static void
init(void) {
    logger_init(daemon_mode);

    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

#ifndef _WIN32
    signal(SIGPIPE, SIG_IGN);
    signal(SIGCHLD, SIG_IGN);
    signal(SIGABRT, SIG_IGN);
#endif

    if (crypto_init(password)) {
        logger_log(LOG_ERR, "crypto init failed");
        exit(1);
    }

    resolver_prepare(nameserver_num);
    uv_key_create(&thread_resolver_key);

    if (idle_timeout == 0) {
        idle_timeout = 60;
    }
}

void
app_startup(void)
{
  msg_init(FALSE);
  iv_set_fatal_msg_handler(app_fatal);
  iv_init();
  g_thread_init(NULL);
  crypto_init();
  hostname_global_init();
  dns_caching_global_init();
  dns_caching_thread_init();
  afinter_global_init();
  child_manager_init();
  alarm_init();
  stats_init();
  tzset();
  log_msg_global_init();
  log_tags_global_init();
  log_source_global_init();
  log_template_global_init();
  value_pairs_global_init();
  service_management_init();
  scratch_buffers_allocator_init();
  main_loop_thread_resource_init();
  nondumpable_setlogger(nondumpable_allocator_logger);
  secret_storage_init();
  transport_factory_id_global_init();
}

void
test_crypto (enum transform which)
{
  u_int8_t buf[256];
  struct crypto_xf *xf;
  struct keystate *ks;
  enum cryptoerr err;

  xf = crypto_get (which);
  printf ("Testing %s: ", xf->name);

  SET_KEY (buf, xf->keymax);
  ks = crypto_init (xf, buf, xf->keymax, &err);
  if (!ks)
    {
      printf ("FAILED (init %d)", err);
      goto fail;
    }
  SET_KEY (buf, sizeof (buf));
  crypto_init_iv (ks, buf, xf->blocksize);
  crypto_encrypt (ks, buf, sizeof (buf));
  dump_buf (buf, sizeof buf);
  crypto_decrypt (ks, buf, sizeof (buf));
  if (!verify_buf (buf, sizeof (buf)))
    printf ("FAILED ");
  else
    printf ("OKAY ");

  free (ks);

 fail:
  printf ("\n");
  return;
}

void cli_session(int sock_in, int sock_out) {

	seedrandom();

	crypto_init();

	common_session_init(sock_in, sock_out);

	chaninitialise(cli_chantypes);

	/* Set up cli_ses vars */
	cli_session_init();

	/* Ready to go */
	sessinitdone = 1;

	/* Exchange identification */
	session_identification();

	send_msg_kexinit();

	session_loop(cli_sessionloop);

	/* Not reached */

}

const unsigned char * objectcrypto_decrypt(char *user, char *object, char *content, char *passphrase)
{
  //the three keys
  const unsigned char *K1, *K2, *K2E, *IV, *De;
  
  //initialize
  crypto_init();

  //first, obtain K1 by hashing the passphrase.
  K1 = crypto_MD5(passphrase);

  //second, obtain K2E from the keySafe:
  K2E = keyset_retrieve(user, object);


  //third, use this to decrypt K2E to find K2.
  IV = IVSTRING;//_setIV(K1);
  K2 = crypto_decryptAES(K1, IV, K2E);
  //fourth, once you have K2, you can decrypt the content
  De = crypto_decryptAES(K2, IV, content);

  //check if the original file was blank 
  if (strncmp(De, blankFile, 16) == 0)
  {
    De = NULL;
  }

  crypto_destroy();

  //return this content
  return De;
}

static void
init(void) {
#ifdef ANDROID
    logger_init(0);
#else
    logger_init(daemon_mode);
#endif

    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

#if !defined(_WIN32)
    signal(SIGPIPE, SIG_IGN);
    signal(SIGCHLD, SIG_IGN);
    signal(SIGABRT, SIG_IGN);
#endif

    if (crypto_init(password)) {
        logger_stderr("crypto init failed");
        exit(1);
    }

    if (idle_timeout == 0) {
        idle_timeout = 60;
    }

#if !defined(_WIN32)
    if (acl_file != NULL) {
        acl = !acl_init(acl_file);
    }
#endif
}

void service_init(struct service *sv, uint16_t port, const char *key, const char *capture, const char *playback, uint32_t bitrate,
        void (*handler)(enum service_event event, const uint8_t uid[20], void *args), void *args)
{
    sv->state = STATE_IDLE;
    sv->state_handler = handler;
    sv->state_args = args;
    sv->epfd = epoll_create1(0); assert(sv->epfd > 0);
    sv->timerfd = timerfd_create(CLOCK_MONOTONIC, 0); assert(sv->timerfd > 0);
    service_pollfd(sv, sv->timerfd, (void(*)(void*))timer_handler, sv);

    const int optval = 1;
    const struct sockaddr_in addr = { AF_INET, htons(port) };
    sv->sockfd = socket(AF_INET, SOCK_DGRAM, 0); assert(sv->sockfd > 0);
    int res = setsockopt(sv->sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval)); assert(res == 0);
    if(bind(sv->sockfd, (struct sockaddr*)&addr, sizeof(addr)) != 0) { ERROR("Cannot bind socket"); abort(); }
    service_pollfd(sv, sv->sockfd, (void(*)(void*))socket_handler, sv);

    route_init(sv->table);
    sv->crypto = (struct crypto*)((void*)sv + sizeof(struct service));
    crypto_init(sv->crypto, key, sv->srcid);
    sv->media = (struct media*)((void*)sv + sizeof(struct service) + crypto_sizeof());
    media_init(sv->media, capture, playback);
    sv->packet_size = bitrate / 8 / 50;
    INFO("Media: bitrate = %u, capture = %s, playback = %s", bitrate, capture, playback);

    char tmp[128]; INFO("User ID is %.40s", hexify(sv->srcid, tmp, 20));
}

/**
 *  Parse the config file, and initiate the host and crypto modules.
 */
int init (void)
{
        int port, max, capup, capdown;
        parser_load_config(&port, &max, &capup, &capdown);
        crypto_init();
        return host_init_server(port, max, capup, capdown);
}

int main(int argc, char **argv) {

    unsigned char *x;
    unsigned long long xlen;

    if (argv[0])
        if (argv[1]) {
            if (str_equal(argv[1], "-h"))
                die_usage(0);
        }

    /* get password  */
    x = (unsigned char *)env_get("PASSWORD");
    if (!x) { errno = 0; die_usage("$PASSWORD not set"); }
    xlen = str_len((char *)x);

    /* create salt */
    randombytes(s, sizeof s);

    /* derive key  */
    if (sha512hmacpbkdf2(h, sizeof h, x, xlen, s, sizeof s, ROUNDS) == -1) die_fatal("unable to derive keys", 0);
    byte_zero(x, xlen);

    /* create nonce */
    randombytes(n, sizeof n);
    uint64_pack(n, nanoseconds());
    sha512(nk, (unsigned char *)MAGIC, MAGICBYTES);
    crypto_block_aes256vulnerable(n, n, nk);

    /* initialize */
    crypto_init(&ctx, n, h, MAGIC);
    randombytes(h, sizeof h);
    sha512_init(&shactx);

    /* write header */
    if (writeall(1, MAGIC, MAGICBYTES) == -1) die_fatal("unable to write output", 0);
    if (writeall(1, s, sizeof s) == -1) die_fatal("unable to write output", 0);
    randombytes(s, sizeof s);
    if (writeall(1, n, sizeof n) == -1) die_fatal("unable to write output", 0);

    for (;;) {
        inlen = readblock(in, BLOCK);
        if (inlen != BLOCK) break;
        if (sha512_block(&shactx, in, inlen) != 0) die_fatal("unable to compute hash", 0);
        if (crypto_block(&ctx, in, inlen) != 0) die_fatal("unable to encrypt stream", 0);
        if (writeall(1, in, inlen) == -1) die_fatal("unable to write output", 0);
    }
    if (sha512_last(&shactx, h, in, inlen) != 0) die_fatal("unable to compute hash", 0);
    byte_copy(in + inlen, CHECKSUMBYTES, h);
    inlen += CHECKSUMBYTES;
    if (crypto_last(&ctx, in, inlen) != 0) die_fatal("unable to encrypt stream", 0);
    if (writeall(1, in, inlen) == -1) die_fatal("unable to write output", 0);

    if (fsyncfd(1) == -1) die_fatal("unable to write output", 0);
    cleanup();
    _exit(0);
}

void mvWLAN_init_crypt_lib(local_info_t *local)
{
	crypto_init();

	INIT_LIST_HEAD(&local->crypt_deinit_list);
	init_timer(&local->crypt_deinit_timer);
	local->crypt_deinit_timer.data = (unsigned long) local;
	local->crypt_deinit_timer.function = crypt_deinit_handler;
}

/**
 * u2fs_global_init:
 * @flags: initialization flags, ORed #u2fs_initflags.
 *
 * Initialize the library.  This function is not guaranteed to be
 * thread safe and must be invoked on application startup.
 *
 * Returns: On success %U2FS_OK (integer 0) is returned, and on errors
 * an #u2fs_rc error code.
 */
u2fs_rc u2fs_global_init(u2fs_initflags flags)
{
  if (flags & U2FS_DEBUG)
    debug = 1;

  crypto_init();

  return U2FS_OK;
}

void
storage_init (struct config_data_storage *config_storage)
{
	void crypto_init (void);

	crypto_init ();
	cfg = config_storage;
	storage_desc = msgregister ("storage", storage_msghandler);
}

static int load_module(void *mod)
{
	crypto_init();
	if (ast_opt_init_keys)
		crypto_load(STDIN_FILENO, STDOUT_FILENO);
	else
		crypto_load(-1, -1);
	return 0;
}

gboolean
crypto_randomize (void *buffer, gsize buffer_len, GError **error)
{
    if (!crypto_init (error))
        return FALSE;

    gnutls_rnd (GNUTLS_RND_RANDOM, buffer, buffer_len);
    return TRUE;
}

int load_module(void)
{
	crypto_init();
	if (option_initcrypto)
		crypto_load(STDIN_FILENO, STDOUT_FILENO);
	else
		crypto_load(-1, -1);
	return 0;
}

void trng_init(trng_t *obj)
{
    (void)obj;
    
    /* Init crypto module */
    crypto_init();
    
    PRNG_ENABLE_INT();
}

END_TEST


START_TEST(check_ec_serialization)
{
	EC_KEY *pair, *pair2;
	unsigned char *sbuf, *sbuf2;
	int res;
	size_t ssize, ssize2;

	res = crypto_init();
	ck_assert_msg(!res, "Crypto initialization routine failed.\n");

	for (size_t i = 0; i < N_SERIALIZATION_TESTS; i++) {
		pair = _generate_ec_keypair(0);
		ck_assert_msg((pair != NULL), "EC serialization check failed: could not generate key pair.\n");

		sbuf = _serialize_ec_pubkey(pair, &ssize);
		ck_assert_msg((sbuf != NULL), "EC serialization check failed: pubkey serialization error.\n");

		pair2 = _deserialize_ec_pubkey(sbuf, ssize, 0);
		ck_assert_msg((pair2 != NULL), "EC serialization check failed: pubkey deserialization error.\n");

		sbuf2 = _serialize_ec_pubkey(pair, &ssize2);
		ck_assert_msg((sbuf2 != NULL), "EC serialization check failed: pubkey serialization error [2].\n");

		ck_assert_msg((ssize == ssize2), "EC serialization check failed: serialized pubkeys had different serialized lengths {%u vs %u}\n", ssize, ssize2);

		res = memcmp(sbuf, sbuf2, ssize);
		ck_assert_msg(!res, "EC serialization check failed: serialized pubkeys had different data.\n");

		free(sbuf);
		free(sbuf2);

		_free_ec_key(pair2);

		sbuf = _serialize_ec_privkey(pair, &ssize);
		ck_assert_msg((sbuf != NULL), "EC serialization check failed: pubkey serialization error.\n");

		pair2 = _deserialize_ec_privkey(sbuf, ssize, 0);
		ck_assert_msg((pair2 != NULL), "EC serialization check failed: pubkey deserialization error.\n");

		sbuf2 = _serialize_ec_privkey(pair, &ssize2);
		ck_assert_msg((sbuf2 != NULL), "EC serialization check failed: pubkey serialization error [2].\n");

		ck_assert_msg((ssize == ssize2), "EC serialization check failed: serialized pubkeys had different serialized lengths {%u vs %u}\n", ssize, ssize2);

		res = memcmp(sbuf, sbuf2, ssize);
		ck_assert_msg(!res, "EC serialization check failed: serialized pubkeys had different data.\n");

		free(sbuf);
		free(sbuf2);
		free_ec_key(pair);
	}

	fprintf(stderr, "EC serialization check completed.\n");
}

gboolean
crypto_verify_pkcs12 (const guint8 *data,
                      gsize data_len,
                      const char *password,
                      GError **error)
{
    gnutls_pkcs12_t p12;
    gnutls_datum_t dt;
    gboolean success = FALSE;
    int err;

    g_return_val_if_fail (data != NULL, FALSE);

    if (!crypto_init (error))
        return FALSE;

    dt.data = (unsigned char *) data;
    dt.size = data_len;

    err = gnutls_pkcs12_init (&p12);
    if (err < 0) {
        g_set_error (error, NM_CRYPTO_ERROR,
                     NM_CRYPTO_ERROR_FAILED,
                     _("Couldn't initialize PKCS#12 decoder: %s"),
                     gnutls_strerror (err));
        return FALSE;
    }

    /* DER first */
    err = gnutls_pkcs12_import (p12, &dt, GNUTLS_X509_FMT_DER, 0);
    if (err < 0) {
        /* PEM next */
        err = gnutls_pkcs12_import (p12, &dt, GNUTLS_X509_FMT_PEM, 0);
        if (err < 0) {
            g_set_error (error, NM_CRYPTO_ERROR,
                         NM_CRYPTO_ERROR_INVALID_DATA,
                         _("Couldn't decode PKCS#12 file: %s"),
                         gnutls_strerror (err));
            goto out;
        }
    }

    err = gnutls_pkcs12_verify_mac (p12, password);
    if (err == GNUTLS_E_SUCCESS)
        success = TRUE;
    else {
        g_set_error (error, NM_CRYPTO_ERROR,
                     NM_CRYPTO_ERROR_DECRYPTION_FAILED,
                     _("Couldn't verify PKCS#12 file: %s"),
                     gnutls_strerror (err));
    }

out:
    gnutls_pkcs12_deinit (p12);
    return success;
}

int dropbearconvert_main(int argc, char ** argv) {
#else 
int main(int argc, char ** argv) {
#endif

	int intype, outtype;
	const char* infile;
	const char* outfile;

	crypto_init();
	seedrandom();

#if DEBUG_TRACE
	/* It's hard for it to get in the way _too_ much */
	debug_trace = 1;
#endif

	/* get the commandline options */
	if (argc != 5) {
		fprintf(stderr, "All arguments must be specified\n");
		goto usage;
	}

	/* input type */
	if (argv[1][0] == 'd') {
		intype = KEYFILE_DROPBEAR;
	} else if (argv[1][0] == 'o') {
		intype = KEYFILE_OPENSSH;
	} else {
		fprintf(stderr, "Invalid input key type\n");
		goto usage;
	}

	/* output type */
	if (argv[2][0] == 'd') {
		outtype = KEYFILE_DROPBEAR;
	} else if (argv[2][0] == 'o') {
		outtype = KEYFILE_OPENSSH;
	} else {
		fprintf(stderr, "Invalid output key type\n");
		goto usage;
	}

	/* we don't want output readable by others */
	umask(077);

	infile = argv[3];
	outfile = argv[4];

	return do_convert(intype, infile, outtype, outfile);

usage:
	printhelp(argv[0]);
	return 1;
}

void svr_session(int sock, int childpipe) {
	char *host, *port;
	size_t len;
    reseedrandom();

	crypto_init();
	common_session_init(sock, sock);

	/* Initialise server specific parts of the session */
	svr_ses.childpipe = childpipe;
#ifdef __uClinux__
	svr_ses.server_pid = getpid();
#endif
	svr_authinitialise();
	chaninitialise(svr_chantypes);
	svr_chansessinitialise();

	ses.connect_time = time(NULL);

	/* for logging the remote address */
	get_socket_address(ses.sock_in, NULL, NULL, &host, &port, 0);
	len = strlen(host) + strlen(port) + 2;
	svr_ses.addrstring = m_malloc(len);
	snprintf(svr_ses.addrstring, len, "%s:%s", host, port);
	m_free(host);
	m_free(port);

	get_socket_address(ses.sock_in, NULL, NULL, 
			&svr_ses.remotehost, NULL, 1);

	/* set up messages etc */
	ses.remoteclosed = svr_remoteclosed;

	/* packet handlers */
	ses.packettypes = svr_packettypes;
	ses.buf_match_algo = svr_buf_match_algo;

	ses.isserver = 1;

	/* We're ready to go now */
	sessinitdone = 1;

	/* exchange identification, version etc */
	session_identification();

	/* start off with key exchange */
	send_msg_kexinit();

	/* Run the main for loop. NULL is for the dispatcher - only the client
	 * code makes use of it */
	session_loop(NULL);

	/* Not reached */

}