diff --git a/Makefile b/Makefile
index 6175a10..855e6db 100644
--- a/Makefile
+++ b/Makefile
@@ -3,53 +3,56 @@
 # nm ntd_crypto_rsa.o | grep " [T|B|D] "
 # nm generate_id.o | grep " [T|B|D] "
 # nm ../rsa_keysrcgen/rsa1_key.o | grep " [T|B|D] "
-
-# nFast Path
-NFAST_PATH = /opt/nfast
-
-# nFast Developer tools installation
-NFAST_DEV_PATH = $(NFAST_PATH)/c/ctd/gcc
-NFAST_EXAMPLES = $(NFAST_PATH)/c/ctd/examples
-
-# nFast Developer tools library
-NFAST_LIBPATH = $(NFAST_DEV_PATH)/lib
-
-# nFast Developer tools include
-NFAST_INC = $(NFAST_DEV_PATH)/include
-
-# nFast CPPFLAGS
-NFAST_CPPFLAGS = \
-					-I$(NFAST_INC)/sworld \
-					-I$(NFAST_INC)/hilibs \
-					-I$(NFAST_INC)/nflog \
-					-I$(NFAST_INC)/cutils \
-					-I$(NFAST_EXAMPLES)/sworld \
-					-I$(NFAST_EXAMPLES)/hilibs \
-					-I$(NFAST_EXAMPLES)/nflog \
-					-I$(NFAST_EXAMPLES)/cutils \
-					
-# nFast LDLIBS
-NFAST_LDLIBS = \
-					$(NFAST_LIBPATH)/librqcard.a \
-					$(NFAST_LIBPATH)/libnfkm.a \
-					$(NFAST_LIBPATH)/libnfstub.a \
-					$(NFAST_LIBPATH)/libnflog.a \
-					$(NFAST_LIBPATH)/libcutils.a -lm \
-
-# nFast OBJS
-NFAST_OBJS_PATH = $(NFAST_EXAMPLES)/nfuser/build-gcc-lib
-NFAST_OBJS_LIST = \
-				$(NFAST_OBJS_PATH)/simplebignum.o \
-				$(NFAST_OBJS_PATH)/nfutil.o \
-				
-#				$(NFAST_OBJS_PATH)/simplebignum.o \
-				
 
 # ダミーのRSA鍵ペアを使用する場合は、USE_DUMMY_KEYをTRUEにしてください。
 # 正式な　RSA鍵ペアを使用する場合は、USE_DUMMY_KEYをコメントアウトして、DER_KEY_DIRにRSA鍵ペアが入ったフォルダを指定してください。
 
-#USE_DUMMY_KEY = TRUE
+DEV_CYGWIN = TRUE
 #ENCRYPT_AES = TRUE
+USE_DUMMY_KEY = TRUE
+USE_SFMT = TRUE
+#USE_HSM = TRUE
+
+ifeq ($(USE_HSM),TRUE)
+# nFast Path
+NFAST_PATH = /opt/nfast
+
+# nFast Developer tools installation
+NFAST_DEV_PATH = $(NFAST_PATH)/c/ctd/gcc
+NFAST_EXAMPLES = $(NFAST_PATH)/c/ctd/examples
+
+# nFast Developer tools library
+NFAST_LIBPATH = $(NFAST_DEV_PATH)/lib
+
+# nFast Developer tools include
+NFAST_INC = $(NFAST_DEV_PATH)/include
+
+# nFast CPPFLAGS
+NFAST_CPPFLAGS = \
+					-I$(NFAST_INC)/sworld \
+					-I$(NFAST_INC)/hilibs \
+					-I$(NFAST_INC)/nflog \
+					-I$(NFAST_INC)/cutils \
+					-I$(NFAST_EXAMPLES)/sworld \
+					-I$(NFAST_EXAMPLES)/hilibs \
+					-I$(NFAST_EXAMPLES)/nflog \
+					-I$(NFAST_EXAMPLES)/cutils \
+					
+# nFast LDLIBS
+NFAST_LDLIBS = \
+					$(NFAST_LIBPATH)/librqcard.a \
+					$(NFAST_LIBPATH)/libnfkm.a \
+					$(NFAST_LIBPATH)/libnfstub.a \
+					$(NFAST_LIBPATH)/libnflog.a \
+					$(NFAST_LIBPATH)/libcutils.a -lm \
+
+# nFast OBJS
+NFAST_OBJS_PATH = $(NFAST_EXAMPLES)/nfuser/build-gcc-lib
+NFAST_OBJS_LIST = \
+				$(NFAST_OBJS_PATH)/simplebignum.o \
+				$(NFAST_OBJS_PATH)/nfutil.o \
+
+endif # USE_HSM
 
 ifeq ($(USE_DUMMY_KEY),TRUE)
 DER_KEY_DIR = ./rsakey_dummy
@@ -62,45 +65,56 @@ PACKAGE_DIR = ./package
 # OPENSSL_DIR = ./openssl-1.0.0-beta2
 OPENSSL_DIR = ./openssl-0.9.8k
 
-# SFMT_DIR	= ./SFMT-src-1.3.3
+SFMT_DIR	= ./SFMT-src-1.3.3
 
 TARGET	    = gen_id
 
 KEYS_C  = cr_gen_id_rsa_key_priv.c cr_gen_id_rsa_key_pub.c
 KEYS_H  = $(KEYS_C:.c=.h)
-SRCS	= main.c cr_generate_id.c cr_alloc.c $(KEYS_C)
+SRCS	= main.c cr_generate_id.c cr_enc_id.c cr_alloc.c $(KEYS_C)
+
+ifeq ($(USE_SFMT),TRUE)
+SRCS   += $(SFMT_DIR)/SFMT.c
+endif
 
 OBJS	= $(notdir $(SRCS:.c=.o))
-
-
-#DEV_CYGWIN = TRUE
-ifeq ($(DEV_CYGWIN),TRUE)
+
+CFLAGS	= -Wall -DMEXP=216091 -msse2 -DHAVE_SSE2
+CPPFLAGS= -I. -I$(OPENSSL_DIR)/include -I$(OPENSSL_DIR)/crypto/ec
+LDFLAGS	= -mwindows -L$(OPENSSL_DIR)
+LDLIBS	= -lcrypto -lssl
+
+ifeq ($(DEV_CYGWIN),TRUE)
 CC := C:/Cygwin/bin/gcc
-CFLAGS	= -mno-cygwin -Wall -DMEXP=216091  -msse2 -DHAVE_SSE2 
-CPPFLAGS= -I. -I$(OPENSSL_DIR)/include -I$(OPENSSL_DIR)/crypto/ec -I$(SFMT_DIR)
-else
+LD	= C:/Cygwin/bin/gcc
+CFLAGS	+= -mno-cygwin -DDEV_CYGWIN
+LDFLAGS	+= -Wl,--subsystem,console -mno-cygwin
+else # DEV_CYGWIN
 CC := /usr/bin/gcc
-CFLAGS	= -Wall -DMEXP=216091  -msse2 -DHAVE_SSE2
-CPPFLAGS = -I. -I$(OPENSSL_DIR)/include -I$(OPENSSL_DIR)/crypto/ec $(NFAST_CPPFLAGS)
-endif
+LD	= /usr/bin/gcc
+LDFLAGS	+= -Wl
+LDLIBS	+= -ldl -lnsl
+endif # DEV_CYGWIN
+
+ifeq ($(ENCRYPT_AES),TRUE)
+CFLAGS += -DENCRYPT_AES
+endif
 
 ifeq ($(USE_DUMMY_KEY),TRUE)
 CFLAGS += -DUSE_DUMMY_KEY
 endif
 
-ifeq ($(ENCRYPT_AES),TRUE)
-CFLAGS += -DENCRYPT_AES
+ifeq ($(USE_SFMT),TRUE)
+CFLAGS  += -DUSE_SFMT
+CPPFLAGS+= -I$(SFMT_DIR)
 endif
-
-ifeq ($(DEV_CYGWIN),TRUE)
-LD	= C:/Cygwin/bin/gcc
-LDFLAGS	= -Wl,--subsystem,console -mwindows -mno-cygwin -L$(OPENSSL_DIR)
-LDLIBS	= -lcrypto -lssl
-else
-LD	= /usr/bin/gcc
-LDFLAGS	= -Wl -mwindows -L$(OPENSSL_DIR)
-LDLIBS	= -lcrypto -lssl -ldl -lnsl $(NFAST_LDLIBS)
-endif
+
+ifeq ($(USE_HSM),TRUE)
+CFLAGS  += -DUSE_HSM
+CPPFLAGS+= $(NFAST_CPPFLAGS)
+LDLIBS  += $(NFAST_LDLIBS)
+endif
+
 
 .SUFFIXES:
 
@@ -109,16 +123,21 @@ all: package_build $(KEYS_C) $(TARGET)
 # install: $(TARGET)
 #	install -c -m 777 $(TARGET) ../bin
 
+ifeq ($(DEV_CYGWIN),TRUE)
+package_build :
+	cd $(PACKAGE_DIR);make DEV_CYGWIN=TRUE
+else
 package_build :
 	cd $(PACKAGE_DIR);make
+endif
 
 $(TARGET): $(OBJS) 
 	$(LD) $(LDFLAGS) $(OBJS) -o $@ $(LDLIBS) $(NFAST_OBJS_LIST)
 
 $(OBJS): $(HEADS) Makefile
 
-# %.o:$(SFMT_DIR)/%.c
-#	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
+%.o:$(SFMT_DIR)/%.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
 
 %.o:%.c
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
diff --git a/cr_enc_id.c b/cr_enc_id.c
new file mode 100644
index 0000000..f9ef38d
--- /dev/null
+++ b/cr_enc_id.c
@@ -0,0 +1,477 @@
+/* ====================================================================
+ * Copyright (c) 1998-2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include "cr_generate_id.h"
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <time.h>
+#include <sys/time.h>
+#include <string.h>
+
+#ifdef USE_HSM
+// nShield
+#include "nfastapp.h"
+#include "nfkm.h"
+#include "rqcard-applic.h"
+#include "rqcard-fips.h"
+// nShield optional
+#include "simplebignum.h"
+
+#else  // !USE_HSM
+// openssl
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/sha.h>
+#include <openssl/rsa.h>
+#include <openssl/aes.h>
+#include "cr_gen_id_rsa_key_priv.h"
+#include "cr_gen_id_rsa_key_pub.h"
+
+extern RSA *d2i_RSA_PUBKEY(RSA **a, const unsigned char **pp, long length);
+
+#endif // !USE_HSM
+
+static unsigned char local_buf_1[CR_ID_BUF_SIZE];
+static unsigned char local_buf_2[CR_ID_BUF_SIZE];
+
+
+#ifdef ENCRYPT_AES
+// AES暗号化 -> 復号化 -> ベリファイ
+
+#ifdef USE_HSM
+
+int crypto_aes_enc_dec( unsigned char *dst_buf, unsigned char *org_buf )
+{
+	int i, ret_code;
+	
+	M_Command cmd;
+	M_Reply reply;
+	M_IV enc_iv, dec_iv;
+	
+	ret_code = 0;
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	
+	// iv
+	enc_iv.mech = dec_iv.mech = Mech_RijndaelmCBCpNONE;
+	for ( i = 0; i < 16; i++ )
+		enc_iv.iv.generic128.iv.bytes[i] = dec_iv.iv.generic128.iv.bytes[i] = i;
+	
+	// encrypt
+	cmd.cmd = Cmd_Encrypt;
+	cmd.args.encrypt.key = hsmAeskeyid;
+	cmd.args.encrypt.mech = Mech_RijndaelmCBCpNONE;
+	cmd.args.encrypt.plain.type = PlainTextType_Bytes;
+	cmd.args.encrypt.plain.data.bytes.data.len = CR_ID_BUF_SIZE;
+	cmd.args.encrypt.plain.data.bytes.data.ptr = org_buf;
+	cmd.args.encrypt.flags = Cmd_Encrypt_Args_flags_given_iv_present;
+	cmd.args.encrypt.given_iv = &enc_iv;
+	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Encryption by HSM\n", ret_code );
+	}
+	ret_code = reply.status;
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Encrypt Reply Status by HSM\n", ret_code );
+	}
+	memcpy( local_buf_1, 
+				reply.reply.encrypt.cipher.data.generic128.cipher.ptr,
+				CR_ID_BUF_SIZE );
+
+	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	
+	// decyrpt
+	cmd.cmd = Cmd_Decrypt;
+	cmd.args.decrypt.flags = 0;
+	cmd.args.decrypt.key = hsmAeskeyid;
+	cmd.args.decrypt.mech = Mech_RijndaelmCBCpNONE;
+	cmd.args.decrypt.cipher.mech = Mech_RijndaelmCBCpNONE;
+	cmd.args.decrypt.cipher.data.generic128.cipher.len = CR_ID_BUF_SIZE;
+	cmd.args.decrypt.cipher.data.generic128.cipher.ptr = local_buf_1;
+	cmd.args.decrypt.cipher.iv = dec_iv.iv;
+	cmd.args.decrypt.reply_type = PlainTextType_Bytes;
+	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Decryption by HSM\n", ret_code );
+	}
+	ret_code = reply.status;
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Decrypt Reply Status by HSM\n", ret_code );
+	}
+	memcpy( local_buf_2, 
+				reply.reply.decrypt.plain.data.bytes.data.ptr,
+				CR_ID_BUF_SIZE );
+	
+	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
+	
+	// ベリファイ
+	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
+	{
+		if( org_buf[i] != local_buf_2[i] )
+		{
+			printf( "error : aes verify\n" );
+			return 0;
+		}
+	}
+	
+	// バッファコピー
+	memcpy( dst_buf, local_buf_1, CR_ID_BUF_SIZE );
+	
+	return 0;
+}	// hsm_crypto_aes_enc_dec
+
+#else // !USE_HSM
+
+int crypto_aes_enc_dec( unsigned char *dst_buf, unsigned char *org_buf )
+{
+	int i;
+	
+	AES_KEY	aesEncKey;
+	AES_KEY	aesDecKey;
+	
+	u8 temp_iv[16];
+
+	memset( local_buf_1, 0, CR_ID_BUF_SIZE );
+	memset( local_buf_2, 0, CR_ID_BUF_SIZE );
+	
+	// AES 暗号化用鍵 作成
+	if ( AES_set_encrypt_key( AES_PASS_PHRASE, 128, &aesEncKey ) != 0 )
+	{
+		printf( "error : AES_set_encrypt_key\n" );
+		return 0;
+	}
+	
+	// AES 復号化用鍵 作成
+	if ( AES_set_decrypt_key( AES_PASS_PHRASE, 128, &aesDecKey ) != 0 )
+	{
+		printf( "error : AES_set_decrypt_key\n" );
+		return 0;
+	}
+	
+	// iv 初期化
+	for ( i = 0; i < 16; i++ )
+	{
+		temp_iv[i] = i;
+	}
+	
+	// AES 暗号化
+	AES_cbc_encrypt ( org_buf, local_buf_1, CR_ID_BUF_SIZE, &aesEncKey, temp_iv, AES_ENCRYPT );
+	
+	// iv 初期化
+	for ( i = 0; i < 16; i++ )
+	{
+		temp_iv[i] = i;
+	}
+	
+	// AES 復号化
+	AES_cbc_encrypt ( local_buf_1, local_buf_2, CR_ID_BUF_SIZE, &aesDecKey, temp_iv, AES_DECRYPT );
+	
+	// ベリファイ
+	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
+	{
+		if( org_buf[i] != local_buf_2[i] )
+		{
+			printf( "error : aes verify\n" );
+			return 0;
+		}
+	}
+	
+	// バッファコピー
+	memcpy( dst_buf, local_buf_1, CR_ID_BUF_SIZE );
+	
+	return 0;
+}	// crypto_aes_enc_dec
+
+#endif	// USE_HSM
+
+#else   // !ENCRYPT_AES
+
+// RSA暗号化->復号化->ベリファイ
+#ifdef USE_HSM
+
+int crypto_rsa_enc_dec( unsigned char *dst_buf,unsigned char *org_buf )
+{
+	int i, ret_code;
+	
+	M_Command cmd;
+	M_Reply reply;
+	M_IV enc_iv, dec_iv;
+	
+	ret_code = 0;
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	
+	// iv
+	enc_iv.mech = dec_iv.mech = Mech_RSApPKCS1;
+	for ( i = 0; i < sizeof( enc_iv.iv.generic256.iv.bytes ); i++ )
+		enc_iv.iv.generic256.iv.bytes[i] = dec_iv.iv.generic256.iv.bytes[i] = i;
+	
+	for ( i = 0; i < 256; i++ )
+	{
+		if ( i % 16 == 0 )
+			printf( "\n" );
+		printf( "0x%02X ", org_buf[i] );
+	}
+	printf( "\n" );
+	
+	// encrypt
+	cmd.cmd = Cmd_Encrypt;
+	cmd.args.encrypt.flags = Cmd_Encrypt_Args_flags_given_iv_present;
+	cmd.args.encrypt.key = hsmRsaPubkeyid;
+	cmd.args.encrypt.mech = Mech_RSApPKCS1;
+	cmd.args.encrypt.plain.type = PlainTextType_Bytes;
+	cmd.args.encrypt.plain.data.bytes.data.len = CR_ID_BUF_SIZE;
+	cmd.args.encrypt.plain.data.bytes.data.ptr = org_buf;
+	cmd.args.encrypt.given_iv = &enc_iv;
+	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Encryption by HSM\n", ret_code );
+	}
+	ret_code = reply.status;
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Encrypt Reply Status by HSM\n", ret_code );
+	}
+	memcpy( local_buf_1, 
+				reply.reply.encrypt.cipher.data.generic128.cipher.ptr,
+				CR_ID_BUF_SIZE );
+
+	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	
+	// decyrpt
+	cmd.cmd = Cmd_Decrypt;
+	cmd.args.decrypt.flags = 0;
+	cmd.args.decrypt.key = hsmAeskeyid;
+	cmd.args.decrypt.mech = Mech_RijndaelmCBCpNONE;
+	cmd.args.decrypt.cipher.mech = Mech_RijndaelmCBCpNONE;
+	cmd.args.decrypt.cipher.data.generic128.cipher.len = CR_ID_BUF_SIZE;
+	cmd.args.decrypt.cipher.data.generic128.cipher.ptr = local_buf_1;
+	cmd.args.decrypt.cipher.iv = dec_iv.iv;
+	cmd.args.decrypt.reply_type = PlainTextType_Bytes;
+	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Decryption by HSM\n", ret_code );
+	}
+	ret_code = reply.status;
+	if ( ret_code != Status_OK )
+	{
+		printf( "error(%d) : Decrypt Reply Status by HSM\n", ret_code );
+	}
+	memcpy( local_buf_2, 
+				reply.reply.decrypt.plain.data.bytes.data.ptr,
+				CR_ID_BUF_SIZE );
+	
+	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
+	
+	// ベリファイ
+	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
+	{
+		if( org_buf[i] != local_buf_2[i] )
+		{
+			printf( "error : aes verify\n" );
+			return 0;
+		}
+	}
+	
+	// バッファコピー
+	memcpy( dst_buf, local_buf_1, CR_ID_BUF_SIZE );
+	
+	return 0;
+}	// hsm_crypto_rsa_enc_dec
+
+#else // USE_HSM
+
+int crypto_rsa_enc_dec( unsigned char *dst_buf,unsigned char *org_buf)
+{
+  int ret_code = 0;
+  int rsa_outlen = 0;
+  RSA *rsa_privkey = NULL;
+  RSA *rsa_pubkey  = NULL;
+
+  memset(local_buf_1, 0,CR_ID_BUF_SIZE);
+  memset(local_buf_2, 0,CR_ID_BUF_SIZE);
+
+
+  // DERフォーマットのRSA鍵を読み込み
+  {
+	const unsigned char *der_priv = cr_gen_id_rsa_key_priv_DER + 0x10; // ヘッダ部分を除外してKEY実体を指定
+	const unsigned char *der_pub  = cr_gen_id_rsa_key_pub_DER  + 0x10; // 同上
+	int priv_len = cr_gen_id_rsa_key_priv_DER[ 8 ] | cr_gen_id_rsa_key_priv_DER[ 9 ] << 8;	// KEY長を取り出し
+	int pub_len  = cr_gen_id_rsa_key_pub_DER [ 8 ] | cr_gen_id_rsa_key_pub_DER [ 9 ] << 8;   // 同上
+	// コマンドラインのopensslが出力する秘密鍵は、PKCS#1 RSAPublicKeyフォーマットなので、この関数を使う。
+	rsa_privkey = d2i_RSAPrivateKey( NULL, &der_priv, priv_len );
+	if( rsa_privkey == NULL ) {
+		ret_code = CR_GENID_ERROR_RSA_READ_PRIVATE_KEY;
+		goto end;
+	}
+	// コマンドラインのopensslが出力する公開鍵は、SubjectPublicKeyInfo形式なので、この関数を使う。
+	rsa_pubkey = d2i_RSA_PUBKEY( NULL, &der_pub, pub_len );
+	if( rsa_pubkey == NULL ) {
+		ret_code = CR_GENID_ERROR_RSA_READ_PUBLIC_KEY;
+		goto end;
+	}
+  }
+  
+  if( (rsa_outlen = RSA_private_encrypt(CR_ID_BUF_SIZE, org_buf, local_buf_1,
+						 rsa_privkey, RSA_NO_PADDING)) == -1) {
+      ret_code = CR_GENID_ERROR_RSA_ENC;
+	  goto end;
+  }
+  else {
+    if((rsa_outlen = RSA_public_decrypt(rsa_outlen, local_buf_1, local_buf_2, 
+						rsa_pubkey, RSA_NO_PADDING)) == -1)  {
+      ret_code = CR_GENID_ERROR_RSA_DEC;
+      goto end;
+    }
+    else {
+      int i;
+      int error_flag = 0;
+      for( i = 0 ; i < CR_ID_BUF_SIZE ; i++ ) {
+        if( org_buf[i] != local_buf_2[i] ) {
+	      error_flag++;
+        }
+      }
+      if( error_flag ) {
+        ret_code = CR_GENID_ERROR_RSA_VERIFY;
+		goto end;
+      }
+    }
+  }
+
+  memcpy(dst_buf,local_buf_1,CR_ID_BUF_SIZE);
+
+end:
+  if ( rsa_privkey )	RSA_free( rsa_privkey );
+  if ( rsa_pubkey  )	RSA_free( rsa_pubkey );
+
+  return ret_code;
+}
+
+#endif	// !USE_HSM
+
+#endif  // ENCRYPT_AES
diff --git a/cr_generate_id.c b/cr_generate_id.c
index 85e19e0..ff1052b 100644
--- a/cr_generate_id.c
+++ b/cr_generate_id.c
@@ -117,32 +117,32 @@
 #include <sys/time.h>
 #include <string.h>
 
+#ifdef USE_HSM
 // nShield
 #include "nfastapp.h"
 #include "nfkm.h"
 #include "rqcard-applic.h"
 #include "rqcard-fips.h"
-
 // nShield optional
 #include "simplebignum.h"
+#endif // USE_HSM
 
 // openssl
 #include <openssl/err.h>
 #include <openssl/bn.h>
-#include <openssl/ec.h>
 #include <openssl/sha.h>
+#include <openssl/ec.h>
 #include <openssl/rsa.h>
-#include <openssl/x509.h>
 #include <openssl/aes.h>
+#include <openssl/X509.h>
 
-// openssl optional
 #include "ec_lcl.h"	// ec_key_st構造体の参照に必要
 #include "openssl-0.9.8k/crypto/pem/pem.h"	// for PEM_read_X509 関数
 
+
 #include "cr_generate_id.h"
+#include "cr_generate_id_private.h"
 #include "cr_alloc.h"
-#include "cr_gen_id_rsa_key_priv.h"
-#include "cr_gen_id_rsa_key_pub.h"
 
 // #define DEBUG_PRINT 1
 
@@ -167,6 +167,7 @@
 const char *issuerNameDev	= "NintendoCA - G2_NintendoCTR2dev";
 const char *issuerNameProd	= "NintendoCA - G2_NintendoCTR2prod";
 
+#ifdef USE_HSM
 // TORIAEZU : nFast variables
 NFast_AppHandle hsmHandle;
 NFastApp_Connection hsmConnection;
@@ -189,6 +190,8 @@ M_ByteBlock *hsmBlobptr = NULL;
 static int hsm_generate_random( unsigned char *buf, int bytes );
 static int hsm_get_rtc( time_t *time );
 
+#endif // USE_HSM
+
 static struct _caInfo
 {
 	X509		*cert;		// 証明書
@@ -214,18 +217,6 @@ certEntry certEntries[ENTRY_COUNT] =
 	{ "commonName",             "Device"   }
 };
 
-#if 0
-typedef struct CTR_Device_Cert {
-	u32 deviceID;
-	u8 bonding_option;
-//	u8 signatureAlgorithmIdentifier[x];	// openssl/crypto/objects/obj_dat.h辺りで定義？
-//	u8 publicKeyAlgorithmIdentifier[x];
-	u8 timestamp[ 8 ];
-	u8 ca_name[ 16 ];
-	u8 public_key[ 61 ];
-	u8 signature[ 64 ];
-} CTR_Device_Cert;
-#else
 // TWL device cert base
 typedef struct CTR_Device_Cert
 {
@@ -239,7 +230,6 @@ typedef struct CTR_Device_Cert
 	u8		eccPubKey[60];		// 0x108 - 0x143 : cert public key (openssl sect233r1)
 	u8		padding1[60];			// 0x144 - 0x17F : zero-filled
 } CTR_Device_Cert;
-#endif
 
 
 typedef struct {
@@ -290,22 +280,25 @@ int cr_print_flag = 0;
 // EC秘密鍵を生成
 static int generate_EC_private_key( EC_KEY *eckey, u8 *privKey )
 {
-	int ret_code;
+	int ret_code = 0;
 	BIGNUM *bn_privkey = NULL;
 
-#ifdef USE_SFMT  // メルセンヌ・ツイスタ
-	for ( i = 0; i < EC_PRIVATE_KEY_LENGTH; i++ )
-	{
-		privKey[i] = (u8)gen_rand32();
-	}
-#else /* USE_SFMT */
+#ifdef USE_HSM
 	ret_code = hsm_generate_random( privKey, EC_PRIVATE_KEY_LENGTH );
 	if ( ret_code != Status_OK )
 	{
 		printf( "error(%d) : hsm_generate_random\n", ret_code );
 		return ret_code;
 	}
-#endif /* USE_SFMT */
+#else // !USE_HSM
+	{
+		int i;
+		for ( i = 0; i < EC_PRIVATE_KEY_LENGTH; i++ )
+		{
+			privKey[i] = (u8)gen_rand32();
+		}
+	}
+#endif // USE_HSM
 
 	// ECC233 で30バイトだけ利用するので、後ろ2バイトは0で埋める
 	// (DER(BER) が big endian なので、ここでは先頭2byte)
@@ -339,7 +332,7 @@ static int generate_EC_private_key( EC_KEY *eckey, u8 *privKey )
 	}
 #endif /* DEBUG_PRINT */
 
-	return 0;
+	return ret_code;
 }	// generate_EC_private_key
 
 // EC公開鍵を生成
@@ -632,7 +625,7 @@ static int generate_X509_cert( EVP_PKEY *evp_pkey, X509_REQ *req, X509 *cert, u3
 // create CTR Custom cert
 static int generate_CTRCustom_cert( CTR_Device_Cert *cert, u32 deviceId, u8 bondingOption )
 {
-	int result;
+	int result = 0;
 	char str[80];
 	
 	// sigType
@@ -655,12 +648,21 @@ static int generate_CTRCustom_cert( CTR_Device_Cert *cert, u32 deviceId, u8 bond
 	memcpy( cert->subject, str, strlen( str ) );
 	
 	// expiryDate
+#ifdef USE_HSM
 	result = hsm_get_rtc( &cert->expiryDate );
 	if ( result != 0 )
 	{
 		printf( "error(%d) : hsm_get_rtc\n", result );
 		return result;
 	}
+#else  // !USE_HSM
+	{
+		struct timeval tv;
+		struct timezone tz;
+		gettimeofday(&tv,&tz);
+		cert->expiryDate = tv.tv_sec;
+	}
+#endif // USE_HSM
 
 #if 0
 	if ( cr_print_flag )
@@ -721,300 +723,11 @@ static int generate_CTRCustom_cert( CTR_Device_Cert *cert, u32 deviceId, u8 bond
 	}
 #endif
 
-	return 0;
+	return result;
 }	// generate_CTRCustom_cert
 
-#ifndef ENCRYPT_AES
-// RSA暗号化->復号化->ベリファイ
-static unsigned char local_rsa_buf_1[CR_ID_BUF_SIZE];
-static unsigned char local_rsa_buf_2[CR_ID_BUF_SIZE];
 
-#ifdef DEV_CYGWIN
-static int crypto_rsa_enc_dec( RSA *rsa_key_pub, RSA *rsa_key_priv, 
-			    unsigned char *dst_buf,unsigned char *org_buf)
-{
-  int rsa_outlen = 0;
-
-  memset(local_rsa_buf_1, 0,CR_ID_BUF_SIZE);
-  memset(local_rsa_buf_2, 0,CR_ID_BUF_SIZE);
-
-  if( (rsa_outlen = RSA_private_encrypt(CR_ID_BUF_SIZE, org_buf, local_rsa_buf_1,
-						 rsa_key_priv, RSA_NO_PADDING)) == -1) {
-      return CR_GENID_ERROR_RSA_ENC;
-  }
-  else {
-    if((rsa_outlen = RSA_public_decrypt(rsa_outlen, local_rsa_buf_1, local_rsa_buf_2, 
-						rsa_key_pub, RSA_NO_PADDING)) == -1)  {
-      return CR_GENID_ERROR_RSA_DEC;
-    }
-    else {
-      int i;
-      int error_flag = 0;
-      for( i = 0 ; i < CR_ID_BUF_SIZE ; i++ ) {
-	if( org_buf[i] != local_rsa_buf_2[i] ) {
-	  error_flag++;
-	}
-      }
-      if( error_flag ) {
-	return CR_GENID_ERROR_RSA_VERIFY;
-      }
-    }
-  }
-  memcpy(dst_buf,local_rsa_buf_1,CR_ID_BUF_SIZE);
-  return 0;
-}
-#else	// cygwin
-static int hsm_crypto_rsa_enc_dec( unsigned char *dst_buf,unsigned char *org_buf )
-{
-	int i, ret_code;
-	
-	M_Command cmd;
-	M_Reply reply;
-	M_IV enc_iv, dec_iv;
-	
-	ret_code = 0;
-	memset( &cmd, 0, sizeof( cmd ) );
-	memset( &reply, 0, sizeof( reply ) );
-	
-	// iv
-	enc_iv.mech = dec_iv.mech = Mech_RSApPKCS1;
-	for ( i = 0; i < sizeof( enc_iv.iv.generic256.iv.bytes ); i++ )
-		enc_iv.iv.generic256.iv.bytes[i] = dec_iv.iv.generic256.iv.bytes[i] = i;
-	
-	for ( i = 0; i < 256; i++ )
-	{
-		if ( i % 16 == 0 )
-			printf( "\n" );
-		printf( "0x%02X ", org_buf[i] );
-	}
-	printf( "\n" );
-	
-	// encrypt
-	cmd.cmd = Cmd_Encrypt;
-	cmd.args.encrypt.flags = Cmd_Encrypt_Args_flags_given_iv_present;
-	cmd.args.encrypt.key = hsmRsaPubkeyid;
-	cmd.args.encrypt.mech = Mech_RSApPKCS1;
-	cmd.args.encrypt.plain.type = PlainTextType_Bytes;
-	cmd.args.encrypt.plain.data.bytes.data.len = CR_ID_BUF_SIZE;
-	cmd.args.encrypt.plain.data.bytes.data.ptr = org_buf;
-	cmd.args.encrypt.given_iv = &enc_iv;
-	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Encryption by HSM\n", ret_code );
-	}
-	ret_code = reply.status;
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Encrypt Reply Status by HSM\n", ret_code );
-	}
-	memcpy( local_rsa_buf_1, 
-				reply.reply.encrypt.cipher.data.generic128.cipher.ptr,
-				CR_ID_BUF_SIZE );
-
-	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
-	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
-	memset( &cmd, 0, sizeof( cmd ) );
-	memset( &reply, 0, sizeof( reply ) );
-	
-	// decyrpt
-	cmd.cmd = Cmd_Decrypt;
-	cmd.args.decrypt.flags = 0;
-	cmd.args.decrypt.key = hsmAeskeyid;
-	cmd.args.decrypt.mech = Mech_RijndaelmCBCpNONE;
-	cmd.args.decrypt.cipher.mech = Mech_RijndaelmCBCpNONE;
-	cmd.args.decrypt.cipher.data.generic128.cipher.len = CR_ID_BUF_SIZE;
-	cmd.args.decrypt.cipher.data.generic128.cipher.ptr = local_rsa_buf_1;
-	cmd.args.decrypt.cipher.iv = dec_iv.iv;
-	cmd.args.decrypt.reply_type = PlainTextType_Bytes;
-	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Decryption by HSM\n", ret_code );
-	}
-	ret_code = reply.status;
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Decrypt Reply Status by HSM\n", ret_code );
-	}
-	memcpy( local_rsa_buf_2, 
-				reply.reply.decrypt.plain.data.bytes.data.ptr,
-				CR_ID_BUF_SIZE );
-	
-	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
-	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
-	
-	// ベリファイ
-	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
-	{
-		if( org_buf[i] != local_rsa_buf_2[i] )
-		{
-			printf( "error : aes verify\n" );
-			return 0;
-		}
-	}
-	
-	// バッファコピー
-	memcpy( dst_buf, local_rsa_buf_1, CR_ID_BUF_SIZE );
-	
-	return 0;
-}	// hsm_crypto_rsa_enc_dec
-#endif	// linux
-#else
-// AES暗号化 -> 復号化 -> ベリファイ
-static unsigned char local_aes_buf_1[ CR_ID_BUF_SIZE ];
-static unsigned char local_aes_buf_2[ CR_ID_BUF_SIZE ];
-
-#ifdef DEV_CYGWIN
-static int crypto_aes_enc_dec( unsigned char *dst_buf, unsigned char *org_buf )
-{
-	int i;
-	
-	AES_KEY	aesEncKey;
-	AES_KEY	aesDecKey;
-	
-	u8 temp_iv[16];
-
-	memset( local_aes_buf_1, 0, CR_ID_BUF_SIZE );
-	memset( local_aes_buf_2, 0, CR_ID_BUF_SIZE );
-	
-	// AES 暗号化用鍵 作成
-	if ( AES_set_encrypt_key( AES_PASS_PHRASE, 128, &aesEncKey ) != 0 )
-	{
-		printf( "error : AES_set_encrypt_key\n" );
-		return 0;
-	}
-	
-	// AES 復号化用鍵 作成
-	if ( AES_set_decrypt_key( AES_PASS_PHRASE, 128, &aesDecKey ) != 0 )
-	{
-		printf( "error : AES_set_decrypt_key\n" );
-		return 0;
-	}
-	
-	// iv 初期化
-	for ( i = 0; i < 16; i++ )
-	{
-		temp_iv[i] = i;
-	}
-	
-	// AES 暗号化
-	AES_cbc_encrypt ( org_buf, local_aes_buf_1, CR_ID_BUF_SIZE, &aesEncKey, temp_iv, AES_ENCRYPT );
-	
-	// iv 初期化
-	for ( i = 0; i < 16; i++ )
-	{
-		temp_iv[i] = i;
-	}
-	
-	// AES 復号化
-	AES_cbc_encrypt ( local_aes_buf_1, local_aes_buf_2, CR_ID_BUF_SIZE, &aesDecKey, temp_iv, AES_DECRYPT );
-	
-	// ベリファイ
-	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
-	{
-		if( org_buf[i] != local_aes_buf_2[i] )
-		{
-			printf( "error : aes verify\n" );
-			return 0;
-		}
-	}
-	
-	// バッファコピー
-	memcpy( dst_buf, local_aes_buf_1, CR_ID_BUF_SIZE );
-	
-	return 0;
-}	// crypto_aes_enc_dec
-#else	// DEV_CYGWIN(openssl)
-static int hsm_crypto_aes_enc_dec( unsigned char *dst_buf, unsigned char *org_buf )
-{
-	int i, ret_code;
-	
-	M_Command cmd;
-	M_Reply reply;
-	M_IV enc_iv, dec_iv;
-	
-	ret_code = 0;
-	memset( &cmd, 0, sizeof( cmd ) );
-	memset( &reply, 0, sizeof( reply ) );
-	
-	// iv
-	enc_iv.mech = dec_iv.mech = Mech_RijndaelmCBCpNONE;
-	for ( i = 0; i < 16; i++ )
-		enc_iv.iv.generic128.iv.bytes[i] = dec_iv.iv.generic128.iv.bytes[i] = i;
-	
-	// encrypt
-	cmd.cmd = Cmd_Encrypt;
-	cmd.args.encrypt.key = hsmAeskeyid;
-	cmd.args.encrypt.mech = Mech_RijndaelmCBCpNONE;
-	cmd.args.encrypt.plain.type = PlainTextType_Bytes;
-	cmd.args.encrypt.plain.data.bytes.data.len = CR_ID_BUF_SIZE;
-	cmd.args.encrypt.plain.data.bytes.data.ptr = org_buf;
-	cmd.args.encrypt.flags = Cmd_Encrypt_Args_flags_given_iv_present;
-	cmd.args.encrypt.given_iv = &enc_iv;
-	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Encryption by HSM\n", ret_code );
-	}
-	ret_code = reply.status;
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Encrypt Reply Status by HSM\n", ret_code );
-	}
-	memcpy( local_aes_buf_1, 
-				reply.reply.encrypt.cipher.data.generic128.cipher.ptr,
-				CR_ID_BUF_SIZE );
-
-	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
-	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
-	memset( &cmd, 0, sizeof( cmd ) );
-	memset( &reply, 0, sizeof( reply ) );
-	
-	// decyrpt
-	cmd.cmd = Cmd_Decrypt;
-	cmd.args.decrypt.flags = 0;
-	cmd.args.decrypt.key = hsmAeskeyid;
-	cmd.args.decrypt.mech = Mech_RijndaelmCBCpNONE;
-	cmd.args.decrypt.cipher.mech = Mech_RijndaelmCBCpNONE;
-	cmd.args.decrypt.cipher.data.generic128.cipher.len = CR_ID_BUF_SIZE;
-	cmd.args.decrypt.cipher.data.generic128.cipher.ptr = local_aes_buf_1;
-	cmd.args.decrypt.cipher.iv = dec_iv.iv;
-	cmd.args.decrypt.reply_type = PlainTextType_Bytes;
-	ret_code = NFastApp_Transact( hsmConnection, NULL, &cmd, &reply, NULL );
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Decryption by HSM\n", ret_code );
-	}
-	ret_code = reply.status;
-	if ( ret_code != Status_OK )
-	{
-		printf( "error(%d) : Decrypt Reply Status by HSM\n", ret_code );
-	}
-	memcpy( local_aes_buf_2, 
-				reply.reply.decrypt.plain.data.bytes.data.ptr,
-				CR_ID_BUF_SIZE );
-	
-	//NFastApp_Free_Command( hsmHandle, NULL, NULL, &cmd );
-	NFastApp_Free_Reply( hsmHandle, NULL, NULL, &reply );
-	
-	// ベリファイ
-	for ( i = 0 ; i < CR_ID_BUF_SIZE ; i++ )
-	{
-		if( org_buf[i] != local_aes_buf_2[i] )
-		{
-			printf( "error : aes verify\n" );
-			return 0;
-		}
-	}
-	
-	// バッファコピー
-	memcpy( dst_buf, local_aes_buf_1, CR_ID_BUF_SIZE );
-	
-	return 0;
-}	// hsm_crypto_aes_enc_dec
-#endif	// HSM
-#endif
+#ifdef USE_HSM
 
 static int hsm_generate_random( unsigned char *buf, int bytes )
 {
@@ -1112,13 +825,14 @@ static int hsm_get_rtc( time_t *time )
 	return 0;
 }	// hsm_get_rtc
 
+#endif // USE_HSM
 
 int cr_generate_id_initialize( void )
 {
 	int		ret_code = 0;
-	
 	FILE	*fp;
 	
+#ifdef USE_HSM
 	// init HSM
 	ret_code = NFastApp_InitEx( &hsmHandle, NULL, NULL );
 	if ( ret_code != Status_OK )
@@ -1400,6 +1114,8 @@ int cr_generate_id_initialize( void )
 		}
 		#endif
 	}	// load RSA private key object
+
+#endif // USE_HSM
 	
 	// CAの証明書を読み込む
 	fp = fopen( CA_FILE, "r" );
@@ -1454,12 +1170,14 @@ int cr_generate_id_finalize( void )
 	CRYPTO_cleanup_all_ex_data();
 	
 	// HSM
+#ifdef USE_HSM
 	RQCard_fips_free( &hsmCard, &hsmFips );
 	RQCard_destroy( &hsmCard );
 	NFKM_freekey( hsmHandle, hsmAeskeyinfo, NULL );
 	NFKM_freeinfo( hsmHandle, &hsmWorld, NULL );
 	NFastApp_Disconnect( hsmConnection, NULL );
 	NFastApp_Finish( hsmHandle, NULL );
+#endif // USE_HSM
 	
 	ok = 1;
 	
@@ -1477,8 +1195,6 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   int ret_code;
   EC_KEY	*my_eckey	= NULL;
   EVP_PKEY	*my_evppkey	= NULL;
-  RSA *rsa_privkey = NULL;
-  RSA *rsa_pubkey  = NULL;
   
 	X509_REQ	*req  = NULL;
 	X509		*cert = NULL;
@@ -1508,7 +1224,6 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
 	}	
 	
   ret_code = CR_GENID_ERROR_NON; /* CR_GENID_ERROR_NON = 0 */
-
   //  printf("sizeof(CR_ID_BUFFER) = %d bytes\n",sizeof(CR_ID_BUFFER) );
   //  printf("offset(factory, CR_ID_BUFFER) = 0x%02x bytes\n", offsetof(CR_ID_BUFFER,factory ) );
   //  printf("sizeof(CR_ERR_BUFFER) = 0x%02x bytes\n",sizeof(CR_ERR_BUFFER) );
@@ -1572,10 +1287,14 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   //--------------------------------------------------------------
   // タイムスタンプセット
   //--------------------------------------------------------------
-	hsm_get_rtc( &tv.tv_sec );	
+#ifdef USE_HSM
+	hsm_get_rtc( &tv.tv_sec );
+#else // !USE_HSM
+	gettimeofday(&tv,&tz);
+#endif // USE_HSM
+	
 	tm_time = gmtime( &tv.tv_sec );
 
-
 #ifdef DEBUG_PRINT
   if( cr_print_flag ) 
   {
@@ -1600,12 +1319,25 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   //--------------------------------------------------------------
   // 乱数を生成してセット
   //--------------------------------------------------------------
+#ifdef USE_HSM
 	ret_code = hsm_generate_random( cr_id_buf->random, CR_RANDOM_LENGTH );
 	if ( ret_code != Status_OK )
 	{
 		printf( "error(%d) : hsm_generate_random\n", ret_code );
 		return ret_code;
 	}
+#else // !USE_HSM
+#ifdef USE_SFMT  // メルセンヌ・ツイスタ
+	for ( i = 0; i < CR_RANDOM_LENGTH; i += 4 )
+	{
+		*(u32*)&(cr_id_buf->random[i]) = gen_rand32();
+	}
+#else /* USE_SFMT */
+  for( i = 0 ; i < CR_NUM_OF_RANDOM ; i++ ) {
+    cr_id_buf->random[i] = (u16)rand(); /* 範囲は０から３２７６７ */
+  }
+#endif /* USE_SFMT */
+#endif // USE_HSM
 
 #ifdef DEBUG_PRINT
   if( cr_print_flag ) {
@@ -1688,7 +1420,7 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
 #endif
 	
 	//printf( "evp_pkey size : %d\n", EVP_PKEY_size( my_evppkey ) );
-	
+#if 1
 	//--------------------------------------------------------------
 	// デバイス証明書要求生成
 	//--------------------------------------------------------------
@@ -1710,16 +1442,17 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
 		return 0;	// error
 	}
 	generate_X509_cert( my_evppkey, req, cert, cr_id_buf->serial[0] );
-	
 	//--------------------------------------------------------------
 	// デバイス証明書の署名をセット
 	//--------------------------------------------------------------
 	int padding = ECDSA_SIGN_LENGTH % cert->signature->length;
+	printf( "padding = %d\n", padding );
 	for ( i = 0; i < padding; i++ )
 		cr_id_buf->deviceCertSign[i] = 0;
 	for ( i = 0; i < cert->signature->length; i++ )
 		cr_id_buf->deviceCertSign[ i + padding ] = cert->signature->data[i];
 	// mistake!!
+#endif
 
 	// TORIAEZU : create Custom cert
 	memset( &ctr_dev_cert, 0, sizeof( ctr_dev_cert ) );
@@ -1734,6 +1467,7 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
 	len = BN_bn2bin( &my_eckey->pub_key->Y, buf );
 	memcpy( &ctr_dev_cert.eccPubKey[30], buf, len );
 	free( buf );
+
 	// copy sign to Custom cert
 //#define SHOW_SIG
 	u8 *ptr = cert->signature->data;
@@ -1770,13 +1504,14 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
 		ctr_dev_cert.eccSignature[i] = *(ptr++);
 	ptr++;
 	int s_len = *(ptr++);
-	for ( i = 0; i < r_len; i++ )
+	for ( i = 0; i < s_len; i++ )
 		ctr_dev_cert.eccSignature[i+30] = *(ptr++);
 	
 	// create CTR Custom cert
 	ret_code = generate_CTRCustom_cert( &ctr_dev_cert, 
 		cr_id_buf->serial[0], cr_id_buf->bondingOption );
 #endif
+printf("3\n");
 		
 #if 0
 	if( cr_print_flag )
@@ -1813,11 +1548,9 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   }
 #endif /* DEBUG_PRINT */
 
-#ifndef ENCRYPT_AES
   //--------------------------------------------------------------
-  // FuseIDバッファ全体をRSA秘密鍵で暗号化
+  // FuseIDバッファ全体を暗号化
   //--------------------------------------------------------------
-  
 #ifdef DEBUG_PRINT
   if( cr_print_flag ) {
     printf("ORG buf:");
@@ -1830,53 +1563,22 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
     printf("\n");
   }
 #endif /* DEBUG_PRINT */
-
-#ifdef DEV_CYGWIN
-  // DERフォーマットのRSA鍵を読み込み
-  {
-	const unsigned char *der_priv = cr_gen_id_rsa_key_priv_DER + 0x10; // ヘッダ部分を除外してKEY実体を指定
-	const unsigned char *der_pub  = cr_gen_id_rsa_key_pub_DER  + 0x10; // 同上
-	int priv_len = cr_gen_id_rsa_key_priv_DER[ 8 ] | cr_gen_id_rsa_key_priv_DER[ 9 ] << 8;	// KEY長を取り出し
-	int pub_len  = cr_gen_id_rsa_key_pub_DER [ 8 ] | cr_gen_id_rsa_key_pub_DER [ 9 ] << 8;   // 同上
-	// コマンドラインのopensslが出力する秘密鍵は、PKCS#1 RSAPublicKeyフォーマットなので、この関数を使う。
-	rsa_privkey = d2i_RSAPrivateKey( NULL, &der_priv, priv_len );
-	if( rsa_privkey == NULL ) {
-		ret_code = CR_GENID_ERROR_RSA_READ_PRIVATE_KEY;
-		goto end;
-	}
-	// コマンドラインのopensslが出力する公開鍵は、SubjectPublicKeyInfo形式なので、この関数を使う。
-	rsa_pubkey = d2i_RSA_PUBKEY( NULL, &der_pub, pub_len );
-	if( rsa_pubkey == NULL ) {
-		ret_code = CR_GENID_ERROR_RSA_READ_PUBLIC_KEY;
-		goto end;
-	}
-  }
-
-  // RSA暗号化 -> 復号化 -> ベリファイ
-  if( 0 != (ret_code = crypto_rsa_enc_dec( rsa_pubkey, rsa_privkey, id_buf, id_buf)) ) {
-	switch( ret_code ) {
-	case CR_GENID_ERROR_RSA_ENC:
-	  break;
-	case CR_GENID_ERROR_RSA_DEC:
-	  break;
-	case CR_GENID_ERROR_RSA_VERIFY:
-	  break;
-	}
-	goto end;
-  }
-#else	// Cygwin
-
-	ret_code = hsm_crypto_rsa_enc_dec( id_buf, id_buf );
-	if ( ret_code != 0 )
+	
+#ifdef ENCRYPT_AES
+	// AES暗号化 -> 復号化 -> ベリファイ
+	ret_code = crypto_aes_enc_dec( id_buf, id_buf );
+#else	// !ENCRYPT_AES
+	ret_code = crypto_rsa_enc_dec( id_buf, id_buf);
+#endif	// ENCRYPT_AES
+	
+	if( ret_code != 0 )
 	{
-		printf( "error(%d) : hsm_crypto_aes_enc_dec\n", ret_code );
+		goto end;
 	}
-
-#endif	// Linux
-
+	
 #ifdef DEBUG_PRINT
   if( cr_print_flag ) {
-    printf("RSA encrypted:");
+    printf("encrypted:");
     for( i = 0 ; i < CR_ID_BUF_SIZE ; i++ ) {
       if( (i%16) == 0 ) {
 	printf("\n ");
@@ -1887,48 +1589,6 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   }
 #endif /* DEBUG_PRINT */
 
-#else
-	//--------------------------------------------------------------
-	// FuseIDバッファ全体をAES共通鍵で暗号化
-	//--------------------------------------------------------------
-	// AES暗号化 -> 復号化 -> ベリファイ
-#ifdef DEV_CYGWIN
-	if( 0 != (ret_code = crypto_aes_enc_dec( id_buf, id_buf )) )
-	{
-		switch( ret_code )
-		{
-			case CR_GENID_ERROR_RSA_ENC:
-			  break;
-			case CR_GENID_ERROR_RSA_DEC:
-			  break;
-			case CR_GENID_ERROR_RSA_VERIFY:
-			  break;
-		}
-		goto end;
-	}
-#else	// DEV_CYGWIN(openssl)
-	ret_code = hsm_crypto_aes_enc_dec( id_buf, id_buf );
-	if ( ret_code != 0 )
-	{
-		printf( "error(%d) : hsm_crypto_aes_enc_dec\n", ret_code );
-	}
-#endif	// HSM
-
-#ifdef DEBUG_PRINT
-  if( cr_print_flag ) {
-    printf("AES encrypted:");
-    for( i = 0 ; i < CR_ID_BUF_SIZE ; i++ ) {
-      if( (i%16) == 0 ) {
-	printf("\n ");
-      }
-      printf("0x%02x ", id_buf[i] );
-    }
-    printf("\n");
-  }
-#endif
-
-#endif	// ENCRYPT_AES
-
   //--------------------------------------------------------------
   // 終了処理
   //--------------------------------------------------------------
@@ -1954,8 +1614,6 @@ int cr_generate_id( u32 serial[CR_NUM_OF_SERIAL], u8 id_buf[CR_ID_BUF_SIZE], u8
   if ( my_eckey )		EC_KEY_free( my_eckey );
   if ( my_evppkey )		EVP_PKEY_free( my_evppkey );
   if ( req )			X509_REQ_free( req );
-  if ( rsa_privkey )	RSA_free( rsa_privkey );
-  if ( rsa_pubkey  )	RSA_free( rsa_pubkey );
 
   ERR_remove_state(0);
   EVP_cleanup();
diff --git a/cr_generate_id_private.h b/cr_generate_id_private.h
new file mode 100644
index 0000000..2f045e6
--- /dev/null
+++ b/cr_generate_id_private.h
@@ -0,0 +1,129 @@
+/* ====================================================================
+ * Copyright (c) 1998-2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef	_CR_GENERATE_ID_PRIVATE_H_
+#define	_CR_GENERATE_ID_PRIVATE_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+int crypto_aes_enc_dec( unsigned char *dst_buf, unsigned char *org_buf );
+int crypto_rsa_enc_dec( unsigned char *dst_buf, unsigned char *org_buf );
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif	/* _CR_GENERATE_ID_PRIVATE_H_ */
+
diff --git a/main.c b/main.c
index 8b5c075..e15cd5c 100644
--- a/main.c
+++ b/main.c
@@ -3,6 +3,9 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
+#include <sys/time.h>
+#include <openssl/err.h>
 
 #ifdef DEV_CYGWIN
 #include <conio.h>
@@ -11,11 +14,6 @@
 #include <unistd.h>
 #endif	// Linux
 
-#include <time.h>
-#include <sys/time.h>
-
-#include <openssl/err.h>
-
 #include "cr_generate_id.h"
 
 #define T_BONDING_OPTION	0	// TORIAEZU bondingOption = 0
@@ -28,6 +26,8 @@
   gen_id.exe 0x01 0x03 ctrid090728.dat
 */
 
+#ifndef DEV_CYGWIN
+
 static struct termios initial_setting, new_setting;
 static int peek_character = -1;
 void keyboard_initialize( void )
@@ -83,6 +83,8 @@ int getch( void )
 	return ch;
 }	// readch
 
+#endif // DEV_CYGWIN
+
 // char *str = "0x11111111";
 static int str_to_u32(u32 *num, const char *str)
 {
@@ -186,8 +188,8 @@ int main(int ac, char *argv[])
 #endif
 
 #ifdef USE_DUMMY_KEY
-  fprintf(stderr,"RSA private key is dummy!\n");
-  return -1; /* error */
+//  fprintf(stderr,"RSA private key is dummy!\n");
+//  return -1; /* error */
 #endif
 
   time(&tloc);