From e3b58c07ccd4bf79991c3faea34ed5206323c8a1 Mon Sep 17 00:00:00 2001
From: kubodera_yuichi <kubodera_yuichi@ff987cc8-cf2f-4642-8568-d52cce064691>
Date: Mon, 28 Dec 2009 11:58:55 +0000
Subject: [PATCH] =?UTF-8?q?hsm=5Futils:RSA=E3=82=AD=E3=83=BC=E3=83=9A?=
 =?UTF-8?q?=E3=82=A2=E3=82=A4=E3=83=B3=E3=83=9D=E3=83=BC=E3=83=88"?=
 =?UTF-8?q?=E8=87=AA=E4=BD=93"=E6=88=90=E5=8A=9F=E3=80=81ECDSA=20priv=20ke?=
 =?UTF-8?q?y=20=E3=82=A4=E3=83=B3=E3=83=9D=E3=83=BC=E3=83=88=E6=88=90?=
 =?UTF-8?q?=E5=8A=9F=EF=BC=9F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: file:///Volumes/Transfer/gigaleak_20231201/2020-09-30%20-%20paladin.7z/paladin/ctr_eFuse@116 ff987cc8-cf2f-4642-8568-d52cce064691
---
 hsm_utils/import_ecc_keypair.c |  12 +-
 hsm_utils/import_rsa_keypair.c | 837 ++++++++++++++++++++++++---------
 hsm_utils/my_hsm_bignum.c      |  41 ++
 hsm_utils/my_hsm_bignum.h      |  10 +
 4 files changed, 672 insertions(+), 228 deletions(-)

diff --git a/hsm_utils/import_ecc_keypair.c b/hsm_utils/import_ecc_keypair.c
index a3eaba5..3c43035 100644
--- a/hsm_utils/import_ecc_keypair.c
+++ b/hsm_utils/import_ecc_keypair.c
@@ -383,7 +383,7 @@ int main( int argc, char *argv[] )
 	// 暗号化と復号化、署名とベリファイなど、相反する操作を持たせることはできない(エラーになる)
 	// e.g. NFKM_DEFOPPERMS_SIGN | NFKM_DEFOPPERMS_VERIFY -> エラー
 	// e.g. NFKM_DEFOPPERMS_ENCRYPT | NFKM_DEFOPPERMS_DECRYPT -> エラー
-	map.op_base = NFKM_DEFOPPERMS_SIGN | NFKM_DEFOPPERMS_ENCRYPT;
+	map.op_base = NFKM_DEFOPPERMS_SIGN;
 	map.cs = cardset;
 	result = NFKM_newkey_makeaclx( handle, nc, world, &map, &(cmd.args.import.acl), NULL );
 	if ( result != Status_OK )
@@ -421,10 +421,11 @@ int main( int argc, char *argv[] )
 	NFKM_KeyIdent keyident = { (char*)"simple", (char*)"ecc-import-privkey" };
 	cmd.cmd = Cmd_Import;
 	cmd.args.import.module = MODULE_ID;
-	cmd.args.import.data.type = KeyType_ECPrivate;
-	cmd.args.import.data.data.ecprivate.curve.name = ECName_NISTK233;
-	//cmd.args.import.data.data.ecprivate.curve.name = ECName_NISTB233;
+	cmd.args.import.data.type = KeyType_ECDSAPrivate;
+	//cmd.args.import.data.data.ecprivate.curve.name = ECName_NISTK233;
+	cmd.args.import.data.data.ecprivate.curve.name = ECName_NISTB233;
 
+#if 0
 #if 0
 	cmd.args.import.data.data.ecprivate.curve.data.custom.F.type = FieldType_Prime;
 	cmd.args.import.data.data.ecprivate.curve.data.custom.F.data.prime.flags = 0; // ???
@@ -454,6 +455,7 @@ int main( int argc, char *argv[] )
 	cmd.args.import.data.data.ecprivate.curve.data.customlcf.g.x = gyBn;
 	cmd.args.import.data.data.ecprivate.curve.data.customlcf.r = rBn;
 	cmd.args.import.data.data.ecprivate.curve.data.customlcf.h = hBn;
+#endif
 #endif
 	cmd.args.import.data.data.ecprivate.d = dBn;
 	
@@ -473,7 +475,7 @@ int main( int argc, char *argv[] )
 	
 	printf( "done. next : make blob ...\n" );
 
-#if 0
+#if 1
 		
 	// make blobs
 	NFKM_MakeBlobsParams mbp;
diff --git a/hsm_utils/import_rsa_keypair.c b/hsm_utils/import_rsa_keypair.c
index 0071d5f..cad7e46 100644
--- a/hsm_utils/import_rsa_keypair.c
+++ b/hsm_utils/import_rsa_keypair.c
@@ -49,7 +49,7 @@ typedef struct
 	struct NFast_Bignum *e;
 	struct NFast_Bignum *n;
 }
-RSAPublicKeyData;
+RSAPublicKeyDataBn;
 
 // global variable
 NFast_AppHandle handle;
@@ -59,13 +59,22 @@ RQCard card;
 RQCard_FIPS fips;
 M_KeyID ltid = 0;	// the cardset loaded into the module
 NFKM_CardSet *cardset = NULL;
+NFKM_ModuleInfo *moduleinfo = NULL;
+const NFKM_KeyIdent priv_keyident = { (char*)"simple", (char*)"rsa-import-privkey" };
+const NFKM_KeyIdent pub_keyident = { (char*)"simple", (char*)"rsa-import-pubkey" };
+
+unsigned char save_enc[DATA_LEN];
 
 // function
-int importRSAPrivate( void );
+int importRSAPrivate( NFKM_KeyIdent keyident );
+int importRSAPublic( NFKM_KeyIdent keyident );
+int verifyRSAKeyPair( NFKM_KeyIdent priv_keyident, NFKM_KeyIdent pub_keyident );
 void PrintArray( char *pStr, const unsigned char *pData, int length );
 
 int importRSAPrivate( NFKM_KeyIdent keyident )
 {
+	int result = Status_OK;
+	
 	RSA *privkey = NULL;
 	FILE *fp;
 	
@@ -77,7 +86,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 	NFKM_MakeACLParams map;
 	NFKM_MakeBlobsParams mbp;
 	NFKM_Key reg_key;
-	RSAPrivateKeyDataBn *privBn = NULL;
+	RSAPrivateKeyDataBn privBn;
 	
 	pPtr = qPtr = dmp1Ptr = dmq1Ptr = iqmpPtr = ePtr = NULL;
 	pLen = qLen = dmp1Len = dmq1Len = iqmpLen = eLen = 0;
@@ -86,6 +95,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 	memset( &map, 0, sizeof( map ) );
 	memset( &mbp, 0, sizeof( mbp ) );
 	memset( &reg_key, 0, sizeof( reg_key ) );
+	memset( &privBn, 0, sizeof( privBn ) );
 	
 	// key data open
 	fp = fopen( PRIV_KEY_FILE, "rb" );
@@ -102,7 +112,22 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 	}
 	fclose( fp );
 
+	printf( "\nRSA(p) = " );
+	BN_print_fp( stdout, privkey->p );
+	printf( "\nRSA(q) = " );
+	BN_print_fp( stdout, privkey->q );
+	printf( "\nRSA(dmp1) = " );
+	BN_print_fp( stdout, privkey->dmp1 );
+	printf( "\nRSA(dmq1) = " );
+	BN_print_fp( stdout, privkey->dmq1 );
+	printf( "\nRSA(iqmp) = " );
+	BN_print_fp( stdout, privkey->iqmp );
+	printf( "\nRSA(e) = " );
+	BN_print_fp( stdout, privkey->e );
+	printf( "\n" );
+
 #if 0
+	printf( "RSA bignum(Openssl) size\n" );
 	printf( "RSA(p)    : %d bytes\n", BN_num_bytes( privkey->p ) );
 	printf( "RSA(q)    : %d bytes\n", BN_num_bytes( privkey->q ) );
 	printf( "RSA(dmp1) : %d bytes\n", BN_num_bytes( privkey->dmp1 ) );
@@ -115,7 +140,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 	{
 		// p
 		pLen = BN_num_bytes( privkey->p );
-		pPtr = (char *)malloc( pLen );
+		pPtr = (unsigned char *)malloc( pLen );
 		if ( pLen != BN_bn2bin( privkey->p, pPtr ) )
 		{
 			printf( "BN_bn2bin failed!(p)\n" );
@@ -123,7 +148,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		}
 		// q
 		qLen = BN_num_bytes( privkey->q );
-		qPtr = (char *)malloc( qLen );
+		qPtr = (unsigned char *)malloc( qLen );
 		if ( qLen != BN_bn2bin( privkey->q, qPtr ) )
 		{
 			printf( "BN_bn2bin failed!(q)\n" );
@@ -131,7 +156,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		} 
 		// dmp1
 		dmp1Len = BN_num_bytes( privkey->dmp1 );
-		dmp1Ptr = (char *)malloc( dmp1Len );
+		dmp1Ptr = (unsigned char *)malloc( dmp1Len );
 		if ( dmp1Len != BN_bn2bin( privkey->dmp1, dmp1Ptr ) )
 		{
 			printf( "BN_bn2bin failed!(dmp1)\n" );
@@ -140,7 +165,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		
 		// dmq1
 		dmq1Len = BN_num_bytes( privkey->dmq1 );
-		dmq1Ptr = (char *)malloc( dmq1Len );
+		dmq1Ptr = (unsigned char *)malloc( dmq1Len );
 		if ( dmq1Len != BN_bn2bin( privkey->dmq1, dmq1Ptr ) )
 		{
 			printf( "BN_bn2bin failed!(dmq1)\n" );
@@ -148,7 +173,7 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		} 
 		// iqmp
 		iqmpLen = BN_num_bytes( privkey->iqmp );
-		iqmpPtr = (char *)malloc( iqmpLen );
+		iqmpPtr = (unsigned char *)malloc( iqmpLen );
 		if ( iqmpLen != BN_bn2bin( privkey->iqmp, iqmpPtr ) )
 		{
 			printf( "BN_bn2bin failed!(dmq1)\n" );
@@ -156,22 +181,32 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		} 
 		// e
 		eLen = BN_num_bytes( privkey->e );
-		ePtr = (char *)malloc( eLen );
+		ePtr = (unsigned char *)malloc( eLen );
 		if ( eLen != BN_bn2bin( privkey->e, ePtr ) )
 		{
 			printf( "BN_bn2bin failed!(e)\n" );
 			return 1;
 		}
 	}	// rsa bignum(openssl) -> bin
+
+#if 0
+	printf( "RSA bin addr\n" );
+	printf( "RSA(p)    : 0x%08X\n", (unsigned int)pPtr );
+	printf( "RSA(q)    : 0x%08X\n", (unsigned int)qPtr );
+	printf( "RSA(dmp1) : 0x%08X\n", (unsigned int)dmp1Ptr );
+	printf( "RSA(dmq1) : 0x%08X\n", (unsigned int)dmq1Ptr );
+	printf( "RSA(iqmp) : 0x%08X\n", (unsigned int)iqmpPtr );
+	printf( "RSA(e)    : 0x%08X\n", (unsigned int)ePtr );
+#endif
 	
 	// バイナリをHSMのBignumに変換
 	{
-		my_bin2bignum( &(privBn->p), handle, pPtr, pLen );
-		my_bin2bignum( &(privBn->q), handle, qPtr, qLen );
-		my_bin2bignum( &(privBn->dmp1), handle, dmp1Ptr, dmp1Len );
-		my_bin2bignum( &(privBn->dmq1), handle, dmq1Ptr, dmq1Len );
-		my_bin2bignum( &(privBn->iqmp), handle, iqmpPtr, iqmpLen );
-		my_bin2bignum( &(privBn->e), handle, ePtr, eLen );
+		my_bin2bignum( &(privBn.p), handle, pPtr, pLen );
+		my_bin2bignum( &(privBn.q), handle, qPtr, qLen );
+		my_bin2bignum( &(privBn.dmp1), handle, dmp1Ptr, dmp1Len );
+		my_bin2bignum( &(privBn.dmq1), handle, dmq1Ptr, dmq1Len );
+		my_bin2bignum( &(privBn.iqmp), handle, iqmpPtr, iqmpLen );
+		my_bin2bignum( &(privBn.e), handle, ePtr, eLen );
 		free( pPtr );
 		free( qPtr );
 		free( dmp1Ptr );
@@ -179,16 +214,59 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		free( iqmpPtr );
 		free( ePtr );
 	}
-		
+	
+	my_printbignum ( stdout, "RSA(p)", privBn.p );
+	my_printbignum ( stdout, "RSA(q)", privBn.q );
+	my_printbignum ( stdout, "RSA(dmp1)", privBn.dmp1 );
+	my_printbignum ( stdout, "RSA(dmq1)", privBn.dmq1 );
+	my_printbignum ( stdout, "RSA(iqmp)", privBn.iqmp );
+	my_printbignum ( stdout, "RSA(e)", privBn.e );
+	
+			
 #if 0
-	printf( "RSA(p)    : 0x%08X\n", (unsigned int)privBn->p );
-	printf( "RSA(q)    : 0x%08X\n", (unsigned int)privBn->q );
-	printf( "RSA(dmp1) : 0x%08X\n", (unsigned int)privBn->dmp1 );
-	printf( "RSA(dmq1) : 0x%08X\n", (unsigned int)privBn->dmq1 );
-	printf( "RSA(iqmp) : 0x%08X\n", (unsigned int)privBn->iqmp );
-	printf( "RSA(e)    : 0x%08X\n", (unsigned int)privBn->e );
+	printf( "RSA bn addr\n" );
+	printf( "RSA(p)    : 0x%08X\n", (unsigned int)privBn.p );
+	printf( "RSA(q)    : 0x%08X\n", (unsigned int)privBn.q );
+	printf( "RSA(dmp1) : 0x%08X\n", (unsigned int)privBn.dmp1 );
+	printf( "RSA(dmq1) : 0x%08X\n", (unsigned int)privBn.dmq1 );
+	printf( "RSA(iqmp) : 0x%08X\n", (unsigned int)privBn.iqmp );
+	printf( "RSA(e)    : 0x%08X\n", (unsigned int)privBn.e );
 #endif
 	
+	// imm dec
+	{
+	struct NFast_Bignum *dec_bn = NULL;
+	unsigned char *out = (unsigned char*)malloc( DATA_LEN );
+	my_bin2bignum( &(dec_bn), handle, save_enc, DATA_LEN );
+	
+	M_Command cmd;
+	M_Reply reply;
+	cmd.cmd = Cmd_RSAImmedSignDecrypt;
+	cmd.args.rsaimmedsigndecrypt.m = dec_bn;
+	cmd.args.rsaimmedsigndecrypt.k_p = privBn.p;
+	cmd.args.rsaimmedsigndecrypt.k_q = privBn.q;
+	cmd.args.rsaimmedsigndecrypt.k_dmp1 = privBn.dmp1;
+	cmd.args.rsaimmedsigndecrypt.k_dmq1 = privBn.dmq1;
+	cmd.args.rsaimmedsigndecrypt.k_iqmp = privBn.iqmp;
+	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : imm dec\n", result );
+		return 1;
+	}
+	result = reply.status;
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : imm dec(reply)\n", result );
+		return 1;
+	}
+	printf ( "imm %d bytes\n", reply.reply.rsaimmedsigndecrypt.r->nbytes );
+	my_bignum2bin( out, DATA_LEN, handle, reply.reply.rsaimmedsigndecrypt.r );
+	PrintArray( (char*)"imm dec before", save_enc, DATA_LEN );
+	PrintArray( (char*)"imm dec after", out, DATA_LEN - 11 );
+	memcpy( save_enc, out, DATA_LEN );
+	}	// imm dec
+	
 	// make ACL
 	if ( cardset != NULL )
 		map.f = NFKM_NKF_RecoveryEnabled | NFKM_NKF_ProtectionCardSet;
@@ -204,19 +282,17 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		printf( "error(%d) : NFKM_newkey_makeaclx\n", result );
 		return result;
 	}
-	
-	printf( "import.\n" );
-	
+
 	// import key
 	cmd.cmd = Cmd_Import;
 	cmd.args.import.module = MODULE_ID;
 	cmd.args.import.data.type = KeyType_RSAPrivate;
-	cmd.args.import.data.data.rsaprivate.p = pBn;
-	cmd.args.import.data.data.rsaprivate.q = qBn;
-	cmd.args.import.data.data.rsaprivate.dmp1 = dmp1Bn;
-	cmd.args.import.data.data.rsaprivate.dmq1 = dmq1Bn;
-	cmd.args.import.data.data.rsaprivate.iqmp = iqmpBn;
-	cmd.args.import.data.data.rsaprivate.e = eBn;
+	cmd.args.import.data.data.rsaprivate.p = privBn.p;
+	cmd.args.import.data.data.rsaprivate.q = privBn.q;
+	cmd.args.import.data.data.rsaprivate.dmp1 = privBn.dmp1;
+	cmd.args.import.data.data.rsaprivate.dmq1 = privBn.dmq1;
+	cmd.args.import.data.data.rsaprivate.iqmp = privBn.iqmp;
+	cmd.args.import.data.data.rsaprivate.e = privBn.e;
 	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
 	if ( result != Status_OK )
 	{	
@@ -229,10 +305,9 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		printf( "error(%d) : Cmd_Import(reply)\n", result );
 		return 1;
 	}
-	printf( "keyid : 0x%08X\n", (unsigned int)reply.reply.import.key );
 	
 	// make blobs
-	reg_key.v = Key__maxversion; // TORIAEZU Version Max (8)
+	reg_key.v = Key__maxversion; // TORIAEZU : Key__maxversion = 8
 	reg_key.name = keyident.ident;
 	reg_key.appname = keyident.appname;
 	reg_key.ident = keyident.ident;
@@ -248,8 +323,6 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		return 1;
 	}
 	
-	printf( "recordkey.\n" );
-	
 	// record key to disk
 	result = NFKM_recordkey( handle, &reg_key, NULL );
 	if ( result != Status_OK )
@@ -266,9 +339,472 @@ int importRSAPrivate( NFKM_KeyIdent keyident )
 		return 1;
 	}
 	
-	printf( "record key success.\n" );
+	return result;
 }	// import_rsa_private
 
+int importRSAPublic( NFKM_KeyIdent keyident )
+{
+	int result = Status_OK;
+	
+	RSA *pubkey = NULL;
+	FILE *fp;
+	
+	unsigned char *ePtr, *nPtr;
+	int eLen, nLen;
+	
+	M_Command cmd;
+	M_Reply reply;
+	NFKM_MakeACLParams map;
+	NFKM_MakeBlobsParams mbp;
+	NFKM_Key reg_key;
+	RSAPublicKeyDataBn pubBn;
+	
+	ePtr = nPtr = NULL;
+	eLen = nLen = 0;
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	memset( &map, 0, sizeof( map ) );
+	memset( &mbp, 0, sizeof( mbp ) );
+	memset( &reg_key, 0, sizeof( reg_key ) );
+	memset( &pubBn, 0, sizeof( pubBn ) );
+	
+	// key data open
+	fp = fopen( PUB_KEY_FILE, "rb" );
+	if ( !fp )
+	{
+		printf( "error : open %s file\n", PUB_KEY_FILE );
+		return 1;
+	}
+	pubkey = d2i_RSA_PUBKEY_fp( fp, NULL );
+	if ( !pubkey )
+	{
+		printf( "error : d2i_RSA_PUBKEY_fp\n" );
+		return 1;
+	}
+	fclose( fp );
+
+#if 0
+	printf( "RSA bignum(Openssl) size\n" );
+	printf( "RSA(e)    : %d bytes\n", BN_num_bytes( pubkey->e ) );
+	printf( "RSA(n)    : %d bytes\n", BN_num_bytes( pubkey->n ) );
+#endif
+	
+	// RSA public key の構成要素をそれぞれバイナリに変換
+	{
+		// e
+		eLen = BN_num_bytes( pubkey->e );
+		ePtr = (unsigned char *)malloc( eLen );
+		if ( eLen != BN_bn2bin( pubkey->e, ePtr ) )
+		{
+			printf( "BN_bn2bin failed!(e)\n" );
+			return 1;
+		}
+		// n
+		nLen = BN_num_bytes( pubkey->n );
+		nPtr = (unsigned char *)malloc( nLen );
+		if ( nLen != BN_bn2bin( pubkey->n, nPtr ) )
+		{
+			printf( "BN_bn2bin failed!(n)\n" );
+			return 1;
+		}
+	}	// rsa bignum(openssl) -> bin
+
+#if 0
+	printf( "RSA bin addr\n" );
+	printf( "RSA(e)    : 0x%08X\n", (unsigned int)ePtr );
+	printf( "RSA(n)    : 0x%08X\n", (unsigned int)nPtr );
+#endif
+	
+	// バイナリをHSMのBignumに変換
+	{
+		my_bin2bignum( &(pubBn.e), handle, ePtr, eLen );
+		my_bin2bignum( &(pubBn.n), handle, nPtr, nLen );
+		free( ePtr );
+		free( nPtr );
+	}
+		
+#if 0
+	printf( "RSA bn addr\n" );
+	printf( "RSA(e)    : 0x%08X\n", (unsigned int)pubBn.e );
+	printf( "RSA(n)    : 0x%08X\n", (unsigned int)pubBn.n );
+#endif
+	
+	// imm enc
+	{
+	int i;
+	struct NFast_Bignum *enc_bn = NULL;
+	unsigned char *ptr = (unsigned char*)malloc( DATA_LEN - 11 );
+	unsigned char *out = (unsigned char*)malloc( DATA_LEN );
+	for ( i = 0; i < DATA_LEN - 11; i++ )
+		ptr[i] = i;
+	my_bin2bignum( &(enc_bn), handle, ptr, DATA_LEN - 11 );
+	
+	M_Command cmd;
+	M_Reply reply;
+	cmd.cmd = Cmd_RSAImmedVerifyEncrypt;
+	cmd.args.rsaimmedverifyencrypt.m = enc_bn;
+	cmd.args.rsaimmedverifyencrypt.k_e = pubBn.e;
+	cmd.args.rsaimmedverifyencrypt.k_n = pubBn.n;
+	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : imm enc\n", result );
+		return 1;
+	}
+	result = reply.status;
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : imm enc(reply)\n", result );
+		return 1;
+	}
+	printf ( "imm %d bytes\n", reply.reply.rsaimmedsigndecrypt.r->nbytes );
+	my_bignum2bin( out, DATA_LEN, handle, reply.reply.rsaimmedsigndecrypt.r );
+	PrintArray( (char*)"imm before", ptr, DATA_LEN - 11 );
+	PrintArray( (char*)"imm after", out, DATA_LEN );
+	memcpy( save_enc, out, DATA_LEN );
+	}	// imm enc & dec
+	
+	// make ACL
+	if ( cardset != NULL )
+		map.f = NFKM_NKF_RecoveryEnabled | NFKM_NKF_ProtectionCardSet;
+	else
+		map.f = NFKM_NKF_RecoveryEnabled | NFKM_NKF_ProtectionModule;
+	// 秘密鍵には DECRYPT と SIGN
+	// 公開鍵には ENCRYPT と VERIFY しかセットできない？？
+	map.op_base = NFKM_DEFOPPERMS_ENCRYPT | NFKM_DEFOPPERMS_VERIFY;
+	map.cs = cardset;
+	result = NFKM_newkey_makeaclx( handle, nc, world, &map, &(cmd.args.import.acl), NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_newkey_makeaclx\n", result );
+		return result;
+	}
+
+	// import key
+	cmd.cmd = Cmd_Import;
+	cmd.args.import.module = MODULE_ID;
+	cmd.args.import.data.type = KeyType_RSAPublic;
+	cmd.args.import.data.data.rsapublic.e = pubBn.e;
+	cmd.args.import.data.data.rsapublic.n = pubBn.n;
+	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : Cmd_Import\n", result );
+		return 1;
+	}
+	result = reply.status;
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : Cmd_Import(reply)\n", result );
+		return 1;
+	}
+	
+	// make blobs
+	reg_key.v = Key__maxversion; // TORIAEZU : Key__maxversion = 8
+	reg_key.name = keyident.ident;
+	reg_key.appname = keyident.appname;
+	reg_key.ident = keyident.ident;
+	time( &(reg_key.gentime) );
+	mbp.f = map.f;
+	mbp.kpriv = reply.reply.import.key;
+	mbp.lt = ltid;
+	mbp.cs = cardset;
+	result = NFKM_newkey_makeblobsx( handle, nc, world, &mbp, &reg_key, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_newkey_makeblobsx\n", result );
+		return 1;
+	}
+	
+	// record key to disk
+	result = NFKM_recordkey( handle, &reg_key, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_recordkey\n", result );
+		return 1;
+	}
+	
+	// destroy key
+	result = NFKM_cmd_destroy( handle, nc, 0, reply.reply.import.key, "destroy import key", NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_cmd_destroy\n", result );
+		return 1;
+	}
+	
+	return result;
+}	// import_rsa_public
+
+int verifyRSAKeyPair( NFKM_KeyIdent priv_ident, NFKM_KeyIdent pub_ident )
+{
+	int i;
+	int result = Status_OK;
+	M_ByteBlock *blobptr = NULL;
+	M_KeyID priv_keyid, pub_keyid;
+	NFKM_Key *keyinfo = NULL;
+	M_Command cmd;
+	M_Reply reply;
+
+	priv_keyid = pub_keyid = 0;
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+
+	// find priv key
+	result = NFKM_findkey( handle, priv_ident, &keyinfo, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_findkey(priv)\n", result );
+		return result;
+	}
+	
+	// load priv key blob
+	blobptr = &(keyinfo->privblob);
+	result = NFKM_cmd_loadblob( handle, nc, 
+		moduleinfo->module, blobptr, ltid, &priv_keyid, "loading priv key blob", NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_cmd_loadblob(priv)\n", result );
+		return result;
+	}
+	NFKM_freekey( handle, keyinfo, NULL );
+	keyinfo = NULL;
+
+#if 0
+	// get priv key info
+	cmd.cmd = Cmd_GetKeyInfo;
+	cmd.args.getkeyinfo.key = priv_keyid;
+	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : FastApp_Transact(Cmd_GetKeyInfo)\n", result );
+		return result;
+	}
+	printf( "priv key ID  : %08X\n", (unsigned int)priv_keyid );			
+	printf( "priv keytype : %d\n", reply.reply.getkeyinfo.type );
+	NFastApp_Free_Command( handle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+#endif
+		
+	// find pub key
+	result = NFKM_findkey( handle, pub_ident, &keyinfo, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_findkey(pub)\n", result );
+		return result;
+	}
+	
+	// load pub key blob
+	blobptr = &(keyinfo->privblob); // pub dakedo privblob
+	result = NFKM_cmd_loadblob( handle, nc, 
+		moduleinfo->module, blobptr, ltid, &pub_keyid, "loading pub key blob", NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : NFKM_cmd_loadblob(pub)\n", result );
+		return result;
+	}
+	NFKM_freekey( handle, keyinfo, NULL );
+	keyinfo = NULL;
+	
+#if 0
+	// get priv key info
+	cmd.cmd = Cmd_GetKeyInfo;
+	cmd.args.getkeyinfo.key = pub_keyid;
+	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+	if ( result != Status_OK )
+	{	
+		printf( "error(%d) : FastApp_Transact(Cmd_GetKeyInfo)\n", result );
+		return result;
+	}
+	printf( "pub key ID  : %08X\n", (unsigned int)pub_keyid );
+	printf( "pub keytype : %d\n", reply.reply.getkeyinfo.type );
+	NFastApp_Free_Command( handle, NULL, NULL, &cmd );
+	NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+	memset( &cmd, 0, sizeof( cmd ) );
+	memset( &reply, 0, sizeof( reply ) );
+	keyinfo = NULL;
+#endif
+
+#if 1
+	// encrypt & dectypt test
+	{
+		unsigned char *beforePtr, *middlePtr, *afterPtr;
+		unsigned char *encPtr, *decPtr;
+		struct NFast_Bignum *enc_bn, *dec_bn;
+		M_Mech dec_mech;
+				
+		beforePtr = afterPtr = NULL;
+		encPtr = decPtr = NULL;
+		enc_bn = dec_bn = NULL;
+		
+		// encrypt data setting
+		beforePtr = (unsigned char*)malloc( DATA_LEN - 11 );
+		for ( i = 0; i < DATA_LEN - 11; i++ )
+			beforePtr[i] = i;
+		my_bin2bignum( &(enc_bn), handle, beforePtr, DATA_LEN - 11 );
+
+#if 0
+		// my_bignum2bin test
+		unsigned char debug_buf[ DATA_LEN ];
+		PrintArray( (char*)"beforePtr", beforePtr, DATA_LEN );
+		printf( "beforePtr -> bin2bignum -> bignum2bin -> debug_buf\n" );
+		my_bignum2bin( debug_buf, DATA_LEN, handle, enc_bn );
+		PrintArray( (char*)"debug_buf", debug_buf, DATA_LEN );
+#endif
+		printf( "%d bytes\n", enc_bn->nbytes ); 
+		
+		// encrypt transact
+		cmd.cmd = Cmd_Encrypt;
+		cmd.args.encrypt.flags = 0;	// Cmd_Encrypt_Args_flags_given_iv_present;
+		cmd.args.encrypt.key = pub_keyid;
+		cmd.args.encrypt.mech = Mech_RSApPKCS1;
+		cmd.args.encrypt.plain.type = PlainTextType_Bignum;
+		cmd.args.encrypt.plain.data.bignum.m = enc_bn;
+		//cmd.args.encrypt.given_iv = NULL;
+		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : FastApp_Transact(Cmd_Encrypt)\n", result );
+			return 1;
+		}
+		result = reply.status;
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : reply.status(Cmd_Encrypt)\n", result );
+			return 1;
+		}
+		#if 1
+		if ( DATA_LEN != reply.reply.encrypt.cipher.data.rsappkcs1.m->nbytes )
+		{
+			printf( "error : output size isn't %d bytes!\n", DATA_LEN );
+			return 1;
+		}
+		#endif
+		
+		printf( "RSA data encrypt ok\n" );
+		
+		// decrypt data setting
+		middlePtr = (unsigned char*)malloc( DATA_LEN );
+		my_bignum2bin( middlePtr, DATA_LEN, handle,
+					reply.reply.encrypt.cipher.data.rsappkcs1.m );
+		//my_bin2bignum( &dec_bn, handle, middlePtr, DATA_LEN );		
+		my_bignumCopy( &dec_bn, reply.reply.encrypt.cipher.data.rsappkcs1.m, handle );
+		dec_mech = reply.reply.encrypt.cipher.mech;
+				
+		NFastApp_Free_Command( handle, NULL, NULL, &cmd );
+		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+		memset( &cmd, 0, sizeof( cmd ) );
+		memset( &reply, 0, sizeof( reply ) );
+
+		// decrypt transact
+		cmd.cmd = Cmd_Decrypt;
+		cmd.args.decrypt.flags = 0;
+		cmd.args.decrypt.key = priv_keyid;
+		cmd.args.decrypt.mech = Mech_RSApPKCS1;
+		cmd.args.decrypt.cipher.mech = dec_mech;
+		cmd.args.decrypt.cipher.data.rsappkcs1.m = dec_bn;
+		cmd.args.decrypt.reply_type = PlainTextType_Bignum;
+		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : FastApp_Transact(Cmd_Decrypt)\n", result );
+			return 1;
+		}
+		result = reply.status;
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : reply.status(Cmd_Decrypt)\n", result );
+			return 1;
+		}
+		#if 0
+		if ( DATA_LEN != reply.reply.decrypt.plain.data.bignum.m->nbytes )
+		{
+			printf( "error : output size isn't %d bytes!\n", DATA_LEN );
+			return 1;
+		}
+		#endif
+		
+		printf( "RSA data decrypt ok\n" );
+		
+		// after
+		afterPtr = (unsigned char*)malloc( DATA_LEN );
+		my_bignum2bin( middlePtr, DATA_LEN, handle,
+					reply.reply.decrypt.plain.data.bignum.m );
+		
+		NFastApp_Free_Command( handle, NULL, NULL, &cmd );
+		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+					
+		// data show
+		PrintArray( (char*)"before", beforePtr, DATA_LEN - 11);
+		PrintArray( (char*)"middle", middlePtr, DATA_LEN );
+		PrintArray( (char*)"after", afterPtr, DATA_LEN - 11);				
+		
+#if 0
+		
+		dec_output.ptr = (unsigned char*)malloc( dec_output.len );
+		memcpy( dec_output.ptr, 
+			reply.reply.decrypt.plain.data.bytes.data.ptr,
+			dec_output.len );
+
+		printf( "decrypt ok\n" );
+		
+		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+
+		// key destroy
+		memset( &cmd, 0, sizeof( cmd ) ); // fail if NFastApp_Free_Command
+		cmd.cmd = Cmd_Destroy;
+		cmd.args.destroy.key = pub_keyid;
+		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : NFastApp_Transact(Cmd_Destroy)\n", result );
+		}
+		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+		memset( &cmd, 0, sizeof( cmd ) ); // fail if NFastApp_Free_Command
+		cmd.cmd = Cmd_Destroy;
+		cmd.args.destroy.key = priv_keyid;
+		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
+		if ( result != Status_OK )
+		{	
+			printf( "error(%d) : NFastApp_Transact(Cmd_Destroy)\n", result );
+		}
+		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
+		
+		// data show
+		printf( "enc_input : (%d bytes)", (int)enc_input.len );
+		for ( i = 0; i < enc_input.len; i++ )
+		{
+			if ( i % 16 == 0 )
+				printf( "\n" );
+			printf( "%02X ", enc_input.ptr[i] );
+		}
+		printf( "\n" );
+		
+		printf( "\nenc_output : (%d bytes)", (int)enc_output.len );
+		for ( i = 0; i < enc_output.len; i++ )
+		{
+			if ( i % 16 == 0 )
+				printf( "\n" );
+			printf( "%02X ", enc_output.ptr[i] );
+		}
+		printf( "\n" );
+		
+		printf( "\ndec_output : (%d bytes)", (int)dec_output.len );
+		for ( i = 0; i < dec_output.len; i++ )
+		{
+			if ( i % 16 == 0 )
+				printf( "\n" );
+			printf( "%02X ", dec_output.ptr[i] );
+		}
+		printf( "\n" );
+#endif
+	}	// encrypt & decrypt
+#endif
+		
+	return result;
+}	// verify_rsa_keypair
+
 void PrintArray( char *pStr, const unsigned char *pData, int length )
 {
 	int i;
@@ -283,28 +819,20 @@ void PrintArray( char *pStr, const unsigned char *pData, int length )
 
 int main( int argc, char *argv[] )
 {
-	int i;
-	int result = 0;
-	int rand_size = 80;
-	
+	int result = Status_OK;
+
 	M_Command cmd;
 	M_Reply reply;
 	
 	memset( &cmd, 0, sizeof( cmd ) );
 	memset( &reply, 0, sizeof( reply ) );
 	
-	M_KeyID keyid;
-	NFKM_Key *keyinfo;
-	
-	if ( argc == 2 )
-		rand_size = atoi( argv[1] );
-
 	// init nFast
 	result = NFastApp_InitEx( &handle, NULL, NULL );
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : NFastApp_InitEx\n", result );
-		return 0;
+		return 1;
 	}
 
 	// connecting to hardserver
@@ -312,7 +840,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{
 		printf( "error(%d) : NFastApp_Connect\n", result );
-		return 0;
+		return 1;
 	}
 
 	// set bignum upcalls setting
@@ -327,7 +855,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{
 		printf( "error(%d) : NFastApp_SetBignumUpcalls\n", result );
-		return 0;
+		return 1;
 	}
 
 	// NFKM getinfo
@@ -335,7 +863,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : NFKM_getinfo\n", result );
-		return 0;
+		return 1;
 	}
 
 	// init card-loading lib
@@ -343,7 +871,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : RQCard_init\n", result );
-		return 0;
+		return 1;
 	}
 
 	// init FIPS state
@@ -351,7 +879,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : RQCard_fips_init\n", result );
-		return 0;
+		return 1;
 	}
 	
 	// ui select
@@ -359,7 +887,7 @@ int main( int argc, char *argv[] )
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : RQCard_ui_default\n", result );
-		return 0;
+		return 1;
 	}
 
 	// get strict-FIPS authorization
@@ -422,21 +950,42 @@ int main( int argc, char *argv[] )
 #endif
 		
 	// get usable module
-	NFKM_ModuleInfo *moduleinfo = world->modules[0];
+	moduleinfo = world->modules[0];
 	result = NFKM_getusablemodule( world, MODULE_ID, &moduleinfo );
 	if ( result != Status_OK )
 	{	
 		printf( "error(%d) : NFKM_getusablemodule\n", result );
+		return 1;
 	}
-	
+
+#if 0
 	// RSA privkey のインポート
-	NFKM_KeyIdent keyident = { (char*)"simple", (char*)"rsa-import-privkey" };
-	result = importRSAPrivate( keyident );
+	result = importRSAPrivate( priv_keyident );
 	if ( result != Status_OK )
 	{	
-		printf( "error(%d) : importRSAPrivate\n", result );
+		printf( "error : importRSAPrivate\n" );
+		return 1;
 	}
-	
+	printf( "RSA privkey import success.\n" );
+#endif
+
+	// RSA pubkey
+	result = importRSAPublic( pub_keyident );
+	if ( result != Status_OK )
+	{	
+		printf( "error : importRSAPublic\n" );
+		return 1;
+	}
+	printf( "RSA pubkey import success.\n" );
+
+	// RSA privkey のインポート
+	result = importRSAPrivate( priv_keyident );
+	if ( result != Status_OK )
+	{	
+		printf( "error : importRSAPrivate\n" );
+		return 1;
+	}
+	printf( "RSA privkey import success.\n" );
 
 	// list key
 #if 0
@@ -453,177 +1002,19 @@ int main( int argc, char *argv[] )
 		printf( "appname : %s, ident : %s\n", tkp[i]->appname, tkp[i]->ident );
 	}
 #endif
-		
-	// find key
-	NFKM_KeyIdent ki_v = { (char*)"simple", (char*)"rsa-import-privkey" };
 	
-	printf( "appname : %s, ident : %s\n", ki_v.appname, ki_v.ident );
-	
-	result = NFKM_findkey( handle, ki_v, &keyinfo, NULL );
+	// verify key pair
+	result = verifyRSAKeyPair( priv_keyident, pub_keyident );
 	if ( result != Status_OK )
 	{	
-		printf( "error(%d) : NFKM_findkey\n", result );
+		printf( "error : verifyRSAKeyPair\n" );
+		return 1;
 	}
-	
-	// load blob
-	M_ByteBlock *blobptr;
-	if ( keyinfo->pubblob.len)
-		blobptr = &keyinfo->pubblob;
-	else
-	{
-		blobptr = &keyinfo->privblob;
-	}
-	
-	result = NFKM_cmd_loadblob( handle, nc, 
-		moduleinfo->module, blobptr, ltid, &keyid, "loading key blob", NULL );
-	if ( result != Status_OK )
-	{	
-		printf( "error(%d) : NFKM_cmd_loadblob\n", result );
-	}
-	printf( "key ID : %u\n", (unsigned int)keyid );
-									
-	// get key info
-	cmd.cmd = Cmd_GetKeyInfo;
-	cmd.args.getkeyinfo.key = keyid;
-	result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
-	if ( result != Status_OK )
-	{	
-		printf( "error(%d) : FastApp_Transact(Cmd_GetKeyInfo)\n", result );
-	}
-	// if type == 30 then Rijndael(AES)
-	printf( "keytype : %d\n", reply.reply.getkeyinfo.type );
-
-	// encrypt & dectypt test
-	{
-		M_ByteBlock enc_input, dec_input;
-		M_ByteBlock enc_output, dec_output;
-		M_IV base_iv, enc_iv, dec_iv;
-		
-		// data setting
-		enc_input.len = DATA_LEN;
-		enc_input.ptr = (unsigned char*)malloc( DATA_LEN );
-		for ( i = 0; i < enc_input.len; i++ )
-			enc_input.ptr[i] = i;
-		
-		base_iv.mech = Mech_RijndaelmCBCpNONE;
-		for ( i = 0; i < 16; i++ )
-			base_iv.iv.generic128.iv.bytes[i] = i;
-		enc_iv = base_iv;
-		dec_iv = base_iv;
-
-		// encrypt : my ver
-		cmd.cmd = Cmd_Encrypt;
-		cmd.args.encrypt.key = keyid;
-		cmd.args.encrypt.mech = Mech_RijndaelmCBCpNONE;
-		cmd.args.encrypt.plain.type = PlainTextType_Bytes;
-		cmd.args.encrypt.plain.data.bytes.data = enc_input;
-		cmd.args.encrypt.flags = Cmd_Encrypt_Args_flags_given_iv_present;
-		cmd.args.encrypt.given_iv = &enc_iv;
-		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
-		if ( result != Status_OK )
-		{	
-			printf( "error(%d) : FastApp_Transact(Cmd_Encrypt)\n", result );
-		}
-		result = reply.status;
-		if ( result != Status_OK )
-		{	
-			printf( "error(%d) : reply.status(Cmd_Encrypt)\n", result );
-		}
-		enc_output.len = reply.reply.encrypt.cipher.data.generic128.cipher.len;
-		if ( enc_output.len != DATA_LEN )
-		{	
-			printf( "error : output data size isn't %d bytes(Cmd_Encrypt)\n", (int)enc_output.len );
-		}
-		enc_output.ptr = (unsigned char*)malloc( enc_output.len );
-		memcpy( enc_output.ptr, 
-			reply.reply.encrypt.cipher.data.generic128.cipher.ptr,
-			enc_output.len );
-
-		printf( "encrypt ok\n" );
-		
-		dec_input.len = enc_output.len;
-		dec_input.ptr = (unsigned char*)malloc( dec_input.len );
-		memcpy( dec_input.ptr, enc_output.ptr, DATA_LEN );
-		
-		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
-
-		// decrypt : my ver
-		cmd.cmd = Cmd_Decrypt;
-		cmd.args.decrypt.flags = 0;
-		cmd.args.decrypt.key = keyid;
-		cmd.args.decrypt.mech = Mech_RSApPKCS1;
-		cmd.args.decrypt.cipher.mech = Mech_RSApPKCS1;
-		cmd.args.decrypt.cipher.data.generic128.cipher = dec_input;
-		cmd.args.decrypt.cipher.iv = dec_iv.iv;
-		cmd.args.decrypt.reply_type = PlainTextType_Bytes;
-		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
-		if ( result != Status_OK )
-		{	
-			printf( "error(%d) : FastApp_Transact(Cmd_Decrypt)\n", result );
-		}
-		result = reply.status;
-		if ( result != Status_OK )
-		{	
-			printf( "error(%d) : reply.status(Cmd_Decrypt)\n", result );
-		}
-		dec_output.len = reply.reply.decrypt.plain.data.bytes.data.len;
-		if ( dec_output.len != DATA_LEN )
-		{	
-			printf( "error : output size isn't %d bytes(Cmd_Decrypt)\n", (int)enc_output.len );
-		}
-		dec_output.ptr = (unsigned char*)malloc( dec_output.len );
-		memcpy( dec_output.ptr, 
-			reply.reply.decrypt.plain.data.bytes.data.ptr,
-			dec_output.len );
-
-		printf( "decrypt ok\n" );
-		
-		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
-
-		// key destroy
-		memset( &cmd, 0, sizeof( cmd ) ); // fail if NFastApp_Free_Command
-		cmd.cmd = Cmd_Destroy;
-		cmd.args.destroy.key = keyid;
-		result = NFastApp_Transact( nc, NULL, &cmd, &reply, NULL );
-		if ( result != Status_OK )
-		{	
-			printf( "error(%d) : NFastApp_Transact(Cmd_Destroy)\n", result );
-		}
-		NFastApp_Free_Reply( handle, NULL, NULL, &reply );
-		
-		// data show
-		printf( "enc_input : (%d bytes)", (int)enc_input.len );
-		for ( i = 0; i < enc_input.len; i++ )
-		{
-			if ( i % 16 == 0 )
-				printf( "\n" );
-			printf( "%02X ", enc_input.ptr[i] );
-		}
-		printf( "\n" );
-		
-		printf( "\nenc_output : (%d bytes)", (int)enc_output.len );
-		for ( i = 0; i < enc_output.len; i++ )
-		{
-			if ( i % 16 == 0 )
-				printf( "\n" );
-			printf( "%02X ", enc_output.ptr[i] );
-		}
-		printf( "\n" );
-		
-		printf( "\ndec_output : (%d bytes)", (int)dec_output.len );
-		for ( i = 0; i < dec_output.len; i++ )
-		{
-			if ( i % 16 == 0 )
-				printf( "\n" );
-			printf( "%02X ", dec_output.ptr[i] );
-		}
-		printf( "\n" );
-	}	// encrypt & decrypt
-
+	printf( "RSA keypair verify success.\n" );
+											
 	// end processing
 	RQCard_fips_free( &card, &fips );
 	RQCard_destroy( &card );
-	NFKM_freekey( handle, keyinfo, NULL );
 	NFKM_freeinfo( handle, &world, NULL );
 	NFastApp_Disconnect( nc, NULL );
 	NFastApp_Finish( handle, NULL );
diff --git a/hsm_utils/my_hsm_bignum.c b/hsm_utils/my_hsm_bignum.c
index dda52f6..7883b7e 100644
--- a/hsm_utils/my_hsm_bignum.c
+++ b/hsm_utils/my_hsm_bignum.c
@@ -281,6 +281,47 @@ int my_bignum2char ( char *buf, int buflen,
 
 /* --------------------- */
 
+int my_bignum2bin ( unsigned char *buf, int buflen,
+			struct NFast_Application *app,
+			const struct NFast_Bignum *pBN )
+{
+  int i, pos, len;
+
+	len = pBN->nbytes;
+	pos = len;
+	if ( buflen < pos )
+		return Status_BufferFull;
+
+  for ( i = 0; i < len; i++ )
+  {
+    buf[--pos] = getbyte( pBN, i );
+  }
+
+  return Status_OK;
+}	// my_bignum2bin
+
+/* --------------------- */
+
+int my_bignumCopy( struct NFast_Bignum **dst, 
+					const struct NFast_Bignum *src,
+					struct NFast_Application *app )
+{	
+	struct NFast_Bignum *pBN;
+	pBN = (struct NFast_Bignum *)NFastApp_Malloc( app, sizeof(struct NFast_Bignum), NULL, NULL );
+	if ( !pBN ) return NOMEM;
+
+	pBN->msb_first = src->msb_first;
+	pBN->msw_first = src->msw_first;
+	pBN->nbytes = src->nbytes;
+	memcpy( pBN->bytes, src->bytes, src->nbytes );
+	
+	*dst = pBN;
+
+	return Status_OK;
+}
+
+/* --------------------- */
+
 void my_printbignum ( FILE *f, const char *prefix, const struct NFast_Bignum *pBN )
 {
   char buf[MAXBIGNUMBITS/4+1];
diff --git a/hsm_utils/my_hsm_bignum.h b/hsm_utils/my_hsm_bignum.h
index 6629b75..c029d8a 100644
--- a/hsm_utils/my_hsm_bignum.h
+++ b/hsm_utils/my_hsm_bignum.h
@@ -145,6 +145,16 @@ extern int my_bignum2char ( char *buf, int buflen,
                         struct NFast_Call_Context *cctx,
                         struct NFast_Transaction_Context *tctx );
 
+// convert NFast_Bignum to binary
+int my_bignum2bin ( unsigned char *buf, int buflen,
+			struct NFast_Application *app,
+			const struct NFast_Bignum *pBN );
+
+// NFast_Bignum copy
+int my_bignumCopy( struct NFast_Bignum **dst, 
+					const struct NFast_Bignum *src,
+					struct NFast_Application *app );
+
 /** Print a bignum in hex to a file
  *
  * Call ferror() to test for output errors.