crypto/evp/p_lib.c

   1 /*
   2  * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include "internal/refcount.h"
  13 #include <openssl/bn.h>
  14 #include <openssl/err.h>
  15 #include <openssl/objects.h>
  16 #include <openssl/evp.h>
  17 #include <openssl/x509.h>
  18 #include <openssl/rsa.h>
  19 #include <openssl/dsa.h>
  20 #include <openssl/dh.h>
  21 #include <openssl/cmac.h>
  22 #include <openssl/engine.h>
  23 #include <openssl/params.h>
  24 #include <openssl/core_names.h>
  25
  26 #include "internal/asn1_int.h"
  27 #include "internal/evp_int.h"
  28 #include "internal/provider.h"
  29
  30 static void EVP_PKEY_free_it(EVP_PKEY *x);
  31
  32 int EVP_PKEY_bits(const EVP_PKEY *pkey)
  33 {
  34     if (pkey && pkey->ameth && pkey->ameth->pkey_bits)
  35         return pkey->ameth->pkey_bits(pkey);
  36     return 0;
  37 }
  38
  39 int EVP_PKEY_security_bits(const EVP_PKEY *pkey)
  40 {
  41     if (pkey == NULL)
  42         return 0;
  43     if (!pkey->ameth || !pkey->ameth->pkey_security_bits)
  44         return -2;
  45     return pkey->ameth->pkey_security_bits(pkey);
  46 }
  47
  48 int EVP_PKEY_size(const EVP_PKEY *pkey)
  49 {
  50     if (pkey && pkey->ameth && pkey->ameth->pkey_size)
  51         return pkey->ameth->pkey_size(pkey);
  52     return 0;
  53 }
  54
  55 int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode)
  56 {
  57 #ifndef OPENSSL_NO_DSA
  58     if (pkey->type == EVP_PKEY_DSA) {
  59         int ret = pkey->save_parameters;
  60
  61         if (mode >= 0)
  62             pkey->save_parameters = mode;
  63         return ret;
  64     }
  65 #endif
  66 #ifndef OPENSSL_NO_EC
  67     if (pkey->type == EVP_PKEY_EC) {
  68         int ret = pkey->save_parameters;
  69
  70         if (mode >= 0)
  71             pkey->save_parameters = mode;
  72         return ret;
  73     }
  74 #endif
  75     return 0;
  76 }
  77
  78 int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  79 {
  80     if (to->type == EVP_PKEY_NONE) {
  81         if (EVP_PKEY_set_type(to, from->type) == 0)
  82             return 0;
  83     } else if (to->type != from->type) {
  84         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_KEY_TYPES);
  85         goto err;
  86     }
  87
  88     if (EVP_PKEY_missing_parameters(from)) {
  89         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_MISSING_PARAMETERS);
  90         goto err;
  91     }
  92
  93     if (!EVP_PKEY_missing_parameters(to)) {
  94         if (EVP_PKEY_cmp_parameters(to, from) == 1)
  95             return 1;
  96         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_PARAMETERS);
  97         return 0;
  98     }
  99
 100     if (from->ameth && from->ameth->param_copy)
 101         return from->ameth->param_copy(to, from);
 102  err:
 103     return 0;
 104 }
 105
 106 int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey)
 107 {
 108     if (pkey->ameth && pkey->ameth->param_missing)
 109         return pkey->ameth->param_missing(pkey);
 110     return 0;
 111 }
 112
 113 int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
 114 {
 115     if (a->type != b->type)
 116         return -1;
 117     if (a->ameth && a->ameth->param_cmp)
 118         return a->ameth->param_cmp(a, b);
 119     return -2;
 120 }
 121
 122 int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 123 {
 124     if (a->type != b->type)
 125         return -1;
 126
 127     if (a->ameth) {
 128         int ret;
 129         /* Compare parameters if the algorithm has them */
 130         if (a->ameth->param_cmp) {
 131             ret = a->ameth->param_cmp(a, b);
 132             if (ret <= 0)
 133                 return ret;
 134         }
 135
 136         if (a->ameth->pub_cmp)
 137             return a->ameth->pub_cmp(a, b);
 138     }
 139
 140     return -2;
 141 }
 142
 143 EVP_PKEY *EVP_PKEY_new(void)
 144 {
 145     EVP_PKEY *ret = OPENSSL_zalloc(sizeof(*ret));
 146
 147     if (ret == NULL) {
 148         EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
 149         return NULL;
 150     }
 151     ret->type = EVP_PKEY_NONE;
 152     ret->save_type = EVP_PKEY_NONE;
 153     ret->references = 1;
 154     ret->save_parameters = 1;
 155     ret->lock = CRYPTO_THREAD_lock_new();
 156     if (ret->lock == NULL) {
 157         EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
 158         OPENSSL_free(ret);
 159         return NULL;
 160     }
 161     return ret;
 162 }
 163
 164 int EVP_PKEY_up_ref(EVP_PKEY *pkey)
 165 {
 166     int i;
 167
 168     if (CRYPTO_UP_REF(&pkey->references, &i, pkey->lock) <= 0)
 169         return 0;
 170
 171     REF_PRINT_COUNT("EVP_PKEY", pkey);
 172     REF_ASSERT_ISNT(i < 2);
 173     return ((i > 1) ? 1 : 0);
 174 }
 175
 176 /*
 177  * Setup a public key ASN1 method and ENGINE from a NID or a string. If pkey
 178  * is NULL just return 1 or 0 if the algorithm exists.
 179  */
 180
 181 static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
 182                          int len)
 183 {
 184     const EVP_PKEY_ASN1_METHOD *ameth;
 185     ENGINE **eptr = (e == NULL) ? &e :  NULL;
 186
 187     if (pkey) {
 188         if (pkey->pkey.ptr)
 189             EVP_PKEY_free_it(pkey);
 190         /*
 191          * If key type matches and a method exists then this lookup has
 192          * succeeded once so just indicate success.
 193          */
 194         if ((type == pkey->save_type) && pkey->ameth)
 195             return 1;
 196 #ifndef OPENSSL_NO_ENGINE
 197         /* If we have ENGINEs release them */
 198         ENGINE_finish(pkey->engine);
 199         pkey->engine = NULL;
 200         ENGINE_finish(pkey->pmeth_engine);
 201         pkey->pmeth_engine = NULL;
 202 #endif
 203     }
 204     if (str)
 205         ameth = EVP_PKEY_asn1_find_str(eptr, str, len);
 206     else
 207         ameth = EVP_PKEY_asn1_find(eptr, type);
 208 #ifndef OPENSSL_NO_ENGINE
 209     if (pkey == NULL && eptr != NULL)
 210         ENGINE_finish(e);
 211 #endif
 212     if (ameth == NULL) {
 213         EVPerr(EVP_F_PKEY_SET_TYPE, EVP_R_UNSUPPORTED_ALGORITHM);
 214         return 0;
 215     }
 216     if (pkey) {
 217         pkey->ameth = ameth;
 218         pkey->engine = e;
 219
 220         pkey->type = pkey->ameth->pkey_id;
 221         pkey->save_type = type;
 222     }
 223     return 1;
 224 }
 225
 226 EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
 227                                        const unsigned char *priv,
 228                                        size_t len)
 229 {
 230     EVP_PKEY *ret = EVP_PKEY_new();
 231
 232     if (ret == NULL
 233             || !pkey_set_type(ret, e, type, NULL, -1)) {
 234         /* EVPerr already called */
 235         goto err;
 236     }
 237
 238     if (ret->ameth->set_priv_key == NULL) {
 239         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY,
 240                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 241         goto err;
 242     }
 243
 244     if (!ret->ameth->set_priv_key(ret, priv, len)) {
 245         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY, EVP_R_KEY_SETUP_FAILED);
 246         goto err;
 247     }
 248
 249     return ret;
 250
 251  err:
 252     EVP_PKEY_free(ret);
 253     return NULL;
 254 }
 255
 256 EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
 257                                       const unsigned char *pub,
 258                                       size_t len)
 259 {
 260     EVP_PKEY *ret = EVP_PKEY_new();
 261
 262     if (ret == NULL
 263             || !pkey_set_type(ret, e, type, NULL, -1)) {
 264         /* EVPerr already called */
 265         goto err;
 266     }
 267
 268     if (ret->ameth->set_pub_key == NULL) {
 269         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY,
 270                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 271         goto err;
 272     }
 273
 274     if (!ret->ameth->set_pub_key(ret, pub, len)) {
 275         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY, EVP_R_KEY_SETUP_FAILED);
 276         goto err;
 277     }
 278
 279     return ret;
 280
 281  err:
 282     EVP_PKEY_free(ret);
 283     return NULL;
 284 }
 285
 286 int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
 287                                  size_t *len)
 288 {
 289      if (pkey->ameth->get_priv_key == NULL) {
 290         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY,
 291                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 292         return 0;
 293     }
 294
 295     if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
 296         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, EVP_R_GET_RAW_KEY_FAILED);
 297         return 0;
 298     }
 299
 300     return 1;
 301 }
 302
 303 int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
 304                                 size_t *len)
 305 {
 306      if (pkey->ameth->get_pub_key == NULL) {
 307         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY,
 308                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 309         return 0;
 310     }
 311
 312     if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
 313         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, EVP_R_GET_RAW_KEY_FAILED);
 314         return 0;
 315     }
 316
 317     return 1;
 318 }
 319
 320 EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
 321                                 size_t len, const EVP_CIPHER *cipher)
 322 {
 323 #ifndef OPENSSL_NO_CMAC
 324 # ifndef OPENSSL_NO_ENGINE
 325     const char *engine_id = e != NULL ? ENGINE_get_id(e) : NULL;
 326 # endif
 327     const char *cipher_name = EVP_CIPHER_name(cipher);
 328     const OSSL_PROVIDER *prov = EVP_CIPHER_provider(cipher);
 329     OPENSSL_CTX *libctx =
 330         prov == NULL ? NULL : ossl_provider_library_context(prov);
 331     EVP_PKEY *ret = EVP_PKEY_new();
 332     EVP_MAC *cmac = EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, NULL);
 333     EVP_MAC_CTX *cmctx = cmac != NULL ? EVP_MAC_CTX_new(cmac) : NULL;
 334     OSSL_PARAM params[4];
 335     size_t paramsn = 0;
 336
 337     if (ret == NULL
 338             || cmctx == NULL
 339             || !pkey_set_type(ret, e, EVP_PKEY_CMAC, NULL, -1)) {
 340         /* EVPerr already called */
 341         goto err;
 342     }
 343
 344 # ifndef OPENSSL_NO_ENGINE
 345     if (engine_id != NULL)
 346         params[paramsn++] =
 347             OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_ENGINE,
 348                                              (char *)engine_id,
 349                                              strlen(engine_id) + 1);
 350 # endif
 351
 352     params[paramsn++] =
 353         OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER,
 354                                          (char *)cipher_name,
 355                                          strlen(cipher_name) + 1);
 356     params[paramsn++] =
 357         OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
 358                                           (char *)priv, len);
 359     params[paramsn] = OSSL_PARAM_construct_end();
 360
 361     if (!EVP_MAC_CTX_set_params(cmctx, params)) {
 362         EVPerr(EVP_F_EVP_PKEY_NEW_CMAC_KEY, EVP_R_KEY_SETUP_FAILED);
 363         goto err;
 364     }
 365
 366     ret->pkey.ptr = cmctx;
 367     return ret;
 368
 369  err:
 370     EVP_PKEY_free(ret);
 371     EVP_MAC_CTX_free(cmctx);
 372     EVP_MAC_free(cmac);
 373     return NULL;
 374 #else
 375     EVPerr(EVP_F_EVP_PKEY_NEW_CMAC_KEY,
 376            EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 377     return NULL;
 378 #endif
 379 }
 380
 381 int EVP_PKEY_set_type(EVP_PKEY *pkey, int type)
 382 {
 383     return pkey_set_type(pkey, NULL, type, NULL, -1);
 384 }
 385
 386 int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len)
 387 {
 388     return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, str, len);
 389 }
 390
 391 int EVP_PKEY_set_alias_type(EVP_PKEY *pkey, int type)
 392 {
 393     if (pkey->type == type) {
 394         return 1; /* it already is that type */
 395     }
 396
 397     /*
 398      * The application is requesting to alias this to a different pkey type,
 399      * but not one that resolves to the base type.
 400      */
 401     if (EVP_PKEY_type(type) != EVP_PKEY_base_id(pkey)) {
 402         EVPerr(EVP_F_EVP_PKEY_SET_ALIAS_TYPE, EVP_R_UNSUPPORTED_ALGORITHM);
 403         return 0;
 404     }
 405
 406     pkey->type = type;
 407     return 1;
 408 }
 409
 410 #ifndef OPENSSL_NO_ENGINE
 411 int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e)
 412 {
 413     if (e != NULL) {
 414         if (!ENGINE_init(e)) {
 415             EVPerr(EVP_F_EVP_PKEY_SET1_ENGINE, ERR_R_ENGINE_LIB);
 416             return 0;
 417         }
 418         if (ENGINE_get_pkey_meth(e, pkey->type) == NULL) {
 419             ENGINE_finish(e);
 420             EVPerr(EVP_F_EVP_PKEY_SET1_ENGINE, EVP_R_UNSUPPORTED_ALGORITHM);
 421             return 0;
 422         }
 423     }
 424     ENGINE_finish(pkey->pmeth_engine);
 425     pkey->pmeth_engine = e;
 426     return 1;
 427 }
 428
 429 ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey)
 430 {
 431     return pkey->engine;
 432 }
 433 #endif
 434 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key)
 435 {
 436     if (pkey == NULL || !EVP_PKEY_set_type(pkey, type))
 437         return 0;
 438     pkey->pkey.ptr = key;
 439     return (key != NULL);
 440 }
 441
 442 void *EVP_PKEY_get0(const EVP_PKEY *pkey)
 443 {
 444     return pkey->pkey.ptr;
 445 }
 446
 447 const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len)
 448 {
 449     ASN1_OCTET_STRING *os = NULL;
 450     if (pkey->type != EVP_PKEY_HMAC) {
 451         EVPerr(EVP_F_EVP_PKEY_GET0_HMAC, EVP_R_EXPECTING_AN_HMAC_KEY);
 452         return NULL;
 453     }
 454     os = EVP_PKEY_get0(pkey);
 455     *len = os->length;
 456     return os->data;
 457 }
 458
 459 #ifndef OPENSSL_NO_POLY1305
 460 const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len)
 461 {
 462     ASN1_OCTET_STRING *os = NULL;
 463     if (pkey->type != EVP_PKEY_POLY1305) {
 464         EVPerr(EVP_F_EVP_PKEY_GET0_POLY1305, EVP_R_EXPECTING_A_POLY1305_KEY);
 465         return NULL;
 466     }
 467     os = EVP_PKEY_get0(pkey);
 468     *len = os->length;
 469     return os->data;
 470 }
 471 #endif
 472
 473 #ifndef OPENSSL_NO_SIPHASH
 474 const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len)
 475 {
 476     ASN1_OCTET_STRING *os = NULL;
 477
 478     if (pkey->type != EVP_PKEY_SIPHASH) {
 479         EVPerr(EVP_F_EVP_PKEY_GET0_SIPHASH, EVP_R_EXPECTING_A_SIPHASH_KEY);
 480         return NULL;
 481     }
 482     os = EVP_PKEY_get0(pkey);
 483     *len = os->length;
 484     return os->data;
 485 }
 486 #endif
 487
 488 #ifndef OPENSSL_NO_RSA
 489 int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key)
 490 {
 491     int ret = EVP_PKEY_assign_RSA(pkey, key);
 492     if (ret)
 493         RSA_up_ref(key);
 494     return ret;
 495 }
 496
 497 RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey)
 498 {
 499     if (pkey->type != EVP_PKEY_RSA) {
 500         EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
 501         return NULL;
 502     }
 503     return pkey->pkey.rsa;
 504 }
 505
 506 RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey)
 507 {
 508     RSA *ret = EVP_PKEY_get0_RSA(pkey);
 509     if (ret != NULL)
 510         RSA_up_ref(ret);
 511     return ret;
 512 }
 513 #endif
 514
 515 #ifndef OPENSSL_NO_DSA
 516 int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
 517 {
 518     int ret = EVP_PKEY_assign_DSA(pkey, key);
 519     if (ret)
 520         DSA_up_ref(key);
 521     return ret;
 522 }
 523
 524 DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey)
 525 {
 526     if (pkey->type != EVP_PKEY_DSA) {
 527         EVPerr(EVP_F_EVP_PKEY_GET0_DSA, EVP_R_EXPECTING_A_DSA_KEY);
 528         return NULL;
 529     }
 530     return pkey->pkey.dsa;
 531 }
 532
 533 DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
 534 {
 535     DSA *ret = EVP_PKEY_get0_DSA(pkey);
 536     if (ret != NULL)
 537         DSA_up_ref(ret);
 538     return ret;
 539 }
 540 #endif
 541
 542 #ifndef OPENSSL_NO_EC
 543
 544 int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key)
 545 {
 546     int ret = EVP_PKEY_assign_EC_KEY(pkey, key);
 547     if (ret)
 548         EC_KEY_up_ref(key);
 549     return ret;
 550 }
 551
 552 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey)
 553 {
 554     if (pkey->type != EVP_PKEY_EC) {
 555         EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
 556         return NULL;
 557     }
 558     return pkey->pkey.ec;
 559 }
 560
 561 EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)
 562 {
 563     EC_KEY *ret = EVP_PKEY_get0_EC_KEY(pkey);
 564     if (ret != NULL)
 565         EC_KEY_up_ref(ret);
 566     return ret;
 567 }
 568 #endif
 569
 570 #ifndef OPENSSL_NO_DH
 571
 572 int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
 573 {
 574     int ret = EVP_PKEY_assign_DH(pkey, key);
 575     if (ret)
 576         DH_up_ref(key);
 577     return ret;
 578 }
 579
 580 DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey)
 581 {
 582     if (pkey->type != EVP_PKEY_DH && pkey->type != EVP_PKEY_DHX) {
 583         EVPerr(EVP_F_EVP_PKEY_GET0_DH, EVP_R_EXPECTING_A_DH_KEY);
 584         return NULL;
 585     }
 586     return pkey->pkey.dh;
 587 }
 588
 589 DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
 590 {
 591     DH *ret = EVP_PKEY_get0_DH(pkey);
 592     if (ret != NULL)
 593         DH_up_ref(ret);
 594     return ret;
 595 }
 596 #endif
 597
 598 int EVP_PKEY_type(int type)
 599 {
 600     int ret;
 601     const EVP_PKEY_ASN1_METHOD *ameth;
 602     ENGINE *e;
 603     ameth = EVP_PKEY_asn1_find(&e, type);
 604     if (ameth)
 605         ret = ameth->pkey_id;
 606     else
 607         ret = NID_undef;
 608 #ifndef OPENSSL_NO_ENGINE
 609     ENGINE_finish(e);
 610 #endif
 611     return ret;
 612 }
 613
 614 int EVP_PKEY_id(const EVP_PKEY *pkey)
 615 {
 616     return pkey->type;
 617 }
 618
 619 int EVP_PKEY_base_id(const EVP_PKEY *pkey)
 620 {
 621     return EVP_PKEY_type(pkey->type);
 622 }
 623
 624 void EVP_PKEY_free(EVP_PKEY *x)
 625 {
 626     int i;
 627
 628     if (x == NULL)
 629         return;
 630
 631     CRYPTO_DOWN_REF(&x->references, &i, x->lock);
 632     REF_PRINT_COUNT("EVP_PKEY", x);
 633     if (i > 0)
 634         return;
 635     REF_ASSERT_ISNT(i < 0);
 636     EVP_PKEY_free_it(x);
 637     CRYPTO_THREAD_lock_free(x->lock);
 638     sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
 639     OPENSSL_free(x);
 640 }
 641
 642 static void EVP_PKEY_free_it(EVP_PKEY *x)
 643 {
 644     /* internal function; x is never NULL */
 645
 646     evp_keymgmt_clear_pkey_cache(x);
 647
 648     if (x->ameth && x->ameth->pkey_free) {
 649         x->ameth->pkey_free(x);
 650         x->pkey.ptr = NULL;
 651     }
 652 #ifndef OPENSSL_NO_ENGINE
 653     ENGINE_finish(x->engine);
 654     x->engine = NULL;
 655     ENGINE_finish(x->pmeth_engine);
 656     x->pmeth_engine = NULL;
 657 #endif
 658 }
 659
 660 static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,
 661                      const char *kstr)
 662 {
 663     BIO_indent(out, indent, 128);
 664     BIO_printf(out, "%s algorithm \"%s\" unsupported\n",
 665                kstr, OBJ_nid2ln(pkey->type));
 666     return 1;
 667 }
 668
 669 int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey,
 670                           int indent, ASN1_PCTX *pctx)
 671 {
 672     if (pkey->ameth && pkey->ameth->pub_print)
 673         return pkey->ameth->pub_print(out, pkey, indent, pctx);
 674
 675     return unsup_alg(out, pkey, indent, "Public Key");
 676 }
 677
 678 int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey,
 679                            int indent, ASN1_PCTX *pctx)
 680 {
 681     if (pkey->ameth && pkey->ameth->priv_print)
 682         return pkey->ameth->priv_print(out, pkey, indent, pctx);
 683
 684     return unsup_alg(out, pkey, indent, "Private Key");
 685 }
 686
 687 int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
 688                           int indent, ASN1_PCTX *pctx)
 689 {
 690     if (pkey->ameth && pkey->ameth->param_print)
 691         return pkey->ameth->param_print(out, pkey, indent, pctx);
 692     return unsup_alg(out, pkey, indent, "Parameters");
 693 }
 694
 695 static int evp_pkey_asn1_ctrl(EVP_PKEY *pkey, int op, int arg1, void *arg2)
 696 {
 697     if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL)
 698         return -2;
 699     return pkey->ameth->pkey_ctrl(pkey, op, arg1, arg2);
 700 }
 701
 702 int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
 703 {
 704     return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
 705 }
 706
 707 int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid)
 708 {
 709     int rv, default_nid;
 710
 711     rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SUPPORTS_MD_NID, nid, NULL);
 712     if (rv == -2) {
 713         /*
 714          * If there is a mandatory default digest and this isn't it, then
 715          * the answer is 'no'.
 716          */
 717         rv = EVP_PKEY_get_default_digest_nid(pkey, &default_nid);
 718         if (rv == 2)
 719             return (nid == default_nid);
 720         /* zero is an error from EVP_PKEY_get_default_digest_nid() */
 721         if (rv == 0)
 722             return -1;
 723     }
 724     return rv;
 725 }
 726
 727 int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
 728                                const unsigned char *pt, size_t ptlen)
 729 {
 730     if (ptlen > INT_MAX)
 731         return 0;
 732     if (evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SET1_TLS_ENCPT, ptlen,
 733                            (void *)pt) <= 0)
 734         return 0;
 735     return 1;
 736 }
 737
 738 size_t EVP_PKEY_get1_tls_encodedpoint(EVP_PKEY *pkey, unsigned char **ppt)
 739 {
 740     int rv;
 741     rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_GET1_TLS_ENCPT, 0, ppt);
 742     if (rv <= 0)
 743         return 0;
 744     return rv;
 745 }