Use of algo_properties to avoid linear search on a table for each property.

23 files changed, 284 insertions, 350 deletions

diff --git a/libtomcrypt/hashes/crypt_hash_is_valid.c b/libtomcrypt/hashes/crypt_hash_is_valid.c
index 32e8699..d01d418 100644
--- a/libtomcrypt/hashes/crypt_hash_is_valid.c
+++ b/libtomcrypt/hashes/crypt_hash_is_valid.c
@@ -17,10 +17,10 @@
 
 /*
    Test if a hash index is valid
-   @param idx   The index of the hash to search for
+   @param idx   The hash to search for
    @return CRYPT_OK if valid
 */
-int hash_is_valid(int idx)
+int hash_is_valid(const struct algo_properties_st *hash)
 {
    return CRYPT_OK;
 }
diff --git a/libtomcrypt/hashes/hash_get_oid.c b/libtomcrypt/hashes/hash_get_oid.c
index 32e4390..c6469ba 100644
--- a/libtomcrypt/hashes/hash_get_oid.c
+++ b/libtomcrypt/hashes/hash_get_oid.c
@@ -46,9 +46,9 @@ static const oid_st sha512_oid = {
    .OID = { 2, 16, 840, 1, 101, 3, 4, 2, 3,  },
 };
 
-int hash_get_oid(int hash, oid_st *st)
+int hash_get_oid(const struct algo_properties_st *hash, oid_st *st)
 {
-   switch (hash) {
+   switch (hash->algo) {
       case NCR_ALG_SHA1:
          memcpy(st, &sha1_oid, sizeof(*st));
          break;
diff --git a/libtomcrypt/hashes/hash_memory.c b/libtomcrypt/hashes/hash_memory.c
index 274c208..5ba3bc6 100644
--- a/libtomcrypt/hashes/hash_memory.c
+++ b/libtomcrypt/hashes/hash_memory.c
@@ -19,18 +19,17 @@
 
 /**
   Hash a block of memory and store the digest.
-  @param hash   The index of the hash you wish to use
+  @param hash   The hash you wish to use
   @param in     The data you wish to hash
   @param inlen  The length of the data to hash (octets)
   @param out    [out] Where to store the digest
   @param outlen [in/out] Max size and resulting size of the digest
   @return CRYPT_OK if successful
 */
-int hash_memory(int hash, const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen)
+int hash_memory(const struct algo_properties_st *hash, const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen)
 {
     int err;
     struct hash_data hdata;
-    int digest_size;
 
     LTC_ARGCHK(in     != NULL);
     LTC_ARGCHK(out    != NULL);
@@ -40,13 +39,12 @@ int hash_memory(int hash, const unsigned char *in, unsigned long inlen, unsigned
         return err;
     }
 
-    digest_size = _ncr_algo_digest_size(hash);
-    if (*outlen < digest_size) {
-       *outlen = digest_size;
+    if (*outlen < hash->digest_size) {
+       *outlen = hash->digest_size;
        return CRYPT_BUFFER_OVERFLOW;
     }
 
-    err = cryptodev_hash_init( &hdata, _ncr_algo_to_str(hash), 0, NULL, 0);
+    err = cryptodev_hash_init( &hdata, hash->kstr, 0, NULL, 0);
     if (err < 0) {
        err = CRYPT_INVALID_HASH;
        goto LBL_ERR;
@@ -59,7 +57,7 @@ int hash_memory(int hash, const unsigned char *in, unsigned long inlen, unsigned
     
     err = cryptodev_hash_final(&hdata, out);
     
-    *outlen = digest_size;
+    *outlen = hash->digest_size;
 LBL_ERR:
     cryptodev_hash_deinit(&hdata);
 
diff --git a/libtomcrypt/hashes/hash_memory_multi.c b/libtomcrypt/hashes/hash_memory_multi.c
index 6a85f65..d772492 100644
--- a/libtomcrypt/hashes/hash_memory_multi.c
+++ b/libtomcrypt/hashes/hash_memory_multi.c
@@ -20,7 +20,7 @@
 
 /**
   Hash multiple (non-adjacent) blocks of memory at once.  
-  @param hash   The index of the hash you wish to use
+  @param hash   The hash you wish to use
   @param out    [out] Where to store the digest
   @param outlen [in/out] Max size and resulting size of the digest
   @param in     The data you wish to hash
@@ -28,11 +28,10 @@
   @param ...    tuples of (data,len) pairs to hash, terminated with a (NULL,x) (x=don't care)
   @return CRYPT_OK if successful
 */  
-int hash_memory_multi(int hash, unsigned char *out, unsigned long *outlen,
+int hash_memory_multi(const struct algo_properties_st *hash, unsigned char *out, unsigned long *outlen,
                       const unsigned char *in, unsigned long inlen, ...)
 {
     struct hash_data hdata;
-    int digest_size;
     int                  err;
     va_list              args;
     const unsigned char *curptr;
@@ -46,13 +45,12 @@ int hash_memory_multi(int hash, unsigned char *out, unsigned long *outlen,
         return err;
     }
 
-    digest_size = _ncr_algo_digest_size(hash);
-    if (*outlen < digest_size) {
-       *outlen = digest_size;
+    if (*outlen < hash->digest_size) {
+       *outlen = hash->digest_size;
        return CRYPT_BUFFER_OVERFLOW;
     }
 
-    err = cryptodev_hash_init( &hdata, _ncr_algo_to_str(hash), 0, NULL, 0);
+    err = cryptodev_hash_init( &hdata, hash->kstr, 0, NULL, 0);
     if (err < 0) {
        err = CRYPT_INVALID_HASH;
        goto LBL_ERR;
@@ -77,7 +75,7 @@ int hash_memory_multi(int hash, unsigned char *out, unsigned long *outlen,
  
     err = cryptodev_hash_final(&hdata, out);
     
-    *outlen = digest_size;
+    *outlen = hash->digest_size;
 LBL_ERR:
     cryptodev_hash_deinit(&hdata);
     va_end(args);
diff --git a/libtomcrypt/headers/tomcrypt_hash.h b/libtomcrypt/headers/tomcrypt_hash.h
index 417e481..e4e84e4 100644
--- a/libtomcrypt/headers/tomcrypt_hash.h
+++ b/libtomcrypt/headers/tomcrypt_hash.h
@@ -1,12 +1,14 @@
 /* ---- HASH FUNCTIONS ---- */
 
-int hash_is_valid(int idx);
+struct algo_properties_st;
 
-int hash_memory(int hash, 
+int hash_is_valid(const struct algo_properties_st *hash);
+
+int hash_memory(const struct algo_properties_st *hash,
                 const unsigned char *in,  unsigned long inlen, 
                       unsigned char *out, unsigned long *outlen);
-int hash_memory_multi(int hash, unsigned char *out, unsigned long *outlen,
+int hash_memory_multi(const struct algo_properties_st *hash, unsigned char *out, unsigned long *outlen,
                       const unsigned char *in, unsigned long inlen, ...);
 
-int hash_get_oid(int hash, oid_st* st);
+int hash_get_oid(const struct algo_properties_st *hash, oid_st* st);
 
diff --git a/libtomcrypt/headers/tomcrypt_pk.h b/libtomcrypt/headers/tomcrypt_pk.h
index fa6030e..145165e 100644
--- a/libtomcrypt/headers/tomcrypt_pk.h
+++ b/libtomcrypt/headers/tomcrypt_pk.h
@@ -1,5 +1,7 @@
 /* ---- NUMBER THEORY ---- */
 
+struct algo_properties_st;
+
 enum {
    PK_PUBLIC=0,
    PK_PRIVATE=1
@@ -57,40 +59,40 @@ int rsa_exptmod(const unsigned char *in,   unsigned long inlen,
 void rsa_free(rsa_key *key);
 
 /* These use LTC_PKCS #1 v2.0 padding */
-#define rsa_encrypt_key(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash_idx, _key) \
-  rsa_encrypt_key_ex(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash_idx, LTC_LTC_PKCS_1_OAEP, _key)
+#define rsa_encrypt_key(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash, _key) \
+  rsa_encrypt_key_ex(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash, LTC_LTC_PKCS_1_OAEP, _key)
 
-#define rsa_decrypt_key(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash_idx, _stat, _key) \
-  rsa_decrypt_key_ex(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash_idx, LTC_LTC_PKCS_1_OAEP, _stat, _key)
+#define rsa_decrypt_key(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash, _stat, _key) \
+  rsa_decrypt_key_ex(_in, _inlen, _out, _outlen, _lparam, _lparamlen, _hash, LTC_LTC_PKCS_1_OAEP, _stat, _key)
 
-#define rsa_sign_hash(_in, _inlen, _out, _outlen, _hash_idx, _saltlen, _key) \
-  rsa_sign_hash_ex(_in, _inlen, _out, _outlen, LTC_LTC_PKCS_1_PSS, _hash_idx, _saltlen, _key)
+#define rsa_sign_hash(_in, _inlen, _out, _outlen, _hash, _saltlen, _key) \
+  rsa_sign_hash_ex(_in, _inlen, _out, _outlen, LTC_LTC_PKCS_1_PSS, _hash, _saltlen, _key)
 
-#define rsa_verify_hash(_sig, _siglen, _hash, _hashlen, _hash_idx, _saltlen, _stat, _key) \
-  rsa_verify_hash_ex(_sig, _siglen, _hash, _hashlen, LTC_LTC_PKCS_1_PSS, _hash_idx, _saltlen, _stat, _key)
+#define rsa_verify_hash(_sig, _siglen, _hash, _hashlen, _hash_algo, _saltlen, _stat, _key) \
+  rsa_verify_hash_ex(_sig, _siglen, _hash, _hashlen, LTC_LTC_PKCS_1_PSS, _hash_algo, _saltlen, _stat, _key)
 
 /* These can be switched between LTC_PKCS #1 v2.x and LTC_PKCS #1 v1.5 paddings */
 int rsa_encrypt_key_ex(const unsigned char *in,     unsigned long inlen,
                              unsigned char *out,    unsigned long *outlen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                       int hash_idx, int padding, rsa_key *key);
+                       const struct algo_properties_st *hash, int padding, rsa_key *key);
 
 int rsa_decrypt_key_ex(const unsigned char *in,       unsigned long  inlen,
                              unsigned char *out,      unsigned long *outlen,
                        const unsigned char *lparam,   unsigned long  lparamlen,
-                             int            hash_idx, int            padding,
+                       const struct algo_properties_st *hash, int padding,
                              int           *stat,     rsa_key       *key);
 
 int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
                            unsigned char *out,      unsigned long *outlen,
                            int            padding,
-                           int            hash_idx, unsigned long  saltlen,
+                     const struct algo_properties_st *hash, unsigned long saltlen,
                            rsa_key *key);
 
 int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
                        const unsigned char *hash,     unsigned long hashlen,
                              int            padding,
-                             int            hash_idx, unsigned long saltlen,
+                       const struct algo_properties_st *hash_algo, unsigned long saltlen,
                              int           *stat,     rsa_key      *key);
 
 /* LTC_PKCS #1 import/export */
diff --git a/libtomcrypt/headers/tomcrypt_pkcs.h b/libtomcrypt/headers/tomcrypt_pkcs.h
index 8e43942..be0d7f6 100644
--- a/libtomcrypt/headers/tomcrypt_pkcs.h
+++ b/libtomcrypt/headers/tomcrypt_pkcs.h
@@ -3,6 +3,8 @@
 /* ===> LTC_PKCS #1 -- RSA Cryptography <=== */
 #ifdef LTC_PKCS_1
 
+struct algo_properties_st;
+
 enum ltc_pkcs_1_v1_5_blocks
 {
   LTC_LTC_PKCS_1_EMSA   = 1,        /* Block type 1 (LTC_PKCS #1 v1.5 signature padding) */
@@ -16,7 +18,7 @@ enum ltc_pkcs_1_paddings
   LTC_LTC_PKCS_1_PSS    = 3         /* LTC_PKCS #1 v2.1 signature padding */
 };
 
-int pkcs_1_mgf1(      int            hash_idx,
+int pkcs_1_mgf1(const struct algo_properties_st *hash,
                 const unsigned char *seed, unsigned long seedlen,
                       unsigned char *mask, unsigned long masklen);
 
@@ -42,23 +44,23 @@ int pkcs_1_v1_5_decode(const unsigned char *msg,
 /* *** v2.1 padding */
 int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                             unsigned long modulus_bitlen, int  hash_idx,
+                             unsigned long modulus_bitlen, const struct algo_properties_st *hash,
                              unsigned char *out,    unsigned long *outlen);
 
 int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                             unsigned long modulus_bitlen, int hash_idx,
+                             unsigned long modulus_bitlen, const struct algo_properties_st *hash,
                              unsigned char *out,    unsigned long *outlen,
                              int           *res);
 
 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
-                            unsigned long saltlen, int           hash_idx,
+                            unsigned long saltlen, const struct algo_properties_st *hash,
                             unsigned long modulus_bitlen,
                             unsigned char *out,     unsigned long *outlen);
 
 int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
                       const unsigned char *sig,     unsigned long siglen,
-                            unsigned long saltlen,  int           hash_idx,
+                            unsigned long saltlen, const struct algo_properties_st *hash,
                             unsigned long modulus_bitlen, int    *res);
 
 #endif /* LTC_PKCS_1 */
diff --git a/libtomcrypt/pk/pkcs1/pkcs_1_mgf1.c b/libtomcrypt/pk/pkcs1/pkcs_1_mgf1.c
index 01fe231..b09dd11 100644
--- a/libtomcrypt/pk/pkcs1/pkcs_1_mgf1.c
+++ b/libtomcrypt/pk/pkcs1/pkcs_1_mgf1.c
@@ -22,12 +22,12 @@
    Perform LTC_PKCS #1 MGF1 (internal)
    @param seed        The seed for MGF1
    @param seedlen     The length of the seed
-   @param hash_idx    The index of the hash desired
+   @param hash        The desired hash
    @param mask        [out] The destination
    @param masklen     The length of the mask desired
    @return CRYPT_OK if successful
 */
-int pkcs_1_mgf1(int                  hash_idx,
+int pkcs_1_mgf1(const struct algo_properties_st *hash,
                 const unsigned char *seed, unsigned long seedlen,
                       unsigned char *mask, unsigned long masklen)
 {
@@ -40,12 +40,12 @@ int pkcs_1_mgf1(int                  hash_idx,
    LTC_ARGCHK(mask != NULL);
 
    /* ensure valid hash */
-   if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) { 
+   if ((err = hash_is_valid(hash)) != CRYPT_OK) {
       return err;
    }
 
    /* get hash output size */
-   hLen = _ncr_algo_digest_size(hash_idx);
+   hLen = hash->digest_size;
 
    /* allocate memory */
    buf = XMALLOC(hLen);
@@ -61,7 +61,7 @@ int pkcs_1_mgf1(int                  hash_idx,
        STORE32H(counter, buf);
        ++counter;
 
-       err = hash_memory_multi(hash_idx, buf, &hLen, seed, seedlen, buf, (unsigned long) 4, NULL, 0);
+       err = hash_memory_multi(hash, buf, &hLen, seed, seedlen, buf, (unsigned long) 4, NULL, 0);
        if (err != CRYPT_OK) {
           goto LBL_ERR;
        }
diff --git a/libtomcrypt/pk/pkcs1/pkcs_1_oaep_decode.c b/libtomcrypt/pk/pkcs1/pkcs_1_oaep_decode.c
index 4114c56..60f76a0 100644
--- a/libtomcrypt/pk/pkcs1/pkcs_1_oaep_decode.c
+++ b/libtomcrypt/pk/pkcs1/pkcs_1_oaep_decode.c
@@ -25,7 +25,7 @@
    @param lparam           The session or system data (can be NULL)
    @param lparamlen        The length of the lparam
    @param modulus_bitlen   The bit length of the RSA modulus
-   @param hash_idx         The index of the hash desired
+   @param hash             The desired hash
    @param out              [out] Destination of decoding
    @param outlen           [in/out] The max size and resulting size of the decoding
    @param res              [out] Result of decoding, 1==valid, 0==invalid
@@ -33,7 +33,7 @@
 */
 int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                             unsigned long modulus_bitlen, int hash_idx,
+                             unsigned long modulus_bitlen, const struct algo_properties_st *hash,
                              unsigned char *out,    unsigned long *outlen,
                              int           *res)
 {
@@ -50,11 +50,11 @@ int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
    *res = 0;
    
    /* test valid hash */
-   if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) { 
+   if ((err = hash_is_valid(hash)) != CRYPT_OK) {
       return err;
    }
 
-   hLen = _ncr_algo_digest_size(hash_idx);
+   hLen = hash->digest_size;
    modulus_len = (modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0);
 
    /* test hash/message size */
@@ -103,7 +103,7 @@ int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
    x += modulus_len - hLen - 1;
 
    /* compute MGF1 of maskedDB (hLen) */ 
-   if ((err = pkcs_1_mgf1(hash_idx, DB, modulus_len - hLen - 1, mask, hLen)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash, DB, modulus_len - hLen - 1, mask, hLen)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
@@ -113,7 +113,7 @@ int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
    }
 
    /* compute MGF1 of seed (k - hlen - 1) */
-   if ((err = pkcs_1_mgf1(hash_idx, seed, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash, seed, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
@@ -127,12 +127,12 @@ int pkcs_1_oaep_decode(const unsigned char *msg,    unsigned long msglen,
    /* compute lhash and store it in seed [reuse temps!] */
    x = modulus_len;
    if (lparam != NULL) {
-      if ((err = hash_memory(hash_idx, lparam, lparamlen, seed, &x)) != CRYPT_OK) {
+      if ((err = hash_memory(hash, lparam, lparamlen, seed, &x)) != CRYPT_OK) {
          goto LBL_ERR;
       }
    } else {
       /* can't pass hash_memory a NULL so use DB with zero length */
-      if ((err = hash_memory(hash_idx, DB, 0, seed, &x)) != CRYPT_OK) {
+      if ((err = hash_memory(hash, DB, 0, seed, &x)) != CRYPT_OK) {
          goto LBL_ERR;
       }
    }
diff --git a/libtomcrypt/pk/pkcs1/pkcs_1_oaep_encode.c b/libtomcrypt/pk/pkcs1/pkcs_1_oaep_encode.c
index ccee5cf..c56e3b1 100644
--- a/libtomcrypt/pk/pkcs1/pkcs_1_oaep_encode.c
+++ b/libtomcrypt/pk/pkcs1/pkcs_1_oaep_encode.c
@@ -25,14 +25,14 @@
   @param lparam          A session or system parameter (can be NULL)
   @param lparamlen       The length of the lparam data
   @param modulus_bitlen  The bit length of the RSA modulus
-  @param hash_idx        The index of the hash desired
+  @param hash            The desired hash
   @param out             [out] The destination for the encoded data
   @param outlen          [in/out] The max size and resulting size of the encoded data
   @return CRYPT_OK if successful
 */
 int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                             unsigned long modulus_bitlen, int  hash_idx,
+                             unsigned long modulus_bitlen, const struct algo_properties_st *hash,
                              unsigned char *out,    unsigned long *outlen)
 {
    unsigned char *DB, *seed, *mask;
@@ -44,11 +44,11 @@ int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
    LTC_ARGCHK(outlen != NULL);
 
    /* test valid hash */
-   if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) { 
+   if ((err = hash_is_valid(hash)) != CRYPT_OK) {
       return err;
    }
 
-   hLen = _ncr_algo_digest_size(hash_idx);
+   hLen = hash->digest_size;
    modulus_len = (modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0);
 
    /* test message size */
@@ -77,12 +77,12 @@ int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
    /* DB == lhash || PS || 0x01 || M, PS == k - mlen - 2hlen - 2 zeroes */
    x = modulus_len;
    if (lparam != NULL) {
-      if ((err = hash_memory(hash_idx, lparam, lparamlen, DB, &x)) != CRYPT_OK) {
+      if ((err = hash_memory(hash, lparam, lparamlen, DB, &x)) != CRYPT_OK) {
          goto LBL_ERR;
       }
    } else {
       /* can't pass hash_memory a NULL so use DB with zero length */
-      if ((err = hash_memory(hash_idx, DB, 0, DB, &x)) != CRYPT_OK) {
+      if ((err = hash_memory(hash, DB, 0, DB, &x)) != CRYPT_OK) {
          goto LBL_ERR;
       }
    }
@@ -104,7 +104,7 @@ int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
    get_random_bytes(seed, hLen);
 
    /* compute MGF1 of seed (k - hlen - 1) */
-   if ((err = pkcs_1_mgf1(hash_idx, seed, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash, seed, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
@@ -114,7 +114,7 @@ int pkcs_1_oaep_encode(const unsigned char *msg,    unsigned long msglen,
    }
 
    /* compute MGF1 of maskedDB (hLen) */ 
-   if ((err = pkcs_1_mgf1(hash_idx, DB, modulus_len - hLen - 1, mask, hLen)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash, DB, modulus_len - hLen - 1, mask, hLen)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
diff --git a/libtomcrypt/pk/pkcs1/pkcs_1_pss_decode.c b/libtomcrypt/pk/pkcs1/pkcs_1_pss_decode.c
index 5a26654..293d84f 100644
--- a/libtomcrypt/pk/pkcs1/pkcs_1_pss_decode.c
+++ b/libtomcrypt/pk/pkcs1/pkcs_1_pss_decode.c
@@ -25,14 +25,14 @@
    @param  sig             The signature data (encoded data)
    @param  siglen          The length of the signature data (octets)
    @param  saltlen         The length of the salt used (octets)
-   @param  hash_idx        The index of the hash desired
+   @param  hash_algo       The desired hash
    @param  modulus_bitlen  The bit length of the RSA modulus
    @param  res             [out] The result of the comparison, 1==valid, 0==invalid
    @return CRYPT_OK if successful (even if the comparison failed)
 */
 int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
                       const unsigned char *sig,     unsigned long siglen,
-                            unsigned long saltlen,  int           hash_idx,
+                            unsigned long saltlen, const struct algo_properties_st *hash_algo,
                             unsigned long modulus_bitlen, int    *res)
 {
    unsigned char *DB, *mask, *salt, *hash;
@@ -46,11 +46,11 @@ int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
    *res = 0;
 
    /* ensure hash is valid */
-   if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+   if ((err = hash_is_valid(hash_algo)) != CRYPT_OK) {
       return err;
    }
 
-   hLen = _ncr_algo_digest_size(hash_idx);
+   hLen = hash_algo->digest_size;
    modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
 
    /* check sizes */
@@ -102,7 +102,7 @@ int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
    }
 
    /* generate mask of length modulus_len - hLen - 1 from hash */
-   if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash_algo, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
@@ -131,7 +131,7 @@ int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
    }
 
    /* M = (eight) 0x00 || msghash || salt, mask = H(M) */
-   err = hash_memory_multi(hash_idx, mask, &hLen, mask, 8, msghash, (unsigned long)msghashlen, DB+x, (unsigned long)saltlen, NULL, 0);
+   err = hash_memory_multi(hash_algo, mask, &hLen, mask, 8, msghash, (unsigned long)msghashlen, DB+x, (unsigned long)saltlen, NULL, 0);
    if (err != CRYPT_OK) {
       goto LBL_ERR;
    }
diff --git a/libtomcrypt/pk/pkcs1/pkcs_1_pss_encode.c b/libtomcrypt/pk/pkcs1/pkcs_1_pss_encode.c
index 382820d..d747b49 100644
--- a/libtomcrypt/pk/pkcs1/pkcs_1_pss_encode.c
+++ b/libtomcrypt/pk/pkcs1/pkcs_1_pss_encode.c
@@ -23,14 +23,14 @@
    @param msghash          The hash to encode
    @param msghashlen       The length of the hash (octets)
    @param saltlen          The length of the salt desired (octets)
-   @param hash_idx         The index of the hash desired
+   @param hash_algo        The desired hash
    @param modulus_bitlen   The bit length of the RSA modulus
    @param out              [out] The destination of the encoding
    @param outlen           [in/out] The max size and resulting size of the encoded data
    @return CRYPT_OK if successful
 */
 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
-                            unsigned long saltlen,  int           hash_idx,
+                            unsigned long saltlen, const struct algo_properties_st *hash_algo,
                             unsigned long modulus_bitlen,
                             unsigned char *out,     unsigned long *outlen)
 {
@@ -43,11 +43,11 @@ int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
    LTC_ARGCHK(outlen  != NULL);
 
    /* ensure hash and PRNG are valid */
-   if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+   if ((err = hash_is_valid(hash_algo)) != CRYPT_OK) {
       return err;
    }
 
-   hLen = _ncr_algo_digest_size(hash_idx);
+   hLen = hash_algo->digest_size;
    modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
 
    /* check sizes */
@@ -83,7 +83,7 @@ int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
    }
 
    /* M = (eight) 0x00 || msghash || salt, hash = H(M) */
-   err = hash_memory_multi(hash_idx, hash, &hLen, DB, 8, msghash, (unsigned long)msghashlen, salt, (unsigned long)saltlen, NULL, 0);
+   err = hash_memory_multi(hash_algo, hash, &hLen, DB, 8, msghash, (unsigned long)msghashlen, salt, (unsigned long)saltlen, NULL, 0);
    if (err != CRYPT_OK) {
       goto LBL_ERR;
    }
@@ -97,7 +97,7 @@ int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
    x += saltlen;
 
    /* generate mask of length modulus_len - hLen - 1 from hash */
-   if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
+   if ((err = pkcs_1_mgf1(hash_algo, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
       goto LBL_ERR;
    }
 
diff --git a/libtomcrypt/pk/rsa/rsa_decrypt_key.c b/libtomcrypt/pk/rsa/rsa_decrypt_key.c
index 52885e8..989c935 100644
--- a/libtomcrypt/pk/rsa/rsa_decrypt_key.c
+++ b/libtomcrypt/pk/rsa/rsa_decrypt_key.c
@@ -9,6 +9,7 @@
  * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
  */
 #include "tomcrypt.h"
+#include "ncr_int.h"
 
 /**
   @file rsa_decrypt_key.c
@@ -25,7 +26,7 @@
    @param outlen      [in/out] The max size and resulting size of the plaintext (octets)
    @param lparam      The system "lparam" value
    @param lparamlen   The length of the lparam value (octets)
-   @param hash_idx    The index of the hash desired
+   @param hash        The desired hash
    @param padding     Type of padding (LTC_LTC_PKCS_1_OAEP or LTC_LTC_PKCS_1_V1_5)
    @param stat        [out] Result of the decryption, 1==valid, 0==invalid
    @param key         The corresponding private RSA key
@@ -34,7 +35,7 @@
 int rsa_decrypt_key_ex(const unsigned char *in,       unsigned long  inlen,
                              unsigned char *out,      unsigned long *outlen,
                        const unsigned char *lparam,   unsigned long  lparamlen,
-                             int            hash_idx, int            padding,
+                       const struct algo_properties_st *hash, int padding,
                              int           *stat,     rsa_key       *key)
 {
   unsigned long modulus_bitlen, modulus_bytelen, x;
@@ -58,7 +59,7 @@ int rsa_decrypt_key_ex(const unsigned char *in,       unsigned long  inlen,
 
   if (padding == LTC_LTC_PKCS_1_OAEP) {
     /* valid hash ? */
-    if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+    if ((err = hash_is_valid(hash)) != CRYPT_OK) {
        return err;
     }
   }
@@ -87,7 +88,7 @@ int rsa_decrypt_key_ex(const unsigned char *in,       unsigned long  inlen,
 
   if (padding == LTC_LTC_PKCS_1_OAEP) {
     /* now OAEP decode the packet */
-    err = pkcs_1_oaep_decode(tmp, x, lparam, lparamlen, modulus_bitlen, hash_idx,
+    err = pkcs_1_oaep_decode(tmp, x, lparam, lparamlen, modulus_bitlen, hash,
                              out, outlen, stat);
   } else {
     /* now LTC_PKCS #1 v1.5 depad the packet */
diff --git a/libtomcrypt/pk/rsa/rsa_encrypt_key.c b/libtomcrypt/pk/rsa/rsa_encrypt_key.c
index d59699c..4ce51a4 100644
--- a/libtomcrypt/pk/rsa/rsa_encrypt_key.c
+++ b/libtomcrypt/pk/rsa/rsa_encrypt_key.c
@@ -9,6 +9,7 @@
  * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
  */
 #include "tomcrypt.h"
+#include "ncr_int.h"
 
 /**
   @file rsa_encrypt_key.c
@@ -25,7 +26,7 @@
     @param outlen      [in/out] The max size and resulting size of the ciphertext
     @param lparam      The system "lparam" for the encryption
     @param lparamlen   The length of lparam (octets)
-    @param hash_idx    The index of the desired hash
+    @param hash        The desired hash
     @param padding     Type of padding (LTC_LTC_PKCS_1_OAEP or LTC_LTC_PKCS_1_V1_5)
     @param key         The RSA key to encrypt to
     @return CRYPT_OK if successful
@@ -33,7 +34,7 @@
 int rsa_encrypt_key_ex(const unsigned char *in,     unsigned long inlen,
                              unsigned char *out,    unsigned long *outlen,
                        const unsigned char *lparam, unsigned long lparamlen,
-                       int hash_idx, int padding, rsa_key *key)
+                       const struct algo_properties_st *hash, int padding, rsa_key *key)
 {
   unsigned long modulus_bitlen, modulus_bytelen, x;
   int           err;
@@ -51,7 +52,7 @@ int rsa_encrypt_key_ex(const unsigned char *in,     unsigned long inlen,
 
   if (padding == LTC_LTC_PKCS_1_OAEP) {
     /* valid hash? */
-    if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+    if ((err = hash_is_valid(hash)) != CRYPT_OK) {
        return err;
     }
   }
@@ -70,8 +71,8 @@ int rsa_encrypt_key_ex(const unsigned char *in,     unsigned long inlen,
     /* OAEP pad the key */
     x = *outlen;
     if ((err = pkcs_1_oaep_encode(in, inlen, lparam,
-                                  lparamlen, modulus_bitlen, hash_idx,
-                                  out, &x)) != CRYPT_OK) {
+                                  lparamlen, modulus_bitlen, hash,
+				  out, &x)) != CRYPT_OK) {
        return err;
     }
   } else {
diff --git a/libtomcrypt/pk/rsa/rsa_sign_hash.c b/libtomcrypt/pk/rsa/rsa_sign_hash.c
index 1298d46..5a32d33 100644
--- a/libtomcrypt/pk/rsa/rsa_sign_hash.c
+++ b/libtomcrypt/pk/rsa/rsa_sign_hash.c
@@ -9,6 +9,7 @@
  * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
  */
 #include "tomcrypt.h"
+#include "ncr_int.h"
 
 /**
   @file rsa_sign_hash.c
@@ -24,7 +25,7 @@
   @param out       [out] The signature
   @param outlen    [in/out] The max size and resulting size of the signature
   @param padding   Type of padding (LTC_LTC_PKCS_1_PSS or LTC_LTC_PKCS_1_V1_5)
-  @param hash_idx  The index of the hash desired
+  @param hash      The desired hash
   @param saltlen   The length of the salt desired (octets)
   @param key       The private RSA key to use
   @return CRYPT_OK if successful
@@ -32,7 +33,7 @@
 int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
                            unsigned char *out,      unsigned long *outlen,
                            int            padding,
-                           int            hash_idx, unsigned long  saltlen,
+                     const struct algo_properties_st *hash, unsigned long saltlen,
                            rsa_key *key)
 {
    unsigned long modulus_bitlen, modulus_bytelen, x, y;
@@ -49,7 +50,7 @@ int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
    }
 
    if (padding == LTC_LTC_PKCS_1_PSS) {
-     if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+     if ((err = hash_is_valid(hash)) != CRYPT_OK) {
         return err;
      }
    }
@@ -68,7 +69,7 @@ int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
     /* PSS pad the key */
     x = *outlen;
     if ((err = pkcs_1_pss_encode(in, inlen, saltlen, 
-                                 hash_idx, modulus_bitlen, out, &x)) != CRYPT_OK) {
+                                 hash, modulus_bitlen, out, &x)) != CRYPT_OK) {
        return err;
     }
   } else {
@@ -78,7 +79,7 @@ int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
     oid_st st;
 
     /* not all hashes have OIDs... so sad */
-    if (hash_get_oid(hash_idx, &st) != CRYPT_OK) {
+    if (hash_get_oid(hash, &st) != CRYPT_OK) {
        return CRYPT_INVALID_ARG;
     }
 
diff --git a/libtomcrypt/pk/rsa/rsa_verify_hash.c b/libtomcrypt/pk/rsa/rsa_verify_hash.c
index 773ea7d..20f852e 100644
--- a/libtomcrypt/pk/rsa/rsa_verify_hash.c
+++ b/libtomcrypt/pk/rsa/rsa_verify_hash.c
@@ -9,6 +9,7 @@
  * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
  */
 #include "tomcrypt.h"
+#include "ncr_int.h"
 
 /**
   @file rsa_verify_hash.c
@@ -24,7 +25,7 @@
   @param hash             The hash of the message that was signed
   @param hashlen          The length of the hash of the message that was signed (octets)
   @param padding          Type of padding (LTC_LTC_PKCS_1_PSS or LTC_LTC_PKCS_1_V1_5)
-  @param hash_idx         The index of the desired hash
+  @param hash_algo        The desired hash
   @param saltlen          The length of the salt used during signature
   @param stat             [out] The result of the signature comparison, 1==valid, 0==invalid
   @param key              The public RSA key corresponding to the key that performed the signature
@@ -33,7 +34,7 @@
 int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
                        const unsigned char *hash,     unsigned long hashlen,
                              int            padding,
-                             int            hash_idx, unsigned long saltlen,
+                       const struct algo_properties_st *hash_algo, unsigned long saltlen,
                              int           *stat,     rsa_key      *key)
 {
   unsigned long modulus_bitlen, modulus_bytelen, x;
@@ -57,7 +58,7 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
 
   if (padding == LTC_LTC_PKCS_1_PSS) {
     /* valid hash ? */
-    if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
+    if ((err = hash_is_valid(hash_algo)) != CRYPT_OK) {
        return err;
     }
   }
@@ -92,7 +93,7 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
 
   if (padding == LTC_LTC_PKCS_1_PSS) {
     /* PSS decode and verify it */
-    err = pkcs_1_pss_decode(hash, hashlen, tmpbuf, x, saltlen, hash_idx, modulus_bitlen, stat);
+    err = pkcs_1_pss_decode(hash, hashlen, tmpbuf, x, saltlen, hash_algo, modulus_bitlen, stat);
   } else {
     /* LTC_PKCS #1 v1.5 decode it */
     unsigned char *out;
@@ -102,7 +103,7 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
     oid_st st;
 
     /* not all hashes have OIDs... so sad */
-    if (hash_get_oid(hash_idx, &st) != CRYPT_OK) {
+    if (hash_get_oid(hash_algo, &st) != CRYPT_OK) {
        err = CRYPT_INVALID_ARG;
        goto bail_2;
     }
diff --git a/ncr-key-storage.c b/ncr-key-storage.c
index 69e1c50..90d3f74 100644
--- a/ncr-key-storage.c
+++ b/ncr-key-storage.c
@@ -52,7 +52,7 @@ int key_to_storage_data( uint8_t** sdata, size_t * sdata_size, const struct key_
 
 	pkey->type = key->type;
 	pkey->flags = key->flags;
-	pkey->algorithm = key->algorithm;
+	pkey->algorithm = key->algorithm->algo;
 	pkey->key_id_size = key->key_id_size;
 	memcpy(pkey->key_id, key->key_id, key->key_id_size);
 
@@ -95,7 +95,11 @@ int key_from_storage_data(struct key_item_st* key, const void* data, size_t data
 	key->type = pkey->type;
 	key->flags = pkey->flags;
 
-	key->algorithm = pkey->algorithm;
+	key->algorithm = _ncr_algo_to_properties(pkey->algorithm);
+	if (key->algorithm == NULL) {
+		err();
+		return -EINVAL;
+	}
 	key->key_id_size = pkey->key_id_size;
 	memcpy(key->key_id, pkey->key_id, pkey->key_id_size);
 
diff --git a/ncr-key.c b/ncr-key.c
index 134831e..db5d458 100644
--- a/ncr-key.c
+++ b/ncr-key.c
@@ -337,7 +337,12 @@ int ret;
 	}
 
 	item->type = data.type;
-	item->algorithm = data.algorithm;
+	item->algorithm = _ncr_algo_to_properties(data.algorithm);
+	if (item->algorithm == NULL) {
+		err();
+		ret = -EINVAL;
+		goto fail;
+	}
 	item->flags = data.flags;
 	/* if data cannot be exported then the flags above
 	 * should be overriden */
@@ -414,6 +419,7 @@ int ncr_key_generate(struct list_sem_st* lst, void __user* arg)
 {
 struct ncr_key_generate_st gen;
 struct key_item_st* item = NULL;
+const struct algo_properties_st *algo;
 int ret;
 size_t size;
 
@@ -432,9 +438,15 @@ size_t size;
 
 	/* we generate only secret keys */
 	item->flags = gen.params.keyflags;
-	item->type = ncr_algorithm_to_key_type(gen.params.algorithm);
+	algo = _ncr_algo_to_properties(gen.params.algorithm);
+	if (algo == NULL) {
+		err();
+		return ret;
+	}
+	item->type = algo->key_type;
 	if (item->type == NCR_KEY_TYPE_SECRET) {
-		item->algorithm = /* arbitrary */ NCR_ALG_AES_CBC;
+		/* arbitrary */
+		item->algorithm = _ncr_algo_to_properties(NCR_ALG_AES_CBC);
 
 		size = gen.params.params.secret.bits/8;
 		if ((gen.params.params.secret.bits % 8 != 0) ||
@@ -485,7 +497,7 @@ int ret;
 
 	info.flags = item->flags;
 	info.type = item->type;
-	info.algorithm = item->algorithm;
+	info.algorithm = item->algorithm->algo;
 
 	_ncr_key_item_put( item);
 
@@ -521,13 +533,18 @@ int ret;
 
 	/* we generate only secret keys */
 	private->flags = public->flags = gen.params.keyflags;
-	public->type = ncr_algorithm_to_key_type(gen.params.algorithm);
+	private->algorithm = public->algorithm = _ncr_algo_to_properties(gen.params.algorithm);
+	if (private->algorithm == NULL) {
+		err();
+		ret = -EINVAL;
+		goto fail;
+	}
+	public->type = public->algorithm->key_type;
 	private->type = NCR_KEY_TYPE_PRIVATE;
-	private->algorithm = public->algorithm = gen.params.algorithm;
 	public->flags |= (NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE);
 	
 	if (public->type == NCR_KEY_TYPE_PUBLIC) {
-		ret = ncr_pk_generate(gen.params.algorithm, &gen.params, private, public);
+		ret = ncr_pk_generate(public->algorithm, &gen.params, private, public);
 		if (ret < 0) {
 			err();
 			goto fail;
diff --git a/ncr-pk.c b/ncr-pk.c
index b95256d..bfe575d 100644
--- a/ncr-pk.c
+++ b/ncr-pk.c
@@ -45,7 +45,9 @@ static int tomerr(int err)
 
 void ncr_pk_clear(struct key_item_st* key)
 {
-	switch(key->algorithm) {
+	if (key->algorithm == NULL)
+		return;
+	switch(key->algorithm->algo) {
 		case NCR_ALG_RSA:
 			rsa_free(&key->key.pk.rsa);
 			break;
@@ -71,7 +73,7 @@ static int ncr_pk_make_public_and_id( struct key_item_st * private, struct key_i
 		return -ENOMEM;
 	}
 
-	switch(private->algorithm) {
+	switch(private->algorithm->algo) {
 		case NCR_ALG_RSA:
 			cret = rsa_export(tmp, &max_size, PK_PUBLIC, &private->key.pk.rsa);
 			if (cret != CRYPT_OK) {
@@ -109,7 +111,7 @@ static int ncr_pk_make_public_and_id( struct key_item_st * private, struct key_i
 	}
 
 	key_id_size = MAX_KEY_ID_SIZE;
-	cret = hash_memory(NCR_ALG_SHA1, tmp, max_size, private->key_id, &key_id_size);
+	cret = hash_memory(_ncr_algo_to_properties(NCR_ALG_SHA1), tmp, max_size, private->key_id, &key_id_size);
 	if (cret != CRYPT_OK) {
 		err();
 		ret = tomerr(cret);
@@ -135,7 +137,7 @@ int ncr_pk_pack( const struct key_item_st * key, uint8_t * packed, uint32_t * pa
 		return -EINVAL;
 	}
 
-	switch(key->algorithm) {
+	switch(key->algorithm->algo) {
 		case NCR_ALG_RSA:
 			cret = rsa_export(packed, &max_size, key->key.pk.rsa.type, (void*)&key->key.pk.rsa);
 			if (cret != CRYPT_OK) {
@@ -170,7 +172,7 @@ int ncr_pk_unpack( struct key_item_st * key, const void * packed, size_t packed_
 		return -EINVAL;
 	}
 
-	switch(key->algorithm) {
+	switch(key->algorithm->algo) {
 		case NCR_ALG_RSA:
 			cret = rsa_import(packed, packed_size, (void*)&key->key.pk.rsa);
 			if (cret != CRYPT_OK) {
@@ -197,7 +199,7 @@ struct keygen_st {
 	struct work_struct pk_gen;
 	struct completion completed;
 	int ret;
-	ncr_algorithm_t algo;
+	const struct algo_properties_st *algo;
 	struct key_item_st* private;
 	struct key_item_st* public;
 	struct ncr_key_generate_params_st * params;
@@ -210,7 +212,7 @@ static void keygen_handler(struct work_struct *instance)
 	struct keygen_st *st =
 	    container_of(instance, struct keygen_st, pk_gen);
 
-	switch(st->algo) {
+	switch(st->algo->algo) {
 		case NCR_ALG_RSA:
 			e = st->params->params.rsa.e;
 			
@@ -246,7 +248,7 @@ static void keygen_handler(struct work_struct *instance)
 }
 
 
-int ncr_pk_generate(ncr_algorithm_t algo,
+int ncr_pk_generate(const struct algo_properties_st *algo,
 	struct ncr_key_generate_params_st * params,
 	struct key_item_st* private, struct key_item_st* public) 
 {
@@ -303,16 +305,21 @@ void ncr_pk_queue_deinit(void)
 	destroy_workqueue(pk_wq);
 }
 
-int ncr_key_params_get_sign_hash(ncr_algorithm_t algo, struct ncr_key_params_st * params)
+const struct algo_properties_st *ncr_key_params_get_sign_hash(const struct algo_properties_st *algo, struct ncr_key_params_st * params)
 {
-	switch(algo) {
+	ncr_algorithm_t id;
+
+	switch(algo->algo) {
 		case NCR_ALG_RSA:
-			return params->params.rsa.sign_hash;
+			id = params->params.rsa.sign_hash;
+			break;
 		case NCR_ALG_DSA:
-			return params->params.dsa.sign_hash;
+			id = params->params.dsa.sign_hash;
+			break;
 		default:
-			return -EINVAL;
+			return ERR_PTR(-EINVAL);
 	}
+	return _ncr_algo_to_properties(id);
 }
 
 /* Encryption/Decryption
@@ -326,12 +333,10 @@ void ncr_pk_cipher_deinit(struct ncr_pk_ctx* ctx)
 	}
 }
 
-int ncr_pk_cipher_init(ncr_algorithm_t algo, 
+int ncr_pk_cipher_init(const struct algo_properties_st *algo,
 	struct ncr_pk_ctx* ctx, struct ncr_key_params_st* params,
-	struct key_item_st *key)
+	struct key_item_st *key, const struct algo_properties_st *sign_hash)
 {
-int ret;
-
 	memset(ctx, 0, sizeof(*ctx));
 	
 	if (key->algorithm != algo) {
@@ -341,23 +346,22 @@ int ret;
 
 	ctx->algorithm = algo;
 	ctx->key = key;
-	ret = ncr_key_params_get_sign_hash(algo, params);
-	if (ret < 0) {
-		err();
-		return ret;
-	}
-	ctx->sign_hash = ret;
+	ctx->sign_hash = sign_hash;
 
-	switch(algo) {
+	switch(algo->algo) {
 		case NCR_ALG_RSA:
 			if (params->params.rsa.type == RSA_PKCS1_V1_5)
 				ctx->type = LTC_LTC_PKCS_1_V1_5;
-			else if (params->params.rsa.type == RSA_PKCS1_OAEP)
+			else if (params->params.rsa.type == RSA_PKCS1_OAEP) {
 				ctx->type = LTC_LTC_PKCS_1_OAEP;
-			else if (params->params.rsa.type == RSA_PKCS1_PSS)
+				ctx->oaep_hash = _ncr_algo_to_properties(params->params.rsa.oaep_hash);
+				if (ctx->oaep_hash == NULL) {
+				  err();
+				  return -EINVAL;
+				}
+			} else if (params->params.rsa.type == RSA_PKCS1_PSS)
 				ctx->type = LTC_LTC_PKCS_1_PSS;
 			
-			ctx->oaep_hash = params->params.rsa.oaep_hash;
 			ctx->salt_len = params->params.rsa.pss_salt;
 			break;
 		case NCR_ALG_DSA:
@@ -379,7 +383,7 @@ int ncr_pk_cipher_encrypt(const struct ncr_pk_ctx* ctx,
 int cret;
 unsigned long osize = *output_size;
 
-	switch(ctx->algorithm) {
+	switch(ctx->algorithm->algo) {
 		case NCR_ALG_RSA:
 			cret = rsa_encrypt_key_ex( input, input_size, output, &osize, 
 				NULL, 0, ctx->oaep_hash, ctx->type, &ctx->key->key.pk.rsa);
@@ -409,7 +413,7 @@ int cret;
 unsigned long osize = *output_size;
 int stat;
 
-	switch(ctx->algorithm) {
+	switch(ctx->algorithm->algo) {
 		case NCR_ALG_RSA:
 			cret = rsa_decrypt_key_ex( input, input_size, output, &osize, 
 				NULL, 0, ctx->oaep_hash, ctx->type, &stat, &ctx->key->key.pk.rsa);
@@ -443,8 +447,12 @@ int ncr_pk_cipher_sign(const struct ncr_pk_ctx* ctx,
 int cret;
 unsigned long osize = *output_size;
 
-	switch(ctx->algorithm) {
+	switch(ctx->algorithm->algo) {
 		case NCR_ALG_RSA:
+			if (ctx->sign_hash == NULL) {
+				err();
+				return -EINVAL;
+			}
 			cret = rsa_sign_hash_ex( input, input_size, output, &osize, 
 				ctx->type, ctx->sign_hash, ctx->salt_len, &ctx->key->key.pk.rsa);
 
@@ -479,8 +487,12 @@ int ncr_pk_cipher_verify(const struct ncr_pk_ctx* ctx,
 int cret;
 int stat;
 
-	switch(ctx->algorithm) {
+	switch(ctx->algorithm->algo) {
 		case NCR_ALG_RSA:
+			if (ctx->sign_hash == NULL) {
+				err();
+				return -EINVAL;
+			}
 			cret = rsa_verify_hash_ex( signature, signature_size, 
 				hash, hash_size, ctx->type, ctx->sign_hash,
 				ctx->salt_len, &stat, &ctx->key->key.pk.rsa);
diff --git a/ncr-pk.h b/ncr-pk.h
index 1180017..873ee83 100644
--- a/ncr-pk.h
+++ b/ncr-pk.h
@@ -4,11 +4,11 @@
 #include <tomcrypt.h>
 
 struct ncr_pk_ctx {
-	ncr_algorithm_t algorithm; /* algorithm */
+	const struct algo_properties_st *algorithm; /* algorithm */
 	
-	ncr_algorithm_t sign_hash; /* for verification */
+	const struct algo_properties_st *sign_hash; /* for verification */
 	
-	ncr_algorithm_t oaep_hash;
+	const struct algo_properties_st *oaep_hash;
 	int salt_len; /* for RSA-PSS signatures */
 	
 	int type; /* libtomcrypt type */
@@ -19,7 +19,7 @@ struct ncr_pk_ctx {
 
 /* PK */
 void ncr_pk_clear(struct key_item_st* key);
-int ncr_pk_generate(ncr_algorithm_t algo,
+int ncr_pk_generate(const struct algo_properties_st *algo,
 	struct ncr_key_generate_params_st * params,
 	struct key_item_st* private, struct key_item_st* public);
 int ncr_pk_pack( const struct key_item_st * key, uint8_t * packed, uint32_t * packed_size);
@@ -30,9 +30,9 @@ int ncr_pk_queue_init(void);
 void ncr_pk_queue_deinit(void);
 
 /* encryption/decryption */
-int ncr_pk_cipher_init(ncr_algorithm_t algo, 
+int ncr_pk_cipher_init(const struct algo_properties_st *algo,
 	struct ncr_pk_ctx* ctx, struct ncr_key_params_st* params,
-	struct key_item_st *key);
+	struct key_item_st *key, const struct algo_properties_st *sign_hash);
 void ncr_pk_cipher_deinit(struct ncr_pk_ctx* ctx);
 int ncr_pk_cipher_encrypt(const struct ncr_pk_ctx* ctx, const void* input, 
 	size_t input_size, void* output, size_t *output_size);
diff --git a/ncr-sessions.c b/ncr-sessions.c
index 6856310..f768cb3 100644
--- a/ncr-sessions.c
+++ b/ncr-sessions.c
@@ -112,186 +112,96 @@ struct session_item_st* ncr_session_new(struct list_sem_st* lst)
 	return sess;
 }
 
-static const struct algo_properties_st {
-	ncr_algorithm_t algo;
-	const char* kstr;
-	unsigned needs_iv:1;
-	unsigned hmac:1;
-	unsigned can_sign:1;
-	unsigned can_digest:1;
-	unsigned can_encrypt:1;
-	unsigned symmetric:1;
-	int digest_size;
-} algo_properties[] = {
+static const struct algo_properties_st algo_properties[] = {
 	{ .algo = NCR_ALG_NULL, .kstr = "ecb(cipher_null)", 
-		.needs_iv = 0, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 0, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_3DES_CBC, .kstr = "cbc(des3_ede)", 
-		.needs_iv = 1, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 1, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_AES_CBC, .kstr = "cbc(aes)", 
-		.needs_iv = 1, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 1, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_CAMELLIA_CBC, .kstr = "cbc(camelia)", 
-		.needs_iv = 1, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 1, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_AES_CTR, .kstr = "ctr(aes)", 
-		.needs_iv = 1, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 1, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_CAMELLIA_CTR, .kstr = "ctr(camelia)", 
-		.needs_iv = 1, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 1, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_ARCFOUR, .kstr = NULL, 
-		.needs_iv = 0, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 0, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_AES_ECB, .kstr = "ecb(aes)", 
-		.needs_iv = 0, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 0, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_CAMELLIA_ECB, .kstr = "ecb(camelia)", 
-		.needs_iv = 0, .symmetric=1, .can_encrypt=1 },
+		.needs_iv = 0, .is_symmetric=1, .can_encrypt=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_SHA1, .kstr = "sha1", 
-		.digest_size = 20, .can_digest=1 },
+		.digest_size = 20, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_MD5, .kstr = "md5", 
-		.digest_size = 16, .can_digest=1 },
+		.digest_size = 16, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_SHA2_224, .kstr = "sha224", 
-		.digest_size = 28, .can_digest=1 },
+		.digest_size = 28, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_SHA2_256, .kstr = "sha256", 
-		.digest_size = 32, .can_digest=1 },
+		.digest_size = 32, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_SHA2_384, .kstr = "sha384", 
-		.digest_size = 48, .can_digest=1 },
+		.digest_size = 48, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
 	{ .algo = NCR_ALG_SHA2_512, .kstr = "sha512", 
-		.digest_size = 64, .can_digest=1 },
-	{ .algo = NCR_ALG_HMAC_SHA1, .hmac = 1, .kstr = "hmac(sha1)", 
-		.digest_size = 20, .can_sign=1 },
-	{ .algo = NCR_ALG_HMAC_MD5, .hmac = 1, .kstr = "hmac(md5)", 
-		.digest_size = 16, .can_sign=1 },
-	{ .algo = NCR_ALG_HMAC_SHA2_224, .hmac = 1, .kstr = "hmac(sha224)", 
-		.digest_size = 28, .can_sign=1 },
-	{ .algo = NCR_ALG_HMAC_SHA2_256, .hmac = 1, .kstr = "hmac(sha256)", 
-		.digest_size = 32, .can_sign=1 },
-	{ .algo = NCR_ALG_HMAC_SHA2_384, .hmac = 1, .kstr = "hmac(sha384)", 
-		.digest_size = 48, .can_sign=1 },
-	{ .algo = NCR_ALG_HMAC_SHA2_512, .hmac = 1, .kstr = "hmac(sha512)", 
-		.digest_size = 64, .can_sign=1 },
+		.digest_size = 64, .can_digest=1,
+		.key_type = NCR_KEY_TYPE_INVALID },
+	{ .algo = NCR_ALG_HMAC_SHA1, .is_hmac = 1, .kstr = "hmac(sha1)", 
+		.digest_size = 20, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
+	{ .algo = NCR_ALG_HMAC_MD5, .is_hmac = 1, .kstr = "hmac(md5)", 
+		.digest_size = 16, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
+	{ .algo = NCR_ALG_HMAC_SHA2_224, .is_hmac = 1, .kstr = "hmac(sha224)", 
+		.digest_size = 28, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
+	{ .algo = NCR_ALG_HMAC_SHA2_256, .is_hmac = 1, .kstr = "hmac(sha256)", 
+		.digest_size = 32, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
+	{ .algo = NCR_ALG_HMAC_SHA2_384, .is_hmac = 1, .kstr = "hmac(sha384)", 
+		.digest_size = 48, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
+	{ .algo = NCR_ALG_HMAC_SHA2_512, .is_hmac = 1, .kstr = "hmac(sha512)", 
+		.digest_size = 64, .can_sign=1,
+		.key_type = NCR_KEY_TYPE_SECRET },
 	{ .algo = NCR_ALG_RSA, .kstr = NULL, 
-		.can_encrypt=1, .can_sign=1},
+		.can_encrypt=1, .can_sign=1, .key_type = NCR_KEY_TYPE_PUBLIC },
 	{ .algo = NCR_ALG_DSA, .kstr = NULL, 
-		.can_sign=1 },
+		.can_sign=1, .key_type = NCR_KEY_TYPE_PUBLIC },
 	{ .algo = NCR_ALG_NONE }
 
 };
 
-const char* _ncr_algo_to_str(ncr_algorithm_t algo)
+const struct algo_properties_st *_ncr_algo_to_properties(ncr_algorithm_t algo)
 {
-ncr_algorithm_t a;
-int i = 0;
+	ncr_algorithm_t a;
+	int i = 0;
 
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
+	for (i = 0; (a = algo_properties[i].algo) != NCR_ALG_NONE; i++) {
 		if (a == algo)
-			return algo_properties[i].kstr;
-		i++;
+			return &algo_properties[i];
 	}
 
 	return NULL;
 }
 
-static int algo_needs_iv(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].needs_iv;
-		i++;
-	}
-
-	return 0;
-}
-
-static int algo_can_sign(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].can_sign;
-		i++;
-	}
-
-	return 0;
-}
-
-static int algo_can_encrypt(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].can_encrypt;
-		i++;
-	}
-
-	return 0;
-}
-
-static int algo_can_digest(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].can_digest;
-		i++;
-	}
-
-	return 0;
-}
-
-
-static int algo_is_hmac(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].hmac;
-		i++;
-	}
-
-	return 0;
-}
-
-static int algo_is_symmetric(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].symmetric;
-		i++;
-	}
-
-	return 0;
-}
-
-int _ncr_algo_digest_size(ncr_algorithm_t algo)
-{
-ncr_algorithm_t a;
-int i = 0;
-
-	while((a=algo_properties[i].algo)!=NCR_ALG_NONE) {
-		if (a == algo)
-			return algo_properties[i].digest_size;
-		i++;
-	}
-
-	return 0;
-}
-
 static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* session)
 {
 	struct session_item_st* ns = NULL;
 	int ret;
-	ncr_algorithm_t sign_hash;
-	const char* str = NULL;
+	const struct algo_properties_st *sign_hash;
 
 	ns = ncr_session_new(&lists->sessions);
 	if (ns == NULL) {
@@ -300,11 +210,16 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 	}
 
 	ns->op = session->op;
-	ns->algorithm = session->algorithm;
+	ns->algorithm = _ncr_algo_to_properties(session->algorithm);
+	if (ns->algorithm == NULL) {
+		err();
+		ret = -EINVAL;
+		goto fail;
+	}
 	switch(session->op) {
 		case NCR_OP_ENCRYPT:
 		case NCR_OP_DECRYPT:
-			if (algo_can_encrypt(session->algorithm)==0) {
+			if (!ns->algorithm->can_encrypt) {
 				err();
 				ret = -EINVAL;
 				goto fail;
@@ -322,20 +237,19 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 				if (session->algorithm == NCR_ALG_NULL)
 				  keysize = 0;
 				
-				str = _ncr_algo_to_str(session->algorithm);
-				if (str == NULL) {
+				if (ns->algorithm->kstr == NULL) {
 					err();
 					return -EINVAL;
 				}
 
-				ret = cryptodev_cipher_init(&ns->cipher, str, 
+				ret = cryptodev_cipher_init(&ns->cipher, ns->algorithm->kstr,
 					ns->key->key.secret.data, keysize);
 				if (ret < 0) {
 					err();
 					goto fail;
 				}
 
-				if (algo_needs_iv(session->algorithm)) {
+				if (ns->algorithm->needs_iv) {
 					if (session->params.params.cipher.iv_size > sizeof(session->params.params.cipher.iv)) {
 						err();
 						ret = -EINVAL;
@@ -345,7 +259,7 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 				}
 			} else if (ns->key->type == NCR_KEY_TYPE_PRIVATE || ns->key->type == NCR_KEY_TYPE_PUBLIC) {
 				ret = ncr_pk_cipher_init(ns->algorithm, &ns->pk, 
-					&session->params, ns->key);
+					&session->params, ns->key, NULL);
 				if (ret < 0) {
 					err();
 					goto fail;
@@ -359,7 +273,7 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 
 		case NCR_OP_SIGN:
 		case NCR_OP_VERIFY:
-			if (algo_can_sign(session->algorithm)==0) {
+			if (!ns->algorithm->can_sign) {
 				err();
 				ret = -EINVAL;
 				goto fail;
@@ -373,13 +287,12 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 			}
 
 			if (ns->key->type == NCR_KEY_TYPE_SECRET) {
-				str = _ncr_algo_to_str(session->algorithm);
-				if (str == NULL) {
+				if (ns->algorithm->kstr == NULL) {
 					err();
 					return -EINVAL;
 				}
 
-				ret = cryptodev_hash_init(&ns->hash, str, 1, 
+				ret = cryptodev_hash_init(&ns->hash, ns->algorithm->kstr, 1,
 					ns->key->key.secret.data, ns->key->key.secret.size);
 				if (ret < 0) {
 					err();
@@ -387,33 +300,31 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 				}
 
 			} else if (ns->key->type == NCR_KEY_TYPE_PRIVATE || ns->key->type == NCR_KEY_TYPE_PUBLIC) {
-				ret = ncr_key_params_get_sign_hash(ns->key->algorithm, &session->params);
-				if (ret < 0) {
+				sign_hash = ncr_key_params_get_sign_hash(ns->key->algorithm, &session->params);
+				if (IS_ERR(sign_hash)) {
 					err();
-					return ret;
+					return PTR_ERR(sign_hash);
 				}
-				sign_hash = ret;
 
-				if (algo_can_digest(sign_hash) == 0) {
+				if (!sign_hash->can_digest) {
 					err();
 					ret = -EINVAL;
 					goto fail;
 				}
-				str = _ncr_algo_to_str(sign_hash);
-				if (str == NULL) {
+				if (sign_hash->kstr == NULL) {
 					err();
 					ret = -EINVAL;
 					goto fail;
 				}
 
 				ret = ncr_pk_cipher_init(ns->algorithm, &ns->pk, 
-					&session->params, ns->key);
+					&session->params, ns->key, sign_hash);
 				if (ret < 0) {
 					err();
 					goto fail;
 				}
 
-				ret = cryptodev_hash_init(&ns->hash, str, 0, NULL, 0);
+				ret = cryptodev_hash_init(&ns->hash, sign_hash->kstr, 0, NULL, 0);
 				if (ret < 0) {
 					err();
 					goto fail;
@@ -426,19 +337,18 @@ static int _ncr_session_init(struct ncr_lists* lists, struct ncr_session_st* ses
 
 			break;
 		case NCR_OP_DIGEST:
-			if (algo_can_digest(session->algorithm)==0) {
+			if (!ns->algorithm->can_digest) {
 				err();
 				ret = -EINVAL;
 				goto fail;
 			}
-			str = _ncr_algo_to_str(session->algorithm);
-			if (str == NULL) {
+			if (ns->algorithm->kstr == NULL) {
 				err();
 				ret = -EINVAL;
 				goto fail;
 			}
 
-			ret = cryptodev_hash_init(&ns->hash, str, 0, NULL, 0);
+			ret = cryptodev_hash_init(&ns->hash, ns->algorithm->kstr, 0, NULL, 0);
 			if (ret < 0) {
 				err();
 				goto fail;
@@ -525,7 +435,7 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
 				goto fail;
 			}
 			
-			if (algo_is_symmetric(sess->algorithm)) {
+			if (sess->algorithm->is_symmetric) {
 				/* read key */
 				ret = _cryptodev_cipher_encrypt(&sess->cipher, data->data, 
 					data->data_size, odata->data, data->data_size);
@@ -571,7 +481,7 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
 			}
 			
 			/* read key */
-			if (algo_is_symmetric(sess->algorithm)) {
+			if (sess->algorithm->is_symmetric) {
 				ret = _cryptodev_cipher_decrypt(&sess->cipher, data->data, data->data_size, odata->data, data->data_size);
 				if (ret < 0) {
 					err();
@@ -728,7 +638,7 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
 			}
 			
 
-			if (algo_is_hmac(sess->algorithm)) {
+			if (sess->algorithm->is_hmac) {
 				if (digest_size != odata->data_size ||
 					memcmp(odata->data, digest, digest_size) != 0) {
 						
@@ -773,7 +683,7 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
 			
 			cryptodev_hash_deinit(&sess->hash);
 
-			if (sess->op != NCR_OP_DIGEST && !algo_is_hmac(sess->algorithm)) {
+			if (sess->op != NCR_OP_DIGEST && !sess->algorithm->is_hmac) {
 				/* PK signature */
 				size_t new_size = odata->max_data_size;
 				ret = ncr_pk_cipher_sign(&sess->pk, odata->data, odata->data_size,
@@ -796,7 +706,7 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
 fail:
 	if (odata) _ncr_data_item_put(odata);
 	cryptodev_hash_deinit(&sess->hash);
-	if (algo_is_symmetric(sess->algorithm)) {
+	if (sess->algorithm->is_symmetric) {
 		cryptodev_cipher_deinit(&sess->cipher);
 	} else {
 		ncr_pk_cipher_deinit(&sess->pk);
diff --git a/ncr.c b/ncr.c
index 5740580..7014a30 100644
--- a/ncr.c
+++ b/ncr.c
@@ -173,31 +173,3 @@ ncr_ioctl(struct ncr_lists* lst, struct file *filp,
 			return -EINVAL;
 	}
 }
-
-/* Returns NCR_KEY_TYPE_SECRET if a secret key algorithm or MAC is given,
- * and NCR_KEY_TYPE_PUBLIC if a public key algorithm is given.
- */
-ncr_key_type_t ncr_algorithm_to_key_type(ncr_algorithm_t algo)
-{
-	switch(algo) {
-		case NCR_ALG_3DES_CBC:
-		case NCR_ALG_AES_CBC:
-		case NCR_ALG_CAMELLIA_CBC:
-		case NCR_ALG_ARCFOUR:
-		case NCR_ALG_HMAC_SHA1:
-		case NCR_ALG_HMAC_MD5:
-		case NCR_ALG_HMAC_SHA2_224:
-		case NCR_ALG_HMAC_SHA2_256:
-		case NCR_ALG_HMAC_SHA2_384:
-		case NCR_ALG_HMAC_SHA2_512:
-			return NCR_KEY_TYPE_SECRET;
-		case NCR_ALG_RSA:
-		case NCR_ALG_DSA:
-			return NCR_KEY_TYPE_PUBLIC;
-		default:
-			return NCR_KEY_TYPE_INVALID;
-	}
-	
-}
-
-
diff --git a/ncr_int.h b/ncr_int.h
index 12c053a..506dfa3 100644
--- a/ncr_int.h
+++ b/ncr_int.h
@@ -10,10 +10,26 @@
 
 #define err() printk(KERN_DEBUG"ncr: %s: %s: %d\n", __FILE__, __func__, __LINE__)
 
+struct algo_properties_st {
+	ncr_algorithm_t algo;
+	const char *kstr;
+	unsigned needs_iv:1;
+	unsigned is_hmac:1;
+	unsigned can_sign:1;
+	unsigned can_digest:1;
+	unsigned can_encrypt:1;
+	unsigned is_symmetric:1;
+	int digest_size;
+	/* NCR_KEY_TYPE_SECRET if for a secret key algorithm or MAC,
+	 * NCR_KEY_TYPE_PUBLIC for a public key algorithm.
+	 */
+	ncr_key_type_t key_type;
+};
+
 struct session_item_st {
 	struct list_head list;
 
-	ncr_algorithm_t algorithm;
+	const struct algo_properties_st *algorithm;
 	ncr_crypto_op_t op;
 
 	/* contexts for various options.
@@ -56,7 +72,7 @@ struct key_item_st {
 	 */
 	ncr_key_type_t type;
 	unsigned int flags;
-	ncr_algorithm_t algorithm; /* valid for public/private keys */
+	const struct algo_properties_st *algorithm; /* non-NULL for public/private keys */
 	uint8_t key_id[MAX_KEY_ID_SIZE];
 	size_t key_id_size;
 
@@ -142,8 +158,6 @@ int ncr_limits_add_and_check(uid_t uid, pid_t pid, limits_type_t type);
 void ncr_limits_init(void);
 void ncr_limits_deinit(void);
 
-ncr_key_type_t ncr_algorithm_to_key_type(ncr_algorithm_t algo);
-
 int ncr_key_wrap(struct list_sem_st* keys, struct list_sem_st* data, void __user* arg);
 int ncr_key_unwrap(struct list_sem_st*, struct list_sem_st* data, void __user* arg);
 int ncr_key_storage_wrap(struct list_sem_st* key_lst, struct list_sem_st* data_lst, void __user* arg);
@@ -191,8 +205,7 @@ inline static unsigned int data_flags_to_key(unsigned int data_flags)
 	return flags;
 }
 
-const char* _ncr_algo_to_str(ncr_algorithm_t algo);
-int _ncr_algo_digest_size(ncr_algorithm_t algo);
-int ncr_key_params_get_sign_hash(ncr_algorithm_t algo, struct ncr_key_params_st * params);
+const struct algo_properties_st *_ncr_algo_to_properties(ncr_algorithm_t algo);
+const struct algo_properties_st *ncr_key_params_get_sign_hash(const struct algo_properties_st *algo, struct ncr_key_params_st * params);
 
 #endif