ERR_R_SM9_LIB);
+	if (!(sk->pairing = master->pairing)
+		|| !(sk->scheme = master->scheme)
+		|| !(sk->hash1 = master->hash1)
+		|| !(sk->pointPpub = ASN1_OCTET_STRING_dup(master->pointPpub))
+		|| !(sk->identity = ASN1_OCTET_STRING_new())
+		|| !ASN1_OCTET_STRING_set(sk->identity, (unsigned char *)id, idlen)
+		|| !(sk->publicPoint = ASN1_OCTET_STRING_new())
+		|| !(sk->privatePoint = ASN1_OCTET_STRING_new())) {
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_ASN1_LIB);
 		goto end;
 	}

-	if (!BN_mod_add(t, t, msk->masterSecret, n, ctx)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, ERR_R_BN_LIB);
+	/* h1 = H1(id||HID) */
+	if (!SM9_hash1(md, &t, id, idlen, hid, n, ctx)) {
+		SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	/* generate (Ppubs, ds) or (Ppube, de) */
+	if (scheme == NID_sm9sign) {
+
+		/* publicPoint = h1 * P2 + Ppubs */
+		point_t Ppubs;
+		point_t point;
+		if (!point_init(&point, ctx)
+			|| !point_init(&Ppubs, ctx)
+			|| ASN1_STRING_length(master->pointPpub) != sizeof(buf)
+			|| !point_from_octets(&Ppubs, ASN1_STRING_get0_data(master->pointPpub), p, ctx)
+			|| !point_mul_generator(&point, t, p, ctx)
+			|| !point_add(&point, &point, &Ppubs, p, ctx)
+			|| !point_to_octets(&point, buf, ctx)
+			|| !ASN1_OCTET_STRING_set(sk->publicPoint, buf, sizeof(buf))) {
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_SM9_LIB);
+			point_cleanup(&Ppubs);
+			point_cleanup(&point);
+			goto end;
+		}
+		point_cleanup(&Ppubs);
+		point_cleanup(&point);
+
+	} else {
+
+		/* publicPoint = h1 * P1 + Ppube */
+		EC_POINT *Ppube = NULL;
+		EC_POINT *point = NULL;
+		if (!(group = EC_GROUP_new_by_curve_name(NID_sm9bn256v1))
+			|| !(point = EC_POINT_new(group))
+			|| !(Ppube = EC_POINT_new(group))
+			|| !EC_POINT_oct2point(group, Ppube,
+				ASN1_STRING_get0_data(master->pointPpub),
+				ASN1_STRING_length(master->pointPpub), ctx)
+			|| !EC_POINT_mul(group, point, t, NULL, NULL, ctx)
+			|| !EC_POINT_add(group, point, point, Ppube, ctx)
+			|| !(len = EC_POINT_point2oct(group, point, point_form, buf, len, ctx))
+			|| !ASN1_OCTET_STRING_set(sk->publicPoint, buf, len)) {
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_SM9_LIB);
+			EC_POINT_free(Ppube);
+			EC_POINT_free(point);
+			goto end;
+		}
+		EC_POINT_free(Ppube);
+		EC_POINT_free(point);
+	}
+
+	if (priv) {
+
+		/* t1 = H1(ID||hid) + master (mod n) */
+		if (!BN_mod_add(t, t, master->masterSecret, n, ctx)) {
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_BN_LIB);
 			goto end;
 		}

 		/* if t1 is zero, return failed */
 		if (BN_is_zero(t)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, SM9_R_ZERO_ID);
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, SM9_R_ZERO_ID);
 			goto end;
 		}

-	/* t2 = msk * t1^-1 (mod n) */
+		/* t2 = master * t1^-1 (mod n) */
 		if (!BN_mod_inverse(t, t, n, ctx)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, ERR_R_BN_LIB);
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_BN_LIB);
 			goto end;
 		}
-	if (!BN_mod_mul(t, msk->masterSecret, t, n, ctx)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, ERR_R_BN_LIB);
+		if (!BN_mod_mul(t, master->masterSecret, t, n, ctx)) {
+			SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_BN_LIB);
 			goto end;
 		}

-	/* generate ds or de */
 		if (scheme == NID_sm9sign) {
-
-		EC_GROUP *group = NULL;
-		EC_POINT *ds = NULL;
-
 			/* ds = t2 * P1 */
-		if (!(group = EC_GROUP_new_by_curve_name(NID_sm9bn256v1))
-			|| !(ds = EC_POINT_new(group))
+			EC_POINT *ds = NULL;
+			if (!(ds = EC_POINT_new(group))
 				|| !EC_POINT_mul(group, ds, t, NULL, NULL, ctx)
-			|| !(len = EC_POINT_point2oct(group, ds, point_form, buf, len, ctx))) {
-			EC_GROUP_free(group);
+				|| !(len = EC_POINT_point2oct(group, ds, point_form, buf, len, ctx))
+				|| !ASN1_OCTET_STRING_set(sk->privatePoint, buf, len)) {
+				SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_SM9_LIB);
 				EC_POINT_free(ds);
 				goto end;
 			}
-
-		EC_GROUP_free(group);
 			EC_POINT_free(ds);
-
 		} else {
-		point_t de;
-
 			/* de = t2 * P2 */
+			point_t de;
 			if (!point_init(&de, ctx)
 				|| !point_mul_generator(&de, t, p, ctx)
-			|| !point_to_octets(&de, buf, ctx)) {
+				|| !point_to_octets(&de, buf, ctx)
+				|| !ASN1_OCTET_STRING_set(sk->privatePoint, buf, sizeof(buf))) {
+				SM9err(SM9_F_SM9_MASTER_KEY_EXTRACT_KEY, ERR_R_SM9_LIB);
 				point_cleanup(&de);
 				goto end;
 			}
-
 			point_cleanup(&de);
-
 		}
-
-	ASN1_OBJECT_free(sk->pairing);
-	ASN1_OBJECT_free(sk->scheme);
-	ASN1_OBJECT_free(sk->hash1);
-	sk->pairing = NULL;
-	sk->scheme = NULL;
-	sk->hash1 = NULL;
-
-	if (!(sk->pairing = msk->pairing)
-		|| !(sk->scheme = msk->scheme)
-		|| !(sk->hash1 = msk->hash1)
-		|| !ASN1_STRING_copy(sk->pointPpub, msk->pointPpub)
-		|| !ASN1_STRING_set(sk->identity, id, idlen)
-		/* FIXME: create publicPoint */
-		|| !ASN1_STRING_set(sk->privatePoint, buf, len)) {
-		SM9err(SM9_F_SM9_EXTRACT_PRIVATE_KEY, ERR_R_ASN1_LIB);
-		goto end;
 	}

 	ret = sk;
 	sk = NULL;

 end:
+	EC_GROUP_free(group);
 	if (ctx) {
 		BN_CTX_end(ctx);
 	}
@@ -295,133 +314,16 @@ end:
 	return ret;
 }

-SM9PublicKey *SM9_extract_public_key(SM9PublicParameters *mpk,
+SM9PublicKey *SM9_extract_public_key(SM9PublicParameters *master,
 	const char *id, size_t idlen)
 {
-	SM9PublicKey *ret = NULL;
-	SM9PublicKey *pk = NULL;
-	BN_CTX *ctx = NULL;
-	BIGNUM *h1 = NULL;
-	int scheme;
-	unsigned char hid;
-	const EVP_MD *md;
-	const BIGNUM *p = SM9_get0_prime();
-	const BIGNUM *n = SM9_get0_order();
-	int point_form = POINT_CONVERSION_UNCOMPRESSED;
-	unsigned char buf[129];
-	size_t len = sizeof(buf);
+	return SM9_MASTER_KEY_extract_key(master, id, idlen, 0);
+}

-	if (!(pk = SM9PublicKey_new())
-		|| !(ctx = BN_CTX_new())) {
-		goto end;
-	}
-
-	/* check pairing */
-	if (OBJ_obj2nid(mpk->pairing) != NID_sm9bn256v1) {
-		goto end;
-	}
-
-	/* check scheme and set hash1 hid */
-	scheme = OBJ_obj2nid(mpk->scheme);
-	switch (scheme) {
-	case NID_sm9sign:
-		hid = SM9_HID_SIGN;
-		break;
-	case NID_sm9encrypt:
-		hid = SM9_HID_ENC;
-		break;
-	case NID_sm9keyagreement:
-		hid = SM9_HID_EXCH;
-		break;
-	default:
-		goto end;
-	}
-
-	/* check hash1 and set hash1 md */
-	switch (OBJ_obj2nid(mpk->hash1)) {
-	case NID_sm9hash1_with_sm3:
-		md = EVP_sm3();
-		break;
-	case NID_sm9hash1_with_sha256:
-		md = EVP_sha256();
-		break;
-	default:
-		goto end;
-	}
-
-	/* h1 = H1(ID || hid) in [1, n-1] */
-	if (!SM9_hash1(md, &h1, id, idlen, hid, n, ctx)) {
-		goto end;
-	}
-
-	if (scheme == NID_sm9sign) {
-		/* publicPoint = h1 * P2 + Ppubs */
-		point_t point;
-		point_t Ppubs;
-
-
-		if (!point_init(&point, ctx)
-			|| !point_init(&Ppubs, ctx)
-			|| ASN1_STRING_length(mpk->pointPpub) != sizeof(buf)
-			|| !point_from_octets(&Ppubs, ASN1_STRING_get0_data(mpk->pointPpub), p, ctx)
-			|| !point_mul_generator(&point, h1, p, ctx)
-			|| !point_add(&point, &point, &Ppubs, p, ctx)
-			|| !point_to_octets(&point, buf, ctx)) {
-			point_cleanup(&point);
-			point_cleanup(&Ppubs);
-			goto end;
-		}
-		point_cleanup(&point);
-		point_cleanup(&Ppubs);
-
-	} else if (OBJ_obj2nid(mpk->scheme) == NID_sm9encrypt) {
-		/* publicPoint = h1 * P1 + Ppube */
-		EC_GROUP *group = NULL;
-		EC_POINT *point = NULL;
-		EC_POINT *Ppube = NULL;
-
-		if (!(group = EC_GROUP_new_by_curve_name(NID_sm9bn256v1))
-			|| !(point = EC_POINT_new(group))
-			|| !(Ppube = EC_POINT_new(group))
-			|| !EC_POINT_oct2point(group, Ppube,
-				ASN1_STRING_get0_data(mpk->pointPpub),
-				ASN1_STRING_length(mpk->pointPpub), ctx)
-			|| !EC_POINT_mul(group, point, h1, NULL, NULL, ctx)
-			|| !EC_POINT_add(group, point, point, Ppube, ctx)
-			|| !(len = EC_POINT_point2oct(group, point, point_form, buf, len, ctx))) {
-			EC_GROUP_free(group);
-			EC_POINT_free(point);
-			EC_POINT_free(Ppube);
-			goto end;
-		}
-		EC_GROUP_free(group);
-		EC_POINT_free(point);
-		EC_POINT_free(Ppube);
-	}
-
-	/* init object */
-	ASN1_OBJECT_free(pk->pairing);
-	ASN1_OBJECT_free(pk->scheme);
-	ASN1_OBJECT_free(pk->hash1);
-	pk->pairing = NULL;
-	pk->scheme = NULL;
-	pk->hash1 = NULL;
-
-	if (!(pk->pairing = OBJ_dup(mpk->pairing))
-		|| !(pk->scheme = OBJ_dup(mpk->scheme))
-		|| !(pk->hash1 = OBJ_dup(mpk->hash1))
-		|| !ASN1_STRING_copy(pk->pointPpub, mpk->pointPpub)
-		|| !ASN1_STRING_set(pk->publicPoint, buf, len)
-		|| !ASN1_STRING_set(pk->identity, id, idlen)) {
-		goto end;
-	}
-
-	ret = pk;
-	pk = NULL;
-
-end:
-	SM9PublicKey_free(pk);
-	return ret;
+SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *master,
+	const char *id, size_t idlen)
+{
+	return SM9_MASTER_KEY_extract_key(master, id, idlen, 1);
 }

 SM9PublicKey *SM9PrivateKey_get_public_key(SM9PrivateKey *sk)
--- a/crypto/sm9/sm9_lcl.h
+++ b/crypto/sm9/sm9_lcl.h
@@ -52,6 +52,7 @@

 #include <openssl/err.h>
 #include <openssl/sm9.h>
+#include "e_os.h"

 /* private key extract algorithms */
 #define SM9_HID_SIGN		0x01
@@ -86,38 +87,38 @@ extern "C" {
 #endif


-struct SM9MasterSecret_st {
+struct SM9_MASTER_KEY_st {
+	/* public */
 	ASN1_OBJECT *pairing;
 	ASN1_OBJECT *scheme;
 	ASN1_OBJECT *hash1;
 	ASN1_OCTET_STRING *pointPpub;
+
+	/* private */
 	BIGNUM *masterSecret;
+
+	int references;
+	int flags;
+	CRYPTO_EX_DATA ex_data;
+	CRYPTO_RWLOCK *lock;
 };

-struct SM9PublicParameters_st {
-	ASN1_OBJECT *pairing;
-	ASN1_OBJECT *scheme;
-	ASN1_OBJECT *hash1;
-	ASN1_OCTET_STRING *pointPpub;
-};
-
-struct SM9PrivateKey_st {
+struct SM9_KEY_st {
+	/* public */
 	ASN1_OBJECT *pairing;
 	ASN1_OBJECT *scheme;
 	ASN1_OBJECT *hash1;
 	ASN1_OCTET_STRING *pointPpub;
 	ASN1_OCTET_STRING *identity;
 	ASN1_OCTET_STRING *publicPoint;
+
+	/* private */
 	ASN1_OCTET_STRING *privatePoint;
-};

-struct SM9PublicKey_st {
-	ASN1_OBJECT *pairing;
-	ASN1_OBJECT *scheme;
-	ASN1_OBJECT *hash1;
-	ASN1_OCTET_STRING *pointPpub;
-	ASN1_OCTET_STRING *identity;
-	ASN1_OCTET_STRING *publicPoint;
+	int references;
+	int flags;
+	CRYPTO_EX_DATA ex_data;
+	CRYPTO_RWLOCK *lock;
 };

 struct SM9Ciphertext_st {
--- a/crypto/sm9/sm9_lib.c
+++ b/crypto/sm9/sm9_lib.c
@@ -50,9 +50,60 @@
 #include <string.h>
 #include <openssl/err.h>
 #include <openssl/sm9.h>
+#include <openssl/crypto.h>
 #include <openssl/bn_hash.h>
 #include "sm9_lcl.h"

+SM9_MASTER_KEY *SM9_MASTER_KEY_new(void)
+{
+	SM9_MASTER_KEY *ret = NULL;
+
+	if (!(ret = OPENSSL_zalloc(sizeof(*ret)))) {
+		SM9err(SM9_F_SM9_MASTER_KEY_NEW, ERR_R_MALLOC_FAILURE);
+		return NULL;
+	}
+
+	return ret;
+}
+
+void SM9_MASTER_KEY_free(SM9_MASTER_KEY *key)
+{
+	if (key) {
+		ASN1_OBJECT_free(key->pairing);
+		ASN1_OBJECT_free(key->scheme);
+		ASN1_OBJECT_free(key->hash1);
+		ASN1_OCTET_STRING_free(key->pointPpub);
+		BN_clear_free(key->masterSecret);
+	}
+	OPENSSL_clear_free(key, sizeof(*key));
+}
+
+SM9_KEY *SM9_KEY_new(void)
+{
+	SM9_KEY *ret = NULL;
+
+	if (!(ret = OPENSSL_zalloc(sizeof(*ret)))) {
+		SM9err(SM9_F_SM9_KEY_NEW, ERR_R_MALLOC_FAILURE);
+		return NULL;
+	}
+
+	return ret;
+}
+
+void SM9_KEY_free(SM9_KEY *key)
+{
+	if (key) {
+		ASN1_OBJECT_free(key->pairing);
+		ASN1_OBJECT_free(key->scheme);
+		ASN1_OBJECT_free(key->hash1);
+		ASN1_OCTET_STRING_free(key->pointPpub);
+		ASN1_OCTET_STRING_free(key->identity);
+		ASN1_OCTET_STRING_free(key->publicPoint);
+	}
+	OPENSSL_clear_free(key, sizeof(*key));
+}
+
+
 int SM9PrivateKey_get_gmtls_public_key(SM9PublicParameters *mpk,
 	SM9PrivateKey *sk, unsigned char pub_key[1024])
 {
@@ -99,32 +150,26 @@ int SM9_DigestInit(EVP_MD_CTX *ctx, unsigned char prefix,
 	return 1;
 }

-#if 0
-int SM9_DigestFinal(EVP_MD_CTX *ctx1, BIGNUM *h, const BIGNUM *n_1)
+int SM9_MASTER_KEY_up_ref(SM9_MASTER_KEY *msk)
 {
-	int ret = 0;
-	EVP_MD_CTX *ctx2 = NULL;
-	const unsigned char ct1[4] = {0x00, 0x00, 0x00, 0x01};
-	const unsigned char ct2[4] = {0x00, 0x00, 0x00, 0x02};
-	unsigned char Ha[EVP_MAX_MD_SIZE * 2];
-	unsigned int len = 0;
+	int i;

-	if (!(ctx2 = EVP_MD_CTX_new())
-		|| !EVP_MD_CTX_copy(ctx2, ctx1)
-		|| !EVP_DigestUpdate(ctx1, ct1, sizeof(ct))
-		|| !EVP_DigestUpdate(ctx2, ct2, sizeof(ct2))
-		|| !EVP_DigestFinal_ex(ctx1, Ha, &len)
-		|| !EVP_DigestFinal_ex(ctx2, Ha + len, &len)
-		|| !BN_bin2bn(Ha, 40, h)
-		|| !BN_mod(h, h, n_1, bn_ctx)
-		|| !BN_add_word(h, 1)) {
-		ERR_print_errors_fp(stderr);
-		goto end;
-	}
+	if (CRYPTO_atomic_add(&msk->references, 1,  &i, msk->lock) <= 0)
+		return 0;

-	ret = 1;
-end:
-	EVP_MD_CTX_free(ctx2);
-	return ret;
+	REF_PRINT_COUNT("SM9_MASTER_KEY", msk);
+	REF_ASSERT_ISNT(i < 2);
+	return ((i > 1) ? 1 : 0);
+}
+
+int SM9_KEY_up_ref(SM9_KEY *sk)
+{
+	int i;
+
+	if (CRYPTO_atomic_add(&sk->references, 1,  &i, sk->lock) <= 0)
+		return 0;
+
+	REF_PRINT_COUNT("SM9_KEY", sk);
+	REF_ASSERT_ISNT(i < 2);
+	return ((i > 1) ? 1 : 0);
 }
-#endif
--- a/include/openssl/pem3.h
+++ b/include/openssl/pem3.h
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2015 - 2016 The GmSSL Project.  All rights reserved.
+ * Copyright (c) 2016 The GmSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -47,59 +47,105 @@
 * ====================================================================
 */

-#ifndef HEADER_PEM3_H
-#define HEADER_PEM3_H
+#include <string.h>
+#include <openssl/err.h>
+#include <openssl/sm9.h>
+#include <openssl/bn_hash.h>
+#include "sm9_lcl.h"

-#ifndef OPENSSL_NO_CPK
-# include <openssl/cpk.h>
-#endif
-#ifndef OPENSSL_NO_SM9
-# include <openssl/sm9.h>
-#endif
-#ifndef OPENSSL_NO_BFIBE
-# include <openssl/bfibe.h>
-#endif
-#ifndef OPENSSL_NO_BB1IBE
-# include <openssl/bb1ibe.h>
-#endif
-#ifndef OPENSSL_NO_PAILLIER
-# include <openssl/paillier.h>
-#endif
+int SM9PrivateKey_get_gmtls_public_key(SM9PublicParameters *mpk,
+	SM9PrivateKey *sk, unsigned char pub_key[1024])
+{
+	return 0;
+}
+
+int SM9PublicKey_get_gmtls_encoded(SM9PublicParameters *mpk,
+	SM9PublicKey *pk, unsigned char encoded[1024])
+{
+	return 0;
+}


-#ifdef __cplusplus
-extern "C" {
-#endif
+int SM9_hash2(const EVP_MD *md, BIGNUM **r,
+	const unsigned char *data, size_t datalen,
+	const unsigned char *elem, size_t elemlen,
+	const BIGNUM *range, BN_CTX *ctx)
+{
+	unsigned char *buf;

+	if (!(buf = OPENSSL_malloc(datalen + elemlen))) {
+		return 0;
+	}
+	memcpy(buf, data, datalen);
+	memcpy(buf + datalen, elem, elemlen);

-#include <openssl/pem.h>
+	if (!BN_hash_to_range(md, r, buf, datalen + elemlen, range, ctx)) {
+		OPENSSL_free(buf);
+		return 0;
+	}

+	OPENSSL_free(buf);
+	return 1;
+}

-#define PEM_STRING_PAILLIER		"PAILLIER PRIVATE KEY"
-#define PEM_STRING_PAILLIER_PUBLIC	"PAILLIER PUBLIC KEY"
-#define PEM_STRING_CPK_PARAMS		"CPK PUBLIC PARAMETERS"
-#define PEM_STRING_CPK_MASTER		"CPK MASTER SECRET"
-#define PEM_STRING_SM9_PARAMS		"SM9 PUBLIC PARAMETERS"
-#define PEM_STRING_SM9_MASTER		"SM9 MASTER SECRET"
-#define PEM_STRING_SM9_PRIVATE		"SM9 PRIVATE KEY"
-#define PEM_STRING_BFIBE_PARAMS		"BFIBE PUBLIC PARAMETERS"
-#define PEM_STRING_BFIBE_MASTER		"BFIBE MASTER SECRET"
-#define PEM_STRING_BFIBE_PRIVATE	"BFIBE PRIVATE KEY"
-#define PEM_STRING_BB1IBE_PARAMS	"BB1IBE PUBLIC PARAMETERS"
-#define PEM_STRING_BB1IBE_MASTER	"BB1IBE MASTER SECRET"
-#define PEM_STRING_BB1IBE_PRIVATE	"BB1IBE PRIVATE KEY"
+int SM9_DigestInit(EVP_MD_CTX *ctx, unsigned char prefix,
+	const EVP_MD *md, ENGINE *impl)
+{
+	if (!EVP_DigestInit_ex(ctx, md, impl)
+		|| !EVP_DigestUpdate(ctx, &prefix, 1)) {
+		ERR_print_errors_fp(stderr);
+		return 0;
+	}
+	return 1;
+}

+//FIXME: implement this !!!
+int SM9MasterSecret_up_ref(SM9MasterSecret *msk)
+{
+	return 1;
+}

-# ifndef OPENSSL_NO_PAILLIER
-/*
-DECLARE_PEM_rw_cb(PAILLIERPrivateKey, PAILLIER)
-DECLARE_PEM_rw_const(PAILLIERPublicKey, PAILLIER)
-DECLARE_PEM_rw(PAILLIER_PUBKEY, PAILLIER)
-*/
-# endif
+int SM9PublicParameters_up_ref(SM9PublicParameters *mpk)
+{
+	return 1;
+}

+int SM9PrivateKey_up_ref(SM9PrivateKey *sk)
+{
+	return 1;
+}

-#ifdef __cplusplus
+int SM9PublicKey_up_ref(SM9PublicKey *pk)
+{
+	return 1;
+}
+
+#if 0
+int SM9_DigestFinal(EVP_MD_CTX *ctx1, BIGNUM *h, const BIGNUM *n_1)
+{
+	int ret = 0;
+	EVP_MD_CTX *ctx2 = NULL;
+	const unsigned char ct1[4] = {0x00, 0x00, 0x00, 0x01};
+	const unsigned char ct2[4] = {0x00, 0x00, 0x00, 0x02};
+	unsigned char Ha[EVP_MAX_MD_SIZE * 2];
+	unsigned int len = 0;
+
+	if (!(ctx2 = EVP_MD_CTX_new())
+		|| !EVP_MD_CTX_copy(ctx2, ctx1)
+		|| !EVP_DigestUpdate(ctx1, ct1, sizeof(ct))
+		|| !EVP_DigestUpdate(ctx2, ct2, sizeof(ct2))
+		|| !EVP_DigestFinal_ex(ctx1, Ha, &len)
+		|| !EVP_DigestFinal_ex(ctx2, Ha + len, &len)
+		|| !BN_bin2bn(Ha, 40, h)
+		|| !BN_mod(h, h, n_1, bn_ctx)
+		|| !BN_add_word(h, 1)) {
+		ERR_print_errors_fp(stderr);
+		goto end;
+	}
+
+	ret = 1;
+end:
+	EVP_MD_CTX_free(ctx2);
+	return ret;
 }
 #endif
-#endif
--- a/crypto/sm9/sm9_setup.c
+++ b/crypto/sm9/sm9_setup.c
@@ -73,7 +73,6 @@ SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1)
 	/* set pairing type */
 	switch (pairing) {
 	case NID_sm9bn256v1:
-		ASN1_OBJECT_free(msk->pairing);
 		if (!(msk->pairing = OBJ_nid2obj(pairing))) {
 			SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_OBJ_LIB);
 			goto end;
@@ -89,7 +88,6 @@ SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1)
 	case NID_sm9sign:
 	case NID_sm9encrypt:
 	case NID_sm9keyagreement:
-		ASN1_OBJECT_free(msk->scheme);
 		if (!(msk->scheme = OBJ_nid2obj(scheme))) {
 			SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_OBJ_LIB);
 			goto end;
@@ -104,7 +102,6 @@ SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1)
 	switch (hash1) {
 	case NID_sm9hash1_with_sm3:
 	case NID_sm9hash1_with_sha256:
-		ASN1_OBJECT_free(msk->hash1);
 		if (!(msk->hash1 = OBJ_nid2obj(hash1))) {
 			SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_OBJ_LIB);
 			goto end;
@@ -117,6 +114,11 @@ SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1)

 	/* generate master secret k = rand(1, n - 1) */
 	do {
+
+		if (!(msk->masterSecret = BN_new())) {
+			SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
+			goto end;
+		}
 		if (!BN_rand_range(msk->masterSecret, n)) {
 			SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_BN_LIB);
 			goto end;
@@ -165,6 +167,10 @@ SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1)
 		goto end;
 	}

+	if (!(msk->pointPpub = ASN1_OCTET_STRING_new())) {
+		SM9err(SM9_F_SM9_GENERATE_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
+		goto end;
+	}
 	if (!ASN1_OCTET_STRING_set(msk->pointPpub, buf, (int)len)) {
 		ERR_print_errors_fp(stderr);
 		goto end;
@@ -193,17 +199,10 @@ SM9PublicParameters *SM9_extract_public_parameters(SM9MasterSecret *msk)
 		return NULL;
 	}

-	ASN1_OBJECT_free(mpk->pairing);
-	ASN1_OBJECT_free(mpk->scheme);
-	ASN1_OBJECT_free(mpk->hash1);
-	mpk->pairing = NULL;
-	mpk->scheme = NULL;
-	mpk->hash1 = NULL;
-
 	if (!(mpk->pairing = OBJ_dup(msk->pairing))
 		|| !(mpk->scheme = OBJ_dup(msk->scheme))
 		|| !(mpk->hash1 = OBJ_dup(msk->hash1))
-		|| !ASN1_STRING_copy(mpk->pointPpub, msk->pointPpub)) {
+		|| !(mpk->pointPpub = ASN1_OCTET_STRING_dup(msk->pointPpub))) {
 		SM9err(SM9_F_SM9_EXTRACT_PUBLIC_PARAMETERS, ERR_R_MALLOC_FAILURE);
 		goto end;
 	}
--- a/crypto/x509/x_pubkey.c
+++ b/crypto/x509/x_pubkey.c
@@ -302,6 +302,84 @@ int i2d_PAILLIER_PUBKEY(PAILLIER *a, unsigned char **pp)
 }
 #endif

+#ifndef OPENSSL_NO_SM9
+SM9_MASTER_KEY *d2i_SM9_MASTER_PUBKEY(SM9_MASTER_KEY **a, const unsigned char **pp, long length)
+{
+    EVP_PKEY *pkey;
+    SM9_MASTER_KEY *key;
+    const unsigned char *q;
+    q = *pp;
+    pkey = d2i_PUBKEY(NULL, &q, length);
+    if (!pkey)
+        return NULL;
+    key = EVP_PKEY_get1_SM9_MASTER(pkey);
+    EVP_PKEY_free(pkey);
+    if (!key)
+        return NULL;
+    *pp = q;
+    if (a) {
+        SM9_MASTER_KEY_free(*a);
+        *a = key;
+    }
+    return key;
+}
+
+int i2d_SM9_MASTER_PUBKEY(SM9_MASTER_KEY *a, unsigned char **pp)
+{
+    EVP_PKEY *pktmp;
+    int ret;
+    if (!a)
+        return 0;
+    pktmp = EVP_PKEY_new();
+    if (pktmp == NULL) {
+        ASN1err(ASN1_F_I2D_SM9_MASTER_PUBKEY, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    EVP_PKEY_set1_SM9_MASTER(pktmp, a);
+    ret = i2d_PUBKEY(pktmp, pp);
+    EVP_PKEY_free(pktmp);
+    return ret;
+}
+
+SM9_KEY *d2i_SM9_PUBKEY(SM9_KEY **a, const unsigned char **pp, long length)
+{
+    EVP_PKEY *pkey;
+    SM9_KEY *key;
+    const unsigned char *q;
+    q = *pp;
+    pkey = d2i_PUBKEY(NULL, &q, length);
+    if (!pkey)
+        return NULL;
+    key = EVP_PKEY_get1_SM9(pkey);
+    EVP_PKEY_free(pkey);
+    if (!key)
+        return NULL;
+    *pp = q;
+    if (a) {
+        SM9_KEY_free(*a);
+        *a = key;
+    }
+    return key;
+}
+
+int i2d_SM9_PUBKEY(SM9_KEY *a, unsigned char **pp)
+{
+    EVP_PKEY *pktmp;
+    int ret;
+    if (!a)
+        return 0;
+    pktmp = EVP_PKEY_new();
+    if (pktmp == NULL) {
+        //ASN1err(ASN1_F_I2D_SM9_PUBKEY, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+    EVP_PKEY_set1_SM9(pktmp, a);
+    ret = i2d_PUBKEY(pktmp, pp);
+    EVP_PKEY_free(pktmp);
+    return ret;
+}
+#endif
+
 #ifndef OPENSSL_NO_DSA
 DSA *d2i_DSA_PUBKEY(DSA **a, const unsigned char **pp, long length)
 {
--- a/include/openssl/asn1.h
+++ b/include/openssl/asn1.h
@@ -963,6 +963,8 @@ int ERR_load_ASN1_strings(void);
 # define ASN1_F_I2D_PRIVATEKEY                            163
 # define ASN1_F_I2D_PUBLICKEY                             164
 # define ASN1_F_I2D_RSA_PUBKEY                            165
+# define ASN1_F_I2D_SM9_MASTER_PUBKEY                     105
+# define ASN1_F_I2D_SM9_PUBKEY                            112
 # define ASN1_F_LONG_C2I                                  166
 # define ASN1_F_OID_MODULE_INIT                           174
 # define ASN1_F_PARSE_TAGGING                             182
--- a/include/openssl/cpk.h
+++ b/include/openssl/cpk.h
@@ -139,6 +139,7 @@ int ERR_load_CPK_strings(void);
 # define CPK_R_BAD_DATA                                   101
 # define CPK_R_INVALID_ALGORITHM                          106
 # define CPK_R_INVALID_ARGUMENT                           107
+# define CPK_R_INVALID_CURVE                              108
 # define CPK_R_INVALID_ID_LENGTH                          102
 # define CPK_R_INVALID_MAP_ALGOR                          103
 # define CPK_R_INVALID_PKEY_TYPE                          104
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -101,6 +101,8 @@
 # define EVP_PKEY_TLS1_PRF   NID_tls1_prf
 # define EVP_PKEY_HKDF       NID_hkdf
 # define EVP_PKEY_PAILLIER   NID_paillier
+# define EVP_PKEY_SM9_MASTER NID_id_sm9MasterSecret
+# define EVP_PKEY_SM9        NID_id_sm9PublicKey

 #ifdef  __cplusplus
 extern "C" {
@@ -454,6 +456,17 @@ typedef int (EVP_PBE_KEYGEN) (EVP_CIPHER_CTX *ctx, const char *pass,
                                        (char *)(paillier))
 # endif

+# ifndef OPENSSL_NO_SM9
+#  define EVP_PKEY_assign_SM9_MASTER(pkey,sm9) EVP_PKEY_assign((pkey),EVP_PKEY_SM9_MASTER,\
+                                        (char *)(sm9))
+#  define EVP_PKEY_assign_SM9(pkey,sm9) EVP_PKEY_assign((pkey),EVP_PKEY_SM9,\
+                                        (char *)(sm9))
+#  define EVP_PKEY_assign_SM9MasterSecret(pkey,sm9) EVP_PKEY_assign_SM9_MASTER(pkey,sm9)
+#  define EVP_PKEY_assign_SM9PublicParameters(pkey,sm9) EVP_PKEY_assign_SM9_MASTER(pkey,sm9)
+#  define EVP_PKEY_assign_SM9PrivateKey(pkey,sm9) EVP_PKEY_assign_SM9(pkey,sm9)
+#  define EVP_PKEY_assign_SM9PublicKey(pkey,sm9) EVP_PKEY_assign_SM9(pkey,sm9)
+# endif
+
 /* Add some extra combinations */
 # define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a))
 # define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a))
@@ -1023,6 +1036,28 @@ int EVP_PKEY_set1_PAILLIER(EVP_PKEY *pkey, struct paillier_st *key);
 struct paillier_st *EVP_PKEY_get0_PAILLIER(EVP_PKEY *pkey);
 struct paillier_st *EVP_PKEY_get1_PAILLIER(EVP_PKEY *pkey);
 # endif
+# ifndef OPENSSL_NO_SM9
+struct SM9_MASTER_KEY_st;
+int EVP_PKEY_set1_SM9_MASTER(EVP_PKEY *pkey, struct SM9_MASTER_KEY_st *key);
+struct SM9_MASTER_KEY_st *EVP_PKEY_get0_SM9_MASTER(EVP_PKEY *pkey);
+struct SM9_MASTER_KEY_st *EVP_PKEY_get1_SM9_MASTER(EVP_PKEY *pkey);
+#define EVP_PKEY_set1_SM9MasterSecret(pk,k) EVP_PKEY_set1_SM9_MASTER(pk,k)
+#define EVP_PKEY_get0_SM9MasterSecret(pk) EVP_PKEY_get0_SM9_MASTER(pk)
+#define EVP_PKEY_get1_SM9MasterSecret(pk) EVP_PKEY_get1_SM9_MASTER(pk)
+#define EVP_PKEY_set1_SM9PublicParameters(pk,k) EVP_PKEY_set1_SM9_MASTER(pk,k)
+#define EVP_PKEY_get0_SM9PublicParameters(pk) EVP_PKEY_get0_SM9_MASTER(pk)
+#define EVP_PKEY_get1_SM9PublicParameters(pk) EVP_PKEY_get1_SM9_MASTER(pk)
+struct SM9_KEY_st;
+int EVP_PKEY_set1_SM9(EVP_PKEY *pkey, struct SM9_KEY_st *key);
+struct SM9_KEY_st *EVP_PKEY_get0_SM9(EVP_PKEY *pkey);
+struct SM9_KEY_st *EVP_PKEY_get1_SM9(EVP_PKEY *pkey);
+#define EVP_PKEY_set1_SM9PrivateKey(pk,k) EVP_PKEY_set1_SM9(pk,k)
+#define EVP_PKEY_get0_SM9PrivateKey(pk,k) EVP_PKEY_get0_SM9(pk)
+#define EVP_PKEY_get1_SM9PrivateKey(pk,k) EVP_PKEY_get1_SM9(pk)
+#define EVP_PKEY_set1_SM9PublicKey(pk,k) EVP_PKEY_set1_SM9(pk,k)
+#define EVP_PKEY_get0_SM9PublicKey(pk,k) EVP_PKEY_get0_SM9(pk)
+#define EVP_PKEY_get1_SM9PublicKey(pk,k) EVP_PKEY_get1_SM9(pk)
+# endif

 EVP_PKEY *EVP_PKEY_new(void);
 int EVP_PKEY_up_ref(EVP_PKEY *pkey);
@@ -1600,6 +1635,10 @@ int ERR_load_EVP_strings(void);
 # define EVP_F_EVP_PKEY_GET0_HMAC                         183
 # define EVP_F_EVP_PKEY_GET0_PAILLIER                     172
 # define EVP_F_EVP_PKEY_GET0_RSA                          121
+# define EVP_F_EVP_PKEY_GET0_SM9                          176
+# define EVP_F_EVP_PKEY_GET0_SM9MASTERSECRET              173
+# define EVP_F_EVP_PKEY_GET0_SM9PUBLICPARAMETERS          174
+# define EVP_F_EVP_PKEY_GET0_SM9_MASTER                   175
 # define EVP_F_EVP_PKEY_KEYGEN                            146
 # define EVP_F_EVP_PKEY_KEYGEN_INIT                       147
 # define EVP_F_EVP_PKEY_NEW                               106
@@ -1644,6 +1683,9 @@ int ERR_load_EVP_strings(void);
 # define EVP_R_EXPECTING_A_DSA_KEY                        129
 # define EVP_R_EXPECTING_A_EC_KEY                         142
 # define EVP_R_EXPECTING_A_PAILLIER                       176
+# define EVP_R_EXPECTING_A_SM9_KEY                        180
+# define EVP_R_EXPECTING_A_SM9_MASTER_KEY                 181
+# define EVP_R_EXPECTING_A_SM9_MASTER_SECRET              179
 # define EVP_R_FIPS_MODE_NOT_SUPPORTED                    167
 # define EVP_R_ILLEGAL_SCRYPT_PARAMETERS                  171
 # define EVP_R_INITIALIZATION_ERROR                       134
--- a/include/openssl/obj_mac.h
+++ b/include/openssl/obj_mac.h
@@ -1072,7 +1072,7 @@

 #define SN_pbe_WithSM3AndSMS4_CBC               "PBE-SM3-SMS4"
 #define LN_pbe_WithSM3AndSMS4_CBC               "pbeWithSM3AndSMS4-CBC"
-#define NID_pbe_WithSM3AndSMS4_CBC              1195
+#define NID_pbe_WithSM3AndSMS4_CBC              1083
 #define OBJ_pbe_WithSM3AndSMS4_CBC              OBJ_pkcs12_pbeids,100L

 #define OBJ_pkcs12_Version1             OBJ_pkcs12,10L
@@ -4553,26 +4553,6 @@
 #define LN_kx_gost              "kx-gost"
 #define NID_kx_gost             1045

-#define SN_kx_sm2               "KxSM2"
-#define LN_kx_sm2               "kx-sm2"
-#define NID_kx_sm2              1186
-
-#define SN_kx_sm2dhe            "KxSM2DHE"
-#define LN_kx_sm2dhe            "kx-sm2dhe"
-#define NID_kx_sm2dhe           1190
-
-#define SN_kx_sm2_psk           "KxSM2-PSK"
-#define LN_kx_sm2_psk           "kx-sm2-psk"
-#define NID_kx_sm2_psk          1191
-
-#define SN_kx_sm9               "KxSM9"
-#define LN_kx_sm9               "kx-sm9"
-#define NID_kx_sm9              1188
-
-#define SN_kx_sm9dhe            "KxSM9DHE"
-#define LN_kx_sm9dhe            "kx-sm9dhe"
-#define NID_kx_sm9dhe           1192
-
 #define SN_auth_rsa             "AuthRSA"
 #define LN_auth_rsa             "auth-rsa"
 #define NID_auth_rsa            1046
@@ -4605,14 +4585,6 @@
 #define LN_auth_null            "auth-null"
 #define NID_auth_null           1053

-#define SN_auth_sm2             "AuthSM2"
-#define LN_auth_sm2             "auth-sm2"
-#define NID_auth_sm2            1187
-
-#define SN_auth_sm9             "AuthSM9"
-#define LN_auth_sm9             "auth-sm9"
-#define NID_auth_sm9            1189
-
 #define SN_ecies_recommendedParameters          "ecies-recommendedParameters"
 #define NID_ecies_recommendedParameters         1063
 #define OBJ_ecies_recommendedParameters         OBJ_secg_scheme,7L
@@ -4690,541 +4662,554 @@
 #define OBJ_cmac_aes256_ecies           OBJ_secg_scheme,24L,2L

 #define SN_ecies_with_x9_63_sha1_xor_hmac               "ecies-with-x9-63-sha1-xor-hmac"
-#define NID_ecies_with_x9_63_sha1_xor_hmac              1169
+#define NID_ecies_with_x9_63_sha1_xor_hmac              1084
 #define OBJ_ecies_with_x9_63_sha1_xor_hmac              OBJ_ecies_specifiedParameters,1L

 #define SN_ecies_with_x9_63_sha256_xor_hmac             "ecies-with-x9-63-sha256-xor-hmac"
-#define NID_ecies_with_x9_63_sha256_xor_hmac            1170
+#define NID_ecies_with_x9_63_sha256_xor_hmac            1085
 #define OBJ_ecies_with_x9_63_sha256_xor_hmac            OBJ_ecies_specifiedParameters,2L

 #define SN_ecies_with_x9_63_sha512_xor_hmac             "ecies-with-x9-63-sha512-xor-hmac"
-#define NID_ecies_with_x9_63_sha512_xor_hmac            1171
+#define NID_ecies_with_x9_63_sha512_xor_hmac            1086
 #define OBJ_ecies_with_x9_63_sha512_xor_hmac            OBJ_ecies_specifiedParameters,3L

 #define SN_ecies_with_x9_63_sha1_aes128_cbc_hmac                "ecies-with-x9-63-sha1-aes128-cbc-hmac"
-#define NID_ecies_with_x9_63_sha1_aes128_cbc_hmac               1172
+#define NID_ecies_with_x9_63_sha1_aes128_cbc_hmac               1087
 #define OBJ_ecies_with_x9_63_sha1_aes128_cbc_hmac               OBJ_ecies_specifiedParameters,4L

 #define SN_ecies_with_x9_63_sha256_aes128_cbc_hmac              "ecies-with-x9-63-sha256-aes128-cbc-hmac"
-#define NID_ecies_with_x9_63_sha256_aes128_cbc_hmac             1173
+#define NID_ecies_with_x9_63_sha256_aes128_cbc_hmac             1088
 #define OBJ_ecies_with_x9_63_sha256_aes128_cbc_hmac             OBJ_ecies_specifiedParameters,5L

 #define SN_ecies_with_x9_63_sha512_aes256_cbc_hmac              "ecies-with-x9-63-sha512-aes256-cbc-hmac"
-#define NID_ecies_with_x9_63_sha512_aes256_cbc_hmac             1174
+#define NID_ecies_with_x9_63_sha512_aes256_cbc_hmac             1089
 #define OBJ_ecies_with_x9_63_sha512_aes256_cbc_hmac             OBJ_ecies_specifiedParameters,6L

 #define SN_ecies_with_x9_63_sha256_aes128_ctr_hmac              "ecies-with-x9-63-sha256-aes128-ctr-hmac"
-#define NID_ecies_with_x9_63_sha256_aes128_ctr_hmac             1175
+#define NID_ecies_with_x9_63_sha256_aes128_ctr_hmac             1090
 #define OBJ_ecies_with_x9_63_sha256_aes128_ctr_hmac             OBJ_ecies_specifiedParameters,7L

 #define SN_ecies_with_x9_63_sha512_aes256_ctr_hmac              "ecies-with-x9-63-sha512-aes256-ctr-hmac"
-#define NID_ecies_with_x9_63_sha512_aes256_ctr_hmac             1176
+#define NID_ecies_with_x9_63_sha512_aes256_ctr_hmac             1091
 #define OBJ_ecies_with_x9_63_sha512_aes256_ctr_hmac             OBJ_ecies_specifiedParameters,8L

 #define SN_ecies_with_x9_63_sha256_aes128_cbc_hmac_half         "ecies-with-x9-63-sha256-aes128-cbc-hmac-half"
-#define NID_ecies_with_x9_63_sha256_aes128_cbc_hmac_half                1177
+#define NID_ecies_with_x9_63_sha256_aes128_cbc_hmac_half                1092
 #define OBJ_ecies_with_x9_63_sha256_aes128_cbc_hmac_half                OBJ_ecies_specifiedParameters,9L

 #define SN_ecies_with_x9_63_sha512_aes256_cbc_hmac_half         "ecies-with-x9-63-sha512-aes256-cbc-hmac-half"
-#define NID_ecies_with_x9_63_sha512_aes256_cbc_hmac_half                1178
+#define NID_ecies_with_x9_63_sha512_aes256_cbc_hmac_half                1093
 #define OBJ_ecies_with_x9_63_sha512_aes256_cbc_hmac_half                OBJ_ecies_specifiedParameters,10L

 #define SN_ecies_with_x9_63_sha256_aes128_ctr_hmac_half         "ecies-with-x9-63-sha256-aes128-ctr-hmac-half"
-#define NID_ecies_with_x9_63_sha256_aes128_ctr_hmac_half                1179
+#define NID_ecies_with_x9_63_sha256_aes128_ctr_hmac_half                1094
 #define OBJ_ecies_with_x9_63_sha256_aes128_ctr_hmac_half                OBJ_ecies_specifiedParameters,11L

 #define SN_ecies_with_x9_63_sha512_aes256_ctr_hmac_half         "ecies-with-x9-63-sha512-aes256-ctr-hmac-half"
-#define NID_ecies_with_x9_63_sha512_aes256_ctr_hmac_half                1180
+#define NID_ecies_with_x9_63_sha512_aes256_ctr_hmac_half                1095
 #define OBJ_ecies_with_x9_63_sha512_aes256_ctr_hmac_half                OBJ_ecies_specifiedParameters,12L

 #define SN_ecies_with_x9_63_sha1_aes128_cbc_cmac                "ecies-with-x9-63-sha1-aes128-cbc-cmac"
-#define NID_ecies_with_x9_63_sha1_aes128_cbc_cmac               1181
+#define NID_ecies_with_x9_63_sha1_aes128_cbc_cmac               1096
 #define OBJ_ecies_with_x9_63_sha1_aes128_cbc_cmac               OBJ_ecies_specifiedParameters,13L

 #define SN_ecies_with_x9_63_sha256_aes128_cbc_cmac              "ecies-with-x9-63-sha256-aes128-cbc-cmac"
-#define NID_ecies_with_x9_63_sha256_aes128_cbc_cmac             1182
+#define NID_ecies_with_x9_63_sha256_aes128_cbc_cmac             1097
 #define OBJ_ecies_with_x9_63_sha256_aes128_cbc_cmac             OBJ_ecies_specifiedParameters,14L

 #define SN_ecies_with_x9_63_sha512_aes256_cbc_cmac              "ecies-with-x9-63-sha512-aes256-cbc-cmac"
-#define NID_ecies_with_x9_63_sha512_aes256_cbc_cmac             1183
+#define NID_ecies_with_x9_63_sha512_aes256_cbc_cmac             1098
 #define OBJ_ecies_with_x9_63_sha512_aes256_cbc_cmac             OBJ_ecies_specifiedParameters,15L

 #define SN_ecies_with_x9_63_sha256_aes128_ctr_cmac              "ecies-with-x9-63-sha256-aes128-ctr-cmac"
-#define NID_ecies_with_x9_63_sha256_aes128_ctr_cmac             1184
+#define NID_ecies_with_x9_63_sha256_aes128_ctr_cmac             1099
 #define OBJ_ecies_with_x9_63_sha256_aes128_ctr_cmac             OBJ_ecies_specifiedParameters,16L

 #define SN_ecies_with_x9_63_sha512_aes256_ctr_cmac              "ecies-with-x9-63-sha512-aes256-ctr-cmac"
-#define NID_ecies_with_x9_63_sha512_aes256_ctr_cmac             1185
+#define NID_ecies_with_x9_63_sha512_aes256_ctr_cmac             1100
 #define OBJ_ecies_with_x9_63_sha512_aes256_ctr_cmac             OBJ_ecies_specifiedParameters,17L

+#define OBJ_ibcs                OBJ_ISO_US,1L,114334L,1L
+
+#define SN_ibcs1                "ibcs1"
+#define NID_ibcs1               1101
+#define OBJ_ibcs1               OBJ_ibcs,1L
+
+#define SN_type1curve           "type1curve"
+#define NID_type1curve          1102
+#define OBJ_type1curve          OBJ_ibcs1,1L,1L
+
+#define SN_bfibe                "bfibe"
+#define NID_bfibe               1103
+#define OBJ_bfibe               OBJ_ibcs1,2L,1L
+
+#define SN_bb1ibe               "bb1ibe"
+#define NID_bb1ibe              1104
+#define OBJ_bb1ibe              OBJ_ibcs1,2L,2L
+
 #define SN_ISO_CN               "ISO-CN"
 #define LN_ISO_CN               "ISO CN Member Body"
-#define NID_ISO_CN              1083
+#define NID_ISO_CN              1105
 #define OBJ_ISO_CN              OBJ_member_body,156L

 #define SN_oscca                "oscca"
-#define NID_oscca               1084
+#define NID_oscca               1106
 #define OBJ_oscca               OBJ_ISO_CN,10197L

 #define SN_sm_scheme            "sm-scheme"
-#define NID_sm_scheme           1085
+#define NID_sm_scheme           1107
 #define OBJ_sm_scheme           OBJ_oscca,1L

-#define SN_sm6_ecb              "SM6-ECB"
-#define LN_sm6_ecb              "sm6-ecb"
-#define NID_sm6_ecb             1086
-#define OBJ_sm6_ecb             OBJ_sm_scheme,101L,1L
-
-#define SN_sm6_cbc              "SM6-CBC"
-#define LN_sm6_cbc              "sm6-cbc"
-#define NID_sm6_cbc             1087
-#define OBJ_sm6_cbc             OBJ_sm_scheme,101L,2L
-
-#define SN_sm6_ofb128           "SM6-OFB"
-#define LN_sm6_ofb128           "sm6-ofb"
-#define NID_sm6_ofb128          1088
-#define OBJ_sm6_ofb128          OBJ_sm_scheme,101L,3L
-
-#define SN_sm6_cfb128           "SM6-CFB"
-#define LN_sm6_cfb128           "sm6-cfb"
-#define NID_sm6_cfb128          1089
-#define OBJ_sm6_cfb128          OBJ_sm_scheme,101L,4L
-
-#define SN_sm1_ecb              "SM1-ECB"
-#define LN_sm1_ecb              "sm1-ecb"
-#define NID_sm1_ecb             1090
-#define OBJ_sm1_ecb             OBJ_sm_scheme,102L,1L
-
-#define SN_sm1_cbc              "SM1-CBC"
-#define LN_sm1_cbc              "sm1-cbc"
-#define NID_sm1_cbc             1091
-#define OBJ_sm1_cbc             OBJ_sm_scheme,102L,2L
-
-#define SN_sm1_ofb128           "SM1-OFB"
-#define LN_sm1_ofb128           "sm1-ofb"
-#define NID_sm1_ofb128          1092
-#define OBJ_sm1_ofb128          OBJ_sm_scheme,102L,3L
-
-#define SN_sm1_cfb128           "SM1-CFB"
-#define LN_sm1_cfb128           "sm1-cfb"
-#define NID_sm1_cfb128          1093
-#define OBJ_sm1_cfb128          OBJ_sm_scheme,102L,4L
-
-#define SN_sm1_cfb1             "SM1-CFB1"
-#define LN_sm1_cfb1             "sm1-cfb1"
-#define NID_sm1_cfb1            1094
-#define OBJ_sm1_cfb1            OBJ_sm_scheme,102L,5L
-
-#define SN_sm1_cfb8             "SM1-CFB8"
-#define LN_sm1_cfb8             "sm1-cfb8"
-#define NID_sm1_cfb8            1095
-#define OBJ_sm1_cfb8            OBJ_sm_scheme,102L,6L
-
 #define SN_ssf33_ecb            "SSF33-ECB"
 #define LN_ssf33_ecb            "ssf33-ecb"
-#define NID_ssf33_ecb           1096
+#define NID_ssf33_ecb           1108
 #define OBJ_ssf33_ecb           OBJ_sm_scheme,103L,1L

 #define SN_ssf33_cbc            "SSF33-CBC"
 #define LN_ssf33_cbc            "ssf33-cbc"
-#define NID_ssf33_cbc           1097
+#define NID_ssf33_cbc           1109
 #define OBJ_ssf33_cbc           OBJ_sm_scheme,103L,2L

 #define SN_ssf33_ofb128         "SSF33-OFB"
 #define LN_ssf33_ofb128         "ssf33-ofb"
-#define NID_ssf33_ofb128                1098
+#define NID_ssf33_ofb128                1110
 #define OBJ_ssf33_ofb128                OBJ_sm_scheme,103L,3L

 #define SN_ssf33_cfb128         "SSF33-CFB"
 #define LN_ssf33_cfb128         "ssf33-cfb"
-#define NID_ssf33_cfb128                1099
+#define NID_ssf33_cfb128                1111
 #define OBJ_ssf33_cfb128                OBJ_sm_scheme,103L,4L

 #define SN_ssf33_cfb1           "SSF33-CFB1"
 #define LN_ssf33_cfb1           "ssf33-cfb1"
-#define NID_ssf33_cfb1          1100
+#define NID_ssf33_cfb1          1112
 #define OBJ_ssf33_cfb1          OBJ_sm_scheme,103L,5L

 #define SN_ssf33_cfb8           "SSF33-CFB8"
 #define LN_ssf33_cfb8           "ssf33-cfb8"
-#define NID_ssf33_cfb8          1101
+#define NID_ssf33_cfb8          1113
 #define OBJ_ssf33_cfb8          OBJ_sm_scheme,103L,6L

+#define SN_ssf33_cbc_mac                "SSF33-CBC-MAC"
+#define LN_ssf33_cbc_mac                "ssf33-cbc-mac"
+#define NID_ssf33_cbc_mac               1114
+#define OBJ_ssf33_cbc_mac               OBJ_sm_scheme,103L,7L
+
+#define SN_sm1_ecb              "SM1-ECB"
+#define LN_sm1_ecb              "sm1-ecb"
+#define NID_sm1_ecb             1115
+#define OBJ_sm1_ecb             OBJ_sm_scheme,102L,1L
+
+#define SN_sm1_cbc              "SM1-CBC"
+#define LN_sm1_cbc              "sm1-cbc"
+#define NID_sm1_cbc             1116
+#define OBJ_sm1_cbc             OBJ_sm_scheme,102L,2L
+
+#define SN_sm1_ofb128           "SM1-OFB"
+#define LN_sm1_ofb128           "sm1-ofb"
+#define NID_sm1_ofb128          1117
+#define OBJ_sm1_ofb128          OBJ_sm_scheme,102L,3L
+
+#define SN_sm1_cfb128           "SM1-CFB"
+#define LN_sm1_cfb128           "sm1-cfb"
+#define NID_sm1_cfb128          1118
+#define OBJ_sm1_cfb128          OBJ_sm_scheme,102L,4L
+
+#define SN_sm1_cfb1             "SM1-CFB1"
+#define LN_sm1_cfb1             "sm1-cfb1"
+#define NID_sm1_cfb1            1119
+#define OBJ_sm1_cfb1            OBJ_sm_scheme,102L,5L
+
+#define SN_sm1_cfb8             "SM1-CFB8"
+#define LN_sm1_cfb8             "sm1-cfb8"
+#define NID_sm1_cfb8            1120
+#define OBJ_sm1_cfb8            OBJ_sm_scheme,102L,6L
+
+#define SN_sm2p256v1            "sm2p256v1"
+#define NID_sm2p256v1           1121
+#define OBJ_sm2p256v1           OBJ_sm_scheme,301L
+
+#define SN_sm2sign              "sm2sign"
+#define NID_sm2sign             1122
+#define OBJ_sm2sign             OBJ_sm_scheme,301L,1L
+
+#define SN_sm2exchange          "sm2exchange"
+#define NID_sm2exchange         1123
+#define OBJ_sm2exchange         OBJ_sm_scheme,301L,2L
+
+#define SN_sm2encrypt           "sm2encrypt"
+#define NID_sm2encrypt          1124
+#define OBJ_sm2encrypt          OBJ_sm_scheme,301L,3L
+
+#define SN_sm2sign_with_sm3             "SM2Sign-with-SM3"
+#define LN_sm2sign_with_sm3             "sm2sign-with-sm3"
+#define NID_sm2sign_with_sm3            1125
+#define OBJ_sm2sign_with_sm3            OBJ_sm_scheme,501L
+
+#define SN_sm2sign_with_sha1            "SM2Sign-with-SHA1"
+#define LN_sm2sign_with_sha1            "sm2sign-with-sha1"
+#define NID_sm2sign_with_sha1           1126
+#define OBJ_sm2sign_with_sha1           OBJ_sm_scheme,502L
+
+#define SN_sm2sign_with_sha256          "SM2Sign-with-SHA256"
+#define LN_sm2sign_with_sha256          "sm2sign-with-sha256"
+#define NID_sm2sign_with_sha256         1127
+#define OBJ_sm2sign_with_sha256         OBJ_sm_scheme,503L
+
+#define SN_sm2sign_with_sha512          "SM2Sign-with-SHA511"
+#define LN_sm2sign_with_sha512          "sm2sign-with-sha512"
+#define NID_sm2sign_with_sha512         1128
+#define OBJ_sm2sign_with_sha512         OBJ_sm_scheme,504L
+
+#define SN_sm2sign_with_sha224          "SM2Sign-with-SHA224"
+#define LN_sm2sign_with_sha224          "sm2sign-with-sha224"
+#define NID_sm2sign_with_sha224         1129
+#define OBJ_sm2sign_with_sha224         OBJ_sm_scheme,505L
+
+#define SN_sm2sign_with_sha384          "SM2Sign-with-SHA384"
+#define LN_sm2sign_with_sha384          "sm2sign-with-sha384"
+#define NID_sm2sign_with_sha384         1130
+#define OBJ_sm2sign_with_sha384         OBJ_sm_scheme,506L
+
+#define SN_sm2sign_with_rmd160          "SM2Sign-with-RMD160"
+#define LN_sm2sign_with_rmd160          "sm2sign-with-rmd160"
+#define NID_sm2sign_with_rmd160         1131
+#define OBJ_sm2sign_with_rmd160         OBJ_sm_scheme,507L
+
+#define SN_sm2sign_with_whirlpool               "SM2Sign-with-Whirlpool"
+#define LN_sm2sign_with_whirlpool               "sm2sign-with-whirlpool"
+#define NID_sm2sign_with_whirlpool              1132
+#define OBJ_sm2sign_with_whirlpool              OBJ_sm_scheme,520L
+
+#define SN_sm2sign_with_blake2b512              "SM2Sign-with-Blake2b512"
+#define LN_sm2sign_with_blake2b512              "sm2sign-with-blake2b512"
+#define NID_sm2sign_with_blake2b512             1133
+#define OBJ_sm2sign_with_blake2b512             OBJ_sm_scheme,521L
+
+#define SN_sm2sign_with_blake2s256              "SM2Sign-with-Blake2s256"
+#define LN_sm2sign_with_blake2s256              "sm2sign-with-blake2s256"
+#define NID_sm2sign_with_blake2s256             1134
+#define OBJ_sm2sign_with_blake2s256             OBJ_sm_scheme,522L
+
+#define SN_sm2encrypt_recommendedParameters             "sm2encrypt-recommendedParameters"
+#define NID_sm2encrypt_recommendedParameters            1135
+#define OBJ_sm2encrypt_recommendedParameters            OBJ_sm2encrypt,1L
+
+#define SN_sm2encrypt_specifiedParameters               "sm2encrypt-specifiedParameters"
+#define NID_sm2encrypt_specifiedParameters              1136
+#define OBJ_sm2encrypt_specifiedParameters              OBJ_sm2encrypt,2L
+
+#define SN_sm2encrypt_with_sm3          "sm2encrypt-with-sm3"
+#define NID_sm2encrypt_with_sm3         1137
+#define OBJ_sm2encrypt_with_sm3         OBJ_sm2encrypt,2L,1L
+
+#define SN_sm2encrypt_with_sha1         "sm2encrypt-with-sha1"
+#define NID_sm2encrypt_with_sha1                1138
+#define OBJ_sm2encrypt_with_sha1                OBJ_sm2encrypt,2L,2L
+
+#define SN_sm2encrypt_with_sha224               "sm2encrypt-with-sha224"
+#define NID_sm2encrypt_with_sha224              1139
+#define OBJ_sm2encrypt_with_sha224              OBJ_sm2encrypt,2L,3L
+
+#define SN_sm2encrypt_with_sha256               "sm2encrypt-with-sha256"
+#define NID_sm2encrypt_with_sha256              1140
+#define OBJ_sm2encrypt_with_sha256              OBJ_sm2encrypt,2L,4L
+
+#define SN_sm2encrypt_with_sha384               "sm2encrypt-with-sha384"
+#define NID_sm2encrypt_with_sha384              1141
+#define OBJ_sm2encrypt_with_sha384              OBJ_sm2encrypt,2L,5L
+
+#define SN_sm2encrypt_with_sha512               "sm2encrypt-with-sha512"
+#define NID_sm2encrypt_with_sha512              1142
+#define OBJ_sm2encrypt_with_sha512              OBJ_sm2encrypt,2L,6L
+
+#define SN_sm2encrypt_with_rmd160               "sm2encrypt-with-rmd160"
+#define NID_sm2encrypt_with_rmd160              1143
+#define OBJ_sm2encrypt_with_rmd160              OBJ_sm2encrypt,2L,7L
+
+#define SN_sm2encrypt_with_whirlpool            "sm2encrypt-with-whirlpool"
+#define NID_sm2encrypt_with_whirlpool           1144
+#define OBJ_sm2encrypt_with_whirlpool           OBJ_sm2encrypt,2L,8L
+
+#define SN_sm2encrypt_with_blake2b512           "sm2encrypt-with-blake2b512"
+#define NID_sm2encrypt_with_blake2b512          1145
+#define OBJ_sm2encrypt_with_blake2b512          OBJ_sm2encrypt,2L,9L
+
+#define SN_sm2encrypt_with_blake2s256           "sm2encrypt-with-blake2s256"
+#define NID_sm2encrypt_with_blake2s256          1146
+#define OBJ_sm2encrypt_with_blake2s256          OBJ_sm2encrypt,2L,10L
+
+#define SN_sm2encrypt_with_md5          "sm2encrypt-with-md5"
+#define NID_sm2encrypt_with_md5         1147
+#define OBJ_sm2encrypt_with_md5         OBJ_sm2encrypt,2L,11L
+
+#define SN_sm3          "SM3"
+#define LN_sm3          "sm3"
+#define NID_sm3         1148
+#define OBJ_sm3         OBJ_sm_scheme,401L
+
+#define SN_hmac_sm3             "HMAC-SM3"
+#define LN_hmac_sm3             "hmac-sm3"
+#define NID_hmac_sm3            1149
+#define OBJ_hmac_sm3            OBJ_sm_scheme,401L,2L
+
 #define SN_sms4_ecb             "SMS4-ECB"
 #define LN_sms4_ecb             "sms4-ecb"
-#define NID_sms4_ecb            1102
+#define NID_sms4_ecb            1150
 #define OBJ_sms4_ecb            OBJ_sm_scheme,104L,1L

 #define SN_sms4_cbc             "SMS4-CBC"
 #define LN_sms4_cbc             "sms4-cbc"
-#define NID_sms4_cbc            1103
+#define NID_sms4_cbc            1151
 #define OBJ_sms4_cbc            OBJ_sm_scheme,104L,2L

 #define SN_sms4_ofb128          "SMS4-OFB"
 #define LN_sms4_ofb128          "sms4-ofb"
-#define NID_sms4_ofb128         1104
+#define NID_sms4_ofb128         1152
 #define OBJ_sms4_ofb128         OBJ_sm_scheme,104L,3L

 #define SN_sms4_cfb128          "SMS4-CFB"
 #define LN_sms4_cfb128          "sms4-cfb"
-#define NID_sms4_cfb128         1105
+#define NID_sms4_cfb128         1153
 #define OBJ_sms4_cfb128         OBJ_sm_scheme,104L,4L

 #define SN_sms4_cfb1            "SMS4-CFB1"
 #define LN_sms4_cfb1            "sms4-cfb1"
-#define NID_sms4_cfb1           1106
+#define NID_sms4_cfb1           1154
 #define OBJ_sms4_cfb1           OBJ_sm_scheme,104L,5L

 #define SN_sms4_cfb8            "SMS4-CFB8"
 #define LN_sms4_cfb8            "sms4-cfb8"
-#define NID_sms4_cfb8           1107
+#define NID_sms4_cfb8           1155
 #define OBJ_sms4_cfb8           OBJ_sm_scheme,104L,6L

 #define SN_sms4_ctr             "SMS4-CTR"
 #define LN_sms4_ctr             "sms4-ctr"
-#define NID_sms4_ctr            1108
+#define NID_sms4_ctr            1156
 #define OBJ_sms4_ctr            OBJ_sm_scheme,104L,7L

 #define SN_sms4_gcm             "SMS4-GCM"
 #define LN_sms4_gcm             "sms4-gcm"
-#define NID_sms4_gcm            1109
+#define NID_sms4_gcm            1157
 #define OBJ_sms4_gcm            OBJ_sm_scheme,104L,8L

 #define SN_sms4_ccm             "SMS4-CCM"
 #define LN_sms4_ccm             "sms4-ccm"
-#define NID_sms4_ccm            1110
+#define NID_sms4_ccm            1158
 #define OBJ_sms4_ccm            OBJ_sm_scheme,104L,9L

 #define SN_sms4_xts             "SMS4-XTS"
 #define LN_sms4_xts             "sms4-xts"
-#define NID_sms4_xts            1111
+#define NID_sms4_xts            1159
 #define OBJ_sms4_xts            OBJ_sm_scheme,104L,10L

 #define SN_sms4_wrap            "SMS4-WRAP"
 #define LN_sms4_wrap            "sms4-wrap"
-#define NID_sms4_wrap           1112
+#define NID_sms4_wrap           1160
 #define OBJ_sms4_wrap           OBJ_sm_scheme,104L,11L

 #define SN_sms4_wrap_pad                "SMS4-WRAP-PAD"
 #define LN_sms4_wrap_pad                "sms4-wrap-pad"
-#define NID_sms4_wrap_pad               1113
+#define NID_sms4_wrap_pad               1161
 #define OBJ_sms4_wrap_pad               OBJ_sm_scheme,104L,12L

 #define SN_sms4_ocb             "SMS4-OCB"
 #define LN_sms4_ocb             "sms4-ocb"
-#define NID_sms4_ocb            1114
+#define NID_sms4_ocb            1162
 #define OBJ_sms4_ocb            OBJ_sm_scheme,104L,100L

+#define SN_sm5          "SM5"
+#define LN_sm5          "sm5"
+#define NID_sm5         1163
+#define OBJ_sm5         OBJ_sm_scheme,201L
+
+#define SN_sm6_ecb              "SM6-ECB"
+#define LN_sm6_ecb              "sm6-ecb"
+#define NID_sm6_ecb             1164
+#define OBJ_sm6_ecb             OBJ_sm_scheme,101L,1L
+
+#define SN_sm6_cbc              "SM6-CBC"
+#define LN_sm6_cbc              "sm6-cbc"
+#define NID_sm6_cbc             1165
+#define OBJ_sm6_cbc             OBJ_sm_scheme,101L,2L
+
+#define SN_sm6_ofb128           "SM6-OFB"
+#define LN_sm6_ofb128           "sm6-ofb"
+#define NID_sm6_ofb128          1166
+#define OBJ_sm6_ofb128          OBJ_sm_scheme,101L,3L
+
+#define SN_sm6_cfb128           "SM6-CFB"
+#define LN_sm6_cfb128           "sm6-cfb"
+#define NID_sm6_cfb128          1167
+#define OBJ_sm6_cfb128          OBJ_sm_scheme,101L,4L
+
 #define OBJ_sm7         OBJ_sm_scheme,105L

 #define OBJ_sm8         OBJ_sm_scheme,106L

-#define SN_sm5          "SM5"
-#define LN_sm5          "sm5"
-#define NID_sm5         1115
-#define OBJ_sm5         OBJ_sm_scheme,201L
-
-#define SN_sm2p256v1            "sm2p256v1"
-#define NID_sm2p256v1           1116
-#define OBJ_sm2p256v1           OBJ_sm_scheme,301L
-
-#define SN_sm2sign              "sm2sign"
-#define NID_sm2sign             1117
-#define OBJ_sm2sign             OBJ_sm_scheme,301L,1L
-
-#define SN_sm2exchange          "sm2exchange"
-#define NID_sm2exchange         1149
-#define OBJ_sm2exchange         OBJ_sm_scheme,301L,2L
-
-#define SN_sm2encrypt           "sm2encrypt"
-#define NID_sm2encrypt          1119
-#define OBJ_sm2encrypt          OBJ_sm_scheme,301L,3L
-
-#define SN_sm2encrypt_recommendedParameters             "sm2encrypt-recommendedParameters"
-#define NID_sm2encrypt_recommendedParameters            1120
-#define OBJ_sm2encrypt_recommendedParameters            OBJ_sm2encrypt,1L
-
-#define SN_sm2encrypt_specifiedParameters               "sm2encrypt-specifiedParameters"
-#define NID_sm2encrypt_specifiedParameters              1121
-#define OBJ_sm2encrypt_specifiedParameters              OBJ_sm2encrypt,2L
-
-#define SN_sm2encrypt_with_sm3          "sm2encrypt-with-sm3"
-#define NID_sm2encrypt_with_sm3         1155
-#define OBJ_sm2encrypt_with_sm3         OBJ_sm2encrypt,2L,1L
-
-#define SN_sm2encrypt_with_sha1         "sm2encrypt-with-sha1"
-#define NID_sm2encrypt_with_sha1                1156
-#define OBJ_sm2encrypt_with_sha1                OBJ_sm2encrypt,2L,2L
-
-#define SN_sm2encrypt_with_sha224               "sm2encrypt-with-sha224"
-#define NID_sm2encrypt_with_sha224              1157
-#define OBJ_sm2encrypt_with_sha224              OBJ_sm2encrypt,2L,3L
-
-#define SN_sm2encrypt_with_sha256               "sm2encrypt-with-sha256"
-#define NID_sm2encrypt_with_sha256              1158
-#define OBJ_sm2encrypt_with_sha256              OBJ_sm2encrypt,2L,4L
-
-#define SN_sm2encrypt_with_sha384               "sm2encrypt-with-sha384"
-#define NID_sm2encrypt_with_sha384              1159
-#define OBJ_sm2encrypt_with_sha384              OBJ_sm2encrypt,2L,5L
-
-#define SN_sm2encrypt_with_sha512               "sm2encrypt-with-sha512"
-#define NID_sm2encrypt_with_sha512              1160
-#define OBJ_sm2encrypt_with_sha512              OBJ_sm2encrypt,2L,6L
-
-#define SN_sm2encrypt_with_rmd160               "sm2encrypt-with-rmd160"
-#define NID_sm2encrypt_with_rmd160              1161
-#define OBJ_sm2encrypt_with_rmd160              OBJ_sm2encrypt,2L,7L
-
-#define SN_sm2encrypt_with_whirlpool            "sm2encrypt-with-whirlpool"
-#define NID_sm2encrypt_with_whirlpool           1162
-#define OBJ_sm2encrypt_with_whirlpool           OBJ_sm2encrypt,2L,8L
-
-#define SN_sm2encrypt_with_blake2b512           "sm2encrypt-with-blake2b512"
-#define NID_sm2encrypt_with_blake2b512          1163
-#define OBJ_sm2encrypt_with_blake2b512          OBJ_sm2encrypt,2L,9L
-
-#define SN_sm2encrypt_with_blake2s256           "sm2encrypt-with-blake2s256"
-#define NID_sm2encrypt_with_blake2s256          1164
-#define OBJ_sm2encrypt_with_blake2s256          OBJ_sm2encrypt,2L,10L
-
-#define SN_sm2encrypt_with_md5          "sm2encrypt-with-md5"
-#define NID_sm2encrypt_with_md5         1165
-#define OBJ_sm2encrypt_with_md5         OBJ_sm2encrypt,2L,11L
-
 #define SN_id_sm9PublicKey              "id-sm9PublicKey"
-#define NID_id_sm9PublicKey             1122
+#define NID_id_sm9PublicKey             1168
 #define OBJ_id_sm9PublicKey             OBJ_sm_scheme,302L

 #define SN_sm9sign              "sm9sign"
-#define NID_sm9sign             1123
+#define NID_sm9sign             1169
 #define OBJ_sm9sign             OBJ_sm_scheme,302L,1L

-#define SN_sm9sign_with_sm3             "sm9sign-with-sm3"
-#define NID_sm9sign_with_sm3            1204
-#define OBJ_sm9sign_with_sm3            OBJ_sm9sign,1L
-
-#define SN_sm9sign_with_sha256          "sm9sign-with-sha256"
-#define NID_sm9sign_with_sha256         1205
-#define OBJ_sm9sign_with_sha256         OBJ_sm9sign,2L
-
 #define SN_sm9keyagreement              "sm9keyagreement"
-#define NID_sm9keyagreement             1124
+#define NID_sm9keyagreement             1170
 #define OBJ_sm9keyagreement             OBJ_sm_scheme,302L,2L

 #define SN_sm9encrypt           "sm9encrypt"
-#define NID_sm9encrypt          1125
+#define NID_sm9encrypt          1171
 #define OBJ_sm9encrypt          OBJ_sm_scheme,302L,3L

-#define SN_sm9encrypt_with_sm3_xor              "sm9encrypt-with-sm3-xor"
-#define NID_sm9encrypt_with_sm3_xor             1206
-#define OBJ_sm9encrypt_with_sm3_xor             OBJ_sm9encrypt,1L
-
-#define SN_sm9encrypt_with_sm3_sms4_cbc         "sm9encrypt-with-sm3-sms4-cbc"
-#define NID_sm9encrypt_with_sm3_sms4_cbc                1207
-#define OBJ_sm9encrypt_with_sm3_sms4_cbc                OBJ_sm9encrypt,2L
-
-#define SN_sm9encrypt_with_sm3_sms4_ctr         "sm9encrypt-with-sm3-sms4-ctr"
-#define NID_sm9encrypt_with_sm3_sms4_ctr                1208
-#define OBJ_sm9encrypt_with_sm3_sms4_ctr                OBJ_sm9encrypt,3L
-
 #define SN_sm9hash1             "sm9hash1"
-#define NID_sm9hash1            1201
+#define NID_sm9hash1            1172
 #define OBJ_sm9hash1            OBJ_sm_scheme,302L,4L

 #define SN_sm9kdf               "sm9kdf"
-#define NID_sm9kdf              1209
+#define NID_sm9kdf              1173
 #define OBJ_sm9kdf              OBJ_sm_scheme,302L,5L

+#define SN_id_sm9MasterSecret           "id-sm9MasterSecret"
+#define NID_id_sm9MasterSecret          1174
+#define OBJ_id_sm9MasterSecret          OBJ_sm_scheme,302L,6L
+
+#define SN_sm9bn256v1           "sm9bn256v1"
+#define NID_sm9bn256v1          1175
+#define OBJ_sm9bn256v1          OBJ_sm_scheme,302L,6L,1L
+
+#define SN_sm9sign_with_sm3             "sm9sign-with-sm3"
+#define NID_sm9sign_with_sm3            1176
+#define OBJ_sm9sign_with_sm3            OBJ_sm9sign,1L
+
+#define SN_sm9sign_with_sha256          "sm9sign-with-sha256"
+#define NID_sm9sign_with_sha256         1177
+#define OBJ_sm9sign_with_sha256         OBJ_sm9sign,2L
+
+#define SN_sm9encrypt_with_sm3_xor              "sm9encrypt-with-sm3-xor"
+#define NID_sm9encrypt_with_sm3_xor             1178
+#define OBJ_sm9encrypt_with_sm3_xor             OBJ_sm9encrypt,1L
+
+#define SN_sm9encrypt_with_sm3_sms4_cbc         "sm9encrypt-with-sm3-sms4-cbc"
+#define NID_sm9encrypt_with_sm3_sms4_cbc                1179
+#define OBJ_sm9encrypt_with_sm3_sms4_cbc                OBJ_sm9encrypt,2L
+
+#define SN_sm9encrypt_with_sm3_sms4_ctr         "sm9encrypt-with-sm3-sms4-ctr"
+#define NID_sm9encrypt_with_sm3_sms4_ctr                1180
+#define OBJ_sm9encrypt_with_sm3_sms4_ctr                OBJ_sm9encrypt,3L
+
 #define SN_sm9hash1_with_sm3            "sm9hash1-with-sm3"
-#define NID_sm9hash1_with_sm3           1202
+#define NID_sm9hash1_with_sm3           1181
 #define OBJ_sm9hash1_with_sm3           OBJ_sm9hash1,1L

 #define SN_sm9hash1_with_sha256         "sm9hash1-with-sha256"
-#define NID_sm9hash1_with_sha256                1203
+#define NID_sm9hash1_with_sha256                1182
 #define OBJ_sm9hash1_with_sha256                OBJ_sm9hash1,2L

 #define SN_sm9kdf_with_sm3              "sm9kdf-with-sm3"
-#define NID_sm9kdf_with_sm3             1210
+#define NID_sm9kdf_with_sm3             1183
 #define OBJ_sm9kdf_with_sm3             OBJ_sm9kdf,1L

 #define SN_sm9kdf_with_sha256           "sm9kdf-with-sha256"
-#define NID_sm9kdf_with_sha256          1211
+#define NID_sm9kdf_with_sha256          1184
 #define OBJ_sm9kdf_with_sha256          OBJ_sm9kdf,2L

-#define SN_sm3          "SM3"
-#define LN_sm3          "sm3"
-#define NID_sm3         1126
-#define OBJ_sm3         OBJ_sm_scheme,401L
-
-#define SN_hmac_sm3             "HMAC-SM3"
-#define LN_hmac_sm3             "hmac-sm3"
-#define NID_hmac_sm3            1127
-#define OBJ_hmac_sm3            OBJ_sm_scheme,401L,2L
-
-#define SN_sm2sign_with_sm3             "SM2Sign-with-SM3"
-#define LN_sm2sign_with_sm3             "sm2sign-with-sm3"
-#define NID_sm2sign_with_sm3            1128
-#define OBJ_sm2sign_with_sm3            OBJ_sm_scheme,501L
-
-#define SN_sm2sign_with_sha1            "SM2Sign-with-SHA1"
-#define LN_sm2sign_with_sha1            "sm2sign-with-sha1"
-#define NID_sm2sign_with_sha1           1129
-#define OBJ_sm2sign_with_sha1           OBJ_sm_scheme,502L
-
-#define SN_sm2sign_with_sha256          "SM2Sign-with-SHA256"
-#define LN_sm2sign_with_sha256          "sm2sign-with-sha256"
-#define NID_sm2sign_with_sha256         1130
-#define OBJ_sm2sign_with_sha256         OBJ_sm_scheme,503L
-
-#define SN_sm2sign_with_sha512          "SM2Sign-with-SHA511"
-#define LN_sm2sign_with_sha512          "sm2sign-with-sha512"
-#define NID_sm2sign_with_sha512         1131
-#define OBJ_sm2sign_with_sha512         OBJ_sm_scheme,504L
-
-#define SN_sm2sign_with_sha224          "SM2Sign-with-SHA224"
-#define LN_sm2sign_with_sha224          "sm2sign-with-sha224"
-#define NID_sm2sign_with_sha224         1132
-#define OBJ_sm2sign_with_sha224         OBJ_sm_scheme,505L
-
-#define SN_sm2sign_with_sha384          "SM2Sign-with-SHA384"
-#define LN_sm2sign_with_sha384          "sm2sign-with-sha384"
-#define NID_sm2sign_with_sha384         1133
-#define OBJ_sm2sign_with_sha384         OBJ_sm_scheme,506L
-
-#define SN_sm2sign_with_rmd160          "SM2Sign-with-RMD160"
-#define LN_sm2sign_with_rmd160          "sm2sign-with-rmd160"
-#define NID_sm2sign_with_rmd160         1134
-#define OBJ_sm2sign_with_rmd160         OBJ_sm_scheme,507L
-
-#define SN_sm2sign_with_whirlpool               "SM2Sign-with-Whirlpool"
-#define LN_sm2sign_with_whirlpool               "sm2sign-with-whirlpool"
-#define NID_sm2sign_with_whirlpool              1166
-#define OBJ_sm2sign_with_whirlpool              OBJ_sm_scheme,520L
-
-#define SN_sm2sign_with_blake2b512              "SM2Sign-with-Blake2b512"
-#define LN_sm2sign_with_blake2b512              "sm2sign-with-blake2b512"
-#define NID_sm2sign_with_blake2b512             1167
-#define OBJ_sm2sign_with_blake2b512             OBJ_sm_scheme,521L
-
-#define SN_sm2sign_with_blake2s256              "SM2Sign-with-Blake2s256"
-#define LN_sm2sign_with_blake2s256              "sm2sign-with-blake2s256"
-#define NID_sm2sign_with_blake2s256             1168
-#define OBJ_sm2sign_with_blake2s256             OBJ_sm_scheme,522L
-
 #define SN_zuc          "ZUC"
 #define LN_zuc          "zuc"
-#define NID_zuc         1136
+#define NID_zuc         1185
 #define OBJ_zuc         OBJ_sm_scheme,800L

 #define SN_zuc_128eea3          "zuc-128eea3"
-#define NID_zuc_128eea3         1193
+#define NID_zuc_128eea3         1186
 #define OBJ_zuc_128eea3         OBJ_zuc,1L

 #define SN_zuc_128eia3          "zuc-128eia3"
-#define NID_zuc_128eia3         1194
+#define NID_zuc_128eia3         1187
 #define OBJ_zuc_128eia3         OBJ_zuc,2L

-#define OBJ_ibcs1               OBJ_ISO_US,1L,114334L,1L
+#define SN_bwips                "bwips"
+#define NID_bwips               1188
+#define OBJ_bwips               OBJ_ISO_CN,11235L

-#define SN_bfibe                "bfibe"
-#define NID_bfibe               1137
-#define OBJ_bfibe               OBJ_ibcs1,2L,1L
+#define SN_wapi_crypto          "wapi-crypto"
+#define NID_wapi_crypto         1189
+#define OBJ_wapi_crypto         OBJ_bwips,1L

-#define SN_bb1          "bb1"
-#define NID_bb1         1138
-#define OBJ_bb1         OBJ_ibcs1,2L,2L
+#define SN_wapi_ec              "wapi-ec"
+#define NID_wapi_ec             1190
+#define OBJ_wapi_ec             OBJ_wapi_crypto,1L

-#define SN_type1curve           "type1curve"
-#define NID_type1curve          1139
-#define OBJ_type1curve          OBJ_ibcs1,1L,1L
+#define SN_wapi_ecdsa192_sha256         "wapi-ecdsa192-sha256"
+#define NID_wapi_ecdsa192_sha256                1191
+#define OBJ_wapi_ecdsa192_sha256                OBJ_wapi_ec,1L

-#define SN_type2curve           "type2curve"
-#define NID_type2curve          1140
-#define OBJ_type2curve          OBJ_ibcs1,1L,2L
+#define SN_wapip192v1           "wapip192v1"
+#define NID_wapip192v1          1192
+#define OBJ_wapip192v1          OBJ_wapi_ec,2L,1L

-#define SN_type3curve           "type3curve"
-#define NID_type3curve          1141
-#define OBJ_type3curve          OBJ_ibcs1,1L,3L
+#define SN_kx_sm2               "KxSM2"
+#define LN_kx_sm2               "kx-sm2"
+#define NID_kx_sm2              1193

-#define SN_type4curve           "type4curve"
-#define NID_type4curve          1142
-#define OBJ_type4curve          OBJ_ibcs1,1L,4L
+#define SN_kx_sm2dhe            "KxSM2DHE"
+#define LN_kx_sm2dhe            "kx-sm2dhe"
+#define NID_kx_sm2dhe           1194

-#define SN_tate_pairing         "tate-pairing"
-#define NID_tate_pairing                1143
-#define OBJ_tate_pairing                OBJ_ibcs1,3L,1L
+#define SN_kx_sm2_psk           "KxSM2-PSK"
+#define LN_kx_sm2_psk           "kx-sm2-psk"
+#define NID_kx_sm2_psk          1195

-#define SN_weil_pairing         "weil-pairing"
-#define NID_weil_pairing                1144
-#define OBJ_weil_pairing                OBJ_ibcs1,3L,2L
+#define SN_kx_sm9               "KxSM9"
+#define LN_kx_sm9               "kx-sm9"
+#define NID_kx_sm9              1196

-#define SN_ate_pairing          "ate-pairing"
-#define NID_ate_pairing         1145
-#define OBJ_ate_pairing         OBJ_ibcs1,3L,3L
+#define SN_kx_sm9dhe            "KxSM9DHE"
+#define LN_kx_sm9dhe            "kx-sm9dhe"
+#define NID_kx_sm9dhe           1197

-#define SN_r_ate_pairing                "r-ate-pairing"
-#define NID_r_ate_pairing               1146
-#define OBJ_r_ate_pairing               OBJ_ibcs1,3L,4L
+#define SN_auth_sm2             "AuthSM2"
+#define LN_auth_sm2             "auth-sm2"
+#define NID_auth_sm2            1198
+
+#define SN_auth_sm9             "AuthSM9"
+#define LN_auth_sm9             "auth-sm9"
+#define NID_auth_sm9            1199

 #define SN_GmSSL                "gmssl"
 #define LN_GmSSL                "GmSSL"
-#define NID_GmSSL               1150
+#define NID_GmSSL               1200
 #define OBJ_GmSSL               OBJ_Enterprises,49549L

 #define SN_cpk          "CPK"
 #define LN_cpk          "cpk"
-#define NID_cpk         1147
+#define NID_cpk         1201
 #define OBJ_cpk         OBJ_GmSSL,1L

 #define SN_cpk_map              "cpk-map"
-#define NID_cpk_map             1151
+#define NID_cpk_map             1202
 #define OBJ_cpk_map             OBJ_cpk,1L

 #define SN_cpk_map_sha1         "cpk-map-sha1"
-#define NID_cpk_map_sha1                1218
+#define NID_cpk_map_sha1                1203
 #define OBJ_cpk_map_sha1                OBJ_cpk_map,1L

 #define SN_cpk_map_sha256               "cpk-map-sha256"
-#define NID_cpk_map_sha256              1219
+#define NID_cpk_map_sha256              1204
 #define OBJ_cpk_map_sha256              OBJ_cpk_map,2L

 #define SN_cpk_map_sm3          "cpk-map-sm3"
-#define NID_cpk_map_sm3         1220
+#define NID_cpk_map_sm3         1205
 #define OBJ_cpk_map_sm3         OBJ_cpk_map,3L

 #define SN_cpk_map_sha384               "cpk-map-sha384"
-#define NID_cpk_map_sha384              1221
+#define NID_cpk_map_sha384              1206
 #define OBJ_cpk_map_sha384              OBJ_cpk_map,4L

 #define SN_cpk_map_sha512               "cpk-map-sha512"
-#define NID_cpk_map_sha512              1222
+#define NID_cpk_map_sha512              1207
 #define OBJ_cpk_map_sha512              OBJ_cpk_map,5L

 #define SN_paillier             "paillier"
-#define NID_paillier            1148
+#define NID_paillier            1208
 #define OBJ_paillier            OBJ_GmSSL,21L
-
-#define SN_bwips                "bwips"
-#define NID_bwips               1196
-#define OBJ_bwips               OBJ_ISO_CN,11235L
-
-#define SN_wapi_crypto          "wapi-crypto"
-#define NID_wapi_crypto         1197
-#define OBJ_wapi_crypto         OBJ_bwips,1L
-
-#define SN_wapi_ec              "wapi-ec"
-#define NID_wapi_ec             1198
-#define OBJ_wapi_ec             OBJ_wapi_crypto,1L
-
-#define SN_wapi_ecdsa192_sha256         "wapi-ecdsa192-sha256"
-#define NID_wapi_ecdsa192_sha256                1199
-#define OBJ_wapi_ecdsa192_sha256                OBJ_wapi_ec,1L
-
-#define SN_wapip192v1           "wapip192v1"
-#define NID_wapip192v1          1135
-#define OBJ_wapip192v1          OBJ_wapi_ec,2L,1L
-
-#define SN_sm9bn256v1           "sm9bn256v1"
-#define NID_sm9bn256v1          1200
-#define OBJ_sm9bn256v1          OBJ_GmSSL,9L,1L
--- a/include/openssl/opensslv.h
+++ b/include/openssl/opensslv.h
@@ -41,9 +41,9 @@ extern "C" {
 */
 # define OPENSSL_VERSION_NUMBER  0x1010004fL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "GmSSL 2.4.0 - OpenSSL 1.1.0d-fips  13 Oct 2018"
+#  define OPENSSL_VERSION_TEXT    "GmSSL 2.4.1 - OpenSSL 1.1.0d-fips  16 Nov 2018"
 # else
-#  define OPENSSL_VERSION_TEXT    "GmSSL 2.4.0 - OpenSSL 1.1.0d  13 Oct 2018"
+#  define OPENSSL_VERSION_TEXT    "GmSSL 2.4.1 - OpenSSL 1.1.0d  16 Nov 2018"
 # endif

 /*-
--- a/include/openssl/paillier.h
+++ b/include/openssl/paillier.h
@@ -69,6 +69,9 @@ typedef struct paillier_st PAILLIER;
 PAILLIER *PAILLIER_new(void);
 void PAILLIER_free(PAILLIER *key);

+int PAILLIER_size(const PAILLIER *key);
+int PAILLIER_security_bits(const PAILLIER *key);
+
 int PAILLIER_generate_key(PAILLIER *key, int bits);
 int PAILLIER_check_key(PAILLIER *key);
 int PAILLIER_encrypt(BIGNUM *out, const BIGNUM *in, PAILLIER *key);
@@ -92,6 +95,7 @@ int ERR_load_PAILLIER_strings(void);
 /* Error codes for the PAILLIER functions. */

 /* Function codes. */
+# define PAILLIER_F_OLD_PAILLIER_PRIV_DECODE              110
 # define PAILLIER_F_PAILLIER_CHECK_KEY                    100
 # define PAILLIER_F_PAILLIER_CIPHERTEXT_ADD               101
 # define PAILLIER_F_PAILLIER_CIPHERTEXT_SCALAR_MUL        102
@@ -99,12 +103,15 @@ int ERR_load_PAILLIER_strings(void);
 # define PAILLIER_F_PAILLIER_ENCRYPT                      104
 # define PAILLIER_F_PAILLIER_GENERATE_KEY                 105
 # define PAILLIER_F_PAILLIER_NEW                          106
+# define PAILLIER_F_PAILLIER_PRIV_DECODE                  111
+# define PAILLIER_F_PAILLIER_PRIV_ENCODE                  112
 # define PAILLIER_F_PAILLIER_PUB_DECODE                   107
 # define PAILLIER_F_PKEY_PAILLIER_DECRYPT                 108
 # define PAILLIER_F_PKEY_PAILLIER_ENCRYPT                 109

 /* Reason codes. */
 # define PAILLIER_R_BUFFER_TOO_SMALL                      104
+# define PAILLIER_R_DECODE_ERROR                          105
 # define PAILLIER_R_GENERATE_PRIME_FAILED                 100
 # define PAILLIER_R_INVALID_PLAINTEXT                     101
 # define PAILLIER_R_MALLOC_FAILED                         102
--- a/include/openssl/pem.h
+++ b/include/openssl/pem.h
@@ -49,6 +49,23 @@ extern "C" {
 # define PEM_STRING_PARAMETERS   "PARAMETERS"
 # define PEM_STRING_CMS          "CMS"

+# define PEM_STRING_PAILLIER             "PAILLIER PRIVATE KEY"
+# define PEM_STRING_PAILLIER_PUBLIC      "PAILLIER PUBLIC KEY"
+# define PEM_STRING_CPK_MASTER           "CPK MASTER PRIVATE KEY"
+# define PEM_STRING_CPK_MASTER_PUBLIC    "CPK MASTER PUBLIC KEY"
+# define PEM_STRING_SM9_MASTER           "SM9 MASTER PRIVATE KEY"
+# define PEM_STRING_SM9_MASTER_PUBLIC    "SM9 MASTER PUBLIC KEY"
+# define PEM_STRING_SM9                  "SM9 PRIVATE KEY"
+# define PEM_STRING_SM9_PUBLIC           "SM9 PUBLIC KEY"
+# define PEM_STRING_BFIBE_MASTER         "BFIBE MASTER PRIVATE KEY"
+# define PEM_STRING_BFIBE_MASTER_PUBLIC  "BFIBE MASTER PUBLIC KEY"
+# define PEM_STRING_BFIBE                "BFIBE PRIVATE KEY"
+# define PEM_STRING_BFIBE_PUBLIC         "BFIBE PUBLIC KEY"
+# define PEM_STRING_BB1IBE_MASTER        "BB1IBE MASTER PRIVATE KEY"
+# define PEM_STRING_BB1IBE_MASTER_PUBLIC "BB1IBE MASTER PUBLIC KEY"
+# define PEM_STRING_BB1IBE               "BB1IBE PRIVATE KEY"
+# define PEM_STRING_BB1IBE_PUBLIC        "BB1IBE PUBLIC KEY"
+
 # define PEM_TYPE_ENCRYPTED      10
 # define PEM_TYPE_MIC_ONLY       20
 # define PEM_TYPE_MIC_CLEAR      30
@@ -356,6 +373,25 @@ DECLARE_PEM_rw(EC_PUBKEY, EC_KEY)
 DECLARE_PEM_rw_const(DHparams, DH)
 DECLARE_PEM_write_const(DHxparams, DH)
 # endif
+# ifndef OPENSSL_NO_PAILLIER
+DECLARE_PEM_rw_cb(PaillierPrivateKey, PAILLIER)
+DECLARE_PEM_rw_const(PaillierPublicKey, PAILLIER)
+DECLARE_PEM_rw(PAILLIER_PUBKEY, PAILLIER)
+# endif
+# ifndef OPENSSL_NO_CPK
+# endif
+# ifndef OPENSSL_NO_SM9
+DECLARE_PEM_rw_cb(SM9MasterSecret, SM9_MASTER_KEY)
+DECLARE_PEM_rw_const(SM9PublicParameters, SM9_MASTER_KEY)
+DECLARE_PEM_rw(SM9_MASTER_PUBKEY, SM9_MASTER_KEY)
+DECLARE_PEM_rw_cb(SM9PrivateKey, SM9_KEY)
+DECLARE_PEM_rw_const(SM9PublicKey, SM9_KEY)
+DECLARE_PEM_rw(SM9_PUBKEY, SM9_KEY)
+# endif
+# ifndef OPENSSL_NO_BFIBE
+# endif
+# ifndef OPENSSL_NO_BB1IBE
+# endif
 DECLARE_PEM_rw_cb(PrivateKey, EVP_PKEY)
 DECLARE_PEM_rw(PUBKEY, EVP_PKEY)

--- a/include/openssl/sm9.h
+++ b/include/openssl/sm9.h
@@ -67,13 +67,20 @@
 extern "C" {
 #endif

-typedef struct SM9MasterSecret_st SM9MasterSecret;
-typedef struct SM9PublicParameters_st SM9PublicParameters;
-typedef struct SM9PrivateKey_st SM9PrivateKey;
-typedef struct SM9PublicKey_st SM9PublicKey;
+typedef struct SM9_MASTER_KEY_st SM9_MASTER_KEY;
+typedef struct SM9_KEY_st SM9_KEY;
 typedef struct SM9Signature_st SM9Signature;
 typedef struct SM9Ciphertext_st SM9Ciphertext;

+typedef SM9_MASTER_KEY SM9MasterSecret;
+typedef SM9_MASTER_KEY SM9PublicParameters;
+typedef SM9_KEY SM9PrivateKey;
+typedef SM9_KEY SM9PublicKey;
+
+SM9_MASTER_KEY *SM9_MASTER_KEY_new(void);
+void SM9_MASTER_KEY_free(SM9_MASTER_KEY *a);
+SM9_KEY *SM9_KEY_new(void);
+void SM9_KEY_free(SM9_KEY *a);

 int SM9_setup(int pairing, /* NID_sm9bn256v1 */
 	int scheme, /* NID_[sm9sign | sm9encrypt | sm9keyagreement] */
@@ -81,13 +88,11 @@ int SM9_setup(int pairing, /* NID_sm9bn256v1 */
 	SM9PublicParameters **mpk,
 	SM9MasterSecret **msk);

-SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
-	const char *id, size_t idlen);

 SM9MasterSecret *SM9_generate_master_secret(int pairing, int scheme, int hash1);
-
 SM9PublicParameters *SM9_extract_public_parameters(SM9MasterSecret *msk);
-
+SM9PrivateKey *SM9_extract_private_key(SM9MasterSecret *msk,
+	const char *id, size_t idlen);
 SM9PublicKey *SM9_extract_public_key(SM9PublicParameters *mpk,
 	const char *id, size_t idlen);

@@ -169,25 +174,42 @@ int SM9_compute_share_key_B(int type,


 #ifndef OPENSSL_NO_STDIO
-SM9MasterSecret *d2i_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret **msk);
-SM9PublicParameters *d2i_SM9PublicParameters_fp(FILE *fp, SM9PublicParameters **mpk);
-SM9PrivateKey *d2i_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey **sk);
-SM9Signature *d2i_SM9Signature_fp(FILE *fp, SM9Signature **sk);
-SM9Ciphertext *d2i_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext **sk);
-int i2d_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret *msk);
-int i2d_SM9PublicParameters_fp(FILE *fp, SM9PublicParameters *mpk);
-int i2d_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey *sk);
-int i2d_SM9Signature_fp(FILE *fp, SM9Signature *sk);
-int i2d_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext *sk);
+
+SM9MasterSecret *d2i_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret **pp);
+SM9PublicParameters *d2i_SM9PublicParameters_fp(FILE *fp, SM9PublicParameters **pp);
+SM9PrivateKey *d2i_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey **pp);
+SM9PublicKey *d2i_SM9PublicKey_fp(FILE *fp, SM9PublicKey **pp);
+SM9Signature *d2i_SM9Signature_fp(FILE *fp, SM9Signature **pp);
+SM9Ciphertext *d2i_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext **pp);
+
+int i2d_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret *a);
+int i2d_PublicParameters_fp(FILE *fp, SM9PublicParameters *a);
+int i2d_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey *a);
+int i2d_SM9PublicKey_fp(FILE *fp, SM9PublicKey *a);
+int i2d_SM9Signature_fp(FILE *fp, SM9Signature *a);
+int i2d_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext *a);
 #endif

-DECLARE_ASN1_FUNCTIONS(SM9MasterSecret)
-DECLARE_ASN1_FUNCTIONS(SM9PublicParameters)
-DECLARE_ASN1_FUNCTIONS(SM9PrivateKey)
-DECLARE_ASN1_FUNCTIONS(SM9PublicKey)
+int SM9_MASTER_KEY_up_ref(SM9_MASTER_KEY *msk);
+int SM9_KEY_up_ref(SM9_KEY *sk);
+
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(SM9_MASTER_KEY,SM9MasterSecret)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(SM9_MASTER_KEY,SM9PublicParameters)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(SM9_KEY,SM9PrivateKey)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(SM9_KEY,SM9PublicKey)
 DECLARE_ASN1_FUNCTIONS(SM9Signature)
 DECLARE_ASN1_FUNCTIONS(SM9Ciphertext)

+#define SM9MasterSecret_new() SM9_MASTER_KEY_new()
+#define SM9MasterSecret_free(a) SM9_MASTER_KEY_free(a)
+#define SM9PublicParameters_new() SM9_MASTER_KEY_new()
+#define SM9PublicParameters_free(a) SM9_MASTER_KEY_free(a)
+#define SM9PrivateKey_new() SM9_KEY_new()
+#define SM9PrivateKey_free(a) SM9_KEY_free(a)
+#define SM9PublicKey_new() SM9_KEY_new()
+#define SM9PublicKey_free(a) SM9_KEY_free(a)
+
+

 /* BEGIN ERROR CODES */
 /*
@@ -200,6 +222,8 @@ int ERR_load_SM9_strings(void);
 /* Error codes for the SM9 functions. */

 /* Function codes. */
+# define SM9_F_OLD_SM9_MASTER_DECODE                      124
+# define SM9_F_OLD_SM9_PRIV_DECODE                        125
 # define SM9_F_SM9CIPHERTEXT_CHECK                        100
 # define SM9_F_SM9ENCPARAMETERS_DECRYPT                   101
 # define SM9_F_SM9ENCPARAMETERS_ENCRYPT                   102
@@ -216,6 +240,15 @@ int ERR_load_SM9_strings(void);
 # define SM9_F_SM9_EXTRACT_PUBLIC_PARAMETERS              111
 # define SM9_F_SM9_GENERATE_KEY_EXCHANGE                  121
 # define SM9_F_SM9_GENERATE_MASTER_SECRET                 112
+# define SM9_F_SM9_KEY_NEW                                132
+# define SM9_F_SM9_MASTER_DECODE                          126
+# define SM9_F_SM9_MASTER_ENCODE                          127
+# define SM9_F_SM9_MASTER_KEY_EXTRACT_KEY                 134
+# define SM9_F_SM9_MASTER_KEY_NEW                         133
+# define SM9_F_SM9_PARAMS_DECODE                          128
+# define SM9_F_SM9_PRIV_DECODE                            129
+# define SM9_F_SM9_PRIV_ENCODE                            130
+# define SM9_F_SM9_PUB_DECODE                             131
 # define SM9_F_SM9_SIGN                                   119
 # define SM9_F_SM9_SIGNFINAL                              115
 # define SM9_F_SM9_SIGNINIT                               116
@@ -227,6 +260,7 @@ int ERR_load_SM9_strings(void);

 /* Reason codes. */
 # define SM9_R_BUFFER_TOO_SMALL                           100
+# define SM9_R_DECODE_ERROR                               132
 # define SM9_R_DIGEST_FAILURE                             119
 # define SM9_R_EC_LIB                                     101
 # define SM9_R_EXTENSION_FIELD_ERROR                      120
@@ -253,6 +287,7 @@ int ERR_load_SM9_strings(void);
 # define SM9_R_INVALID_SIGNATURE_FORMAT                   127
 # define SM9_R_INVALID_TYPE1CURVE                         115
 # define SM9_R_KDF_FAILURE                                116
+# define SM9_R_NO_MASTER_SECRET                           133
 # define SM9_R_PAIRING_ERROR                              124
 # define SM9_R_RATE_PAIRING_ERROR                         129
 # define SM9_R_TWIST_CURVE_ERROR                          117
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -30,6 +30,9 @@
 # ifndef OPENSSL_NO_PAILLIER
 #  include <openssl/paillier.h>
 # endif
+# ifndef OPENSSL_NO_SM9
+#  include <openssl/sm9.h>
+# endif

 # if OPENSSL_API_COMPAT < 0x10100000L
 #  ifndef OPENSSL_NO_RSA
@@ -549,6 +552,12 @@ EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, long length);
 int i2d_PAILLIER_PUBKEY(PAILLIER *a, unsigned char **pp);
 PAILLIER *d2i_PAILLIER_PUBKEY(PAILLIER **a, const unsigned char **pp, long length);
 # endif
+# ifndef OPENSSL_NO_SM9
+int i2d_SM9_MASTER_PUBKEY(SM9_MASTER_KEY *a, unsigned char **pp);
+SM9_MASTER_KEY *d2i_SM9_MASTER_PUBKEY(SM9_MASTER_KEY **a, const unsigned char **pp, long length);
+int i2d_SM9_PUBKEY(SM9_KEY *a, unsigned char **pp);
+SM9_KEY *d2i_SM9_PUBKEY(SM9_KEY **a, const unsigned char **pp, long length);
+# endif


 DECLARE_ASN1_FUNCTIONS(X509_SIG)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -1,411 +1,411 @@
-SSL_CONF_cmd_argv                       1	1_1_0d	EXIST::FUNCTION:
-SSL_set1_param                          2	1_1_0d	EXIST::FUNCTION:
-SSL_get_psk_identity                    3	1_1_0d	EXIST::FUNCTION:PSK
-SSL_dane_enable                         4	1_1_0d	EXIST::FUNCTION:
-SSL_ctrl                                5	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_new                         6	1_1_0d	EXIST::FUNCTION:
-SSL_set_rfd                             7	1_1_0d	EXIST::FUNCTION:SOCK
-SSL_CTX_use_RSAPrivateKey_ASN1          8	1_1_0d	EXIST::FUNCTION:RSA
-SSL_CONF_cmd                            9	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_load_verify_locations           10	1_1_0d	EXIST::FUNCTION:
-BIO_ssl_shutdown                        11	1_1_0d	EXIST::FUNCTION:
-SSL_get_current_compression             12	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_certificate                 13	1_1_0d	EXIST::FUNCTION:
-SSL_select_next_proto                   14	1_1_0d	EXIST::FUNCTION:
-SSL_do_handshake                        15	1_1_0d	EXIST::FUNCTION:
-SSL_set_not_resumable_session_callback  16	1_1_0d	EXIST::FUNCTION:
-SSL_set_SSL_CTX                         17	1_1_0d	EXIST::FUNCTION:
-SSL_renegotiate_abbreviated             18	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_cookie_generate_cb          19	1_1_0d	EXIST::FUNCTION:
-SSL_get_cipher_list                     20	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_ctlog_list_file             21	1_1_0d	EXIST::FUNCTION:CT
-DTLS_server_method                      22	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_username                23	1_1_0d	EXIST::FUNCTION:SRP
-SSL_SESSION_set_ex_data                 24	1_1_0d	EXIST::FUNCTION:
-SSL_get0_dane                           25	1_1_0d	EXIST::FUNCTION:
-SSL_has_pending                         26	1_1_0d	EXIST::FUNCTION:
-SSL_renegotiate                         27	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_add_server_custom_ext           28	1_1_0d	EXIST::FUNCTION:
-SSLv3_client_method                     29	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
-SSL_clear_options                       30	1_1_0d	EXIST::FUNCTION:
-TLS_client_method                       31	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set1_param                      32	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_client_CA_list              33	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_has_ticket                  34	1_1_0d	EXIST::FUNCTION:
-DTLSv1_server_method                    35	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-SSL_CTX_set_default_verify_paths        36	1_1_0d	EXIST::FUNCTION:
-SSL_connect                             37	1_1_0d	EXIST::FUNCTION:
-SSL_get_finished                        38	1_1_0d	EXIST::FUNCTION:
-GMTLS_client_method                     39	1_1_0d	EXIST::FUNCTION:GMTLS
-SSL_get_rfd                             40	1_1_0d	EXIST::FUNCTION:
-SSL_free                                41	1_1_0d	EXIST::FUNCTION:
-SSL_is_dtls                             42	1_1_0d	EXIST::FUNCTION:
-DTLSv1_client_method                    43	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-SSL_CTX_remove_session                  44	1_1_0d	EXIST::FUNCTION:
-SSL_set_cipher_list                     45	1_1_0d	EXIST::FUNCTION:
-SSL_get_shared_sigalgs                  46	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_ciphers                     47	1_1_0d	EXIST::FUNCTION:
-SSL_get_security_callback               48	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_session_id_context          49	1_1_0d	EXIST::FUNCTION:
-SSL_get_srtp_profiles                   50	1_1_0d	EXIST::FUNCTION:SRTP
-SSL_SESSION_set1_id                     51	1_1_0d	EXIST::FUNCTION:
-SSL_extension_supported                 52	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_description                  53	1_1_0d	EXIST::FUNCTION:
-SSL_dup                                 54	1_1_0d	EXIST::FUNCTION:
-SSL_set_hostflags                       55	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_sess_set_get_cb                 56	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set0_security_ex_data           57	1_1_0d	EXIST::FUNCTION:
-SSL_get_peer_certificate                58	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_cookie_verify_cb            59	1_1_0d	EXIST::FUNCTION:
-SSL_add1_host                           60	1_1_0d	EXIST::FUNCTION:
-SSL_set_client_CA_list                  61	1_1_0d	EXIST::FUNCTION:
-TLS_method                              62	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get0_ticket                 63	1_1_0d	EXIST::FUNCTION:
-SSL_get_server_random                   64	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_ssl_method                  65	1_1_0d	EXIST::FUNCTION:
-SSL_set_ssl_method                      66	1_1_0d	EXIST::FUNCTION:
-TLSv1_method                            67	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-SSL_get0_param                          68	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_client_pwd_callback     69	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CTX_use_certificate_file            70	1_1_0d	EXIST::FUNCTION:
-TLSv1_2_server_method                   71	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-BIO_new_buffer_ssl_connect              72	1_1_0d	EXIST::FUNCTION:
-SSL_get0_peername                       73	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_up_ref                          74	1_1_0d	EXIST::FUNCTION:
-SSL_alert_desc_string_long              75	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_sess_set_remove_cb              76	1_1_0d	EXIST::FUNCTION:
-TLSv1_2_client_method                   77	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-SSL_load_client_CA_file                 78	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_verify_callback             79	1_1_0d	EXIST::FUNCTION:
-SRP_Calc_A_param                        80	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CTX_set_quiet_shutdown              81	1_1_0d	EXIST::FUNCTION:
-SSL_trace                               82	1_1_0d	EXIST::FUNCTION:SSL_TRACE
-SSL_get_certificate                     83	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_sess_set_new_cb                 84	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_master_key              85	1_1_0d	EXIST::FUNCTION:
-SSL_use_RSAPrivateKey                   86	1_1_0d	EXIST::FUNCTION:RSA
-GMTLS_server_method                     87	1_1_0d	EXIST::FUNCTION:GMTLS
-SSL_CTX_set_ex_data                     88	1_1_0d	EXIST::FUNCTION:
-SSL_set_wfd                             89	1_1_0d	EXIST::FUNCTION:SOCK
-SSL_check_chain                         90	1_1_0d	EXIST::FUNCTION:
-SSL_set_tmp_dh_callback                 91	1_1_0d	EXIST::FUNCTION:DH
-SSL_set_options                         92	1_1_0d	EXIST::FUNCTION:
-SSL_set_security_callback               93	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_SRP_CTX_init                    94	1_1_0d	EXIST::FUNCTION:SRP
-SSL_waiting_for_async                   95	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_is_aead                      96	1_1_0d	EXIST::FUNCTION:
-SSL_get_options                         97	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_verify_param_callback   98	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CTX_set_default_verify_dir          99	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_timeout                     100	1_1_0d	EXIST::FUNCTION:
-SSL_rstate_string_long                  101	1_1_0d	EXIST::FUNCTION:
-BIO_f_ssl                               102	1_1_0d	EXIST::FUNCTION:
-OPENSSL_init_ssl                        103	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_new                             104	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_kx_nid                   105	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_auth_nid                 106	1_1_0d	EXIST::FUNCTION:
-SSL_set_session_ticket_ext              107	1_1_0d	EXIST::FUNCTION:
-SSL_callback_ctrl                       108	1_1_0d	EXIST::FUNCTION:
-SSL_state_string_long                   109	1_1_0d	EXIST::FUNCTION:
-SSL_add_dir_cert_subjects_to_stack      110	1_1_0d	EXIST::FUNCTION:
-DTLS_method                             111	1_1_0d	EXIST::FUNCTION:
-SSL_get0_dane_tlsa                      112	1_1_0d	EXIST::FUNCTION:
-SSL_get_shutdown                        113	1_1_0d	EXIST::FUNCTION:
-SSL_pending                             114	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_ct_is_enabled                   115	1_1_0d	EXIST::FUNCTION:CT
-SSL_client_version                      116	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_add_session                     117	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_client_CA_list              118	1_1_0d	EXIST::FUNCTION:
-TLS_server_method                       119	1_1_0d	EXIST::FUNCTION:
-PEM_read_SSL_SESSION                    120	1_1_0d	EXIST::FUNCTION:STDIO
-SSL_SESSION_print_keylog                121	1_1_0d	EXIST::FUNCTION:
-SSL_session_reused                      122	1_1_0d	EXIST::FUNCTION:
-SSL_get_SSL_CTX                         123	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_add_client_CA                   124	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_client_cert_engine          125	1_1_0d	EXIST::FUNCTION:ENGINE
-SSL_use_certificate_ASN1                126	1_1_0d	EXIST::FUNCTION:
-SSLv3_server_method                     127	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
-SSL_config                              128	1_1_0d	EXIST::FUNCTION:
-SSL_set0_security_ex_data               129	1_1_0d	EXIST::FUNCTION:
-SSL_set_fd                              130	1_1_0d	EXIST::FUNCTION:SOCK
-SSL_use_PrivateKey_file                 131	1_1_0d	EXIST::FUNCTION:
-SSL_use_PrivateKey                      132	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get0_ctlog_store                133	1_1_0d	EXIST::FUNCTION:CT
-SSL_CONF_CTX_new                        134	1_1_0d	EXIST::FUNCTION:
-SSL_get_ex_data_X509_STORE_CTX_idx      135	1_1_0d	EXIST::FUNCTION:
-SSL_new                                 136	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_quiet_shutdown              137	1_1_0d	EXIST::FUNCTION:
-SSL_get0_next_proto_negotiated          138	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
-SSL_CTX_use_PrivateKey                  139	1_1_0d	EXIST::FUNCTION:
-GMTLS_method                            140	1_1_0d	EXIST::FUNCTION:GMTLS
-SSL_get_wfd                             141	1_1_0d	EXIST::FUNCTION:
-TLSv1_client_method                     142	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-SSL_get_sigalgs                         143	1_1_0d	EXIST::FUNCTION:
-PEM_write_bio_SSL_SESSION               144	1_1_0d	EXIST::FUNCTION:
-SSL_add_client_CA                       145	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_ctrl                            146	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_verify_mode                 147	1_1_0d	EXIST::FUNCTION:
-SSL_get_psk_identity_hint               148	1_1_0d	EXIST::FUNCTION:PSK
-SSL_CTX_set_cert_store                  149	1_1_0d	EXIST::FUNCTION:
-SSL_get_default_timeout                 150	1_1_0d	EXIST::FUNCTION:
-SSL_get_peer_cert_chain                 151	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_generate_session_id         152	1_1_0d	EXIST::FUNCTION:
-SSL_get_state                           153	1_1_0d	EXIST::FUNCTION:
-TLSv1_2_method                          154	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-SSL_CTX_get0_security_ex_data           155	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_default_ctlog_list_file     156	1_1_0d	EXIST::FUNCTION:CT
-BIO_new_ssl                             157	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_print                       158	1_1_0d	EXIST::FUNCTION:
-SSL_set_connect_state                   159	1_1_0d	EXIST::FUNCTION:
-SSL_get_all_async_fds                   160	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_compress_id             161	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_serverinfo                  162	1_1_0d	EXIST::FUNCTION:
-SSL_set_default_passwd_cb               163	1_1_0d	EXIST::FUNCTION:
-SSL_use_RSAPrivateKey_file              164	1_1_0d	EXIST::FUNCTION:RSA
-SSL_CTX_set_security_level              165	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_dane_mtype_set                  166	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_set0_compression_methods       167	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_client_cert_cb              168	1_1_0d	EXIST::FUNCTION:
-SSL_renegotiate_pending                 169	1_1_0d	EXIST::FUNCTION:
-SSL_get_verify_callback                 170	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_security_callback           171	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_default_passwd_cb_userdata  172	1_1_0d	EXIST::FUNCTION:
-SSL_get_shared_ciphers                  173	1_1_0d	EXIST::FUNCTION:
-d2i_SSL_SESSION                         174	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_serverinfo_file             175	1_1_0d	EXIST::FUNCTION:
-PEM_write_SSL_SESSION                   176	1_1_0d	EXIST::FUNCTION:STDIO
-SSL_get_verify_mode                     177	1_1_0d	EXIST::FUNCTION:
-DTLSv1_method                           178	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-SSL_want                                179	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_username_callback       180	1_1_0d	EXIST::FUNCTION:SRP
-SSL_in_before                           181	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_default_passwd_cb           182	1_1_0d	EXIST::FUNCTION:
-SSL_get_changed_async_fds               183	1_1_0d	EXIST::FUNCTION:
-SSL_get1_session                        184	1_1_0d	EXIST::FUNCTION:
-SSL_get_fd                              185	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_info_callback               186	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_set_time                    187	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_PrivateKey_file             188	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set0_ctlog_store                189	1_1_0d	EXIST::FUNCTION:CT
-SSL_set_srp_server_param_pw             190	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CTX_clear_options                   191	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_flush_sessions                  192	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_psk_identity_hint           193	1_1_0d	EXIST::FUNCTION:PSK
-SSL_CTX_get0_certificate                194	1_1_0d	EXIST::FUNCTION:
-SSL_get_servername_type                 195	1_1_0d	EXIST::FUNCTION:
-SSL_dane_clear_flags                    196	1_1_0d	EXIST::FUNCTION:
-SSL_dane_tlsa_add                       197	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_psk_server_callback         198	1_1_0d	EXIST::FUNCTION:PSK
-SSL_alert_type_string                   199	1_1_0d	EXIST::FUNCTION:
-SSL_set_msg_callback                    200	1_1_0d	EXIST::FUNCTION:
-SSL_get_ciphers                         201	1_1_0d	EXIST::FUNCTION:
-SSL_alert_desc_string                   202	1_1_0d	EXIST::FUNCTION:
-SSL_set_read_ahead                      203	1_1_0d	EXIST::FUNCTION:
-SSL_use_psk_identity_hint               204	1_1_0d	EXIST::FUNCTION:PSK
-SSL_CTX_config                          205	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_get_name                       206	1_1_0d	EXIST::FUNCTION:
-SSL_set_info_callback                   207	1_1_0d	EXIST::FUNCTION:
-SSL_get_ssl_method                      208	1_1_0d	EXIST::FUNCTION:
-TLSv1_1_server_method                   209	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-SSL_CTX_use_RSAPrivateKey               210	1_1_0d	EXIST::FUNCTION:RSA
-SSL_set_accept_state                    211	1_1_0d	EXIST::FUNCTION:
-SSL_get_version                         212	1_1_0d	EXIST::FUNCTION:
-SSL_set_cert_cb                         213	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_next_protos_advertised_cb   214	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
-SSL_set_session_ticket_ext_cb           215	1_1_0d	EXIST::FUNCTION:
-SSL_set_shutdown                        216	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_enable_ct                       217	1_1_0d	EXIST::FUNCTION:CT
-SSL_set_verify_depth                    218	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_digest_nid               219	1_1_0d	EXIST::FUNCTION:
-SSL_is_init_finished                    220	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_options                     221	1_1_0d	EXIST::FUNCTION:
-DTLSv1_2_client_method                  222	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
-TLSv1_1_method                          223	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-SSL_get_peer_finished                   224	1_1_0d	EXIST::FUNCTION:
-SSL_dup_CA_list                         225	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_verify_depth                226	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_add_compression_method         227	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_version                  228	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_set1_id_context             229	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_dane_clear_flags                230	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_next_proto_select_cb        231	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
-SSL_set_default_read_buffer_len         232	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_timeout                 233	1_1_0d	EXIST::FUNCTION:
-SSL_dane_set_flags                      234	1_1_0d	EXIST::FUNCTION:
-SSL_test_functions                      235	1_1_0d	EXIST::FUNCTION:UNIT_TEST
-SSL_srp_server_param_with_username      236	1_1_0d	EXIST::FUNCTION:SRP
-SSL_get_quiet_shutdown                  237	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_ex_data                     238	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_name                     239	1_1_0d	EXIST::FUNCTION:
-SSL_get0_dane_authority                 240	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_password                241	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CONF_CTX_finish                     242	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_certificate_chain_file      243	1_1_0d	EXIST::FUNCTION:
-i2d_SSL_SESSION                         244	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_purpose                     245	1_1_0d	EXIST::FUNCTION:
-DTLSv1_2_server_method                  246	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
-SSL_CONF_CTX_set1_prefix                247	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_standard_name                248	1_1_0d	EXIST::FUNCTION:SSL_TRACE
-SSL_get_current_expansion               249	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_print_fp                    250	1_1_0d	EXIST::FUNCTION:STDIO
-SSL_get_verify_result                   251	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_CTX_set_flags                  252	1_1_0d	EXIST::FUNCTION:
-SSL_get_security_level                  253	1_1_0d	EXIST::FUNCTION:
-SSL_set_purpose                         254	1_1_0d	EXIST::FUNCTION:
-SSL_get0_alpn_selected                  255	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_get_id                         256	1_1_0d	EXIST::FUNCTION:
-SSL_get_privatekey                      257	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_cipher_list                 258	1_1_0d	EXIST::FUNCTION:
-SSL_add_file_cert_subjects_to_stack     259	1_1_0d	EXIST::FUNCTION:
-SSL_rstate_string                       260	1_1_0d	EXIST::FUNCTION:
-SSL_set_quiet_shutdown                  261	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_ct_validation_callback      262	1_1_0d	EXIST::FUNCTION:CT
-SSL_get0_security_ex_data               263	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_id                       264	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_ex_data                 265	1_1_0d	EXIST::FUNCTION:
-SSL_get0_peer_scts                      266	1_1_0d	EXIST::FUNCTION:CT
-SSL_set_bio                             267	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_callback_ctrl                   268	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_get0_name                      269	1_1_0d	EXIST::FUNCTION:
-SSL_clear                               270	1_1_0d	EXIST::FUNCTION:
-SSL_set_psk_server_callback             271	1_1_0d	EXIST::FUNCTION:PSK
-BIO_new_ssl_connect                     272	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_options                     273	1_1_0d	EXIST::FUNCTION:
-ERR_load_SSL_strings                    274	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_CTX_clear_flags                275	1_1_0d	EXIST::FUNCTION:
-SSL_get0_verified_chain                 276	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_psk_client_callback         277	1_1_0d	EXIST::FUNCTION:PSK
-SSL_CTX_sessions                        278	1_1_0d	EXIST::FUNCTION:
-TLSv1_1_client_method                   279	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-SSL_state_string                        280	1_1_0d	EXIST::FUNCTION:
-SSL_get_verify_depth                    281	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_client_cert_cb              282	1_1_0d	EXIST::FUNCTION:
-SSL_get_srp_N                           283	1_1_0d	EXIST::FUNCTION:SRP
-SSL_use_RSAPrivateKey_ASN1              284	1_1_0d	EXIST::FUNCTION:RSA
-SSL_set_trust                           285	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_cmd_value_type                 286	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_trust                       287	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_msg_callback                288	1_1_0d	EXIST::FUNCTION:
-SSL_export_keying_material              289	1_1_0d	EXIST::FUNCTION:
-SSL_get_session                         290	1_1_0d	EXIST::FUNCTION:
-SSL_get_default_passwd_cb_userdata      291	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_tlsext_use_srtp             292	1_1_0d	EXIST::FUNCTION:SRTP
-SSL_CTX_get_cert_store                  293	1_1_0d	EXIST::FUNCTION:
-SSL_get_ex_data                         294	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_SRP_CTX_free                    295	1_1_0d	EXIST::FUNCTION:SRP
-SSL_CTX_get_default_passwd_cb_userdata  296	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_sess_get_remove_cb              297	1_1_0d	EXIST::FUNCTION:
-SSLv3_method                            298	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
-SSL_set_session                         299	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get0_id_context             300	1_1_0d	EXIST::FUNCTION:
-SSL_shutdown                            301	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_time                    302	1_1_0d	EXIST::FUNCTION:
-TLSv1_server_method                     303	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-SSL_set_debug                           304	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0
-SSL_write                               305	1_1_0d	EXIST::FUNCTION:
-SSL_is_gmtls                            306	1_1_0d	EXIST::FUNCTION:
-SSL_set_tlsext_use_srtp                 307	1_1_0d	EXIST::FUNCTION:SRTP
-SSL_set_ct_validation_callback          308	1_1_0d	EXIST::FUNCTION:CT
-SSL_get_error                           309	1_1_0d	EXIST::FUNCTION:
-SSL_get_selected_srtp_profile           310	1_1_0d	EXIST::FUNCTION:SRTP
-SSL_CTX_free                            311	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_certificate_ASN1            312	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_default_verify_file         313	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_verify_depth                314	1_1_0d	EXIST::FUNCTION:
-SSL_set1_host                           315	1_1_0d	EXIST::FUNCTION:
-SSL_enable_ct                           316	1_1_0d	EXIST::FUNCTION:CT
-SSL_ct_is_enabled                       317	1_1_0d	EXIST::FUNCTION:CT
-SSL_CTX_use_PrivateKey_ASN1             318	1_1_0d	EXIST::FUNCTION:
-SSL_version                             319	1_1_0d	EXIST::FUNCTION:
-SSL_get_client_ciphers                  320	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_timeout                     321	1_1_0d	EXIST::FUNCTION:
-SSL_add_ssl_module                      322	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_tmp_dh_callback             323	1_1_0d	EXIST::FUNCTION:DH
-SSL_CTX_set_alpn_protos                 324	1_1_0d	EXIST::FUNCTION:
-SSL_is_server                           325	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get0_privatekey                 326	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_up_ref                      327	1_1_0d	EXIST::FUNCTION:
-SSL_get_read_ahead                      328	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_check_private_key               329	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_strength                330	1_1_0d	EXIST::FUNCTION:SRP
-SSL_SESSION_get0_cipher                 331	1_1_0d	EXIST::FUNCTION:
-SSL_get_client_random                   332	1_1_0d	EXIST::FUNCTION:
-SSL_copy_session_id                     333	1_1_0d	EXIST::FUNCTION:
-PEM_read_bio_SSL_SESSION                334	1_1_0d	EXIST::FUNCTION:
-SSL_set_alpn_protos                     335	1_1_0d	EXIST::FUNCTION:
-SSL_COMP_get_compression_methods        336	1_1_0d	EXIST::FUNCTION:
-SSL_set_security_level                  337	1_1_0d	EXIST::FUNCTION:
-DTLSv1_listen                           338	1_1_0d	EXIST::FUNCTION:SOCK
-SSL_SESSION_get_protocol_version        339	1_1_0d	EXIST::FUNCTION:
-BIO_ssl_copy_session_id                 340	1_1_0d	EXIST::FUNCTION:
-SSL_peek                                341	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_bits                     342	1_1_0d	EXIST::FUNCTION:
-SSL_use_certificate                     343	1_1_0d	EXIST::FUNCTION:
-DTLSv1_2_method                         344	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
-SSL_use_certificate_file                345	1_1_0d	EXIST::FUNCTION:
-SSL_get_rbio                            346	1_1_0d	EXIST::FUNCTION:
-SSL_SRP_CTX_free                        347	1_1_0d	EXIST::FUNCTION:SRP
-SSL_get_wbio                            348	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_default_read_buffer_len     349	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_alpn_select_cb              350	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_set_timeout                 351	1_1_0d	EXIST::FUNCTION:
-SSL_use_certificate_chain_file          352	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_CTX_set_ssl                    353	1_1_0d	EXIST::FUNCTION:
-SSL_set_ex_data                         354	1_1_0d	EXIST::FUNCTION:
-SSL_get_current_cipher                  355	1_1_0d	EXIST::FUNCTION:
-SSL_set_session_secret_cb               356	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_verify                      357	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_sess_get_new_cb                 358	1_1_0d	EXIST::FUNCTION:
-SSL_up_ref                              359	1_1_0d	EXIST::FUNCTION:
-SSL_set_default_passwd_cb_userdata      360	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_CTX_set_ssl_ctx                361	1_1_0d	EXIST::FUNCTION:
-SSL_get_srp_g                           362	1_1_0d	EXIST::FUNCTION:SRP
-SSL_read                                363	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_id                      364	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_dane_set_flags                  365	1_1_0d	EXIST::FUNCTION:
-SSL_set_generate_session_id             366	1_1_0d	EXIST::FUNCTION:
-SSL_get_default_passwd_cb               367	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_security_level              368	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_srp_cb_arg                  369	1_1_0d	EXIST::FUNCTION:SRP
-SSL_SRP_CTX_init                        370	1_1_0d	EXIST::FUNCTION:SRP
-SSL_set_psk_client_callback             371	1_1_0d	EXIST::FUNCTION:PSK
-SSL_CTX_sess_get_get_cb                 372	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_security_callback           373	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_has_client_custom_ext           374	1_1_0d	EXIST::FUNCTION:
-SSL_get_servername                      375	1_1_0d	EXIST::FUNCTION:
-SSL_set_srp_server_param                376	1_1_0d	EXIST::FUNCTION:SRP
-SSL_get1_supported_ciphers              377	1_1_0d	EXIST::FUNCTION:
-SSL_accept                              378	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_dane_enable                     379	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_ssl_version                 380	1_1_0d	EXIST::FUNCTION:
-SSL_set0_wbio                           381	1_1_0d	EXIST::FUNCTION:
-SSL_set0_rbio                           382	1_1_0d	EXIST::FUNCTION:
-SSL_get_srp_userinfo                    383	1_1_0d	EXIST::FUNCTION:SRP
-SSL_certs_clear                         384	1_1_0d	EXIST::FUNCTION:
-SSL_get_srp_username                    385	1_1_0d	EXIST::FUNCTION:SRP
-SSL_get_client_CA_list                  386	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_info_callback               387	1_1_0d	EXIST::FUNCTION:
-SSL_set_session_id_context              388	1_1_0d	EXIST::FUNCTION:
-SSL_get_info_callback                   389	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get0_hostname               390	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get0_peer                   391	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_add_client_custom_ext           392	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_cert_cb                     393	1_1_0d	EXIST::FUNCTION:
-DTLS_client_method                      394	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_cert_verify_callback        395	1_1_0d	EXIST::FUNCTION:
-SSL_CONF_CTX_free                       396	1_1_0d	EXIST::FUNCTION:
-SSL_set_verify                          397	1_1_0d	EXIST::FUNCTION:
-SSL_in_init                             398	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_find                         399	1_1_0d	EXIST::FUNCTION:
-SSL_CIPHER_get_cipher_nid               400	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get0_param                      401	1_1_0d	EXIST::FUNCTION:
-SSL_check_private_key                   402	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_get_default_passwd_cb           403	1_1_0d	EXIST::FUNCTION:
-SSL_has_matching_session_id             404	1_1_0d	EXIST::FUNCTION:
-SSL_set_verify_result                   405	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_set_not_resumable_session_callback 406	1_1_0d	EXIST::FUNCTION:
-SSL_alert_type_string_long              407	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_get_ticket_lifetime_hint    408	1_1_0d	EXIST::FUNCTION:
-SSL_use_PrivateKey_ASN1                 409	1_1_0d	EXIST::FUNCTION:
-SSL_SESSION_free                        410	1_1_0d	EXIST::FUNCTION:
-SSL_CTX_use_RSAPrivateKey_file          411	1_1_0d	EXIST::FUNCTION:RSA
+SSL_SESSION_get_id                      1	1_1_0d	EXIST::FUNCTION:
+SSL_certs_clear                         2	1_1_0d	EXIST::FUNCTION:
+SSL_set_security_level                  3	1_1_0d	EXIST::FUNCTION:
+SSL_do_handshake                        4	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_standard_name                5	1_1_0d	EXIST::FUNCTION:SSL_TRACE
+SSL_CTX_set_default_ctlog_list_file     6	1_1_0d	EXIST::FUNCTION:CT
+SSL_COMP_get_id                         7	1_1_0d	EXIST::FUNCTION:
+SSL_set_verify_result                   8	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_description                  9	1_1_0d	EXIST::FUNCTION:
+SSL_get_default_passwd_cb_userdata      10	1_1_0d	EXIST::FUNCTION:
+SSL_config                              11	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_SRP_CTX_free                    12	1_1_0d	EXIST::FUNCTION:SRP
+DTLSv1_server_method                    13	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
+SSL_CTX_sess_get_new_cb                 14	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sess_get_remove_cb              15	1_1_0d	EXIST::FUNCTION:
+SSL_shutdown                            16	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_print_fp                    17	1_1_0d	EXIST::FUNCTION:STDIO
+SSL_SESSION_has_ticket                  18	1_1_0d	EXIST::FUNCTION:
+SSL_rstate_string                       19	1_1_0d	EXIST::FUNCTION:
+SSL_is_dtls                             20	1_1_0d	EXIST::FUNCTION:
+SSL_client_version                      21	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_print                       22	1_1_0d	EXIST::FUNCTION:
+SSL_get_SSL_CTX                         23	1_1_0d	EXIST::FUNCTION:
+SSL_get_peer_certificate                24	1_1_0d	EXIST::FUNCTION:
+TLSv1_1_client_method                   25	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
+SSL_CTX_add_client_CA                   26	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_client_cert_engine          27	1_1_0d	EXIST::FUNCTION:ENGINE
+SSL_CTX_get_info_callback               28	1_1_0d	EXIST::FUNCTION:
+SSL_get_wbio                            29	1_1_0d	EXIST::FUNCTION:
+SSL_write                               30	1_1_0d	EXIST::FUNCTION:
+GMTLS_server_method                     31	1_1_0d	EXIST::FUNCTION:GMTLS
+SSL_CTX_set_not_resumable_session_callback 32	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_timeout                     33	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_PrivateKey_file             34	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_ctrl                            35	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_next_protos_advertised_cb   36	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
+SSL_SESSION_get_time                    37	1_1_0d	EXIST::FUNCTION:
+SSL_select_next_proto                   38	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_strength                39	1_1_0d	EXIST::FUNCTION:SRP
+SSL_SESSION_get0_hostname               40	1_1_0d	EXIST::FUNCTION:
+SSL_set0_rbio                           41	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get_ticket_lifetime_hint    42	1_1_0d	EXIST::FUNCTION:
+SSL_get_psk_identity                    43	1_1_0d	EXIST::FUNCTION:PSK
+DTLSv1_listen                           44	1_1_0d	EXIST::FUNCTION:SOCK
+SSL_CTX_set_srp_username                45	1_1_0d	EXIST::FUNCTION:SRP
+SSL_SESSION_up_ref                      46	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_client_CA_list              47	1_1_0d	EXIST::FUNCTION:
+GMTLS_method                            48	1_1_0d	EXIST::FUNCTION:GMTLS
+SSL_CTX_add_session                     49	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_default_passwd_cb_userdata  50	1_1_0d	EXIST::FUNCTION:
+SSL_set_srp_server_param_pw             51	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_set0_security_ex_data           52	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_dane_mtype_set                  53	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sess_set_remove_cb              54	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sess_set_new_cb                 55	1_1_0d	EXIST::FUNCTION:
+SSL_srp_server_param_with_username      56	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_dane_clear_flags                57	1_1_0d	EXIST::FUNCTION:
+SSL_get0_dane                           58	1_1_0d	EXIST::FUNCTION:
+SSL_get_rbio                            59	1_1_0d	EXIST::FUNCTION:
+SSL_set_security_callback               60	1_1_0d	EXIST::FUNCTION:
+SSL_set_quiet_shutdown                  61	1_1_0d	EXIST::FUNCTION:
+SSL_get0_verified_chain                 62	1_1_0d	EXIST::FUNCTION:
+SSL_get_ssl_method                      63	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_dane_set_flags                  64	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_get_name                     65	1_1_0d	EXIST::FUNCTION:
+SSL_callback_ctrl                       66	1_1_0d	EXIST::FUNCTION:
+SSL_waiting_for_async                   67	1_1_0d	EXIST::FUNCTION:
+TLSv1_1_method                          68	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
+ERR_load_SSL_strings                    69	1_1_0d	EXIST::FUNCTION:
+SSL_get_default_timeout                 70	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_check_private_key               71	1_1_0d	EXIST::FUNCTION:
+SSL_set_bio                             72	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_CTX_set_ssl_ctx                73	1_1_0d	EXIST::FUNCTION:
+SSL_get_servername_type                 74	1_1_0d	EXIST::FUNCTION:
+SSL_SRP_CTX_init                        75	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CONF_CTX_finish                     76	1_1_0d	EXIST::FUNCTION:
+SSL_get_srp_N                           77	1_1_0d	EXIST::FUNCTION:SRP
+TLS_client_method                       78	1_1_0d	EXIST::FUNCTION:
+SSL_set_trust                           79	1_1_0d	EXIST::FUNCTION:
+SSL_get0_alpn_selected                  80	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_verify_param_callback   81	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CIPHER_get_kx_nid                   82	1_1_0d	EXIST::FUNCTION:
+BIO_f_ssl                               83	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_trust                       84	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cipher_list                 85	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_security_callback           86	1_1_0d	EXIST::FUNCTION:
+TLSv1_client_method                     87	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
+SSL_set_psk_server_callback             88	1_1_0d	EXIST::FUNCTION:PSK
+SSL_CTX_get0_privatekey                 89	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_cert_store                  90	1_1_0d	EXIST::FUNCTION:
+SSL_set_srp_server_param                91	1_1_0d	EXIST::FUNCTION:SRP
+SSL_set_session_ticket_ext              92	1_1_0d	EXIST::FUNCTION:
+SSL_COMP_get0_name                      93	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_serverinfo_file             94	1_1_0d	EXIST::FUNCTION:
+SSL_load_client_CA_file                 95	1_1_0d	EXIST::FUNCTION:
+DTLS_server_method                      96	1_1_0d	EXIST::FUNCTION:
+SSL_read                                97	1_1_0d	EXIST::FUNCTION:
+SSL_get_shared_sigalgs                  98	1_1_0d	EXIST::FUNCTION:
+SSL_COMP_set0_compression_methods       99	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_set1_id_context             100	1_1_0d	EXIST::FUNCTION:
+SSL_get_finished                        101	1_1_0d	EXIST::FUNCTION:
+GMTLS_client_method                     102	1_1_0d	EXIST::FUNCTION:GMTLS
+SSL_get_peer_finished                   103	1_1_0d	EXIST::FUNCTION:
+SSL_state_string                        104	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_certificate_chain_file      105	1_1_0d	EXIST::FUNCTION:
+SSL_version                             106	1_1_0d	EXIST::FUNCTION:
+TLSv1_2_server_method                   107	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
+SSL_CTX_set_purpose                     108	1_1_0d	EXIST::FUNCTION:
+SSL_set_purpose                         109	1_1_0d	EXIST::FUNCTION:
+SSL_get_verify_result                   110	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_ex_data                     111	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_CTX_clear_flags                112	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_CTX_new                        113	1_1_0d	EXIST::FUNCTION:
+SSL_set_debug                           114	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0
+SSL_is_server                           115	1_1_0d	EXIST::FUNCTION:
+BIO_new_ssl                             116	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_ciphers                     117	1_1_0d	EXIST::FUNCTION:
+SSL_peek                                118	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_SRP_CTX_init                    119	1_1_0d	EXIST::FUNCTION:SRP
+SSL_SRP_CTX_free                        120	1_1_0d	EXIST::FUNCTION:SRP
+SSL_get_client_ciphers                  121	1_1_0d	EXIST::FUNCTION:
+SSL_new                                 122	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_certificate_ASN1            123	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_ct_validation_callback      124	1_1_0d	EXIST::FUNCTION:CT
+SSL_COMP_get_name                       125	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_print_keylog                126	1_1_0d	EXIST::FUNCTION:
+SSL_set_wfd                             127	1_1_0d	EXIST::FUNCTION:SOCK
+SSL_get_client_CA_list                  128	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_alpn_select_cb              129	1_1_0d	EXIST::FUNCTION:
+SSL_get_current_expansion               130	1_1_0d	EXIST::FUNCTION:
+SSL_set_not_resumable_session_callback  131	1_1_0d	EXIST::FUNCTION:
+SSL_enable_ct                           132	1_1_0d	EXIST::FUNCTION:CT
+SSL_get_version                         133	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cookie_generate_cb          134	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get_timeout                 135	1_1_0d	EXIST::FUNCTION:
+SSL_get_peer_cert_chain                 136	1_1_0d	EXIST::FUNCTION:
+SSL_get_sigalgs                         137	1_1_0d	EXIST::FUNCTION:
+BIO_ssl_copy_session_id                 138	1_1_0d	EXIST::FUNCTION:
+SSL_get_all_async_fds                   139	1_1_0d	EXIST::FUNCTION:
+BIO_new_buffer_ssl_connect              140	1_1_0d	EXIST::FUNCTION:
+SSL_get_srtp_profiles                   141	1_1_0d	EXIST::FUNCTION:SRTP
+SSL_CTX_set_default_passwd_cb           142	1_1_0d	EXIST::FUNCTION:
+SSL_set_session_secret_cb               143	1_1_0d	EXIST::FUNCTION:
+SSL_get_security_level                  144	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_client_CA_list              145	1_1_0d	EXIST::FUNCTION:
+DTLSv1_2_client_method                  146	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
+SSL_clear_options                       147	1_1_0d	EXIST::FUNCTION:
+SSL_has_pending                         148	1_1_0d	EXIST::FUNCTION:
+SSL_state_string_long                   149	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_free                        150	1_1_0d	EXIST::FUNCTION:
+SSL_get_quiet_shutdown                  151	1_1_0d	EXIST::FUNCTION:
+SSL_get_servername                      152	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_verify_depth                153	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_security_callback           154	1_1_0d	EXIST::FUNCTION:
+SSL_alert_desc_string_long              155	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get_master_key              156	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_verify                      157	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_set_timeout                 158	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_callback_ctrl                   159	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get0_ctlog_store                160	1_1_0d	EXIST::FUNCTION:CT
+SSL_CONF_CTX_set_flags                  161	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_clear_options                   162	1_1_0d	EXIST::FUNCTION:
+SSL_get_info_callback                   163	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_psk_client_callback         164	1_1_0d	EXIST::FUNCTION:PSK
+SSL_set_options                         165	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_set_time                    166	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_psk_server_callback         167	1_1_0d	EXIST::FUNCTION:PSK
+SSL_free                                168	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_add_server_custom_ext           169	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_cb_arg                  170	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_set_tlsext_use_srtp             171	1_1_0d	EXIST::FUNCTION:SRTP
+DTLSv1_2_method                         172	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
+SSL_set_session_ticket_ext_cb           173	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_client_cert_cb              174	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_get_cipher_nid               175	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_ssl_version                 176	1_1_0d	EXIST::FUNCTION:
+SSL_get_srp_userinfo                    177	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_use_psk_identity_hint           178	1_1_0d	EXIST::FUNCTION:PSK
+SSL_get_ciphers                         179	1_1_0d	EXIST::FUNCTION:
+TLSv1_2_method                          180	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
+DTLSv1_2_server_method                  181	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
+SSLv3_method                            182	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
+SSL_rstate_string_long                  183	1_1_0d	EXIST::FUNCTION:
+SSL_set_generate_session_id             184	1_1_0d	EXIST::FUNCTION:
+SSL_set_ssl_method                      185	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_is_aead                      186	1_1_0d	EXIST::FUNCTION:
+SSL_get_cipher_list                     187	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_load_verify_locations           188	1_1_0d	EXIST::FUNCTION:
+SSL_clear                               189	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_has_client_custom_ext           190	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_security_level              191	1_1_0d	EXIST::FUNCTION:
+SSL_add_ssl_module                      192	1_1_0d	EXIST::FUNCTION:
+SSL_get0_peer_scts                      193	1_1_0d	EXIST::FUNCTION:CT
+SSL_use_RSAPrivateKey                   194	1_1_0d	EXIST::FUNCTION:RSA
+SSL_CIPHER_get_bits                     195	1_1_0d	EXIST::FUNCTION:
+TLSv1_method                            196	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
+SSL_CTX_dane_enable                     197	1_1_0d	EXIST::FUNCTION:
+SSL_check_private_key                   198	1_1_0d	EXIST::FUNCTION:
+SSL_set1_param                          199	1_1_0d	EXIST::FUNCTION:
+SSL_add_client_CA                       200	1_1_0d	EXIST::FUNCTION:
+SSL_set_rfd                             201	1_1_0d	EXIST::FUNCTION:SOCK
+SSL_COMP_get_compression_methods        202	1_1_0d	EXIST::FUNCTION:
+SSL_set_accept_state                    203	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cookie_verify_cb            204	1_1_0d	EXIST::FUNCTION:
+SSL_get_ex_data                         205	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get_ex_data                 206	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_next_proto_select_cb        207	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
+d2i_SSL_SESSION                         208	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_remove_session                  209	1_1_0d	EXIST::FUNCTION:
+SSL_get_default_passwd_cb               210	1_1_0d	EXIST::FUNCTION:
+SSL_get0_dane_tlsa                      211	1_1_0d	EXIST::FUNCTION:
+SSL_get_srp_g                           212	1_1_0d	EXIST::FUNCTION:SRP
+SSL_in_before                           213	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_ssl_method                  214	1_1_0d	EXIST::FUNCTION:
+SSL_use_psk_identity_hint               215	1_1_0d	EXIST::FUNCTION:PSK
+DTLSv1_client_method                    216	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
+SSL_CTX_ct_is_enabled                   217	1_1_0d	EXIST::FUNCTION:CT
+SSL_CTX_use_RSAPrivateKey               218	1_1_0d	EXIST::FUNCTION:RSA
+SSL_trace                               219	1_1_0d	EXIST::FUNCTION:SSL_TRACE
+SSL_set_SSL_CTX                         220	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_default_passwd_cb_userdata  221	1_1_0d	EXIST::FUNCTION:
+SSL_renegotiate_pending                 222	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_find                         223	1_1_0d	EXIST::FUNCTION:
+SSL_get_certificate                     224	1_1_0d	EXIST::FUNCTION:
+SSL_renegotiate                         225	1_1_0d	EXIST::FUNCTION:
+SSL_set_psk_client_callback             226	1_1_0d	EXIST::FUNCTION:PSK
+SSL_set_default_passwd_cb               227	1_1_0d	EXIST::FUNCTION:
+SSL_set_ex_data                         228	1_1_0d	EXIST::FUNCTION:
+i2d_SSL_SESSION                         229	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_new                         230	1_1_0d	EXIST::FUNCTION:
+OPENSSL_init_ssl                        231	1_1_0d	EXIST::FUNCTION:
+SSL_get0_param                          232	1_1_0d	EXIST::FUNCTION:
+SSL_get_srp_username                    233	1_1_0d	EXIST::FUNCTION:SRP
+SSL_renegotiate_abbreviated             234	1_1_0d	EXIST::FUNCTION:
+SSL_get_wfd                             235	1_1_0d	EXIST::FUNCTION:
+SSL_set_default_passwd_cb_userdata      236	1_1_0d	EXIST::FUNCTION:
+SSL_use_PrivateKey_file                 237	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_add_client_custom_ext           238	1_1_0d	EXIST::FUNCTION:
+SSL_get_session                         239	1_1_0d	EXIST::FUNCTION:
+SSL_get_security_callback               240	1_1_0d	EXIST::FUNCTION:
+SSL_set_cert_cb                         241	1_1_0d	EXIST::FUNCTION:
+SSL_get1_supported_ciphers              242	1_1_0d	EXIST::FUNCTION:
+SSL_dane_tlsa_add                       243	1_1_0d	EXIST::FUNCTION:
+SSL_get_rfd                             244	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get0_security_ex_data           245	1_1_0d	EXIST::FUNCTION:
+SSL_get_state                           246	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cert_verify_callback        247	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_get_id                       248	1_1_0d	EXIST::FUNCTION:
+SSL_get_changed_async_fds               249	1_1_0d	EXIST::FUNCTION:
+SSL_set1_host                           250	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sess_set_get_cb                 251	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_CTX_set_ssl                    252	1_1_0d	EXIST::FUNCTION:
+SSL_get0_dane_authority                 253	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_free                            254	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_verify_mode                 255	1_1_0d	EXIST::FUNCTION:
+DTLS_client_method                      256	1_1_0d	EXIST::FUNCTION:
+BIO_ssl_shutdown                        257	1_1_0d	EXIST::FUNCTION:
+PEM_read_SSL_SESSION                    258	1_1_0d	EXIST::FUNCTION:STDIO
+SSL_set_read_ahead                      259	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_config                          260	1_1_0d	EXIST::FUNCTION:
+SSL_get_privatekey                      261	1_1_0d	EXIST::FUNCTION:
+SSL_get_read_ahead                      262	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_default_passwd_cb           263	1_1_0d	EXIST::FUNCTION:
+SSL_get_verify_callback                 264	1_1_0d	EXIST::FUNCTION:
+SSL_get_verify_depth                    265	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_quiet_shutdown              266	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_ctlog_list_file             267	1_1_0d	EXIST::FUNCTION:CT
+SSL_SESSION_get0_ticket                 268	1_1_0d	EXIST::FUNCTION:
+SSL_use_RSAPrivateKey_file              269	1_1_0d	EXIST::FUNCTION:RSA
+SSL_CTX_flush_sessions                  270	1_1_0d	EXIST::FUNCTION:
+SSL_is_gmtls                            271	1_1_0d	EXIST::FUNCTION:
+SSL_get1_session                        272	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_up_ref                          273	1_1_0d	EXIST::FUNCTION:
+SSL_set_verify_depth                    274	1_1_0d	EXIST::FUNCTION:
+TLS_server_method                       275	1_1_0d	EXIST::FUNCTION:
+PEM_write_SSL_SESSION                   276	1_1_0d	EXIST::FUNCTION:STDIO
+DTLS_method                             277	1_1_0d	EXIST::FUNCTION:
+SSL_get_shared_ciphers                  278	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_info_callback               279	1_1_0d	EXIST::FUNCTION:
+SSL_dup_CA_list                         280	1_1_0d	EXIST::FUNCTION:
+SSL_set_fd                              281	1_1_0d	EXIST::FUNCTION:SOCK
+SSL_set_cipher_list                     282	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_set1_id                     283	1_1_0d	EXIST::FUNCTION:
+SSL_set_alpn_protos                     284	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get_protocol_version        285	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_alpn_protos                 286	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_options                     287	1_1_0d	EXIST::FUNCTION:
+PEM_read_bio_SSL_SESSION                288	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set0_ctlog_store                289	1_1_0d	EXIST::FUNCTION:CT
+SSL_SESSION_get_compress_id             290	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cert_cb                     291	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_set_ex_data                 292	1_1_0d	EXIST::FUNCTION:
+SSL_set_default_read_buffer_len         293	1_1_0d	EXIST::FUNCTION:
+SSL_set_session                         294	1_1_0d	EXIST::FUNCTION:
+SSLv3_server_method                     295	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
+SSL_get_psk_identity_hint               296	1_1_0d	EXIST::FUNCTION:PSK
+SSL_CTX_set_default_verify_dir          297	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_generate_session_id         298	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_options                     299	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_certificate                 300	1_1_0d	EXIST::FUNCTION:
+SSL_add_dir_cert_subjects_to_stack      301	1_1_0d	EXIST::FUNCTION:
+SSL_dane_enable                         302	1_1_0d	EXIST::FUNCTION:
+SSLv3_client_method                     303	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
+SSL_alert_type_string_long              304	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_serverinfo                  305	1_1_0d	EXIST::FUNCTION:
+SSL_get0_next_proto_negotiated          306	1_1_0d	EXIST::FUNCTION:NEXTPROTONEG
+SSL_CTX_use_certificate_file            307	1_1_0d	EXIST::FUNCTION:
+SSL_add1_host                           308	1_1_0d	EXIST::FUNCTION:
+SSL_use_PrivateKey                      309	1_1_0d	EXIST::FUNCTION:
+SSL_set_client_CA_list                  310	1_1_0d	EXIST::FUNCTION:
+SSL_set_tmp_dh_callback                 311	1_1_0d	EXIST::FUNCTION:DH
+SSL_CIPHER_get_version                  312	1_1_0d	EXIST::FUNCTION:
+DTLSv1_method                           313	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
+SSL_set_shutdown                        314	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_password                315	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_set_default_verify_file         316	1_1_0d	EXIST::FUNCTION:
+SSL_alert_desc_string                   317	1_1_0d	EXIST::FUNCTION:
+SSL_use_certificate_chain_file          318	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get0_cipher                 319	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_client_pwd_callback     320	1_1_0d	EXIST::FUNCTION:SRP
+SSL_set0_security_ex_data               321	1_1_0d	EXIST::FUNCTION:
+SSL_ct_is_enabled                       322	1_1_0d	EXIST::FUNCTION:CT
+SSL_SESSION_get0_peer                   323	1_1_0d	EXIST::FUNCTION:
+SSL_get_selected_srtp_profile           324	1_1_0d	EXIST::FUNCTION:SRTP
+SSL_set_connect_state                   325	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_tmp_dh_callback             326	1_1_0d	EXIST::FUNCTION:DH
+SRP_Calc_A_param                        327	1_1_0d	EXIST::FUNCTION:SRP
+SSL_CTX_use_RSAPrivateKey_ASN1          328	1_1_0d	EXIST::FUNCTION:RSA
+SSL_set_info_callback                   329	1_1_0d	EXIST::FUNCTION:
+SSL_get_current_cipher                  330	1_1_0d	EXIST::FUNCTION:
+SSL_set_ct_validation_callback          331	1_1_0d	EXIST::FUNCTION:CT
+SSL_export_keying_material              332	1_1_0d	EXIST::FUNCTION:
+TLSv1_2_client_method                   333	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
+SSL_get0_security_ex_data               334	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_verify_depth                335	1_1_0d	EXIST::FUNCTION:
+SSL_use_PrivateKey_ASN1                 336	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_cert_store                  337	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_default_read_buffer_len     338	1_1_0d	EXIST::FUNCTION:
+SSL_get_client_random                   339	1_1_0d	EXIST::FUNCTION:
+SSL_set0_wbio                           340	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sessions                        341	1_1_0d	EXIST::FUNCTION:
+SSL_get_ex_data_X509_STORE_CTX_idx      342	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_sess_get_get_cb                 343	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_CTX_set1_prefix                344	1_1_0d	EXIST::FUNCTION:
+SSL_set_msg_callback                    345	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_cmd_value_type                 346	1_1_0d	EXIST::FUNCTION:
+SSL_copy_session_id                     347	1_1_0d	EXIST::FUNCTION:
+SSL_dup                                 348	1_1_0d	EXIST::FUNCTION:
+SSL_get_server_random                   349	1_1_0d	EXIST::FUNCTION:
+SSL_SESSION_get0_id_context             350	1_1_0d	EXIST::FUNCTION:
+SSL_set_hostflags                       351	1_1_0d	EXIST::FUNCTION:
+PEM_write_bio_SSL_SESSION               352	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_PrivateKey                  353	1_1_0d	EXIST::FUNCTION:
+SSL_get0_peername                       354	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_timeout                     355	1_1_0d	EXIST::FUNCTION:
+SSL_use_RSAPrivateKey_ASN1              356	1_1_0d	EXIST::FUNCTION:RSA
+SSL_ctrl                                357	1_1_0d	EXIST::FUNCTION:
+SSL_use_certificate                     358	1_1_0d	EXIST::FUNCTION:
+SSL_check_chain                         359	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_PrivateKey_ASN1             360	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_srp_username_callback       361	1_1_0d	EXIST::FUNCTION:SRP
+SSL_get_fd                              362	1_1_0d	EXIST::FUNCTION:
+SSL_get_current_compression             363	1_1_0d	EXIST::FUNCTION:
+SSL_add_file_cert_subjects_to_stack     364	1_1_0d	EXIST::FUNCTION:
+SSL_dane_set_flags                      365	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get0_certificate                366	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_new                             367	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set1_param                      368	1_1_0d	EXIST::FUNCTION:
+SSL_set_verify                          369	1_1_0d	EXIST::FUNCTION:
+SSL_use_certificate_file                370	1_1_0d	EXIST::FUNCTION:
+SSL_dane_clear_flags                    371	1_1_0d	EXIST::FUNCTION:
+TLS_method                              372	1_1_0d	EXIST::FUNCTION:
+SSL_in_init                             373	1_1_0d	EXIST::FUNCTION:
+SSL_test_functions                      374	1_1_0d	EXIST::FUNCTION:UNIT_TEST
+SSL_get_options                         375	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_use_RSAPrivateKey_file          376	1_1_0d	EXIST::FUNCTION:RSA
+SSL_CONF_CTX_free                       377	1_1_0d	EXIST::FUNCTION:
+TLSv1_1_server_method                   378	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
+SSL_session_reused                      379	1_1_0d	EXIST::FUNCTION:
+SSL_COMP_add_compression_method         380	1_1_0d	EXIST::FUNCTION:
+SSL_connect                             381	1_1_0d	EXIST::FUNCTION:
+SSL_use_certificate_ASN1                382	1_1_0d	EXIST::FUNCTION:
+SSL_up_ref                              383	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_quiet_shutdown              384	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_enable_ct                       385	1_1_0d	EXIST::FUNCTION:CT
+SSL_CTX_set_msg_callback                386	1_1_0d	EXIST::FUNCTION:
+SSL_get_shutdown                        387	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_cmd_argv                       388	1_1_0d	EXIST::FUNCTION:
+SSL_want                                389	1_1_0d	EXIST::FUNCTION:
+SSL_alert_type_string                   390	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_client_cert_cb              391	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_default_verify_paths        392	1_1_0d	EXIST::FUNCTION:
+SSL_get_verify_mode                     393	1_1_0d	EXIST::FUNCTION:
+SSL_extension_supported                 394	1_1_0d	EXIST::FUNCTION:
+SSL_is_init_finished                    395	1_1_0d	EXIST::FUNCTION:
+SSL_CONF_cmd                            396	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_session_id_context          397	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_ex_data                     398	1_1_0d	EXIST::FUNCTION:
+SSL_pending                             399	1_1_0d	EXIST::FUNCTION:
+SSL_set_session_id_context              400	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get_verify_callback             401	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_get0_param                      402	1_1_0d	EXIST::FUNCTION:
+SSL_set_tlsext_use_srtp                 403	1_1_0d	EXIST::FUNCTION:SRTP
+SSL_CIPHER_get_digest_nid               404	1_1_0d	EXIST::FUNCTION:
+SSL_CTX_set_security_level              405	1_1_0d	EXIST::FUNCTION:
+SSL_has_matching_session_id             406	1_1_0d	EXIST::FUNCTION:
+SSL_get_error                           407	1_1_0d	EXIST::FUNCTION:
+SSL_CIPHER_get_auth_nid                 408	1_1_0d	EXIST::FUNCTION:
+TLSv1_server_method                     409	1_1_0d	EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
+SSL_accept                              410	1_1_0d	EXIST::FUNCTION:
+BIO_new_ssl_connect                     411	1_1_0d	EXIST::FUNCTION: