diff --git a/crypto/evp/CMakeLists.txt b/crypto/evp/CMakeLists.txt
index 5f54e3a..6db9752 100644
--- a/crypto/evp/CMakeLists.txt
+++ b/crypto/evp/CMakeLists.txt
@@ -29,10 +29,18 @@
 )
 
 add_executable(
+  evp_test
+
+  evp_test.cc
+  $<TARGET_OBJECTS:test_support>
+)
+
+add_executable(
   pbkdf_test
 
   pbkdf_test.cc
 )
 
 target_link_libraries(evp_extra_test crypto)
+target_link_libraries(evp_test crypto)
 target_link_libraries(pbkdf_test crypto)
diff --git a/crypto/evp/evp_test.cc b/crypto/evp/evp_test.cc
new file mode 100644
index 0000000..239f868
--- /dev/null
+++ b/crypto/evp/evp_test.cc
@@ -0,0 +1,262 @@
+/*
+ * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2015 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <map>
+#include <string>
+#include <vector>
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
+#include "../test/file_test.h"
+#include "../test/scoped_types.h"
+#include "../test/stl_compat.h"
+
+
+// evp_test dispatches between multiple test types. HMAC tests test the legacy
+// EVP_PKEY_HMAC API. PrivateKey tests take a key name parameter and single
+// block, decode it as a PEM private key, and save it under that key name.
+// Decrypt, Sign, and Verify tests take a previously imported key name as
+// parameter and test their respective operations.
+
+static const EVP_MD *GetDigest(FileTest *t, const std::string &name) {
+  if (name == "MD5") {
+    return EVP_md5();
+  } else if (name == "SHA1") {
+    return EVP_sha1();
+  } else if (name == "SHA224") {
+    return EVP_sha224();
+  } else if (name == "SHA256") {
+    return EVP_sha256();
+  } else if (name == "SHA384") {
+    return EVP_sha384();
+  } else if (name == "SHA512") {
+    return EVP_sha512();
+  }
+  t->PrintLine("Unknown digest: '%s'", name.c_str());
+  return nullptr;
+}
+
+using KeyMap = std::map<std::string, EVP_PKEY*>;
+
+// ImportPrivateKey evaluates a PrivateKey test in |t| and writes the resulting
+// private key to |key_map|.
+static bool ImportPrivateKey(FileTest *t, KeyMap *key_map) {
+  const std::string &key_name = t->GetParameter();
+  if (key_map->count(key_name) > 0) {
+    t->PrintLine("Duplicate key '%s'.", key_name.c_str());
+    return false;
+  }
+  const std::string &block = t->GetBlock();
+  ScopedBIO bio(BIO_new_mem_buf(const_cast<char*>(block.data()), block.size()));
+  if (!bio) {
+    return false;
+  }
+  ScopedEVP_PKEY pkey(PEM_read_bio_PrivateKey(bio.get(), nullptr, 0, nullptr));
+  if (!pkey) {
+    t->PrintLine("Error reading private key.");
+    return false;
+  }
+  (*key_map)[key_name] = pkey.release();
+  return true;
+}
+
+static bool TestHMAC(FileTest *t) {
+  std::string digest_str;
+  if (!t->GetAttribute(&digest_str, "HMAC")) {
+    return false;
+  }
+  const EVP_MD *digest = GetDigest(t, digest_str);
+  if (digest == nullptr) {
+    return false;
+  }
+
+  std::vector<uint8_t> key, input, output;
+  if (!t->GetBytes(&key, "Key") ||
+      !t->GetBytes(&input, "Input") ||
+      !t->GetBytes(&output, "Output")) {
+    return false;
+  }
+
+  ScopedEVP_PKEY pkey(EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, nullptr,
+                                           bssl::vector_data(&key),
+                                           key.size()));
+  ScopedEVP_MD_CTX mctx;
+  if (!pkey ||
+      !EVP_DigestSignInit(mctx.get(), nullptr, digest, nullptr, pkey.get()) ||
+      !EVP_DigestSignUpdate(mctx.get(), bssl::vector_data(&input),
+                            input.size())) {
+    return false;
+  }
+
+  size_t len;
+  std::vector<uint8_t> actual;
+  if (!EVP_DigestSignFinal(mctx.get(), nullptr, &len)) {
+    return false;
+  }
+  actual.resize(len);
+  if (!EVP_DigestSignFinal(mctx.get(), bssl::vector_data(&actual), &len)) {
+    return false;
+  }
+  actual.resize(len);
+  return t->ExpectBytesEqual(bssl::vector_data(&output), output.size(),
+                             bssl::vector_data(&actual), actual.size());
+}
+
+static bool TestEVP(FileTest *t, void *arg) {
+  KeyMap *key_map = reinterpret_cast<KeyMap*>(arg);
+  if (t->GetType() == "PrivateKey") {
+    return ImportPrivateKey(t, key_map);
+  } else if (t->GetType() == "HMAC") {
+    return TestHMAC(t);
+  }
+
+  int (*key_op_init)(EVP_PKEY_CTX *ctx);
+  int (*key_op)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len,
+                const uint8_t *in, size_t in_len);
+  if (t->GetType() == "Decrypt") {
+    key_op_init = EVP_PKEY_decrypt_init;
+    key_op = EVP_PKEY_decrypt;
+  } else if (t->GetType() == "Sign") {
+    key_op_init = EVP_PKEY_sign_init;
+    key_op = EVP_PKEY_sign;
+  } else if (t->GetType() == "Verify") {
+    key_op_init = EVP_PKEY_verify_init;
+    key_op = nullptr;  // EVP_PKEY_verify is handled differently.
+  } else {
+    t->PrintLine("Unknown test '%s'", t->GetType().c_str());
+    return false;
+  }
+
+  // Load the key.
+  const std::string &key_name = t->GetParameter();
+  if (key_map->count(key_name) == 0) {
+    t->PrintLine("Could not find key '%s'.", key_name.c_str());
+    return false;
+  }
+  EVP_PKEY *key = (*key_map)[key_name];
+
+  std::vector<uint8_t> input, output;
+  if (!t->GetBytes(&input, "Input") ||
+      !t->GetBytes(&output, "Output")) {
+    return false;
+  }
+
+  // Set up the EVP_PKEY_CTX.
+  ScopedEVP_PKEY_CTX ctx(EVP_PKEY_CTX_new(key, nullptr));
+  if (!ctx || !key_op_init(ctx.get())) {
+    return false;
+  }
+  if (t->HasAttribute("Digest")) {
+    const EVP_MD *digest = GetDigest(t, t->GetAttributeOrDie("Digest"));
+    if (digest == nullptr ||
+        !EVP_PKEY_CTX_set_signature_md(ctx.get(), digest)) {
+      return false;
+    }
+  }
+
+  if (t->GetType() == "Verify") {
+    if (!EVP_PKEY_verify(ctx.get(), bssl::vector_data(&output), output.size(),
+                         bssl::vector_data(&input), input.size())) {
+      // ECDSA sometimes doesn't push an error code. Push one on the error queue
+      // so it's distinguishable from other errors.
+      ERR_put_error(ERR_LIB_USER, 0, ERR_R_EVP_LIB, __FILE__, __LINE__);
+      return false;
+    }
+    return true;
+  }
+
+  size_t len;
+  std::vector<uint8_t> actual;
+  if (!key_op(ctx.get(), nullptr, &len, bssl::vector_data(&input),
+              input.size())) {
+    return false;
+  }
+  actual.resize(len);
+  if (!key_op(ctx.get(), bssl::vector_data(&actual), &len,
+              bssl::vector_data(&input), input.size())) {
+    return false;
+  }
+  actual.resize(len);
+  if (!t->ExpectBytesEqual(bssl::vector_data(&output), output.size(),
+                           bssl::vector_data(&actual), len)) {
+    return false;
+  }
+  return true;
+}
+
+int main(int argc, char **argv) {
+  CRYPTO_library_init();
+  if (argc != 2) {
+    fprintf(stderr, "%s <test file.txt>\n", argv[0]);
+    return 1;
+  }
+
+  KeyMap map;
+  int ret = FileTestMain(TestEVP, &map, argv[1]);
+  // TODO(davidben): When we can rely on a move-aware std::map, make KeyMap a
+  // map of ScopedEVP_PKEY instead.
+  for (const auto &pair : map) {
+    EVP_PKEY_free(pair.second);
+  }
+  return ret;
+}
diff --git a/crypto/evp/evp_tests.txt b/crypto/evp/evp_tests.txt
new file mode 100644
index 0000000..cccfa4f
--- /dev/null
+++ b/crypto/evp/evp_tests.txt
@@ -0,0 +1,174 @@
+# Public key algorithm tests
+
+# Private keys used for PKEY operations.
+
+# RSA 2048 bit key.
+
+PrivateKey = RSA-2048
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDNAIHqeyrh6gbV
+n3xz2f+5SglhXC5Lp8Y2zvCN01M+wxhVJbAVx2m5mnfWclv5w1Mqm25fZifV+4UW
+B2jT3anL01l0URcX3D0wnS/EfuQfl+Mq23+d2GShxHZ6Zm7NcbwarPXnUX9LOFlP
+6psF5C1a2pkSAIAT5FMWpNm7jtCGuI0odYusr5ItRqhotIXSOcm66w4rZFknEPQr
+LR6gpLSALAvsqzKPimiwBzvbVG/uqYCdKEmRKzkMFTK8finHZY+BdfrkbzQzL/h7
+yrPkBkm5hXeGnaDqcYNT8HInVIhpE2SHYNEivmduD8SD3SD/wxvalqMZZsmqLnWt
+A95H4cRPAgMBAAECggEAYCl6x5kbFnoG1rJHWLjL4gi+ubLZ7Jc4vYD5Ci41AF3X
+ziktnim6iFvTFv7x8gkTvArJDWsICLJBTYIQREHYYkozzgIzyPeApIs3Wv8C12cS
+IopwJITbP56+zM+77hcJ26GCgA2Unp5CFuC/81WDiPi9kNo3Oh2CdD7D+90UJ/0W
+glplejFpEuhpU2URfKL4RckJQF/KxV+JX8FdIDhsJu54yemQdQKaF4psHkzwwgDo
+qc+yfp0Vb4bmwq3CKxqEoc1cpbJ5CHXXlAfISzUjlcuBzD/tW7BDtp7eDAcgRVAC
+XO6MX0QBcLYSC7SOD3R7zY9SIRCFDfBDxCjf0YcFMQKBgQD2+WG0fLwDXTrt68fe
+hQqVa2Xs25z2B2QGPxWqSFU8WNly/mZ1BW413f3De/O58vYi7icTNyVoScm+8hdv
+6PfD+LuRujdN1TuvPeyBTSvewQwf3IjN0Wh28mse36PwlBl+301C/x+ylxEDuJjK
+hZxCcocIaoQqtBC7ac8tNa9r4wKBgQDUfnJKf/QQSLJwwlJKQQGHi3MVm7c9PbwY
+eyIOY1s1NPluJDoYTZP4YLa/u2txwe2aHh9FhYMCPDAelqaSwaCLU9DsnKkQEA2A
+RR47fcagG6xK7O+N95iEa8I1oIy7os9MBoBMwRIZ6VYIxxTj8UMNSR+tu6MqV1Gg
+T5d0WDTJpQKBgCHyRSu5uV39AoyRS/eZ8cp36JqV1Q08FtOE+EVfi9evnrPfo9WR
+2YQt7yNfdjCo5IwIj/ZkLhAXlFNakz4el2+oUJ/HKLLaDEoaCNf883q6rh/zABrK
+HcG7sF2d/7qhoJ9/se7zgjfZ68zHIrkzhDbd5xGREnmMJoCcGo3sQyBhAoGAH3UQ
+qmLC2N5KPFMoJ4H0HgLQ6LQCrnhDLkScSBEBYaEUA/AtAYgKjcyTgVLXlyGkcRpg
+esRHHr+WSBD5W+R6ReYEmeKfTJdzyDdzQE9gZjdyjC0DUbsDwybIu3OnIef6VEDq
+IXK7oUZfzDDcsNn4mTDoFaoff5cpqFfgDgM43VkCgYBNHw11b+d+AQmaZS9QqIt7
+aF3FvwCYHV0jdv0Mb+Kc1bY4c0R5MFpzrTwVmdOerjuuA1+9b+0Hwo3nBZM4eaBu
+SOamA2hu2OJWCl9q8fLCT69KqWDjghhvFe7c6aJJGucwaA3Uz3eLcPqoaCarMiNH
+fMkTd7GabVourqIZdgvu1Q==
+-----END PRIVATE KEY-----
+
+# EC P-256 key
+
+PrivateKey = P-256
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiocvtiiTxNH/xbnw
++RdYBp+DUuCPoFpJ+NuSbLVyhyWhRANCAAQsFQ9CnOcPIWwlLPXgYs4fY5zV0WXH
++JQkBywnGX14szuSDpXNtmTpkNzwz+oNlOKo5q+dDlgFbmUxBJJbn+bJ
+-----END PRIVATE KEY-----
+
+# RSA tests
+
+Sign = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+
+# Digest too long
+Sign = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF12345"
+Output =
+Error = INVALID_DIGEST_LENGTH
+
+# Digest too short
+Sign = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF12345"
+Output =
+Error = INVALID_DIGEST_LENGTH
+
+# Mismatched digest
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1233"
+Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+Error = BAD_SIGNATURE
+
+# Corrupted signature
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1233"
+Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ae
+Error = BLOCK_TYPE_IS_NOT_01
+
+# parameter missing (NOTE: this differs from upstream)
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 3ec3fc29eb6e122bd7aa361cd09fe1bcbe85311096a7b9e4799cedfb2351ce0ab7fe4e75b4f6b37f67edd9c60c800f9ab941c0c157d7d880ca9de40c951d60fd293ae220d4bc510b1572d6e85a1bbbd8605b52e05f1c64fafdae59a1c2fbed214b7844d0134619de62851d5a0522e32e556e5950f3f97b8150e3f0dffee612c924201c27cd9bc8b423a71533380c276d3d59fcba35a2e80a1a192ec266a6c2255012cd86a349fe90a542b355fa3355b04da6cdf1df77f0e7bd44a90e880e1760266d233e465226f5db1c68857847d82072861ee266ddfc2e596845b77e1803274a579835ab5e4975d81d20b7df9cec7795489e4a2bdb8c1cf6a6b359945ac92c
+Error = BAD_SIGNATURE
+
+# embedded digest too long
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
+Error = BAD_SIGNATURE
+
+# embedded digest too short
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = afec9a0d5330a08f54283bb4a9d4e7e7e70fc1342336c4c766fba713f66970151c6e27413c48c33864ea45a0238787004f338ed3e21b53b0fe9c1151c42c388cbc7cba5a06b706c407a5b48324fbe994dc7afc3a19fb3d2841e66222596c14cd72a0f0a7455a019d8eb554f59c0183f9552b75aa96fee8bf935945e079ca283d2bd3534a86f11351f6d6181fbf433e5b01a6d1422145c7a72214d3aacdd5d3af12b2d6bf6438f9f9a64010d8aeed801c87f0859412b236150b86a545f7239be022f4a7ad246b59df87514294cb4a4c7c5a997ee53c66054d9f38ca4e76c1f7af83c30f737ef70f83a45aebe18238ddb95e1998814ca4fc72388f1533147c169d
+Error = BAD_SIGNATURE
+
+# Garbage after DigestInfo
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 9ee34872d4271a7d8808af0a4052a145a6d6a8437d00da3ed14428c7f087cd39f4d43334c41af63e7fa1ba363fee7bcef401d9d36a662abbab55ce89a696e1be0dfa19a5d09ca617dd488787b6048baaefeb29bc8688b2fe3882de2b77c905b5a8b56cf9616041e5ec934ba6de863efe93acc4eef783fe7f72a00fa65d6093ed32bf98ce527e62ccb1d56317f4be18b7e0f55d7c36617d2d0678a306e3350956b662ac15df45215dd8f6b314babb9788e6c272fa461e4c9b512a11a4b92bc77c3a4c95c903fccb238794eca5c750477bf56ea6ee6a167367d881b485ae3889e7c489af8fdf38e0c0f2aed780831182e34abedd43c39281b290774bf35cc25274
+Error = BAD_SIGNATURE
+
+# invalid tag for parameter
+Verify = RSA-2048
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 49525db4d44c755e560cba980b1d85ea604b0e077fcadd4ba44072a3487bbddb835016200a7d8739cce2dc3223d9c20cbdd25059ab02277f1f21318efd18e21038ec89aa9d40680987129e8b41ba33bceb86518bdf47268b921cce2037acabca6575d832499538d6f40cdba0d40bd7f4d8ea6ca6e2eec87f294efc971407857f5d7db09f6a7b31e301f571c6d82a5e3d08d2bb3a36e673d28b910f5bec57f0fcc4d968fd7c94d0b9226dec17f5192ad8b42bcab6f26e1bea1fdc3b958199acb00f14ebcb2a352f3afcedd4c09000128a603bbeb9696dea13040445253972d46237a25c7845e3b464e6984c2348ea1f1210a9ff0b00d2d72b50db00c009bb39f9
+Error = BAD_SIGNATURE
+
+# EC tests
+
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+
+# Digest too long
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF12345"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
+
+# Digest too short
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF123"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
+
+# Digest invalid
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF1235"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
+
+# Invalid signature
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec7
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
+
+# Garbage after signature
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec800
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
+
+# BER signature
+Verify = P-256
+Digest = SHA1
+Input = "0123456789ABCDEF1234"
+Output = 3080022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec80000
+# This operation fails without an error code, so ERR_R_EVP_LIB is surfaced.
+Error = public key routines
diff --git a/crypto/hmac/hmac_test.cc b/crypto/hmac/hmac_test.cc
index e512827..d438b70 100644
--- a/crypto/hmac/hmac_test.cc
+++ b/crypto/hmac/hmac_test.cc
@@ -86,7 +86,7 @@
   return nullptr;
 }
 
-static bool TestHMAC(FileTest *t) {
+static bool TestHMAC(FileTest *t, void *arg) {
   std::string digest_str;
   if (!t->GetAttribute(&digest_str, "HMAC")) {
     return false;
@@ -167,5 +167,5 @@
     return 1;
   }
 
-  return FileTestMain(TestHMAC, argv[1]);
+  return FileTestMain(TestHMAC, nullptr, argv[1]);
 }
diff --git a/crypto/hmac/hmac_tests.txt b/crypto/hmac/hmac_tests.txt
index 141b1ed..9caa3c9 100644
--- a/crypto/hmac/hmac_tests.txt
+++ b/crypto/hmac/hmac_tests.txt
@@ -1,3 +1,6 @@
+# This test file is shared between evp_test and hmac_test, to test the legacy
+# EVP_PKEY_HMAC API.
+
 HMAC = MD5
 # Note: The empty key results in passing NULL to HMAC_Init_ex, so this tests
 # that HMAC_CTX and HMAC treat NULL as the empty key initially.
diff --git a/crypto/test/file_test.cc b/crypto/test/file_test.cc
index 907e57b..12405f2 100644
--- a/crypto/test/file_test.cc
+++ b/crypto/test/file_test.cc
@@ -19,6 +19,8 @@
 #include <stdarg.h>
 #include <string.h>
 
+#include <openssl/err.h>
+
 #include "stl_compat.h"
 
 
@@ -184,6 +186,13 @@
   return true;
 }
 
+const std::string &FileTest::GetAttributeOrDie(const std::string &key) {
+  if (!HasAttribute(key)) {
+    abort();
+  }
+  return attributes_[key];
+}
+
 static bool FromHexDigit(uint8_t *out, char c) {
   if ('0' <= c && c <= '9') {
     *out = c - '0';
@@ -266,7 +275,8 @@
   unused_attributes_.erase(key);
 }
 
-int FileTestMain(bool (*run_test)(FileTest *t), const char *path) {
+int FileTestMain(bool (*run_test)(FileTest *t, void *arg), void *arg,
+                 const char *path) {
   FileTest t(path);
   if (!t.is_open()) {
     return 1;
@@ -281,8 +291,29 @@
       break;
     }
 
-    if (!run_test(&t)) {
+    bool result = run_test(&t, arg);
+    if (t.HasAttribute("Error")) {
+      if (result) {
+        t.PrintLine("Operation unexpectedly succeeded.");
+        failed = true;
+        continue;
+      }
+      uint32_t err = ERR_peek_error();
+      if (ERR_reason_error_string(err) != t.GetAttributeOrDie("Error")) {
+        t.PrintLine("Unexpected error; wanted '%s', got '%s'.",
+                     t.GetAttributeOrDie("Error").c_str(),
+                     ERR_reason_error_string(err));
+        failed = true;
+        continue;
+      }
+      ERR_clear_error();
+    } else if (!result) {
+      // In case the test itself doesn't print output, print something so the
+      // line number is reported.
+      t.PrintLine("Test failed");
+      ERR_print_errors_fp(stderr);
       failed = true;
+      continue;
     }
   }
 
diff --git a/crypto/test/file_test.h b/crypto/test/file_test.h
index 5ea65c1..7303d8a 100644
--- a/crypto/test/file_test.h
+++ b/crypto/test/file_test.h
@@ -104,6 +104,10 @@
   // |stderr| otherwise.
   bool GetAttribute(std::string *out_value, const std::string &key);
 
+  // GetAttributeOrDie looks up the attribute with key |key| and aborts if it is
+  // missing. It only be used after a |HasAttribute| call.
+  const std::string &GetAttributeOrDie(const std::string &key);
+
   // GetBytes looks up the attribute with key |key| and decodes it as a byte
   // string. On success, it writes the result to |*out| and returns
   // true. Otherwise it returns false with an error to |stderr|. The value may
@@ -146,14 +150,17 @@
 
 // FileTestMain runs a file-based test out of |path| and returns an exit code
 // suitable to return out of |main|. |run_test| should return true on pass and
-// false on failure.
+// false on failure. FileTestMain also implements common handling of the 'Error'
+// attribute. A test with that attribute is expected to fail. The value of the
+// attribute is the reason string of the expected OpenSSL error code.
 //
 // Tests are guaranteed to run serially and may affect global state if need be.
 // It is legal to use "tests" which, for example, import a private key into a
 // list of keys. This may be used to initialize a shared set of keys for many
 // tests. However, if one test fails, the framework will continue to run
 // subsequent tests.
-int FileTestMain(bool (*run_test)(FileTest *t), const char *path);
+int FileTestMain(bool (*run_test)(FileTest *t, void *arg), void *arg,
+                 const char *path);
 
 
 #endif /* OPENSSL_HEADER_CRYPTO_TEST_FILE_TEST_H */
diff --git a/crypto/test/scoped_types.h b/crypto/test/scoped_types.h
index 9f5a8db..eb04c18 100644
--- a/crypto/test/scoped_types.h
+++ b/crypto/test/scoped_types.h
@@ -98,6 +98,7 @@
 using ScopedEC_KEY = ScopedOpenSSLType<EC_KEY, EC_KEY_free>;
 using ScopedEC_POINT = ScopedOpenSSLType<EC_POINT, EC_POINT_free>;
 using ScopedEVP_PKEY = ScopedOpenSSLType<EVP_PKEY, EVP_PKEY_free>;
+using ScopedEVP_PKEY_CTX = ScopedOpenSSLType<EVP_PKEY_CTX, EVP_PKEY_CTX_free>;
 using ScopedPKCS8_PRIV_KEY_INFO = ScopedOpenSSLType<PKCS8_PRIV_KEY_INFO,
                                                     PKCS8_PRIV_KEY_INFO_free>;
 using ScopedPKCS12 = ScopedOpenSSLType<PKCS12, PKCS12_free>;
diff --git a/crypto/test/stl_compat.h b/crypto/test/stl_compat.h
index 9c45a98..1997a45 100644
--- a/crypto/test/stl_compat.h
+++ b/crypto/test/stl_compat.h
@@ -32,6 +32,11 @@
   return out->empty() ? nullptr : &(*out)[0];
 }
 
+template <class T>
+static const T *vector_data(const std::vector<T> *out) {
+  return out->empty() ? nullptr : &(*out)[0];
+}
+
 // remove_reference is a reimplementation of |std::remove_reference| from C++11.
 template <class T>
 struct remove_reference {
diff --git a/util/all_tests.go b/util/all_tests.go
index 87af024..91822d1 100644
--- a/util/all_tests.go
+++ b/util/all_tests.go
@@ -75,6 +75,8 @@
 	{"crypto/ecdsa/ecdsa_test"},
 	{"crypto/err/err_test"},
 	{"crypto/evp/evp_extra_test"},
+	{"crypto/evp/evp_test", "crypto/evp/evp_tests.txt"},
+	{"crypto/evp/evp_test", "crypto/hmac/hmac_tests.txt"},
 	{"crypto/evp/pbkdf_test"},
 	{"crypto/hkdf/hkdf_test"},
 	{"crypto/hmac/hmac_test", "crypto/hmac/hmac_tests.txt"},
@@ -184,13 +186,13 @@
 	return false, nil
 }
 
-// shortTestName returns the short name of a test. It assumes that any argument
-// which ends in .txt is a path to a data file and not relevant to the test's
-// uniqueness.
+// shortTestName returns the short name of a test. Except for evp_test, it
+// assumes that any argument which ends in .txt is a path to a data file and not
+// relevant to the test's uniqueness.
 func shortTestName(test test) string {
 	var args []string
 	for _, arg := range test {
-		if !strings.HasSuffix(arg, ".txt") {
+		if test[0] == "crypto/evp/evp_test" || !strings.HasSuffix(arg, ".txt") {
 			args = append(args, arg)
 		}
 	}