X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=include%2Fcrypto%2Fevp.h;h=dbbdcccbda90ce0b63c3a1ac9847a9d2300be4f4;hb=98642df4ba886818900ab7e6b23703544e6addd4;hp=835224a7aad1a8e159dc7952949b72a9fad26e73;hpb=989684227b669b5deb52ca05aa99f798fe0852e3;p=openssl.git diff --git a/include/crypto/evp.h b/include/crypto/evp.h index 835224a7aa..dbbdcccbda 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -1,5 +1,5 @@ /* - * Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -7,10 +7,14 @@ * https://www.openssl.org/source/license.html */ -#include -#include -#include "internal/refcount.h" -#include "crypto/ecx.h" +#ifndef OSSL_CRYPTO_EVP_H +# define OSSL_CRYPTO_EVP_H +# pragma once + +# include +# include +# include "internal/refcount.h" +# include "crypto/ecx.h" /* * Don't free up md_ctx->pctx in EVP_MD_CTX_reset, use the reserved flag @@ -18,6 +22,11 @@ */ #define EVP_MD_CTX_FLAG_KEEP_PKEY_CTX 0x0400 +#define evp_pkey_ctx_is_legacy(ctx) \ + ((ctx)->keymgmt == NULL) +#define evp_pkey_ctx_is_provided(ctx) \ + (!evp_pkey_ctx_is_legacy(ctx)) + struct evp_pkey_ctx_st { /* Actual operation */ int operation; @@ -26,9 +35,10 @@ struct evp_pkey_ctx_st { * Library context, property query, keytype and keymgmt associated with * this context */ - OPENSSL_CTX *libctx; - const char *propquery; + OSSL_LIB_CTX *libctx; + char *propquery; const char *keytype; + /* If |pkey| below is set, this field is always a reference to its keymgmt */ EVP_KEYMGMT *keymgmt; union { @@ -38,21 +48,37 @@ struct evp_pkey_ctx_st { struct { EVP_KEYEXCH *exchange; - void *exchprovctx; + /* + * Opaque ctx returned from a providers exchange algorithm + * implementation OSSL_FUNC_keyexch_newctx() + */ + void *algctx; } kex; struct { EVP_SIGNATURE *signature; - void *sigprovctx; + /* + * Opaque ctx returned from a providers signature algorithm + * implementation OSSL_FUNC_signature_newctx() + */ + void *algctx; } sig; struct { EVP_ASYM_CIPHER *cipher; - void *ciphprovctx; + /* + * Opaque ctx returned from a providers asymmetric cipher algorithm + * implementation OSSL_FUNC_asym_cipher_newctx() + */ + void *algctx; } ciph; struct { EVP_KEM *kem; - void *kemprovctx; + /* + * Opaque ctx returned from a providers KEM algorithm + * implementation OSSL_FUNC_kem_newctx() + */ + void *algctx; } encap; } op; @@ -95,6 +121,13 @@ struct evp_pkey_ctx_st { void *data; /* Indicator if digest_custom needs to be called */ unsigned int flag_call_digest_custom:1; + /* + * Used to support taking custody of memory in the case of a provider being + * used with the deprecated EVP_PKEY_CTX_set_rsa_keygen_pubexp() API. This + * member should NOT be used for any other purpose and should be removed + * when said deprecated API is excised completely. + */ + BIGNUM *rsa_pubexp; } /* EVP_PKEY_CTX */ ; #define EVP_PKEY_FLAG_DYNAMIC 1 @@ -152,20 +185,22 @@ DEFINE_STACK_OF_CONST(EVP_PKEY_METHOD) void evp_pkey_set_cb_translate(BN_GENCB *cb, EVP_PKEY_CTX *ctx); -const EVP_PKEY_METHOD *dh_pkey_method(void); -const EVP_PKEY_METHOD *dhx_pkey_method(void); -const EVP_PKEY_METHOD *dsa_pkey_method(void); -const EVP_PKEY_METHOD *ec_pkey_method(void); -const EVP_PKEY_METHOD *ecx25519_pkey_method(void); -const EVP_PKEY_METHOD *ecx448_pkey_method(void); -const EVP_PKEY_METHOD *ed25519_pkey_method(void); -const EVP_PKEY_METHOD *ed448_pkey_method(void); -const EVP_PKEY_METHOD *rsa_pkey_method(void); -const EVP_PKEY_METHOD *rsa_pss_pkey_method(void); +const EVP_PKEY_METHOD *ossl_dh_pkey_method(void); +const EVP_PKEY_METHOD *ossl_dhx_pkey_method(void); +const EVP_PKEY_METHOD *ossl_dsa_pkey_method(void); +const EVP_PKEY_METHOD *ossl_ec_pkey_method(void); +const EVP_PKEY_METHOD *ossl_ecx25519_pkey_method(void); +const EVP_PKEY_METHOD *ossl_ecx448_pkey_method(void); +const EVP_PKEY_METHOD *ossl_ed25519_pkey_method(void); +const EVP_PKEY_METHOD *ossl_ed448_pkey_method(void); +const EVP_PKEY_METHOD *ossl_rsa_pkey_method(void); +const EVP_PKEY_METHOD *ossl_rsa_pss_pkey_method(void); struct evp_mac_st { OSSL_PROVIDER *prov; int name_id; + char *type_name; + const char *description; CRYPTO_REF_COUNT refcnt; CRYPTO_RWLOCK *lock; @@ -173,7 +208,6 @@ struct evp_mac_st { OSSL_FUNC_mac_newctx_fn *newctx; OSSL_FUNC_mac_dupctx_fn *dupctx; OSSL_FUNC_mac_freectx_fn *freectx; - OSSL_FUNC_mac_size_fn *size; OSSL_FUNC_mac_init_fn *init; OSSL_FUNC_mac_update_fn *update; OSSL_FUNC_mac_final_fn *final; @@ -188,6 +222,8 @@ struct evp_mac_st { struct evp_kdf_st { OSSL_PROVIDER *prov; int name_id; + char *type_name; + const char *description; CRYPTO_REF_COUNT refcnt; CRYPTO_RWLOCK *lock; @@ -204,15 +240,19 @@ struct evp_kdf_st { OSSL_FUNC_kdf_set_ctx_params_fn *set_ctx_params; }; +#define EVP_ORIG_DYNAMIC 0 +#define EVP_ORIG_GLOBAL 1 +#define EVP_ORIG_METH 2 + struct evp_md_st { /* nid */ int type; /* Legacy structure members */ - /* TODO(3.0): Remove these */ int pkey_type; int md_size; unsigned long flags; + int origin; int (*init) (EVP_MD_CTX *ctx); int (*update) (EVP_MD_CTX *ctx, const void *data, size_t count); int (*final) (EVP_MD_CTX *ctx, unsigned char *md); @@ -224,8 +264,10 @@ struct evp_md_st { int (*md_ctrl) (EVP_MD_CTX *ctx, int cmd, int p1, void *p2); /* New structure members */ - /* TODO(3.0): Remove above comment when legacy has gone */ + /* Above comment to be removed when legacy has gone */ int name_id; + char *type_name; + const char *description; OSSL_PROVIDER *prov; CRYPTO_REF_COUNT refcnt; CRYPTO_RWLOCK *lock; @@ -254,9 +296,10 @@ struct evp_cipher_st { int iv_len; /* Legacy structure members */ - /* TODO(3.0): Remove these */ /* Various flags */ unsigned long flags; + /* How the EVP_CIPHER was created. */ + int origin; /* init key */ int (*init) (EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc); @@ -277,8 +320,10 @@ struct evp_cipher_st { void *app_data; /* New structure members */ - /* TODO(3.0): Remove above comment when legacy has gone */ + /* Above comment to be removed when legacy has gone */ int name_id; + char *type_name; + const char *description; OSSL_PROVIDER *prov; CRYPTO_REF_COUNT refcnt; CRYPTO_RWLOCK *lock; @@ -307,7 +352,7 @@ struct evp_cipher_st { #define BLOCK_CIPHER_ecb_loop() \ size_t i, bl; \ - bl = EVP_CIPHER_CTX_cipher(ctx)->block_size; \ + bl = EVP_CIPHER_CTX_get0_cipher(ctx)->block_size; \ if (inl < bl) return 1;\ inl -= bl; \ for (i=0; i <= inl; i+=bl) @@ -316,17 +361,17 @@ struct evp_cipher_st { static int cname##_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl) \ {\ BLOCK_CIPHER_ecb_loop() \ - cprefix##_ecb_encrypt(in + i, out + i, &EVP_C_DATA(kstruct,ctx)->ksched, EVP_CIPHER_CTX_encrypting(ctx)); \ + cprefix##_ecb_encrypt(in + i, out + i, &EVP_C_DATA(kstruct,ctx)->ksched, EVP_CIPHER_CTX_is_encrypting(ctx)); \ return 1;\ } -#define EVP_MAXCHUNK ((size_t)1<<(sizeof(long)*8-2)) +#define EVP_MAXCHUNK ((size_t)1 << 30) #define BLOCK_CIPHER_func_ofb(cname, cprefix, cbits, kstruct, ksched) \ static int cname##_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, size_t inl) \ {\ while(inl>=EVP_MAXCHUNK) {\ - int num = EVP_CIPHER_CTX_num(ctx);\ + int num = EVP_CIPHER_CTX_get_num(ctx);\ cprefix##_ofb##cbits##_encrypt(in, out, (long)EVP_MAXCHUNK, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, &num); \ EVP_CIPHER_CTX_set_num(ctx, num);\ inl-=EVP_MAXCHUNK;\ @@ -334,7 +379,7 @@ static int cname##_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const uns out+=EVP_MAXCHUNK;\ }\ if (inl) {\ - int num = EVP_CIPHER_CTX_num(ctx);\ + int num = EVP_CIPHER_CTX_get_num(ctx);\ cprefix##_ofb##cbits##_encrypt(in, out, (long)inl, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, &num); \ EVP_CIPHER_CTX_set_num(ctx, num);\ }\ @@ -346,13 +391,13 @@ static int cname##_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const uns {\ while(inl>=EVP_MAXCHUNK) \ {\ - cprefix##_cbc_encrypt(in, out, (long)EVP_MAXCHUNK, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, EVP_CIPHER_CTX_encrypting(ctx));\ + cprefix##_cbc_encrypt(in, out, (long)EVP_MAXCHUNK, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, EVP_CIPHER_CTX_is_encrypting(ctx));\ inl-=EVP_MAXCHUNK;\ in +=EVP_MAXCHUNK;\ out+=EVP_MAXCHUNK;\ }\ if (inl)\ - cprefix##_cbc_encrypt(in, out, (long)inl, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, EVP_CIPHER_CTX_encrypting(ctx));\ + cprefix##_cbc_encrypt(in, out, (long)inl, &EVP_C_DATA(kstruct,ctx)->ksched, ctx->iv, EVP_CIPHER_CTX_is_encrypting(ctx));\ return 1;\ } @@ -364,13 +409,13 @@ static int cname##_cfb##cbits##_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, if (inl < chunk) chunk = inl;\ while (inl && inl >= chunk)\ {\ - int num = EVP_CIPHER_CTX_num(ctx);\ + int num = EVP_CIPHER_CTX_get_num(ctx);\ cprefix##_cfb##cbits##_encrypt(in, out, (long) \ ((cbits == 1) \ && !EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS) \ ? chunk*8 : chunk), \ &EVP_C_DATA(kstruct, ctx)->ksched, ctx->iv,\ - &num, EVP_CIPHER_CTX_encrypting(ctx));\ + &num, EVP_CIPHER_CTX_is_encrypting(ctx));\ EVP_CIPHER_CTX_set_num(ctx, num);\ inl -= chunk;\ in += chunk;\ @@ -392,6 +437,7 @@ static int cname##_cfb##cbits##_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, static const EVP_CIPHER cname##_##mode = { \ nid##_##nmode, block_size, key_len, iv_len, \ flags | EVP_CIPH_##MODE##_MODE, \ + EVP_ORIG_GLOBAL, \ init_key, \ cname##_##mode##_cipher, \ cleanup, \ @@ -447,6 +493,7 @@ BLOCK_CIPHER_def_ecb(cname, kstruct, nid, block_size, key_len, flags, \ static const EVP_CIPHER cname##_cbc = {\ nid##_cbc, block_size, key_len, iv_len, \ flags | EVP_CIPH_CBC_MODE,\ + EVP_ORIG_GLOBAL,\ init_key,\ cname##_cbc_cipher,\ cleanup,\ @@ -460,6 +507,7 @@ const EVP_CIPHER *EVP_##cname##_cbc(void) { return &cname##_cbc; }\ static const EVP_CIPHER cname##_cfb = {\ nid##_cfb64, 1, key_len, iv_len, \ flags | EVP_CIPH_CFB_MODE,\ + EVP_ORIG_GLOBAL,\ init_key,\ cname##_cfb_cipher,\ cleanup,\ @@ -473,6 +521,7 @@ const EVP_CIPHER *EVP_##cname##_cfb(void) { return &cname##_cfb; }\ static const EVP_CIPHER cname##_ofb = {\ nid##_ofb64, 1, key_len, iv_len, \ flags | EVP_CIPH_OFB_MODE,\ + EVP_ORIG_GLOBAL,\ init_key,\ cname##_ofb_cipher,\ cleanup,\ @@ -486,6 +535,7 @@ const EVP_CIPHER *EVP_##cname##_ofb(void) { return &cname##_ofb; }\ static const EVP_CIPHER cname##_ecb = {\ nid##_ecb, block_size, key_len, iv_len, \ flags | EVP_CIPH_ECB_MODE,\ + EVP_ORIG_GLOBAL,\ init_key,\ cname##_ecb_cipher,\ cleanup,\ @@ -526,6 +576,24 @@ int evp_cipher_param_to_asn1_ex(EVP_CIPHER_CTX *c, ASN1_TYPE *type, int evp_cipher_asn1_to_param_ex(EVP_CIPHER_CTX *c, ASN1_TYPE *type, evp_cipher_aead_asn1_params *params); +/* + * To support transparent execution of operation in backends other + * than the "origin" key, we support transparent export/import to + * those providers, and maintain a cache of the imported keydata, + * so we don't need to redo the export/import every time we perform + * the same operation in that same provider. + * This requires that the "origin" backend (whether it's a legacy or a + * provider "origin") implements exports, and that the target provider + * has an EVP_KEYMGMT that implements import. + */ +typedef struct { + EVP_KEYMGMT *keymgmt; + void *keydata; + int selection; +} OP_CACHE_ELEM; + +DEFINE_STACK_OF(OP_CACHE_ELEM) + /* * An EVP_PKEY can have the following states: * @@ -555,13 +623,33 @@ int evp_cipher_asn1_to_param_ex(EVP_CIPHER_CTX *c, ASN1_TYPE *type, ((pk)->type == EVP_PKEY_NONE && (pk)->keymgmt == NULL) #define evp_pkey_is_typed(pk) \ ((pk)->type != EVP_PKEY_NONE || (pk)->keymgmt != NULL) -#define evp_pkey_is_assigned(pk) \ +#ifndef FIPS_MODULE +# define evp_pkey_is_assigned(pk) \ ((pk)->pkey.ptr != NULL || (pk)->keydata != NULL) +#else +# define evp_pkey_is_assigned(pk) \ + ((pk)->keydata != NULL) +#endif #define evp_pkey_is_legacy(pk) \ ((pk)->type != EVP_PKEY_NONE && (pk)->keymgmt == NULL) #define evp_pkey_is_provided(pk) \ ((pk)->keymgmt != NULL) +union legacy_pkey_st { + void *ptr; + struct rsa_st *rsa; /* RSA */ +# ifndef OPENSSL_NO_DSA + struct dsa_st *dsa; /* DSA */ +# endif +# ifndef OPENSSL_NO_DH + struct dh_st *dh; /* DH */ +# endif +# ifndef OPENSSL_NO_EC + struct ec_key_st *ec; /* ECC */ + ECX_KEY *ecx; /* X25519, X448, Ed25519, Ed448 */ +# endif +}; + struct evp_pkey_st { /* == Legacy attributes == */ int type; @@ -575,31 +663,21 @@ struct evp_pkey_st { const EVP_PKEY_ASN1_METHOD *ameth; ENGINE *engine; ENGINE *pmeth_engine; /* If not NULL public key ENGINE to use */ - union { - void *ptr; -# ifndef OPENSSL_NO_RSA - struct rsa_st *rsa; /* RSA */ -# endif -# ifndef OPENSSL_NO_DSA - struct dsa_st *dsa; /* DSA */ -# endif -# ifndef OPENSSL_NO_DH - struct dh_st *dh; /* DH */ -# endif -# ifndef OPENSSL_NO_EC - struct ec_key_st *ec; /* ECC */ - ECX_KEY *ecx; /* X25519, X448, Ed25519, Ed448 */ -# endif - } pkey; + + /* Union to store the reference to an origin legacy key */ + union legacy_pkey_st pkey; + + /* Union to store the reference to a non-origin legacy key */ + union legacy_pkey_st legacy_cache_pkey; # endif /* == Common attributes == */ - /* If these are modified, so must evp_pkey_downgrade() */ CRYPTO_REF_COUNT references; CRYPTO_RWLOCK *lock; +#ifndef FIPS_MODULE STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */ int save_parameters; -#ifndef FIPS_MODULE + unsigned int foreign:1; /* the low-level key is using an engine or an app-method */ CRYPTO_EX_DATA ex_data; #endif @@ -624,18 +702,9 @@ struct evp_pkey_st { * those providers, and maintain a cache of the imported keydata, * so we don't need to redo the export/import every time we perform * the same operation in that same provider. - * This requires that the "origin" backend (whether it's a legacy or a - * provider "origin") implements exports, and that the target provider - * has an EVP_KEYMGMT that implements import. - * - * The cache limit is set at 10 different providers using the same - * "origin". It's probably over the top, but is preferable to too - * few. */ - struct { - EVP_KEYMGMT *keymgmt; - void *keydata; - } operation_cache[10]; + STACK_OF(OP_CACHE_ELEM) *operation_cache; + /* * We keep a copy of that "origin"'s dirty count, so we know if the * operation cache needs flushing. @@ -668,6 +737,9 @@ struct evp_pkey_st { ((ctx)->operation == EVP_PKEY_OP_PARAMGEN \ || (ctx)->operation == EVP_PKEY_OP_KEYGEN) +#define EVP_PKEY_CTX_IS_FROMDATA_OP(ctx) \ + ((ctx)->operation == EVP_PKEY_OP_FROMDATA) + #define EVP_PKEY_CTX_IS_KEM_OP(ctx) \ ((ctx)->operation == EVP_PKEY_OP_ENCAPSULATE \ || (ctx)->operation == EVP_PKEY_OP_DECAPSULATE) @@ -676,13 +748,15 @@ void openssl_add_all_ciphers_int(void); void openssl_add_all_digests_int(void); void evp_cleanup_int(void); void evp_app_cleanup_int(void); -void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx, +void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx, EVP_KEYMGMT **keymgmt, const char *propquery); #ifndef FIPS_MODULE int evp_pkey_copy_downgraded(EVP_PKEY **dest, const EVP_PKEY *src); -int evp_pkey_downgrade(EVP_PKEY *pk); +void *evp_pkey_get_legacy(EVP_PKEY *pk); void evp_pkey_free_legacy(EVP_PKEY *x); +EVP_PKEY *evp_pkcs82pkey_legacy(const PKCS8_PRIV_KEY_INFO *p8inf, + OSSL_LIB_CTX *libctx, const char *propq); #endif /* @@ -705,12 +779,14 @@ EVP_PKEY *evp_keymgmt_util_make_pkey(EVP_KEYMGMT *keymgmt, void *keydata); int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection, OSSL_CALLBACK *export_cb, void *export_cbarg); -void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt); -size_t evp_keymgmt_util_find_operation_cache_index(EVP_PKEY *pk, - EVP_KEYMGMT *keymgmt); -void evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk); -int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, size_t index, - EVP_KEYMGMT *keymgmt, void *keydata); +void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + int selection); +OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk, + EVP_KEYMGMT *keymgmt, + int selection); +int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking); +int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt, + void *keydata, int selection); void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk); void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, int selection, const OSSL_PARAM params[]); @@ -722,6 +798,8 @@ void *evp_keymgmt_util_gen(EVP_PKEY *target, EVP_KEYMGMT *keymgmt, int evp_keymgmt_util_get_deflt_digest_name(EVP_KEYMGMT *keymgmt, void *keydata, char *mdname, size_t mdname_sz); +const char *evp_keymgmt_util_query_operation_name(EVP_KEYMGMT *keymgmt, + int op_id); /* * KEYMGMT provider interface functions @@ -732,7 +810,8 @@ int evp_keymgmt_get_params(const EVP_KEYMGMT *keymgmt, void *keydata, OSSL_PARAM params[]); int evp_keymgmt_set_params(const EVP_KEYMGMT *keymgmt, void *keydata, const OSSL_PARAM params[]); -void *evp_keymgmt_gen_init(const EVP_KEYMGMT *keymgmt, int selection); +void *evp_keymgmt_gen_init(const EVP_KEYMGMT *keymgmt, int selection, + const OSSL_PARAM params[]); int evp_keymgmt_gen_set_template(const EVP_KEYMGMT *keymgmt, void *genctx, void *template); int evp_keymgmt_gen_set_params(const EVP_KEYMGMT *keymgmt, void *genctx, @@ -741,12 +820,13 @@ void *evp_keymgmt_gen(const EVP_KEYMGMT *keymgmt, void *genctx, OSSL_CALLBACK *cb, void *cbarg); void evp_keymgmt_gen_cleanup(const EVP_KEYMGMT *keymgmt, void *genctx); +int evp_keymgmt_has_load(const EVP_KEYMGMT *keymgmt); void *evp_keymgmt_load(const EVP_KEYMGMT *keymgmt, const void *objref, size_t objref_sz); int evp_keymgmt_has(const EVP_KEYMGMT *keymgmt, void *keyddata, int selection); int evp_keymgmt_validate(const EVP_KEYMGMT *keymgmt, void *keydata, - int selection); + int selection, int checktype); int evp_keymgmt_match(const EVP_KEYMGMT *keymgmt, const void *keydata1, const void *keydata2, int selection); @@ -759,16 +839,18 @@ int evp_keymgmt_export(const EVP_KEYMGMT *keymgmt, void *keydata, int selection, OSSL_CALLBACK *param_cb, void *cbarg); const OSSL_PARAM *evp_keymgmt_export_types(const EVP_KEYMGMT *keymgmt, int selection); -int evp_keymgmt_copy(const EVP_KEYMGMT *keymgmt, - void *keydata_to, const void *keydata_from, - int selection); +void *evp_keymgmt_dup(const EVP_KEYMGMT *keymgmt, + const void *keydata_from, int selection); +EVP_KEYMGMT *evp_keymgmt_fetch_from_prov(OSSL_PROVIDER *prov, + const char *name, + const char *properties); /* Pulling defines out of C source files */ -#define EVP_RC4_KEY_SIZE 16 -#ifndef TLS1_1_VERSION -# define TLS1_1_VERSION 0x0302 -#endif +# define EVP_RC4_KEY_SIZE 16 +# ifndef TLS1_1_VERSION +# define TLS1_1_VERSION 0x0302 +# endif void evp_encode_ctx_set_flags(EVP_ENCODE_CTX *ctx, unsigned int flags); @@ -778,16 +860,18 @@ void evp_encode_ctx_set_flags(EVP_ENCODE_CTX *ctx, unsigned int flags); /* Use the SRP base64 alphabet instead of the standard one */ #define EVP_ENCODE_CTX_USE_SRP_ALPHABET 2 -const EVP_CIPHER *evp_get_cipherbyname_ex(OPENSSL_CTX *libctx, const char *name); -const EVP_MD *evp_get_digestbyname_ex(OPENSSL_CTX *libctx, const char *name); +const EVP_CIPHER *evp_get_cipherbyname_ex(OSSL_LIB_CTX *libctx, + const char *name); +const EVP_MD *evp_get_digestbyname_ex(OSSL_LIB_CTX *libctx, + const char *name); -int pkcs5_pbkdf2_hmac_with_libctx(const char *pass, int passlen, - const unsigned char *salt, int saltlen, - int iter, const EVP_MD *digest, int keylen, - unsigned char *out, - OPENSSL_CTX *libctx, const char *propq); +int ossl_pkcs5_pbkdf2_hmac_ex(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, + const EVP_MD *digest, int keylen, + unsigned char *out, + OSSL_LIB_CTX *libctx, const char *propq); -#ifndef FIPS_MODULE +# ifndef FIPS_MODULE /* * Internal helpers for stricter EVP_PKEY_CTX_{set,get}_params(). * @@ -803,19 +887,68 @@ int pkcs5_pbkdf2_hmac_with_libctx(const char *pass, int passlen, int evp_pkey_ctx_set_params_strict(EVP_PKEY_CTX *ctx, OSSL_PARAM *params); int evp_pkey_ctx_get_params_strict(EVP_PKEY_CTX *ctx, OSSL_PARAM *params); -EVP_MD_CTX *evp_md_ctx_new_with_libctx(EVP_PKEY *pkey, - const ASN1_OCTET_STRING *id, - OPENSSL_CTX *libctx, const char *propq); +EVP_MD_CTX *evp_md_ctx_new_ex(EVP_PKEY *pkey, const ASN1_OCTET_STRING *id, + OSSL_LIB_CTX *libctx, const char *propq); int evp_pkey_name2type(const char *name); +const char *evp_pkey_type2name(int type); int evp_pkey_ctx_set1_id_prov(EVP_PKEY_CTX *ctx, const void *id, int len); int evp_pkey_ctx_get1_id_prov(EVP_PKEY_CTX *ctx, void *id); int evp_pkey_ctx_get1_id_len_prov(EVP_PKEY_CTX *ctx, size_t *id_len); int evp_pkey_ctx_use_cached_data(EVP_PKEY_CTX *ctx); -#endif /* !defined(FIPS_MODULE) */ -void evp_method_store_flush(OPENSSL_CTX *libctx); -int evp_set_default_properties_int(OPENSSL_CTX *libctx, const char *propq, - int loadconfig); +# endif /* !defined(FIPS_MODULE) */ + +int evp_method_store_cache_flush(OSSL_LIB_CTX *libctx); +int evp_method_store_remove_all_provided(const OSSL_PROVIDER *prov); + +int evp_default_properties_enable_fips_int(OSSL_LIB_CTX *libctx, int enable, + int loadconfig); +int evp_set_default_properties_int(OSSL_LIB_CTX *libctx, const char *propq, + int loadconfig, int mirrored); +char *evp_get_global_properties_str(OSSL_LIB_CTX *libctx, int loadconfig); + +void evp_md_ctx_clear_digest(EVP_MD_CTX *ctx, int force, int keep_digest); +/* just free the algctx if set, returns 0 on inconsistent state of ctx */ +int evp_md_ctx_free_algctx(EVP_MD_CTX *ctx); + +/* Three possible states: */ +# define EVP_PKEY_STATE_UNKNOWN 0 +# define EVP_PKEY_STATE_LEGACY 1 +# define EVP_PKEY_STATE_PROVIDER 2 +int evp_pkey_ctx_state(const EVP_PKEY_CTX *ctx); + +/* These two must ONLY be called for provider side operations */ +int evp_pkey_ctx_ctrl_to_param(EVP_PKEY_CTX *ctx, + int keytype, int optype, + int cmd, int p1, void *p2); +int evp_pkey_ctx_ctrl_str_to_param(EVP_PKEY_CTX *ctx, + const char *name, const char *value); + +/* These two must ONLY be called for legacy operations */ +int evp_pkey_ctx_set_params_to_ctrl(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params); +int evp_pkey_ctx_get_params_to_ctrl(EVP_PKEY_CTX *ctx, OSSL_PARAM *params); + +/* This must ONLY be called for legacy EVP_PKEYs */ +int evp_pkey_get_params_to_ctrl(const EVP_PKEY *pkey, OSSL_PARAM *params); + +/* Same as the public get0 functions but are not const */ +# ifndef OPENSSL_NO_DEPRECATED_3_0 +DH *evp_pkey_get0_DH_int(const EVP_PKEY *pkey); +EC_KEY *evp_pkey_get0_EC_KEY_int(const EVP_PKEY *pkey); +RSA *evp_pkey_get0_RSA_int(const EVP_PKEY *pkey); +# endif -void evp_md_ctx_clear_digest(EVP_MD_CTX *ctx, int force); +/* Get internal identification number routines */ +int evp_asym_cipher_get_number(const EVP_ASYM_CIPHER *cipher); +int evp_cipher_get_number(const EVP_CIPHER *cipher); +int evp_kdf_get_number(const EVP_KDF *kdf); +int evp_kem_get_number(const EVP_KEM *wrap); +int evp_keyexch_get_number(const EVP_KEYEXCH *keyexch); +int evp_keymgmt_get_number(const EVP_KEYMGMT *keymgmt); +int evp_mac_get_number(const EVP_MAC *mac); +int evp_md_get_number(const EVP_MD *md); +int evp_rand_get_number(const EVP_RAND *rand); +int evp_signature_get_number(const EVP_SIGNATURE *signature); + +#endif /* OSSL_CRYPTO_EVP_H */