Changed the crypto make system to add build flexibility. The update cancels the requirement for the dir structures to be identical in all crypto implementation and supports impl. dependent tests. Also, minor libk5crypto.exports list reduction ( from f_tables)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22995 dc483132-0cff-0310-8789-dd5450dbe970

24 files changed, 917 insertions, 201 deletions

diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in
index deccbd6..7205660 100644
--- a/src/lib/crypto/builtin/Makefile.in
+++ b/src/lib/crypto/builtin/Makefile.in
@@ -5,18 +5,20 @@ BUILDTOP=$(REL)..$(S)..$(S)..
 SUBDIRS=des arcfour aes	 md4 md5  sha1 enc_provider hash_provider
 LOCALINCLUDES = -I$(srcdir)/../krb 			\
 		-I$(srcdir)/../krb/hash_provider 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/des 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/aes 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/arcfour 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/sha1 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/md4 	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/md5	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/enc_provider	\
-		-I$(srcdir)/../@CRYPTO_IMPL@/hash_provider 	
+		-I$(srcdir)/des 	\
+		-I$(srcdir)/aes 	\
+		-I$(srcdir)/arcfour 	\
+		-I$(srcdir)/sha1 	\
+		-I$(srcdir)/md4 	\
+		-I$(srcdir)/md5	\
+		-I$(srcdir)/enc_provider	\
+		-I$(srcdir)/hash_provider 	
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 DEFS=
 
+EXTRADEPSRCS= $(srcdir)/t_cf2.c 
+
 
 ##DOSBUILDTOP = ..\..\..
 ##DOSLIBNAME=$(OUTPRE)crypto.lib
@@ -25,16 +27,16 @@ DEFS=
 ##DOSOBJFILEDEP =$(OUTPRE)crypto.lst $(OUTPRE)des.lst $(OUTPRE)md4.lst $(OUTPRE)md5.lst $(OUTPRE)sha1.lst $(OUTPRE)arcfour.lst $(OUTPRE)crc32.lst $(OUTPRE)dk.lst $(OUTPRE)old.lst $(OUTPRE)raw.lst $(OUTPRE)enc_prov.lst $(OUTPRE)hash_pro.lst $(OUTPRE)kh_pro.lst $(OUTPRE)aes.lst
 
 STLIBOBJS=\
-	../@CRYPTO_IMPL@/hmac.o	\
-	../@CRYPTO_IMPL@/pbkdf2.o		
+	hmac.o	\
+	pbkdf2.o		
 
 OBJS=\
-	$(OUTPRE)../@CRYPTO_IMPL@/hmac.$(OBJEXT)	\
-	$(OUTPRE)../@CRYPTO_IMPL@/pbkdf2.$(OBJEXT)		
+	$(OUTPRE)hmac.$(OBJEXT)	\
+	$(OUTPRE)pbkdf2.$(OBJEXT)		
 
 SRCS=\
-	$(srcdir)/../@CRYPTO_IMPL@/hmac.c	\
-	$(srcdir)/../@CRYPTO_IMPL@/pbkdf2.c	
+	$(srcdir)/hmac.c	\
+	$(srcdir)/pbkdf2.c	
 
 STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
 	md5/OBJS.ST sha1/OBJS.ST 	\
@@ -59,6 +61,18 @@ includes:: depend
 depend:: $(SRCS)
 
 clean-unix:: clean-libobjs
+check-unix:: t_cf2
+	$(RUN_SETUP) $(VALGRIND) ./t_cf2 <$(srcdir)/t_cf2.in >t_cf2.output
+	diff t_cf2.output $(srcdir)/t_cf2.expected
+
+t_cf2$(EXEEXT): t_cf2.$(OBJEXT) $(SUPPORT_DEPLIB)
+	$(CC_LINK) -o $@ t_cf2.$(OBJEXT)  -lkrb5 -lk5crypto -lcom_err $(SUPPORT_LIB)
+
+clean::
+	$(RM)  t_cf2 t_cf2.o  t_cf2.output
+
+
+
 
 all-windows::
 	cd ..\des
diff --git a/src/lib/crypto/builtin/aes/Makefile.in b/src/lib/crypto/builtin/aes/Makefile.in
index a39e7df..d8e866f 100644
--- a/src/lib/crypto/builtin/aes/Makefile.in
+++ b/src/lib/crypto/builtin/aes/Makefile.in
@@ -12,30 +12,28 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-CIMPL = @CRYPTO_IMPL@/aes
-
 STLIBOBJS=\
-	../../$(CIMPL)/aescrypt.o	\
-	../../$(CIMPL)/aestab.o	\
-	../../$(CIMPL)/aeskey.o	\
-	../../$(CIMPL)/aes_s2k.o
+	aescrypt.o	\
+	aestab.o	\
+	aeskey.o	\
+	aes_s2k.o
 
 OBJS=\
-	$(OUTPRE)../../$(CIMPL)/aescrypt.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/aestab.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/aeskey.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/aes_s2k.$(OBJEXT)
+	$(OUTPRE)aescrypt.$(OBJEXT)	\
+	$(OUTPRE)aestab.$(OBJEXT)	\
+	$(OUTPRE)aeskey.$(OBJEXT)	\
+	$(OUTPRE)aes_s2k.$(OBJEXT)
 
 SRCS=\
-	$(srcdir)/../../$(CIMPL)/aescrypt.c	\
-	$(srcdir)/../../$(CIMPL)/aestab.c	\
-	$(srcdir)/../../$(CIMPL)/aeskey.c	\
-	$(srcdir)/../../$(CIMPL)/aes_s2k.c
+	$(srcdir)/aescrypt.c	\
+	$(srcdir)/aestab.c	\
+	$(srcdir)/aeskey.c	\
+	$(srcdir)/aes_s2k.c
 
 GEN_OBJS=\
-	$(OUTPRE)../../$(CIMPL)/aescrypt.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/aestab.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/aeskey.$(OBJEXT)
+	$(OUTPRE)aescrypt.$(OBJEXT)	\
+	$(OUTPRE)aestab.$(OBJEXT)	\
+	$(OUTPRE)aeskey.$(OBJEXT)
 
 ##DOS##LIBOBJS = $(OBJS)
 
@@ -45,11 +43,11 @@ includes:: depend
 
 depend:: $(SRCS)
 
-../../$(CIMPL)/aes-gen: ../../$(CIMPL)/aes-gen.o $(GEN_OBJS)
-	$(CC_LINK) -I../../../../include $(LOCALINCLUDES) -o ../../$(CIMPL)/aes-gen ../../$(CIMPL)/aes-gen.o $(GEN_OBJS)
+aes-gen: aes-gen.o $(GEN_OBJS)
+	$(CC_LINK) -I../../../../include $(LOCALINCLUDES) -o aes-gen aes-gen.o $(GEN_OBJS)
 
-run-aes-gen: ../../$(CIMPL)/aes-gen
-	../../$(CIMPL)/aes-gen > kresults.out
+run-aes-gen: aes-gen
+	./aes-gen > kresults.out
 
 check:: run-aes-gen
 
@@ -57,7 +55,7 @@ check:: run-aes-gen
 clean-unix:: clean-libobjs
 
 clean::
-	-$(RM) ../../$(CIMPL)/aes-gen ../../$(CIMPL)/aes-gen.o ../../$(CIMPL)/kresults.out
+	-$(RM) aes-gen aes-gen.o kresults.out
 
 @libobj_frag@
 
diff --git a/src/lib/crypto/builtin/aes/deps b/src/lib/crypto/builtin/aes/deps
index 6dc70ef..eac0a5c 100644
--- a/src/lib/crypto/builtin/aes/deps
+++ b/src/lib/crypto/builtin/aes/deps
@@ -2,15 +2,15 @@
 # Generated makefile dependencies follow.
 #
 aescrypt.so aescrypt.po $(OUTPRE)aescrypt.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(srcdir)/../../builtin/aes/aes.h \
-  $(srcdir)/../../builtin/aes/aescrypt.c $(srcdir)/../../builtin/aes/aesopt.h \
-  $(srcdir)/../../builtin/aes/uitypes.h
+  $(BUILDTOP)/include/autoconf.h $(srcdir)/aes.h \
+  $(srcdir)/aescrypt.c $(srcdir)/aesopt.h \
+  $(srcdir)/uitypes.h
 aestab.so aestab.po $(OUTPRE)aestab.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(srcdir)/../../builtin/aes/aes.h $(srcdir)/../../builtin/aes/aesopt.h \
-  $(srcdir)/../../builtin/aes/aestab.c $(srcdir)/../../builtin/aes/uitypes.h
+  $(srcdir)/aes.h $(srcdir)/aesopt.h \
+  $(srcdir)/aestab.c $(srcdir)/uitypes.h
 aeskey.so aeskey.po $(OUTPRE)aeskey.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(srcdir)/../../builtin/aes/aes.h $(srcdir)/../../builtin/aes/aeskey.c \
-  $(srcdir)/../../builtin/aes/aesopt.h $(srcdir)/../../builtin/aes/uitypes.h
+  $(srcdir)/aes.h $(srcdir)/aeskey.c \
+  $(srcdir)/aesopt.h $(srcdir)/uitypes.h
 aes_s2k.so aes_s2k.po $(OUTPRE)aes_s2k.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -20,5 +20,5 @@ aes_s2k.so aes_s2k.po $(OUTPRE)aes_s2k.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/aes/aes_s2k.c \
-  $(srcdir)/../../builtin/aes/aes_s2k.h $(srcdir)/../../krb/dk/dk.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/aes_s2k.c \
+  $(srcdir)/aes_s2k.h $(srcdir)/../../krb/dk/dk.h
diff --git a/src/lib/crypto/builtin/arcfour/Makefile.in b/src/lib/crypto/builtin/arcfour/Makefile.in
index 6b54f49..b1a9687 100644
--- a/src/lib/crypto/builtin/arcfour/Makefile.in
+++ b/src/lib/crypto/builtin/arcfour/Makefile.in
@@ -2,7 +2,7 @@ thisconfigdir=../../../..
 myfulldir=lib/crypto/builtin/arcfour
 mydir=lib/crypto/builtin/arcfour
 BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
-LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../@CRYPTO_IMPL@/md4  -I$(srcdir)/../../krb
+LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../md4  -I$(srcdir)/../../krb
 DEFS=
 
 ##DOS##BUILDTOP = ..\..\..\..
@@ -12,22 +12,20 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-CIMPL = @CRYPTO_IMPL@/arcfour
-
 STLIBOBJS=\
-	../../$(CIMPL)/arcfour.o	\
-	../../$(CIMPL)/arcfour_aead.o	\
-	../../$(CIMPL)/arcfour_s2k.o
+	arcfour.o	\
+	arcfour_aead.o	\
+	arcfour_s2k.o
 
 OBJS=\
-	$(OUTPRE)../../$(CIMPL)/arcfour.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/arcfour_aead.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/arcfour_s2k.$(OBJEXT)
+	$(OUTPRE)arcfour.$(OBJEXT)	\
+	$(OUTPRE)arcfour_aead.$(OBJEXT)	\
+	$(OUTPRE)arcfour_s2k.$(OBJEXT)
 
 SRCS=\
-	$(srcdir)/../../$(CIMPL)/arcfour.c	\
-	$(srcdir)/../../$(CIMPL)/arcfour_aead.c\
-	$(srcdir)/../../$(CIMPL)/arcfour_s2k.c
+	$(srcdir)/arcfour.c	\
+	$(srcdir)/arcfour_aead.c\
+	$(srcdir)/arcfour_s2k.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
diff --git a/src/lib/crypto/builtin/arcfour/deps b/src/lib/crypto/builtin/arcfour/deps
index 2179fcb..1356791 100644
--- a/src/lib/crypto/builtin/arcfour/deps
+++ b/src/lib/crypto/builtin/arcfour/deps
@@ -10,8 +10,8 @@ arcfour.so arcfour.po $(OUTPRE)arcfour.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/arcfour/arcfour-int.h \
-  $(srcdir)/../../builtin/arcfour/arcfour.c $(srcdir)/../../builtin/arcfour/arcfour.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/arcfour-int.h \
+  $(srcdir)/arcfour.c $(srcdir)/arcfour.h \
   $(srcdir)/../hash_provider/hash_provider.h
 arcfour_aead.so arcfour_aead.po $(OUTPRE)arcfour_aead.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
@@ -23,8 +23,8 @@ arcfour_aead.so arcfour_aead.po $(OUTPRE)arcfour_aead.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/arcfour/arcfour-int.h $(srcdir)/../../builtin/arcfour/arcfour.h \
-  $(srcdir)/../../builtin/arcfour/arcfour_aead.c $(srcdir)/../../krb/aead.h \
+  $(srcdir)/arcfour-int.h $(srcdir)/arcfour.h \
+  $(srcdir)/arcfour_aead.c $(srcdir)/../../krb/aead.h \
   $(srcdir)/../../krb/cksumtypes.h
 arcfour_s2k.so arcfour_s2k.po $(OUTPRE)arcfour_s2k.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
@@ -36,6 +36,7 @@ arcfour_s2k.so arcfour_s2k.po $(OUTPRE)arcfour_s2k.$(OBJEXT): \
   $(SRCTOP)/include/k5-utf8.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/arcfour/arcfour-int.h \
-  $(srcdir)/../../builtin/arcfour/arcfour.h $(srcdir)/../../builtin/arcfour/arcfour_s2k.c \
-  $(srcdir)/../../builtin/md4/rsa-md4.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/arcfour-int.h \
+  $(srcdir)/arcfour.h $(srcdir)/arcfour_s2k.c \
+  $(srcdir)/../md4/rsa-md4.h
+
diff --git a/src/lib/crypto/builtin/deps b/src/lib/crypto/builtin/deps
index f8bef28..2552b78 100644
--- a/src/lib/crypto/builtin/deps
+++ b/src/lib/crypto/builtin/deps
@@ -10,7 +10,7 @@ hmac.so hmac.po $(OUTPRE)hmac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../builtin/hmac.c \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/hmac.c \
   $(srcdir)/../krb/aead.h $(srcdir)/../krb/cksumtypes.h
 pbkdf2.so pbkdf2.po $(OUTPRE)pbkdf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
@@ -21,5 +21,5 @@ pbkdf2.so pbkdf2.po $(OUTPRE)pbkdf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../builtin/hash_provider/hash_provider.h \
-  $(srcdir)/../builtin/pbkdf2.c
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/hash_provider/hash_provider.h \
+  $(srcdir)/pbkdf2.c
diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in
index d17d9d2..bfe48e8 100644
--- a/src/lib/crypto/builtin/des/Makefile.in
+++ b/src/lib/crypto/builtin/des/Makefile.in
@@ -13,50 +13,49 @@ RUN_SETUP = @KRB5_RUN_ENV@
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-CIMPL = @CRYPTO_IMPL@/des
 
 STLIBOBJS=\
-	../../$(CIMPL)/afsstring2key.o	\
-	../../$(CIMPL)/d3_cbc.o	\
-	../../$(CIMPL)/d3_aead.o	\
-	../../$(CIMPL)/d3_kysched.o	\
-	../../$(CIMPL)/f_aead.o 	\
-	../../$(CIMPL)/f_cbc.o 	\
-	../../$(CIMPL)/f_cksum.o	\
-	../../$(CIMPL)/f_parity.o 	\
-	../../$(CIMPL)/f_sched.o 	\
-	../../$(CIMPL)/f_tables.o	\
-	../../$(CIMPL)/key_sched.o	\
-	../../$(CIMPL)/string2key.o	\
-	../../$(CIMPL)/weak_key.o
-
-OBJS=	$(OUTPRE)../../$(CIMPL)/afsstring2key.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/d3_cbc.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/d3_aead.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/d3_kysched.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/f_aead.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/f_cbc.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/f_cksum.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/f_parity.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/f_sched.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/f_tables.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/key_sched.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/string2key.$(OBJEXT)	\
-	$(OUTPRE)../../$(CIMPL)/weak_key.$(OBJEXT)
-
-SRCS=	$(srcdir)/../../$(CIMPL)/afsstring2key.c	\
-	$(srcdir)/../../$(CIMPL)/d3_cbc.c	\
-	$(srcdir)/../../$(CIMPL)/d3_aead.c	\
-	$(srcdir)/../../$(CIMPL)/d3_kysched.c	\
-	$(srcdir)/../../$(CIMPL)/f_aead.c	\
-	$(srcdir)/../../$(CIMPL)/f_cbc.c	\
-	$(srcdir)/../../$(CIMPL)/f_cksum.c	\
-	$(srcdir)/../../$(CIMPL)/f_parity.c	\
-	$(srcdir)/../../$(CIMPL)/f_sched.c	\
-	$(srcdir)/../../$(CIMPL)/f_tables.c	\
-	$(srcdir)/../../$(CIMPL)/key_sched.c	\
-	$(srcdir)/../../$(CIMPL)/weak_key.c	\
-	$(srcdir)/../../$(CIMPL)/string2key.c
+	afsstring2key.o	\
+	d3_cbc.o	\
+	d3_aead.o	\
+	d3_kysched.o	\
+	f_aead.o 	\
+	f_cbc.o 	\
+	f_cksum.o	\
+	f_parity.o 	\
+	f_sched.o 	\
+	f_tables.o	\
+	key_sched.o	\
+	string2key.o	\
+	weak_key.o
+
+OBJS=	$(OUTPRE)afsstring2key.$(OBJEXT)	\
+	$(OUTPRE)d3_cbc.$(OBJEXT)	\
+	$(OUTPRE)d3_aead.$(OBJEXT)	\
+	$(OUTPRE)d3_kysched.$(OBJEXT)	\
+	$(OUTPRE)f_aead.$(OBJEXT) 	\
+	$(OUTPRE)f_cbc.$(OBJEXT) 	\
+	$(OUTPRE)f_cksum.$(OBJEXT)	\
+	$(OUTPRE)f_parity.$(OBJEXT) 	\
+	$(OUTPRE)f_sched.$(OBJEXT) 	\
+	$(OUTPRE)f_tables.$(OBJEXT)	\
+	$(OUTPRE)key_sched.$(OBJEXT)	\
+	$(OUTPRE)string2key.$(OBJEXT)	\
+	$(OUTPRE)weak_key.$(OBJEXT)
+
+SRCS=	$(srcdir)/afsstring2key.c	\
+	$(srcdir)/d3_cbc.c	\
+	$(srcdir)/d3_aead.c	\
+	$(srcdir)/d3_kysched.c	\
+	$(srcdir)/f_aead.c	\
+	$(srcdir)/f_cbc.c	\
+	$(srcdir)/f_cksum.c	\
+	$(srcdir)/f_parity.c	\
+	$(srcdir)/f_sched.c	\
+	$(srcdir)/f_tables.c	\
+	$(srcdir)/key_sched.c	\
+	$(srcdir)/weak_key.c	\
+	$(srcdir)/string2key.c
 
 EXTRADEPSRCS = $(SRCDIR)destest.c
 
@@ -66,13 +65,29 @@ TOBJS = $(OUTPRE)key_sched.$(OBJEXT) $(OUTPRE)f_sched.$(OBJEXT) \
 	$(OUTPRE)f_cbc.$(OBJEXT) $(OUTPRE)f_tables.$(OBJEXT) \
 	$(OUTPRE)f_cksum.$(OBJEXT)
 
+verify$(EXEEXT): t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \
+	$(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
+	$(CC_LINK) -o $@ t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \
+		-lcom_err $(SUPPORT_LIB)
+
 destest$(EXEEXT): destest.$(OBJEXT) $(TOBJS) $(SUPPORT_DEPLIB)
 	$(CC_LINK) -o $@ destest.$(OBJEXT) $(TOBJS) $(SUPPORT_LIB)
 
 all-unix:: all-libobjs
 
-check-unix:: destest
+TAFSS2KOBJS =							   \
+	t_afss2k.$(OBJEXT) $(TOBJS)				     \
+	afsstring2key.$(OBJEXT) f_parity.$(OBJEXT) weak_key.$(OBJEXT)
+
+t_afss2k$(EXEEXT): $(TAFSS2KOBJS) $(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
+	$(CC_LINK) -o $@ $(TAFSS2KOBJS) -lcom_err $(SUPPORT_LIB)
+
+check-unix:: verify destest t_afss2k
+	$(RUN_SETUP) $(VALGRIND) ./verify -z
+	$(RUN_SETUP) $(VALGRIND) ./verify -m
+	$(RUN_SETUP) $(VALGRIND) ./verify
 	$(RUN_SETUP) $(VALGRIND) ./destest < $(srcdir)/keytest.data
+	$(RUN_SETUP) $(VALGRIND) ./t_afss2k
 
 includes:: depend
 
@@ -81,7 +96,8 @@ depend:: $(SRCS)
 check-windows::
 
 clean::
-	$(RM) destest.$(OBJEXT) destest$(EXEEXT)
+	$(RM) destest.$(OBJEXT) destest$(EXEEXT) \
+	t_verify.$(OBJEXT) t_afss2k.$(OBJEXT) t_afss2k$(EXEEXT)
 
 clean-unix:: clean-libobjs
 
diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps
index 4d91187..ed127e9 100644
--- a/src/lib/crypto/builtin/des/deps
+++ b/src/lib/crypto/builtin/des/deps
@@ -11,7 +11,7 @@ afsstring2key.so afsstring2key.po $(OUTPRE)afsstring2key.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/afsstring2key.c $(srcdir)/../../builtin/des/des_int.h
+  $(srcdir)/afsstring2key.c $(srcdir)/des_int.h
 d3_cbc.so d3_cbc.po $(OUTPRE)d3_cbc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -21,8 +21,8 @@ d3_cbc.so d3_cbc.po $(OUTPRE)d3_cbc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/d3_cbc.c \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/f_tables.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/d3_cbc.c \
+  $(srcdir)/des_int.h $(srcdir)/f_tables.h
 d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -32,8 +32,8 @@ d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/d3_aead.c \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/f_tables.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/d3_aead.c \
+  $(srcdir)/des_int.h $(srcdir)/f_tables.h \
   $(srcdir)/../../krb/aead.h $(srcdir)/../../krb/cksumtypes.h
 d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
@@ -45,7 +45,7 @@ d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/d3_kysched.c $(srcdir)/../../builtin/des/des_int.h
+  $(srcdir)/d3_kysched.c $(srcdir)/des_int.h
 f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -55,8 +55,8 @@ f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/des/f_aead.c $(srcdir)/../../builtin/des/f_tables.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/des_int.h \
+  $(srcdir)/f_aead.c $(srcdir)/f_tables.h \
   $(srcdir)/../../krb/aead.h $(srcdir)/../../krb/cksumtypes.h
 f_cbc.so f_cbc.po $(OUTPRE)f_cbc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
@@ -67,8 +67,8 @@ f_cbc.so f_cbc.po $(OUTPRE)f_cbc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/des/f_cbc.c $(srcdir)/../../builtin/des/f_tables.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/des_int.h \
+  $(srcdir)/f_cbc.c $(srcdir)/f_tables.h
 f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -78,8 +78,8 @@ f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/des/f_cksum.c $(srcdir)/../../builtin/des/f_tables.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/des_int.h \
+  $(srcdir)/f_cksum.c $(srcdir)/f_tables.h
 f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -90,7 +90,7 @@ f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/f_parity.c
+  $(srcdir)/des_int.h $(srcdir)/f_parity.c
 f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
@@ -100,8 +100,8 @@ f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/des/f_sched.c
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/des_int.h \
+  $(srcdir)/f_sched.c
 f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -112,8 +112,8 @@ f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/f_tables.c \
-  $(srcdir)/../../builtin/des/f_tables.h
+  $(srcdir)/des_int.h $(srcdir)/f_tables.c \
+  $(srcdir)/f_tables.h
 key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -124,7 +124,7 @@ key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/key_sched.c
+  $(srcdir)/des_int.h $(srcdir)/key_sched.c
 weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -135,7 +135,7 @@ weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/weak_key.c
+  $(srcdir)/des_int.h $(srcdir)/weak_key.c
 string2key.so string2key.po $(OUTPRE)string2key.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -146,7 +146,7 @@ string2key.so string2key.po $(OUTPRE)string2key.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/des/des_int.h $(srcdir)/../../builtin/des/string2key.c
+  $(srcdir)/des_int.h $(srcdir)/string2key.c
 destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h \
diff --git a/src/lib/crypto/builtin/des/t_afss2k.c b/src/lib/crypto/builtin/des/t_afss2k.c
new file mode 100644
index 0000000..a6d0aa5
--- /dev/null
+++ b/src/lib/crypto/builtin/des/t_afss2k.c
@@ -0,0 +1,136 @@
+#include "des_int.h"
+
+static const char *me;
+
+struct test_case {
+	char *saltstr;
+	int saltlen;
+	unsigned char keys[12][8];
+};
+
+struct test_case test_cases[] = {
+	{
+		"Sodium Chloride", -1,
+		{
+			{ 0xa4, 0xd0, 0xd0, 0x9b, 0x86, 0x92, 0xb0, 0xc2, },
+			{ 0xf1, 0xf2, 0x9e, 0xab, 0xd0, 0xef, 0xdf, 0x73, },
+			{ 0xd6, 0x85, 0x61, 0xc4, 0xf2, 0x94, 0xf4, 0xa1, },
+			{ 0xd0, 0xe3, 0xa7, 0x83, 0x94, 0x61, 0xe0, 0xd0, },
+			{ 0xd5, 0x62, 0xcd, 0x94, 0x61, 0xcb, 0x97, 0xdf, },
+			{ 0x9e, 0xa2, 0xa2, 0xec, 0xa8, 0x8c, 0x6b, 0x8f, },
+			{ 0xe3, 0x91, 0x6d, 0xd3, 0x85, 0xf1, 0x67, 0xc4, },
+			{ 0xf4, 0xc4, 0x73, 0xc8, 0x8a, 0xe9, 0x94, 0x6d, },
+			{ 0xa1, 0x9e, 0xb3, 0xad, 0x6b, 0xe3, 0xab, 0xd9, },
+			{ 0xad, 0xa1, 0xce, 0x10, 0x37, 0x83, 0xa7, 0x8c, },
+			{ 0xd3, 0x01, 0xd0, 0xf7, 0x3e, 0x7a, 0x49, 0x0b, },
+			{ 0xb6, 0x2a, 0x4a, 0xec, 0x9d, 0x4c, 0x68, 0xdf, },
+		}
+	},
+	{
+		"NaCl", 4,
+		{
+			{ 0x61, 0xef, 0xe6, 0x83, 0xe5, 0x8a, 0x6b, 0x98 },
+			{ 0x68, 0xcd, 0x68, 0xad, 0xc4, 0x86, 0xcd, 0xe5 },
+			{ 0x83, 0xa1, 0xc8, 0x86, 0x8f, 0x67, 0xd0, 0x62 },
+			{ 0x9e, 0xc7, 0x8f, 0xa4, 0xa4, 0xb3, 0xe0, 0xd5 },
+			{ 0xd9, 0x92, 0x86, 0x8f, 0x9d, 0x8c, 0x85, 0xe6 },
+			{ 0xda, 0xf2, 0x92, 0x83, 0xf4, 0x9b, 0xa7, 0xad },
+			{ 0x91, 0xcd, 0xad, 0xef, 0x86, 0xdf, 0xd3, 0xa2 },
+			{ 0x73, 0xd3, 0x67, 0x68, 0x8f, 0x6e, 0xe3, 0x73 },
+			{ 0xc4, 0x61, 0x85, 0x9d, 0xad, 0xf4, 0xdc, 0xb0 },
+			{ 0xe9, 0x02, 0x83, 0x16, 0x2c, 0xec, 0xe0, 0x08 },
+			{ 0x61, 0xc8, 0x26, 0x29, 0xd9, 0x73, 0x6e, 0xb6 },
+			{ 0x8c, 0xa8, 0x9e, 0xc4, 0xa8, 0xdc, 0x31, 0x73 },
+		}
+	},
+	{
+		/* This one intentionally supplies a length shorter
+		   than the string.  The point of this is to ensure
+		   that s[len] is not zero, so that anything actually
+		   relying on that value (i.e., reading out of bounds)
+		   should generate incorrect results.  */
+		"NaCl2", 4,
+		{
+			{ 0x61, 0xef, 0xe6, 0x83, 0xe5, 0x8a, 0x6b, 0x98 },
+			{ 0x68, 0xcd, 0x68, 0xad, 0xc4, 0x86, 0xcd, 0xe5 },
+			{ 0x83, 0xa1, 0xc8, 0x86, 0x8f, 0x67, 0xd0, 0x62 },
+			{ 0x9e, 0xc7, 0x8f, 0xa4, 0xa4, 0xb3, 0xe0, 0xd5 },
+			{ 0xd9, 0x92, 0x86, 0x8f, 0x9d, 0x8c, 0x85, 0xe6 },
+			{ 0xda, 0xf2, 0x92, 0x83, 0xf4, 0x9b, 0xa7, 0xad },
+			{ 0x91, 0xcd, 0xad, 0xef, 0x86, 0xdf, 0xd3, 0xa2 },
+			{ 0x73, 0xd3, 0x67, 0x68, 0x8f, 0x6e, 0xe3, 0x73 },
+			{ 0xc4, 0x61, 0x85, 0x9d, 0xad, 0xf4, 0xdc, 0xb0 },
+			{ 0xe9, 0x02, 0x83, 0x16, 0x2c, 0xec, 0xe0, 0x08 },
+			{ 0x61, 0xc8, 0x26, 0x29, 0xd9, 0x73, 0x6e, 0xb6 },
+			{ 0x8c, 0xa8, 0x9e, 0xc4, 0xa8, 0xdc, 0x31, 0x73 },
+		}
+	},
+};
+
+static void do_it (struct test_case *tcase);
+
+int
+main (int argc, char *argv[])
+{
+	int i;
+
+	me = argv[0];
+	for (i = 0; i < sizeof (test_cases) / sizeof (struct test_case); i++)
+		do_it (&test_cases[i]);
+	return 0;
+}
+
+static void
+do_it (struct test_case *tcase)
+{
+	unsigned char keydata[8];
+	krb5_data salt, passwd;
+	krb5_keyblock key;
+	krb5_error_code err;
+	int i;
+	unsigned char longpass[2048];
+
+	key.contents = keydata;
+	key.length = sizeof (keydata);
+
+	salt.data = tcase->saltstr;
+	if (tcase->saltlen == -1)
+		salt.length = strlen (tcase->saltstr);
+	else
+		salt.length = tcase->saltlen;
+
+	/*
+	 * Try passwords with lengths equal to, greater than, and less
+	 * than 8 characters, since the AFS s2k algorithm does
+	 * interesting stuff depending on the length.
+	 */
+	passwd.data = "My Password";
+	for (i = 0; i < 12; i++) {
+		passwd.length = i;
+		err = mit_afs_string_to_key (&key, &passwd, &salt);
+		if (err != 0) {
+			com_err (me, err, "");
+			exit (1);
+		}
+		if (memcmp (tcase->keys[i], keydata, 8) != 0)
+			abort ();
+	}
+
+	/* Run another pass to make sure the characters after the
+	   password in the buffer aren't influencing the output.  The
+	   password is *not* required to be null-terminated.  */
+	memset (longpass, '!', sizeof (longpass));
+	longpass[sizeof (longpass)-1] = '\0';
+	memcpy (longpass, "My Password", strlen ("My Password"));
+	passwd.data = (char *) longpass;
+	for (i = 0; i < 12; i++) {
+		passwd.length = i;
+		err = mit_afs_string_to_key (&key, &passwd, &salt);
+		if (err != 0) {
+			com_err (me, err, "");
+			exit (1);
+		}
+		if (memcmp (tcase->keys[i], keydata, 8) != 0)
+			abort ();
+	}
+}
diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c
new file mode 100644
index 0000000..a6ad07c
--- /dev/null
+++ b/src/lib/crypto/builtin/des/t_verify.c
@@ -0,0 +1,418 @@
+/*
+ * lib/crypto/des/verify.c
+ *
+ * Copyright 1988, 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ * 
+ *
+ * Program to test the correctness of the DES library
+ * implementation.
+ *
+ * exit returns	 0 ==> success
+ * 		-1 ==> error
+ */
+
+/*
+ * Copyright (C) 1998 by the FundsXpress, INC.
+ * 
+ * All rights reserved.
+ * 
+ * Export of this software from the United States of America may require
+ * a specific license from the United States Government.  It is the
+ * responsibility of any person or organization contemplating export to
+ * obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of FundsXpress. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  FundsXpress makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ * 
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#include "k5-int.h"
+#include "des_int.h"
+#include <stdio.h>
+#include "com_err.h"
+
+static void do_encrypt(unsigned char *, unsigned char *);
+static void do_decrypt(unsigned char *, unsigned char *);
+
+char *progname;
+int nflag = 2;
+int vflag;
+int mflag;
+int zflag;
+int pid;
+int mit_des_debug;
+
+unsigned char cipher_text[64];
+unsigned char clear_text[64] = "Now is the time for all " ;
+unsigned char clear_text2[64] = "7654321 Now is the time for ";
+unsigned char clear_text3[64] = {2,0,0,0, 1,0,0,0};
+unsigned char output[64];
+unsigned char zero_text[8] = {0x0,0,0,0,0,0,0,0};
+unsigned char msb_text[8] = {0x0,0,0,0, 0,0,0,0x40}; /* to ANSI MSB */
+unsigned char *input;
+
+/* 0x0123456789abcdef */
+unsigned char default_key[8] = {
+    0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef
+};
+unsigned char key2[8] = { 0x08,0x19,0x2a,0x3b,0x4c,0x5d,0x6e,0x7f };
+unsigned char key3[8] = { 0x80,1,1,1,1,1,1,1 };
+mit_des_cblock s_key;
+unsigned char default_ivec[8] = {
+    0x12,0x34,0x56,0x78,0x90,0xab,0xcd,0xef
+};
+unsigned char *ivec;
+unsigned char zero_key[8] = {1,1,1,1,1,1,1,1}; /* just parity bits */
+
+unsigned char cipher1[8] = {
+    0x25,0xdd,0xac,0x3e,0x96,0x17,0x64,0x67
+};
+unsigned char cipher2[8] = {
+    0x3f,0xa4,0x0e,0x8a,0x98,0x4d,0x48,0x15
+};
+unsigned char cipher3[64] = {
+    0xe5,0xc7,0xcd,0xde,0x87,0x2b,0xf2,0x7c,
+    0x43,0xe9,0x34,0x00,0x8c,0x38,0x9c,0x0f,
+    0x68,0x37,0x88,0x49,0x9a,0x7c,0x05,0xf6
+};
+unsigned char checksum[8] = {
+    0x58,0xd2,0xe7,0x7e,0x86,0x06,0x27,0x33
+};
+
+unsigned char zresult[8] = {
+    0x8c, 0xa6, 0x4d, 0xe9, 0xc1, 0xb1, 0x23, 0xa7
+};
+
+unsigned char mresult[8] = {
+    0xa3, 0x80, 0xe0, 0x2a, 0x6b, 0xe5, 0x46, 0x96
+};
+
+    
+/*
+ * Can also add :
+ * plaintext = 0, key = 0, cipher = 0x8ca64de9c1b123a7 (or is it a 1?)
+ */
+
+mit_des_key_schedule sched;
+
+int
+main(argc,argv)
+    int argc;
+    char *argv[];
+{
+    /* Local Declarations */
+    size_t  in_length;
+    int  retval;
+    int i, j;
+
+#ifdef WINDOWS
+    /* Set screen window buffer to infinite size -- MS default is tiny.  */
+    _wsetscreenbuf (fileno (stdout), _WINBUFINF);
+#endif
+    progname=argv[0];		/* salt away invoking program */
+
+    while (--argc > 0 && (*++argv)[0] == '-')
+	for (i=1; argv[0][i] != '\0'; i++) {
+	    switch (argv[0][i]) {
+
+		/* debug flag */
+	    case 'd':
+		mit_des_debug=3;
+		continue;
+
+	    case 'z':
+		zflag = 1;
+		continue;
+
+	    case 'm':
+		mflag = 1;
+		continue;
+
+	    default:
+		printf("%s: illegal flag \"%c\" ",
+		       progname,argv[0][i]);
+		exit(1);
+	    }
+	};
+
+    if (argc) {
+	fprintf(stderr, "Usage: %s [-dmz]\n", progname);
+	exit(1);
+    }
+
+    /* do some initialisation */
+
+    /* use known input and key */
+
+    /* ECB zero text zero key */
+    if (zflag) {
+	input = zero_text;
+	mit_des_key_sched(zero_key, sched);
+	printf("plaintext = key = 0, cipher = 0x8ca64de9c1b123a7\n");
+	do_encrypt(input,cipher_text);
+	printf("\tcipher  = (low to high bytes)\n\t\t");
+	for (j = 0; j<=7; j++)
+	    printf("%02x ",cipher_text[j]);
+	printf("\n");
+	do_decrypt(output,cipher_text);
+	if ( memcmp((char *)cipher_text, (char *)zresult, 8) ) {
+	    printf("verify: error in zero key test\n");
+	    exit(-1);
+	}
+
+	exit(0);
+    }
+
+    if (mflag) {
+	input = msb_text;
+	mit_des_key_sched(key3, sched);
+	printf("plaintext = 0x00 00 00 00 00 00 00 40, ");
+	printf("key = 0x80 01 01 01 01 01 01 01\n");
+	printf("	cipher = 0xa380e02a6be54696\n");
+	do_encrypt(input,cipher_text);
+	printf("\tcipher  = (low to high bytes)\n\t\t");
+	for (j = 0; j<=7; j++) {
+	    printf("%02x ",cipher_text[j]);
+	}
+	printf("\n");
+	do_decrypt(output,cipher_text);
+	if ( memcmp((char *)cipher_text, (char *)mresult, 8) ) {
+	    printf("verify: error in msb test\n");
+	    exit(-1);
+	}
+	exit(0);
+    }
+
+    /* ECB mode Davies and Price */
+    {
+	input = zero_text;
+	mit_des_key_sched(key2, sched);
+	printf("Examples per FIPS publication 81, keys ivs and cipher\n");
+	printf("in hex.  These are the correct answers, see below for\n");
+	printf("the actual answers.\n\n");
+	printf("Examples per Davies and Price.\n\n");
+	printf("EXAMPLE ECB\tkey = 08192a3b4c5d6e7f\n");
+	printf("\tclear = 0\n");
+	printf("\tcipher = 25 dd ac 3e 96 17 64 67\n");
+	printf("ACTUAL ECB\n");
+	printf("\tclear \"%s\"\n", input);
+	do_encrypt(input,cipher_text);
+	printf("\tcipher  = (low to high bytes)\n\t\t");
+	for (j = 0; j<=7; j++)
+	    printf("%02x ",cipher_text[j]);
+	printf("\n\n");
+	do_decrypt(output,cipher_text);
+	if ( memcmp((char *)cipher_text, (char *)cipher1, 8) ) {
+	    printf("verify: error in ECB encryption\n");
+	    exit(-1);
+	}
+	else 
+	    printf("verify: ECB encryption is correct\n\n");
+    }
+
+    /* ECB mode */
+    {
+	mit_des_key_sched(default_key, sched);
+	input = clear_text;
+	ivec = default_ivec;
+	printf("EXAMPLE ECB\tkey = 0123456789abcdef\n");
+	printf("\tclear = \"Now is the time for all \"\n");
+	printf("\tcipher = 3f a4 0e 8a 98 4d 48 15 ...\n");
+	printf("ACTUAL ECB\n\tclear \"%s\"",input);
+	do_encrypt(input,cipher_text);
+	printf("\n\tcipher	= (low to high bytes)\n\t\t");
+	for (j = 0; j<=7; j++) {
+	    printf("%02x ",cipher_text[j]);
+	}
+	printf("\n\n");
+	do_decrypt(output,cipher_text);
+	if ( memcmp((char *)cipher_text, (char *)cipher2, 8) ) {
+	    printf("verify: error in ECB encryption\n");
+	    exit(-1);
+	}
+	else 
+	    printf("verify: ECB encryption is correct\n\n");
+    }
+
+    /* CBC mode */
+    printf("EXAMPLE CBC\tkey = 0123456789abcdef");
+    printf("\tiv = 1234567890abcdef\n");
+    printf("\tclear = \"Now is the time for all \"\n");
+    printf("\tcipher =\te5 c7 cd de 87 2b f2 7c\n");
+    printf("\t\t\t43 e9 34 00 8c 38 9c 0f\n");
+    printf("\t\t\t68 37 88 49 9a 7c 05 f6\n");
+
+    printf("ACTUAL CBC\n\tclear \"%s\"\n",input);
+    in_length =  strlen((char *)input);
+    if ((retval = mit_des_cbc_encrypt((const mit_des_cblock *) input,
+				      (mit_des_cblock *) cipher_text,
+				      (size_t) in_length, 
+				      sched,
+				      ivec,
+				      MIT_DES_ENCRYPT))) {
+	com_err("des verify", retval, "can't encrypt");
+	exit(-1);
+    }
+    printf("\tciphertext = (low to high bytes)\n");
+    for (i = 0; i <= 2; i++) {
+	printf("\t\t");
+	for (j = 0; j <= 7; j++) {
+	    printf("%02x ",cipher_text[i*8+j]);
+	}
+	printf("\n");
+    }
+    if ((retval = mit_des_cbc_encrypt((const mit_des_cblock *) cipher_text,
+				      (mit_des_cblock *) clear_text,
+				      (size_t) in_length, 
+				      sched,
+				      ivec,
+				      MIT_DES_DECRYPT))) {
+	com_err("des verify", retval, "can't decrypt");
+	exit(-1);
+    }
+    printf("\tdecrypted clear_text = \"%s\"\n",clear_text);
+
+    if ( memcmp((char *)cipher_text, (char *)cipher3, in_length) ) {
+	printf("verify: error in CBC encryption\n");
+	exit(-1);
+    }
+    else 
+	printf("verify: CBC encryption is correct\n\n");
+
+    printf("EXAMPLE CBC checksum");
+    printf("\tkey =  0123456789abcdef\tiv =  1234567890abcdef\n");
+    printf("\tclear =\t\t\"7654321 Now is the time for \"\n");
+    printf("\tchecksum\t58 d2 e7 7e 86 06 27 33, ");
+    printf("or some part thereof\n");
+    input = clear_text2;
+    mit_des_cbc_cksum(input,cipher_text, strlen((char *)input),
+		      sched,ivec);
+    printf("ACTUAL CBC checksum\n");
+    printf("\t\tencrypted cksum = (low to high bytes)\n\t\t");
+    for (j = 0; j<=7; j++)
+	printf("%02x ",cipher_text[j]);
+    printf("\n\n");
+    if ( memcmp((char *)cipher_text, (char *)checksum, 8) ) {
+	printf("verify: error in CBC cheksum\n");
+	exit(-1);
+    }
+    else 
+	printf("verify: CBC checksum is correct\n\n");
+
+    exit(0);
+}
+
+#if 0
+void
+flip(array)
+    char *array;
+{
+    register int old,new,i,j;
+    /* flips the bit order within each byte from 0 lsb to 0 msb */
+    for (i = 0; i<=7; i++) {
+	old = *array;
+	new = 0;
+	for (j = 0; j<=7; j++) {
+	    if (old & 01)
+		new = new | 01;
+	    if (j < 7) {
+		old = old >> 1;
+		new = new << 1;
+	    }
+	}
+	*array = new;
+	array++;
+    }
+}
+#endif
+
+static void
+do_encrypt(in,out)
+    unsigned char *in;
+    unsigned char *out;
+{
+    int i, j;
+    for (i =1; i<=nflag; i++) {
+	mit_des_cbc_encrypt((const mit_des_cblock *)in,
+			    (mit_des_cblock *)out,
+			    8,
+			    sched,
+			    zero_text,
+			    MIT_DES_ENCRYPT);
+	if (mit_des_debug) {
+	    printf("\nclear %s\n",in);
+	    for (j = 0; j<=7; j++)
+		printf("%02X ",in[j] & 0xff);
+	    printf("\tcipher ");
+	    for (j = 0; j<=7; j++)
+		printf("%02X ",out[j] & 0xff);
+	}
+    }
+}
+
+static void
+do_decrypt(in,out)
+    unsigned char *out;
+    unsigned char *in;
+    /* try to invert it */
+{
+    int i, j;
+    for (i =1; i<=nflag; i++) {
+	mit_des_cbc_encrypt((const mit_des_cblock *)out,
+			    (mit_des_cblock *)in,
+			    8,
+			    sched,
+			    zero_text,
+			    MIT_DES_DECRYPT);
+	if (mit_des_debug) {
+	    printf("clear %s\n",in);
+	    for (j = 0; j<=7; j++)
+		printf("%02X ",in[j] & 0xff);
+	    printf("\tcipher ");
+	    for (j = 0; j<=7; j++)
+		printf("%02X ",out[j] & 0xff);
+	}
+    }
+}
+
+/*
+ * Fake out the DES library, for the purposes of testing.
+ */
+
+int
+mit_des_is_weak_key(key)
+    mit_des_cblock key;
+{
+    return 0;				/* fake it out for testing */
+}
diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in
index 712a225..14d5317 100644
--- a/src/lib/crypto/builtin/enc_provider/Makefile.in
+++ b/src/lib/crypto/builtin/enc_provider/Makefile.in
@@ -2,12 +2,12 @@ thisconfigdir=../../../..
 myfulldir=lib/crypto/builtin/enc_provider
 mydir=lib/crypto/builtin/enc_provider
 BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
-LOCALINCLUDES = -I$(srcdir)/../../@CRYPTO_IMPL@/des 	\
-		-I$(srcdir)/../../@CRYPTO_IMPL@/arcfour \
-		-I$(srcdir)/../../@CRYPTO_IMPL@/aes 	\
+LOCALINCLUDES = -I$(srcdir)/../des 	\
+		-I$(srcdir)/../arcfour \
+		-I$(srcdir)/../aes 	\
 		-I$(srcdir)/../../krb 			\
 		-I$(srcdir)/../../krb/rand2key	 	\
-		-I$(srcdir)/.. -I$(srcdir)/../../@CRYPTO_IMPL@ 
+		-I$(srcdir)/.. -I$(srcdir)/. 
 DEFS=
 
 ##DOS##BUILDTOP = ..\..\..\..
@@ -18,22 +18,22 @@ PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
 STLIBOBJS= \
-	../../@CRYPTO_IMPL@/enc_provider/des.o 	\
-	../../@CRYPTO_IMPL@/enc_provider/des3.o 	\
-	../../@CRYPTO_IMPL@/enc_provider/rc4.o 	\
-	../../@CRYPTO_IMPL@/enc_provider/aes.o 
+	des.o 	\
+	des3.o 	\
+	rc4.o 	\
+	aes.o 
 
 OBJS= \
-	$(OUTPRE)../../@CRYPTO_IMPL@/enc_provider/des.$(OBJEXT) 	\
-	$(OUTPRE)../../@CRYPTO_IMPL@/enc_provider/des3.$(OBJEXT) 	\
-	$(OUTPRE)../../@CRYPTO_IMPL@/enc_provider/aes.$(OBJEXT) 	\
-	$(OUTPRE)../../@CRYPTO_IMPL@/enc_provider/rc4.$(OBJEXT)
+	$(OUTPRE)des.$(OBJEXT) 	\
+	$(OUTPRE)des3.$(OBJEXT) 	\
+	$(OUTPRE)aes.$(OBJEXT) 	\
+	$(OUTPRE)rc4.$(OBJEXT)
 
 SRCS= \
-	$(srcdir)/../../@CRYPTO_IMPL@/enc_provider/des.c 	\
-	$(srcdir)/../../@CRYPTO_IMPL@/enc_provider/des3.c 	\
-	$(srcdir)/../../@CRYPTO_IMPL@/enc_provider/aes.c 	\
-	$(srcdir)/../../@CRYPTO_IMPL@/enc_provider/rc4.c
+	$(srcdir)/des.c 	\
+	$(srcdir)/des3.c 	\
+	$(srcdir)/aes.c 	\
+	$(srcdir)/rc4.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps
index 292aa56..0895448 100644
--- a/src/lib/crypto/builtin/enc_provider/deps
+++ b/src/lib/crypto/builtin/enc_provider/deps
@@ -10,8 +10,8 @@ des.so des.po $(OUTPRE)des.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/enc_provider/des.c $(srcdir)/../../builtin/enc_provider/enc_provider.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../des/des_int.h \
+  $(srcdir)/des.c $(srcdir)/enc_provider.h \
   $(srcdir)/../../krb/aead.h $(srcdir)/../../krb/cksumtypes.h \
   $(srcdir)/../../krb/rand2key/rand2key.h
 des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
@@ -23,8 +23,8 @@ des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/des/des_int.h \
-  $(srcdir)/../../builtin/enc_provider/des3.c $(srcdir)/../../krb/aead.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../des/des_int.h \
+  $(srcdir)/des3.c $(srcdir)/../../krb/aead.h \
   $(srcdir)/../../krb/cksumtypes.h $(srcdir)/../../krb/rand2key/rand2key.h
 aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
@@ -35,9 +35,9 @@ aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/aes/aes.h \
-  $(srcdir)/../../builtin/aes/uitypes.h $(srcdir)/../../builtin/enc_provider/aes.c \
-  $(srcdir)/../../builtin/enc_provider/enc_provider.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../aes/aes.h \
+  $(srcdir)/../aes/uitypes.h $(srcdir)/aes.c \
+  $(srcdir)/enc_provider.h \
   $(srcdir)/../../krb/aead.h $(srcdir)/../../krb/cksumtypes.h \
   $(srcdir)/../../krb/rand2key/rand2key.h
 rc4.so rc4.po $(OUTPRE)rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
@@ -49,7 +49,7 @@ rc4.so rc4.po $(OUTPRE)rc4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/arcfour/arcfour-int.h \
-  $(srcdir)/../../builtin/arcfour/arcfour.h $(srcdir)/../../builtin/enc_provider/enc_provider.h \
-  $(srcdir)/../../builtin/enc_provider/rc4.c $(srcdir)/../../krb/aead.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../arcfour/arcfour-int.h \
+  $(srcdir)/../arcfour/arcfour.h $(srcdir)/enc_provider.h \
+  $(srcdir)/rc4.c $(srcdir)/../../krb/aead.h \
   $(srcdir)/../../krb/cksumtypes.h $(srcdir)/../../krb/rand2key/rand2key.h
diff --git a/src/lib/crypto/builtin/hash_provider/Makefile.in b/src/lib/crypto/builtin/hash_provider/Makefile.in
index a901d11..09bfb59 100644
--- a/src/lib/crypto/builtin/hash_provider/Makefile.in
+++ b/src/lib/crypto/builtin/hash_provider/Makefile.in
@@ -2,8 +2,8 @@ thisconfigdir=../../../..
 myfulldir=lib/crypto/builtin/hash_provider
 mydir=lib/crypto/builtin/hash_provider
 BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
-LOCALINCLUDES = -I$(srcdir)/../../krb/crc32 -I$(srcdir)/../../@CRYPTO_IMPL@/md4 \
-	-I$(srcdir)/../../@CRYPTO_IMPL@/md5 -I$(srcdir)/../../@CRYPTO_IMPL@/sha1
+LOCALINCLUDES = -I$(srcdir)/../../krb/crc32 -I$(srcdir)/../md4 \
+	-I$(srcdir)/../md5 -I$(srcdir)/../sha1
 DEFS=
 
 ##DOS##BUILDTOP = ..\..\..\..
@@ -13,23 +13,21 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-CIMPL = @CRYPTO_IMPL@/hash_provider
-
 STLIBOBJS= \
-	../../$(CIMPL)/hash_crc32.o 	\
-	../../$(CIMPL)/hash_md4.o 	\
-	../../$(CIMPL)/hash_md5.o 	\
-	../../$(CIMPL)/hash_sha1.o
-
-OBJS=   $(OUTPRE)../../$(CIMPL)/hash_crc32.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/hash_md4.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/hash_md5.$(OBJEXT) 	\
-	$(OUTPRE)../../$(CIMPL)/hash_sha1.$(OBJEXT)
-
-SRCS=	$(srcdir)/../../$(CIMPL)/hash_crc32.c	\
-	$(srcdir)/../../$(CIMPL)/hash_md4.c 	\
-	$(srcdir)/../../$(CIMPL)/hash_md5.c 	\
-	$(srcdir)/../../$(CIMPL)/hash_sha1.c
+	hash_crc32.o 	\
+	hash_md4.o 	\
+	hash_md5.o 	\
+	hash_sha1.o
+
+OBJS=   $(OUTPRE)hash_crc32.$(OBJEXT) 	\
+	$(OUTPRE)hash_md4.$(OBJEXT) 	\
+	$(OUTPRE)hash_md5.$(OBJEXT) 	\
+	$(OUTPRE)hash_sha1.$(OBJEXT)
+
+SRCS=	$(srcdir)/hash_crc32.c	\
+	$(srcdir)/hash_md4.c 	\
+	$(srcdir)/hash_md5.c 	\
+	$(srcdir)/hash_sha1.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
diff --git a/src/lib/crypto/builtin/hash_provider/deps b/src/lib/crypto/builtin/hash_provider/deps
index f69f19a..aae0b98 100644
--- a/src/lib/crypto/builtin/hash_provider/deps
+++ b/src/lib/crypto/builtin/hash_provider/deps
@@ -11,8 +11,8 @@ hash_crc32.so hash_crc32.po $(OUTPRE)hash_crc32.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/hash_provider/hash_crc32.c \
-  $(srcdir)/../../builtin/hash_provider/hash_provider.h \
+  $(srcdir)/hash_crc32.c \
+  $(srcdir)/hash_provider.h \
   $(srcdir)/../../krb/crc32/crc-32.h
 hash_md4.so hash_md4.po $(OUTPRE)hash_md4.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
@@ -24,8 +24,8 @@ hash_md4.so hash_md4.po $(OUTPRE)hash_md4.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/hash_provider/hash_md4.c $(srcdir)/../../builtin/hash_provider/hash_provider.h \
-  $(srcdir)/../../builtin/md4/rsa-md4.h
+  $(srcdir)/hash_md4.c $(srcdir)/hash_provider.h \
+  $(srcdir)/../md4/rsa-md4.h
 hash_md5.so hash_md5.po $(OUTPRE)hash_md5.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -36,8 +36,8 @@ hash_md5.so hash_md5.po $(OUTPRE)hash_md5.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/hash_provider/hash_md5.c $(srcdir)/../../builtin/hash_provider/hash_provider.h \
-  $(srcdir)/../../builtin/md5/rsa-md5.h
+  $(srcdir)/hash_md5.c $(srcdir)/hash_provider.h \
+  $(srcdir)/../md5/rsa-md5.h
 hash_sha1.so hash_sha1.po $(OUTPRE)hash_sha1.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -48,5 +48,5 @@ hash_sha1.so hash_sha1.po $(OUTPRE)hash_sha1.$(OBJEXT): \
   $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/authdata_plugin.h \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../../builtin/hash_provider/hash_provider.h \
-  $(srcdir)/../../builtin/hash_provider/hash_sha1.c $(srcdir)/../../builtin/sha1/shs.h
+  $(srcdir)/hash_provider.h \
+  $(srcdir)/hash_sha1.c $(srcdir)/../sha1/shs.h
diff --git a/src/lib/crypto/builtin/md4/Makefile.in b/src/lib/crypto/builtin/md4/Makefile.in
index 480906b..78dd053 100644
--- a/src/lib/crypto/builtin/md4/Makefile.in
+++ b/src/lib/crypto/builtin/md4/Makefile.in
@@ -12,11 +12,11 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-STLIBOBJS= ../../@CRYPTO_IMPL@/md4/md4.o
+STLIBOBJS= md4.o
 
-OBJS= $(OUTPRE)../../@CRYPTO_IMPL@/md4/md4.$(OBJEXT) 
+OBJS= $(OUTPRE)md4.$(OBJEXT) 
 
-SRCS= $(srcdir)/../../@CRYPTO_IMPL@/md4/md4.c
+SRCS= $(srcdir)/md4.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
diff --git a/src/lib/crypto/builtin/md4/deps b/src/lib/crypto/builtin/md4/deps
index 04c312f..9381aa7 100644
--- a/src/lib/crypto/builtin/md4/deps
+++ b/src/lib/crypto/builtin/md4/deps
@@ -10,5 +10,5 @@ md4.so md4.po $(OUTPRE)md4.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/md4/md4.c \
-  $(srcdir)/../../builtin/md4/rsa-md4.h
+  $(SRCTOP)/include/socket-utils.h md4.c \
+  rsa-md4.h
diff --git a/src/lib/crypto/builtin/md5/Makefile.in b/src/lib/crypto/builtin/md5/Makefile.in
index 9292919..6da4374 100644
--- a/src/lib/crypto/builtin/md5/Makefile.in
+++ b/src/lib/crypto/builtin/md5/Makefile.in
@@ -11,11 +11,11 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-STLIBOBJS= ../../@CRYPTO_IMPL@/md5/md5.o
+STLIBOBJS= md5.o
 
-OBJS= $(OUTPRE)../../@CRYPTO_IMPL@/md5/md5.$(OBJEXT) 
+OBJS= $(OUTPRE)md5.$(OBJEXT) 
 
-SRCS= $(srcdir)/../../@CRYPTO_IMPL@/md5/md5.c
+SRCS= $(srcdir)/md5.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
diff --git a/src/lib/crypto/builtin/md5/deps b/src/lib/crypto/builtin/md5/deps
index 501a7b6..abfc549 100644
--- a/src/lib/crypto/builtin/md5/deps
+++ b/src/lib/crypto/builtin/md5/deps
@@ -10,5 +10,5 @@ md5.so md5.po $(OUTPRE)md5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/md5/md5.c \
-  $(srcdir)/../../builtin/md5/rsa-md5.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/md5.c \
+  $(srcdir)/rsa-md5.h
diff --git a/src/lib/crypto/builtin/sha1/Makefile.in b/src/lib/crypto/builtin/sha1/Makefile.in
index 7610881..c93cb85 100644
--- a/src/lib/crypto/builtin/sha1/Makefile.in
+++ b/src/lib/crypto/builtin/sha1/Makefile.in
@@ -11,11 +11,11 @@ DEFS=
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
-STLIBOBJS= ../../@CRYPTO_IMPL@/sha1/shs.o
+STLIBOBJS= shs.o
 
-OBJS= $(OUTPRE)../../@CRYPTO_IMPL@/sha1/shs.$(OBJEXT) 
+OBJS= $(OUTPRE)shs.$(OBJEXT) 
 
-SRCS= $(srcdir)/../../@CRYPTO_IMPL@/sha1/shs.c
+SRCS= $(srcdir)/shs.c
 
 ##DOS##LIBOBJS = $(OBJS)
 
@@ -24,12 +24,25 @@ all-unix:: all-libobjs
 includes:: depend
 
 depend:: $(SRCS)
+t_shs: t_shs.o shs.o $(SUPPORT_DEPLIB)
+	$(CC_LINK) -o t_shs t_shs.o shs.o $(SUPPORT_LIB)
 
-check-unix:: 
+$(OUTPRE)t_shs.exe: $(OUTPRE)t_shs.obj $(OUTPRE)shs.obj
+	link -out:$@ $**
 
-check-windows:: 
+t_shs3: t_shs3.o shs.o $(SUPPORT_DEPLIB)
+	$(CC_LINK) -o t_shs3 t_shs3.o shs.o $(SUPPORT_LIB)
 
-clean:: 
+check-unix:: t_shs t_shs3
+	$(RUN_SETUP) $(VALGRIND) $(C)t_shs -x
+	$(RUN_SETUP) $(VALGRIND) $(C)t_shs3
+
+check-windows:: $(OUTPRE)t_shs.exe $(OUTPRE)t_shs3.exe
+	$(OUTPRE)$(C)t_shs.exe -x
+	$(OUTPRE)$(C)t_shs3.exe
+
+clean::
+	$(RM) t_shs$(EXEEXT) t_shs.$(OBJEXT) t_shs3$(EXEEXT) t_shs3.$(OBJEXT)
 
 clean-unix:: clean-libobjs
 
diff --git a/src/lib/crypto/builtin/sha1/deps b/src/lib/crypto/builtin/sha1/deps
index ee1dc4d..a5e424d 100644
--- a/src/lib/crypto/builtin/sha1/deps
+++ b/src/lib/crypto/builtin/sha1/deps
@@ -10,5 +10,5 @@ shs.so shs.po $(OUTPRE)shs.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
   $(SRCTOP)/include/krb5/authdata_plugin.h $(SRCTOP)/include/krb5/locate_plugin.h \
   $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../../builtin/sha1/shs.c \
-  $(srcdir)/../../builtin/sha1/shs.h
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/shs.c \
+  $(srcdir)/shs.h
diff --git a/src/lib/crypto/builtin/t_cf2.c b/src/lib/crypto/builtin/t_cf2.c
new file mode 100644
index 0000000..2e171c2
--- /dev/null
+++ b/src/lib/crypto/builtin/t_cf2.c
@@ -0,0 +1,88 @@
+/*
+ * lib/crypto/t_cf2.c
+ *
+ * Copyright (C) 2004, 2009 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ * 
+ * This file contains tests for theKRB-FX-CF2 code in Kerberos, based
+ *on the PRF regression tests.  It reads an input file, and writes an
+ *output file.  It is assumed that the output file will be diffed
+ *against expected output to see whether regression tests pass.  The
+ *input file is a very primitive format.
+ *First line: enctype
+ *second line: key to pass to string2key; also used as salt
+ *Third line: second key to pass to string2key
+ *fourth line: pepper1
+ *fifth line:  pepper2
+ *scanf is used to read the file, so interior spaces are not permitted.  The program outputs the hex bytes of the key.
+ */
+#include <krb5.h>
+
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+
+int main () {
+  char pepper1[1024], pepper2[1024];
+  krb5_keyblock *k1 = NULL, *k2 = NULL, *out = NULL;
+  krb5_data s2k;
+  unsigned int i;
+  while (1) {
+    krb5_enctype enctype;
+    char s[1025];
+
+    if (scanf( "%d", &enctype) == EOF)
+      break;
+    if (scanf("%1024s", &s[0]) == EOF)
+      break;
+    assert (krb5_init_keyblock(0, enctype, 0, &k1) == 0);
+    s2k.data = &s[0];
+    s2k.length = strlen(s);
+    assert(krb5_c_string_to_key (0, enctype, &s2k, &s2k, k1) == 0);
+    if (scanf("%1024s", &s[0]) == EOF)
+      break;
+    assert (krb5_init_keyblock(0, enctype, 0, &k2) == 0);
+    s2k.data = &s[0];
+    s2k.length = strlen(s);
+    assert(krb5_c_string_to_key (0, enctype, &s2k, &s2k, k2) == 0);
+    if (scanf("%1024s %1024s", pepper1, pepper2) == EOF)
+      break;
+    assert(krb5_c_fx_cf2_simple(0, k1, pepper1,
+				k2, pepper2, &out) ==0);
+    i = out->length;
+    for (; i > 0; i--) {
+      printf ("%02x",
+	      (unsigned int) ((unsigned char) out->contents[out->length-i]));
+    }
+    printf ("\n");
+
+    krb5_free_keyblock(0,out);
+    out = NULL;
+	  
+    krb5_free_keyblock(0, k1);
+    k1 = NULL;
+    krb5_free_keyblock(0, k2);
+    k2 =  NULL;
+  }
+
+  return (0);
+}
diff --git a/src/lib/crypto/builtin/t_cf2.comments b/src/lib/crypto/builtin/t_cf2.comments
new file mode 100644
index 0000000..0643b65
--- /dev/null
+++ b/src/lib/crypto/builtin/t_cf2.comments
@@ -0,0 +1,6 @@
+The first test  mirrors the first two tests in t_prf.in.
+
+The second test mirrors the following four tests in t_prf.in.
+
+The third and fourth tests are simple tests of the DES and 3DES PRF.
+The fifth test is the same simple test for RC4.
diff --git a/src/lib/crypto/builtin/t_cf2.expected b/src/lib/crypto/builtin/t_cf2.expected
new file mode 100644
index 0000000..007000f
--- /dev/null
+++ b/src/lib/crypto/builtin/t_cf2.expected
@@ -0,0 +1,5 @@
+97df97e4b798b29eb31ed7280287a92a
+4d6ca4e629785c1f01baf55e2e548566b9617ae3a96868c337cb93b5e72b1c7b
+43bae3738c9467e6
+e58f9eb643862c13ad38e529313462a7f73e62834fe54a01
+24d7f6b6bae4e5c00d2082c5ebab3672
diff --git a/src/lib/crypto/builtin/t_cf2.in b/src/lib/crypto/builtin/t_cf2.in
new file mode 100644
index 0000000..094c239
--- /dev/null
+++ b/src/lib/crypto/builtin/t_cf2.in
@@ -0,0 +1,25 @@
+17
+key1
+key2
+a
+b
+18
+key1
+key2
+a
+b
+1
+key1
+key2
+a
+b
+16
+key1
+key2
+a
+b
+23
+key1
+key2
+a
+b