diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
new file mode 100644
index 0000000..05272c2
--- /dev/null
+++ b/CryptoPkg/.gitignore
@@ -0,0 +1,2 @@
+Include/openssl
+Library/OpensslLib/openssl-*/
diff --git a/CryptoPkg/Application/Cryptest/Cryptest.c b/CryptoPkg/Application/Cryptest/Cryptest.c
index 44aaaba..79c1850 100644
--- a/CryptoPkg/Application/Cryptest/Cryptest.c
+++ b/CryptoPkg/Application/Cryptest/Cryptest.c
@@ -1,7 +1,7 @@
-/** @file  
+/** @file
   Application for Cryptographic Primitives Validation.
 
-Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -73,6 +73,11 @@
     return Status;
   }
 
+  Status = ValidateTSCounterSignature ();
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
   Status = ValidateCryptDh ();
   if (EFI_ERROR (Status)) {
     return Status;
@@ -84,4 +89,4 @@
   }
 
   return EFI_SUCCESS;
-}
+}
\ No newline at end of file
diff --git a/CryptoPkg/Application/Cryptest/Cryptest.h b/CryptoPkg/Application/Cryptest/Cryptest.h
index 216d0a2..17b4224 100644
--- a/CryptoPkg/Application/Cryptest/Cryptest.h
+++ b/CryptoPkg/Application/Cryptest/Cryptest.h
@@ -1,7 +1,7 @@
-/** @file  
+/** @file
   Application for Cryptographic Primitives Validation.
 
-Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -109,6 +109,18 @@
   );
 
 /**
+  Validate UEFI-OpenSSL RFC3161 Timestamp CounterSignature Verification Interfaces.
+
+  @retval  EFI_SUCCESS  Validation succeeded.
+  @retval  EFI_ABORTED  Validation failed.
+
+**/
+EFI_STATUS
+ValidateTSCounterSignature (
+  VOID
+  );
+
+/**
   Validate UEFI-OpenSSL DH Interfaces.
 
   @retval  EFI_SUCCESS  Validation succeeded.
@@ -132,4 +144,4 @@
   VOID
   );
 
-#endif
+#endif
\ No newline at end of file
diff --git a/CryptoPkg/Application/Cryptest/Cryptest.inf b/CryptoPkg/Application/Cryptest/Cryptest.inf
index b3ffab7..6696f94 100644
--- a/CryptoPkg/Application/Cryptest/Cryptest.inf
+++ b/CryptoPkg/Application/Cryptest/Cryptest.inf
@@ -37,6 +37,7 @@
   RsaVerify.c
   RsaVerify2.c
   AuthenticodeVerify.c
+  TSVerify.c
   DhVerify.c
   RandVerify.c
   
diff --git a/CryptoPkg/Application/Cryptest/DhVerify.c b/CryptoPkg/Application/Cryptest/DhVerify.c
index 455d85b..6384a8a 100644
--- a/CryptoPkg/Application/Cryptest/DhVerify.c
+++ b/CryptoPkg/Application/Cryptest/DhVerify.c
@@ -1,7 +1,7 @@
-/** @file  
+/** @file
   Application for Diffie-Hellman Primitives Validation.
 
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -42,6 +42,14 @@
   Print (L"\nUEFI-OpenSSL DH Engine Testing:\n");
 
   //
+  // Initialize Key Length
+  //
+  PublicKey1Length = sizeof (PublicKey1);
+  PublicKey2Length = sizeof (PublicKey2);
+  Key1Length       = sizeof (Key1);
+  Key2Length       = sizeof (Key2);
+
+  //
   // Generate & Initialize DH Context
   //
   Print (L"- Context1 ... ");
@@ -114,4 +122,4 @@
   Print (L"[Pass]\n");
 
   return EFI_SUCCESS;
-}
+}
\ No newline at end of file
diff --git a/CryptoPkg/Application/Cryptest/HashVerify.c b/CryptoPkg/Application/Cryptest/HashVerify.c
index 107ff45..ca64361 100644
--- a/CryptoPkg/Application/Cryptest/HashVerify.c
+++ b/CryptoPkg/Application/Cryptest/HashVerify.c
@@ -1,7 +1,7 @@
-/** @file  
+/** @file
   Application for Hash Primitives Validation.
 
-Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -54,6 +54,25 @@
   0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad
   };
 
+//
+// Result for SHA-384("abc"). (From "D.1 SHA-384 Example" of NIST FIPS 180-2)
+//
+GLOBAL_REMOVE_IF_UNREFERENCED CONST UINT8 Sha384Digest[SHA384_DIGEST_SIZE] = {
+  0xcb, 0x00, 0x75, 0x3f, 0x45, 0xa3, 0x5e, 0x8b, 0xb5, 0xa0, 0x3d, 0x69, 0x9a, 0xc6, 0x50, 0x07,
+  0x27, 0x2c, 0x32, 0xab, 0x0e, 0xde, 0xd1, 0x63, 0x1a, 0x8b, 0x60, 0x5a, 0x43, 0xff, 0x5b, 0xed,
+  0x80, 0x86, 0x07, 0x2b, 0xa1, 0xe7, 0xcc, 0x23, 0x58, 0xba, 0xec, 0xa1, 0x34, 0xc8, 0x25, 0xa7
+  };
+
+//
+// Result for SHA-512("abc"). (From "C.1 SHA-512 Example" of NIST FIPS 180-2)
+//
+GLOBAL_REMOVE_IF_UNREFERENCED CONST UINT8 Sha512Digest[SHA512_DIGEST_SIZE] = {
+  0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49, 0xae, 0x20, 0x41, 0x31,
+  0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2, 0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a,
+  0x21, 0x92, 0x99, 0x2a, 0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
+  0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f, 0xa5, 0x4c, 0xa4, 0x9f
+  };
+
 /**
   Validate UEFI-OpenSSL Digest Interfaces.
 
@@ -76,7 +95,7 @@
   DataSize = AsciiStrLen (HashData);
 
   Print (L"- MD4:    ");
-  
+
   //
   // MD4 Digest Validation
   //
@@ -234,6 +253,86 @@
   }
 
   Print (L"[Pass]\n");
-  
+
+  Print (L"- SHA384: ");
+
+  //
+  // SHA384 Digest Validation
+  //
+  ZeroMem (Digest, MAX_DIGEST_SIZE);
+  CtxSize = Sha384GetContextSize ();
+  HashCtx = AllocatePool (CtxSize);
+
+  Print (L"Init... ");
+  Status  = Sha384Init (HashCtx);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"Update... ");
+  Status  = Sha384Update (HashCtx, HashData, DataSize);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"Finalize... ");
+  Status  = Sha384Final (HashCtx, Digest);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  FreePool (HashCtx);
+
+  Print (L"Check Value... ");
+  if (CompareMem (Digest, Sha384Digest, SHA384_DIGEST_SIZE) != 0) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"[Pass]\n");
+
+  Print (L"- SHA512: ");
+
+  //
+  // SHA512 Digest Validation
+  //
+  ZeroMem (Digest, MAX_DIGEST_SIZE);
+  CtxSize = Sha512GetContextSize ();
+  HashCtx = AllocatePool (CtxSize);
+
+  Print (L"Init... ");
+  Status  = Sha512Init (HashCtx);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"Update... ");
+  Status  = Sha512Update (HashCtx, HashData, DataSize);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"Finalize... ");
+  Status  = Sha512Final (HashCtx, Digest);
+  if (!Status) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  FreePool (HashCtx);
+
+  Print (L"Check Value... ");
+  if (CompareMem (Digest, Sha512Digest, SHA512_DIGEST_SIZE) != 0) {
+    Print (L"[Fail]");
+    return EFI_ABORTED;
+  }
+
+  Print (L"[Pass]\n");
+
   return EFI_SUCCESS;
 }
diff --git a/CryptoPkg/Application/Cryptest/TSVerify.c b/CryptoPkg/Application/Cryptest/TSVerify.c
new file mode 100644
index 0000000..7a8d107
--- /dev/null
+++ b/CryptoPkg/Application/Cryptest/TSVerify.c
@@ -0,0 +1,501 @@
+/** @file
+  Sample Implementation for RFC3161 Time Stamping Verification.
+
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "Cryptest.h"
+
+//
+// Sample Authenticode Data with RFC3161 time stamping signature.
+// The data retrieved from one signed sample UEFI image, which is generated by MSFT's signtool 
+// utility in conjunction with RFC3161 timestamping, as the following command:
+//   signtool sign /ac <xxx.cer> / f <xxx.pfx> /p <pass> /fd <digestAlg> 
+//     /tr http://timestamp.comodoca.com/rfc3161 sample.efi
+//
+GLOBAL_REMOVE_IF_UNREFERENCED UINT8 AuthenticodeWithTS[] = {
+  0x30, 0x82, 0x0c, 0x00, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0,
+  0x82, 0x0b, 0xf1, 0x30, 0x82, 0x0b, 0xed, 0x02, 0x01, 0x01, 0x31, 0x0f, 0x30, 0x0d, 0x06, 0x09,
+  0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x30, 0x78, 0x06, 0x0a, 0x2b,
+  0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04, 0xa0, 0x6a, 0x30, 0x68, 0x30, 0x33, 0x06,
+  0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x0f, 0x30, 0x25, 0x03, 0x01, 0x00,
+  0xa0, 0x20, 0xa2, 0x1e, 0x80, 0x1c, 0x00, 0x3c, 0x00, 0x3c, 0x00, 0x3c, 0x00, 0x4f, 0x00, 0x62,
+  0x00, 0x73, 0x00, 0x6f, 0x00, 0x6c, 0x00, 0x65, 0x00, 0x74, 0x00, 0x65, 0x00, 0x3e, 0x00, 0x3e,
+  0x00, 0x3e, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
+  0x01, 0x05, 0x00, 0x04, 0x20, 0x1e, 0x9e, 0x74, 0x31, 0xe1, 0x3e, 0x51, 0x46, 0xab, 0xce, 0x10,
+  0x0d, 0x7c, 0x38, 0x66, 0x34, 0xd4, 0xdd, 0x04, 0xa5, 0xe7, 0x75, 0x40, 0xdd, 0x99, 0x73, 0xf3,
+  0x2a, 0x54, 0x3e, 0xa8, 0x18, 0xa0, 0x82, 0x01, 0xee, 0x30, 0x82, 0x01, 0xea, 0x30, 0x82, 0x01,
+  0x57, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x2c, 0x65, 0xcf, 0xcf, 0xdd, 0x61, 0x7b, 0xa4,
+  0x41, 0xad, 0x26, 0x1b, 0x63, 0xce, 0x91, 0x0f, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
+  0x1d, 0x05, 0x00, 0x30, 0x13, 0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x08,
+  0x54, 0x65, 0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x37,
+  0x32, 0x38, 0x30, 0x37, 0x33, 0x38, 0x35, 0x39, 0x5a, 0x17, 0x0d, 0x33, 0x39, 0x31, 0x32, 0x33,
+  0x31, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x12, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
+  0x55, 0x04, 0x03, 0x13, 0x07, 0x54, 0x65, 0x73, 0x74, 0x53, 0x75, 0x62, 0x30, 0x81, 0x9f, 0x30,
+  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81,
+  0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0x94, 0xa6, 0x02, 0x15, 0x87, 0xd6, 0xbf,
+  0x71, 0xe8, 0xc6, 0x68, 0xf6, 0x9f, 0x66, 0x09, 0x6c, 0xe7, 0x39, 0x52, 0xf4, 0x4e, 0xaf, 0xf5,
+  0xe0, 0xba, 0x0f, 0xfd, 0xe6, 0x77, 0xa9, 0x71, 0x5b, 0x5c, 0x92, 0x50, 0x1d, 0xfd, 0x9b, 0x6e,
+  0x52, 0x92, 0x9e, 0x3a, 0x75, 0x86, 0x41, 0x2a, 0x41, 0x30, 0x1b, 0x67, 0x66, 0x91, 0xde, 0x71,
+  0x84, 0xe0, 0x90, 0xc3, 0x50, 0x36, 0x78, 0xb5, 0xa0, 0x1e, 0x72, 0xde, 0xe7, 0x66, 0x42, 0x4f,
+  0x59, 0x5e, 0x3d, 0xf3, 0x85, 0x82, 0x0b, 0xa8, 0x26, 0x2d, 0xd9, 0xe3, 0x14, 0xda, 0x9d, 0x2e,
+  0x3f, 0x53, 0x4d, 0x8d, 0x10, 0xbf, 0xa4, 0x7c, 0xe5, 0xaf, 0x3a, 0xa6, 0xaf, 0x49, 0x64, 0xb0,
+  0x60, 0x17, 0x87, 0x71, 0x77, 0x59, 0x52, 0xe5, 0x5a, 0xed, 0x96, 0x7d, 0x7e, 0x5d, 0xc1, 0xef,
+  0x6b, 0xfb, 0x80, 0xc5, 0x2b, 0x10, 0xfe, 0xe7, 0xd3, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x48,
+  0x30, 0x46, 0x30, 0x44, 0x06, 0x03, 0x55, 0x1d, 0x01, 0x04, 0x3d, 0x30, 0x3b, 0x80, 0x10, 0x19,
+  0x8d, 0x48, 0xa1, 0xb9, 0xf3, 0x5e, 0x3c, 0x13, 0xb4, 0x08, 0xb6, 0xd9, 0xf3, 0x4f, 0x0a, 0xa1,
+  0x15, 0x30, 0x13, 0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x08, 0x54, 0x65,
+  0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x82, 0x10, 0x27, 0xcb, 0x16, 0x33, 0x8b, 0xed, 0x4d, 0xa8,
+  0x47, 0xf0, 0x86, 0x47, 0x10, 0xef, 0x15, 0xd9, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
+  0x1d, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x51, 0x94, 0xed, 0x7a, 0x5c, 0x0b, 0x34, 0x16, 0x9c,
+  0xf4, 0x5f, 0x88, 0x16, 0xa8, 0x4b, 0x13, 0xfc, 0xa4, 0x0a, 0xc7, 0xd9, 0x20, 0xb1, 0x93, 0xc5,
+  0x81, 0x4f, 0x35, 0x3a, 0x89, 0x10, 0x04, 0xc4, 0xcc, 0x10, 0x34, 0xc3, 0x15, 0x57, 0x06, 0x97,
+  0xee, 0x06, 0x2f, 0xf3, 0x24, 0xa1, 0xe6, 0x3a, 0x89, 0x4d, 0xb4, 0x7b, 0x12, 0x87, 0x90, 0x8c,
+  0xfc, 0x5b, 0xb0, 0xf0, 0xdd, 0xaa, 0x3a, 0x24, 0x6d, 0x55, 0x47, 0x8a, 0xf2, 0x61, 0x08, 0x7a,
+  0x59, 0x5f, 0x6e, 0x7b, 0xcb, 0x34, 0xbe, 0xb6, 0x5d, 0xcb, 0x60, 0xae, 0xc4, 0xda, 0x62, 0xbb,
+  0x7f, 0x17, 0x1e, 0x73, 0xd1, 0x4e, 0x9f, 0x6e, 0xd3, 0xc8, 0x35, 0x58, 0x30, 0xd2, 0x89, 0xe5,
+  0x22, 0x5e, 0x86, 0xac, 0x7a, 0x56, 0xd6, 0x70, 0xdb, 0x54, 0x10, 0x6c, 0xd3, 0xd5, 0x38, 0xfb,
+  0x69, 0xcb, 0x4f, 0x36, 0x83, 0xc2, 0xe8, 0x31, 0x82, 0x09, 0x69, 0x30, 0x82, 0x09, 0x65, 0x02,
+  0x01, 0x01, 0x30, 0x27, 0x30, 0x13, 0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
+  0x08, 0x54, 0x65, 0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x02, 0x10, 0x2c, 0x65, 0xcf, 0xcf, 0xdd,
+  0x61, 0x7b, 0xa4, 0x41, 0xad, 0x26, 0x1b, 0x63, 0xce, 0x91, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60,
+  0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa0, 0x5e, 0x30, 0x10, 0x06, 0x0a,
+  0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x0c, 0x31, 0x02, 0x30, 0x00, 0x30, 0x19,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x03, 0x31, 0x0c, 0x06, 0x0a, 0x2b,
+  0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04, 0x30, 0x2f, 0x06, 0x09, 0x2a, 0x86, 0x48,
+  0x86, 0xf7, 0x0d, 0x01, 0x09, 0x04, 0x31, 0x22, 0x04, 0x20, 0x97, 0x6e, 0x29, 0x47, 0xc4, 0x03,
+  0x68, 0x70, 0x1c, 0x99, 0x2c, 0x61, 0xb0, 0xbc, 0xde, 0x77, 0xe1, 0xa1, 0xeb, 0x4c, 0x1c, 0xac,
+  0x4c, 0x64, 0xf6, 0x43, 0x96, 0x94, 0x0b, 0xc0, 0xbb, 0x03, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
+  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x81, 0x80, 0x85, 0x93, 0xad, 0x93,
+  0x92, 0x9e, 0xa4, 0x94, 0x30, 0x02, 0xe1, 0xc8, 0xcd, 0x37, 0xb2, 0xe1, 0xcb, 0xb2, 0x0f, 0x1c,
+  0x67, 0xd1, 0xc9, 0xeb, 0x4d, 0x68, 0x85, 0x97, 0x5a, 0xa6, 0x0c, 0x03, 0xc7, 0x86, 0xae, 0xb3,
+  0x35, 0xb4, 0x1d, 0x0e, 0x95, 0x5f, 0xed, 0x37, 0x13, 0x6b, 0x1e, 0x94, 0x80, 0xf1, 0xac, 0x55,
+  0x73, 0xd1, 0x31, 0xf9, 0xad, 0x13, 0x7b, 0x26, 0xbf, 0xe7, 0x55, 0x7b, 0xb2, 0xf9, 0x21, 0x42,
+  0x23, 0x64, 0xe6, 0x45, 0x03, 0x67, 0xcb, 0x42, 0xd3, 0x71, 0x3f, 0xd5, 0x29, 0x17, 0x4b, 0x49,
+  0x45, 0x0e, 0x8b, 0xba, 0x1f, 0x15, 0x5a, 0x7f, 0x7b, 0x5e, 0x9b, 0x22, 0x46, 0xa7, 0x9c, 0x0d,
+  0x25, 0x9c, 0x76, 0x25, 0x02, 0xc8, 0x15, 0x00, 0x51, 0xe6, 0x73, 0x39, 0xac, 0x8d, 0x41, 0x7b,
+  0xc8, 0x42, 0xc9, 0xdb, 0x1b, 0x16, 0x13, 0xf6, 0x44, 0x32, 0xef, 0x17, 0xa1, 0x82, 0x08, 0x34,
+  0x30, 0x82, 0x08, 0x30, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x03, 0x03, 0x01,
+  0x31, 0x82, 0x08, 0x20,
+  0x30, 0x82, 0x08, 0x1c, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0,
+  0x82, 0x08, 0x0d, 0x30, 0x82, 0x08, 0x09, 0x02, 0x01, 0x03, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x05,
+  0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x30, 0x81, 0xf6, 0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86,
+  0xf7, 0x0d, 0x01, 0x09, 0x10, 0x01, 0x04, 0xa0, 0x81, 0xe6, 0x04, 0x81, 0xe3, 0x30, 0x81, 0xe0,
+  0x02, 0x01, 0x01, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xb2, 0x31, 0x02, 0x01, 0x01, 0x30,
+  0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14, 0xcd, 0x06,
+  0xf0, 0xbd, 0x8b, 0xcd, 0x5c, 0x2e, 0x5a, 0x7c, 0x42, 0x56, 0x2c, 0x20, 0x4a, 0x15, 0xcb, 0x1d,
+  0x8b, 0x0e, 0x02, 0x15, 0x00, 0xb6, 0xff, 0x47, 0x05, 0xb6, 0x2d, 0x15, 0xac, 0x3f, 0x5d, 0xd9,
+  0xcf, 0x9d, 0x54, 0x35, 0x56, 0x7c, 0xc1, 0x6e, 0x8b, 0x18, 0x0f, 0x32, 0x30, 0x31, 0x34, 0x30,
+  0x37, 0x32, 0x38, 0x30, 0x38, 0x35, 0x30, 0x30, 0x33, 0x5a, 0xa0, 0x81, 0x83, 0xa4, 0x81, 0x80,
+  0x30, 0x7e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31,
+  0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74, 0x65,
+  0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e,
+  0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a,
+  0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20,
+  0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03,
+  0x55, 0x04, 0x03, 0x13, 0x1b, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x54, 0x69, 0x6d, 0x65,
+  0x20, 0x53, 0x74, 0x61, 0x6d, 0x70, 0x69, 0x6e, 0x67, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x72,
+  0xa0, 0x82, 0x04, 0x97, 0x30, 0x82, 0x04, 0x93, 0x30, 0x82, 0x03, 0x7b, 0xa0, 0x03, 0x02, 0x01,
+  0x02, 0x02, 0x10, 0x47, 0x8a, 0x8e, 0xfb, 0x59, 0xe1, 0xd8, 0x3f, 0x0c, 0xe1, 0x42, 0xd2, 0xa2,
+  0x87, 0x07, 0xbe, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05,
+  0x05, 0x00, 0x30, 0x81, 0x95, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
+  0x55, 0x53, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x02, 0x55, 0x54, 0x31,
+  0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0e, 0x53, 0x61, 0x6c, 0x74, 0x20, 0x4c,
+  0x61, 0x6b, 0x65, 0x20, 0x43, 0x69, 0x74, 0x79, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04,
+  0x0a, 0x13, 0x15, 0x54, 0x68, 0x65, 0x20, 0x55, 0x53, 0x45, 0x52, 0x54, 0x52, 0x55, 0x53, 0x54,
+  0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04,
+  0x0b, 0x13, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x75, 0x73,
+  0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x31, 0x1d, 0x30, 0x1b, 0x06,
+  0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69,
+  0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30,
+  0x30, 0x35, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30,
+  0x35, 0x31, 0x30, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x7e, 0x31, 0x0b, 0x30, 0x09,
+  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55,
+  0x04, 0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63,
+  0x68, 0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13,
+  0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04,
+  0x0a, 0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d,
+  0x69, 0x74, 0x65, 0x64, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1b, 0x43,
+  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x54, 0x69, 0x6d, 0x65, 0x20, 0x53, 0x74, 0x61, 0x6d, 0x70,
+  0x69, 0x6e, 0x67, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x72, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01,
+  0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xbc, 0x35, 0xa0, 0x36, 0x70,
+  0x22, 0x81, 0x11, 0xc3, 0xb2, 0x83, 0xb9, 0xd3, 0x28, 0xc6, 0x36, 0xcd, 0x25, 0x6b, 0xa9, 0x7b,
+  0xb2, 0x1c, 0xf6, 0x9b, 0x51, 0x9c, 0xef, 0x35, 0xf4, 0xed, 0x08, 0x8e, 0x5e, 0x38, 0x08, 0xf8,
+  0x77, 0x3c, 0x0a, 0x42, 0xe0, 0xf3, 0x70, 0xdc, 0xa3, 0xd7, 0xca, 0xf5, 0x4c, 0x0b, 0xcf, 0xff,
+  0x22, 0x9c, 0x0a, 0x7e, 0x68, 0xd6, 0x09, 0xa2, 0x2a, 0x84, 0x7b, 0xa6, 0x9d, 0xb4, 0xa9, 0xc1,
+  0x33, 0xe2, 0xef, 0x1f, 0x17, 0x48, 0xca, 0x3a, 0xcd, 0x46, 0xe6, 0xc5, 0xaa, 0x77, 0xbd, 0xe3,
+  0x77, 0x9a, 0xfa, 0x47, 0x53, 0x40, 0x28, 0x59, 0x43, 0x93, 0xf1, 0xa4, 0x81, 0xea, 0xef, 0x80,
+  0xb5, 0x4f, 0xa7, 0x08, 0xce, 0xba, 0x6e, 0xbc, 0xca, 0x76, 0x0c, 0x97, 0x64, 0x59, 0x86, 0x24,
+  0xbb, 0x3d, 0x82, 0x90, 0xa8, 0x55, 0xb1, 0x92, 0xd3, 0xa0, 0xa7, 0x05, 0xac, 0x9f, 0x53, 0x25,
+  0x08, 0x10, 0x47, 0x99, 0xcd, 0x98, 0xde, 0x68, 0xe5, 0xb4, 0x50, 0x78, 0xa3, 0xaf, 0x01, 0xcc,
+  0x59, 0x43, 0x58, 0xe4, 0x76, 0x6e, 0x7e, 0xac, 0xc7, 0xe2, 0x9e, 0x1f, 0x4f, 0xb0, 0x47, 0x2d,
+  0xc8, 0x0c, 0xa3, 0x49, 0x27, 0x80, 0x75, 0x8c, 0xbb, 0x06, 0x91, 0x65, 0x0f, 0x90, 0x9b, 0xf4,
+  0xba, 0xd1, 0x81, 0xc8, 0x5c, 0x6a, 0xec, 0x14, 0xe9, 0x25, 0x09, 0xbf, 0x23, 0x16, 0xf4, 0x95,
+  0x46, 0x40, 0x40, 0x21, 0xbb, 0x83, 0x96, 0xfd, 0x86, 0x1f, 0x7a, 0xc8, 0x0d, 0x10, 0x8e, 0xa2,
+  0xf8, 0x19, 0x07, 0x58, 0x7f, 0x9f, 0xbd, 0x37, 0x02, 0x60, 0xf2, 0xa4, 0xe9, 0x9d, 0x44, 0x3f,
+  0x30, 0x05, 0xe4, 0xa7, 0x70, 0x99, 0x51, 0x9a, 0xe8, 0x17, 0xf1, 0x55, 0xca, 0xb2, 0x61, 0x89,
+  0x65, 0x46, 0xa7, 0x6a, 0xf2, 0x58, 0x46, 0x7e, 0xaa, 0xa0, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01,
+  0xa3, 0x81, 0xf4, 0x30, 0x81, 0xf1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
+  0x16, 0x80, 0x14, 0xda, 0xed, 0x64, 0x74, 0x14, 0x9c, 0x14, 0x3c, 0xab, 0xdd, 0x99, 0xa9, 0xbd,
+  0x5b, 0x28, 0x4d, 0x8b, 0x3c, 0xc9, 0xd8, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16,
+  0x04, 0x14, 0x2e, 0x2d, 0xb0, 0x0a, 0x44, 0x4a, 0xd3, 0x87, 0xc0, 0x02, 0x07, 0xce, 0x97, 0x7d,
+  0x50, 0x62, 0x20, 0xfd, 0x0f, 0x83, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff,
+  0x04, 0x04, 0x03, 0x02, 0x06, 0xc0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
+  0x04, 0x02, 0x30, 0x00, 0x30, 0x16, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x01, 0x01, 0xff, 0x04, 0x0c,
+  0x30, 0x0a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08, 0x30, 0x42, 0x06, 0x03,
+  0x55, 0x1d, 0x1f, 0x04, 0x3b, 0x30, 0x39, 0x30, 0x37, 0xa0, 0x35, 0xa0, 0x33, 0x86, 0x31, 0x68,
+  0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72,
+  0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52,
+  0x46, 0x69, 0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x63, 0x72, 0x6c,
+  0x30, 0x35, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x29, 0x30, 0x27,
+  0x30, 0x25, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x19, 0x68, 0x74,
+  0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72,
+  0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+  0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xc8, 0xfb, 0x63, 0xf8, 0x0b,
+  0x75, 0x75, 0x2c, 0x3a, 0xf1, 0xf2, 0x13, 0xa7, 0x2d, 0xb6, 0xa3, 0x1a, 0x9c, 0xad, 0x01, 0x07,
+  0xd3, 0x34, 0x8e, 0x77, 0xe0, 0xc2, 0x6e, 0xae, 0x02, 0x5d, 0x48, 0x4f, 0xa4, 0xd2, 0x21, 0xb6,
+  0x36, 0xfd, 0x2a, 0x35, 0x43, 0x7c, 0x6b, 0xdf, 0x80, 0x87, 0x0b, 0x15, 0xf0, 0x76, 0x32, 0x00,
+  0xb4, 0xce, 0xb5, 0x67, 0xa4, 0x2f, 0x2f, 0x20, 0x1b, 0x9c, 0x54, 0x9e, 0x83, 0x3f, 0x1f, 0x5f,
+  0x14, 0x95, 0x62, 0x82, 0x0f, 0x22, 0x41, 0x22, 0x1f, 0x70, 0xb3, 0xf3, 0xf7, 0x42, 0xde, 0x6c,
+  0x51, 0xcd, 0x4b, 0xf8, 0x21, 0xac, 0x9b, 0x3b, 0x8c, 0xb1, 0xe5, 0xe6, 0x28, 0x8f, 0xce, 0x2a,
+  0x8a, 0xf9, 0xaa, 0x52, 0x4d, 0x8c, 0x5b, 0x77, 0xba, 0x4d, 0x5a, 0x58, 0xdb, 0xbb, 0x6a, 0x04,
+  0xcc, 0x52, 0x1e, 0x9d, 0xe2, 0x28, 0x37, 0x0e, 0xbb, 0xe7, 0x0e, 0x91, 0xc7, 0xf8, 0xdb, 0xf1,
+  0x81, 0x98, 0xeb, 0xcd, 0x37, 0xb3, 0x0e, 0xab, 0x65, 0xd3, 0x62, 0xec, 0x3a, 0xa5, 0x76, 0xeb,
+  0x13, 0xa8, 0x35, 0x93, 0xc9, 0x2e, 0x0a, 0x01, 0xec, 0xc0, 0xe8, 0xcc, 0x3d, 0x7e, 0xb6, 0xeb,
+  0xe2, 0xc1, 0xec, 0xd3, 0x14, 0x92, 0x82, 0x66, 0x87, 0x50, 0xdc, 0xfd, 0x50, 0x97, 0xac, 0xb3,
+  0x4a, 0x76, 0x73, 0x06, 0xc4, 0x86, 0x11, 0x3a, 0xb3, 0x5f, 0x43, 0x04, 0x52, 0x6f, 0xea, 0xb3,
+  0xd0, 0x74, 0x36, 0x4c, 0xca, 0xf1, 0x1b, 0x79, 0x84, 0x37, 0x70, 0x63, 0xad, 0x74, 0xb9, 0xaa,
+  0x0e, 0xf3, 0x98, 0xb0, 0x86, 0x08, 0xeb, 0xdb, 0xe0, 0x1f, 0x8c, 0x10, 0xf2, 0x39, 0x64, 0x9b,
+  0xae, 0x4f, 0x0a, 0x2c, 0x92, 0x8a, 0x4f, 0x18, 0xb5, 0x91, 0xe5, 0x8d, 0x1a, 0x93, 0x5f, 0x1f,
+  0xae, 0xf1, 0xa6, 0xf0, 0x2e, 0x97, 0xd0, 0xd2, 0xf6, 0x2b, 0x3c, 0x31, 0x82, 0x02, 0x61, 0x30,
+  0x82, 0x02, 0x5d, 0x02, 0x01, 0x01, 0x30, 0x81, 0xaa, 0x30, 0x81, 0x95, 0x31, 0x0b, 0x30, 0x09,
+  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
+  0x04, 0x08, 0x13, 0x02, 0x55, 0x54, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13,
+  0x0e, 0x53, 0x61, 0x6c, 0x74, 0x20, 0x4c, 0x61, 0x6b, 0x65, 0x20, 0x43, 0x69, 0x74, 0x79, 0x31,
+  0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x15, 0x54, 0x68, 0x65, 0x20, 0x55, 0x53,
+  0x45, 0x52, 0x54, 0x52, 0x55, 0x53, 0x54, 0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31,
+  0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
+  0x2f, 0x77, 0x77, 0x77, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x63,
+  0x6f, 0x6d, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x55, 0x54, 0x4e,
+  0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69, 0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63,
+  0x74, 0x02, 0x10, 0x47, 0x8a, 0x8e, 0xfb, 0x59, 0xe1, 0xd8, 0x3f, 0x0c, 0xe1, 0x42, 0xd2, 0xa2,
+  0x87, 0x07, 0xbe, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0xa0, 0x81,
+  0x8c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x03, 0x31, 0x0d,
+  0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x10, 0x01, 0x04, 0x30, 0x1c, 0x06,
+  0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x05, 0x31, 0x0f, 0x17, 0x0d, 0x31, 0x34,
+  0x30, 0x37, 0x32, 0x38, 0x30, 0x38, 0x35, 0x30, 0x30, 0x33, 0x5a, 0x30, 0x23, 0x06, 0x09, 0x2a,
+  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x04, 0x31, 0x16, 0x04, 0x14, 0x7a, 0xad, 0x35, 0xdc,
+  0x5b, 0xd6, 0x00, 0xd7, 0x44, 0xac, 0x80, 0x8f, 0x4f, 0xb6, 0xb4, 0x03, 0x62, 0x34, 0x53, 0xdc,
+  0x30, 0x2b, 0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x10, 0x02, 0x0c, 0x31,
+  0x1c, 0x30, 0x1a, 0x30, 0x18, 0x30, 0x16, 0x04, 0x14, 0x3d, 0xbb, 0x6d, 0xb5, 0x08, 0x5c, 0x6d,
+  0xd5, 0xa1, 0xca, 0x7f, 0x9c, 0xf8, 0x4e, 0xcb, 0x1a, 0x39, 0x10, 0xca, 0xc8, 0x30, 0x0d, 0x06,
+  0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x01, 0x00,
+  0x73, 0x64, 0xb9, 0xa3, 0x54, 0x6f, 0x50, 0x97, 0x01, 0xa7, 0xf6, 0x0d, 0xb8, 0xce, 0x4b, 0xaa,
+  0x43, 0xa2, 0x8f, 0xa3, 0xea, 0x93, 0xf2, 0xa3, 0xd0, 0x46, 0xde, 0xdd, 0x45, 0xe5, 0x94, 0x5a,
+  0x45, 0xc2, 0x13, 0x1b, 0x90, 0x9b, 0xcf, 0x73, 0xcd, 0x28, 0x70, 0xf0, 0xf4, 0x54, 0xb5, 0x2d,
+  0x31, 0xf9, 0xf3, 0x2d, 0x38, 0x78, 0xfe, 0x68, 0xea, 0x3c, 0xc0, 0xbe, 0x0b, 0x5a, 0x91, 0x49,
+  0x63, 0xeb, 0x26, 0x32, 0x5b, 0x86, 0xcf, 0xe5, 0x8a, 0xa5, 0x9d, 0xe6, 0x4b, 0x57, 0x91, 0x8f,
+  0x3c, 0xdc, 0xa6, 0x53, 0xd8, 0xdb, 0x8a, 0xfd, 0x3e, 0x7e, 0x19, 0x6f, 0x27, 0x72, 0x95, 0xc2,
+  0x79, 0x73, 0xdf, 0xfb, 0x08, 0x5c, 0x5b, 0xc8, 0xb7, 0x94, 0x75, 0x88, 0x7a, 0x9a, 0x85, 0x9f,
+  0x1b, 0xa3, 0x98, 0x30, 0x91, 0xee, 0xc0, 0x52, 0xd2, 0x75, 0x9c, 0xcb, 0x45, 0x0d, 0x94, 0x43,
+  0x67, 0x7a, 0x49, 0x1c, 0xb1, 0x89, 0x9d, 0x6e, 0xfa, 0x87, 0xd2, 0x4d, 0x6e, 0x74, 0x90, 0xf5,
+  0x80, 0x8c, 0x92, 0xda, 0xd9, 0xa1, 0x48, 0x20, 0x31, 0x02, 0x79, 0xde, 0xe3, 0xbd, 0x09, 0x04,
+  0xa8, 0xd4, 0x99, 0xd7, 0x3b, 0xea, 0xf8, 0xdf, 0xb3, 0xb9, 0xd7, 0xa3, 0x36, 0xa1, 0xdb, 0xd3,
+  0xec, 0x65, 0x8c, 0xb8, 0x8f, 0xfb, 0xd6, 0xef, 0x9c, 0x32, 0x3e, 0xab, 0x20, 0x74, 0xb9, 0x65,
+  0x4c, 0xc6, 0x15, 0x2f, 0x31, 0x2a, 0x34, 0x3e, 0x84, 0x09, 0xb4, 0x75, 0xbc, 0xbe, 0xaf, 0xb3,
+  0x9e, 0x85, 0xf1, 0xbb, 0x99, 0x1a, 0x07, 0xbd, 0x20, 0xa6, 0xed, 0xcf, 0xd1, 0xa6, 0x9a, 0x22,
+  0xb2, 0x6d, 0x75, 0xf4, 0x23, 0x58, 0x13, 0x78, 0x73, 0x1a, 0xb2, 0x84, 0xde, 0xad, 0xe8, 0x6d,
+  0xe6, 0xe7, 0x5c, 0xb6, 0xe6, 0x5b, 0x10, 0x37, 0x1f, 0xe3, 0x6e, 0xbd, 0x83, 0xd7, 0x51, 0xb1,
+  0x00, 0x00, 0x00, 0x00, 0x0a
+  };
+
+//
+// The RFC3161 timestamping counterSignature retrieved from the above AuthenticodeWithTS.
+//
+GLOBAL_REMOVE_IF_UNREFERENCED UINT8 TSCounterSignature[] = {
+  0x30, 0x82, 0x08, 0x1c, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0,
+  0x82, 0x08, 0x0d, 0x30, 0x82, 0x08, 0x09, 0x02, 0x01, 0x03, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x05,
+  0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x30, 0x81, 0xf6, 0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86,
+  0xf7, 0x0d, 0x01, 0x09, 0x10, 0x01, 0x04, 0xa0, 0x81, 0xe6, 0x04, 0x81, 0xe3, 0x30, 0x81, 0xe0,
+  0x02, 0x01, 0x01, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xb2, 0x31, 0x02, 0x01, 0x01, 0x30,
+  0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14, 0xcd, 0x06,
+  0xf0, 0xbd, 0x8b, 0xcd, 0x5c, 0x2e, 0x5a, 0x7c, 0x42, 0x56, 0x2c, 0x20, 0x4a, 0x15, 0xcb, 0x1d,
+  0x8b, 0x0e, 0x02, 0x15, 0x00, 0xb6, 0xff, 0x47, 0x05, 0xb6, 0x2d, 0x15, 0xac, 0x3f, 0x5d, 0xd9,
+  0xcf, 0x9d, 0x54, 0x35, 0x56, 0x7c, 0xc1, 0x6e, 0x8b, 0x18, 0x0f, 0x32, 0x30, 0x31, 0x34, 0x30,
+  0x37, 0x32, 0x38, 0x30, 0x38, 0x35, 0x30, 0x30, 0x33, 0x5a, 0xa0, 0x81, 0x83, 0xa4, 0x81, 0x80,
+  0x30, 0x7e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31,
+  0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74, 0x65,
+  0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e,
+  0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a,
+  0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20,
+  0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03,
+  0x55, 0x04, 0x03, 0x13, 0x1b, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x54, 0x69, 0x6d, 0x65,
+  0x20, 0x53, 0x74, 0x61, 0x6d, 0x70, 0x69, 0x6e, 0x67, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x72,
+  0xa0, 0x82, 0x04, 0x97, 0x30, 0x82, 0x04, 0x93, 0x30, 0x82, 0x03, 0x7b, 0xa0, 0x03, 0x02, 0x01,
+  0x02, 0x02, 0x10, 0x47, 0x8a, 0x8e, 0xfb, 0x59, 0xe1, 0xd8, 0x3f, 0x0c, 0xe1, 0x42, 0xd2, 0xa2,
+  0x87, 0x07, 0xbe, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05,
+  0x05, 0x00, 0x30, 0x81, 0x95, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
+  0x55, 0x53, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x02, 0x55, 0x54, 0x31,
+  0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0e, 0x53, 0x61, 0x6c, 0x74, 0x20, 0x4c,
+  0x61, 0x6b, 0x65, 0x20, 0x43, 0x69, 0x74, 0x79, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04,
+  0x0a, 0x13, 0x15, 0x54, 0x68, 0x65, 0x20, 0x55, 0x53, 0x45, 0x52, 0x54, 0x52, 0x55, 0x53, 0x54,
+  0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04,
+  0x0b, 0x13, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x75, 0x73,
+  0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x31, 0x1d, 0x30, 0x1b, 0x06,
+  0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69,
+  0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30,
+  0x30, 0x35, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30,
+  0x35, 0x31, 0x30, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x7e, 0x31, 0x0b, 0x30, 0x09,
+  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55,
+  0x04, 0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63,
+  0x68, 0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13,
+  0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04,
+  0x0a, 0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d,
+  0x69, 0x74, 0x65, 0x64, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1b, 0x43,
+  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x54, 0x69, 0x6d, 0x65, 0x20, 0x53, 0x74, 0x61, 0x6d, 0x70,
+  0x69, 0x6e, 0x67, 0x20, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x72, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01,
+  0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xbc, 0x35, 0xa0, 0x36, 0x70,
+  0x22, 0x81, 0x11, 0xc3, 0xb2, 0x83, 0xb9, 0xd3, 0x28, 0xc6, 0x36, 0xcd, 0x25, 0x6b, 0xa9, 0x7b,
+  0xb2, 0x1c, 0xf6, 0x9b, 0x51, 0x9c, 0xef, 0x35, 0xf4, 0xed, 0x08, 0x8e, 0x5e, 0x38, 0x08, 0xf8,
+  0x77, 0x3c, 0x0a, 0x42, 0xe0, 0xf3, 0x70, 0xdc, 0xa3, 0xd7, 0xca, 0xf5, 0x4c, 0x0b, 0xcf, 0xff,
+  0x22, 0x9c, 0x0a, 0x7e, 0x68, 0xd6, 0x09, 0xa2, 0x2a, 0x84, 0x7b, 0xa6, 0x9d, 0xb4, 0xa9, 0xc1,
+  0x33, 0xe2, 0xef, 0x1f, 0x17, 0x48, 0xca, 0x3a, 0xcd, 0x46, 0xe6, 0xc5, 0xaa, 0x77, 0xbd, 0xe3,
+  0x77, 0x9a, 0xfa, 0x47, 0x53, 0x40, 0x28, 0x59, 0x43, 0x93, 0xf1, 0xa4, 0x81, 0xea, 0xef, 0x80,
+  0xb5, 0x4f, 0xa7, 0x08, 0xce, 0xba, 0x6e, 0xbc, 0xca, 0x76, 0x0c, 0x97, 0x64, 0x59, 0x86, 0x24,
+  0xbb, 0x3d, 0x82, 0x90, 0xa8, 0x55, 0xb1, 0x92, 0xd3, 0xa0, 0xa7, 0x05, 0xac, 0x9f, 0x53, 0x25,
+  0x08, 0x10, 0x47, 0x99, 0xcd, 0x98, 0xde, 0x68, 0xe5, 0xb4, 0x50, 0x78, 0xa3, 0xaf, 0x01, 0xcc,
+  0x59, 0x43, 0x58, 0xe4, 0x76, 0x6e, 0x7e, 0xac, 0xc7, 0xe2, 0x9e, 0x1f, 0x4f, 0xb0, 0x47, 0x2d,
+  0xc8, 0x0c, 0xa3, 0x49, 0x27, 0x80, 0x75, 0x8c, 0xbb, 0x06, 0x91, 0x65, 0x0f, 0x90, 0x9b, 0xf4,
+  0xba, 0xd1, 0x81, 0xc8, 0x5c, 0x6a, 0xec, 0x14, 0xe9, 0x25, 0x09, 0xbf, 0x23, 0x16, 0xf4, 0x95,
+  0x46, 0x40, 0x40, 0x21, 0xbb, 0x83, 0x96, 0xfd, 0x86, 0x1f, 0x7a, 0xc8, 0x0d, 0x10, 0x8e, 0xa2,
+  0xf8, 0x19, 0x07, 0x58, 0x7f, 0x9f, 0xbd, 0x37, 0x02, 0x60, 0xf2, 0xa4, 0xe9, 0x9d, 0x44, 0x3f,
+  0x30, 0x05, 0xe4, 0xa7, 0x70, 0x99, 0x51, 0x9a, 0xe8, 0x17, 0xf1, 0x55, 0xca, 0xb2, 0x61, 0x89,
+  0x65, 0x46, 0xa7, 0x6a, 0xf2, 0x58, 0x46, 0x7e, 0xaa, 0xa0, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01,
+  0xa3, 0x81, 0xf4, 0x30, 0x81, 0xf1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
+  0x16, 0x80, 0x14, 0xda, 0xed, 0x64, 0x74, 0x14, 0x9c, 0x14, 0x3c, 0xab, 0xdd, 0x99, 0xa9, 0xbd,
+  0x5b, 0x28, 0x4d, 0x8b, 0x3c, 0xc9, 0xd8, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16,
+  0x04, 0x14, 0x2e, 0x2d, 0xb0, 0x0a, 0x44, 0x4a, 0xd3, 0x87, 0xc0, 0x02, 0x07, 0xce, 0x97, 0x7d,
+  0x50, 0x62, 0x20, 0xfd, 0x0f, 0x83, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff,
+  0x04, 0x04, 0x03, 0x02, 0x06, 0xc0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
+  0x04, 0x02, 0x30, 0x00, 0x30, 0x16, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x01, 0x01, 0xff, 0x04, 0x0c,
+  0x30, 0x0a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08, 0x30, 0x42, 0x06, 0x03,
+  0x55, 0x1d, 0x1f, 0x04, 0x3b, 0x30, 0x39, 0x30, 0x37, 0xa0, 0x35, 0xa0, 0x33, 0x86, 0x31, 0x68,
+  0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72,
+  0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52,
+  0x46, 0x69, 0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x63, 0x72, 0x6c,
+  0x30, 0x35, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x29, 0x30, 0x27,
+  0x30, 0x25, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x19, 0x68, 0x74,
+  0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72,
+  0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+  0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xc8, 0xfb, 0x63, 0xf8, 0x0b,
+  0x75, 0x75, 0x2c, 0x3a, 0xf1, 0xf2, 0x13, 0xa7, 0x2d, 0xb6, 0xa3, 0x1a, 0x9c, 0xad, 0x01, 0x07,
+  0xd3, 0x34, 0x8e, 0x77, 0xe0, 0xc2, 0x6e, 0xae, 0x02, 0x5d, 0x48, 0x4f, 0xa4, 0xd2, 0x21, 0xb6,
+  0x36, 0xfd, 0x2a, 0x35, 0x43, 0x7c, 0x6b, 0xdf, 0x80, 0x87, 0x0b, 0x15, 0xf0, 0x76, 0x32, 0x00,
+  0xb4, 0xce, 0xb5, 0x67, 0xa4, 0x2f, 0x2f, 0x20, 0x1b, 0x9c, 0x54, 0x9e, 0x83, 0x3f, 0x1f, 0x5f,
+  0x14, 0x95, 0x62, 0x82, 0x0f, 0x22, 0x41, 0x22, 0x1f, 0x70, 0xb3, 0xf3, 0xf7, 0x42, 0xde, 0x6c,
+  0x51, 0xcd, 0x4b, 0xf8, 0x21, 0xac, 0x9b, 0x3b, 0x8c, 0xb1, 0xe5, 0xe6, 0x28, 0x8f, 0xce, 0x2a,
+  0x8a, 0xf9, 0xaa, 0x52, 0x4d, 0x8c, 0x5b, 0x77, 0xba, 0x4d, 0x5a, 0x58, 0xdb, 0xbb, 0x6a, 0x04,
+  0xcc, 0x52, 0x1e, 0x9d, 0xe2, 0x28, 0x37, 0x0e, 0xbb, 0xe7, 0x0e, 0x91, 0xc7, 0xf8, 0xdb, 0xf1,
+  0x81, 0x98, 0xeb, 0xcd, 0x37, 0xb3, 0x0e, 0xab, 0x65, 0xd3, 0x62, 0xec, 0x3a, 0xa5, 0x76, 0xeb,
+  0x13, 0xa8, 0x35, 0x93, 0xc9, 0x2e, 0x0a, 0x01, 0xec, 0xc0, 0xe8, 0xcc, 0x3d, 0x7e, 0xb6, 0xeb,
+  0xe2, 0xc1, 0xec, 0xd3, 0x14, 0x92, 0x82, 0x66, 0x87, 0x50, 0xdc, 0xfd, 0x50, 0x97, 0xac, 0xb3,
+  0x4a, 0x76, 0x73, 0x06, 0xc4, 0x86, 0x11, 0x3a, 0xb3, 0x5f, 0x43, 0x04, 0x52, 0x6f, 0xea, 0xb3,
+  0xd0, 0x74, 0x36, 0x4c, 0xca, 0xf1, 0x1b, 0x79, 0x84, 0x37, 0x70, 0x63, 0xad, 0x74, 0xb9, 0xaa,
+  0x0e, 0xf3, 0x98, 0xb0, 0x86, 0x08, 0xeb, 0xdb, 0xe0, 0x1f, 0x8c, 0x10, 0xf2, 0x39, 0x64, 0x9b,
+  0xae, 0x4f, 0x0a, 0x2c, 0x92, 0x8a, 0x4f, 0x18, 0xb5, 0x91, 0xe5, 0x8d, 0x1a, 0x93, 0x5f, 0x1f,
+  0xae, 0xf1, 0xa6, 0xf0, 0x2e, 0x97, 0xd0, 0xd2, 0xf6, 0x2b, 0x3c, 0x31, 0x82, 0x02, 0x61, 0x30,
+  0x82, 0x02, 0x5d, 0x02, 0x01, 0x01, 0x30, 0x81, 0xaa, 0x30, 0x81, 0x95, 0x31, 0x0b, 0x30, 0x09,
+  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
+  0x04, 0x08, 0x13, 0x02, 0x55, 0x54, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13,
+  0x0e, 0x53, 0x61, 0x6c, 0x74, 0x20, 0x4c, 0x61, 0x6b, 0x65, 0x20, 0x43, 0x69, 0x74, 0x79, 0x31,
+  0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x15, 0x54, 0x68, 0x65, 0x20, 0x55, 0x53,
+  0x45, 0x52, 0x54, 0x52, 0x55, 0x53, 0x54, 0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31,
+  0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
+  0x2f, 0x77, 0x77, 0x77, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x63,
+  0x6f, 0x6d, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x14, 0x55, 0x54, 0x4e,
+  0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69, 0x72, 0x73, 0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63,
+  0x74, 0x02, 0x10, 0x47, 0x8a, 0x8e, 0xfb, 0x59, 0xe1, 0xd8, 0x3f, 0x0c, 0xe1, 0x42, 0xd2, 0xa2,
+  0x87, 0x07, 0xbe, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0xa0, 0x81,
+  0x8c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x03, 0x31, 0x0d,
+  0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x10, 0x01, 0x04, 0x30, 0x1c, 0x06,
+  0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x05, 0x31, 0x0f, 0x17, 0x0d, 0x31, 0x34,
+  0x30, 0x37, 0x32, 0x38, 0x30, 0x38, 0x35, 0x30, 0x30, 0x33, 0x5a, 0x30, 0x23, 0x06, 0x09, 0x2a,
+  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x04, 0x31, 0x16, 0x04, 0x14, 0x7a, 0xad, 0x35, 0xdc,
+  0x5b, 0xd6, 0x00, 0xd7, 0x44, 0xac, 0x80, 0x8f, 0x4f, 0xb6, 0xb4, 0x03, 0x62, 0x34, 0x53, 0xdc,
+  0x30, 0x2b, 0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x10, 0x02, 0x0c, 0x31,
+  0x1c, 0x30, 0x1a, 0x30, 0x18, 0x30, 0x16, 0x04, 0x14, 0x3d, 0xbb, 0x6d, 0xb5, 0x08, 0x5c, 0x6d,
+  0xd5, 0xa1, 0xca, 0x7f, 0x9c, 0xf8, 0x4e, 0xcb, 0x1a, 0x39, 0x10, 0xca, 0xc8, 0x30, 0x0d, 0x06,
+  0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, 0x01, 0x00,
+  0x73, 0x64, 0xb9, 0xa3, 0x54, 0x6f, 0x50, 0x97, 0x01, 0xa7, 0xf6, 0x0d, 0xb8, 0xce, 0x4b, 0xaa,
+  0x43, 0xa2, 0x8f, 0xa3, 0xea, 0x93, 0xf2, 0xa3, 0xd0, 0x46, 0xde, 0xdd, 0x45, 0xe5, 0x94, 0x5a,
+  0x45, 0xc2, 0x13, 0x1b, 0x90, 0x9b, 0xcf, 0x73, 0xcd, 0x28, 0x70, 0xf0, 0xf4, 0x54, 0xb5, 0x2d,
+  0x31, 0xf9, 0xf3, 0x2d, 0x38, 0x78, 0xfe, 0x68, 0xea, 0x3c, 0xc0, 0xbe, 0x0b, 0x5a, 0x91, 0x49,
+  0x63, 0xeb, 0x26, 0x32, 0x5b, 0x86, 0xcf, 0xe5, 0x8a, 0xa5, 0x9d, 0xe6, 0x4b, 0x57, 0x91, 0x8f,
+  0x3c, 0xdc, 0xa6, 0x53, 0xd8, 0xdb, 0x8a, 0xfd, 0x3e, 0x7e, 0x19, 0x6f, 0x27, 0x72, 0x95, 0xc2,
+  0x79, 0x73, 0xdf, 0xfb, 0x08, 0x5c, 0x5b, 0xc8, 0xb7, 0x94, 0x75, 0x88, 0x7a, 0x9a, 0x85, 0x9f,
+  0x1b, 0xa3, 0x98, 0x30, 0x91, 0xee, 0xc0, 0x52, 0xd2, 0x75, 0x9c, 0xcb, 0x45, 0x0d, 0x94, 0x43,
+  0x67, 0x7a, 0x49, 0x1c, 0xb1, 0x89, 0x9d, 0x6e, 0xfa, 0x87, 0xd2, 0x4d, 0x6e, 0x74, 0x90, 0xf5,
+  0x80, 0x8c, 0x92, 0xda, 0xd9, 0xa1, 0x48, 0x20, 0x31, 0x02, 0x79, 0xde, 0xe3, 0xbd, 0x09, 0x04,
+  0xa8, 0xd4, 0x99, 0xd7, 0x3b, 0xea, 0xf8, 0xdf, 0xb3, 0xb9, 0xd7, 0xa3, 0x36, 0xa1, 0xdb, 0xd3,
+  0xec, 0x65, 0x8c, 0xb8, 0x8f, 0xfb, 0xd6, 0xef, 0x9c, 0x32, 0x3e, 0xab, 0x20, 0x74, 0xb9, 0x65,
+  0x4c, 0xc6, 0x15, 0x2f, 0x31, 0x2a, 0x34, 0x3e, 0x84, 0x09, 0xb4, 0x75, 0xbc, 0xbe, 0xaf, 0xb3,
+  0x9e, 0x85, 0xf1, 0xbb, 0x99, 0x1a, 0x07, 0xbd, 0x20, 0xa6, 0xed, 0xcf, 0xd1, 0xa6, 0x9a, 0x22,
+  0xb2, 0x6d, 0x75, 0xf4, 0x23, 0x58, 0x13, 0x78, 0x73, 0x1a, 0xb2, 0x84, 0xde, 0xad, 0xe8, 0x6d,
+  0xe6, 0xe7, 0x5c, 0xb6, 0xe6, 0x5b, 0x10, 0x37, 0x1f, 0xe3, 0x6e, 0xbd, 0x83, 0xd7, 0x51, 0xb1,
+  0x00, 0x00, 0x00, 0x00, 0x0a
+  };
+
+//
+// The Comodo Time Stamping Signer Certificate Used for the verification of TimeStamp signature.
+//
+GLOBAL_REMOVE_IF_UNREFERENCED UINT8 TSTrustedCert[] = {
+  0x30, 0x82, 0x04, 0x93, 0x30, 0x82, 0x03, 0x7b, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x47,
+  0x8a, 0x8e, 0xfb, 0x59, 0xe1, 0xd8, 0x3f, 0x0c, 0xe1, 0x42, 0xd2, 0xa2, 0x87, 0x07, 0xbe, 0x30,
+  0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x81,
+  0x95, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0b,
+  0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x02, 0x55, 0x54, 0x31, 0x17, 0x30, 0x15, 0x06,
+  0x03, 0x55, 0x04, 0x07, 0x13, 0x0e, 0x53, 0x61, 0x6c, 0x74, 0x20, 0x4c, 0x61, 0x6b, 0x65, 0x20,
+  0x43, 0x69, 0x74, 0x79, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x15, 0x54,
+  0x68, 0x65, 0x20, 0x55, 0x53, 0x45, 0x52, 0x54, 0x52, 0x55, 0x53, 0x54, 0x20, 0x4e, 0x65, 0x74,
+  0x77, 0x6f, 0x72, 0x6b, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x18, 0x68,
+  0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72,
+  0x75, 0x73, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x03,
+  0x13, 0x14, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69, 0x72, 0x73, 0x74, 0x2d,
+  0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30, 0x30, 0x35, 0x31, 0x30,
+  0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x35, 0x31, 0x30, 0x32,
+  0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x7e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+  0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12,
+  0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74,
+  0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c,
+  0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43,
+  0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64,
+  0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1b, 0x43, 0x4f, 0x4d, 0x4f, 0x44,
+  0x4f, 0x20, 0x54, 0x69, 0x6d, 0x65, 0x20, 0x53, 0x74, 0x61, 0x6d, 0x70, 0x69, 0x6e, 0x67, 0x20,
+  0x53, 0x69, 0x67, 0x6e, 0x65, 0x72, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
+  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
+  0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xbc, 0x35, 0xa0, 0x36, 0x70, 0x22, 0x81, 0x11, 0xc3,
+  0xb2, 0x83, 0xb9, 0xd3, 0x28, 0xc6, 0x36, 0xcd, 0x25, 0x6b, 0xa9, 0x7b, 0xb2, 0x1c, 0xf6, 0x9b,
+  0x51, 0x9c, 0xef, 0x35, 0xf4, 0xed, 0x08, 0x8e, 0x5e, 0x38, 0x08, 0xf8, 0x77, 0x3c, 0x0a, 0x42,
+  0xe0, 0xf3, 0x70, 0xdc, 0xa3, 0xd7, 0xca, 0xf5, 0x4c, 0x0b, 0xcf, 0xff, 0x22, 0x9c, 0x0a, 0x7e,
+  0x68, 0xd6, 0x09, 0xa2, 0x2a, 0x84, 0x7b, 0xa6, 0x9d, 0xb4, 0xa9, 0xc1, 0x33, 0xe2, 0xef, 0x1f,
+  0x17, 0x48, 0xca, 0x3a, 0xcd, 0x46, 0xe6, 0xc5, 0xaa, 0x77, 0xbd, 0xe3, 0x77, 0x9a, 0xfa, 0x47,
+  0x53, 0x40, 0x28, 0x59, 0x43, 0x93, 0xf1, 0xa4, 0x81, 0xea, 0xef, 0x80, 0xb5, 0x4f, 0xa7, 0x08,
+  0xce, 0xba, 0x6e, 0xbc, 0xca, 0x76, 0x0c, 0x97, 0x64, 0x59, 0x86, 0x24, 0xbb, 0x3d, 0x82, 0x90,
+  0xa8, 0x55, 0xb1, 0x92, 0xd3, 0xa0, 0xa7, 0x05, 0xac, 0x9f, 0x53, 0x25, 0x08, 0x10, 0x47, 0x99,
+  0xcd, 0x98, 0xde, 0x68, 0xe5, 0xb4, 0x50, 0x78, 0xa3, 0xaf, 0x01, 0xcc, 0x59, 0x43, 0x58, 0xe4,
+  0x76, 0x6e, 0x7e, 0xac, 0xc7, 0xe2, 0x9e, 0x1f, 0x4f, 0xb0, 0x47, 0x2d, 0xc8, 0x0c, 0xa3, 0x49,
+  0x27, 0x80, 0x75, 0x8c, 0xbb, 0x06, 0x91, 0x65, 0x0f, 0x90, 0x9b, 0xf4, 0xba, 0xd1, 0x81, 0xc8,
+  0x5c, 0x6a, 0xec, 0x14, 0xe9, 0x25, 0x09, 0xbf, 0x23, 0x16, 0xf4, 0x95, 0x46, 0x40, 0x40, 0x21,
+  0xbb, 0x83, 0x96, 0xfd, 0x86, 0x1f, 0x7a, 0xc8, 0x0d, 0x10, 0x8e, 0xa2, 0xf8, 0x19, 0x07, 0x58,
+  0x7f, 0x9f, 0xbd, 0x37, 0x02, 0x60, 0xf2, 0xa4, 0xe9, 0x9d, 0x44, 0x3f, 0x30, 0x05, 0xe4, 0xa7,
+  0x70, 0x99, 0x51, 0x9a, 0xe8, 0x17, 0xf1, 0x55, 0xca, 0xb2, 0x61, 0x89, 0x65, 0x46, 0xa7, 0x6a,
+  0xf2, 0x58, 0x46, 0x7e, 0xaa, 0xa0, 0x07, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xf4, 0x30,
+  0x81, 0xf1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xda,
+  0xed, 0x64, 0x74, 0x14, 0x9c, 0x14, 0x3c, 0xab, 0xdd, 0x99, 0xa9, 0xbd, 0x5b, 0x28, 0x4d, 0x8b,
+  0x3c, 0xc9, 0xd8, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x2e, 0x2d,
+  0xb0, 0x0a, 0x44, 0x4a, 0xd3, 0x87, 0xc0, 0x02, 0x07, 0xce, 0x97, 0x7d, 0x50, 0x62, 0x20, 0xfd,
+  0x0f, 0x83, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02,
+  0x06, 0xc0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00,
+  0x30, 0x16, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x01, 0x01, 0xff, 0x04, 0x0c, 0x30, 0x0a, 0x06, 0x08,
+  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08, 0x30, 0x42, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04,
+  0x3b, 0x30, 0x39, 0x30, 0x37, 0xa0, 0x35, 0xa0, 0x33, 0x86, 0x31, 0x68, 0x74, 0x74, 0x70, 0x3a,
+  0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+  0x63, 0x6f, 0x6d, 0x2f, 0x55, 0x54, 0x4e, 0x2d, 0x55, 0x53, 0x45, 0x52, 0x46, 0x69, 0x72, 0x73,
+  0x74, 0x2d, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x35, 0x06, 0x08,
+  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0x06, 0x08,
+  0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x19, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
+  0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e,
+  0x63, 0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05,
+  0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xc8, 0xfb, 0x63, 0xf8, 0x0b, 0x75, 0x75, 0x2c, 0x3a,
+  0xf1, 0xf2, 0x13, 0xa7, 0x2d, 0xb6, 0xa3, 0x1a, 0x9c, 0xad, 0x01, 0x07, 0xd3, 0x34, 0x8e, 0x77,
+  0xe0, 0xc2, 0x6e, 0xae, 0x02, 0x5d, 0x48, 0x4f, 0xa4, 0xd2, 0x21, 0xb6, 0x36, 0xfd, 0x2a, 0x35,
+  0x43, 0x7c, 0x6b, 0xdf, 0x80, 0x87, 0x0b, 0x15, 0xf0, 0x76, 0x32, 0x00, 0xb4, 0xce, 0xb5, 0x67,
+  0xa4, 0x2f, 0x2f, 0x20, 0x1b, 0x9c, 0x54, 0x9e, 0x83, 0x3f, 0x1f, 0x5f, 0x14, 0x95, 0x62, 0x82,
+  0x0f, 0x22, 0x41, 0x22, 0x1f, 0x70, 0xb3, 0xf3, 0xf7, 0x42, 0xde, 0x6c, 0x51, 0xcd, 0x4b, 0xf8,
+  0x21, 0xac, 0x9b, 0x3b, 0x8c, 0xb1, 0xe5, 0xe6, 0x28, 0x8f, 0xce, 0x2a, 0x8a, 0xf9, 0xaa, 0x52,
+  0x4d, 0x8c, 0x5b, 0x77, 0xba, 0x4d, 0x5a, 0x58, 0xdb, 0xbb, 0x6a, 0x04, 0xcc, 0x52, 0x1e, 0x9d,
+  0xe2, 0x28, 0x37, 0x0e, 0xbb, 0xe7, 0x0e, 0x91, 0xc7, 0xf8, 0xdb, 0xf1, 0x81, 0x98, 0xeb, 0xcd,
+  0x37, 0xb3, 0x0e, 0xab, 0x65, 0xd3, 0x62, 0xec, 0x3a, 0xa5, 0x76, 0xeb, 0x13, 0xa8, 0x35, 0x93,
+  0xc9, 0x2e, 0x0a, 0x01, 0xec, 0xc0, 0xe8, 0xcc, 0x3d, 0x7e, 0xb6, 0xeb, 0xe2, 0xc1, 0xec, 0xd3,
+  0x14, 0x92, 0x82, 0x66, 0x87, 0x50, 0xdc, 0xfd, 0x50, 0x97, 0xac, 0xb3, 0x4a, 0x76, 0x73, 0x06,
+  0xc4, 0x86, 0x11, 0x3a, 0xb3, 0x5f, 0x43, 0x04, 0x52, 0x6f, 0xea, 0xb3, 0xd0, 0x74, 0x36, 0x4c,
+  0xca, 0xf1, 0x1b, 0x79, 0x84, 0x37, 0x70, 0x63, 0xad, 0x74, 0xb9, 0xaa, 0x0e, 0xf3, 0x98, 0xb0,
+  0x86, 0x08, 0xeb, 0xdb, 0xe0, 0x1f, 0x8c, 0x10, 0xf2, 0x39, 0x64, 0x9b, 0xae, 0x4f, 0x0a, 0x2c,
+  0x92, 0x8a, 0x4f, 0x18, 0xb5, 0x91, 0xe5, 0x8d, 0x1a, 0x93, 0x5f, 0x1f, 0xae, 0xf1, 0xa6, 0xf0,
+  0x2e, 0x97, 0xd0, 0xd2, 0xf6, 0x2b, 0x3c, 0x0a
+  };
+
+/**
+  Validate MSFT Authenticode & Timestamping CounterSignature.
+
+  @retval  TRUE  Validation succeeded.
+  @retval  FALSE Validation failed.
+
+**/
+BOOLEAN
+VerifyTSCounterSignature (
+  VOID
+  )
+{
+  BOOLEAN   Status;
+  EFI_TIME  SigningTime;
+
+  Status = FALSE;
+
+  Print (L"\n- Verify RFC3161 TimeStamp CounterSignature in PE/COFF Authenticode ... ");
+  //
+  // Verify RFC3161 Timestamp CounterSignature.
+  //
+  Status = ImageTimestampVerify (
+             AuthenticodeWithTS,
+             sizeof (AuthenticodeWithTS),
+             TSTrustedCert,
+             sizeof (TSTrustedCert),
+             &SigningTime
+             );
+  if (Status) {
+    Print (L"[Pass]\n");
+    Print (L" --> The PE/COFF was signed at <%t>", &SigningTime);
+  } else {
+    Print (L"[Fail]");
+  }
+
+  return Status;
+}
+
+/**
+  Validate UEFI-OpenSSL RFC3161 Timestamp CounterSignature Verification Interfaces.
+
+  @retval  EFI_SUCCESS  Validation succeeded.
+  @retval  EFI_ABORTED  Validation failed.
+
+**/
+EFI_STATUS
+ValidateTSCounterSignature (
+  VOID
+  )
+{
+  BOOLEAN Status;
+
+  Print (L"\nUEFI-OpenSSL RFC3161 Timestamp Signature Testing: ");
+
+  Status = VerifyTSCounterSignature ();
+
+  Print (L"\n");
+
+  if (Status) {
+    return EFI_SUCCESS;
+  } else {
+    return EFI_ABORTED;
+  }
+}
diff --git a/CryptoPkg/Contributions.txt b/CryptoPkg/Contributions.txt
index 5dd8a47..f87cbd7 100644
--- a/CryptoPkg/Contributions.txt
+++ b/CryptoPkg/Contributions.txt
@@ -34,9 +34,9 @@
    Contributions using other licenses might be accepted, but further
    review will be required.
 
-=======================================
-= Change Description / Commit Message =
-=======================================
+=====================================================
+= Change Description / Commit Message / Patch Email =
+=====================================================
 
 Your change description should use the standard format for a
 commit message, and must include your "Signed-off-by" signature
@@ -44,7 +44,32 @@
 
 == Sample Change Description / Commit Message =
 
-=== Definitions for sample change description ===
+=== Start of sample patch email message ===
+
+From: Contributor Name <contributor@example.com>
+Subject: [PATCH] CodeModule: Brief-single-line-summary
+
+Full-commit-message
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Contributor Name <contributor@example.com>
+---
+
+An extra message for the patch email which will not be considered part
+of the commit message can be added here.
+
+Patch content inline or attached
+
+=== End of sample patch email message ===
+
+=== Notes for sample patch email ===
+
+* The first line of commit message is taken from the email's subject
+  line following [PATCH]. The remaining portion of the commit message
+  is the email's content until the '---' line.
+* git format-patch is one way to create this format
+
+=== Definitions for sample patch email ===
 
 * "CodeModule" is a short idenfier for the affected code.  For
   example MdePkg, or MdeModulePkg UsbBusDxe.
@@ -58,15 +83,6 @@
 * "Signed-off-by" is the contributor's signature identifying them
   by their real/legal name and their email address.
 
-=== Start of sample change description / commit message ===
-CodeModule: Brief-single-line-summary
-
-Full-commit-message
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Contributor Name <contributor@email.server>
-=== End of sample change description / commit message ===
-
 ========================================
 = TianoCore Contribution Agreement 1.0 =
 ========================================
diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec
index 29b46d0..1f1fa1a 100644
--- a/CryptoPkg/CryptoPkg.dec
+++ b/CryptoPkg/CryptoPkg.dec
@@ -4,7 +4,7 @@
 #  This Package provides cryptographic-related libraries for UEFI security modules.
 #  It also provides a test application to test libraries.
 #
-#  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+#  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
@@ -19,7 +19,7 @@
   DEC_SPECIFICATION              = 0x00010005
   PACKAGE_NAME                   = CryptoPkg
   PACKAGE_GUID                   = 36470E80-36F2-4ba0-8CC8-937C7D9FF888
-  PACKAGE_VERSION                = 0.94
+  PACKAGE_VERSION                = 0.96
 
 [Includes]
   Include
diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 11465a3..19a0fbc 100644
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -1,7 +1,7 @@
 ## @file
 #  Cryptographic Library Package for UEFI Security Implementation.
 #
-#  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+#  Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
@@ -20,7 +20,7 @@
 [Defines]
   PLATFORM_NAME                  = CryptoPkg
   PLATFORM_GUID                  = E1063286-6C8C-4c25-AEF0-67A9A5B6E6B6
-  PLATFORM_VERSION               = 0.94
+  PLATFORM_VERSION               = 0.96
   DSC_SPECIFICATION              = 0x00010005
   OUTPUT_DIRECTORY               = Build/CryptoPkg
   SUPPORTED_ARCHITECTURES        = IA32|X64|IPF|ARM|AARCH64
diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 504f405..95b75c9 100644
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -4,7 +4,7 @@
   primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security
   functionality enabling.
 
-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -18,6 +18,8 @@
 #ifndef __BASE_CRYPT_LIB_H__
 #define __BASE_CRYPT_LIB_H__
 
+#include <Uefi/UefiBaseType.h>
+
 ///
 /// MD4 digest size in bytes
 ///
@@ -39,6 +41,16 @@
 #define SHA256_DIGEST_SIZE  32
 
 ///
+/// SHA-384 digest size in bytes
+///
+#define SHA384_DIGEST_SIZE  48
+
+///
+/// SHA-512 digest size in bytes
+///
+#define SHA512_DIGEST_SIZE  64
+
+///
 /// TDES block size in bytes
 ///
 #define TDES_BLOCK_SIZE     8
@@ -513,6 +525,215 @@
   OUT     UINT8  *HashValue
   );
 
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha384GetContextSize (
+  VOID
+  );
+
+/**
+  Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+  subsequent use.
+
+  If Sha384Context is NULL, then return FALSE.
+
+  @param[out]  Sha384Context  Pointer to SHA-384 context being initialized.
+
+  @retval TRUE   SHA-384 context initialization succeeded.
+  @retval FALSE  SHA-384 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Init (
+  OUT  VOID  *Sha384Context
+  );
+
+/**
+  Makes a copy of an existing SHA-384 context.
+
+  If Sha384Context is NULL, then return FALSE.
+  If NewSha384Context is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  Sha384Context     Pointer to SHA-384 context being copied.
+  @param[out] NewSha384Context  Pointer to new SHA-384 context.
+
+  @retval TRUE   SHA-384 context copy succeeded.
+  @retval FALSE  SHA-384 context copy failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Duplicate (
+  IN   CONST VOID  *Sha384Context,
+  OUT  VOID        *NewSha384Context
+  );
+
+/**
+  Digests the input data and updates SHA-384 context.
+
+  This function performs SHA-384 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-384 context should be already correctly intialized by Sha384Init(), and should not be finalized
+  by Sha384Final(). Behavior with invalid context is undefined.
+
+  If Sha384Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-384 data digest succeeded.
+  @retval FALSE  SHA-384 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Update (
+  IN OUT  VOID        *Sha384Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  );
+
+/**
+  Completes computation of the SHA-384 digest value.
+
+  This function completes SHA-384 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-384 context cannot
+  be used again.
+  SHA-384 context should be already correctly intialized by Sha384Init(), and should not be
+  finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
+
+  If Sha384Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-384 digest
+                                  value (48 bytes).
+
+  @retval TRUE   SHA-384 digest computation succeeded.
+  @retval FALSE  SHA-384 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Final (
+  IN OUT  VOID   *Sha384Context,
+  OUT     UINT8  *HashValue
+  );
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha512GetContextSize (
+  VOID
+  );
+
+/**
+  Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+  subsequent use.
+
+  If Sha512Context is NULL, then return FALSE.
+
+  @param[out]  Sha512Context  Pointer to SHA-512 context being initialized.
+
+  @retval TRUE   SHA-512 context initialization succeeded.
+  @retval FALSE  SHA-512 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Init (
+  OUT  VOID  *Sha512Context
+  );
+
+/**
+  Makes a copy of an existing SHA-512 context.
+
+  If Sha512Context is NULL, then return FALSE.
+  If NewSha512Context is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  Sha512Context     Pointer to SHA-512 context being copied.
+  @param[out] NewSha512Context  Pointer to new SHA-512 context.
+
+  @retval TRUE   SHA-512 context copy succeeded.
+  @retval FALSE  SHA-512 context copy failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Duplicate (
+  IN   CONST VOID  *Sha512Context,
+  OUT  VOID        *NewSha512Context
+  );
+
+/**
+  Digests the input data and updates SHA-512 context.
+
+  This function performs SHA-512 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-512 context should be already correctly intialized by Sha512Init(), and should not be finalized
+  by Sha512Final(). Behavior with invalid context is undefined.
+
+  If Sha512Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-512 data digest succeeded.
+  @retval FALSE  SHA-512 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Update (
+  IN OUT  VOID        *Sha512Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  );
+
+/**
+  Completes computation of the SHA-512 digest value.
+
+  This function completes SHA-512 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-512 context cannot
+  be used again.
+  SHA-512 context should be already correctly intialized by Sha512Init(), and should not be
+  finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
+
+  If Sha512Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-512 digest
+                                  value (64 bytes).
+
+  @retval TRUE   SHA-512 digest computation succeeded.
+  @retval FALSE  SHA-512 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Final (
+  IN OUT  VOID   *Sha512Context,
+  OUT     UINT8  *HashValue
+  );
 
 //=====================================================================================
 //    MAC (Message Authentication Code) Primitive
@@ -754,7 +975,6 @@
   OUT     UINT8  *HmacValue
   );
 
-
 //=====================================================================================
 //    Symmetric Cryptography Primitive
 //=====================================================================================
@@ -1395,7 +1615,7 @@
   @param[in, out]  RsaContext           Pointer to RSA context being set.
   @param[in]       ModulusLength        Length of RSA modulus N in bits.
   @param[in]       PublicExponent       Pointer to RSA public exponent.
-  @param[in]       PublicExponentSize   Size of RSA public exponent buffer in bytes. 
+  @param[in]       PublicExponentSize   Size of RSA public exponent buffer in bytes.
 
   @retval  TRUE   RSA key component was generated successfully.
   @retval  FALSE  Invalid RSA key component tag.
@@ -1413,6 +1633,8 @@
 
 /**
   Validates key components of RSA context.
+  NOTE: This function performs integrity checks on all the RSA key material, so
+        the RSA key structure must contain all the private key data.
 
   This function validates key compoents of RSA context in following aspects:
   - Whether p is a prime
@@ -1519,7 +1741,6 @@
   @retval  TRUE   RSA Private Key was retrieved successfully.
   @retval  FALSE  Invalid PEM key data or incorrect password.
   @retval  FALSE  This interface is not supported.
-  
 
 **/
 BOOLEAN
@@ -1642,13 +1863,13 @@
   If X509Stack is NULL, then return FALSE.
   If this interface is not supported, then return FALSE.
 
-  @param[in, out]  X509Stack  On input, pointer to an existing X509 stack object.
+  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
                               On output, pointer to the X509 stack object with new
                               inserted X509 certificate.
   @param           ...        A list of DER-encoded single certificate data followed
                               by certificate size. A NULL terminates the list. The
                               pairs are the arguments to X509ConstructCertificate().
-                                 
+
   @retval     TRUE            The X509 stack construction succeeded.
   @retval     FALSE           The construction operation failed.
   @retval     FALSE           This interface is not supported.
@@ -1658,7 +1879,7 @@
 EFIAPI
 X509ConstructCertificateStack (
   IN OUT  UINT8  **X509Stack,
-  ...  
+  ...
   );
 
 /**
@@ -1690,6 +1911,32 @@
   );
 
 /**
+  Retrieve the TBSCertificate from one given X.509 certificate.
+
+  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
+  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
+
+  If Cert is NULL, then return FALSE.
+  If TBSCert is NULL, then return FALSE.
+  If TBSCertSize is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @retval  TRUE   The TBSCertificate was retrieved successfully.
+  @retval  FALSE  Invalid X.509 certificate.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetTBSCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  OUT UINT8        **TBSCert,
+  OUT UINTN        *TBSCertSize
+  );
+
+/**
   Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
   Cryptographic Message Syntax Standard". The input signed data could be wrapped
   in a ContentInfo structure.
@@ -1811,6 +2058,35 @@
   );
 
 /**
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+  data could be wrapped in a ContentInfo structure.
+
+  If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
+  then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.
+
+  Caution: This function may receive untrusted input. So this function will do
+           basic check for PKCS#7 data structure.
+
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
+                            It's caller's responsiblity to free the buffer.
+  @param[out]  ContentSize  The size of the extracted content in bytes.
+
+  @retval     TRUE          The P7Data was correctly formatted for processing.
+  @retval     FALSE         The P7Data was not correctly formatted for processing.
+
+*/
+BOOLEAN
+EFIAPI
+Pkcs7GetAttachedContent (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT VOID         **Content,
+  OUT UINTN        *ContentSize
+  );
+
+/**
   Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows
   Authenticode Portable Executable Signature Format".
 
@@ -1845,6 +2121,36 @@
   IN  UINTN        HashSize
   );
 
+/**
+  Verifies the validility of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+  signature.
+
+  If AuthData is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed
+                           PE/COFF image to be verified.
+  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
+  @param[in]  TsaCert      Pointer to a trusted/root TSA certificate encoded in DER, which
+                           is used for TSA certificate chain verification.
+  @param[in]  CertSize     Size of the trusted certificate in bytes.
+  @param[out] SigningTime  Return the time of timestamp generation time if the timestamp
+                           signature is valid.
+
+  @retval  TRUE   The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
+  @retval  FALSE  No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
+
+**/
+BOOLEAN
+EFIAPI
+ImageTimestampVerify (
+  IN  CONST UINT8  *AuthData,
+  IN  UINTN        DataSize,
+  IN  CONST UINT8  *TsaCert,
+  IN  UINTN        CertSize,
+  OUT EFI_TIME     *SigningTime
+  );
+
 //=====================================================================================
 //    DH Key Exchange Primitive
 //=====================================================================================
@@ -1882,7 +2188,7 @@
 
   Given generator g, and length of prime number p in bits, this function generates p,
   and sets DH context according to value of g and p.
-  
+
   Before this function can be invoked, pseudorandom number generator must be correctly
   initialized by RandomSeed().
 
@@ -1945,7 +2251,7 @@
 /**
   Generates DH public key.
 
-  This function generates random secret exponent, and computes the public key, which is 
+  This function generates random secret exponent, and computes the public key, which is
   returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
   If the PublicKey buffer is too small to hold the public key, FALSE is returned and
   PublicKeySize is set to the required buffer size to obtain the public key.
diff --git a/CryptoPkg/Include/OpenSslSupport.h b/CryptoPkg/Include/OpenSslSupport.h
index 33eda7d..b5a8b58 100644
--- a/CryptoPkg/Include/OpenSslSupport.h
+++ b/CryptoPkg/Include/OpenSslSupport.h
@@ -1,7 +1,7 @@
 /** @file
   Root include file to support building OpenSSL Crypto Library.
 
-Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -72,7 +72,7 @@
    portably, hence it is provided by a Standard C header file.
    For pre-Standard C compilers, here is a version that usually works
    (but watch out!): */
-#define offsetof(type, member) ( (int) & ((type*)0) -> member )
+#define offsetof(type, member) OFFSET_OF (type, member)
 
 //
 // Basic types from EFI Application Toolkit required to buiild Open SSL
@@ -109,6 +109,11 @@
   char  *tm_zone;   /* timezone abbreviation */
 };
 
+struct timeval {
+  long tv_sec;      /* time value, in seconds */
+  long tv_usec;     /* time value, in microseconds */
+} timeval;
+
 struct dirent {
   UINT32  d_fileno;         /* file number of entry */
   UINT16  d_reclen;         /* length of this record */
@@ -240,5 +245,6 @@
 #define assert(expression)
 #define localtime(timer)                  NULL
 #define gmtime_r(timer,result)            (result = NULL)
+#define atoi(nptr)                        AsciiStrDecimalToUintn(nptr)
 
 #endif
diff --git a/CryptoPkg/Include/memory.h b/CryptoPkg/Include/memory.h
new file mode 100644
index 0000000..092b3cd
--- /dev/null
+++ b/CryptoPkg/Include/memory.h
@@ -0,0 +1,16 @@
+/** @file
+  Include file to support building OpenSSL Crypto Library.
+
+Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <OpenSslSupport.h>
+
diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index 08e9c24..151797a 100644
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -3,7 +3,7 @@
 #
 #  Caution: This module requires additional review when modified.
 #  This library will have external input - signature.
-#  This external input must be validated carefully to avoid security issues such as 
+#  This external input must be validated carefully to avoid security issues such as
 #  buffer overflow or integer overflow.
 #
 #  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
@@ -11,10 +11,10 @@
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -37,6 +37,7 @@
   Hash/CryptMd5.c
   Hash/CryptSha1.c
   Hash/CryptSha256.c
+  Hash/CryptSha512.c
   Hmac/CryptHmacMd5.c
   Hmac/CryptHmacSha1.c
   Cipher/CryptAes.c
@@ -49,6 +50,7 @@
   Pk/CryptDh.c
   Pk/CryptX509.c
   Pk/CryptAuthenticode.c
+  Pk/CryptTs.c
   Pem/CryptPem.c
 
   SysCall/CrtWrapper.c
@@ -56,24 +58,6 @@
   SysCall/BaseMemAllocation.c
 
 [Sources.Ia32]
-  SysCall/Ia32/MathMultS64x64.c     | MSFT
-  SysCall/Ia32/MathDivU64x64.c      | MSFT
-  SysCall/Ia32/MathReminderU64x64.c | MSFT
-  SysCall/Ia32/MathLShiftS64.c      | MSFT
-  SysCall/Ia32/MathRShiftU64.c      | MSFT
-
-  SysCall/Ia32/MathMultS64x64.c     | INTEL
-  SysCall/Ia32/MathDivU64x64.c      | INTEL
-  SysCall/Ia32/MathReminderU64x64.c | INTEL
-  SysCall/Ia32/MathLShiftS64.c      | INTEL
-  SysCall/Ia32/MathRShiftU64.c      | INTEL
-
-  SysCall/Ia32/MathMultS64x64.S     | GCC
-  SysCall/Ia32/MathDivU64x64.S      | GCC
-  SysCall/Ia32/MathReminderU64x64.S | GCC
-  SysCall/Ia32/MathLShiftS64.S      | GCC
-  SysCall/Ia32/MathRShiftU64.S      | GCC
-
   Rand/CryptRandTsc.c
 
 [Sources.X64]
@@ -106,4 +90,7 @@
 # Remove these [BuildOptions] after this library is cleaned up
 #
 [BuildOptions]
+  # suppress the following warnings so we do not break the build with warnings-as-errors:
+  #   C4305: truncation from type1 to type2 (Introduced by RFC3161 Timestamp ASN.1 declarations)
+  MSFT:*_*_*_CC_FLAGS = /wd4305
   GCC:*_GCC44_IA32_CC_FLAGS = "-D__cdecl=__attribute__((cdecl))" "-D__declspec(t)=__attribute__((t))"
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c
index dcf7691..e1c10e3 100644
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c
@@ -56,7 +56,7 @@
   //
   // Check input parameters.
   //
-  if ((Md5Context == NULL)) {
+  if (Md5Context == NULL) {
     return FALSE;
   }
 
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c
new file mode 100644
index 0000000..491f45d
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c
@@ -0,0 +1,354 @@
+/** @file
+  SHA-384 and SHA-512 Digest Wrapper Implementations over OpenSSL.
+
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "InternalCryptLib.h"
+#include <openssl/sha.h>
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha384GetContextSize (
+  VOID
+  )
+{
+  //
+  // Retrieves OpenSSL SHA-384 Context Size
+  //
+  return (UINTN) (sizeof (SHA512_CTX));
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+  subsequent use.
+
+  If Sha384Context is NULL, then return FALSE.
+
+  @param[out]  Sha384Context  Pointer to SHA-384 context being initialized.
+
+  @retval TRUE   SHA-384 context initialization succeeded.
+  @retval FALSE  SHA-384 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Init (
+  OUT  VOID  *Sha384Context
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha384Context == NULL) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-384 Context Initialization
+  //
+  return (BOOLEAN) (SHA384_Init ((SHA512_CTX *) Sha384Context));
+}
+
+/**
+  Makes a copy of an existing SHA-384 context.
+
+  If Sha384Context is NULL, then return FALSE.
+  If NewSha384Context is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  Sha384Context     Pointer to SHA-384 context being copied.
+  @param[out] NewSha384Context  Pointer to new SHA-384 context.
+
+  @retval TRUE   SHA-384 context copy succeeded.
+  @retval FALSE  SHA-384 context copy failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Duplicate (
+  IN   CONST VOID  *Sha384Context,
+  OUT  VOID        *NewSha384Context
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha384Context == NULL || NewSha384Context == NULL) {
+    return FALSE;
+  }
+
+  CopyMem (NewSha384Context, Sha384Context, sizeof (SHA512_CTX));
+
+  return TRUE;
+}
+
+/**
+  Digests the input data and updates SHA-384 context.
+
+  This function performs SHA-384 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-384 context should be already correctly intialized by Sha384Init(), and should not be finalized
+  by Sha384Final(). Behavior with invalid context is undefined.
+
+  If Sha384Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-384 data digest succeeded.
+  @retval FALSE  SHA-384 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Update (
+  IN OUT  VOID        *Sha384Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha384Context == NULL) {
+    return FALSE;
+  }
+
+  //
+  // Check invalid parameters, in case that only DataLength was checked in OpenSSL
+  //
+  if (Data == NULL && DataSize != 0) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-384 Hash Update
+  //
+  return (BOOLEAN) (SHA384_Update ((SHA512_CTX *) Sha384Context, Data, DataSize));
+}
+
+/**
+  Completes computation of the SHA-384 digest value.
+
+  This function completes SHA-384 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-384 context cannot
+  be used again.
+  SHA-384 context should be already correctly intialized by Sha384Init(), and should not be
+  finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
+
+  If Sha384Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-384 digest
+                                  value (48 bytes).
+
+  @retval TRUE   SHA-384 digest computation succeeded.
+  @retval FALSE  SHA-384 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Final (
+  IN OUT  VOID   *Sha384Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha384Context == NULL || HashValue == NULL) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-384 Hash Finalization
+  //
+  return (BOOLEAN) (SHA384_Final (HashValue, (SHA512_CTX *) Sha384Context));
+}
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha512GetContextSize (
+  VOID
+  )
+{
+  //
+  // Retrieves OpenSSL SHA-512 Context Size
+  //
+  return (UINTN) (sizeof (SHA512_CTX));
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+  subsequent use.
+
+  If Sha512Context is NULL, then return FALSE.
+
+  @param[out]  Sha512Context  Pointer to SHA-512 context being initialized.
+
+  @retval TRUE   SHA-512 context initialization succeeded.
+  @retval FALSE  SHA-512 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Init (
+  OUT  VOID  *Sha512Context
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha512Context == NULL) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-512 Context Initialization
+  //
+  return (BOOLEAN) (SHA512_Init ((SHA512_CTX *) Sha512Context));
+}
+
+/**
+  Makes a copy of an existing SHA-512 context.
+
+  If Sha512Context is NULL, then return FALSE.
+  If NewSha512Context is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  Sha512Context     Pointer to SHA-512 context being copied.
+  @param[out] NewSha512Context  Pointer to new SHA-512 context.
+
+  @retval TRUE   SHA-512 context copy succeeded.
+  @retval FALSE  SHA-512 context copy failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Duplicate (
+  IN   CONST VOID  *Sha512Context,
+  OUT  VOID        *NewSha512Context
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha512Context == NULL || NewSha512Context == NULL) {
+    return FALSE;
+  }
+
+  CopyMem (NewSha512Context, Sha512Context, sizeof (SHA512_CTX));
+
+  return TRUE;
+}
+
+/**
+  Digests the input data and updates SHA-512 context.
+
+  This function performs SHA-512 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-512 context should be already correctly intialized by Sha512Init(), and should not be finalized
+  by Sha512Final(). Behavior with invalid context is undefined.
+
+  If Sha512Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-512 data digest succeeded.
+  @retval FALSE  SHA-512 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Update (
+  IN OUT  VOID        *Sha512Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha512Context == NULL) {
+    return FALSE;
+  }
+
+  //
+  // Check invalid parameters, in case that only DataLength was checked in OpenSSL
+  //
+  if (Data == NULL && DataSize != 0) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-512 Hash Update
+  //
+  return (BOOLEAN) (SHA512_Update ((SHA512_CTX *) Sha512Context, Data, DataSize));
+}
+
+/**
+  Completes computation of the SHA-512 digest value.
+
+  This function completes SHA-512 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-512 context cannot
+  be used again.
+  SHA-512 context should be already correctly intialized by Sha512Init(), and should not be
+  finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
+
+  If Sha512Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-512 digest
+                                  value (64 bytes).
+
+  @retval TRUE   SHA-512 digest computation succeeded.
+  @retval FALSE  SHA-512 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Final (
+  IN OUT  VOID   *Sha512Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  //
+  // Check input parameters.
+  //
+  if (Sha512Context == NULL || HashValue == NULL) {
+    return FALSE;
+  }
+
+  //
+  // OpenSSL SHA-512 Hash Finalization
+  //
+  return (BOOLEAN) (SHA384_Final (HashValue, (SHA512_CTX *) Sha512Context));
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c
new file mode 100644
index 0000000..89aeacc
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c
@@ -0,0 +1,231 @@
+/** @file
+  SHA-384 and SHA-512 Digest Wrapper Implementations which does not provide real capabilities.
+
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+Sha384GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Sha384Context  Pointer to SHA-384 context being initialized.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Init (
+  OUT  VOID  *Sha384Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-384 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Sha384Context     Pointer to SHA-384 context being copied.
+  @param[out] NewSha384Context  Pointer to new SHA-384 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Duplicate (
+  IN   CONST VOID  *Sha384Context,
+  OUT  VOID        *NewSha384Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-384 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Update (
+  IN OUT  VOID        *Sha384Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-384 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-384 digest
+                                  value (48 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Final (
+  IN OUT  VOID   *Sha384Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+Sha512GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Sha512Context  Pointer to SHA-512 context being initialized.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Init (
+  OUT  VOID  *Sha512Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-512 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Sha512Context     Pointer to SHA-512 context being copied.
+  @param[out] NewSha512Context  Pointer to new SHA-512 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Duplicate (
+  IN   CONST VOID  *Sha512Context,
+  OUT  VOID        *NewSha512Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-512 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Update (
+  IN OUT  VOID        *Sha512Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-512 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-512 digest
+                                  value (64 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Final (
+  IN OUT  VOID   *Sha512Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index 913e3e1..e5ae595 100644
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -3,24 +3,25 @@
 #
 #  Caution: This module requires additional review when modified.
 #  This library will have external input - signature.
-#  This external input must be validated carefully to avoid security issues such as 
+#  This external input must be validated carefully to avoid security issues such as
 #  buffer overflow or integer overflow.
 #
-#  Note: MD4 Digest functions, HMAC-MD5 functions, HMAC-SHA1 functions, AES/
-#  TDES/ARC4 functions, RSA external functions, PKCS#7 SignedData sign functions,
-#  Diffie-Hellman functions, X.509 certificate handler functions, authenticode
-#  signature verification functions, PEM handler functions, and pseudorandom number
-#  generator functions are not supported in this instance.
+#  Note: MD4 Digest functions, SHA-384 Digest functions, SHA-512 Digest functions,
+#  HMAC-MD5 functions, HMAC-SHA1 functions, AES/TDES/ARC4 functions, RSA external 
+#  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 
+#  certificate handler functions, authenticode signature verification functions, 
+#  PEM handler functions, and pseudorandom number generator functions are not 
+#  supported in this instance.
 #
 #  Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -42,6 +43,7 @@
   Hash/CryptMd5.c
   Hash/CryptSha1.c
   Hash/CryptSha256.c
+  Hash/CryptSha512Null.c
   Hmac/CryptHmacMd5Null.c
   Hmac/CryptHmacSha1Null.c
   Cipher/CryptAesNull.c
@@ -56,6 +58,7 @@
   Pk/CryptDhNull.c
   Pk/CryptX509Null.c
   Pk/CryptAuthenticodeNull.c
+  Pk/CryptTsNull.c
   Pem/CryptPemNull.c
 
   Rand/CryptRandNull.c
@@ -64,26 +67,6 @@
   SysCall/ConstantTimeClock.c
   SysCall/BaseMemAllocation.c
 
-
-[Sources.Ia32]
-  SysCall/Ia32/MathMultS64x64.c     | MSFT
-  SysCall/Ia32/MathDivU64x64.c      | MSFT
-  SysCall/Ia32/MathReminderU64x64.c | MSFT
-  SysCall/Ia32/MathLShiftS64.c      | MSFT
-  SysCall/Ia32/MathRShiftU64.c      | MSFT
-
-  SysCall/Ia32/MathMultS64x64.c     | INTEL
-  SysCall/Ia32/MathDivU64x64.c      | INTEL
-  SysCall/Ia32/MathReminderU64x64.c | INTEL
-  SysCall/Ia32/MathLShiftS64.c      | INTEL
-  SysCall/Ia32/MathRShiftU64.c      | INTEL
-
-  SysCall/Ia32/MathMultS64x64.S     | GCC
-  SysCall/Ia32/MathDivU64x64.S      | GCC
-  SysCall/Ia32/MathReminderU64x64.S | GCC
-  SysCall/Ia32/MathLShiftS64.S      | GCC
-  SysCall/Ia32/MathRShiftU64.S      | GCC
-
 [Packages]
   MdePkg/MdePkg.dec
   CryptoPkg/CryptoPkg.dec
@@ -101,4 +84,3 @@
 #
 [BuildOptions]
   GCC:*_GCC44_IA32_CC_FLAGS = "-D__cdecl=__attribute__((cdecl))" "-D__declspec(t)=__attribute__((t))"
-  
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index 7b8bca5..9e93355 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -9,7 +9,7 @@
   AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for
   data structure.
 
-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2011 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -72,6 +72,7 @@
 {
   BOOLEAN      Status;
   PKCS7        *Pkcs7;
+  CONST UINT8  *Temp;
   CONST UINT8  *OrigAuthData;
   UINT8        *SpcIndirectDataContent;
   UINT8        Asn1Byte;
@@ -96,7 +97,8 @@
   //
   // Retrieve & Parse PKCS#7 Data (DER encoding) from Authenticode Signature
   //
-  Pkcs7 = d2i_PKCS7 (NULL, &AuthData, (int)DataSize);
+  Temp  = AuthData;
+  Pkcs7 = d2i_PKCS7 (NULL, &Temp, (int)DataSize);
   if (Pkcs7 == NULL) {
     goto _Exit;
   }
@@ -123,7 +125,7 @@
     // Un-matched SPC_INDIRECT_DATA_OBJID.
     //
     goto _Exit;
-  }  
+  }
 
 
   SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);
@@ -135,16 +137,27 @@
 
   if ((Asn1Byte & 0x80) == 0) {
     //
-    // Short Form of Length Encoding
+    // Short Form of Length Encoding (Length < 128)
     //
     ContentSize = (UINTN) (Asn1Byte & 0x7F);
     //
     // Skip the SEQUENCE Tag;
     //
     SpcIndirectDataContent += 2;
+
+  } else if ((Asn1Byte & 0x81) == 0x81) {
+    //
+    // Long Form of Length Encoding (128 <= Length < 255, Single Octet)
+    //
+    ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));
+    //
+    // Skip the SEQUENCE Tag;
+    //
+    SpcIndirectDataContent += 3;
+
   } else if ((Asn1Byte & 0x82) == 0x82) {
     //
-    // Long Form of Length Encoding, only support two bytes.
+    // Long Form of Length Encoding (Length > 255, Two Octet)
     //
     ContentSize = (UINTN) (*(UINT8 *)(SpcIndirectDataContent + 2));
     ContentSize = (ContentSize << 8) + (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 3));
@@ -152,6 +165,7 @@
     // Skip the SEQUENCE Tag;
     //
     SpcIndirectDataContent += 4;
+
   } else {
     goto _Exit;
   }
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
index 63fe78f..704eb4e 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
@@ -1,7 +1,7 @@
 /** @file
   PKCS#7 SignedData Sign Wrapper Implementation over OpenSSL.
 
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -116,9 +116,9 @@
   if (Key == NULL) {
     goto _Exit;
   }
-  Key->save_type = EVP_PKEY_RSA;
-  Key->type      = EVP_PKEY_type (EVP_PKEY_RSA);
-  Key->pkey.rsa  = (RSA *) RsaContext;
+  if (EVP_PKEY_assign_RSA (Key, (RSA *) RsaContext) == 0) {
+    goto _Exit;
+  }
 
   //
   // Convert the data to be signed to BIO format. 
@@ -175,7 +175,7 @@
   }
 
   CopyMem (*SignedData, P7Data + 19, *SignedDataSize);
-  
+
   OPENSSL_free (P7Data);
 
   Status = TRUE;
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index 05c3f87..d0b0c83 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -10,7 +10,7 @@
   WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated
   Variable and will do basic check for data structure.
 
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -123,7 +123,7 @@
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.
   @param[out] WrapFlag     If TRUE P7Data is a ContentInfo structure, otherwise
                            return FALSE.
-  @param[out] WrapData     If return status of this function is TRUE: 
+  @param[out] WrapData     If return status of this function is TRUE:
                            1) when WrapFlag is TRUE, pointer to P7Data.
                            2) when WrapFlag is FALSE, pointer to a new ContentInfo
                            structure. It's caller's responsibility to free this
@@ -227,7 +227,7 @@
   @param[in]  X509Stack       Pointer to a X509 stack object.
   @param[out] Cert            Pointer to a X509 certificate.
   @param[out] CertSize        Length of output X509 certificate in bytes.
-                                 
+
   @retval     TRUE            The X509 stack pop succeeded.
   @retval     FALSE           The pop operation failed.
 
@@ -273,7 +273,7 @@
     goto _Exit;
   }
 
-  Length = ((BUF_MEM *) CertBio->ptr)->length;
+  Length = (INT32)(((BUF_MEM *) CertBio->ptr)->length);
   if (Length <= 0) {
     goto _Exit;
   }
@@ -343,7 +343,7 @@
   PKCS7            *Pkcs7;
   BOOLEAN          Status;
   UINT8            *SignedData;
-  UINT8            *Temp;
+  CONST UINT8      *Temp;
   UINTN            SignedDataSize;
   BOOLEAN          Wrapped;
   STACK_OF(X509)   *Stack;
@@ -359,7 +359,7 @@
       (TrustedCert == NULL) || (CertLength == NULL) || (P7Length > INT_MAX)) {
     return FALSE;
   }
-  
+
   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
   if (!Status) {
     return Status;
@@ -410,7 +410,7 @@
   //
   BufferSize = sizeof (UINT8);
   OldSize    = BufferSize;
-  
+
   for (Index = 0; ; Index++) {
     Status = X509PopCertificate (Stack, &SingleCert, &SingleCertSize);
     if (!Status) {
@@ -455,7 +455,7 @@
     *CertStack   = CertBuf;
     *StackLength = BufferSize;
     Status = TRUE;
-  } 
+  }
 
 _Exit:
   //
@@ -485,7 +485,7 @@
   if (OldBuf != NULL) {
     free (OldBuf);
   }
-  
+
   return Status;
 }
 
@@ -549,18 +549,18 @@
   X509        *Cert;
   X509_STORE  *CertStore;
   UINT8       *SignedData;
-  UINT8       *Temp;
+  CONST UINT8 *Temp;
   UINTN       SignedDataSize;
   BOOLEAN     Wrapped;
 
   //
   // Check input parameters.
   //
-  if (P7Data == NULL || TrustedCert == NULL || InData == NULL || 
+  if (P7Data == NULL || TrustedCert == NULL || InData == NULL ||
     P7Length > INT_MAX || CertLength > INT_MAX || DataLength > INT_MAX) {
     return FALSE;
   }
-  
+
   Pkcs7     = NULL;
   DataBio   = NULL;
   Cert      = NULL;
@@ -578,18 +578,23 @@
   if (EVP_add_digest (EVP_sha256 ()) == 0) {
     return FALSE;
   }
+  if (EVP_add_digest (EVP_sha384 ()) == 0) {
+    return FALSE;
+  }
+  if (EVP_add_digest (EVP_sha512 ()) == 0) {
+    return FALSE;
+  }
   if (EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA) == 0) {
     return FALSE;
   }
 
-
   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
   if (!Status) {
     return Status;
   }
 
   Status = FALSE;
-  
+
   //
   // Retrieve PKCS#7 Data (DER encoding)
   //
@@ -613,7 +618,8 @@
   //
   // Read DER-encoded root certificate and Construct X509 Certificate
   //
-  Cert = d2i_X509 (NULL, &TrustedCert, (long) CertLength);
+  Temp = TrustedCert;
+  Cert = d2i_X509 (NULL, &Temp, (long) CertLength);
   if (Cert == NULL) {
     goto _Exit;
   }
@@ -675,3 +681,114 @@
 
   return Status;
 }
+
+/**
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+  data could be wrapped in a ContentInfo structure.
+
+  If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
+  then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.
+
+  Caution: This function may receive untrusted input. So this function will do
+           basic check for PKCS#7 data structure.
+
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
+                            It's caller's responsiblity to free the buffer.
+  @param[out]  ContentSize  The size of the extracted content in bytes.
+
+  @retval     TRUE          The P7Data was correctly formatted for processing.
+  @retval     FALSE         The P7Data was not correctly formatted for processing.
+
+*/
+BOOLEAN
+EFIAPI
+Pkcs7GetAttachedContent (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT VOID         **Content,
+  OUT UINTN        *ContentSize
+  )
+{
+  BOOLEAN            Status;
+  PKCS7              *Pkcs7;
+  UINT8              *SignedData;
+  UINTN              SignedDataSize;
+  BOOLEAN            Wrapped;
+  CONST UINT8        *Temp;
+  ASN1_OCTET_STRING  *OctStr;
+
+  //
+  // Check input parameter.
+  //
+  if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {
+    return FALSE;
+  }
+
+  *Content   = NULL;
+  Pkcs7      = NULL;
+  SignedData = NULL;
+  OctStr     = NULL;
+
+  Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
+  if (!Status || (SignedDataSize > INT_MAX)) {
+    goto _Exit;
+  }
+
+  Status = FALSE;
+
+  //
+  // Decoding PKCS#7 SignedData
+  //
+  Temp  = SignedData;
+  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
+  if (Pkcs7 == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // The type of Pkcs7 must be signedData
+  //
+  if (!PKCS7_type_is_signed (Pkcs7)) {
+    goto _Exit;
+  }
+
+  //
+  // Check for detached or attached content
+  //
+  if (PKCS7_get_detached (Pkcs7)) {
+    //
+    // No Content supplied for PKCS7 detached signedData
+    //
+    *Content     = NULL;
+    *ContentSize = 0;
+  } else {
+    //
+    // Retrieve the attached content in PKCS7 signedData
+    //
+    OctStr = Pkcs7->d.sign->contents->d.data;
+    if ((OctStr->length > 0) && (OctStr->data != NULL)) {
+      *ContentSize = OctStr->length;
+      *Content     = malloc (*ContentSize);
+      if (*Content == NULL) {
+        *ContentSize = 0;
+        goto _Exit;
+      }
+      CopyMem (*Content, OctStr->data, *ContentSize);
+    }
+  }
+  Status = TRUE;
+
+_Exit:
+  //
+  // Release Resources
+  //
+  PKCS7_free (Pkcs7);
+
+  if (!Wrapped) {
+    OPENSSL_free (SignedData);
+  }
+
+  return Status;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
index 9a4c77a..09b92c7 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
@@ -2,7 +2,7 @@
   PKCS#7 SignedData Verification Wrapper Implementation which does not provide
   real capabilities.
 
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -98,3 +98,32 @@
   ASSERT (FALSE);
   return FALSE;
 }
+
+/**
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+  data could be wrapped in a ContentInfo structure.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
+                            It's caller's responsiblity to free the buffer.
+  @param[out]  ContentSize  The size of the extracted content in bytes.
+
+  @retval     TRUE          The P7Data was correctly formatted for processing.
+  @retval     FALSE         The P7Data was not correctly formatted for processing.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7GetAttachedContent (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT VOID         **Content,
+  OUT UINTN        *ContentSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
index 5c21d12..b890704 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
@@ -243,7 +243,9 @@
 }
 
 /**
-  Validates key components of RSA context.
+  Validates key components of RSA context. 
+  NOTE: This function performs integrity checks on all the RSA key material, so
+        the RSA key structure must contain all the private key data.
 
   This function validates key compoents of RSA context in following aspects:
   - Whether p is a prime
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
new file mode 100644
index 0000000..7d269b0
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
@@ -0,0 +1,729 @@
+/** @file
+  RFC3161 Timestamp Countersignature Verification over OpenSSL.
+  The timestamp is generated by a TimeStamping Authority (TSA) and asserts that a
+  publisher's signature existed before the specified time. The timestamp extends
+  the lifetime of the signature when a signing certificate expires or is later
+  revoked.
+
+Copyright (c) 2014 - 2015, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "InternalCryptLib.h"
+
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/pkcs7.h>
+
+//
+// OID ASN.1 Value for SPC_RFC3161_OBJID ("1.3.6.1.4.1.311.3.3.1")
+//
+UINT8 mSpcRFC3161OidValue[] = {
+  0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x03, 0x03, 0x01
+  };
+
+///
+/// The messageImprint field SHOULD contain the hash of the datum to be
+/// time-stamped.  The hash is represented as an OCTET STRING.  Its
+/// length MUST match the length of the hash value for that algorithm
+/// (e.g., 20 bytes for SHA-1 or 16 bytes for MD5).
+///
+/// MessageImprint ::= SEQUENCE  {
+///   hashAlgorithm                AlgorithmIdentifier,
+///   hashedMessage                OCTET STRING  }
+///
+typedef struct {
+  X509_ALGOR         *HashAlgorithm;
+  ASN1_OCTET_STRING  *HashedMessage;
+} TS_MESSAGE_IMPRINT;
+
+//
+// ASN.1 Functions for TS_MESSAGE_IMPRINT
+//
+DECLARE_ASN1_FUNCTIONS (TS_MESSAGE_IMPRINT)
+ASN1_SEQUENCE (TS_MESSAGE_IMPRINT) = {
+  ASN1_SIMPLE (TS_MESSAGE_IMPRINT, HashAlgorithm, X509_ALGOR),
+  ASN1_SIMPLE (TS_MESSAGE_IMPRINT, HashedMessage, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END (TS_MESSAGE_IMPRINT)
+IMPLEMENT_ASN1_FUNCTIONS (TS_MESSAGE_IMPRINT)
+
+///
+/// Accuracy represents the time deviation around the UTC time contained
+/// in GeneralizedTime of time-stamp token.
+///
+/// Accuracy ::= SEQUENCE {
+///       seconds        INTEGER              OPTIONAL,
+///       millis     [0] INTEGER  (1..999)    OPTIONAL,
+///       micros     [1] INTEGER  (1..999)    OPTIONAL  }
+///
+typedef struct {
+  ASN1_INTEGER  *Seconds;
+  ASN1_INTEGER  *Millis;
+  ASN1_INTEGER  *Micros;
+} TS_ACCURACY;
+
+//
+// ASN.1 Functions for TS_ACCURACY
+//
+DECLARE_ASN1_FUNCTIONS (TS_ACCURACY)
+ASN1_SEQUENCE (TS_ACCURACY) = {
+  ASN1_OPT     (TS_ACCURACY, Seconds, ASN1_INTEGER),
+  ASN1_IMP_OPT (TS_ACCURACY, Millis,  ASN1_INTEGER, 0),
+  ASN1_IMP_OPT (TS_ACCURACY, Micros,  ASN1_INTEGER, 1)
+} ASN1_SEQUENCE_END (TS_ACCURACY)
+IMPLEMENT_ASN1_FUNCTIONS (TS_ACCURACY)
+
+///
+/// The timestamp token info resulting from a successful timestamp request,
+/// as defined in RFC 3161.
+///
+///  TSTInfo ::= SEQUENCE  {
+///     version                      INTEGER  { v1(1) },
+///     policy                       TSAPolicyId,
+///     messageImprint               MessageImprint,
+///       -- MUST have the same value as the similar field in
+///       -- TimeStampReq
+///     serialNumber                 INTEGER,
+///       -- Time-Stamping users MUST be ready to accommodate integers
+///       -- up to 160 bits.
+///     genTime                      GeneralizedTime,
+///     accuracy                     Accuracy                 OPTIONAL,
+///     ordering                     BOOLEAN             DEFAULT FALSE,
+///     nonce                        INTEGER                  OPTIONAL,
+///       -- MUST be present if the similar field was present
+///       -- in TimeStampReq.  In that case it MUST have the same value.
+///     tsa                          [0] GeneralName          OPTIONAL,
+///     extensions                   [1] IMPLICIT Extensions   OPTIONAL  }
+///
+typedef struct {
+  ASN1_INTEGER              *Version;
+  ASN1_OBJECT               *Policy;
+  TS_MESSAGE_IMPRINT        *MessageImprint;
+  ASN1_INTEGER              *SerialNumber;
+  ASN1_GENERALIZEDTIME      *GenTime;
+  TS_ACCURACY               *Accuracy;
+  ASN1_BOOLEAN              Ordering;
+  ASN1_INTEGER              *Nonce;
+  GENERAL_NAME              *Tsa;
+  STACK_OF(X509_EXTENSION)  *Extensions;
+} TS_TST_INFO;
+
+//
+// ASN.1 Functions for TS_TST_INFO
+//
+DECLARE_ASN1_FUNCTIONS (TS_TST_INFO)
+ASN1_SEQUENCE (TS_TST_INFO) = {
+  ASN1_SIMPLE (TS_TST_INFO, Version, ASN1_INTEGER),
+  ASN1_SIMPLE (TS_TST_INFO, Policy, ASN1_OBJECT),
+  ASN1_SIMPLE (TS_TST_INFO, MessageImprint, TS_MESSAGE_IMPRINT),
+  ASN1_SIMPLE (TS_TST_INFO, SerialNumber, ASN1_INTEGER),
+  ASN1_SIMPLE (TS_TST_INFO, GenTime, ASN1_GENERALIZEDTIME),
+  ASN1_OPT    (TS_TST_INFO, Accuracy, TS_ACCURACY),
+  ASN1_OPT    (TS_TST_INFO, Ordering, ASN1_FBOOLEAN),
+  ASN1_OPT    (TS_TST_INFO, Nonce, ASN1_INTEGER),
+  ASN1_EXP_OPT(TS_TST_INFO, Tsa, GENERAL_NAME, 0),
+  ASN1_IMP_SEQUENCE_OF_OPT (TS_TST_INFO, Extensions, X509_EXTENSION, 1)
+} ASN1_SEQUENCE_END (TS_TST_INFO)
+IMPLEMENT_ASN1_FUNCTIONS (TS_TST_INFO)
+
+
+/**
+  Verification callback function to override any existing callbacks in OpenSSL
+  for intermediate TSA certificate supports.
+
+  @param[in]  Status   Original status before calling this callback.
+  @param[in]  Context  X509 store context.
+
+  @retval     1        Current X509 certificate is verified successfully.
+  @retval     0        Verification failed.
+
+**/
+int
+TSVerifyCallback (
+  IN int             Status,
+  IN X509_STORE_CTX  *Context
+  )
+{
+  X509_OBJECT  *Obj;
+  INTN         Error;
+  INTN         Index;
+  INTN         Count;
+
+  Obj   = NULL;
+  Error = (INTN) X509_STORE_CTX_get_error (Context);
+
+  //
+  // X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT and X509_V_ERR_UNABLE_TO_GET_ISSUER_
+  // CERT_LOCALLY mean a X509 certificate is not self signed and its issuer
+  // can not be found in X509_verify_cert of X509_vfy.c.
+  // In order to support intermediate certificate node, we override the
+  // errors if the certification is obtained from X509 store, i.e. it is
+  // a trusted ceritifcate node that is enrolled by user.
+  // Besides,X509_V_ERR_CERT_UNTRUSTED and X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
+  // are also ignored to enable such feature.
+  //
+  if ((Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) ||
+      (Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)) {
+    Obj = (X509_OBJECT *) malloc (sizeof (X509_OBJECT));
+    if (Obj == NULL) {
+      return 0;
+    }
+
+    Obj->type      = X509_LU_X509;
+    Obj->data.x509 = Context->current_cert;
+
+    CRYPTO_w_lock (CRYPTO_LOCK_X509_STORE);
+
+    if (X509_OBJECT_retrieve_match (Context->ctx->objs, Obj)) {
+      Status = 1;
+    } else {
+      //
+      // If any certificate in the chain is enrolled as trusted certificate,
+      // pass the certificate verification.
+      //
+      if (Error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) {
+        Count = (INTN) sk_X509_num (Context->chain);
+        for (Index = 0; Index < Count; Index++) {
+          Obj->data.x509 = sk_X509_value (Context->chain, (int) Index);
+          if (X509_OBJECT_retrieve_match (Context->ctx->objs, Obj)) {
+            Status = 1;
+            break;
+          }
+        }
+      }
+    }
+
+    CRYPTO_w_unlock (CRYPTO_LOCK_X509_STORE);
+  }
+
+  if ((Error == X509_V_ERR_CERT_UNTRUSTED) ||
+      (Error == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) {
+    Status = 1;
+  }
+
+  if (Obj != NULL) {
+    OPENSSL_free (Obj);
+  }
+
+  return Status;
+}
+
+/**
+  Convert ASN.1 GeneralizedTime to EFI Time.
+
+  @param[in]  Asn1Time         Pointer to the ASN.1 GeneralizedTime to be converted.
+  @param[out] SigningTime      Return the corresponding EFI Time.
+
+  @retval  TRUE   The time convertion succeeds.
+  @retval  FALSE  Invalid parameters.
+
+**/
+BOOLEAN
+EFIAPI
+ConvertAsn1TimeToEfiTime (
+  IN  ASN1_TIME  *Asn1Time,
+  OUT EFI_TIME   *EfiTime
+  )
+{
+  CONST CHAR8  *Str;
+  UINTN        Index;
+
+  if ((Asn1Time == NULL) || (EfiTime == NULL)) {
+    return FALSE;
+  }
+
+  Str = (CONST CHAR8*)Asn1Time->data;
+  SetMem (EfiTime, 0, sizeof (EFI_TIME));
+
+  Index = 0;
+  if (Asn1Time->type == V_ASN1_UTCTIME) {               /* two digit year */
+    EfiTime->Year  = (Str[Index++] - '0') * 10;
+    EfiTime->Year += (Str[Index++] - '0');
+    if (EfiTime->Year < 70) {
+      EfiTime->Year += 100;
+    }
+  } else if (Asn1Time->type == V_ASN1_GENERALIZEDTIME) { /* four digit year */
+    EfiTime->Year  = (Str[Index++] - '0') * 1000;
+    EfiTime->Year += (Str[Index++] - '0') * 100;
+    EfiTime->Year += (Str[Index++] - '0') * 10;
+    EfiTime->Year += (Str[Index++] - '0');
+    if ((EfiTime->Year < 1900) || (EfiTime->Year > 9999)) {
+      return FALSE;
+    }
+  }
+
+  EfiTime->Month   = (Str[Index++] - '0') * 10;
+  EfiTime->Month  += (Str[Index++] - '0');
+  if ((EfiTime->Month < 1) || (EfiTime->Month > 12)) {
+    return FALSE;
+  }
+
+  EfiTime->Day     = (Str[Index++] - '0') * 10;
+  EfiTime->Day    += (Str[Index++] - '0');
+  if ((EfiTime->Day < 1) || (EfiTime->Day > 31)) {
+    return FALSE;
+  }
+
+  EfiTime->Hour    = (Str[Index++] - '0') * 10;
+  EfiTime->Hour   += (Str[Index++] - '0');
+  if (EfiTime->Hour > 23) {
+    return FALSE;
+  }
+
+  EfiTime->Minute  = (Str[Index++] - '0') * 10;
+  EfiTime->Minute += (Str[Index++] - '0');
+  if (EfiTime->Minute > 59) {
+    return FALSE;
+  }
+
+  EfiTime->Second  = (Str[Index++] - '0') * 10;
+  EfiTime->Second += (Str[Index++] - '0');
+  if (EfiTime->Second > 59) {
+    return FALSE;
+  }
+
+  /* Note: we did not adjust the time based on time zone information */
+
+  return TRUE;
+}
+
+/**
+
+  Check the validity of TimeStamp Token Information.
+
+  @param[in]  TstInfo          Pointer to the TS_TST_INFO structure.
+  @param[in]  TimestampedData  Pointer to the data to be time-stamped.
+  @param[in]  DataSize         Size of timestamped data in bytes.
+
+  @retval  TRUE   The TimeStamp Token Information is valid.
+  @retval  FALSE  Invalid TimeStamp Token Information.
+
+**/
+BOOLEAN
+EFIAPI
+CheckTSTInfo (
+  IN  CONST TS_TST_INFO  *TstInfo,
+  IN  CONST UINT8        *TimestampedData,
+  IN  UINTN              DataSize
+  )
+{
+  BOOLEAN             Status;
+  TS_MESSAGE_IMPRINT  *Imprint;
+  X509_ALGOR          *HashAlgo;
+  CONST EVP_MD        *Md;
+  EVP_MD_CTX          MdCtx;
+  UINTN               MdSize;
+  UINT8               *HashedMsg;
+
+  //
+  // Initialization
+  //
+  Status    = FALSE;
+  HashAlgo  = NULL;
+  HashedMsg = NULL;
+
+  //
+  // -- Check version number of Timestamp:
+  //   The version field (currently v1) describes the version of the time-stamp token.
+  //   Conforming time-stamping servers MUST be able to provide version 1 time-stamp tokens.
+  //
+  if ((ASN1_INTEGER_get (TstInfo->Version)) != 1) {
+    return FALSE;
+  }
+
+  //
+  // -- Check Policies
+  //   The policy field MUST indicate the TSA's policy under which the response was produced.
+  //
+  if (TstInfo->Policy == NULL) {
+    /// NOTE: Need to check if the requested and returned policies.
+    ///       We have no information about the Requested TSA Policy.
+    return FALSE;
+  }
+
+  //
+  // -- Compute & Check Message Imprint
+  //
+  Imprint  = TstInfo->MessageImprint;
+  HashAlgo = X509_ALGOR_dup (Imprint->HashAlgorithm);
+
+  Md = EVP_get_digestbyobj (HashAlgo->algorithm);
+  if (Md == NULL) {
+    goto _Exit;
+  }
+
+  MdSize = EVP_MD_size (Md);
+  HashedMsg = AllocateZeroPool (MdSize);
+  if (HashedMsg == NULL) {
+    goto _Exit;
+  }
+  EVP_DigestInit (&MdCtx, Md);
+  EVP_DigestUpdate (&MdCtx, TimestampedData, DataSize);
+  EVP_DigestFinal (&MdCtx, HashedMsg, NULL);
+  if ((MdSize == (UINTN)ASN1_STRING_length (Imprint->HashedMessage)) &&
+      (CompareMem (HashedMsg, ASN1_STRING_data (Imprint->HashedMessage), MdSize) != 0)) {
+    goto _Exit;
+  }
+
+  //
+  // -- Check Nonces
+  //
+  if (TstInfo->Nonce != NULL) {
+    //
+    // Nonces is optional, No error if no nonce is returned;
+    //
+  }
+
+  //
+  // -- Check if the TSA name and signer certificate is matched.
+  //
+  if (TstInfo->Tsa != NULL) {
+    //
+    //  Ignored the optional Tsa field checking.
+    //
+  }
+
+  Status = TRUE;
+
+_Exit:
+  X509_ALGOR_free (HashAlgo);
+  if (HashedMsg != NULL) {
+    FreePool (HashedMsg);
+  }
+
+  return Status;
+}
+
+/**
+  Verifies the validility of a TimeStamp Token as described in RFC 3161 ("Internet
+  X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)").
+
+  If TSToken is NULL, then return FALSE.
+  If TimestampedData is NULL, then return FALSE.
+
+  @param[in]  TSToken          Pointer to the RFC3161 TimeStamp Token, which is generated
+                               by a TSA and located in the software publisher's SignerInfo
+                               structure.
+  @param[in]  TokenSize        Size of the TimeStamp Token in bytes.
+  @param[in]  TsaCert          Pointer to a trusted/root TSA certificate encoded in DER.
+  @param[in]  CertSize         Size of the trusted TSA certificate in bytes.
+  @param[in]  TimestampedData  Pointer to the data to be time-stamped.
+  @param[in]  DataSize         Size of timestamped data in bytes.
+  @param[out] SigningTime      Return the time of timestamp generation time if the timestamp
+                               signature is valid.
+
+  @retval  TRUE   The specified timestamp token is valid.
+  @retval  FALSE  Invalid timestamp token.
+
+**/
+BOOLEAN
+EFIAPI
+TimestampTokenVerify (
+  IN  CONST UINT8  *TSToken,
+  IN  UINTN        TokenSize,
+  IN  CONST UINT8  *TsaCert,
+  IN  UINTN        CertSize,
+  IN  CONST UINT8  *TimestampedData,
+  IN  UINTN        DataSize,
+  OUT EFI_TIME     *SigningTime
+  )
+{
+  BOOLEAN      Status;
+  CONST UINT8  *TokenTemp;
+  PKCS7        *Pkcs7;
+  X509         *Cert;
+  CONST UINT8  *CertTemp;
+  X509_STORE   *CertStore;
+  BIO          *OutBio;
+  UINT8        *TstData;
+  UINTN        TstSize;
+  CONST UINT8  *TstTemp;
+  TS_TST_INFO  *TstInfo;
+
+  Status = FALSE;
+
+  //
+  // Check input parameters
+  //
+  if ((TSToken == NULL) || (TsaCert == NULL) || (TimestampedData == NULL) ||
+      (TokenSize > INT_MAX) || (CertSize > INT_MAX) || (DataSize > INT_MAX)) {
+    return FALSE;
+  }
+
+  //
+  // Initializations
+  //
+  if (SigningTime != NULL) {
+    SetMem (SigningTime, sizeof (EFI_TIME), 0);
+  }
+  Pkcs7     = NULL;
+  Cert      = NULL;
+  CertStore = NULL;
+  OutBio    = NULL;
+  TstData   = NULL;
+  TstInfo   = NULL;
+
+  //
+  // TimeStamp Token should contain one valid DER-encoded ASN.1 PKCS#7 structure.
+  //
+  TokenTemp = TSToken;
+  Pkcs7     = d2i_PKCS7 (NULL, (const unsigned char **) &TokenTemp, (int) TokenSize);
+  if (Pkcs7 == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // The timestamp signature (TSA's response) will be one PKCS#7 signed data.
+  //
+  if (!PKCS7_type_is_signed (Pkcs7)) {
+    goto _Exit;
+  }
+
+  //
+  // Read the trusted TSA certificate (DER-encoded), and Construct X509 Certificate.
+  //
+  CertTemp = TsaCert;
+  Cert = d2i_X509 (NULL, &CertTemp, (long) CertSize);
+  if (Cert == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // Setup X509 Store for trusted certificate.
+  //
+  CertStore = X509_STORE_new ();
+  if ((CertStore == NULL) || !(X509_STORE_add_cert (CertStore, Cert))) {
+    goto _Exit;
+  }
+
+  //
+  // Register customized X509 verification callback function to support
+  // trusted intermediate TSA certificate anchor.
+  //
+  CertStore->verify_cb = TSVerifyCallback;
+
+  X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY);
+
+  //
+  // Verifies the PKCS#7 signedData structure, and output the signed contents.
+  //
+  OutBio = BIO_new (BIO_s_mem ());
+  if (OutBio == NULL) {
+    goto _Exit;
+  }
+  if (!PKCS7_verify (Pkcs7, NULL, CertStore, NULL, OutBio, PKCS7_BINARY)) {
+    goto _Exit;
+  }
+
+  //
+  // Read the signed contents detached in timestamp signature.
+  //
+  TstData = AllocateZeroPool (2048);
+  if (TstData == NULL) {
+    goto _Exit;
+  }
+  TstSize = BIO_read (OutBio, (void *) TstData, 2048);
+
+  //
+  // Construct TS_TST_INFO structure from the signed contents.
+  //
+  TstTemp = TstData;
+  TstInfo = d2i_TS_TST_INFO (NULL, (const unsigned char **) &TstTemp,
+              (int)TstSize);
+  if (TstInfo == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // Check TS_TST_INFO structure.
+  //
+  Status = CheckTSTInfo (TstInfo, TimestampedData, DataSize);
+  if (!Status) {
+    goto _Exit;
+  }
+
+  //
+  // Retrieve the signing time from TS_TST_INFO structure.
+  //
+  if (SigningTime != NULL) {
+    SetMem (SigningTime, sizeof (EFI_TIME), 0);
+    Status = ConvertAsn1TimeToEfiTime (TstInfo->GenTime, SigningTime);
+  }
+
+_Exit:
+  //
+  // Release Resources
+  //
+  PKCS7_free (Pkcs7);
+  X509_free (Cert);
+  X509_STORE_free (CertStore);
+  BIO_free (OutBio);
+  TS_TST_INFO_free (TstInfo);
+
+  if (TstData != NULL) {
+    FreePool (TstData);
+  }
+
+  return Status;
+}
+
+/**
+  Verifies the validility of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+  signature.
+
+  If AuthData is NULL, then return FALSE.
+
+  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed
+                           PE/COFF image to be verified.
+  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
+  @param[in]  TsaCert      Pointer to a trusted/root TSA certificate encoded in DER, which
+                           is used for TSA certificate chain verification.
+  @param[in]  CertSize     Size of the trusted certificate in bytes.
+  @param[out] SigningTime  Return the time of timestamp generation time if the timestamp
+                           signature is valid.
+
+  @retval  TRUE   The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
+  @retval  FALSE  No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
+
+**/
+BOOLEAN
+EFIAPI
+ImageTimestampVerify (
+  IN  CONST UINT8  *AuthData,
+  IN  UINTN        DataSize,
+  IN  CONST UINT8  *TsaCert,
+  IN  UINTN        CertSize,
+  OUT EFI_TIME     *SigningTime
+  )
+{
+  BOOLEAN                      Status;
+  PKCS7                        *Pkcs7;
+  CONST UINT8                  *Temp;
+  STACK_OF(PKCS7_SIGNER_INFO)  *SignerInfos;
+  PKCS7_SIGNER_INFO            *SignInfo;
+  UINTN                        Index;
+  STACK_OF(X509_ATTRIBUTE)     *Sk;
+  X509_ATTRIBUTE               *Xa;
+  ASN1_TYPE                    *Asn1Type;
+  ASN1_OCTET_STRING            *EncDigest;
+  UINT8                        *TSToken;
+  UINTN                        TokenSize;
+
+  //
+  // Input Parameters Checking.
+  //
+  if ((AuthData == NULL) || (TsaCert == NULL)) {
+    return FALSE;
+  }
+
+  if ((DataSize > INT_MAX) || (CertSize > INT_MAX)) {
+    return FALSE;
+  }
+
+  //
+  // Register & Initialize necessary digest algorithms for PKCS#7 Handling.
+  //
+  if ((EVP_add_digest (EVP_md5 ()) == 0) || (EVP_add_digest (EVP_sha1 ()) == 0) ||
+      (EVP_add_digest (EVP_sha256 ()) == 0) || (EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA)) == 0) {
+    return FALSE;
+  }
+
+  //
+  // Initialization.
+  //
+  Status    = FALSE;
+  Pkcs7     = NULL;
+  SignInfo  = NULL;
+
+  //
+  // Decode ASN.1-encoded Authenticode data into PKCS7 structure.
+  //
+  Temp  = AuthData;
+  Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **) &Temp, (int) DataSize);
+  if (Pkcs7 == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // Check if there is one and only one signer.
+  //
+  SignerInfos = PKCS7_get_signer_info (Pkcs7);
+  if (!SignerInfos || (sk_PKCS7_SIGNER_INFO_num (SignerInfos) != 1)) {
+    goto _Exit;
+  }
+
+  //
+  // Locate the TimeStamp CounterSignature.
+  //
+  SignInfo = sk_PKCS7_SIGNER_INFO_value (SignerInfos, 0);
+  if (SignInfo == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // Locate Message Digest which will be the data to be time-stamped.
+  //
+  EncDigest = SignInfo->enc_digest;
+  if (EncDigest == NULL) {
+    goto _Exit;
+  }
+
+  //
+  // The RFC3161 timestamp counterSignature is contained in unauthenticatedAttributes field
+  // of SignerInfo.
+  //
+  Sk = SignInfo->unauth_attr;
+  if (Sk == NULL) {             // No timestamp counterSignature.
+    goto _Exit;
+  }
+
+  Asn1Type = NULL;
+  for (Index = 0; Index < (UINTN) sk_X509_ATTRIBUTE_num (Sk); Index++) {
+    //
+    // Search valid RFC3161 timestamp counterSignature based on OBJID.
+    //
+    Xa = sk_X509_ATTRIBUTE_value (Sk, (int)Index);
+    if ((Xa->object->length != sizeof (mSpcRFC3161OidValue)) ||
+        (CompareMem (Xa->object->data, mSpcRFC3161OidValue, sizeof (mSpcRFC3161OidValue)) != 0)) {
+      continue;
+    }
+    Asn1Type = sk_ASN1_TYPE_value (Xa->value.set, 0);
+  }
+
+  if (Asn1Type == NULL) {
+    Status = FALSE;
+    goto _Exit;
+  }
+  TSToken   = Asn1Type->value.octet_string->data;
+  TokenSize = Asn1Type->value.octet_string->length;
+
+  //
+  // TimeStamp counterSignature (Token) verification.
+  //
+  Status = TimestampTokenVerify (
+             TSToken,
+             TokenSize,
+             TsaCert,
+             CertSize,
+             EncDigest->data,
+             EncDigest->length,
+             SigningTime
+             );
+
+_Exit:
+  //
+  // Release Resources
+  //
+  PKCS7_free (Pkcs7);
+
+  return Status;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c
new file mode 100644
index 0000000..eb32aaf
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c
@@ -0,0 +1,48 @@
+/** @file
+  RFC3161 Timestamp Countersignature Verification Wrapper Implementation which does
+  not provide real capabilities.
+
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Verifies the validility of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+  signature.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed
+                           PE/COFF image to be verified.
+  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
+  @param[in]  TsaCert      Pointer to a trusted/root TSA certificate encoded in DER, which
+                           is used for TSA certificate chain verification.
+  @param[in]  CertSize     Size of the trusted certificate in bytes.
+  @param[out] SigningTime  Return the time of timestamp generation time if the timestamp
+                           signature is valid.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+ImageTimestampVerify (
+  IN  CONST UINT8  *AuthData,
+  IN  UINTN        DataSize,
+  IN  CONST UINT8  *TsaCert,
+  IN  UINTN        CertSize,
+  OUT EFI_TIME     *SigningTime
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
index 5abe970..70b135a 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
@@ -1,7 +1,7 @@
 /** @file
   X.509 Certificate Handler Wrapper Implementation over OpenSSL.
 
-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -38,7 +38,8 @@
   OUT  UINT8        **SingleX509Cert
   )
 {
-  X509     *X509Cert;
+  X509         *X509Cert;
+  CONST UINT8  *Temp;
 
   //
   // Check input parameters.
@@ -50,7 +51,8 @@
   //
   // Read DER-encoded X509 Certificate and Construct X509 object.
   //
-  X509Cert = d2i_X509 (NULL, &Cert, (long) CertSize);
+  Temp     = Cert;
+  X509Cert = d2i_X509 (NULL, &Temp, (long) CertSize);
   if (X509Cert == NULL) {
     return FALSE;
   }
@@ -65,7 +67,7 @@
 
   If X509Stack is NULL, then return FALSE.
 
-  @param[in, out]  X509Stack  On input, pointer to an existing X509 stack object.
+  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
                               On output, pointer to the X509 stack object with new
                               inserted X509 certificate.
   @param           ...        A list of DER-encoded single certificate data followed
@@ -123,17 +125,23 @@
     }
 
     CertSize = VA_ARG (Args, UINTN);
+    if (CertSize == 0) {
+      break;
+    }
 
     //
     // Construct X509 Object from the given DER-encoded certificate data.
     //
+    X509Cert = NULL;
     Status = X509ConstructCertificate (
                (CONST UINT8 *) Cert,
                CertSize,
                (UINT8 **) &X509Cert
                );
     if (!Status) {
-      X509_free (X509Cert);
+      if (X509Cert != NULL) {
+        X509_free (X509Cert);
+      }
       break;
     }
 
@@ -484,3 +492,80 @@
   
   return Status;
 }
+
+/**
+  Retrieve the TBSCertificate from one given X.509 certificate.
+
+  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
+  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
+
+  If Cert is NULL, then return FALSE.
+  If TBSCert is NULL, then return FALSE.
+  If TBSCertSize is NULL, then return FALSE.
+
+  @retval  TRUE   The TBSCertificate was retrieved successfully.
+  @retval  FALSE  Invalid X.509 certificate.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetTBSCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  OUT UINT8        **TBSCert,
+  OUT UINTN        *TBSCertSize
+  )
+{
+  CONST UINT8  *Temp;
+  INTN         Asn1Tag;
+  INTN         ObjClass;
+  UINTN        Length;
+
+  //
+  // Check input parameters.
+  //
+  if ((Cert == NULL) || (TBSCert == NULL) ||
+      (TBSCertSize == NULL) || (CertSize > INT_MAX)) {
+    return FALSE;
+  }
+
+  //
+  // An X.509 Certificate is: (defined in RFC3280)
+  //   Certificate  ::=  SEQUENCE  {
+  //     tbsCertificate       TBSCertificate,
+  //     signatureAlgorithm   AlgorithmIdentifier,
+  //     signature            BIT STRING }
+  //
+  // and
+  //
+  //  TBSCertificate  ::=  SEQUENCE  {
+  //    version         [0]  Version DEFAULT v1,
+  //    ...
+  //    }
+  //
+  // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
+  // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
+  //
+  Temp = Cert;
+  ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)CertSize);
+
+  if (Asn1Tag != V_ASN1_SEQUENCE) {
+    return FALSE;
+  }
+
+  *TBSCert = (UINT8 *)Temp;
+
+  ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)Length);
+  //
+  // Verify the parsed TBSCertificate is one correct SEQUENCE data.
+  //
+  if (Asn1Tag != V_ASN1_SEQUENCE) {
+    return FALSE;
+  }
+
+  *TBSCertSize = Length + (Temp - *TBSCert);
+  
+  return TRUE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c
index 5dbddca..51aa063 100644
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c
@@ -2,7 +2,7 @@
   X.509 Certificate Handler Wrapper Implementation which does not provide
   real capabilities.
 
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -44,7 +44,7 @@
 
   Return FALSE to indicate this interface is not supported.
 
-  @param[in, out]  X509Stack  On input, pointer to an existing X509 stack object.
+  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
                               On output, pointer to the X509 stack object with new
                               inserted X509 certificate.
   @param           ...        A list of DER-encoded single certificate data followed
@@ -178,3 +178,29 @@
   ASSERT (FALSE);
   return FALSE;
 }
+
+/**
+  Retrieve the TBSCertificate from one given X.509 certificate.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
+  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetTBSCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  OUT UINT8        **TBSCert,
+  OUT UINTN        *TBSCertSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
index d23e3db..04f0689 100644
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -3,23 +3,23 @@
 #
 #  Caution: This module requires additional review when modified.
 #  This library will have external input - signature.
-#  This external input must be validated carefully to avoid security issues such as 
+#  This external input must be validated carefully to avoid security issues such as
 #  buffer overflow or integer overflow.
 #
-#  Note: MD4 Digest functions, HMAC-MD5 functions, HMAC-SHA1 functions, AES/
-#  TDES/ARC4 functions, RSA external functions, PKCS#7 SignedData sign functions,
-#  Diffie-Hellman functions, and authenticode signature verification functions are
-#  not supported in this instance.
+#  Note: MD4 Digest functions, SHA-384 Digest functions, SHA-512 Digest functions,
+#  HMAC-MD5 functions, HMAC-SHA1 functions, AES/TDES/ARC4 functions, RSA external
+#  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and 
+#  authenticode signature verification functions are not supported in this instance.
 #
 #  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -42,6 +42,7 @@
   Hash/CryptMd5.c
   Hash/CryptSha1.c
   Hash/CryptSha256.c
+  Hash/CryptSha512Null.c
   Hmac/CryptHmacMd5Null.c
   Hmac/CryptHmacSha1Null.c
   Cipher/CryptAesNull.c
@@ -50,10 +51,11 @@
   Pk/CryptRsaBasic.c
   Pk/CryptRsaExtNull.c
   Pk/CryptPkcs7SignNull.c
-  Pk/CryptPkcs7Verify.c 
+  Pk/CryptPkcs7Verify.c
   Pk/CryptDhNull.c
   Pk/CryptX509.c
   Pk/CryptAuthenticodeNull.c
+  Pk/CryptTsNull.c
   Pem/CryptPem.c
 
   SysCall/CrtWrapper.c
@@ -61,24 +63,6 @@
   SysCall/RuntimeMemAllocation.c
 
 [Sources.Ia32]
-  SysCall/Ia32/MathMultS64x64.c     | MSFT
-  SysCall/Ia32/MathDivU64x64.c      | MSFT
-  SysCall/Ia32/MathReminderU64x64.c | MSFT
-  SysCall/Ia32/MathLShiftS64.c      | MSFT
-  SysCall/Ia32/MathRShiftU64.c      | MSFT
-
-  SysCall/Ia32/MathMultS64x64.c     | INTEL
-  SysCall/Ia32/MathDivU64x64.c      | INTEL
-  SysCall/Ia32/MathReminderU64x64.c | INTEL
-  SysCall/Ia32/MathLShiftS64.c      | INTEL
-  SysCall/Ia32/MathRShiftU64.c      | INTEL
-
-  SysCall/Ia32/MathMultS64x64.S     | GCC
-  SysCall/Ia32/MathDivU64x64.S      | GCC
-  SysCall/Ia32/MathReminderU64x64.S | GCC
-  SysCall/Ia32/MathLShiftS64.S      | GCC
-  SysCall/Ia32/MathRShiftU64.S      | GCC
-
   Rand/CryptRandTsc.c
 
 [Sources.X64]
@@ -113,4 +97,3 @@
 #
 [BuildOptions]
   GCC:*_GCC44_IA32_CC_FLAGS = "-D__cdecl=__attribute__((cdecl))" "-D__declspec(t)=__attribute__((t))"
-  
diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index b31a785..fa54da6 100644
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -3,23 +3,23 @@
 #
 #  Caution: This module requires additional review when modified.
 #  This library will have external input - signature.
-#  This external input must be validated carefully to avoid security issues such as 
+#  This external input must be validated carefully to avoid security issues such as
 #  buffer overflow or integer overflow.
 #
-#  Note: MD4 Digest functions, HMAC-MD5 functions, HMAC-SHA1 functions, AES/
-#  TDES/ARC4 functions, RSA external functions, PKCS#7 SignedData sign functions,
-#  Diffie-Hellman functions, and authenticode signature verification functions are
-#  not supported in this instance.
+#  Note: MD4 Digest functions, SHA-384 Digest functions, SHA-512 Digest functions,
+#  HMAC-MD5 functions, HMAC-SHA1 functions, AES/TDES/ARC4 functions, RSA external
+#  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and 
+#  authenticode signature verification functions are not supported in this instance.
 #
 #  Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -42,6 +42,7 @@
   Hash/CryptMd5.c
   Hash/CryptSha1.c
   Hash/CryptSha256.c
+  Hash/CryptSha512Null.c
   Hmac/CryptHmacMd5Null.c
   Hmac/CryptHmacSha1Null.c
   Cipher/CryptAesNull.c
@@ -54,6 +55,7 @@
   Pk/CryptDhNull.c
   Pk/CryptX509.c
   Pk/CryptAuthenticodeNull.c
+  Pk/CryptTsNull.c
   Pem/CryptPem.c
 
   SysCall/CrtWrapper.c
@@ -61,24 +63,6 @@
   SysCall/BaseMemAllocation.c
 
 [Sources.Ia32]
-  SysCall/Ia32/MathMultS64x64.c     | MSFT
-  SysCall/Ia32/MathDivU64x64.c      | MSFT
-  SysCall/Ia32/MathReminderU64x64.c | MSFT
-  SysCall/Ia32/MathLShiftS64.c      | MSFT
-  SysCall/Ia32/MathRShiftU64.c      | MSFT
-
-  SysCall/Ia32/MathMultS64x64.c     | INTEL
-  SysCall/Ia32/MathDivU64x64.c      | INTEL
-  SysCall/Ia32/MathReminderU64x64.c | INTEL
-  SysCall/Ia32/MathLShiftS64.c      | INTEL
-  SysCall/Ia32/MathRShiftU64.c      | INTEL
-
-  SysCall/Ia32/MathMultS64x64.S     | GCC
-  SysCall/Ia32/MathDivU64x64.S      | GCC
-  SysCall/Ia32/MathReminderU64x64.S | GCC
-  SysCall/Ia32/MathLShiftS64.S      | GCC
-  SysCall/Ia32/MathRShiftU64.S      | GCC
-
   Rand/CryptRandTsc.c
 
 [Sources.X64]
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.S b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.S
deleted file mode 100644
index f46d5b8..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.S
+++ /dev/null
@@ -1,83 +0,0 @@
-#------------------------------------------------------------------------------
-#
-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-# This program and the accompanying materials
-# are licensed and made available under the terms and conditions of the BSD License
-# which accompanies this distribution.  The full text of the license may be found at
-# http://opensource.org/licenses/bsd-license.php.
-#
-# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#
-# Module Name:
-#
-#   MathDivU64x64.S
-#
-# Abstract:
-#
-#   64-bit Math Worker Function.
-#   Divides a 64-bit unsigned value with a 64-bit unsigned value and returns
-#   a 64-bit unsigned result.
-#
-#------------------------------------------------------------------------------
-
-    .686:
-    .code:
-
-ASM_GLOBAL ASM_PFX(__udivdi3), ASM_PFX(DivU64x64Remainder)
-
-#------------------------------------------------------------------------------
-#
-# void __cdecl __udivdi3 (void)
-#
-#------------------------------------------------------------------------------
-ASM_PFX(__udivdi3):
-    # Original local stack when calling __udivdi3
-    #               -----------------
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--  Divisor  --|
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--  Dividend --|
-    #               |               |
-    #               |---------------|
-    #               |  ReturnAddr** |
-    #       ESP---->|---------------|
-    #
-
-    #
-    # Set up the local stack for NULL Reminder pointer
-    #
-    xorl    %eax, %eax
-    push    %eax
-
-    #
-    # Set up the local stack for Divisor parameter
-    #
-    movl    20(%esp), %eax
-    push    %eax
-    movl    20(%esp), %eax
-    push    %eax
-
-    #
-    # Set up the local stack for Dividend parameter
-    #
-    movl    20(%esp), %eax
-    push    %eax
-    movl    20(%esp), %eax
-    push    %eax
-
-    #
-    # Call native DivU64x64Remainder of BaseLib
-    #
-    jmp     ASM_PFX(DivU64x64Remainder)
-
-    #
-    # Adjust stack
-    #
-    addl    $20, %esp
-
-    ret     $16
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.c b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.c
deleted file mode 100644
index 4011653..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathDivU64x64.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/** @file
-  64-bit Math Worker Function.
-  The 32-bit versions of C compiler generate calls to library routines
-  to handle 64-bit math. These functions use non-standard calling conventions.
-
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <Library/BaseLib.h>
-
-
-/*
- * Divides a 64-bit unsigned value with a 64-bit unsigned value and returns
- * a 64-bit unsigned result.
- */
-__declspec(naked) void __cdecl _aulldiv (void)
-{
-  //
-  // Wrapper Implementation over EDKII DivU64x64Reminder() routine
-  //    UINT64
-  //    EFIAPI
-  //    DivU64x64Remainder (
-  //      IN      UINT64     Dividend,
-  //      IN      UINT64     Divisor,
-  //      OUT     UINT64     *Remainder  OPTIONAL
-  //      )
-  //
-  _asm {
-
-    ; Original local stack when calling _aulldiv
-    ;               -----------------
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--  Divisor  --|
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--  Dividend --|
-    ;               |               |
-    ;               |---------------|
-    ;               |  ReturnAddr** |
-    ;       ESP---->|---------------|
-    ;
-
-    ;
-    ; Set up the local stack for NULL Reminder pointer
-    ;
-    xor  eax, eax
-    push eax
-
-    ;
-    ; Set up the local stack for Divisor parameter
-    ;
-    mov  eax, [esp + 20]
-    push eax
-    mov  eax, [esp + 20]
-    push eax
-
-    ;
-    ; Set up the local stack for Dividend parameter
-    ;
-    mov  eax, [esp + 20]
-    push eax
-    mov  eax, [esp + 20]
-    push eax
-
-    ;
-    ; Call native DivU64x64Remainder of BaseLib
-    ;
-    call DivU64x64Remainder
-
-    ;
-    ; Adjust stack
-    ;
-    add  esp, 20
-
-    ret  16
-  }
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.S b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.S
deleted file mode 100644
index 8a5f330..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.S
+++ /dev/null
@@ -1,77 +0,0 @@
-#------------------------------------------------------------------------------
-#
-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-# This program and the accompanying materials
-# are licensed and made available under the terms and conditions of the BSD License
-# which accompanies this distribution.  The full text of the license may be found at
-# http://opensource.org/licenses/bsd-license.php.
-#
-# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#
-# Module Name:
-#
-#   MathMultS64x64.S
-#
-# Abstract:
-#
-#   64-bit Math Worker Function.
-#   Multiplies a 64-bit signed or unsigned value by a 64-bit signed or unsigned value
-#   and returns a 64-bit result
-#
-#------------------------------------------------------------------------------
-
-    .686:
-    .code:
-
-ASM_GLOBAL ASM_PFX(_mulll), ASM_PFX(MultS64x64)
-
-#------------------------------------------------------------------------------
-#
-# void __cdecl __mulll (void)
-#
-#------------------------------------------------------------------------------
-ASM_PFX(__mulll):
-    # Original local stack when calling __mulll
-    #               -----------------
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--Multiplier --|
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--Multiplicand-|
-    #               |               |
-    #               |---------------|
-    #               |  ReturnAddr** |
-    #       ESP---->|---------------|
-    #
-
-    #
-    # Set up the local stack for Multiplicand parameter
-    #
-    movl    16(%esp), %eax
-    push    %eax
-    movl    16(%esp), %eax
-    push    %eax
-
-    #
-    # Set up the local stack for Multiplier parameter
-    #
-    movl    16(%esp), %eax
-    push    %eax
-    movl    16(%esp), %eax
-    push    %eax
-
-    #
-    # Call native MulS64x64 of BaseLib
-    #
-    jmp     ASM_PFX(MultS64x64)
-
-    #
-    # Adjust stack
-    #
-    add     $16, %esp
-
-    ret     $16
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.c b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.c
deleted file mode 100644
index 17a20bf..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathMultS64x64.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/** @file
-  64-bit Math Worker Function.
-  The 32-bit versions of C compiler generate calls to library routines
-  to handle 64-bit math. These functions use non-standard calling conventions.
-  
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <Library/BaseLib.h>
-
-/*
- * Multiplies a 64-bit signed or unsigned value by a 64-bit signed or unsigned value
- * and returns a 64-bit result.
- */
-__declspec(naked) void __cdecl _allmul (void)
-{
-  //
-  // Wrapper Implementation over EDKII MultS64x64() routine
-  //    INT64
-  //    EFIAPI
-  //    MultS64x64 (
-  //      IN      INT64      Multiplicand,
-  //      IN      INT64      Multiplier
-  //      )
-  //
-  _asm {
-    ; Original local stack when calling _allmul
-    ;               -----------------
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--Multiplier --|
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--Multiplicand-|
-    ;               |               |
-    ;               |---------------|
-    ;               |  ReturnAddr** |
-    ;       ESP---->|---------------|
-    ;
-
-    ;
-    ; Set up the local stack for Multiplicand parameter
-    ;
-    mov  eax, [esp + 16]
-    push eax
-    mov  eax, [esp + 16]
-    push eax
-
-    ;
-    ; Set up the local stack for Multiplier parameter
-    ;
-    mov  eax, [esp + 16]
-    push eax
-    mov  eax, [esp + 16]
-    push eax
-
-    ;
-    ; Call native MulS64x64 of BaseLib
-    ;
-    call MultS64x64
-
-    ;
-    ; Adjust stack
-    ;
-    add  esp, 16
-
-    ret  16
-  }
-} 
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.S b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.S
deleted file mode 100644
index 7c1f971..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.S
+++ /dev/null
@@ -1,89 +0,0 @@
-#------------------------------------------------------------------------------
-#
-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-# This program and the accompanying materials
-# are licensed and made available under the terms and conditions of the BSD License
-# which accompanies this distribution.  The full text of the license may be found at
-# http://opensource.org/licenses/bsd-license.php.
-#
-# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#
-# Module Name:
-#
-#   MathReminderU64x64.S
-#
-# Abstract:
-#
-#   64-bit Math Worker Function.
-#   Divides a 64-bit unsigned value by another 64-bit unsigned value and returns
-#   the 64-bit unsigned remainder
-#
-#------------------------------------------------------------------------------
-
-    .686:
-    .code:
-
-ASM_GLOBAL ASM_PFX(__umoddi3), ASM_PFX(DivU64x64Remainder)
-
-#------------------------------------------------------------------------------
-#
-# void __cdecl __umoddi3 (void)
-#
-#------------------------------------------------------------------------------
-ASM_PFX(__umoddi3):
-    # Original local stack when calling __umoddi3
-    #               -----------------
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--  Divisor  --|
-    #               |               |
-    #               |---------------|
-    #               |               |
-    #               |--  Dividend --|
-    #               |               |
-    #               |---------------|
-    #               |  ReturnAddr** |
-    #       ESP---->|---------------|
-    #
-
-    #
-    # Set up the local stack for Reminder pointer
-    #
-    sub     $8, %esp
-    push    %esp
-
-    #
-    # Set up the local stack for Divisor parameter
-    #
-    movl    28(%esp), %eax
-    push    %eax
-    movl    28(%esp), %eax
-    push    %eax
-
-    #
-    # Set up the local stack for Dividend parameter
-    #
-    movl    28(%esp), %eax
-    push    %eax
-    movl    28(%esp), %eax
-    push    %eax
-
-    #
-    # Call native DivU64x64Remainder of BaseLib
-    #
-    jmp     ASM_PFX(DivU64x64Remainder)
-
-    #
-    # Put the Reminder in EDX:EAX as return value
-    #
-    movl    20(%esp), %eax
-    movl    24(%esp), %edx
-
-    #
-    # Adjust stack
-    #
-    add     $28, %esp
-    
-    ret     $16
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.c b/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.c
deleted file mode 100644
index be70770..0000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathReminderU64x64.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/** @file
-  64-bit Math Worker Function.
-  The 32-bit versions of C compiler generate calls to library routines
-  to handle 64-bit math. These functions use non-standard calling conventions.
-
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution.  The full text of the license may be found at
-http://opensource.org/licenses/bsd-license.php
-
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-
-**/
-
-#include <Library/BaseLib.h>
-
-
-/*
- * Divides a 64-bit unsigned value by another 64-bit unsigned value and returns
- * the 64-bit unsigned remainder.
- */
-__declspec(naked) void __cdecl _aullrem(void)
-{
-  //
-  // Wrapper Implementation over EDKII DivU64x64Remainder() routine
-  //    UINT64
-  //    EFIAPI
-  //    DivU64x64Remainder (
-  //      IN      UINT64     Dividend,
-  //      IN      UINT64     Divisor,
-  //      OUT     UINT64     *Remainder  OPTIONAL
-  //      )
-  //
-  _asm {
-    ; Original local stack when calling _aullrem
-    ;               -----------------
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--  Divisor  --|
-    ;               |               |
-    ;               |---------------|
-    ;               |               |
-    ;               |--  Dividend --|
-    ;               |               |
-    ;               |---------------|
-    ;               |  ReturnAddr** |
-    ;       ESP---->|---------------|
-    ;
-
-    ;
-    ; Set up the local stack for Reminder pointer
-    ;
-    sub  esp, 8
-    push esp
-
-    ;
-    ; Set up the local stack for Divisor parameter
-    ;
-    mov  eax, [esp + 28]
-    push eax
-    mov  eax, [esp + 28]
-    push eax
-
-    ;
-    ; Set up the local stack for Dividend parameter
-    ;
-    mov  eax, [esp + 28]
-    push eax
-    mov  eax, [esp + 28]
-    push eax
-
-    ;
-    ; Call native DivU64x64Remainder of BaseLib
-    ;
-    call DivU64x64Remainder
-
-    ;
-    ; Put the Reminder in EDX:EAX as return value
-    ;
-    mov  eax, [esp + 20]
-    mov  edx, [esp + 24]
-
-    ;
-    ; Adjust stack
-    ;
-    add  esp, 28
-
-    ret  16
-  }
-}
diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
index 9a4c77a..09b92c7 100644
--- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
+++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptPkcs7VerifyNull.c
@@ -2,7 +2,7 @@
   PKCS#7 SignedData Verification Wrapper Implementation which does not provide
   real capabilities.
 
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2015, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -98,3 +98,32 @@
   ASSERT (FALSE);
   return FALSE;
 }
+
+/**
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+  data could be wrapped in a ContentInfo structure.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
+                            It's caller's responsiblity to free the buffer.
+  @param[out]  ContentSize  The size of the extracted content in bytes.
+
+  @retval     TRUE          The P7Data was correctly formatted for processing.
+  @retval     FALSE         The P7Data was not correctly formatted for processing.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7GetAttachedContent (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT VOID         **Content,
+  OUT UINTN        *ContentSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c
index 5dbddca..f5d9aa1 100644
--- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c
+++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/Pk/CryptX509Null.c
@@ -2,7 +2,7 @@
   X.509 Certificate Handler Wrapper Implementation which does not provide
   real capabilities.
 
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2012 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -44,7 +44,7 @@
 
   Return FALSE to indicate this interface is not supported.
 
-  @param[in, out]  X509Stack  On input, pointer to an existing X509 stack object.
+  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
                               On output, pointer to the X509 stack object with new
                               inserted X509 certificate.
   @param           ...        A list of DER-encoded single certificate data followed
@@ -178,3 +178,29 @@
   ASSERT (FALSE);
   return FALSE;
 }
+
+/**
+  Retrieve the TBSCertificate from one given X.509 certificate.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
+  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetTBSCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  OUT UINT8        **TBSCert,
+  OUT UINTN        *TBSCertSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
\ No newline at end of file
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.S b/CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.S
similarity index 95%
rename from CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.S
rename to CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.S
index e89f553..7031a59 100644
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.S
+++ b/CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.S
@@ -1,6 +1,6 @@
 #------------------------------------------------------------------------------
 #
-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
 # which accompanies this distribution.  The full text of the license may be found at
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.c b/CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.c
similarity index 91%
rename from CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.c
rename to CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.c
index 2ea628a..0c0835d 100644
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathLShiftS64.c
+++ b/CryptoPkg/Library/IntrinsicLib/Ia32/MathLShiftS64.c
@@ -3,7 +3,7 @@
   The 32-bit versions of C compiler generate calls to library routines
   to handle 64-bit math. These functions use non-standard calling conventions.
 
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -30,7 +30,7 @@
     ;
     ; Handle shifting of between 0 and 31 bits
     ;
-    cmp     cl, 32              
+    cmp     cl, 32
     jae     short More32
     shld    edx, eax, cl
     shl     eax, cl
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.S b/CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.S
similarity index 95%
rename from CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.S
rename to CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.S
index bf05875..24142b0 100644
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.S
+++ b/CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.S
@@ -1,6 +1,6 @@
 #------------------------------------------------------------------------------
 #
-# Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
 # which accompanies this distribution.  The full text of the license may be found at
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.c b/CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.c
similarity index 94%
rename from CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.c
rename to CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.c
index b7224d6..86b1004 100644
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/Ia32/MathRShiftU64.c
+++ b/CryptoPkg/Library/IntrinsicLib/Ia32/MathRShiftU64.c
@@ -3,7 +3,7 @@
   The 32-bit versions of C compiler generate calls to library routines
   to handle 64-bit math. These functions use non-standard calling conventions.
 
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
diff --git a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
index 08a31ee..d606345 100644
--- a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+++ b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
@@ -1,15 +1,15 @@
 ## @file
 #  Intrinsic Routines Wrapper Library Instance.
 #
-#  Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>
+#  Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -32,6 +32,15 @@
 [Sources.IA32]
   CopyMem.c
 
+  Ia32/MathLShiftS64.c      | MSFT
+  Ia32/MathRShiftU64.c      | MSFT
+
+  Ia32/MathLShiftS64.c      | INTEL
+  Ia32/MathRShiftU64.c      | INTEL
+
+  Ia32/MathLShiftS64.S      | GCC
+  Ia32/MathRShiftU64.S      | GCC
+
 [Sources.X64]
   CopyMem.c
 
@@ -69,4 +78,4 @@
    MSFT:DEBUG_*_IPF_CC_FLAGS              == /nologo /c /WX /GS- /X /W4 /EHs-c- /GR- /Gy /Os /FIAutoGen.h /QIPF_fr32 /Zi
    MSFT:RELEASE_*_IPF_CC_FLAGS            == /nologo /c /WX /GS- /X /W4 /EHs-c- /GR- /Gy /Os /FIAutoGen.h /QIPF_fr32
   INTEL:*_*_*_CC_FLAGS                    =  /Oi-
-    GCC:*_*_*_CC_FLAGS                    =  -fno-builtin
+    GCC:*_*_*_CC_FLAGS                    =  -fno-builtin
\ No newline at end of file
diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8zf.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8zf.patch
deleted file mode 100644
index 4abe62c..0000000
--- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-0.9.8zf.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-Index: crypto/bio/bss_file.c
-===================================================================
---- crypto/bio/bss_file.c	(revision 1)
-+++ crypto/bio/bss_file.c	(working copy)
-@@ -418,6 +418,23 @@
-     return (ret);
- }
- 
-+#else
-+
-+BIO_METHOD *BIO_s_file(void)
-+{
-+    return NULL;
-+}
-+
-+BIO *BIO_new_file(const char *filename, const char *mode)
-+{
-+    return NULL;
-+}
-+
-+BIO *BIO_new_fp(FILE *stream, int close_flag)
-+{
-+    return NULL;
-+}
-+
- # endif                         /* OPENSSL_NO_STDIO */
- 
- #endif                          /* HEADER_BSS_FILE_C */
-Index: crypto/crypto.h
-===================================================================
---- crypto/crypto.h	(revision 1)
-+++ crypto/crypto.h	(working copy)
-@@ -239,15 +239,15 @@
- # ifndef OPENSSL_NO_LOCKING
- #  ifndef CRYPTO_w_lock
- #   define CRYPTO_w_lock(type)     \
--        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
-+        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,NULL,0)
- #   define CRYPTO_w_unlock(type)   \
--        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
-+        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,NULL,0)
- #   define CRYPTO_r_lock(type)     \
--        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,__FILE__,__LINE__)
-+        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,NULL,0)
- #   define CRYPTO_r_unlock(type)   \
--        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,__FILE__,__LINE__)
-+        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,NULL,0)
- #   define CRYPTO_add(addr,amount,type)    \
--        CRYPTO_add_lock(addr,amount,type,__FILE__,__LINE__)
-+        CRYPTO_add_lock(addr,amount,type,NULL,0)
- #  endif
- # else
- #  define CRYPTO_w_lock(a)
-@@ -374,19 +374,19 @@
- # define MemCheck_off()  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE)
- # define is_MemCheck_on() CRYPTO_is_mem_check_on()
- 
--# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,__FILE__,__LINE__)
--# define OPENSSL_strdup(str)     CRYPTO_strdup((str),__FILE__,__LINE__)
-+# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,NULL,0)
-+# define OPENSSL_strdup(str)     CRYPTO_strdup((str),NULL,0)
- # define OPENSSL_realloc(addr,num) \
--        CRYPTO_realloc((char *)addr,(int)num,__FILE__,__LINE__)
-+        CRYPTO_realloc((char *)addr,(int)num,NULL,0)
- # define OPENSSL_realloc_clean(addr,old_num,num) \
--        CRYPTO_realloc_clean(addr,old_num,num,__FILE__,__LINE__)
-+        CRYPTO_realloc_clean(addr,old_num,num,NULL,0)
- # define OPENSSL_remalloc(addr,num) \
--        CRYPTO_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
-+        CRYPTO_remalloc((char **)addr,(int)num,NULL,0)
- # define OPENSSL_freeFunc        CRYPTO_free
- # define OPENSSL_free(addr)      CRYPTO_free(addr)
- 
- # define OPENSSL_malloc_locked(num) \
--        CRYPTO_malloc_locked((int)num,__FILE__,__LINE__)
-+        CRYPTO_malloc_locked((int)num,NULL,0)
- # define OPENSSL_free_locked(addr) CRYPTO_free_locked(addr)
- 
- const char *SSLeay_version(int type);
-@@ -531,7 +531,7 @@
- long CRYPTO_get_mem_debug_options(void);
- 
- # define CRYPTO_push_info(info) \
--        CRYPTO_push_info_(info, __FILE__, __LINE__);
-+        CRYPTO_push_info_(info, NULL, 0);
- int CRYPTO_push_info_(const char *info, const char *file, int line);
- int CRYPTO_pop_info(void);
- int CRYPTO_remove_all_info(void);
-@@ -578,7 +578,7 @@
- 
- /* die if we have to */
- void OpenSSLDie(const char *file, int line, const char *assertion);
--# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(__FILE__, __LINE__, #e),1))
-+# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(NULL, 0, #e),1))
- 
- unsigned long *OPENSSL_ia32cap_loc(void);
- # define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
-@@ -585,10 +585,10 @@
- int OPENSSL_isservice(void);
- 
- # ifdef OPENSSL_FIPS
--#  define FIPS_ERROR_IGNORED(alg) OpenSSLDie(__FILE__, __LINE__, \
-+#  define FIPS_ERROR_IGNORED(alg) OpenSSLDie(NULL, 0, \
-                 alg " previous FIPS forbidden algorithm error ignored");
- 
--#  define FIPS_BAD_ABORT(alg) OpenSSLDie(__FILE__, __LINE__, \
-+#  define FIPS_BAD_ABORT(alg) OpenSSLDie(NULL, 0, \
-                 #alg " Algorithm forbidden in FIPS mode");
- 
- #  ifdef OPENSSL_FIPS_STRICT
-Index: crypto/err/err.c
-===================================================================
---- crypto/err/err.c	(revision 1)
-+++ crypto/err/err.c	(working copy)
-@@ -321,7 +321,12 @@
-     es->err_data_flags[i] = flags;
- }
- 
-+/* Add EFIAPI for UEFI version. */
-+#if defined(OPENSSL_SYS_UEFI)
-+void EFIAPI ERR_add_error_data(int num, ...)
-+#else
- void ERR_add_error_data(int num, ...)
-+#endif
- {
-     va_list args;
-     int i, n, s;
-Index: crypto/err/err.h
-===================================================================
---- crypto/err/err.h	(revision 1)
-+++ crypto/err/err.h	(working copy)
-@@ -285,7 +285,13 @@
- # endif
- # ifndef OPENSSL_NO_BIO
- void ERR_print_errors(BIO *bp);
-+
-+/* Add EFIAPI for UEFI version. */
-+#if defined(OPENSSL_SYS_UEFI)
-+void EFIAPI ERR_add_error_data(int num, ...);
-+#else
- void ERR_add_error_data(int num, ...);
-+#endif
- # endif
- void ERR_load_strings(int lib, ERR_STRING_DATA str[]);
- void ERR_unload_strings(int lib, ERR_STRING_DATA str[]);
-Index: crypto/opensslconf.h
-===================================================================
---- crypto/opensslconf.h	(revision 1)
-+++ crypto/opensslconf.h	(working copy)
-@@ -162,6 +162,9 @@
- /* The prime number generation stuff may not work when
-  * EIGHT_BIT but I don't care since I've only used this mode
-  * for debuging the bignum libraries */
-+
-+/* Bypass following definition for UEFI version. */
-+#if !defined(OPENSSL_SYS_UEFI)
- #undef SIXTY_FOUR_BIT_LONG
- #undef SIXTY_FOUR_BIT
- #define THIRTY_TWO_BIT
-@@ -169,6 +172,8 @@
- #undef EIGHT_BIT
- #endif
- 
-+#endif
-+
- #if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
- #define CONFIG_HEADER_RC4_LOCL_H
- /* if this is defined data[i] is used instead of *data, this is a %20
-Index: crypto/pkcs7/pk7_smime.c
-===================================================================
---- crypto/pkcs7/pk7_smime.c	(revision 1)
-+++ crypto/pkcs7/pk7_smime.c	(working copy)
-@@ -90,7 +90,14 @@
-     if (!PKCS7_content_new(p7, NID_pkcs7_data))
-         goto err;
- 
-+#if defined(OPENSSL_SYS_UEFI)
-+    /*
-+     * NOTE: Update to SHA-256 digest algorithm for UEFI version.
-+     */
-+    if (!(si = PKCS7_add_signature(p7, signcert, pkey, EVP_sha256()))) {
-+#else
-     if (!(si = PKCS7_add_signature(p7, signcert, pkey, EVP_sha1()))) {
-+#endif
-         PKCS7err(PKCS7_F_PKCS7_SIGN, PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
-         goto err;
-     }
-@@ -175,7 +182,8 @@
-     STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
-     PKCS7_SIGNER_INFO *si;
-     X509_STORE_CTX cert_ctx;
--    char buf[4096];
-+    char *buf = NULL;
-+    int bufsiz;
-     int i, j = 0, k, ret = 0;
-     BIO *p7bio;
-     BIO *tmpin, *tmpout;
-@@ -286,6 +294,12 @@
-     } else
-         tmpout = out;
- 
-+    bufsiz = 4096;
-+    buf = OPENSSL_malloc (bufsiz);
-+    if (buf == NULL) {
-+      goto err;
-+    }
-+
-     /* We now have to 'read' from p7bio to calculate digests etc. */
-     for (;;) {
-         i = BIO_read(p7bio, buf, sizeof(buf));
-@@ -328,6 +342,10 @@
- 
-     sk_X509_free(signers);
- 
-+    if (buf != NULL) {
-+      OPENSSL_free (buf);
-+    }
-+
-     return ret;
- }
- 
-Index: crypto/rand/rand_egd.c
-===================================================================
---- crypto/rand/rand_egd.c	(revision 1)
-+++ crypto/rand/rand_egd.c	(working copy)
-@@ -95,7 +95,7 @@
-  *   RAND_egd() is a wrapper for RAND_egd_bytes() with numbytes=255.
-  */
- 
--#if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_VOS)
-+#if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_VOS) || defined(OPENSSL_SYS_UEFI)
- int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
- {
-     return (-1);
-Index: crypto/rand/rand_unix.c
-===================================================================
---- crypto/rand/rand_unix.c	(revision 1)
-+++ crypto/rand/rand_unix.c	(working copy)
-@@ -116,7 +116,7 @@
- #include <openssl/rand.h>
- #include "rand_lcl.h"
- 
--#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE))
-+#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_UEFI))
- 
- # include <sys/types.h>
- # include <sys/time.h>
-@@ -332,7 +332,7 @@
-                                  * defined(OPENSSL_SYS_VXWORKS) ||
-                                  * defined(OPENSSL_SYS_NETWARE)) */
- 
--#if defined(OPENSSL_SYS_VXWORKS)
-+#if defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_UEFI)
- int RAND_poll(void)
- {
-     return 0;
-Index: crypto/x509/x509_vfy.c
-===================================================================
---- crypto/x509/x509_vfy.c	(revision 1)
-+++ crypto/x509/x509_vfy.c	(working copy)
-@@ -871,6 +871,10 @@
- 
- static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)
- {
-+#if defined(OPENSSL_SYS_UEFI)
-+  /* Bypass Certificate Time Checking for UEFI version. */
-+  return 1;
-+#else
-     time_t *ptime;
-     int i;
- 
-@@ -910,6 +914,7 @@
-     }
- 
-     return 1;
-+#endif
- }
- 
- static int internal_verify(X509_STORE_CTX *ctx)
diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch
new file mode 100644
index 0000000..72e5f3d
--- /dev/null
+++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch
@@ -0,0 +1,380 @@
+diff U3 crypto/bio/bio.h crypto/bio/bio.h
+--- crypto/bio/bio.h	Thu Jun 11 21:50:12 2015
++++ crypto/bio/bio.h	Fri Jun 12 11:00:52 2015
+@@ -646,10 +646,10 @@
+ int BIO_asn1_get_suffix(BIO *b, asn1_ps_func **psuffix,
+                         asn1_ps_func **psuffix_free);
+ 
+-# ifndef OPENSSL_NO_FP_API
+ BIO_METHOD *BIO_s_file(void);
+ BIO *BIO_new_file(const char *filename, const char *mode);
+ BIO *BIO_new_fp(FILE *stream, int close_flag);
++# ifndef OPENSSL_NO_FP_API
+ #  define BIO_s_file_internal    BIO_s_file
+ # endif
+ BIO *BIO_new(BIO_METHOD *type);
+diff U3 crypto/bio/bss_file.c crypto/bio/bss_file.c
+--- crypto/bio/bss_file.c	Thu Jun 11 21:01:06 2015
++++ crypto/bio/bss_file.c	Fri Jun 12 11:01:28 2015
+@@ -460,6 +460,23 @@
+     return (ret);
+ }
+ 
++# else
++
++BIO_METHOD *BIO_s_file(void)
++{
++    return NULL;
++}
++
++BIO *BIO_new_file(const char *filename, const char *mode)
++{
++    return NULL;
++}
++
++BIO *BIO_new_fp(FILE *stream, int close_flag)
++{
++    return NULL;
++}
++
+ # endif                         /* OPENSSL_NO_STDIO */
+ 
+ #endif                          /* HEADER_BSS_FILE_C */
+diff U3 crypto/dh/dh_pmeth.c crypto/dh/dh_pmeth.c
+--- crypto/dh/dh_pmeth.c	Thu Jun 11 21:50:12 2015
++++ crypto/dh/dh_pmeth.c	Fri Jun 12 11:08:48 2015
+@@ -449,6 +449,9 @@
+         *keylen = ret;
+         return 1;
+     } else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) {
++#ifdef OPENSSL_NO_CMS
++        return 0;
++#else
+         unsigned char *Z = NULL;
+         size_t Zlen = 0;
+         if (!dctx->kdf_outlen || !dctx->kdf_oid)
+@@ -478,6 +481,7 @@
+             OPENSSL_free(Z);
+         }
+         return ret;
++#endif
+     }
+     return 1;
+ }
+diff U3 crypto/pem/pem.h crypto/pem/pem.h
+--- crypto/pem/pem.h	Thu Jun 11 21:50:12 2015
++++ crypto/pem/pem.h	Fri Jun 12 10:58:18 2015
+@@ -324,6 +324,7 @@
+ 
+ #  define DECLARE_PEM_read_fp(name, type) /**/
+ #  define DECLARE_PEM_write_fp(name, type) /**/
++#  define DECLARE_PEM_write_fp_const(name, type) /**/
+ #  define DECLARE_PEM_write_cb_fp(name, type) /**/
+ # else
+ 
+diff U3 crypto/pkcs7/pk7_smime.c crypto/pkcs7/pk7_smime.c
+--- crypto/pkcs7/pk7_smime.c	Thu Jun 11 21:01:06 2015
++++ crypto/pkcs7/pk7_smime.c	Fri Jun 12 11:23:38 2015
+@@ -254,7 +254,8 @@
+     STACK_OF(PKCS7_SIGNER_INFO) *sinfos;
+     PKCS7_SIGNER_INFO *si;
+     X509_STORE_CTX cert_ctx;
+-    char buf[4096];
++    char *buf = NULL;
++    int bufsiz;
+     int i, j = 0, k, ret = 0;
+     BIO *p7bio;
+     BIO *tmpin, *tmpout;
+@@ -365,9 +366,14 @@
+     } else
+         tmpout = out;
+ 
++    bufsiz = 4096;
++    buf = OPENSSL_malloc(bufsiz);
++    if (buf == NULL) {
++        goto err;
++    }
+     /* We now have to 'read' from p7bio to calculate digests etc. */
+     for (;;) {
+-        i = BIO_read(p7bio, buf, sizeof(buf));
++        i = BIO_read(p7bio, buf, bufsiz);
+         if (i <= 0)
+             break;
+         if (tmpout)
+@@ -406,6 +412,10 @@
+     BIO_free_all(p7bio);
+ 
+     sk_X509_free(signers);
++
++    if (buf != NULL) {
++      OPENSSL_free(buf);
++    }
+ 
+     return ret;
+ }
+diff U3 crypto/rand/rand_unix.c crypto/rand/rand_unix.c
+--- crypto/rand/rand_unix.c	Thu Jun 11 21:01:06 2015
++++ crypto/rand/rand_unix.c	Fri Jun 12 10:51:21 2015
+@@ -116,7 +116,7 @@
+ #include <openssl/rand.h>
+ #include "rand_lcl.h"
+ 
+-#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE))
++#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_UEFI))
+ 
+ # include <sys/types.h>
+ # include <sys/time.h>
+@@ -439,7 +439,7 @@
+                                  * defined(OPENSSL_SYS_VXWORKS) ||
+                                  * defined(OPENSSL_SYS_NETWARE)) */
+ 
+-#if defined(OPENSSL_SYS_VXWORKS)
++#if defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_UEFI)
+ int RAND_poll(void)
+ {
+     return 0;
+diff U3 crypto/rsa/rsa_ameth.c crypto/rsa/rsa_ameth.c
+--- crypto/rsa/rsa_ameth.c	Thu Jun 11 21:50:12 2015
++++ crypto/rsa/rsa_ameth.c	Fri Jun 12 10:45:38 2015
+@@ -68,10 +68,12 @@
+ #endif
+ #include "asn1_locl.h"
+ 
++#ifndef OPENSSL_NO_CMS
+ static int rsa_cms_sign(CMS_SignerInfo *si);
+ static int rsa_cms_verify(CMS_SignerInfo *si);
+ static int rsa_cms_decrypt(CMS_RecipientInfo *ri);
+ static int rsa_cms_encrypt(CMS_RecipientInfo *ri);
++#endif
+ 
+ static int rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
+ {
+@@ -665,6 +667,7 @@
+     return rv;
+ }
+ 
++#ifndef OPENSSL_NO_CMS
+ static int rsa_cms_verify(CMS_SignerInfo *si)
+ {
+     int nid, nid2;
+@@ -683,6 +686,7 @@
+     }
+     return 0;
+ }
++#endif
+ 
+ /*
+  * Customised RSA item verification routine. This is called when a signature
+@@ -705,6 +709,7 @@
+     return -1;
+ }
+ 
++#ifndef OPENSSL_NO_CMS
+ static int rsa_cms_sign(CMS_SignerInfo *si)
+ {
+     int pad_mode = RSA_PKCS1_PADDING;
+@@ -729,6 +734,7 @@
+     X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsassaPss), V_ASN1_SEQUENCE, os);
+     return 1;
+ }
++#endif
+ 
+ static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
+                          X509_ALGOR *alg1, X509_ALGOR *alg2,
+@@ -785,6 +791,7 @@
+     return pss;
+ }
+ 
++#ifndef OPENSSL_NO_CMS
+ static int rsa_cms_decrypt(CMS_RecipientInfo *ri)
+ {
+     EVP_PKEY_CTX *pkctx;
+@@ -857,7 +864,9 @@
+         X509_ALGOR_free(maskHash);
+     return rv;
+ }
++#endif
+ 
++#ifndef OPENSSL_NO_CMS
+ static int rsa_cms_encrypt(CMS_RecipientInfo *ri)
+ {
+     const EVP_MD *md, *mgf1md;
+@@ -920,6 +929,7 @@
+         ASN1_STRING_free(os);
+     return rv;
+ }
++#endif
+ 
+ const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[] = {
+     {
+diff U3 crypto/x509/x509_vfy.c crypto/x509/x509_vfy.c
+--- crypto/x509/x509_vfy.c	Thu Jun 11 21:52:58 2015
++++ crypto/x509/x509_vfy.c	Fri Jun 12 11:29:37 2015
+@@ -1653,6 +1653,10 @@
+ 
+ static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)
+ {
++#ifdef OPENSSL_SYS_UEFI
++    /* Bypass Certificate Time Checking for UEFI version. */
++    return 1;
++#else
+     time_t *ptime;
+     int i;
+ 
+@@ -1692,6 +1696,7 @@
+     }
+ 
+     return 1;
++#endif
+ }
+ 
+ static int internal_verify(X509_STORE_CTX *ctx)
+diff U3 crypto/x509v3/ext_dat.h crypto/x509v3/ext_dat.h
+--- crypto/x509v3/ext_dat.h	Thu Jun 11 21:50:12 2015
++++ crypto/x509v3/ext_dat.h	Fri Jun 12 11:11:03 2015
+@@ -127,8 +127,10 @@
+     &v3_idp,
+     &v3_alt[2],
+     &v3_freshest_crl,
++#ifndef OPENSSL_SYS_UEFI
+     &v3_ct_scts[0],
+     &v3_ct_scts[1],
++#endif
+ };
+ 
+ /* Number of standard extensions */
+diff U3 crypto/crypto.h crypto/crypto.h
+--- crypto/crypto.h	Thu Jun 11 21:01:06 2015
++++ crypto/crypto.h	Fri Jun 12 11:33:27 2015
+@@ -235,15 +235,15 @@
+ # ifndef OPENSSL_NO_LOCKING
+ #  ifndef CRYPTO_w_lock
+ #   define CRYPTO_w_lock(type)     \
+-        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
++        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,NULL,0)
+ #   define CRYPTO_w_unlock(type)   \
+-        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
++        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,NULL,0)
+ #   define CRYPTO_r_lock(type)     \
+-        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,__FILE__,__LINE__)
++        CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,NULL,0)
+ #   define CRYPTO_r_unlock(type)   \
+-        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,__FILE__,__LINE__)
++        CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,NULL,0)
+ #   define CRYPTO_add(addr,amount,type)    \
+-        CRYPTO_add_lock(addr,amount,type,__FILE__,__LINE__)
++        CRYPTO_add_lock(addr,amount,type,NULL,0)
+ #  endif
+ # else
+ #  define CRYPTO_w_lock(a)
+@@ -378,19 +378,19 @@
+ # define MemCheck_off()  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE)
+ # define is_MemCheck_on() CRYPTO_is_mem_check_on()
+ 
+-# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,__FILE__,__LINE__)
+-# define OPENSSL_strdup(str)     CRYPTO_strdup((str),__FILE__,__LINE__)
++# define OPENSSL_malloc(num)     CRYPTO_malloc((int)num,NULL,0)
++# define OPENSSL_strdup(str)     CRYPTO_strdup((str),NULL,0)
+ # define OPENSSL_realloc(addr,num) \
+-        CRYPTO_realloc((char *)addr,(int)num,__FILE__,__LINE__)
++        CRYPTO_realloc((char *)addr,(int)num,NULL,0)
+ # define OPENSSL_realloc_clean(addr,old_num,num) \
+-        CRYPTO_realloc_clean(addr,old_num,num,__FILE__,__LINE__)
++        CRYPTO_realloc_clean(addr,old_num,num,NULL,0)
+ # define OPENSSL_remalloc(addr,num) \
+-        CRYPTO_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
++        CRYPTO_remalloc((char **)addr,(int)num,NULL,0)
+ # define OPENSSL_freeFunc        CRYPTO_free
+ # define OPENSSL_free(addr)      CRYPTO_free(addr)
+ 
+ # define OPENSSL_malloc_locked(num) \
+-        CRYPTO_malloc_locked((int)num,__FILE__,__LINE__)
++        CRYPTO_malloc_locked((int)num,NULL,0)
+ # define OPENSSL_free_locked(addr) CRYPTO_free_locked(addr)
+ 
+ const char *SSLeay_version(int type);
+@@ -545,7 +545,7 @@
+ long CRYPTO_get_mem_debug_options(void);
+ 
+ # define CRYPTO_push_info(info) \
+-        CRYPTO_push_info_(info, __FILE__, __LINE__);
++        CRYPTO_push_info_(info, NULL, 0);
+ int CRYPTO_push_info_(const char *info, const char *file, int line);
+ int CRYPTO_pop_info(void);
+ int CRYPTO_remove_all_info(void);
+@@ -588,7 +588,7 @@
+ 
+ /* die if we have to */
+ void OpenSSLDie(const char *file, int line, const char *assertion);
+-# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(__FILE__, __LINE__, #e),1))
++# define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(NULL, 0, #e),1))
+ 
+ unsigned long *OPENSSL_ia32cap_loc(void);
+ # define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
+@@ -605,14 +605,14 @@
+ #  define fips_md_init_ctx(alg, cx) \
+         int alg##_Init(cx##_CTX *c) \
+         { \
+-        if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
++        if (FIPS_mode()) OpenSSLDie(NULL, 0, \
+                 "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
+         return private_##alg##_Init(c); \
+         } \
+         int private_##alg##_Init(cx##_CTX *c)
+ 
+ #  define fips_cipher_abort(alg) \
+-        if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
++        if (FIPS_mode()) OpenSSLDie(NULL, 0, \
+                 "Low level API call to cipher " #alg " forbidden in FIPS mode!")
+ 
+ # else
+diff U3 crypto/opensslconf.h crypto/opensslconf.h
+--- crypto/opensslconf.h	Thu Jun 11 21:55:38 2015
++++ crypto/opensslconf.h	Fri Jun 12 10:28:27 2015
+@@ -159,9 +159,12 @@
+ /* Should we define BN_DIV2W here? */
+ 
+ /* Only one for the following should be defined */
++/* Bypass the following definitions for UEFI version. */
++#if !defined(OPENSSL_SYS_UEFI)
+ #undef SIXTY_FOUR_BIT_LONG
+ #undef SIXTY_FOUR_BIT
+ #define THIRTY_TWO_BIT
++#endif
+ #endif
+ 
+ #if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
+diff U3 crypto/err/err.c crypto/err/err.c
+--- crypto/err/err.c
++++ crypto/err/err.c
+@@ -1072,7 +1072,12 @@ void ERR_set_error_data(char *data, int flags)
+     es->err_data_flags[i] = flags;
+ }
+ 
++/* Add EFIAPI for UEFI version. */
++#if defined(OPENSSL_SYS_UEFI)
++void EFIAPI ERR_add_error_data(int num, ...)
++#else
+ void ERR_add_error_data(int num, ...)
++#endif
+ {
+     va_list args;
+     va_start(args, num);
+diff U3 crypto/err/err.h crypto/err/err.h
+--- crypto/err/err.h
++++ crypto/err/err.h
+@@ -344,7 +344,14 @@ void ERR_print_errors_fp(FILE *fp);
+ # ifndef OPENSSL_NO_BIO
+ void ERR_print_errors(BIO *bp);
+ # endif
++
++/* Add EFIAPI for UEFI version. */
++#if defined(OPENSSL_SYS_UEFI)
++void EFIAPI ERR_add_error_data(int num, ...);
++#else
+ void ERR_add_error_data(int num, ...);
++#endif
++
+ void ERR_add_error_vdata(int num, va_list args);
+ void ERR_load_strings(int lib, ERR_STRING_DATA str[]);
+ void ERR_unload_strings(int lib, ERR_STRING_DATA str[]);
diff --git a/CryptoPkg/Library/OpensslLib/Install.cmd b/CryptoPkg/Library/OpensslLib/Install.cmd
index 8f1d016..ef0a4bd 100755
--- a/CryptoPkg/Library/OpensslLib/Install.cmd
+++ b/CryptoPkg/Library/OpensslLib/Install.cmd
@@ -1,71 +1,77 @@
-cd openssl-0.9.8zf
-copy e_os2.h              ..\..\..\Include\openssl
-copy crypto\crypto.h  ..\..\..\Include\openssl
-copy crypto\tmdiff.h  ..\..\..\Include\openssl
-copy crypto\opensslv.h ..\..\..\Include\openssl
-copy crypto\opensslconf.h ..\..\..\Include\openssl
-copy crypto\ebcdic.h ..\..\..\Include\openssl
-copy crypto\symhacks.h ..\..\..\Include\openssl
-copy crypto\ossl_typ.h ..\..\..\Include\openssl
-copy crypto\md2\md2.h ..\..\..\Include\openssl
-copy crypto\md4\md4.h ..\..\..\Include\openssl
-copy crypto\md5\md5.h ..\..\..\Include\openssl
-copy crypto\sha\sha.h ..\..\..\Include\openssl
-copy crypto\hmac\hmac.h ..\..\..\Include\openssl
-copy crypto\ripemd\ripemd.h ..\..\..\Include\openssl
-copy crypto\des\des.h ..\..\..\Include\openssl
-copy crypto\des\des_old.h ..\..\..\Include\openssl
-copy crypto\rc2\rc2.h ..\..\..\Include\openssl
-copy crypto\rc4\rc4.h ..\..\..\Include\openssl
-copy crypto\idea\idea.h ..\..\..\Include\openssl
-copy crypto\bf\blowfish.h ..\..\..\Include\openssl
-copy crypto\cast\cast.h ..\..\..\Include\openssl
-copy crypto\aes\aes.h ..\..\..\Include\openssl
-copy crypto\bn\bn.h ..\..\..\Include\openssl
-copy crypto\rsa\rsa.h ..\..\..\Include\openssl
-copy crypto\dsa\dsa.h ..\..\..\Include\openssl
-copy crypto\dso\dso.h ..\..\..\Include\openssl
-copy crypto\dh\dh.h ..\..\..\Include\openssl
-copy crypto\ec\ec.h ..\..\..\Include\openssl
-copy crypto\ecdh\ecdh.h ..\..\..\Include\openssl
-copy crypto\ecdsa\ecdsa.h ..\..\..\Include\openssl
-copy crypto\buffer\buffer.h ..\..\..\Include\openssl
-copy crypto\bio\bio.h ..\..\..\Include\openssl
-copy crypto\stack\stack.h ..\..\..\Include\openssl
-copy crypto\stack\safestack.h ..\..\..\Include\openssl
-copy crypto\lhash\lhash.h ..\..\..\Include\openssl
-copy crypto\rand\rand.h ..\..\..\Include\openssl
-copy crypto\err\err.h ..\..\..\Include\openssl
-copy crypto\objects\objects.h ..\..\..\Include\openssl
-copy crypto\objects\obj_mac.h ..\..\..\Include\openssl
-copy crypto\evp\evp.h ..\..\..\Include\openssl
-copy crypto\asn1\asn1.h ..\..\..\Include\openssl
-copy crypto\asn1\asn1_mac.h ..\..\..\Include\openssl
-copy crypto\asn1\asn1t.h ..\..\..\Include\openssl
-copy crypto\pem\pem.h ..\..\..\Include\openssl
-copy crypto\pem\pem2.h ..\..\..\Include\openssl
-copy crypto\x509\x509.h ..\..\..\Include\openssl
-copy crypto\x509\x509_vfy.h ..\..\..\Include\openssl
-copy crypto\x509v3\x509v3.h ..\..\..\Include\openssl
-copy crypto\conf\conf.h ..\..\..\Include\openssl
-copy crypto\conf\conf_api.h ..\..\..\Include\openssl
-copy crypto\txt_db\txt_db.h ..\..\..\Include\openssl
-copy crypto\pkcs7\pkcs7.h ..\..\..\Include\openssl
-copy crypto\pkcs12\pkcs12.h ..\..\..\Include\openssl
-copy crypto\comp\comp.h ..\..\..\Include\openssl
-copy crypto\engine\engine.h ..\..\..\Include\openssl
-copy crypto\ocsp\ocsp.h ..\..\..\Include\openssl
-copy crypto\ui\ui.h ..\..\..\Include\openssl
-copy crypto\ui\ui_compat.h ..\..\..\Include\openssl
-copy crypto\krb5\krb5_asn.h ..\..\..\Include\openssl
-copy crypto\store\store.h ..\..\..\Include\openssl
-copy crypto\pqueue\pqueue.h ..\..\..\Include\openssl
-copy crypto\pqueue\pq_compat.h ..\..\..\Include\openssl
-copy ssl\ssl.h ..\..\..\Include\openssl
-copy ssl\ssl2.h ..\..\..\Include\openssl
-copy ssl\ssl3.h ..\..\..\Include\openssl
-copy ssl\ssl23.h ..\..\..\Include\openssl
-copy ssl\tls1.h ..\..\..\Include\openssl
-copy ssl\dtls1.h ..\..\..\Include\openssl
-copy ssl\kssl.h ..\..\..\Include\openssl
+cd openssl-1.0.2d
+copy e_os2.h                    ..\..\..\Include\openssl
+copy crypto\crypto.h            ..\..\..\Include\openssl
+copy crypto\opensslv.h          ..\..\..\Include\openssl
+copy crypto\opensslconf.h       ..\..\..\Include\openssl
+copy crypto\ebcdic.h            ..\..\..\Include\openssl
+copy crypto\symhacks.h          ..\..\..\Include\openssl
+copy crypto\ossl_typ.h          ..\..\..\Include\openssl
+copy crypto\objects\objects.h   ..\..\..\Include\openssl
+copy crypto\objects\obj_mac.h   ..\..\..\Include\openssl
+copy crypto\md4\md4.h           ..\..\..\Include\openssl
+copy crypto\md5\md5.h           ..\..\..\Include\openssl
+copy crypto\sha\sha.h           ..\..\..\Include\openssl
+copy crypto\mdc2\mdc2.h         ..\..\..\Include\openssl
+copy crypto\hmac\hmac.h         ..\..\..\Include\openssl
+copy crypto\ripemd\ripemd.h     ..\..\..\Include\openssl
+copy crypto\whrlpool\whrlpool.h ..\..\..\Include\openssl
+copy crypto\des\des.h           ..\..\..\Include\openssl
+copy crypto\des\des_old.h       ..\..\..\Include\openssl
+copy crypto\aes\aes.h           ..\..\..\Include\openssl
+copy crypto\rc2\rc2.h           ..\..\..\Include\openssl
+copy crypto\rc4\rc4.h           ..\..\..\Include\openssl
+copy crypto\idea\idea.h         ..\..\..\Include\openssl
+copy crypto\bf\blowfish.h       ..\..\..\Include\openssl
+copy crypto\cast\cast.h         ..\..\..\Include\openssl
+copy crypto\camellia\camellia.h ..\..\..\Include\openssl
+copy crypto\seed\seed.h         ..\..\..\Include\openssl
+copy crypto\modes\modes.h       ..\..\..\Include\openssl
+copy crypto\bn\bn.h             ..\..\..\Include\openssl
+copy crypto\ec\ec.h             ..\..\..\Include\openssl
+copy crypto\rsa\rsa.h           ..\..\..\Include\openssl
+copy crypto\dsa\dsa.h           ..\..\..\Include\openssl
+copy crypto\ecdsa\ecdsa.h       ..\..\..\Include\openssl
+copy crypto\dh\dh.h             ..\..\..\Include\openssl
+copy crypto\ecdh\ecdh.h         ..\..\..\Include\openssl
+copy crypto\dso\dso.h           ..\..\..\Include\openssl
+copy crypto\engine\engine.h     ..\..\..\Include\openssl
+copy crypto\buffer\buffer.h     ..\..\..\Include\openssl
+copy crypto\bio\bio.h           ..\..\..\Include\openssl
+copy crypto\stack\stack.h       ..\..\..\Include\openssl
+copy crypto\stack\safestack.h   ..\..\..\Include\openssl
+copy crypto\lhash\lhash.h       ..\..\..\Include\openssl
+copy crypto\rand\rand.h         ..\..\..\Include\openssl
+copy crypto\err\err.h           ..\..\..\Include\openssl
+copy crypto\evp\evp.h           ..\..\..\Include\openssl
+copy crypto\asn1\asn1.h         ..\..\..\Include\openssl
+copy crypto\asn1\asn1_mac.h     ..\..\..\Include\openssl
+copy crypto\asn1\asn1t.h        ..\..\..\Include\openssl
+copy crypto\pem\pem.h           ..\..\..\Include\openssl
+copy crypto\pem\pem2.h          ..\..\..\Include\openssl
+copy crypto\x509\x509.h         ..\..\..\Include\openssl
+copy crypto\x509\x509_vfy.h     ..\..\..\Include\openssl
+copy crypto\x509v3\x509v3.h     ..\..\..\Include\openssl
+copy crypto\conf\conf.h         ..\..\..\Include\openssl
+copy crypto\conf\conf_api.h     ..\..\..\Include\openssl
+copy crypto\txt_db\txt_db.h     ..\..\..\Include\openssl
+copy crypto\pkcs7\pkcs7.h       ..\..\..\Include\openssl
+copy crypto\pkcs12\pkcs12.h     ..\..\..\Include\openssl
+copy crypto\comp\comp.h         ..\..\..\Include\openssl
+copy crypto\ocsp\ocsp.h         ..\..\..\Include\openssl
+copy crypto\ui\ui.h             ..\..\..\Include\openssl
+copy crypto\ui\ui_compat.h      ..\..\..\Include\openssl
+copy crypto\krb5\krb5_asn.h     ..\..\..\Include\openssl
+copy crypto\cms\cms.h           ..\..\..\Include\openssl
+copy crypto\pqueue\pqueue.h     ..\..\..\Include\openssl
+copy crypto\ts\ts.h             ..\..\..\Include\openssl
+copy crypto\srp\srp.h           ..\..\..\Include\openssl
+copy crypto\cmac\cmac.h         ..\..\..\Include\openssl
+copy ssl\ssl.h                  ..\..\..\Include\openssl
+copy ssl\ssl2.h                 ..\..\..\Include\openssl
+copy ssl\ssl3.h                 ..\..\..\Include\openssl
+copy ssl\ssl23.h                ..\..\..\Include\openssl
+copy ssl\tls1.h                 ..\..\..\Include\openssl
+copy ssl\dtls1.h                ..\..\..\Include\openssl
+copy ssl\kssl.h                 ..\..\..\Include\openssl
+copy ssl\srtp.h                 ..\..\..\Include\openssl
 cd ..
diff --git a/CryptoPkg/Library/OpensslLib/Install.sh b/CryptoPkg/Library/OpensslLib/Install.sh
index 4a022e6..877e775 100755
--- a/CryptoPkg/Library/OpensslLib/Install.sh
+++ b/CryptoPkg/Library/OpensslLib/Install.sh
@@ -1,73 +1,79 @@
 #!/bin/sh
 
-cd openssl-0.9.8zf
-cp e_os2.h ../../../Include/openssl
-cp crypto/crypto.h ../../../Include/openssl
-cp crypto/tmdiff.h ../../../Include/openssl
-cp crypto/opensslv.h ../../../Include/openssl
-cp crypto/opensslconf.h ../../../Include/openssl
-cp crypto/ebcdic.h ../../../Include/openssl
-cp crypto/symhacks.h ../../../Include/openssl
-cp crypto/ossl_typ.h ../../../Include/openssl
-cp crypto/md2/md2.h ../../../Include/openssl
-cp crypto/md4/md4.h ../../../Include/openssl
-cp crypto/md5/md5.h ../../../Include/openssl
-cp crypto/sha/sha.h ../../../Include/openssl
-cp crypto/hmac/hmac.h ../../../Include/openssl
-cp crypto/ripemd/ripemd.h ../../../Include/openssl
-cp crypto/des/des.h ../../../Include/openssl
-cp crypto/des/des_old.h ../../../Include/openssl
-cp crypto/rc2/rc2.h ../../../Include/openssl
-cp crypto/rc4/rc4.h ../../../Include/openssl
-cp crypto/idea/idea.h ../../../Include/openssl
-cp crypto/bf/blowfish.h ../../../Include/openssl
-cp crypto/cast/cast.h ../../../Include/openssl
-cp crypto/aes/aes.h ../../../Include/openssl
-cp crypto/bn/bn.h ../../../Include/openssl
-cp crypto/rsa/rsa.h ../../../Include/openssl
-cp crypto/dsa/dsa.h ../../../Include/openssl
-cp crypto/dso/dso.h ../../../Include/openssl
-cp crypto/dh/dh.h ../../../Include/openssl
-cp crypto/ec/ec.h ../../../Include/openssl
-cp crypto/ecdh/ecdh.h ../../../Include/openssl
-cp crypto/ecdsa/ecdsa.h ../../../Include/openssl
-cp crypto/buffer/buffer.h ../../../Include/openssl
-cp crypto/bio/bio.h ../../../Include/openssl
-cp crypto/stack/stack.h ../../../Include/openssl
-cp crypto/stack/safestack.h ../../../Include/openssl
-cp crypto/lhash/lhash.h ../../../Include/openssl
-cp crypto/rand/rand.h ../../../Include/openssl
-cp crypto/err/err.h ../../../Include/openssl
-cp crypto/objects/objects.h ../../../Include/openssl
-cp crypto/objects/obj_mac.h ../../../Include/openssl
-cp crypto/evp/evp.h ../../../Include/openssl
-cp crypto/asn1/asn1.h ../../../Include/openssl
-cp crypto/asn1/asn1_mac.h ../../../Include/openssl
-cp crypto/asn1/asn1t.h ../../../Include/openssl
-cp crypto/pem/pem.h ../../../Include/openssl
-cp crypto/pem/pem2.h ../../../Include/openssl
-cp crypto/x509/x509.h ../../../Include/openssl
-cp crypto/x509/x509_vfy.h ../../../Include/openssl
-cp crypto/x509v3/x509v3.h ../../../Include/openssl
-cp crypto/conf/conf.h ../../../Include/openssl
-cp crypto/conf/conf_api.h ../../../Include/openssl
-cp crypto/txt_db/txt_db.h ../../../Include/openssl
-cp crypto/pkcs7/pkcs7.h ../../../Include/openssl
-cp crypto/pkcs12/pkcs12.h ../../../Include/openssl
-cp crypto/comp/comp.h ../../../Include/openssl
-cp crypto/engine/engine.h ../../../Include/openssl
-cp crypto/ocsp/ocsp.h ../../../Include/openssl
-cp crypto/ui/ui.h ../../../Include/openssl
-cp crypto/ui/ui_compat.h ../../../Include/openssl
-cp crypto/krb5/krb5_asn.h ../../../Include/openssl
-cp crypto/store/store.h ../../../Include/openssl
-cp crypto/pqueue/pqueue.h ../../../Include/openssl
-cp crypto/pqueue/pq_compat.h ../../../Include/openssl
-cp ssl/ssl.h ../../../Include/openssl
-cp ssl/ssl2.h ../../../Include/openssl
-cp ssl/ssl3.h ../../../Include/openssl
-cp ssl/ssl23.h ../../../Include/openssl
-cp ssl/tls1.h ../../../Include/openssl
-cp ssl/dtls1.h ../../../Include/openssl
-cp ssl/kssl.h ../../../Include/openssl
+cd openssl-1.0.2d
+cp e_os2.h                    ../../../Include/openssl
+cp crypto/crypto.h            ../../../Include/openssl
+cp crypto/opensslv.h          ../../../Include/openssl
+cp crypto/opensslconf.h       ../../../Include/openssl
+cp crypto/ebcdic.h            ../../../Include/openssl
+cp crypto/symhacks.h          ../../../Include/openssl
+cp crypto/ossl_typ.h          ../../../Include/openssl
+cp crypto/objects/objects.h   ../../../Include/openssl
+cp crypto/objects/obj_mac.h   ../../../Include/openssl
+cp crypto/md4/md4.h           ../../../Include/openssl
+cp crypto/md5/md5.h           ../../../Include/openssl
+cp crypto/sha/sha.h           ../../../Include/openssl
+cp crypto/mdc2/mdc2.h         ../../../Include/openssl
+cp crypto/hmac/hmac.h         ../../../Include/openssl
+cp crypto/ripemd/ripemd.h     ../../../Include/openssl
+cp crypto/whrlpool/whrlpool.h ../../../Include/openssl
+cp crypto/des/des.h           ../../../Include/openssl
+cp crypto/des/des_old.h       ../../../Include/openssl
+cp crypto/aes/aes.h           ../../../Include/openssl
+cp crypto/rc2/rc2.h           ../../../Include/openssl
+cp crypto/rc4/rc4.h           ../../../Include/openssl
+cp crypto/idea/idea.h         ../../../Include/openssl
+cp crypto/bf/blowfish.h       ../../../Include/openssl
+cp crypto/cast/cast.h         ../../../Include/openssl
+cp crypto/camellia/camellia.h ../../../Include/openssl
+cp crypto/seed/seed.h         ../../../Include/openssl
+cp crypto/modes/modes.h       ../../../Include/openssl
+cp crypto/bn/bn.h             ../../../Include/openssl
+cp crypto/ec/ec.h             ../../../Include/openssl
+cp crypto/rsa/rsa.h           ../../../Include/openssl
+cp crypto/dsa/dsa.h           ../../../Include/openssl
+cp crypto/ecdsa/ecdsa.h       ../../../Include/openssl
+cp crypto/dh/dh.h             ../../../Include/openssl
+cp crypto/ecdh/ecdh.h         ../../../Include/openssl
+cp crypto/dso/dso.h           ../../../Include/openssl
+cp crypto/engine/engine.h     ../../../Include/openssl
+cp crypto/buffer/buffer.h     ../../../Include/openssl
+cp crypto/bio/bio.h           ../../../Include/openssl
+cp crypto/stack/stack.h       ../../../Include/openssl
+cp crypto/stack/safestack.h   ../../../Include/openssl
+cp crypto/lhash/lhash.h       ../../../Include/openssl
+cp crypto/rand/rand.h         ../../../Include/openssl
+cp crypto/err/err.h           ../../../Include/openssl
+cp crypto/evp/evp.h           ../../../Include/openssl
+cp crypto/asn1/asn1.h         ../../../Include/openssl
+cp crypto/asn1/asn1_mac.h     ../../../Include/openssl
+cp crypto/asn1/asn1t.h        ../../../Include/openssl
+cp crypto/pem/pem.h           ../../../Include/openssl
+cp crypto/pem/pem2.h          ../../../Include/openssl
+cp crypto/x509/x509.h         ../../../Include/openssl
+cp crypto/x509/x509_vfy.h     ../../../Include/openssl
+cp crypto/x509v3/x509v3.h     ../../../Include/openssl
+cp crypto/conf/conf.h         ../../../Include/openssl
+cp crypto/conf/conf_api.h     ../../../Include/openssl
+cp crypto/txt_db/txt_db.h     ../../../Include/openssl
+cp crypto/pkcs7/pkcs7.h       ../../../Include/openssl
+cp crypto/pkcs12/pkcs12.h     ../../../Include/openssl
+cp crypto/comp/comp.h         ../../../Include/openssl
+cp crypto/ocsp/ocsp.h         ../../../Include/openssl
+cp crypto/ui/ui.h             ../../../Include/openssl
+cp crypto/ui/ui_compat.h      ../../../Include/openssl
+cp crypto/krb5/krb5_asn.h     ../../../Include/openssl
+cp crypto/cms/cms.h           ../../../Include/openssl
+cp crypto/pqueue/pqueue.h     ../../../Include/openssl
+cp crypto/ts/ts.h             ../../../Include/openssl
+cp crypto/srp/srp.h           ../../../Include/openssl
+cp crypto/cmac/cmac.h         ../../../Include/openssl
+cp ssl/ssl.h                  ../../../Include/openssl
+cp ssl/ssl2.h                 ../../../Include/openssl
+cp ssl/ssl3.h                 ../../../Include/openssl
+cp ssl/ssl23.h                ../../../Include/openssl
+cp ssl/tls1.h                 ../../../Include/openssl
+cp ssl/dtls1.h                ../../../Include/openssl
+cp ssl/kssl.h                 ../../../Include/openssl
+cp ssl/srtp.h                 ../../../Include/openssl
 cd ..
diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
index 935774b..054bc64 100644
--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
@@ -1,15 +1,15 @@
 ## @file
 #  This module provides openSSL Library implementation.
-# 
+#
 #  Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution.  The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
-#  
+#
 #  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
-#  
+#
 ##
 
 [Defines]
@@ -19,37 +19,38 @@
   MODULE_TYPE                    = BASE
   VERSION_STRING                 = 1.0
   LIBRARY_CLASS                  = OpensslLib
-  DEFINE OPENSSL_PATH            = openssl-0.9.8zf
-  DEFINE OPENSSL_FLAGS           = -DOPENSSL_SYSNAME_UWIN -DOPENSSL_SYS_UEFI -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_SEED -DOPENSSL_NO_RC5 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_SOCK -DOPENSSL_NO_CMS -DOPENSSL_NO_JPAKE -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_ERR -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE -DGETPID_IS_MEANINGLESS -DOPENSSL_NO_STDIO -DOPENSSL_NO_FP_API -DOPENSSL_NO_DGRAM -DOPENSSL_NO_ASM
-  DEFINE OPENSSL_EXFLAGS         = -DOPENSSL_SMALL_FOOTPRINT -DOPENSSL_NO_MD2 -DOPENSSL_NO_SHA0 -DOPENSSL_NO_SHA512 -DOPENSSL_NO_LHASH -DOPENSSL_NO_HW -DOPENSSL_NO_OCSP -DOPENSSL_NO_LOCKING -DOPENSSL_NO_DEPRECATED -DOPENSSL_NO_RIPEMD -DOPENSSL_NO_RC2 -DOPENSSL_NO_IDEA -DOPENSSL_NO_BF -DOPENSSL_NO_CAST -DOPENSSL_NO_WHIRLPOOL -DOPENSSL_NO_DSA -DOPENSSL_NO_EC -DOPENSSL_NO_ECDH -DOPENSSL_NO_ECDSA -DOPENSSL_NO_ENGINE
-  
+  DEFINE OPENSSL_PATH            = openssl-1.0.2d
+  DEFINE OPENSSL_FLAGS           = -DOPENSSL_SYSNAME_UWIN -DOPENSSL_SYS_UEFI -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_SEED -DOPENSSL_NO_RC5 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_SOCK -DOPENSSL_NO_CMS -DOPENSSL_NO_JPAKE -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_ERR -DOPENSSL_NO_KRB5 -DOPENSSL_NO_DYNAMIC_ENGINE -DGETPID_IS_MEANINGLESS -DOPENSSL_NO_STDIO -DOPENSSL_NO_POSIX_IO -DOPENSSL_NO_FP_API -DOPENSSL_NO_DGRAM -DOPENSSL_NO_ASM
+  DEFINE OPENSSL_EXFLAGS         = -DOPENSSL_SMALL_FOOTPRINT -DOPENSSL_NO_SHA0 -DOPENSSL_NO_LHASH -DOPENSSL_NO_HW -DOPENSSL_NO_OCSP -DOPENSSL_NO_LOCKING -DOPENSSL_NO_DEPRECATED -DOPENSSL_NO_RIPEMD -DOPENSSL_NO_RC2 -DOPENSSL_NO_IDEA -DOPENSSL_NO_BF -DOPENSSL_NO_CAST -DOPENSSL_NO_WHIRLPOOL -DOPENSSL_NO_DSA -DOPENSSL_NO_EC -DOPENSSL_NO_ECDH -DOPENSSL_NO_ECDSA -DOPENSSL_NO_SRP -DOPENSSL_NO_ENGINE
+
 #
-# OPENSSL_FLAGS is set to define the following flags to be compatible with 
-# EDK II build system and UEFI executiuon environment 
+# OPENSSL_FLAGS is set to define the following flags to be compatible with
+# EDK II build system and UEFI executiuon environment
 #
 #   OPENSSL_SYSNAME_UWIN
-#   OPENSSL_SYS_UEFI 
-#   L_ENDIAN 
-#   _CRT_SECURE_NO_DEPRECATE 
-#   _CRT_NONSTDC_NO_DEPRECATE 
-#   OPENSSL_NO_CAMELLIA 
-#   OPENSSL_NO_SEED 
-#   OPENSSL_NO_RC5 
-#   OPENSSL_NO_MDC2 
-#   OPENSSL_NO_SOCK 
-#   OPENSSL_NO_CMS 
-#   OPENSSL_NO_JPAKE 
-#   OPENSSL_NO_CAPIENG 
-#   OPENSSL_NO_ERR 
-#   OPENSSL_NO_KRB5 
-#   OPENSSL_NO_DYNAMIC_ENGINE 
-#   GETPID_IS_MEANINGLESS 
-#   OPENSSL_NO_STDIO 
-#   OPENSSL_NO_FP_API 
-#   OPENSSL_NO_DGRAM  
+#   OPENSSL_SYS_UEFI
+#   L_ENDIAN
+#   _CRT_SECURE_NO_DEPRECATE
+#   _CRT_NONSTDC_NO_DEPRECATE
+#   OPENSSL_NO_CAMELLIA
+#   OPENSSL_NO_SEED
+#   OPENSSL_NO_RC5
+#   OPENSSL_NO_MDC2
+#   OPENSSL_NO_SOCK
+#   OPENSSL_NO_CMS
+#   OPENSSL_NO_JPAKE
+#   OPENSSL_NO_CAPIENG
+#   OPENSSL_NO_ERR
+#   OPENSSL_NO_KRB5
+#   OPENSSL_NO_DYNAMIC_ENGINE
+#   GETPID_IS_MEANINGLESS
+#   OPENSSL_NO_STDIO
+#   OPENSSL_NO_POSIX_IO
+#   OPENSSL_NO_FP_API
+#   OPENSSL_NO_DGRAM
 #   OPENSSL_NO_ASM
 #
-  
+
 #
 #  VALID_ARCHITECTURES           = IA32 X64 IPF ARM AARCH64
 #
@@ -57,80 +58,122 @@
 [Sources]
   $(OPENSSL_PATH)/e_os.h
   $(OPENSSL_PATH)/crypto/cryptlib.c
-  $(OPENSSL_PATH)/crypto/dyn_lck.c
   $(OPENSSL_PATH)/crypto/mem.c
   $(OPENSSL_PATH)/crypto/mem_clr.c
   $(OPENSSL_PATH)/crypto/mem_dbg.c
   $(OPENSSL_PATH)/crypto/cversion.c
   $(OPENSSL_PATH)/crypto/ex_data.c
-
-  #
-  # Not required for UEFI.
-  #
-  # $(OPENSSL_PATH)/crypto/tmdiff.c
-
   $(OPENSSL_PATH)/crypto/cpt_err.c
   $(OPENSSL_PATH)/crypto/ebcdic.c
   $(OPENSSL_PATH)/crypto/uid.c
   $(OPENSSL_PATH)/crypto/o_time.c
   $(OPENSSL_PATH)/crypto/o_str.c
   $(OPENSSL_PATH)/crypto/o_dir.c
+  $(OPENSSL_PATH)/crypto/o_fips.c
   $(OPENSSL_PATH)/crypto/o_init.c
-  $(OPENSSL_PATH)/crypto/fips_err.c
+  $(OPENSSL_PATH)/crypto/fips_ers.c
 
   #
-  # DIsabled by OPENSSL_NO_MD2
+  # OBJECTS
   #
-  # $(OPENSSL_PATH)/crypto/md2/md2_dgst.c
-  # $(OPENSSL_PATH)/crypto/md2/md2_one.c
+  $(OPENSSL_PATH)/crypto/objects/o_names.c
+  $(OPENSSL_PATH)/crypto/objects/obj_dat.c
+  $(OPENSSL_PATH)/crypto/objects/obj_lib.c
+  $(OPENSSL_PATH)/crypto/objects/obj_err.c
+  $(OPENSSL_PATH)/crypto/objects/obj_xref.c
+
+  #
+  # MD4
+  #
   $(OPENSSL_PATH)/crypto/md4/md4_dgst.c
   $(OPENSSL_PATH)/crypto/md4/md4_one.c
+
+  #
+  # MD5
+  #
   $(OPENSSL_PATH)/crypto/md5/md5_dgst.c
   $(OPENSSL_PATH)/crypto/md5/md5_one.c
+
+  #
+  # SHA
+  #
   $(OPENSSL_PATH)/crypto/sha/sha_dgst.c
   $(OPENSSL_PATH)/crypto/sha/sha1dgst.c
   $(OPENSSL_PATH)/crypto/sha/sha_one.c
   $(OPENSSL_PATH)/crypto/sha/sha1_one.c
   $(OPENSSL_PATH)/crypto/sha/sha256.c
   $(OPENSSL_PATH)/crypto/sha/sha512.c
-  $(OPENSSL_PATH)/crypto/hmac/hmac.c
 
   #
-  # Disabled by OPENSSL_NO_RIPEMD
+  # MDC2 - Disabled by OPENSSL_NO_MDC2
+  #
+  # $(OPENSSL_PATH)/crypto/mdc2/mdc2dgst.c
+  # $(OPENSSL_PATH)/crypto/mdc2/mdc2_one.c
+
+  #
+  # HMAC
+  #
+  $(OPENSSL_PATH)/crypto/hmac/hmac.c
+  $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c
+  $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c
+
+  #
+  # RIPEMD - Disabled by OPENSSL_NO_RIPEMD
   #
   # $(OPENSSL_PATH)/crypto/ripemd/rmd_dgst.c
   # $(OPENSSL_PATH)/crypto/ripemd/rmd_one.c
 
-  $(OPENSSL_PATH)/crypto/des/des_lib.c
-  $(OPENSSL_PATH)/crypto/des/set_key.c
-  $(OPENSSL_PATH)/crypto/des/ecb_enc.c
+  #
+  # WHIRLPOOL - Disabled by OPENSSL_NO_WHIRLPOOL
+  #
+  # $(OPENSSL_PATH)/crypto/whrlpool/wp_dgst.c
+  # $(OPENSSL_PATH)/crypto/whrlpool/wp_block.c
+
+  #
+  # DES
+  #
+  $(OPENSSL_PATH)/crypto/des/cbc_cksm.c
   $(OPENSSL_PATH)/crypto/des/cbc_enc.c
-  $(OPENSSL_PATH)/crypto/des/ecb3_enc.c
   $(OPENSSL_PATH)/crypto/des/cfb64enc.c
-  $(OPENSSL_PATH)/crypto/des/cfb64ede.c
   $(OPENSSL_PATH)/crypto/des/cfb_enc.c
-  $(OPENSSL_PATH)/crypto/des/ofb64ede.c
+  $(OPENSSL_PATH)/crypto/des/ecb3_enc.c
+  $(OPENSSL_PATH)/crypto/des/ecb_enc.c
   $(OPENSSL_PATH)/crypto/des/enc_read.c
   $(OPENSSL_PATH)/crypto/des/enc_writ.c
+  $(OPENSSL_PATH)/crypto/des/fcrypt.c
   $(OPENSSL_PATH)/crypto/des/ofb64enc.c
   $(OPENSSL_PATH)/crypto/des/ofb_enc.c
-  $(OPENSSL_PATH)/crypto/des/str2key.c
   $(OPENSSL_PATH)/crypto/des/pcbc_enc.c
   $(OPENSSL_PATH)/crypto/des/qud_cksm.c
   $(OPENSSL_PATH)/crypto/des/rand_key.c
+  $(OPENSSL_PATH)/crypto/des/rpc_enc.c
+  $(OPENSSL_PATH)/crypto/des/set_key.c
   $(OPENSSL_PATH)/crypto/des/des_enc.c
   $(OPENSSL_PATH)/crypto/des/fcrypt_b.c
-  $(OPENSSL_PATH)/crypto/des/fcrypt.c
   $(OPENSSL_PATH)/crypto/des/xcbc_enc.c
-  $(OPENSSL_PATH)/crypto/des/rpc_enc.c
-  $(OPENSSL_PATH)/crypto/des/cbc_cksm.c
+  $(OPENSSL_PATH)/crypto/des/str2key.c
+  $(OPENSSL_PATH)/crypto/des/cfb64ede.c
+  $(OPENSSL_PATH)/crypto/des/ofb64ede.c
   $(OPENSSL_PATH)/crypto/des/ede_cbcm_enc.c
   $(OPENSSL_PATH)/crypto/des/des_old.c
   $(OPENSSL_PATH)/crypto/des/des_old2.c
   $(OPENSSL_PATH)/crypto/des/read2pwd.c
 
   #
-  # Disabled by OPENSSL_NO_RC2
+  # AES
+  #
+  $(OPENSSL_PATH)/crypto/aes/aes_core.c
+  $(OPENSSL_PATH)/crypto/aes/aes_misc.c
+  $(OPENSSL_PATH)/crypto/aes/aes_ecb.c
+  $(OPENSSL_PATH)/crypto/aes/aes_cbc.c
+  $(OPENSSL_PATH)/crypto/aes/aes_cfb.c
+  $(OPENSSL_PATH)/crypto/aes/aes_ofb.c
+  $(OPENSSL_PATH)/crypto/aes/aes_ctr.c
+  $(OPENSSL_PATH)/crypto/aes/aes_ige.c
+  $(OPENSSL_PATH)/crypto/aes/aes_wrap.c
+
+  #
+  # RC2 - Disabled by OPENSSL_NO_RC2
   #
   # $(OPENSSL_PATH)/crypto/rc2/rc2_ecb.c
   # $(OPENSSL_PATH)/crypto/rc2/rc2_skey.c
@@ -138,28 +181,42 @@
   # $(OPENSSL_PATH)/crypto/rc2/rc2cfb64.c
   # $(OPENSSL_PATH)/crypto/rc2/rc2ofb64.c
 
-  $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c
+  #
+  # RC4
+  #
   $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c
-  $(OPENSSL_PATH)/crypto/rc4/rc4_fblk.c
+  $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c
+  $(OPENSSL_PATH)/crypto/rc4/rc4_utl.c
 
   #
-  # Disabled by OPENSSL_NO_IDEA
+  # RC5 - Disabled by OPENSSL_NO_RC5
+  #
+  # $(OPENSSL_PATH)/crypto/rc5/rc5_skey.c
+  # $(OPENSSL_PATH)/crypto/rc5/rc5_ecb.c
+  # $(OPENSSL_PATH)/crypto/rc5/rc5_enc.c
+  # $(OPENSSL_PATH)/crypto/rc5/rc5cfb64.c
+  # $(OPENSSL_PATH)/crypto/rc5/rc5ofb64.c
+
+  #
+  # IDEA - Disabled by OPENSSL_NO_IDEA
   #
   # $(OPENSSL_PATH)/crypto/idea/i_cbc.c
   # $(OPENSSL_PATH)/crypto/idea/i_cfb64.c
   # $(OPENSSL_PATH)/crypto/idea/i_ofb64.c
   # $(OPENSSL_PATH)/crypto/idea/i_ecb.c
   # $(OPENSSL_PATH)/crypto/idea/i_skey.c
+
   #
-  # Disabled by OPENSSL_NO_BF
+  # BLOWFISH - Disabled by OPENSSL_NO_BF
   #
   # $(OPENSSL_PATH)/crypto/bf/bf_skey.c
   # $(OPENSSL_PATH)/crypto/bf/bf_ecb.c
   # $(OPENSSL_PATH)/crypto/bf/bf_enc.c
   # $(OPENSSL_PATH)/crypto/bf/bf_cfb64.c
   # $(OPENSSL_PATH)/crypto/bf/bf_ofb64.c
+
   #
-  # Disabled by OPENSSL_NO_CAST
+  # CAST - Disabled by OPENSSL_NO_CAST
   #
   # $(OPENSSL_PATH)/crypto/cast/c_skey.c
   # $(OPENSSL_PATH)/crypto/cast/c_ecb.c
@@ -167,15 +224,43 @@
   # $(OPENSSL_PATH)/crypto/cast/c_cfb64.c
   # $(OPENSSL_PATH)/crypto/cast/c_ofb64.c
 
-  $(OPENSSL_PATH)/crypto/aes/aes_misc.c
-  $(OPENSSL_PATH)/crypto/aes/aes_ecb.c
-  $(OPENSSL_PATH)/crypto/aes/aes_cfb.c
-  $(OPENSSL_PATH)/crypto/aes/aes_ofb.c
-  $(OPENSSL_PATH)/crypto/aes/aes_ctr.c
-  $(OPENSSL_PATH)/crypto/aes/aes_ige.c
-  $(OPENSSL_PATH)/crypto/aes/aes_wrap.c
-  $(OPENSSL_PATH)/crypto/aes/aes_core.c
-  $(OPENSSL_PATH)/crypto/aes/aes_cbc.c
+  #
+  # CAMELLIA - Disabled by OPENSSL_NO_CAMELLIA
+  #
+  # $(OPENSSL_PATH)/crypto/camellia/camellia.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_misc.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_ecb.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_cbc.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_ofb.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_cfb.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_ctr.c
+  # $(OPENSSL_PATH)/crypto/camellia/cmll_utl.c
+
+  #
+  # SEED - Disabled by OPENSSL_NO_SEED
+  #
+  # $(OPENSSL_PATH)/crypto/seed/seed.c
+  # $(OPENSSL_PATH)/crypto/seed/seed_ecb.c
+  # $(OPENSSL_PATH)/crypto/seed/seed_cbc.c
+  # $(OPENSSL_PATH)/crypto/seed/seed_cfb.c
+  # $(OPENSSL_PATH)/crypto/seed/seed_ofb.c
+
+  #
+  # MODES
+  #
+  $(OPENSSL_PATH)/crypto/modes/cbc128.c
+  $(OPENSSL_PATH)/crypto/modes/ctr128.c
+  $(OPENSSL_PATH)/crypto/modes/cts128.c
+  $(OPENSSL_PATH)/crypto/modes/cfb128.c
+  $(OPENSSL_PATH)/crypto/modes/ofb128.c
+  $(OPENSSL_PATH)/crypto/modes/gcm128.c
+  $(OPENSSL_PATH)/crypto/modes/ccm128.c
+  $(OPENSSL_PATH)/crypto/modes/xts128.c
+  $(OPENSSL_PATH)/crypto/modes/wrap128.c
+
+  #
+  # BIGNUM
+  #
   $(OPENSSL_PATH)/crypto/bn/bn_add.c
   $(OPENSSL_PATH)/crypto/bn/bn_div.c
   $(OPENSSL_PATH)/crypto/bn/bn_exp.c
@@ -202,60 +287,11 @@
   $(OPENSSL_PATH)/crypto/bn/bn_gf2m.c
   $(OPENSSL_PATH)/crypto/bn/bn_nist.c
   $(OPENSSL_PATH)/crypto/bn/bn_depr.c
-  $(OPENSSL_PATH)/crypto/bn/bn_x931p.c
   $(OPENSSL_PATH)/crypto/bn/bn_const.c
-  $(OPENSSL_PATH)/crypto/bn/bn_opt.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_eay.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_sign.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_saos.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_err.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_none.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_chk.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_null.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_pss.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_asn1.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_depr.c
-  $(OPENSSL_PATH)/crypto/rsa/rsa_eng.c
+  $(OPENSSL_PATH)/crypto/bn/bn_x931p.c
 
   #
-  # Disabled by OPENSSL_NO_DSA
-  #
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_gen.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_key.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_lib.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_asn1.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_vrf.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_sign.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_err.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_ossl.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_depr.c
-  # $(OPENSSL_PATH)/crypto/dsa/dsa_utl.c
-
-  $(OPENSSL_PATH)/crypto/dso/dso_dl.c
-  $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c
-  $(OPENSSL_PATH)/crypto/dso/dso_err.c
-  $(OPENSSL_PATH)/crypto/dso/dso_lib.c
-  $(OPENSSL_PATH)/crypto/dso/dso_null.c
-  $(OPENSSL_PATH)/crypto/dso/dso_openssl.c
-  $(OPENSSL_PATH)/crypto/dso/dso_win32.c
-  $(OPENSSL_PATH)/crypto/dso/dso_vms.c
-  $(OPENSSL_PATH)/crypto/dh/dh_asn1.c
-  $(OPENSSL_PATH)/crypto/dh/dh_gen.c
-  $(OPENSSL_PATH)/crypto/dh/dh_key.c
-  $(OPENSSL_PATH)/crypto/dh/dh_lib.c
-  $(OPENSSL_PATH)/crypto/dh/dh_check.c
-  $(OPENSSL_PATH)/crypto/dh/dh_err.c
-  $(OPENSSL_PATH)/crypto/dh/dh_depr.c
-
-  #
-  # Disabled by OPENSSL_NO_EC
+  # ELLIPTIC CURVE - Disabled by OPENSSL_NO_EC
   #
   # $(OPENSSL_PATH)/crypto/ec/ec_lib.c
   # $(OPENSSL_PATH)/crypto/ec/ecp_smpl.c
@@ -271,15 +307,59 @@
   # $(OPENSSL_PATH)/crypto/ec/ec_key.c
   # $(OPENSSL_PATH)/crypto/ec/ec2_smpl.c
   # $(OPENSSL_PATH)/crypto/ec/ec2_mult.c
+  # $(OPENSSL_PATH)/crypto/ec/ec_ameth.c
+  # $(OPENSSL_PATH)/crypto/ec/ec_pmeth.c
+  # $(OPENSSL_PATH)/crypto/ec/eck_prn.c
+  # $(OPENSSL_PATH)/crypto/ec/ecp_nistp224.c
+  # $(OPENSSL_PATH)/crypto/ec/ecp_nistp256.c
+  # $(OPENSSL_PATH)/crypto/ec/ecp_nistp521.c
+  # $(OPENSSL_PATH)/crypto/ec/ecp_nistputil.c
+  # $(OPENSSL_PATH)/crypto/ec/ecp_oct.c
+  # $(OPENSSL_PATH)/crypto/ec/ec2_oct.c
+  # $(OPENSSL_PATH)/crypto/ec/ec_oct.c
+
   #
-  # Disabled by OPENSSL_NO_ECDH
+  # RSA
   #
-  # $(OPENSSL_PATH)/crypto/ecdh/ech_lib.c
-  # $(OPENSSL_PATH)/crypto/ecdh/ech_ossl.c
-  # $(OPENSSL_PATH)/crypto/ecdh/ech_key.c
-  # $(OPENSSL_PATH)/crypto/ecdh/ech_err.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_eay.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_sign.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_saos.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_err.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_none.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_chk.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_null.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_pss.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_asn1.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_depr.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_prn.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_pmeth.c
+  $(OPENSSL_PATH)/crypto/rsa/rsa_crpt.c
+
   #
-  # Disabled by OPENSSL_NO_ECDSA
+  # DSA - Disabled by OPENSSL_NO_DSA
+  #
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_gen.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_key.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_lib.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_asn1.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_vrf.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_sign.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_err.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_ossl.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_depr.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_ameth.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_pmeth.c
+  # $(OPENSSL_PATH)/crypto/dsa/dsa_prn.c
+
+  #
+  # ECDSA - Disabled by OPENSSL_NO_ECDSA
   #
   # $(OPENSSL_PATH)/crypto/ecdsa/ecs_lib.c
   # $(OPENSSL_PATH)/crypto/ecdsa/ecs_asn1.c
@@ -288,9 +368,83 @@
   # $(OPENSSL_PATH)/crypto/ecdsa/ecs_vrf.c
   # $(OPENSSL_PATH)/crypto/ecdsa/ecs_err.c
 
+  #
+  # DIFFIE-HELLMAN
+  #
+  $(OPENSSL_PATH)/crypto/dh/dh_asn1.c
+  $(OPENSSL_PATH)/crypto/dh/dh_gen.c
+  $(OPENSSL_PATH)/crypto/dh/dh_key.c
+  $(OPENSSL_PATH)/crypto/dh/dh_lib.c
+  $(OPENSSL_PATH)/crypto/dh/dh_check.c
+  $(OPENSSL_PATH)/crypto/dh/dh_err.c
+  $(OPENSSL_PATH)/crypto/dh/dh_depr.c
+  $(OPENSSL_PATH)/crypto/dh/dh_ameth.c
+  $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c
+  $(OPENSSL_PATH)/crypto/dh/dh_prn.c
+  $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c
+  # $(OPENSSL_PATH)/crypto/dh/dh_kdf.c
+
+  #
+  # ECDH - Disabled by OPENSSL_NO_ECDH
+  #
+  # $(OPENSSL_PATH)/crypto/ecdh/ech_lib.c
+  # $(OPENSSL_PATH)/crypto/ecdh/ech_ossl.c
+  # $(OPENSSL_PATH)/crypto/ecdh/ech_key.c
+  # $(OPENSSL_PATH)/crypto/ecdh/ech_err.c
+  # $(OPENSSL_PATH)/crypto/ecdh/ech_kdf.c
+
+  #
+  # DSO
+  #
+  $(OPENSSL_PATH)/crypto/dso/dso_dl.c
+  $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c
+  $(OPENSSL_PATH)/crypto/dso/dso_err.c
+  $(OPENSSL_PATH)/crypto/dso/dso_lib.c
+  $(OPENSSL_PATH)/crypto/dso/dso_null.c
+  $(OPENSSL_PATH)/crypto/dso/dso_openssl.c
+  $(OPENSSL_PATH)/crypto/dso/dso_win32.c
+  $(OPENSSL_PATH)/crypto/dso/dso_vms.c
+  $(OPENSSL_PATH)/crypto/dso/dso_beos.c
+
+  #
+  # ENGINE - Disabled by OPENSSL_NO_ENGINE
+  #
+  # $(OPENSSL_PATH)/crypto/engine/eng_err.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_lib.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_list.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_init.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_ctrl.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_table.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_pkey.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_fat.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_all.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_rsa.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_dsa.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_ecdsa.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_dh.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_ecdh.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_rand.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_store.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_cipher.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_digest.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_pkmeth.c
+  # $(OPENSSL_PATH)/crypto/engine/tb_asnmth.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_openssl.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_cnf.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_dyn.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_cryptodev.c
+  # $(OPENSSL_PATH)/crypto/engine/eng_rdrand.c
+
+  #
+  # BUFFER
+  #
   $(OPENSSL_PATH)/crypto/buffer/buffer.c
   $(OPENSSL_PATH)/crypto/buffer/buf_str.c
   $(OPENSSL_PATH)/crypto/buffer/buf_err.c
+
+  #
+  # BIO
+  #
   $(OPENSSL_PATH)/crypto/bio/bio_lib.c
   $(OPENSSL_PATH)/crypto/bio/bio_cb.c
   $(OPENSSL_PATH)/crypto/bio/bio_err.c
@@ -298,45 +452,58 @@
   $(OPENSSL_PATH)/crypto/bio/bss_null.c
   $(OPENSSL_PATH)/crypto/bio/bss_fd.c
   $(OPENSSL_PATH)/crypto/bio/bss_file.c
+  $(OPENSSL_PATH)/crypto/bio/bss_sock.c
+  $(OPENSSL_PATH)/crypto/bio/bss_conn.c
   $(OPENSSL_PATH)/crypto/bio/bf_null.c
   $(OPENSSL_PATH)/crypto/bio/bf_buff.c
-
   #
-  # Not required for UEFI.
+  # Not Required by UEFI.
   #
   # $(OPENSSL_PATH)/crypto/bio/b_print.c
-  
   $(OPENSSL_PATH)/crypto/bio/b_dump.c
+  $(OPENSSL_PATH)/crypto/bio/b_sock.c
+  $(OPENSSL_PATH)/crypto/bio/bss_acpt.c
   $(OPENSSL_PATH)/crypto/bio/bf_nbio.c
   $(OPENSSL_PATH)/crypto/bio/bss_log.c
   $(OPENSSL_PATH)/crypto/bio/bss_bio.c
   $(OPENSSL_PATH)/crypto/bio/bss_dgram.c
+
+  #
+  # STACK
+  #
   $(OPENSSL_PATH)/crypto/stack/stack.c
+
+  #
+  # LHASH
+  #
   $(OPENSSL_PATH)/crypto/lhash/lhash.c
   $(OPENSSL_PATH)/crypto/lhash/lh_stats.c
+
+  #
+  # RAND
+  #
   $(OPENSSL_PATH)/crypto/rand/md_rand.c
   $(OPENSSL_PATH)/crypto/rand/randfile.c
   $(OPENSSL_PATH)/crypto/rand/rand_lib.c
-  $(OPENSSL_PATH)/crypto/rand/rand_eng.c
   $(OPENSSL_PATH)/crypto/rand/rand_err.c
-  $(OPENSSL_PATH)/crypto/rand/rand_egd.c
-  $(OPENSSL_PATH)/crypto/rand/rand_win.c
+  # $(OPENSSL_PATH)/crypto/rand/rand_egd.c
+  # $(OPENSSL_PATH)/crypto/rand/rand_win.c
   $(OPENSSL_PATH)/crypto/rand/rand_unix.c
-  $(OPENSSL_PATH)/crypto/rand/rand_os2.c
-  $(OPENSSL_PATH)/crypto/rand/rand_nw.c
+  # $(OPENSSL_PATH)/crypto/rand/rand_os2.c
+  # $(OPENSSL_PATH)/crypto/rand/rand_nw.c
+
+  #
+  # ERR
+  #
   $(OPENSSL_PATH)/crypto/err/err.c
-  $(OPENSSL_PATH)/crypto/err/err_def.c
   $(OPENSSL_PATH)/crypto/err/err_all.c
   $(OPENSSL_PATH)/crypto/err/err_prn.c
-  $(OPENSSL_PATH)/crypto/err/err_str.c
-  $(OPENSSL_PATH)/crypto/err/err_bio.c
-  $(OPENSSL_PATH)/crypto/objects/o_names.c
-  $(OPENSSL_PATH)/crypto/objects/obj_dat.c
-  $(OPENSSL_PATH)/crypto/objects/obj_lib.c
-  $(OPENSSL_PATH)/crypto/objects/obj_err.c
+
+  #
+  # EVP
+  #
   $(OPENSSL_PATH)/crypto/evp/encode.c
   $(OPENSSL_PATH)/crypto/evp/digest.c
-  $(OPENSSL_PATH)/crypto/evp/dig_eng.c
   $(OPENSSL_PATH)/crypto/evp/evp_enc.c
   $(OPENSSL_PATH)/crypto/evp/evp_key.c
   $(OPENSSL_PATH)/crypto/evp/evp_acnf.c
@@ -345,22 +512,25 @@
   $(OPENSSL_PATH)/crypto/evp/e_bf.c
   $(OPENSSL_PATH)/crypto/evp/e_idea.c
   $(OPENSSL_PATH)/crypto/evp/e_des3.c
+  $(OPENSSL_PATH)/crypto/evp/e_camellia.c
   $(OPENSSL_PATH)/crypto/evp/e_rc4.c
   $(OPENSSL_PATH)/crypto/evp/e_aes.c
   $(OPENSSL_PATH)/crypto/evp/names.c
+  $(OPENSSL_PATH)/crypto/evp/e_seed.c
   $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c
   $(OPENSSL_PATH)/crypto/evp/e_rc2.c
   $(OPENSSL_PATH)/crypto/evp/e_cast.c
   $(OPENSSL_PATH)/crypto/evp/e_rc5.c
-  $(OPENSSL_PATH)/crypto/evp/enc_min.c
   $(OPENSSL_PATH)/crypto/evp/m_null.c
   $(OPENSSL_PATH)/crypto/evp/m_md2.c
   $(OPENSSL_PATH)/crypto/evp/m_md4.c
   $(OPENSSL_PATH)/crypto/evp/m_md5.c
   $(OPENSSL_PATH)/crypto/evp/m_sha.c
   $(OPENSSL_PATH)/crypto/evp/m_sha1.c
+  $(OPENSSL_PATH)/crypto/evp/m_wp.c
   $(OPENSSL_PATH)/crypto/evp/m_dss.c
   $(OPENSSL_PATH)/crypto/evp/m_dss1.c
+  $(OPENSSL_PATH)/crypto/evp/m_mdc2.c
   $(OPENSSL_PATH)/crypto/evp/m_ripemd.c
   $(OPENSSL_PATH)/crypto/evp/m_ecdsa.c
   $(OPENSSL_PATH)/crypto/evp/p_open.c
@@ -385,6 +555,17 @@
   $(OPENSSL_PATH)/crypto/evp/p5_crpt.c
   $(OPENSSL_PATH)/crypto/evp/p5_crpt2.c
   $(OPENSSL_PATH)/crypto/evp/e_old.c
+  $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c
+  $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c
+  $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c
+  $(OPENSSL_PATH)/crypto/evp/m_sigver.c
+  $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c
+  $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c
+  $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c
+
+  #
+  # ASN1
+  #
   $(OPENSSL_PATH)/crypto/asn1/a_object.c
   $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c
   $(OPENSSL_PATH)/crypto/asn1/a_utctm.c
@@ -420,6 +601,7 @@
   $(OPENSSL_PATH)/crypto/asn1/x_info.c
   $(OPENSSL_PATH)/crypto/asn1/x_spki.c
   $(OPENSSL_PATH)/crypto/asn1/nsseq.c
+  $(OPENSSL_PATH)/crypto/asn1/x_nx509.c
   $(OPENSSL_PATH)/crypto/asn1/d2i_pu.c
   $(OPENSSL_PATH)/crypto/asn1/d2i_pr.c
   $(OPENSSL_PATH)/crypto/asn1/i2d_pu.c
@@ -437,20 +619,22 @@
   $(OPENSSL_PATH)/crypto/asn1/tasn_dec.c
   $(OPENSSL_PATH)/crypto/asn1/tasn_utl.c
   $(OPENSSL_PATH)/crypto/asn1/tasn_typ.c
+  $(OPENSSL_PATH)/crypto/asn1/tasn_prn.c
+  $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c
   $(OPENSSL_PATH)/crypto/asn1/f_int.c
   $(OPENSSL_PATH)/crypto/asn1/f_string.c
   $(OPENSSL_PATH)/crypto/asn1/n_pkey.c
   $(OPENSSL_PATH)/crypto/asn1/f_enum.c
-  $(OPENSSL_PATH)/crypto/asn1/a_hdr.c
   $(OPENSSL_PATH)/crypto/asn1/x_pkey.c
   $(OPENSSL_PATH)/crypto/asn1/a_bool.c
   $(OPENSSL_PATH)/crypto/asn1/x_exten.c
+  $(OPENSSL_PATH)/crypto/asn1/bio_asn1.c
+  $(OPENSSL_PATH)/crypto/asn1/bio_ndef.c
   $(OPENSSL_PATH)/crypto/asn1/asn_mime.c
   $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c
   $(OPENSSL_PATH)/crypto/asn1/asn1_par.c
   $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c
   $(OPENSSL_PATH)/crypto/asn1/asn1_err.c
-  $(OPENSSL_PATH)/crypto/asn1/a_meth.c
   $(OPENSSL_PATH)/crypto/asn1/a_bytes.c
   $(OPENSSL_PATH)/crypto/asn1/a_strnid.c
   $(OPENSSL_PATH)/crypto/asn1/evp_asn1.c
@@ -459,6 +643,10 @@
   $(OPENSSL_PATH)/crypto/asn1/p5_pbev2.c
   $(OPENSSL_PATH)/crypto/asn1/p8_pkey.c
   $(OPENSSL_PATH)/crypto/asn1/asn_moid.c
+
+  #
+  # PEM
+  #
   $(OPENSSL_PATH)/crypto/pem/pem_sign.c
   $(OPENSSL_PATH)/crypto/pem/pem_seal.c
   $(OPENSSL_PATH)/crypto/pem/pem_info.c
@@ -470,6 +658,11 @@
   $(OPENSSL_PATH)/crypto/pem/pem_oth.c
   $(OPENSSL_PATH)/crypto/pem/pem_pk8.c
   $(OPENSSL_PATH)/crypto/pem/pem_pkey.c
+  $(OPENSSL_PATH)/crypto/pem/pvkfmt.c
+
+  #
+  # X509
+  #
   $(OPENSSL_PATH)/crypto/x509/x509_def.c
   $(OPENSSL_PATH)/crypto/x509/x509_d2.c
   $(OPENSSL_PATH)/crypto/x509/x509_r2x.c
@@ -491,9 +684,16 @@
   $(OPENSSL_PATH)/crypto/x509/x_all.c
   $(OPENSSL_PATH)/crypto/x509/x509_txt.c
   $(OPENSSL_PATH)/crypto/x509/x509_trs.c
-  $(OPENSSL_PATH)/crypto/x509/by_file.c
-  $(OPENSSL_PATH)/crypto/x509/by_dir.c
+  #
+  #  Not Required by UEFI.
+  #
+  # $(OPENSSL_PATH)/crypto/x509/by_file.c
+  # $(OPENSSL_PATH)/crypto/x509/by_dir.c
   $(OPENSSL_PATH)/crypto/x509/x509_vpm.c
+
+  #
+  # X509v3
+  #
   $(OPENSSL_PATH)/crypto/x509v3/v3_bcons.c
   $(OPENSSL_PATH)/crypto/x509v3/v3_bitst.c
   $(OPENSSL_PATH)/crypto/x509v3/v3_conf.c
@@ -530,6 +730,14 @@
   $(OPENSSL_PATH)/crypto/x509v3/pcy_lib.c
   $(OPENSSL_PATH)/crypto/x509v3/v3_asid.c
   $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c
+  #
+  #  Not Required by UEFI.
+  #
+  # $(OPENSSL_PATH)/crypto/x509v3/v3_scts.c
+
+  #
+  # CONF
+  #
   $(OPENSSL_PATH)/crypto/conf/conf_err.c
   $(OPENSSL_PATH)/crypto/conf/conf_lib.c
   $(OPENSSL_PATH)/crypto/conf/conf_api.c
@@ -537,7 +745,15 @@
   $(OPENSSL_PATH)/crypto/conf/conf_mod.c
   $(OPENSSL_PATH)/crypto/conf/conf_mall.c
   $(OPENSSL_PATH)/crypto/conf/conf_sap.c
+
+  #
+  # TXT_DB
+  #
   $(OPENSSL_PATH)/crypto/txt_db/txt_db.c
+
+  #
+  # PKCS7
+  #
   $(OPENSSL_PATH)/crypto/pkcs7/pk7_asn1.c
   $(OPENSSL_PATH)/crypto/pkcs7/pk7_lib.c
   $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c
@@ -545,6 +761,11 @@
   $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c
   $(OPENSSL_PATH)/crypto/pkcs7/pk7_attr.c
   $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c
+  $(OPENSSL_PATH)/crypto/pkcs7/bio_pk7.c
+
+  #
+  # PKCS12
+  #
   $(OPENSSL_PATH)/crypto/pkcs12/p12_add.c
   $(OPENSSL_PATH)/crypto/pkcs12/p12_asn.c
   $(OPENSSL_PATH)/crypto/pkcs12/p12_attr.c
@@ -560,68 +781,96 @@
   $(OPENSSL_PATH)/crypto/pkcs12/pk12err.c
   $(OPENSSL_PATH)/crypto/pkcs12/p12_p8d.c
   $(OPENSSL_PATH)/crypto/pkcs12/p12_p8e.c
+
+  #
+  # COMP
+  #
   $(OPENSSL_PATH)/crypto/comp/comp_lib.c
   $(OPENSSL_PATH)/crypto/comp/comp_err.c
   $(OPENSSL_PATH)/crypto/comp/c_rle.c
   $(OPENSSL_PATH)/crypto/comp/c_zlib.c
 
   #
-  # Disabled by OPENSSL_NO_ENGINE
+  # OCSP - Disabled by OPENSSL_NO_OCSP
   #
-  # $(OPENSSL_PATH)/crypto/engine/eng_err.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_lib.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_list.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_init.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_ctrl.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_table.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_pkey.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_fat.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_all.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_rsa.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_dsa.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_ecdsa.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_dh.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_ecdh.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_rand.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_store.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_cipher.c
-  # $(OPENSSL_PATH)/crypto/engine/tb_digest.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_openssl.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_cnf.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_dyn.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_cryptodev.c
-  # $(OPENSSL_PATH)/crypto/engine/eng_padlock.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_asn.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_ext.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_ht.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_lib.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_cl.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_srv.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_prn.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_vfy.c
+  $(OPENSSL_PATH)/crypto/ocsp/ocsp_err.c
 
   #
-  # Disabled by OPENSSL_NO_OCSP
+  # UI
   #
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_asn.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_ext.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_ht.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_lib.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_cl.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_srv.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_prn.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_vfy.c
-  # $(OPENSSL_PATH)/crypto/ocsp/ocsp_err.c
-
-  $(OPENSSL_PATH)/crypto/ui/ui_err.c
   $(OPENSSL_PATH)/crypto/ui/ui_lib.c
-
   #
-  # Not required when OPENSSL_NO_STDIO is set, which is is for UEFI.
+  #  Not Required by UEFI.
   #
+  # $(OPENSSL_PATH)/crypto/ui/ui_err.c
   # $(OPENSSL_PATH)/crypto/ui/ui_openssl.c
-
   $(OPENSSL_PATH)/crypto/ui/ui_util.c
   $(OPENSSL_PATH)/crypto/ui/ui_compat.c
+
+  #
+  # KRB5
+  #
   $(OPENSSL_PATH)/crypto/krb5/krb5_asn.c
-  $(OPENSSL_PATH)/crypto/store/str_err.c
-  $(OPENSSL_PATH)/crypto/store/str_lib.c
-  $(OPENSSL_PATH)/crypto/store/str_meth.c
-  $(OPENSSL_PATH)/crypto/store/str_mem.c
+
+  #
+  # CMS - Disabled by OPENSSL_NO_CMS
+  #
+  # $(OPENSSL_PATH)/crypto/cms/cms_lib.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_asn1.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_att.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_io.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_smime.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_err.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_sd.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_dd.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_cd.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_env.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_enc.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_ess.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_pwri.c
+  # $(OPENSSL_PATH)/crypto/cms/cms_kari.c
+
+  #
+  # PQUEUE
+  #
   $(OPENSSL_PATH)/crypto/pqueue/pqueue.c
 
+  #
+  # TS
+  #
+  $(OPENSSL_PATH)/crypto/ts/ts_err.c
+  $(OPENSSL_PATH)/crypto/ts/ts_req_utils.c
+  $(OPENSSL_PATH)/crypto/ts/ts_req_print.c
+  $(OPENSSL_PATH)/crypto/ts/ts_rsp_utils.c
+  $(OPENSSL_PATH)/crypto/ts/ts_rsp_print.c
+  $(OPENSSL_PATH)/crypto/ts/ts_rsp_sign.c
+  $(OPENSSL_PATH)/crypto/ts/ts_rsp_verify.c
+  $(OPENSSL_PATH)/crypto/ts/ts_verify_ctx.c
+  $(OPENSSL_PATH)/crypto/ts/ts_lib.c
+  $(OPENSSL_PATH)/crypto/ts/ts_conf.c
+  $(OPENSSL_PATH)/crypto/ts/ts_asn1.c
+
+  #
+  # SRP - Disabled by OPENSSL_NO_SRP
+  #
+  # $(OPENSSL_PATH)/crypto/srp/srp_lib.c
+  # $(OPENSSL_PATH)/crypto/srp/srp_vfy.c
+
+  #
+  # CMAS
+  #
+  $(OPENSSL_PATH)/crypto/cmac/cmac.c
+  $(OPENSSL_PATH)/crypto/cmac/cm_ameth.c
+  $(OPENSSL_PATH)/crypto/cmac/cm_pmeth.c
+
 [Packages]
   MdePkg/MdePkg.dec
   CryptoPkg/CryptoPkg.dec
@@ -630,47 +879,44 @@
   DebugLib
 
 [BuildOptions]
-   #
-   # Override MSFT build option to remove /W4 (to silence warning messages when building OpenSSL).
-   #
-   MSFT:DEBUG_VS2003_IA32_CC_FLAGS        == /nologo /c /WX /Gs32768 /Gy /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /GX- /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:RELEASE_VS2003_IA32_CC_FLAGS      == /nologo /c /WX /Gs32768 /Gy /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /GX- -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w  -DTHIRTY_TWO_BIT
-   MSFT:DEBUG_VS2003xASL_IA32_CC_FLAGS    == /nologo /c /WX /Gs32768 /Gy /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /GX- /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:RELEASE_VS2003xASL_IA32_CC_FLAGS  == /nologo /c /WX /Gs32768 /Gy /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /GX- -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:DEBUG_DDK3790_IA32_CC_FLAGS       == /nologo /c /WX /Gy /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:RELEASE_DDK3790_IA32_CC_FLAGS     == /nologo /c /WX /Gy /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:DEBUG_DDK3790xASL_IA32_CC_FLAGS   == /nologo /c /WX /Gy /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:RELEASE_DDK3790xASL_IA32_CC_FLAGS == /nologo /c /WX /Gy /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:DEBUG_*_IA32_CC_FLAGS             == /nologo /c /WX /GS- /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF /Gy /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:RELEASE_*_IA32_CC_FLAGS           == /nologo /c /WX /GS- /Gs32768 /D UNICODE /O1ib2 /GL /FIAutoGen.h /EHs-c- /GR- /GF -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:NOOPT_*_IA32_CC_FLAGS             == /nologo /c /WX /GS- /Gs32768 /D UNICODE /Od /FIAutoGen.h /EHs-c- /GR- /GF /Gy /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   MSFT:DEBUG_*_X64_CC_FLAGS              == /nologo /c /WX /GS- /X /Gs32768 /D UNICODE /O1ib2s /GL /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   MSFT:RELEASE_*_X64_CC_FLAGS            == /nologo /c /WX /GS- /X /Gs32768 /D UNICODE /O1ib2s /GL /Gy /FIAutoGen.h /EHs-c- /GR- /GF -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   MSFT:NOOPT_*_X64_CC_FLAGS              == /nologo /c /WX /GS- /X /Gs32768 /D UNICODE /Od /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   MSFT:DEBUG_*_IPF_CC_FLAGS              == /nologo /c /WX /GS- /X /EHs-c- /GR- /Gy /Os /GL /FIAutoGen.h /QIPF_fr32 /Zi -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   MSFT:RELEASE_*_IPF_CC_FLAGS            == /nologo /c /WX /GS- /X /EHs-c- /GR- /Gy /Os /GL /FIAutoGen.h /QIPF_fr32 -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   MSFT:NOOPT_*_IPF_CC_FLAGS              == /nologo /c /WX /GS- /X /EHs-c- /GR- /Gy /Od /FIAutoGen.h /QIPF_fr32 /Zi -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   INTEL:*_*_IA32_CC_FLAGS                = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
-   INTEL:*_*_X64_CC_FLAGS                 = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   INTEL:*_*_IPF_CC_FLAGS                 = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
-   GCC:*_*_IA32_CC_FLAGS                  = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
-   GCC:*_*_X64_CC_FLAGS                   = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT
-   GCC:*_*_IPF_CC_FLAGS                   = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT
-   GCC:*_*_ARM_CC_FLAGS                   = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
-   GCC:*_*_AARCH64_CC_FLAGS               = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT
+  #
+  # Disables the following Visual Studio compiler warnings brought by openssl source, so we do not break the build with /WX option:
+  # C4244: conversion from type1 to type2, possible loss of data
+  # C4702: unreachable code
+  # C4706: assignment within conditional expression
+  # C4133: incompatible types - from type1 to type2
+  # C4245: conversion from type1 to type2, signed/unsigned mismatch
+  # C4267: conversion from size_t to type, possible loss of data
+  # C4305: truncation from type1 to type2 of smaller size
+  # C4306: conversion from type1 to type2 of greater size
+  # C4702: Potentially uninitialized local variable name used
+  #
+  MSFT:*_*_IA32_CC_FLAGS    = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -DTHIRTY_TWO_BIT /wd4244 /wd4701 /wd4702 /wd4706
+  MSFT:*_*_X64_CC_FLAGS     = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -DSIXTY_FOUR_BIT /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 /wd4306 /wd4702 /wd4706
+  MSFT:*_*_IPF_CC_FLAGS     = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -DSIXTY_FOUR_BIT /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 /wd4306 /wd4702 /wd4706
 
-   # suppress the following warnings in openssl so we don't break the build with warnings-as-errors:
-   # 1295: Deprecated declaration <entity> - give arg types
-   #  550: <entity> was set but never used
-   # 1293: assignment in condition
-   #  111: statement is unreachable (invariably "break;" after "return X;" in case statement)
-   #   68: integer conversion resulted in a change of sign ("if (Status == -1)")
-   #  177: <entity> was declared but never referenced
-   #  223: function <entity> declared implicitly
-   #  144: a value of type <type> cannot be used to initialize an entity of type <type>
-   #  513: a value of type <type> cannot be assigned to an entity of type <type>
-   #  188: enumerated type mixed with another type (i.e. passing an integer as an enum without a cast)
-   # 1296: Extended constant initialiser used
-   RVCT:*_*_ARM_CC_FLAGS                  = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) --library_interface=aeabi_clib99 --fpu=vfpv3 -DTHIRTY_TWO_BIT --diag_suppress=1296,1295,550,1293,111,68,177,223,144,513,188
-   XCODE:*_*_IA32_CC_FLAGS                = -mmmx -msse -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
-   XCODE:*_*_X64_CC_FLAGS                 = -mmmx -msse -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT
+  INTEL:*_*_IA32_CC_FLAGS   = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DTHIRTY_TWO_BIT
+  INTEL:*_*_X64_CC_FLAGS    = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
+  INTEL:*_*_IPF_CC_FLAGS    = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) /w -DSIXTY_FOUR_BIT
+
+  GCC:*_*_IA32_CC_FLAGS     = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
+  GCC:*_*_X64_CC_FLAGS      = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT_LONG
+  GCC:*_*_IPF_CC_FLAGS      = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT_LONG
+  GCC:*_*_ARM_CC_FLAGS      = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
+  GCC:*_*_AARCH64_CC_FLAGS  = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT_LONG
+
+  # suppress the following warnings in openssl so we don't break the build with warnings-as-errors:
+  # 1295: Deprecated declaration <entity> - give arg types
+  #  550: <entity> was set but never used
+  # 1293: assignment in condition
+  #  111: statement is unreachable (invariably "break;" after "return X;" in case statement)
+  #   68: integer conversion resulted in a change of sign ("if (Status == -1)")
+  #  177: <entity> was declared but never referenced
+  #  223: function <entity> declared implicitly
+  #  144: a value of type <type> cannot be used to initialize an entity of type <type>
+  #  513: a value of type <type> cannot be assigned to an entity of type <type>
+  #  188: enumerated type mixed with another type (i.e. passing an integer as an enum without a cast)
+  # 1296: Extended constant initialiser used
+  RVCT:*_*_ARM_CC_FLAGS     = $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) --library_interface=aeabi_clib99 --fpu=vfpv3 -DTHIRTY_TWO_BIT --diag_suppress=1296,1295,550,1293,111,68,177,223,144,513,188
+  XCODE:*_*_IA32_CC_FLAGS   = -mmmx -msse -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DTHIRTY_TWO_BIT
+  XCODE:*_*_X64_CC_FLAGS    = -mmmx -msse -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) $(OPENSSL_EXFLAGS) -w -DSIXTY_FOUR_BIT_LONG
diff --git a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
index de60a5f..59e74ee 100644
--- a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
+++ b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt
@@ -4,49 +4,49 @@
 ================================================================================
   OpenSSL is a well-known open source implementation of SSL and TLS protocols.
 The core library implements the basic cryptographic functions and provides various
-utility functions. The OpenSSL library is widely used in variety of security 
-products development as base crypto provider. (See http://www.openssl.org for more 
+utility functions. The OpenSSL library is widely used in variety of security
+products development as base crypto provider. (See http://www.openssl.org for more
 information for OpenSSL).
-  UEFI (Unified Extensible Firmware Interface) is a specification detailing the 
-interfaces between OS and platform firmware. Several security features were 
-introduced (e.g. Authenticated Variable Service, Driver Signing, etc) from UEFI 
-2.2 (http://www.uefi.org). These security features highly depends on the 
+  UEFI (Unified Extensible Firmware Interface) is a specification detailing the
+interfaces between OS and platform firmware. Several security features were
+introduced (e.g. Authenticated Variable Service, Driver Signing, etc) from UEFI
+2.2 (http://www.uefi.org). These security features highly depends on the
 cryptography. This patch will enable openssl building under UEFI environment.
 
 
 ================================================================================
                                 OpenSSL-Version
 ================================================================================
-  Current supported OpenSSL version for UEFI Crypto Library is 0.9.8zf.
-    http://www.openssl.org/source/openssl-0.9.8zf.tar.gz
+  Current supported OpenSSL version for UEFI Crypto Library is 1.0.2d.
+    http://www.openssl.org/source/openssl-1.0.2d.tar.gz
 
 
 ================================================================================
                       HOW to Install Openssl for UEFI Building
 ================================================================================
-1.  Download OpenSSL 0.9.8zf from official website:
-   	http://www.openssl.org/source/openssl-0.9.8zf.tar.gz
+1.  Download OpenSSL 1.0.2d from official website:
+    http://www.openssl.org/source/openssl-1.0.2d.tar.gz
 
-    NOTE: Some web browsers may rename the downloaded TAR file to openssl-0.9.8zf.tar.tar.
-          When you do the download, rename the "openssl-0.9.8zf.tar.tar" to
-          "openssl-0.9.8zf.tar.gz" or rename the local downloaded file with ".tar.tar"
+    NOTE: Some web browsers may rename the downloaded TAR file to openssl-1.0.2d.tar.tar.
+          When you do the download, rename the "openssl-1.0.2d.tar.tar" to
+          "openssl-1.0.2d.tar.gz" or rename the local downloaded file with ".tar.tar"
           extension to ".tar.gz".
 
-2.  Extract TAR into CryptoPkg/Library/OpenSslLib/openssl-0.9.8zf
+2.  Extract TAR into CryptoPkg/Library/OpenSslLib/openssl-1.0.2d
 
-    NOTE: If you use WinZip to unpack the openssl source in Windows, please 
-          uncheck the WinZip smart CR/LF conversion option (WINZIP: Options --> 
+    NOTE: If you use WinZip to unpack the openssl source in Windows, please
+          uncheck the WinZip smart CR/LF conversion option (WINZIP: Options -->
           Configuration --> Miscellaneous --> "TAR file smart CR/LF conversion").
-  
-3.  Apply this patch: EDKII_openssl-0.9.8zf.patch, and make installation
+
+3.  Apply this patch: EDKII_openssl-1.0.2d.patch, and make installation
 
     For Windows Environment:
     ------------------------
     1) Make sure the patch utility has been installed in your machine.
-       Install Cygwin or get the patch utility binary from 
+       Install Cygwin or get the patch utility binary from
           http://gnuwin32.sourceforge.net/packages/patch.htm
-    2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-0.9.8zf
-    3) patch -p0 -i ..\EDKII_openssl-0.9.8zf.patch
+    2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-1.0.2d
+    3) patch -p0 -i ..\EDKII_openssl-1.0.2d.patch
     4) cd ..
     5) Install.cmd
 
@@ -54,8 +54,8 @@
     -----------------------
     1) Make sure the patch utility has been installed in your machine.
        Patch utility is available from http://directory.fsf.org/project/patch/
-    2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-0.9.8zf
-    3) patch -p0 -i ../EDKII_openssl-0.9.8zf.patch
+    2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-1.0.2d
+    3) patch -p0 -i ../EDKII_openssl-1.0.2d.patch
     4) cd ..
     5) ./Install.sh