libgo: Update to weekly.2012-01-20.

From-SVN: r183540

22 files changed, 1242 insertions, 159 deletions

diff --git a/libgo/go/crypto/ecdsa/ecdsa.go b/libgo/go/crypto/ecdsa/ecdsa.go
index 2f19999..d2f7d8f 100644
--- a/libgo/go/crypto/ecdsa/ecdsa.go
+++ b/libgo/go/crypto/ecdsa/ecdsa.go
@@ -20,7 +20,7 @@ import (
 
 // PublicKey represents an ECDSA public key.
 type PublicKey struct {
-	*elliptic.Curve
+	elliptic.Curve
 	X, Y *big.Int
 }
 
@@ -34,22 +34,23 @@ var one = new(big.Int).SetInt64(1)
 
 // randFieldElement returns a random element of the field underlying the given
 // curve using the procedure given in [NSA] A.2.1.
-func randFieldElement(c *elliptic.Curve, rand io.Reader) (k *big.Int, err error) {
-	b := make([]byte, c.BitSize/8+8)
+func randFieldElement(c elliptic.Curve, rand io.Reader) (k *big.Int, err error) {
+	params := c.Params()
+	b := make([]byte, params.BitSize/8+8)
 	_, err = io.ReadFull(rand, b)
 	if err != nil {
 		return
 	}
 
 	k = new(big.Int).SetBytes(b)
-	n := new(big.Int).Sub(c.N, one)
+	n := new(big.Int).Sub(params.N, one)
 	k.Mod(k, n)
 	k.Add(k, one)
 	return
 }
 
 // GenerateKey generates a public&private key pair.
-func GenerateKey(c *elliptic.Curve, rand io.Reader) (priv *PrivateKey, err error) {
+func GenerateKey(c elliptic.Curve, rand io.Reader) (priv *PrivateKey, err error) {
 	k, err := randFieldElement(c, rand)
 	if err != nil {
 		return
@@ -66,8 +67,8 @@ func GenerateKey(c *elliptic.Curve, rand io.Reader) (priv *PrivateKey, err error
 // about how this is done. [NSA] suggests that this is done in the obvious
 // manner, but [SECG] truncates the hash to the bit-length of the curve order
 // first. We follow [SECG] because that's what OpenSSL does.
-func hashToInt(hash []byte, c *elliptic.Curve) *big.Int {
-	orderBits := c.N.BitLen()
+func hashToInt(hash []byte, c elliptic.Curve) *big.Int {
+	orderBits := c.Params().N.BitLen()
 	orderBytes := (orderBits + 7) / 8
 	if len(hash) > orderBytes {
 		hash = hash[:orderBytes]
@@ -88,6 +89,7 @@ func hashToInt(hash []byte, c *elliptic.Curve) *big.Int {
 func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) {
 	// See [NSA] 3.4.1
 	c := priv.PublicKey.Curve
+	N := c.Params().N
 
 	var k, kInv *big.Int
 	for {
@@ -98,9 +100,9 @@ func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err err
 				return
 			}
 
-			kInv = new(big.Int).ModInverse(k, c.N)
+			kInv = new(big.Int).ModInverse(k, N)
 			r, _ = priv.Curve.ScalarBaseMult(k.Bytes())
-			r.Mod(r, priv.Curve.N)
+			r.Mod(r, N)
 			if r.Sign() != 0 {
 				break
 			}
@@ -110,7 +112,7 @@ func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err err
 		s = new(big.Int).Mul(priv.D, r)
 		s.Add(s, e)
 		s.Mul(s, kInv)
-		s.Mod(s, priv.PublicKey.Curve.N)
+		s.Mod(s, N)
 		if s.Sign() != 0 {
 			break
 		}
@@ -124,15 +126,16 @@ func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err err
 func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
 	// See [NSA] 3.4.2
 	c := pub.Curve
+	N := c.Params().N
 
 	if r.Sign() == 0 || s.Sign() == 0 {
 		return false
 	}
-	if r.Cmp(c.N) >= 0 || s.Cmp(c.N) >= 0 {
+	if r.Cmp(N) >= 0 || s.Cmp(N) >= 0 {
 		return false
 	}
 	e := hashToInt(hash, c)
-	w := new(big.Int).ModInverse(s, c.N)
+	w := new(big.Int).ModInverse(s, N)
 
 	u1 := e.Mul(e, w)
 	u2 := w.Mul(r, w)
@@ -143,6 +146,6 @@ func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
 		return false
 	}
 	x, _ := c.Add(x1, y1, x2, y2)
-	x.Mod(x, c.N)
+	x.Mod(x, N)
 	return x.Cmp(r) == 0
 }
diff --git a/libgo/go/crypto/ecdsa/ecdsa_test.go b/libgo/go/crypto/ecdsa/ecdsa_test.go
index 45433e1..3a2b3ef 100644
--- a/libgo/go/crypto/ecdsa/ecdsa_test.go
+++ b/libgo/go/crypto/ecdsa/ecdsa_test.go
@@ -13,7 +13,7 @@ import (
 	"testing"
 )
 
-func testKeyGeneration(t *testing.T, c *elliptic.Curve, tag string) {
+func testKeyGeneration(t *testing.T, c elliptic.Curve, tag string) {
 	priv, err := GenerateKey(c, rand.Reader)
 	if err != nil {
 		t.Errorf("%s: error: %s", tag, err)
@@ -34,7 +34,7 @@ func TestKeyGeneration(t *testing.T) {
 	testKeyGeneration(t, elliptic.P521(), "p521")
 }
 
-func testSignAndVerify(t *testing.T, c *elliptic.Curve, tag string) {
+func testSignAndVerify(t *testing.T, c elliptic.Curve, tag string) {
 	priv, _ := GenerateKey(c, rand.Reader)
 
 	hashed := []byte("testing")
diff --git a/libgo/go/crypto/elliptic/elliptic.go b/libgo/go/crypto/elliptic/elliptic.go
index b7232a2..30835a9 100644
--- a/libgo/go/crypto/elliptic/elliptic.go
+++ b/libgo/go/crypto/elliptic/elliptic.go
@@ -21,7 +21,25 @@ import (
 
 // A Curve represents a short-form Weierstrass curve with a=-3.
 // See http://www.hyperelliptic.org/EFD/g1p/auto-shortw.html
-type Curve struct {
+type Curve interface {
+	// Params returns the parameters for the curve.
+	Params() *CurveParams
+	// IsOnCurve returns true if the given (x,y) lies on the curve.
+	IsOnCurve(x, y *big.Int) bool
+	// Add returns the sum of (x1,y1) and (x2,y2)
+	Add(x1, y1, x2, y2 *big.Int) (x, y *big.Int)
+	// Double returns 2*(x,y)
+	Double(x1, y1 *big.Int) (x, y *big.Int)
+	// ScalarMult returns k*(Bx,By) where k is a number in big-endian form.
+	ScalarMult(x1, y1 *big.Int, scalar []byte) (x, y *big.Int)
+	// ScalarBaseMult returns k*G, where G is the base point of the group and k
+	// is an integer in big-endian form.
+	ScalarBaseMult(scalar []byte) (x, y *big.Int)
+}
+
+// CurveParams contains the parameters of an elliptic curve and also provides
+// a generic, non-constant time implementation of Curve.
+type CurveParams struct {
 	P       *big.Int // the order of the underlying field
 	N       *big.Int // the order of the base point
 	B       *big.Int // the constant of the curve equation
@@ -29,8 +47,11 @@ type Curve struct {
 	BitSize int      // the size of the underlying field
 }
 
-// IsOnCurve returns true if the given (x,y) lies on the curve.
-func (curve *Curve) IsOnCurve(x, y *big.Int) bool {
+func (curve *CurveParams) Params() *CurveParams {
+	return curve
+}
+
+func (curve *CurveParams) IsOnCurve(x, y *big.Int) bool {
 	// y² = x³ - 3x + b
 	y2 := new(big.Int).Mul(y, y)
 	y2.Mod(y2, curve.P)
@@ -50,7 +71,7 @@ func (curve *Curve) IsOnCurve(x, y *big.Int) bool {
 
 // affineFromJacobian reverses the Jacobian transform. See the comment at the
 // top of the file.
-func (curve *Curve) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
+func (curve *CurveParams) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
 	zinv := new(big.Int).ModInverse(z, curve.P)
 	zinvsq := new(big.Int).Mul(zinv, zinv)
 
@@ -62,15 +83,14 @@ func (curve *Curve) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
 	return
 }
 
-// Add returns the sum of (x1,y1) and (x2,y2)
-func (curve *Curve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
+func (curve *CurveParams) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
 	z := new(big.Int).SetInt64(1)
 	return curve.affineFromJacobian(curve.addJacobian(x1, y1, z, x2, y2, z))
 }
 
 // addJacobian takes two points in Jacobian coordinates, (x1, y1, z1) and
 // (x2, y2, z2) and returns their sum, also in Jacobian form.
-func (curve *Curve) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big.Int, *big.Int) {
+func (curve *CurveParams) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big.Int, *big.Int) {
 	// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
 	z1z1 := new(big.Int).Mul(z1, z1)
 	z1z1.Mod(z1z1, curve.P)
@@ -133,15 +153,14 @@ func (curve *Curve) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big
 	return x3, y3, z3
 }
 
-// Double returns 2*(x,y)
-func (curve *Curve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
+func (curve *CurveParams) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
 	z1 := new(big.Int).SetInt64(1)
 	return curve.affineFromJacobian(curve.doubleJacobian(x1, y1, z1))
 }
 
 // doubleJacobian takes a point in Jacobian coordinates, (x, y, z), and
 // returns its double, also in Jacobian form.
-func (curve *Curve) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.Int) {
+func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.Int) {
 	// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
 	delta := new(big.Int).Mul(z, z)
 	delta.Mod(delta, curve.P)
@@ -199,8 +218,7 @@ func (curve *Curve) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.I
 	return x3, y3, z3
 }
 
-// ScalarMult returns k*(Bx,By) where k is a number in big-endian form.
-func (curve *Curve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
+func (curve *CurveParams) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
 	// We have a slight problem in that the identity of the group (the
 	// point at infinity) cannot be represented in (x, y) form on a finite
 	// machine. Thus the standard add/double algorithm has to be tweaked
@@ -238,18 +256,17 @@ func (curve *Curve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
 	return curve.affineFromJacobian(x, y, z)
 }
 
-// ScalarBaseMult returns k*G, where G is the base point of the group and k is
-// an integer in big-endian form.
-func (curve *Curve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
+func (curve *CurveParams) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
 	return curve.ScalarMult(curve.Gx, curve.Gy, k)
 }
 
 var mask = []byte{0xff, 0x1, 0x3, 0x7, 0xf, 0x1f, 0x3f, 0x7f}
 
-// GenerateKey returns a public/private key pair. The private key is generated
-// using the given reader, which must return random data.
-func (curve *Curve) GenerateKey(rand io.Reader) (priv []byte, x, y *big.Int, err error) {
-	byteLen := (curve.BitSize + 7) >> 3
+// GenerateKey returns a public/private key pair. The private key is
+// generated using the given reader, which must return random data.
+func GenerateKey(curve Curve, rand io.Reader) (priv []byte, x, y *big.Int, err error) {
+	bitSize := curve.Params().BitSize
+	byteLen := (bitSize + 7) >> 3
 	priv = make([]byte, byteLen)
 
 	for x == nil {
@@ -259,7 +276,7 @@ func (curve *Curve) GenerateKey(rand io.Reader) (priv []byte, x, y *big.Int, err
 		}
 		// We have to mask off any excess bits in the case that the size of the
 		// underlying field is not a whole number of bytes.
-		priv[0] &= mask[curve.BitSize%8]
+		priv[0] &= mask[bitSize%8]
 		// This is because, in tests, rand will return all zeros and we don't
 		// want to get the point at infinity and loop forever.
 		priv[1] ^= 0x42
@@ -268,10 +285,9 @@ func (curve *Curve) GenerateKey(rand io.Reader) (priv []byte, x, y *big.Int, err
 	return
 }
 
-// Marshal converts a point into the form specified in section 4.3.6 of ANSI
-// X9.62.
-func (curve *Curve) Marshal(x, y *big.Int) []byte {
-	byteLen := (curve.BitSize + 7) >> 3
+// Marshal converts a point into the form specified in section 4.3.6 of ANSI X9.62.
+func Marshal(curve Curve, x, y *big.Int) []byte {
+	byteLen := (curve.Params().BitSize + 7) >> 3
 
 	ret := make([]byte, 1+2*byteLen)
 	ret[0] = 4 // uncompressed point
@@ -283,10 +299,9 @@ func (curve *Curve) Marshal(x, y *big.Int) []byte {
 	return ret
 }
 
-// Unmarshal converts a point, serialized by Marshal, into an x, y pair. On
-// error, x = nil.
-func (curve *Curve) Unmarshal(data []byte) (x, y *big.Int) {
-	byteLen := (curve.BitSize + 7) >> 3
+// Unmarshal converts a point, serialized by Marshal, into an x, y pair. On error, x = nil.
+func Unmarshal(curve Curve, data []byte) (x, y *big.Int) {
+	byteLen := (curve.Params().BitSize + 7) >> 3
 	if len(data) != 1+2*byteLen {
 		return
 	}
@@ -299,10 +314,9 @@ func (curve *Curve) Unmarshal(data []byte) (x, y *big.Int) {
 }
 
 var initonce sync.Once
-var p224 *Curve
-var p256 *Curve
-var p384 *Curve
-var p521 *Curve
+var p256 *CurveParams
+var p384 *CurveParams
+var p521 *CurveParams
 
 func initAll() {
 	initP224()
@@ -311,20 +325,9 @@ func initAll() {
 	initP521()
 }
 
-func initP224() {
-	// See FIPS 186-3, section D.2.2
-	p224 = new(Curve)
-	p224.P, _ = new(big.Int).SetString("26959946667150639794667015087019630673557916260026308143510066298881", 10)
-	p224.N, _ = new(big.Int).SetString("26959946667150639794667015087019625940457807714424391721682722368061", 10)
-	p224.B, _ = new(big.Int).SetString("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4", 16)
-	p224.Gx, _ = new(big.Int).SetString("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21", 16)
-	p224.Gy, _ = new(big.Int).SetString("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34", 16)
-	p224.BitSize = 224
-}
-
 func initP256() {
 	// See FIPS 186-3, section D.2.3
-	p256 = new(Curve)
+	p256 = new(CurveParams)
 	p256.P, _ = new(big.Int).SetString("115792089210356248762697446949407573530086143415290314195533631308867097853951", 10)
 	p256.N, _ = new(big.Int).SetString("115792089210356248762697446949407573529996955224135760342422259061068512044369", 10)
 	p256.B, _ = new(big.Int).SetString("5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", 16)
@@ -335,7 +338,7 @@ func initP256() {
 
 func initP384() {
 	// See FIPS 186-3, section D.2.4
-	p384 = new(Curve)
+	p384 = new(CurveParams)
 	p384.P, _ = new(big.Int).SetString("39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319", 10)
 	p384.N, _ = new(big.Int).SetString("39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942643", 10)
 	p384.B, _ = new(big.Int).SetString("b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef", 16)
@@ -346,7 +349,7 @@ func initP384() {
 
 func initP521() {
 	// See FIPS 186-3, section D.2.5
-	p521 = new(Curve)
+	p521 = new(CurveParams)
 	p521.P, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151", 10)
 	p521.N, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449", 10)
 	p521.B, _ = new(big.Int).SetString("051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00", 16)
@@ -355,26 +358,20 @@ func initP521() {
 	p521.BitSize = 521
 }
 
-// P224 returns a Curve which implements P-224 (see FIPS 186-3, section D.2.2)
-func P224() *Curve {
-	initonce.Do(initAll)
-	return p224
-}
-
 // P256 returns a Curve which implements P-256 (see FIPS 186-3, section D.2.3)
-func P256() *Curve {
+func P256() Curve {
 	initonce.Do(initAll)
 	return p256
 }
 
 // P384 returns a Curve which implements P-384 (see FIPS 186-3, section D.2.4)
-func P384() *Curve {
+func P384() Curve {
 	initonce.Do(initAll)
 	return p384
 }
 
 // P256 returns a Curve which implements P-521 (see FIPS 186-3, section D.2.5)
-func P521() *Curve {
+func P521() Curve {
 	initonce.Do(initAll)
 	return p521
 }
diff --git a/libgo/go/crypto/elliptic/elliptic_test.go b/libgo/go/crypto/elliptic/elliptic_test.go
index a68a380..c23af75 100644
--- a/libgo/go/crypto/elliptic/elliptic_test.go
+++ b/libgo/go/crypto/elliptic/elliptic_test.go
@@ -13,7 +13,7 @@ import (
 
 func TestOnCurve(t *testing.T) {
 	p224 := P224()
-	if !p224.IsOnCurve(p224.Gx, p224.Gy) {
+	if !p224.IsOnCurve(p224.Params().Gx, p224.Params().Gy) {
 		t.Errorf("FAIL")
 	}
 }
@@ -295,7 +295,25 @@ func TestBaseMult(t *testing.T) {
 		}
 		x, y := p224.ScalarBaseMult(k.Bytes())
 		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {
-			t.Errorf("%d: bad output for k=%s: got (%x, %s), want (%x, %s)", i, e.k, x, y, e.x, e.y)
+			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)
+		}
+		if testing.Short() && i > 5 {
+			break
+		}
+	}
+}
+
+func TestGenericBaseMult(t *testing.T) {
+	// We use the P224 CurveParams directly in order to test the generic implementation.
+	p224 := P224().Params()
+	for i, e := range p224BaseMultTests {
+		k, ok := new(big.Int).SetString(e.k, 10)
+		if !ok {
+			t.Errorf("%d: bad value for k: %s", i, e.k)
+		}
+		x, y := p224.ScalarBaseMult(k.Bytes())
+		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {
+			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)
 		}
 		if testing.Short() && i > 5 {
 			break
@@ -316,13 +334,13 @@ func BenchmarkBaseMult(b *testing.B) {
 
 func TestMarshal(t *testing.T) {
 	p224 := P224()
-	_, x, y, err := p224.GenerateKey(rand.Reader)
+	_, x, y, err := GenerateKey(p224, rand.Reader)
 	if err != nil {
 		t.Error(err)
 		return
 	}
-	serialized := p224.Marshal(x, y)
-	xx, yy := p224.Unmarshal(serialized)
+	serialized := Marshal(p224, x, y)
+	xx, yy := Unmarshal(p224, serialized)
 	if xx == nil {
 		t.Error("failed to unmarshal")
 		return
diff --git a/libgo/go/crypto/elliptic/p224.go b/libgo/go/crypto/elliptic/p224.go
new file mode 100644
index 0000000..08db5bc
--- /dev/null
+++ b/libgo/go/crypto/elliptic/p224.go
@@ -0,0 +1,685 @@
+// Copyright 2012 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package elliptic
+
+// This is a constant-time, 32-bit implementation of P224. See FIPS 186-3,
+// section D.2.2.
+//
+// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
+
+import (
+	"math/big"
+)
+
+var p224 p224Curve
+
+type p224Curve struct {
+	*CurveParams
+	gx, gy, b p224FieldElement
+}
+
+func initP224() {
+	// See FIPS 186-3, section D.2.2
+	p224.CurveParams = new(CurveParams)
+	p224.P, _ = new(big.Int).SetString("26959946667150639794667015087019630673557916260026308143510066298881", 10)
+	p224.N, _ = new(big.Int).SetString("26959946667150639794667015087019625940457807714424391721682722368061", 10)
+	p224.B, _ = new(big.Int).SetString("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4", 16)
+	p224.Gx, _ = new(big.Int).SetString("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21", 16)
+	p224.Gy, _ = new(big.Int).SetString("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34", 16)
+	p224.BitSize = 224
+
+	p224FromBig(&p224.gx, p224.Gx)
+	p224FromBig(&p224.gy, p224.Gy)
+	p224FromBig(&p224.b, p224.B)
+}
+
+// P224 returns a Curve which implements P-224 (see FIPS 186-3, section D.2.2)
+func P224() Curve {
+	initonce.Do(initAll)
+	return p224
+}
+
+func (curve p224Curve) Params() *CurveParams {
+	return curve.CurveParams
+}
+
+func (curve p224Curve) IsOnCurve(bigX, bigY *big.Int) bool {
+	var x, y p224FieldElement
+	p224FromBig(&x, bigX)
+	p224FromBig(&y, bigY)
+
+	// y² = x³ - 3x + b
+	var tmp p224LargeFieldElement
+	var x3 p224FieldElement
+	p224Square(&x3, &x, &tmp)
+	p224Mul(&x3, &x3, &x, &tmp)
+
+	for i := 0; i < 8; i++ {
+		x[i] *= 3
+	}
+	p224Sub(&x3, &x3, &x)
+	p224Reduce(&x3)
+	p224Add(&x3, &x3, &curve.b)
+	p224Contract(&x3, &x3)
+
+	p224Square(&y, &y, &tmp)
+	p224Contract(&y, &y)
+
+	for i := 0; i < 8; i++ {
+		if y[i] != x3[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func (p224Curve) Add(bigX1, bigY1, bigX2, bigY2 *big.Int) (x, y *big.Int) {
+	var x1, y1, z1, x2, y2, z2, x3, y3, z3 p224FieldElement
+
+	p224FromBig(&x1, bigX1)
+	p224FromBig(&y1, bigY1)
+	z1[0] = 1
+	p224FromBig(&x2, bigX2)
+	p224FromBig(&y2, bigY2)
+	z2[0] = 1
+
+	p224AddJacobian(&x3, &y3, &z3, &x1, &y1, &z1, &x2, &y2, &z2)
+	return p224ToAffine(&x3, &y3, &z3)
+}
+
+func (p224Curve) Double(bigX1, bigY1 *big.Int) (x, y *big.Int) {
+	var x1, y1, z1, x2, y2, z2 p224FieldElement
+
+	p224FromBig(&x1, bigX1)
+	p224FromBig(&y1, bigY1)
+	z1[0] = 1
+
+	p224DoubleJacobian(&x2, &y2, &z2, &x1, &y1, &z1)
+	return p224ToAffine(&x2, &y2, &z2)
+}
+
+func (p224Curve) ScalarMult(bigX1, bigY1 *big.Int, scalar []byte) (x, y *big.Int) {
+	var x1, y1, z1, x2, y2, z2 p224FieldElement
+
+	p224FromBig(&x1, bigX1)
+	p224FromBig(&y1, bigY1)
+	z1[0] = 1
+
+	p224ScalarMult(&x2, &y2, &z2, &x1, &y1, &z1, scalar)
+	return p224ToAffine(&x2, &y2, &z2)
+}
+
+func (curve p224Curve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {
+	var z1, x2, y2, z2 p224FieldElement
+
+	z1[0] = 1
+	p224ScalarMult(&x2, &y2, &z2, &curve.gx, &curve.gy, &z1, scalar)
+	return p224ToAffine(&x2, &y2, &z2)
+}
+
+// Field element functions.
+//
+// The field that we're dealing with is ℤ/pℤ where p = 2**224 - 2**96 + 1.
+//
+// Field elements are represented by a FieldElement, which is a typedef to an
+// array of 8 uint32's. The value of a FieldElement, a, is:
+//   a[0] + 2**28·a[1] + 2**56·a[1] + ... + 2**196·a[7]
+//
+// Using 28-bit limbs means that there's only 4 bits of headroom, which is less
+// than we would really like. But it has the useful feature that we hit 2**224
+// exactly, making the reflections during a reduce much nicer.
+type p224FieldElement [8]uint32
+
+// p224Add computes *out = a+b
+//
+// a[i] + b[i] < 2**32
+func p224Add(out, a, b *p224FieldElement) {
+	for i := 0; i < 8; i++ {
+		out[i] = a[i] + b[i]
+	}
+}
+
+const two31p3 = 1<<31 + 1<<3
+const two31m3 = 1<<31 - 1<<3
+const two31m15m3 = 1<<31 - 1<<15 - 1<<3
+
+// p224ZeroModP31 is 0 mod p where bit 31 is set in all limbs so that we can
+// subtract smaller amounts without underflow. See the section "Subtraction" in
+// [1] for reasoning.
+var p224ZeroModP31 = []uint32{two31p3, two31m3, two31m3, two31m15m3, two31m3, two31m3, two31m3, two31m3}
+
+// p224Sub computes *out = a-b
+//
+// a[i], b[i] < 2**30
+// out[i] < 2**32
+func p224Sub(out, a, b *p224FieldElement) {
+	for i := 0; i < 8; i++ {
+		out[i] = a[i] + p224ZeroModP31[i] - b[i]
+	}
+}
+
+// LargeFieldElement also represents an element of the field. The limbs are
+// still spaced 28-bits apart and in little-endian order. So the limbs are at
+// 0, 28, 56, ..., 392 bits, each 64-bits wide.
+type p224LargeFieldElement [15]uint64
+
+const two63p35 = 1<<63 + 1<<35
+const two63m35 = 1<<63 - 1<<35
+const two63m35m19 = 1<<63 - 1<<35 - 1<<19
+
+// p224ZeroModP63 is 0 mod p where bit 63 is set in all limbs. See the section
+// "Subtraction" in [1] for why.
+var p224ZeroModP63 = [8]uint64{two63p35, two63m35, two63m35, two63m35, two63m35m19, two63m35, two63m35, two63m35}
+
+const bottom12Bits = 0xfff
+const bottom28Bits = 0xfffffff
+
+// p224Mul computes *out = a*b
+//
+// a[i] < 2**29, b[i] < 2**30 (or vice versa)
+// out[i] < 2**29
+func p224Mul(out, a, b *p224FieldElement, tmp *p224LargeFieldElement) {
+	for i := 0; i < 15; i++ {
+		tmp[i] = 0
+	}
+
+	for i := 0; i < 8; i++ {
+		for j := 0; j < 8; j++ {
+			tmp[i+j] += uint64(a[i]) * uint64(b[j])
+		}
+	}
+
+	p224ReduceLarge(out, tmp)
+}
+
+// Square computes *out = a*a
+//
+// a[i] < 2**29
+// out[i] < 2**29
+func p224Square(out, a *p224FieldElement, tmp *p224LargeFieldElement) {
+	for i := 0; i < 15; i++ {
+		tmp[i] = 0
+	}
+
+	for i := 0; i < 8; i++ {
+		for j := 0; j <= i; j++ {
+			r := uint64(a[i]) * uint64(a[j])
+			if i == j {
+				tmp[i+j] += r
+			} else {
+				tmp[i+j] += r << 1
+			}
+		}
+	}
+
+	p224ReduceLarge(out, tmp)
+}
+
+// ReduceLarge converts a p224LargeFieldElement to a p224FieldElement.
+//
+// in[i] < 2**62
+func p224ReduceLarge(out *p224FieldElement, in *p224LargeFieldElement) {
+	for i := 0; i < 8; i++ {
+		in[i] += p224ZeroModP63[i]
+	}
+
+	// Elimintate the coefficients at 2**224 and greater.
+	for i := 14; i >= 8; i-- {
+		in[i-8] -= in[i]
+		in[i-5] += (in[i] & 0xffff) << 12
+		in[i-4] += in[i] >> 16
+	}
+	in[8] = 0
+	// in[0..8] < 2**64
+
+	// As the values become small enough, we start to store them in |out|
+	// and use 32-bit operations.
+	for i := 1; i < 8; i++ {
+		in[i+1] += in[i] >> 28
+		out[i] = uint32(in[i] & bottom28Bits)
+	}
+	in[0] -= in[8]
+	out[3] += uint32(in[8]&0xffff) << 12
+	out[4] += uint32(in[8] >> 16)
+	// in[0] < 2**64
+	// out[3] < 2**29
+	// out[4] < 2**29
+	// out[1,2,5..7] < 2**28
+
+	out[0] = uint32(in[0] & bottom28Bits)
+	out[1] += uint32((in[0] >> 28) & bottom28Bits)
+	out[2] += uint32(in[0] >> 56)
+	// out[0] < 2**28
+	// out[1..4] < 2**29
+	// out[5..7] < 2**28
+}
+
+// Reduce reduces the coefficients of a to smaller bounds.
+//
+// On entry: a[i] < 2**31 + 2**30
+// On exit: a[i] < 2**29
+func p224Reduce(a *p224FieldElement) {
+	for i := 0; i < 7; i++ {
+		a[i+1] += a[i] >> 28
+		a[i] &= bottom28Bits
+	}
+	top := a[7] >> 28
+	a[7] &= bottom28Bits
+
+	// top < 2**4
+	mask := top
+	mask |= mask >> 2
+	mask |= mask >> 1
+	mask <<= 31
+	mask = uint32(int32(mask) >> 31)
+	// Mask is all ones if top != 0, all zero otherwise
+
+	a[0] -= top
+	a[3] += top << 12
+
+	// We may have just made a[0] negative but, if we did, then we must
+	// have added something to a[3], this it's > 2**12. Therefore we can
+	// carry down to a[0].
+	a[3] -= 1 & mask
+	a[2] += mask & (1<<28 - 1)
+	a[1] += mask & (1<<28 - 1)
+	a[0] += mask & (1 << 28)
+}
+
+// p224Invert calcuates *out = in**-1 by computing in**(2**224 - 2**96 - 1),
+// i.e. Fermat's little theorem.
+func p224Invert(out, in *p224FieldElement) {
+	var f1, f2, f3, f4 p224FieldElement
+	var c p224LargeFieldElement
+
+	p224Square(&f1, in, &c)    // 2
+	p224Mul(&f1, &f1, in, &c)  // 2**2 - 1
+	p224Square(&f1, &f1, &c)   // 2**3 - 2
+	p224Mul(&f1, &f1, in, &c)  // 2**3 - 1
+	p224Square(&f2, &f1, &c)   // 2**4 - 2
+	p224Square(&f2, &f2, &c)   // 2**5 - 4
+	p224Square(&f2, &f2, &c)   // 2**6 - 8
+	p224Mul(&f1, &f1, &f2, &c) // 2**6 - 1
+	p224Square(&f2, &f1, &c)   // 2**7 - 2
+	for i := 0; i < 5; i++ {   // 2**12 - 2**6
+		p224Square(&f2, &f2, &c)
+	}
+	p224Mul(&f2, &f2, &f1, &c) // 2**12 - 1
+	p224Square(&f3, &f2, &c)   // 2**13 - 2
+	for i := 0; i < 11; i++ {  // 2**24 - 2**12
+		p224Square(&f3, &f3, &c)
+	}
+	p224Mul(&f2, &f3, &f2, &c) // 2**24 - 1
+	p224Square(&f3, &f2, &c)   // 2**25 - 2
+	for i := 0; i < 23; i++ {  // 2**48 - 2**24
+		p224Square(&f3, &f3, &c)
+	}
+	p224Mul(&f3, &f3, &f2, &c) // 2**48 - 1
+	p224Square(&f4, &f3, &c)   // 2**49 - 2
+	for i := 0; i < 47; i++ {  // 2**96 - 2**48
+		p224Square(&f4, &f4, &c)
+	}
+	p224Mul(&f3, &f3, &f4, &c) // 2**96 - 1
+	p224Square(&f4, &f3, &c)   // 2**97 - 2
+	for i := 0; i < 23; i++ {  // 2**120 - 2**24
+		p224Square(&f4, &f4, &c)
+	}
+	p224Mul(&f2, &f4, &f2, &c) // 2**120 - 1
+	for i := 0; i < 6; i++ {   // 2**126 - 2**6
+		p224Square(&f2, &f2, &c)
+	}
+	p224Mul(&f1, &f1, &f2, &c) // 2**126 - 1
+	p224Square(&f1, &f1, &c)   // 2**127 - 2
+	p224Mul(&f1, &f1, in, &c)  // 2**127 - 1
+	for i := 0; i < 97; i++ {  // 2**224 - 2**97
+		p224Square(&f1, &f1, &c)
+	}
+	p224Mul(out, &f1, &f3, &c) // 2**224 - 2**96 - 1
+}
+
+// p224Contract converts a FieldElement to its unique, minimal form.
+//
+// On entry, in[i] < 2**32
+// On exit, in[i] < 2**28
+func p224Contract(out, in *p224FieldElement) {
+	copy(out[:], in[:])
+
+	for i := 0; i < 7; i++ {
+		out[i+1] += out[i] >> 28
+		out[i] &= bottom28Bits
+	}
+	top := out[7] >> 28
+	out[7] &= bottom28Bits
+
+	out[0] -= top
+	out[3] += top << 12
+
+	// We may just have made out[i] negative. So we carry down. If we made
+	// out[0] negative then we know that out[3] is sufficiently positive
+	// because we just added to it.
+	for i := 0; i < 3; i++ {
+		mask := uint32(int32(out[i]) >> 31)
+		out[i] += (1 << 28) & mask
+		out[i+1] -= 1 & mask
+	}
+
+	// Now we see if the value is >= p and, if so, subtract p.
+
+	// First we build a mask from the top four limbs, which must all be
+	// equal to bottom28Bits if the whole value is >= p. If top4AllOnes
+	// ends up with any zero bits in the bottom 28 bits, then this wasn't
+	// true.
+	top4AllOnes := uint32(0xffffffff)
+	for i := 4; i < 8; i++ {
+		top4AllOnes &= (out[i] & bottom28Bits) - 1
+	}
+	top4AllOnes |= 0xf0000000
+	// Now we replicate any zero bits to all the bits in top4AllOnes.
+	top4AllOnes &= top4AllOnes >> 16
+	top4AllOnes &= top4AllOnes >> 8
+	top4AllOnes &= top4AllOnes >> 4
+	top4AllOnes &= top4AllOnes >> 2
+	top4AllOnes &= top4AllOnes >> 1
+	top4AllOnes = uint32(int32(top4AllOnes<<31) >> 31)
+
+	// Now we test whether the bottom three limbs are non-zero.
+	bottom3NonZero := out[0] | out[1] | out[2]
+	bottom3NonZero |= bottom3NonZero >> 16
+	bottom3NonZero |= bottom3NonZero >> 8
+	bottom3NonZero |= bottom3NonZero >> 4
+	bottom3NonZero |= bottom3NonZero >> 2
+	bottom3NonZero |= bottom3NonZero >> 1
+	bottom3NonZero = uint32(int32(bottom3NonZero<<31) >> 31)
+
+	// Everything depends on the value of out[3].
+	//    If it's > 0xffff000 and top4AllOnes != 0 then the whole value is >= p
+	//    If it's = 0xffff000 and top4AllOnes != 0 and bottom3NonZero != 0,
+	//      then the whole value is >= p
+	//    If it's < 0xffff000, then the whole value is < p
+	n := out[3] - 0xffff000
+	out3Equal := n
+	out3Equal |= out3Equal >> 16
+	out3Equal |= out3Equal >> 8
+	out3Equal |= out3Equal >> 4
+	out3Equal |= out3Equal >> 2
+	out3Equal |= out3Equal >> 1
+	out3Equal = ^uint32(int32(out3Equal<<31) >> 31)
+
+	// If out[3] > 0xffff000 then n's MSB will be zero.
+	out3GT := ^uint32(int32(n<<31) >> 31)
+
+	mask := top4AllOnes & ((out3Equal & bottom3NonZero) | out3GT)
+	out[0] -= 1 & mask
+	out[3] -= 0xffff000 & mask
+	out[4] -= 0xfffffff & mask
+	out[5] -= 0xfffffff & mask
+	out[6] -= 0xfffffff & mask
+	out[7] -= 0xfffffff & mask
+}
+
+// Group element functions.
+//
+// These functions deal with group elements. The group is an elliptic curve
+// group with a = -3 defined in FIPS 186-3, section D.2.2.
+
+// p224AddJacobian computes *out = a+b where a != b.
+func p224AddJacobian(x3, y3, z3, x1, y1, z1, x2, y2, z2 *p224FieldElement) {
+	// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-p224Add-2007-bl
+	var z1z1, z2z2, u1, u2, s1, s2, h, i, j, r, v p224FieldElement
+	var c p224LargeFieldElement
+
+	// Z1Z1 = Z1²
+	p224Square(&z1z1, z1, &c)
+	// Z2Z2 = Z2²
+	p224Square(&z2z2, z2, &c)
+	// U1 = X1*Z2Z2
+	p224Mul(&u1, x1, &z2z2, &c)
+	// U2 = X2*Z1Z1
+	p224Mul(&u2, x2, &z1z1, &c)
+	// S1 = Y1*Z2*Z2Z2
+	p224Mul(&s1, z2, &z2z2, &c)
+	p224Mul(&s1, y1, &s1, &c)
+	// S2 = Y2*Z1*Z1Z1
+	p224Mul(&s2, z1, &z1z1, &c)
+	p224Mul(&s2, y2, &s2, &c)
+	// H = U2-U1
+	p224Sub(&h, &u2, &u1)
+	p224Reduce(&h)
+	// I = (2*H)²
+	for j := 0; j < 8; j++ {
+		i[j] = h[j] << 1
+	}
+	p224Reduce(&i)
+	p224Square(&i, &i, &c)
+	// J = H*I
+	p224Mul(&j, &h, &i, &c)
+	// r = 2*(S2-S1)
+	p224Sub(&r, &s2, &s1)
+	p224Reduce(&r)
+	for i := 0; i < 8; i++ {
+		r[i] <<= 1
+	}
+	p224Reduce(&r)
+	// V = U1*I
+	p224Mul(&v, &u1, &i, &c)
+	// Z3 = ((Z1+Z2)²-Z1Z1-Z2Z2)*H
+	p224Add(&z1z1, &z1z1, &z2z2)
+	p224Add(&z2z2, z1, z2)
+	p224Reduce(&z2z2)
+	p224Square(&z2z2, &z2z2, &c)
+	p224Sub(z3, &z2z2, &z1z1)
+	p224Reduce(z3)
+	p224Mul(z3, z3, &h, &c)
+	// X3 = r²-J-2*V
+	for i := 0; i < 8; i++ {
+		z1z1[i] = v[i] << 1
+	}
+	p224Add(&z1z1, &j, &z1z1)
+	p224Reduce(&z1z1)
+	p224Square(x3, &r, &c)
+	p224Sub(x3, x3, &z1z1)
+	p224Reduce(x3)
+	// Y3 = r*(V-X3)-2*S1*J
+	for i := 0; i < 8; i++ {
+		s1[i] <<= 1
+	}
+	p224Mul(&s1, &s1, &j, &c)
+	p224Sub(&z1z1, &v, x3)
+	p224Reduce(&z1z1)
+	p224Mul(&z1z1, &z1z1, &r, &c)
+	p224Sub(y3, &z1z1, &s1)
+	p224Reduce(y3)
+}
+
+// p224DoubleJacobian computes *out = a+a.
+func p224DoubleJacobian(x3, y3, z3, x1, y1, z1 *p224FieldElement) {
+	var delta, gamma, beta, alpha, t p224FieldElement
+	var c p224LargeFieldElement
+
+	p224Square(&delta, z1, &c)
+	p224Square(&gamma, y1, &c)
+	p224Mul(&beta, x1, &gamma, &c)
+
+	// alpha = 3*(X1-delta)*(X1+delta)
+	p224Add(&t, x1, &delta)
+	for i := 0; i < 8; i++ {
+		t[i] += t[i] << 1
+	}
+	p224Reduce(&t)
+	p224Sub(&alpha, x1, &delta)
+	p224Reduce(&alpha)
+	p224Mul(&alpha, &alpha, &t, &c)
+
+	// Z3 = (Y1+Z1)²-gamma-delta
+	p224Add(z3, y1, z1)
+	p224Reduce(z3)
+	p224Square(z3, z3, &c)
+	p224Sub(z3, z3, &gamma)
+	p224Reduce(z3)
+	p224Sub(z3, z3, &delta)
+	p224Reduce(z3)
+
+	// X3 = alpha²-8*beta
+	for i := 0; i < 8; i++ {
+		delta[i] = beta[i] << 3
+	}
+	p224Reduce(&delta)
+	p224Square(x3, &alpha, &c)
+	p224Sub(x3, x3, &delta)
+	p224Reduce(x3)
+
+	// Y3 = alpha*(4*beta-X3)-8*gamma²
+	for i := 0; i < 8; i++ {
+		beta[i] <<= 2
+	}
+	p224Sub(&beta, &beta, x3)
+	p224Reduce(&beta)
+	p224Square(&gamma, &gamma, &c)
+	for i := 0; i < 8; i++ {
+		gamma[i] <<= 3
+	}
+	p224Reduce(&gamma)
+	p224Mul(y3, &alpha, &beta, &c)
+	p224Sub(y3, y3, &gamma)
+	p224Reduce(y3)
+}
+
+// p224CopyConditional sets *out = *in iff the least-significant-bit of control
+// is true, and it runs in constant time.
+func p224CopyConditional(out, in *p224FieldElement, control uint32) {
+	control <<= 31
+	control = uint32(int32(control) >> 31)
+
+	for i := 0; i < 8; i++ {
+		out[i] ^= (out[i] ^ in[i]) & control
+	}
+}
+
+func p224ScalarMult(outX, outY, outZ, inX, inY, inZ *p224FieldElement, scalar []byte) {
+	var xx, yy, zz p224FieldElement
+	for i := 0; i < 8; i++ {
+		outZ[i] = 0
+	}
+
+	firstBit := uint32(1)
+	for _, byte := range scalar {
+		for bitNum := uint(0); bitNum < 8; bitNum++ {
+			p224DoubleJacobian(outX, outY, outZ, outX, outY, outZ)
+			bit := uint32((byte >> (7 - bitNum)) & 1)
+			p224AddJacobian(&xx, &yy, &zz, inX, inY, inZ, outX, outY, outZ)
+			p224CopyConditional(outX, inX, firstBit&bit)
+			p224CopyConditional(outY, inY, firstBit&bit)
+			p224CopyConditional(outZ, inZ, firstBit&bit)
+			p224CopyConditional(outX, &xx, ^firstBit&bit)
+			p224CopyConditional(outY, &yy, ^firstBit&bit)
+			p224CopyConditional(outZ, &zz, ^firstBit&bit)
+			firstBit = firstBit & ^bit
+		}
+	}
+}
+
+// p224ToAffine converts from Jacobian to affine form.
+func p224ToAffine(x, y, z *p224FieldElement) (*big.Int, *big.Int) {
+	var zinv, zinvsq, outx, outy p224FieldElement
+	var tmp p224LargeFieldElement
+
+	isPointAtInfinity := true
+	for i := 0; i < 8; i++ {
+		if z[i] != 0 {
+			isPointAtInfinity = false
+			break
+		}
+	}
+
+	if isPointAtInfinity {
+		return nil, nil
+	}
+
+	p224Invert(&zinv, z)
+	p224Square(&zinvsq, &zinv, &tmp)
+	p224Mul(x, x, &zinvsq, &tmp)
+	p224Mul(&zinvsq, &zinvsq, &zinv, &tmp)
+	p224Mul(y, y, &zinvsq, &tmp)
+
+	p224Contract(&outx, x)
+	p224Contract(&outy, y)
+	return p224ToBig(&outx), p224ToBig(&outy)
+}
+
+// get28BitsFromEnd returns the least-significant 28 bits from buf>>shift,
+// where buf is interpreted as a big-endian number.
+func get28BitsFromEnd(buf []byte, shift uint) (uint32, []byte) {
+	var ret uint32
+
+	for i := uint(0); i < 4; i++ {
+		var b byte
+		if l := len(buf); l > 0 {
+			b = buf[l-1]
+			// We don't remove the byte if we're about to return and we're not
+			// reading all of it.
+			if i != 3 || shift == 4 {
+				buf = buf[:l-1]
+			}
+		}
+		ret |= uint32(b) << (8 * i) >> shift
+	}
+	ret &= bottom28Bits
+	return ret, buf
+}
+
+// p224FromBig sets *out = *in.
+func p224FromBig(out *p224FieldElement, in *big.Int) {
+	bytes := in.Bytes()
+	out[0], bytes = get28BitsFromEnd(bytes, 0)
+	out[1], bytes = get28BitsFromEnd(bytes, 4)
+	out[2], bytes = get28BitsFromEnd(bytes, 0)
+	out[3], bytes = get28BitsFromEnd(bytes, 4)
+	out[4], bytes = get28BitsFromEnd(bytes, 0)
+	out[5], bytes = get28BitsFromEnd(bytes, 4)
+	out[6], bytes = get28BitsFromEnd(bytes, 0)
+	out[7], bytes = get28BitsFromEnd(bytes, 4)
+}
+
+// p224ToBig returns in as a big.Int.
+func p224ToBig(in *p224FieldElement) *big.Int {
+	var buf [28]byte
+	buf[27] = byte(in[0])
+	buf[26] = byte(in[0] >> 8)
+	buf[25] = byte(in[0] >> 16)
+	buf[24] = byte(((in[0] >> 24) & 0x0f) | (in[1]<<4)&0xf0)
+
+	buf[23] = byte(in[1] >> 4)
+	buf[22] = byte(in[1] >> 12)
+	buf[21] = byte(in[1] >> 20)
+
+	buf[20] = byte(in[2])
+	buf[19] = byte(in[2] >> 8)
+	buf[18] = byte(in[2] >> 16)
+	buf[17] = byte(((in[2] >> 24) & 0x0f) | (in[3]<<4)&0xf0)
+
+	buf[16] = byte(in[3] >> 4)
+	buf[15] = byte(in[3] >> 12)
+	buf[14] = byte(in[3] >> 20)
+
+	buf[13] = byte(in[4])
+	buf[12] = byte(in[4] >> 8)
+	buf[11] = byte(in[4] >> 16)
+	buf[10] = byte(((in[4] >> 24) & 0x0f) | (in[5]<<4)&0xf0)
+
+	buf[9] = byte(in[5] >> 4)
+	buf[8] = byte(in[5] >> 12)
+	buf[7] = byte(in[5] >> 20)
+
+	buf[6] = byte(in[6])
+	buf[5] = byte(in[6] >> 8)
+	buf[4] = byte(in[6] >> 16)
+	buf[3] = byte(((in[6] >> 24) & 0x0f) | (in[7]<<4)&0xf0)
+
+	buf[2] = byte(in[7] >> 4)
+	buf[1] = byte(in[7] >> 12)
+	buf[0] = byte(in[7] >> 20)
+
+	return new(big.Int).SetBytes(buf[:])
+}
diff --git a/libgo/go/crypto/elliptic/p224_test.go b/libgo/go/crypto/elliptic/p224_test.go
new file mode 100644
index 0000000..4b26d16
--- /dev/null
+++ b/libgo/go/crypto/elliptic/p224_test.go
@@ -0,0 +1,47 @@
+// Copyright 2012 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package elliptic
+
+import (
+	"math/big"
+	"testing"
+)
+
+var toFromBigTests = []string{
+	"0",
+	"1",
+	"23",
+	"b70e0cb46bb4bf7f321390b94a03c1d356c01122343280d6105c1d21",
+	"706a46d476dcb76798e6046d89474788d164c18032d268fd10704fa6",
+}
+
+func p224AlternativeToBig(in *p224FieldElement) *big.Int {
+	ret := new(big.Int)
+	tmp := new(big.Int)
+
+	for i := uint(0); i < 8; i++ {
+		tmp.SetInt64(int64(in[i]))
+		tmp.Lsh(tmp, 28*i)
+		ret.Add(ret, tmp)
+	}
+	ret.Mod(ret, p224.P)
+	return ret
+}
+
+func TestToFromBig(t *testing.T) {
+	for i, test := range toFromBigTests {
+		n, _ := new(big.Int).SetString(test, 16)
+		var x p224FieldElement
+		p224FromBig(&x, n)
+		m := p224ToBig(&x)
+		if n.Cmp(m) != 0 {
+			t.Errorf("#%d: %x != %x", i, n, m)
+		}
+		q := p224AlternativeToBig(&x)
+		if n.Cmp(q) != 0 {
+			t.Errorf("#%d: %x != %x (alternative)", i, n, m)
+		}
+	}
+}
diff --git a/libgo/go/crypto/hmac/hmac.go b/libgo/go/crypto/hmac/hmac.go
index 6e7dd87..a97ce09 100644
--- a/libgo/go/crypto/hmac/hmac.go
+++ b/libgo/go/crypto/hmac/hmac.go
@@ -9,32 +9,20 @@
 package hmac
 
 import (
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
 	"hash"
 )
 
 // FIPS 198:
 // http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf
 
-// key is zero padded to 64 bytes
-// ipad = 0x36 byte repeated to 64 bytes
-// opad = 0x5c byte repeated to 64 bytes
+// key is zero padded to the block size of the hash function
+// ipad = 0x36 byte repeated for key length
+// opad = 0x5c byte repeated for key length
 // hmac = H([key ^ opad] H([key ^ ipad] text))
 
-const (
-	// NOTE(rsc): This constant is actually the
-	// underlying hash function's block size.
-	// HMAC is only conventionally used with
-	// MD5 and SHA1, and both use 64-byte blocks.
-	// The hash.Hash interface doesn't provide a
-	// way to find out the block size.
-	padSize = 64
-)
-
 type hmac struct {
 	size         int
+	blocksize    int
 	key, tmp     []byte
 	outer, inner hash.Hash
 }
@@ -43,7 +31,7 @@ func (h *hmac) tmpPad(xor byte) {
 	for i, k := range h.key {
 		h.tmp[i] = xor ^ k
 	}
-	for i := len(h.key); i < padSize; i++ {
+	for i := len(h.key); i < h.blocksize; i++ {
 		h.tmp[i] = xor
 	}
 }
@@ -52,7 +40,7 @@ func (h *hmac) Sum(in []byte) []byte {
 	origLen := len(in)
 	in = h.inner.Sum(in)
 	h.tmpPad(0x5c)
-	copy(h.tmp[padSize:], in[origLen:])
+	copy(h.tmp[h.blocksize:], in[origLen:])
 	h.outer.Reset()
 	h.outer.Write(h.tmp)
 	return h.outer.Sum(in[:origLen])
@@ -64,20 +52,23 @@ func (h *hmac) Write(p []byte) (n int, err error) {
 
 func (h *hmac) Size() int { return h.size }
 
+func (h *hmac) BlockSize() int { return h.blocksize }
+
 func (h *hmac) Reset() {
 	h.inner.Reset()
 	h.tmpPad(0x36)
-	h.inner.Write(h.tmp[0:padSize])
+	h.inner.Write(h.tmp[0:h.blocksize])
 }
 
-// New returns a new HMAC hash using the given hash generator and key.
+// New returns a new HMAC hash using the given hash.Hash type and key.
 func New(h func() hash.Hash, key []byte) hash.Hash {
 	hm := new(hmac)
 	hm.outer = h()
 	hm.inner = h()
 	hm.size = hm.inner.Size()
-	hm.tmp = make([]byte, padSize+hm.size)
-	if len(key) > padSize {
+	hm.blocksize = hm.inner.BlockSize()
+	hm.tmp = make([]byte, hm.blocksize+hm.size)
+	if len(key) > hm.blocksize {
 		// If key is too big, hash it.
 		hm.outer.Write(key)
 		key = hm.outer.Sum(nil)
@@ -87,12 +78,3 @@ func New(h func() hash.Hash, key []byte) hash.Hash {
 	hm.Reset()
 	return hm
 }
-
-// NewMD5 returns a new HMAC-MD5 hash using the given key.
-func NewMD5(key []byte) hash.Hash { return New(md5.New, key) }
-
-// NewSHA1 returns a new HMAC-SHA1 hash using the given key.
-func NewSHA1(key []byte) hash.Hash { return New(sha1.New, key) }
-
-// NewSHA256 returns a new HMAC-SHA256 hash using the given key.
-func NewSHA256(key []byte) hash.Hash { return New(sha256.New, key) }
diff --git a/libgo/go/crypto/hmac/hmac_test.go b/libgo/go/crypto/hmac/hmac_test.go
index eac254b..0795741 100644
--- a/libgo/go/crypto/hmac/hmac_test.go
+++ b/libgo/go/crypto/hmac/hmac_test.go
@@ -5,13 +5,17 @@
 package hmac
 
 import (
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
 	"fmt"
 	"hash"
 	"testing"
 )
 
 type hmacTest struct {
-	hash func([]byte) hash.Hash
+	hash func() hash.Hash
 	key  []byte
 	in   []byte
 	out  string
@@ -21,7 +25,7 @@ var hmacTests = []hmacTest{
 	// Tests from US FIPS 198
 	// http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf
 	{
-		NewSHA1,
+		sha1.New,
 		[]byte{
 			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
 			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -36,7 +40,7 @@ var hmacTests = []hmacTest{
 		"4f4ca3d5d68ba7cc0a1208c9c61e9c5da0403c0a",
 	},
 	{
-		NewSHA1,
+		sha1.New,
 		[]byte{
 			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
 			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
@@ -46,7 +50,7 @@ var hmacTests = []hmacTest{
 		"0922d3405faa3d194f82a45830737d5cc6c75d24",
 	},
 	{
-		NewSHA1,
+		sha1.New,
 		[]byte{
 			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
 			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
@@ -68,7 +72,7 @@ var hmacTests = []hmacTest{
 
 	// Test from Plan 9.
 	{
-		NewMD5,
+		md5.New,
 		[]byte("Jefe"),
 		[]byte("what do ya want for nothing?"),
 		"750c783e6ab0b503eaa86e310a5db738",
@@ -76,7 +80,7 @@ var hmacTests = []hmacTest{
 
 	// Tests from RFC 4231
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte{
 			0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
 			0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
@@ -86,13 +90,13 @@ var hmacTests = []hmacTest{
 		"b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7",
 	},
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte("Jefe"),
 		[]byte("what do ya want for nothing?"),
 		"5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843",
 	},
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte{
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
@@ -110,7 +114,7 @@ var hmacTests = []hmacTest{
 		"773ea91e36800e46854db8ebd09181a72959098b3ef8c122d9635514ced565fe",
 	},
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte{
 			0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
 			0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
@@ -129,7 +133,7 @@ var hmacTests = []hmacTest{
 		"82558a389a443c0ea4cc819899f2083a85f0faa3e578f8077a2e3ff46729665b",
 	},
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte{
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
@@ -153,7 +157,7 @@ var hmacTests = []hmacTest{
 		"60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54",
 	},
 	{
-		NewSHA256,
+		sha256.New,
 		[]byte{
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
 			0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
@@ -178,11 +182,295 @@ var hmacTests = []hmacTest{
 			"be hashed before being used by the HMAC algorithm."),
 		"9b09ffa71b942fcb27635fbcd5b0e944bfdc63644f0713938a7f51535c3a35e2",
 	},
+
+	// Tests from http://csrc.nist.gov/groups/ST/toolkit/examples.html
+	// (truncated tag tests are left out)
+	{
+		sha1.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"5fd596ee78d5553c8ff4e72d266dfd192366da29",
+	},
+	{
+		sha1.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13,
+		},
+		[]byte("Sample message for keylen<blocklen"),
+		"4c99ff0cb1b31bd33f8431dbaf4d17fcd356a807",
+	},
+	{
+		sha1.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"2d51b2f7750e410584662e38f133435f4c4fd42a",
+	},
+	{
+		sha256.New224,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"c7405e3ae058e8cd30b08b4140248581ed174cb34e1224bcc1efc81b",
+	},
+	{
+		sha256.New224,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b,
+		},
+		[]byte("Sample message for keylen<blocklen"),
+		"e3d249a8cfb67ef8b7a169e9a0a599714a2cecba65999a51beb8fbbe",
+	},
+	{
+		sha256.New224,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"91c52509e5af8531601ae6230099d90bef88aaefb961f4080abc014d",
+	},
+	{
+		sha256.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"8bb9a1db9806f20df7f77b82138c7914d174d59e13dc4d0169c9057b133e1d62",
+	},
+	{
+		sha256.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+		},
+		[]byte("Sample message for keylen<blocklen"),
+		"a28cf43130ee696a98f14a37678b56bcfcbdd9e5cf69717fecf5480f0ebdf790",
+	},
+	{
+		sha256.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"bdccb6c72ddeadb500ae768386cb38cc41c63dbb0878ddb9c7a38a431b78378d",
+	},
+	{
+		sha512.New384,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+			0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+			0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"63c5daa5e651847ca897c95814ab830bededc7d25e83eef9195cd45857a37f448947858f5af50cc2b1b730ddf29671a9",
+	},
+	{
+		sha512.New384,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+		},
+		[]byte("Sample message for keylen<blocklen"),
+		"6eb242bdbb582ca17bebfa481b1e23211464d2b7f8c20b9ff2201637b93646af5ae9ac316e98db45d9cae773675eeed0",
+	},
+	{
+		sha512.New384,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+			0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+			0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
+			0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+			0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+			0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+			0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
+			0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+			0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
+			0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+			0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+			0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"5b664436df69b0ca22551231a3f0a3d5b4f97991713cfa84bff4d0792eff96c27dccbbb6f79b65d548b40e8564cef594",
+	},
+	{
+		sha512.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+			0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+			0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"fc25e240658ca785b7a811a8d3f7b4ca" +
+			"48cfa26a8a366bf2cd1f836b05fcb024bd36853081811d6c" +
+			"ea4216ebad79da1cfcb95ea4586b8a0ce356596a55fb1347",
+	},
+	{
+		sha512.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+		},
+		[]byte("Sample message for keylen<blocklen"),
+		"fd44c18bda0bb0a6ce0e82b031bf2818" +
+			"f6539bd56ec00bdc10a8a2d730b3634de2545d639b0f2cf7" +
+			"10d0692c72a1896f1f211c2b922d1a96c392e07e7ea9fedc",
+	},
+	{
+		sha512.New,
+		[]byte{
+			0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+			0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+			0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+			0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+			0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+			0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+			0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+			0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+			0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+			0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+			0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
+			0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+			0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+			0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+			0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
+			0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+			0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
+			0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+			0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+			0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+		},
+		[]byte("Sample message for keylen=blocklen"),
+		"d93ec8d2de1ad2a9957cb9b83f14e76a" +
+			"d6b5e0cce285079a127d3b14bccb7aa7286d4ac0d4ce6421" +
+			"5f2bc9e6870b33d97438be4aaa20cda5c5a912b48b8e27f3",
+	},
 }
 
 func TestHMAC(t *testing.T) {
 	for i, tt := range hmacTests {
-		h := tt.hash(tt.key)
+		h := New(tt.hash, tt.key)
 		for j := 0; j < 2; j++ {
 			n, err := h.Write(tt.in)
 			if n != len(tt.in) || err != nil {
diff --git a/libgo/go/crypto/md4/md4.go b/libgo/go/crypto/md4/md4.go
index e51e8be..c5f7c57 100644
--- a/libgo/go/crypto/md4/md4.go
+++ b/libgo/go/crypto/md4/md4.go
@@ -17,6 +17,9 @@ func init() {
 // The size of an MD4 checksum in bytes.
 const Size = 16
 
+// The blocksize of MD4 in bytes.
+const BlockSize = 64
+
 const (
 	_Chunk = 64
 	_Init0 = 0x67452301
@@ -51,6 +54,8 @@ func New() hash.Hash {
 
 func (d *digest) Size() int { return Size }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.len += uint64(nn)
diff --git a/libgo/go/crypto/md5/md5.go b/libgo/go/crypto/md5/md5.go
index f4e7b09..cfb728c 100644
--- a/libgo/go/crypto/md5/md5.go
+++ b/libgo/go/crypto/md5/md5.go
@@ -17,6 +17,9 @@ func init() {
 // The size of an MD5 checksum in bytes.
 const Size = 16
 
+// The blocksize of MD5 in bytes.
+const BlockSize = 64
+
 const (
 	_Chunk = 64
 	_Init0 = 0x67452301
@@ -51,6 +54,8 @@ func New() hash.Hash {
 
 func (d *digest) Size() int { return Size }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.len += uint64(nn)
diff --git a/libgo/go/crypto/ocsp/ocsp_test.go b/libgo/go/crypto/ocsp/ocsp_test.go
index 49d8ea2..f0e9f94 100644
--- a/libgo/go/crypto/ocsp/ocsp_test.go
+++ b/libgo/go/crypto/ocsp/ocsp_test.go
@@ -1,3 +1,7 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
 package ocsp
 
 import (
diff --git a/libgo/go/crypto/openpgp/canonical_text.go b/libgo/go/crypto/openpgp/canonical_text.go
index 98cee5e..e601e38 100644
--- a/libgo/go/crypto/openpgp/canonical_text.go
+++ b/libgo/go/crypto/openpgp/canonical_text.go
@@ -53,3 +53,7 @@ func (cth *canonicalTextHash) Reset() {
 func (cth *canonicalTextHash) Size() int {
 	return cth.h.Size()
 }
+
+func (cth *canonicalTextHash) BlockSize() int {
+	return cth.h.BlockSize()
+}
diff --git a/libgo/go/crypto/openpgp/canonical_text_test.go b/libgo/go/crypto/openpgp/canonical_text_test.go
index 841475f..8f3ba2a 100644
--- a/libgo/go/crypto/openpgp/canonical_text_test.go
+++ b/libgo/go/crypto/openpgp/canonical_text_test.go
@@ -29,6 +29,10 @@ func (r recordingHash) Size() int {
 	panic("shouldn't be called")
 }
 
+func (r recordingHash) BlockSize() int {
+	panic("shouldn't be called")
+}
+
 func testCanonicalText(t *testing.T, input, expected string) {
 	r := recordingHash{bytes.NewBuffer(nil)}
 	c := NewCanonicalTextHash(r)
diff --git a/libgo/go/crypto/ripemd160/ripemd160.go b/libgo/go/crypto/ripemd160/ripemd160.go
index cd2cc39..da690f0 100644
--- a/libgo/go/crypto/ripemd160/ripemd160.go
+++ b/libgo/go/crypto/ripemd160/ripemd160.go
@@ -55,6 +55,8 @@ func New() hash.Hash {
 
 func (d *digest) Size() int { return Size }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.tc += uint64(nn)
diff --git a/libgo/go/crypto/sha1/sha1.go b/libgo/go/crypto/sha1/sha1.go
index 7bb68bb..876e799 100644
--- a/libgo/go/crypto/sha1/sha1.go
+++ b/libgo/go/crypto/sha1/sha1.go
@@ -17,6 +17,9 @@ func init() {
 // The size of a SHA1 checksum in bytes.
 const Size = 20
 
+// The blocksize of SHA1 in bytes.
+const BlockSize = 64
+
 const (
 	_Chunk = 64
 	_Init0 = 0x67452301
@@ -53,6 +56,8 @@ func New() hash.Hash {
 
 func (d *digest) Size() int { return Size }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.len += uint64(nn)
diff --git a/libgo/go/crypto/sha256/sha256.go b/libgo/go/crypto/sha256/sha256.go
index 4525541..a61e30b 100644
--- a/libgo/go/crypto/sha256/sha256.go
+++ b/libgo/go/crypto/sha256/sha256.go
@@ -22,6 +22,9 @@ const Size = 32
 // The size of a SHA224 checksum in bytes.
 const Size224 = 28
 
+// The blocksize of SHA256 and SHA224 in bytes.
+const BlockSize = 64
+
 const (
 	_Chunk     = 64
 	_Init0     = 0x6A09E667
@@ -97,6 +100,8 @@ func (d *digest) Size() int {
 	return Size224
 }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.len += uint64(nn)
diff --git a/libgo/go/crypto/sha512/sha512.go b/libgo/go/crypto/sha512/sha512.go
index 927f28a..a245fd6 100644
--- a/libgo/go/crypto/sha512/sha512.go
+++ b/libgo/go/crypto/sha512/sha512.go
@@ -22,6 +22,9 @@ const Size = 64
 // The size of a SHA384 checksum in bytes.
 const Size384 = 48
 
+// The blocksize of SHA512 and SHA384 in bytes.
+const BlockSize = 128
+
 const (
 	_Chunk     = 128
 	_Init0     = 0x6a09e667f3bcc908
@@ -97,6 +100,8 @@ func (d *digest) Size() int {
 	return Size384
 }
 
+func (d *digest) BlockSize() int { return BlockSize }
+
 func (d *digest) Write(p []byte) (nn int, err error) {
 	nn = len(p)
 	d.len += uint64(nn)
diff --git a/libgo/go/crypto/tls/cipher_suites.go b/libgo/go/crypto/tls/cipher_suites.go
index 914491d..00695e7 100644
--- a/libgo/go/crypto/tls/cipher_suites.go
+++ b/libgo/go/crypto/tls/cipher_suites.go
@@ -91,7 +91,7 @@ func macSHA1(version uint16, key []byte) macFunction {
 		copy(mac.key, key)
 		return mac
 	}
-	return tls10MAC{hmac.NewSHA1(key)}
+	return tls10MAC{hmac.New(sha1.New, key)}
 }
 
 type macFunction interface {
diff --git a/libgo/go/crypto/tls/conn.go b/libgo/go/crypto/tls/conn.go
index 6a03fa8..e6cee12 100644
--- a/libgo/go/crypto/tls/conn.go
+++ b/libgo/go/crypto/tls/conn.go
@@ -15,6 +15,7 @@ import (
 	"io"
 	"net"
 	"sync"
+	"time"
 )
 
 // A Conn represents a secured connection.
@@ -86,24 +87,23 @@ func (c *Conn) RemoteAddr() net.Addr {
 	return c.conn.RemoteAddr()
 }
 
-// SetTimeout sets the read deadline associated with the connection.
+// SetDeadline sets the read deadline associated with the connection.
 // There is no write deadline.
-func (c *Conn) SetTimeout(nsec int64) error {
-	return c.conn.SetTimeout(nsec)
+// A zero value for t means Read will not time out.
+func (c *Conn) SetDeadline(t time.Time) error {
+	return c.conn.SetDeadline(t)
 }
 
-// SetReadTimeout sets the time (in nanoseconds) that
-// Read will wait for data before returning a net.Error
-// with Timeout() == true.
-// Setting nsec == 0 (the default) disables the deadline.
-func (c *Conn) SetReadTimeout(nsec int64) error {
-	return c.conn.SetReadTimeout(nsec)
+// SetReadDeadline sets the read deadline on the underlying connection.
+// A zero value for t means Read will not time out.
+func (c *Conn) SetReadDeadline(t time.Time) error {
+	return c.conn.SetReadDeadline(t)
 }
 
-// SetWriteTimeout exists to satisfy the net.Conn interface
+// SetWriteDeadline exists to satisfy the net.Conn interface
 // but is not implemented by TLS.  It always returns an error.
-func (c *Conn) SetWriteTimeout(nsec int64) error {
-	return errors.New("TLS does not support SetWriteTimeout")
+func (c *Conn) SetWriteDeadline(t time.Time) error {
+	return errors.New("TLS does not support SetWriteDeadline")
 }
 
 // A halfConn represents one direction of the record layer
@@ -744,7 +744,7 @@ func (c *Conn) Write(b []byte) (n int, err error) {
 }
 
 // Read can be made to time out and return a net.Error with Timeout() == true
-// after a fixed time limit; see SetTimeout and SetReadTimeout.
+// after a fixed time limit; see SetDeadline and SetReadDeadline.
 func (c *Conn) Read(b []byte) (n int, err error) {
 	if err = c.Handshake(); err != nil {
 		return
diff --git a/libgo/go/crypto/tls/key_agreement.go b/libgo/go/crypto/tls/key_agreement.go
index c3c1664..75f5c73 100644
--- a/libgo/go/crypto/tls/key_agreement.go
+++ b/libgo/go/crypto/tls/key_agreement.go
@@ -105,7 +105,7 @@ func md5SHA1Hash(slices ...[]byte) []byte {
 // pre-master secret is then calculated using ECDH.
 type ecdheRSAKeyAgreement struct {
 	privateKey []byte
-	curve      *elliptic.Curve
+	curve      elliptic.Curve
 	x, y       *big.Int
 }
 
@@ -132,11 +132,11 @@ Curve:
 
 	var x, y *big.Int
 	var err error
-	ka.privateKey, x, y, err = ka.curve.GenerateKey(config.rand())
+	ka.privateKey, x, y, err = elliptic.GenerateKey(ka.curve, config.rand())
 	if err != nil {
 		return nil, err
 	}
-	ecdhePublic := ka.curve.Marshal(x, y)
+	ecdhePublic := elliptic.Marshal(ka.curve, x, y)
 
 	// http://tools.ietf.org/html/rfc4492#section-5.4
 	serverECDHParams := make([]byte, 1+2+1+len(ecdhePublic))
@@ -167,12 +167,12 @@ func (ka *ecdheRSAKeyAgreement) processClientKeyExchange(config *Config, ckx *cl
 	if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
 		return nil, errors.New("bad ClientKeyExchange")
 	}
-	x, y := ka.curve.Unmarshal(ckx.ciphertext[1:])
+	x, y := elliptic.Unmarshal(ka.curve, ckx.ciphertext[1:])
 	if x == nil {
 		return nil, errors.New("bad ClientKeyExchange")
 	}
 	x, _ = ka.curve.ScalarMult(x, y, ka.privateKey)
-	preMasterSecret := make([]byte, (ka.curve.BitSize+7)>>3)
+	preMasterSecret := make([]byte, (ka.curve.Params().BitSize+7)>>3)
 	xBytes := x.Bytes()
 	copy(preMasterSecret[len(preMasterSecret)-len(xBytes):], xBytes)
 
@@ -205,7 +205,7 @@ func (ka *ecdheRSAKeyAgreement) processServerKeyExchange(config *Config, clientH
 	if publicLen+4 > len(skx.key) {
 		return errServerKeyExchange
 	}
-	ka.x, ka.y = ka.curve.Unmarshal(skx.key[4 : 4+publicLen])
+	ka.x, ka.y = elliptic.Unmarshal(ka.curve, skx.key[4:4+publicLen])
 	if ka.x == nil {
 		return errServerKeyExchange
 	}
@@ -229,16 +229,16 @@ func (ka *ecdheRSAKeyAgreement) generateClientKeyExchange(config *Config, client
 	if ka.curve == nil {
 		return nil, nil, errors.New("missing ServerKeyExchange message")
 	}
-	priv, mx, my, err := ka.curve.GenerateKey(config.rand())
+	priv, mx, my, err := elliptic.GenerateKey(ka.curve, config.rand())
 	if err != nil {
 		return nil, nil, err
 	}
 	x, _ := ka.curve.ScalarMult(ka.x, ka.y, priv)
-	preMasterSecret := make([]byte, (ka.curve.BitSize+7)>>3)
+	preMasterSecret := make([]byte, (ka.curve.Params().BitSize+7)>>3)
 	xBytes := x.Bytes()
 	copy(preMasterSecret[len(preMasterSecret)-len(xBytes):], xBytes)
 
-	serialized := ka.curve.Marshal(mx, my)
+	serialized := elliptic.Marshal(ka.curve, mx, my)
 
 	ckx := new(clientKeyExchangeMsg)
 	ckx.ciphertext = make([]byte, 1+len(serialized))
diff --git a/libgo/go/crypto/tls/root_unix.go b/libgo/go/crypto/tls/root_unix.go
index 5bbd982..acaf3dd 100644
--- a/libgo/go/crypto/tls/root_unix.go
+++ b/libgo/go/crypto/tls/root_unix.go
@@ -13,10 +13,11 @@ import (
 
 // Possible certificate files; stop after finding one.
 var certFiles = []string{
-	"/etc/ssl/certs/ca-certificates.crt", // Linux etc
-	"/etc/pki/tls/certs/ca-bundle.crt",   // Fedora/RHEL
-	"/etc/ssl/ca-bundle.pem",             // OpenSUSE
-	"/etc/ssl/cert.pem",                  // OpenBSD
+	"/etc/ssl/certs/ca-certificates.crt",     // Linux etc
+	"/etc/pki/tls/certs/ca-bundle.crt",       // Fedora/RHEL
+	"/etc/ssl/ca-bundle.pem",                 // OpenSUSE
+	"/etc/ssl/cert.pem",                      // OpenBSD
+	"/usr/local/share/certs/ca-root-nss.crt", // FreeBSD
 }
 
 func initDefaultRoots() {
diff --git a/libgo/go/crypto/x509/x509.go b/libgo/go/crypto/x509/x509.go
index 28c7880..bf39c5d 100644
--- a/libgo/go/crypto/x509/x509.go
+++ b/libgo/go/crypto/x509/x509.go
@@ -899,6 +899,14 @@ var (
 	oidRSA         = []int{1, 2, 840, 113549, 1, 1, 1}
 )
 
+func subjectBytes(cert *Certificate) ([]byte, error) {
+	if len(cert.RawSubject) > 0 {
+		return cert.RawSubject, nil
+	}
+
+	return asn1.Marshal(cert.Subject.ToRDNSequence())
+}
+
 // CreateCertificate creates a new certificate based on a template. The
 // following members of template are used: SerialNumber, Subject, NotBefore,
 // NotAfter, KeyUsage, BasicConstraintsValid, IsCA, MaxPathLen, SubjectKeyId,
@@ -909,10 +917,23 @@ var (
 // signee and priv is the private key of the signer.
 //
 // The returned slice is the certificate in DER encoding.
-func CreateCertificate(rand io.Reader, template, parent *Certificate, pub *rsa.PublicKey, priv *rsa.PrivateKey) (cert []byte, err error) {
+//
+// The only supported key type is RSA (*rsa.PublicKey for pub, *rsa.PrivateKey
+// for priv).
+func CreateCertificate(rand io.Reader, template, parent *Certificate, pub interface{}, priv interface{}) (cert []byte, err error) {
+	rsaPub, ok := pub.(*rsa.PublicKey)
+	if !ok {
+		return nil, errors.New("x509: non-RSA public keys not supported")
+	}
+
+	rsaPriv, ok := priv.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("x509: non-RSA private keys not supported")
+	}
+
 	asn1PublicKey, err := asn1.Marshal(rsaPublicKey{
-		N: pub.N,
-		E: pub.E,
+		N: rsaPub.N,
+		E: rsaPub.E,
 	})
 	if err != nil {
 		return
@@ -927,16 +948,12 @@ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub *rsa.P
 		return
 	}
 
-	var asn1Issuer []byte
-	if len(parent.RawSubject) > 0 {
-		asn1Issuer = parent.RawSubject
-	} else {
-		if asn1Issuer, err = asn1.Marshal(parent.Subject.ToRDNSequence()); err != nil {
-			return
-		}
+	asn1Issuer, err := subjectBytes(parent)
+	if err != nil {
+		return
 	}
 
-	asn1Subject, err := asn1.Marshal(template.Subject.ToRDNSequence())
+	asn1Subject, err := subjectBytes(template)
 	if err != nil {
 		return
 	}
@@ -964,7 +981,7 @@ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub *rsa.P
 	h.Write(tbsCertContents)
 	digest := h.Sum(nil)
 
-	signature, err := rsa.SignPKCS1v15(rand, priv, crypto.SHA1, digest)
+	signature, err := rsa.SignPKCS1v15(rand, rsaPriv, crypto.SHA1, digest)
 	if err != nil {
 		return
 	}
@@ -1011,7 +1028,13 @@ func ParseDERCRL(derBytes []byte) (certList *pkix.CertificateList, err error) {
 
 // CreateCRL returns a DER encoded CRL, signed by this Certificate, that
 // contains the given list of revoked certificates.
-func (c *Certificate) CreateCRL(rand io.Reader, priv *rsa.PrivateKey, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error) {
+//
+// The only supported key type is RSA (*rsa.PrivateKey for priv).
+func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error) {
+	rsaPriv, ok := priv.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("x509: non-RSA private keys not supported")
+	}
 	tbsCertList := pkix.TBSCertificateList{
 		Version: 2,
 		Signature: pkix.AlgorithmIdentifier{
@@ -1032,7 +1055,7 @@ func (c *Certificate) CreateCRL(rand io.Reader, priv *rsa.PrivateKey, revokedCer
 	h.Write(tbsCertListContents)
 	digest := h.Sum(nil)
 
-	signature, err := rsa.SignPKCS1v15(rand, priv, crypto.SHA1, digest)
+	signature, err := rsa.SignPKCS1v15(rand, rsaPriv, crypto.SHA1, digest)
 	if err != nil {
 		return
 	}