anchor.diff:      BIO_write(PubKeyBIO, @AKey[0], Length(AKey));
       rsa := PEM_read_bio_RSAPrivateKey(PubKeyBIO, nil, nil, nil);
       Result := (rsa <> nil);
  +    if Result then
  +      RSA_Free(rsa);
     finally
       BIO_free(PubKeyBIO);
     end;
  
positive.code:     BIO_free(PrivKeyBIO);
    end;
  
    // Extract Private key from RSA object
    PrivKey := EVP_PKEY_new();
    if EVP_PKEY_set1_RSA(PrivKey, rsa) <> 1 then
      raise Exception.Create('[RSA] Unable to extract private key: '+ERR_GetErrorMessage_OpenSSL);
  
    locBio := BIO_new( BIO_f_md );
    locSHA := nil;
    try
      // Create context. Use this strage hack since Indy library has no EVP_MD_CTX_create
      BIO_get_md_ctx( locBio, @locCtx );
  
      case AAlg of
        RS256: locSHA := EVP_sha256();
        RS384: locSHA := EVP_sha384();
        RS512: locSHA := EVP_sha512();
      end;
  
      if EVP_DigestSignInit( locCtx, NIL, locSHA, NIL, PrivKey ) <> 1 then
        raise Exception.Create('[RSA] Unable to init context: '+ERR_GetErrorMessage_OpenSSL);
      if EVP_DigestSignUpdate( locCtx, @AInput[0], Length(AInput) ) <> 1 then
        raise Exception.Create('[RSA] Unable to update context with payload: '+ERR_GetErrorMessage_OpenSSL);
      // Get signature, first read signature len
      EVP_DigestSignFinal( locCtx, nil, @slen );
      sig := OPENSSL_malloc(slen);
      try
        EVP_DigestSignFinal( locCtx, sig, @slen );
        setLength(Result, slen);
        move(sig^, Result[0], slen);
      finally
        CRYPTO_free(sig);
      end;
    finally
      BIO_free( locBio );
    end;
  end;
  
  
negative.code:   PubKeyBIO := BIO_new(BIO_s_mem);
    try
      BIO_write(PubKeyBIO, @AKey[0], Length(AKey));
      if CompareMem(@PKCS1_SIGNATURE_PUBKEY[1], @AKey[0], length(PKCS1_SIGNATURE_PUBKEY)) then
        rsa := PEM_read_bio_RSAPublicKey(PubKeyBIO, nil, nil, nil)
      else
        rsa := _PEM_read_bio_RSA_PUBKEY(PubKeyBIO, nil, nil, nil);
      if rsa = nil then
        raise Exception.Create('[RSA] Unable to load public key: '+ERR_GetErrorMessage_OpenSSL);
    finally
      BIO_free(PubKeyBIO);
    end;
  
    try
      // Extract Public key from RSA object
      PubKey := EVP_PKEY_new();
      try
        if EVP_PKEY_set1_RSA(PubKey,rsa) <> 1 then
          raise Exception.Create('[RSA] Unable to extract public key: '+ERR_GetErrorMessage_OpenSSL);
  
        case AAlg of
          RS256: locSHA := EVP_sha256();
          RS384: locSHA := EVP_sha384();
          RS512: locSHA := EVP_sha512();
          else
            raise Exception.Create('[RSA] Unsupported signing algorithm!');
        end;
  
        locCtx := _EVP_MD_CTX_create;
        try
          if EVP_DigestVerifyInit( locCtx, NIL, locSHA, NIL, PubKey ) <> 1 then
            raise Exception.Create('[RSA] Unable to init context: '+ERR_GetErrorMessage_OpenSSL);
          if EVP_DigestVerifyUpdate( locCtx, @AInput[0], Length(AInput) ) <> 1 then
            raise Exception.Create('[RSA] Unable to update context with payload: '+ERR_GetErrorMessage_OpenSSL);
          result := ( EVP_DigestVerifyFinal( locCtx, PAnsiChar(@ASignature[0]), length(ASignature) ) = 1 );
        finally
          _EVP_MD_CTX_destroy(locCtx);
        end;
      finally
        EVP_PKEY_free(PubKey);
      end;
    finally
      RSA_Free(rsa);
    end;
  end;
  
  