]> git.ipfire.org Git - thirdparty/openssl.git/blame - crypto/evp/p_lib.c
Fix crypto/bio/b_sock.c for VMS
[thirdparty/openssl.git] / crypto / evp / p_lib.c
CommitLineData
62867571 1/*
4333b89f 2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6 3 *
4a8b0c55 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
62867571
RS
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
d02b48c6
RE
8 */
9
f41ac0ee
P
10/*
11 * DSA low level APIs are deprecated for public use, but still ok for
12 * internal use.
13 */
14#include "internal/deprecated.h"
15
b574c6a9 16#include <assert.h>
d02b48c6 17#include <stdio.h>
b39fc560 18#include "internal/cryptlib.h"
cd420b0b 19#include "internal/refcount.h"
5060cd5f 20#include "internal/namemap.h"
4d94ae00
BM
21#include <openssl/bn.h>
22#include <openssl/err.h>
ec577822
BM
23#include <openssl/objects.h>
24#include <openssl/evp.h>
ec577822 25#include <openssl/x509.h>
3c27208f
RS
26#include <openssl/rsa.h>
27#include <openssl/dsa.h>
28#include <openssl/dh.h>
4f76d62f 29#include <openssl/ec.h>
b3831fbb 30#include <openssl/cmac.h>
3c27208f 31#include <openssl/engine.h>
e74bd290 32#include <openssl/params.h>
1c4f340d 33#include <openssl/param_build.h>
ece9304c 34#include <openssl/encoder.h>
e74bd290 35#include <openssl/core_names.h>
01b8b3c7 36
88bddad4 37#include "internal/ffc.h"
25f2138b
DMSP
38#include "crypto/asn1.h"
39#include "crypto/evp.h"
b247113c
TM
40#include "crypto/dh.h"
41#include "crypto/dsa.h"
565b3399 42#include "crypto/ec.h"
7c664b1f 43#include "crypto/ecx.h"
b247113c 44#include "crypto/rsa.h"
2145ba5e 45#include "crypto/x509.h"
e74bd290 46#include "internal/provider.h"
f6aa5774 47#include "evp_local.h"
18e377b4 48
4f76d62f
RL
49#include "e_os.h" /* strcasecmp on Windows */
50
8243d8d1
RL
51static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
52 int len, EVP_KEYMGMT *keymgmt);
e683582b
SL
53static void evp_pkey_free_it(EVP_PKEY *key);
54
f844f9eb 55#ifndef FIPS_MODULE
bb2297a4 56
8158cf20
RL
57/* The type of parameters selected in key parameter functions */
58# define SELECT_PARAMETERS OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS
59
8900f3e3 60int EVP_PKEY_bits(const EVP_PKEY *pkey)
0f113f3e 61{
030da844
RL
62 int size = 0;
63
6508e858 64 if (pkey != NULL) {
030da844
RL
65 size = pkey->cache.bits;
66 if (pkey->ameth != NULL && pkey->ameth->pkey_bits != NULL)
67 size = pkey->ameth->pkey_bits(pkey);
6508e858 68 }
030da844 69 return size < 0 ? 0 : size;
0f113f3e 70}
58964a49 71
2514fa79 72int EVP_PKEY_security_bits(const EVP_PKEY *pkey)
0f113f3e 73{
030da844
RL
74 int size = 0;
75
76 if (pkey != NULL) {
77 size = pkey->cache.security_bits;
78 if (pkey->ameth != NULL && pkey->ameth->pkey_security_bits != NULL)
79 size = pkey->ameth->pkey_security_bits(pkey);
80 }
81 return size < 0 ? 0 : size;
0f113f3e 82}
2514fa79 83
6b691a5c 84int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode)
0f113f3e 85{
e683582b 86# ifndef OPENSSL_NO_DSA
0f113f3e
MC
87 if (pkey->type == EVP_PKEY_DSA) {
88 int ret = pkey->save_parameters;
89
90 if (mode >= 0)
91 pkey->save_parameters = mode;
26a7d938 92 return ret;
0f113f3e 93 }
e683582b
SL
94# endif
95# ifndef OPENSSL_NO_EC
0f113f3e
MC
96 if (pkey->type == EVP_PKEY_EC) {
97 int ret = pkey->save_parameters;
98
99 if (mode >= 0)
100 pkey->save_parameters = mode;
26a7d938 101 return ret;
0f113f3e 102 }
e683582b 103# endif
26a7d938 104 return 0;
0f113f3e 105}
d02b48c6 106
ff1f7cde
AT
107int EVP_PKEY_set_ex_data(EVP_PKEY *key, int idx, void *arg)
108{
109 return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
110}
111
112void *EVP_PKEY_get_ex_data(const EVP_PKEY *key, int idx)
113{
114 return CRYPTO_get_ex_data(&key->ex_data, idx);
115}
116
a8b72844 117int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
0f113f3e 118{
ff3b59e1 119 /*
5b5eea4b 120 * Clean up legacy stuff from this function when legacy support is gone.
ff3b59e1
RL
121 */
122
93d6132a
RL
123 EVP_PKEY *downgraded_from = NULL;
124 int ok = 0;
125
ff3b59e1 126 /*
93d6132a
RL
127 * If |to| is a legacy key and |from| isn't, we must make a downgraded
128 * copy of |from|. If that fails, this function fails.
ff3b59e1 129 */
93d6132a
RL
130 if (evp_pkey_is_legacy(to) && evp_pkey_is_provided(from)) {
131 if (!evp_pkey_copy_downgraded(&downgraded_from, from))
132 goto end;
133 from = downgraded_from;
134 }
acb90ba8
RL
135
136 /*
137 * Make sure |to| is typed. Content is less important at this early
138 * stage.
139 *
140 * 1. If |to| is untyped, assign |from|'s key type to it.
141 * 2. If |to| contains a legacy key, compare its |type| to |from|'s.
142 * (|from| was already downgraded above)
143 *
144 * If |to| is a provided key, there's nothing more to do here, functions
145 * like evp_keymgmt_util_copy() and evp_pkey_export_to_provider() called
146 * further down help us find out if they are the same or not.
147 */
5e5bc836
RL
148 if (evp_pkey_is_blank(to)) {
149 if (evp_pkey_is_legacy(from)) {
ff3b59e1 150 if (EVP_PKEY_set_type(to, from->type) == 0)
93d6132a 151 goto end;
acb90ba8
RL
152 } else {
153 if (EVP_PKEY_set_type_by_keymgmt(to, from->keymgmt) == 0)
93d6132a 154 goto end;
acb90ba8 155 }
5e5bc836 156 } else if (evp_pkey_is_legacy(to)) {
acb90ba8 157 if (to->type != from->type) {
9311d0c4 158 ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES);
93d6132a 159 goto end;
ff3b59e1 160 }
0f113f3e
MC
161 }
162
163 if (EVP_PKEY_missing_parameters(from)) {
9311d0c4 164 ERR_raise(ERR_LIB_EVP, EVP_R_MISSING_PARAMETERS);
93d6132a 165 goto end;
0f113f3e 166 }
f72f00d4
DSH
167
168 if (!EVP_PKEY_missing_parameters(to)) {
c74aaa39 169 if (EVP_PKEY_parameters_eq(to, from) == 1)
93d6132a
RL
170 ok = 1;
171 else
172 ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_PARAMETERS);
173 goto end;
f72f00d4
DSH
174 }
175
ff3b59e1 176 /* For purely provided keys, we just call the keymgmt utility */
93d6132a
RL
177 if (to->keymgmt != NULL && from->keymgmt != NULL) {
178 ok = evp_keymgmt_util_copy(to, (EVP_PKEY *)from, SELECT_PARAMETERS);
179 goto end;
180 }
ff3b59e1
RL
181
182 /*
183 * If |to| is provided, we know that |from| is legacy at this point.
85fcc3fb 184 * Try exporting |from| to |to|'s keymgmt, then use evp_keymgmt_dup()
ff3b59e1 185 * to copy the appropriate data to |to|'s keydata.
85fcc3fb
TM
186 * We cannot override existing data so do it only if there is no keydata
187 * in |to| yet.
ff3b59e1 188 */
85fcc3fb 189 if (to->keymgmt != NULL && to->keydata == NULL) {
ff3b59e1
RL
190 EVP_KEYMGMT *to_keymgmt = to->keymgmt;
191 void *from_keydata =
192 evp_pkey_export_to_provider((EVP_PKEY *)from, NULL, &to_keymgmt,
193 NULL);
194
acb90ba8
RL
195 /*
196 * If we get a NULL, it could be an internal error, or it could be
197 * that there's a key mismatch. We're pretending the latter...
198 */
93d6132a 199 if (from_keydata == NULL)
acb90ba8 200 ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES);
93d6132a 201 else
85fcc3fb
TM
202 ok = (to->keydata = evp_keymgmt_dup(to->keymgmt,
203 from_keydata,
204 SELECT_PARAMETERS)) != NULL;
93d6132a 205 goto end;
ff3b59e1
RL
206 }
207
208 /* Both keys are legacy */
209 if (from->ameth != NULL && from->ameth->param_copy != NULL)
93d6132a
RL
210 ok = from->ameth->param_copy(to, from);
211 end:
212 EVP_PKEY_free(downgraded_from);
213 return ok;
0f113f3e 214}
d02b48c6 215
af0f0f3e 216int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey)
0f113f3e 217{
157ded39
RL
218 if (pkey != NULL) {
219 if (pkey->keymgmt != NULL)
8158cf20 220 return !evp_keymgmt_util_has((EVP_PKEY *)pkey, SELECT_PARAMETERS);
157ded39
RL
221 else if (pkey->ameth != NULL && pkey->ameth->param_missing != NULL)
222 return pkey->ameth->param_missing(pkey);
223 }
0f113f3e
MC
224 return 0;
225}
d02b48c6 226
1e9101c4
RL
227/*
228 * This function is called for any mixture of keys except pure legacy pair.
37cddb2e 229 * When legacy keys are gone, we replace a call to this functions with
1e9101c4
RL
230 * a call to evp_keymgmt_util_match().
231 */
232static int evp_pkey_cmp_any(const EVP_PKEY *a, const EVP_PKEY *b,
233 int selection)
234{
235 EVP_KEYMGMT *keymgmt1 = NULL, *keymgmt2 = NULL;
236 void *keydata1 = NULL, *keydata2 = NULL, *tmp_keydata = NULL;
237
238 /* If none of them are provided, this function shouldn't have been called */
a57fc730 239 if (!ossl_assert(evp_pkey_is_provided(a) || evp_pkey_is_provided(b)))
1e9101c4
RL
240 return -2;
241
242 /* For purely provided keys, we just call the keymgmt utility */
a57fc730 243 if (evp_pkey_is_provided(a) && evp_pkey_is_provided(b))
1e9101c4
RL
244 return evp_keymgmt_util_match((EVP_PKEY *)a, (EVP_PKEY *)b, selection);
245
246 /*
acb90ba8
RL
247 * At this point, one of them is provided, the other not. This allows
248 * us to compare types using legacy NIDs.
249 */
a57fc730
RL
250 if (evp_pkey_is_legacy(a)
251 && !EVP_KEYMGMT_is_a(b->keymgmt, OBJ_nid2sn(a->type)))
252 return -1; /* not the same key type */
253 if (evp_pkey_is_legacy(b)
254 && !EVP_KEYMGMT_is_a(a->keymgmt, OBJ_nid2sn(b->type)))
acb90ba8
RL
255 return -1; /* not the same key type */
256
257 /*
258 * We've determined that they both are the same keytype, so the next
259 * step is to do a bit of cross export to ensure we have keydata for
260 * both keys in the same keymgmt.
1e9101c4
RL
261 */
262 keymgmt1 = a->keymgmt;
263 keydata1 = a->keydata;
264 keymgmt2 = b->keymgmt;
265 keydata2 = b->keydata;
266
1e9101c4
RL
267 if (keymgmt2 != NULL && keymgmt2->match != NULL) {
268 tmp_keydata =
269 evp_pkey_export_to_provider((EVP_PKEY *)a, NULL, &keymgmt2, NULL);
270 if (tmp_keydata != NULL) {
271 keymgmt1 = keymgmt2;
272 keydata1 = tmp_keydata;
273 }
274 }
275 if (tmp_keydata == NULL && keymgmt1 != NULL && keymgmt1->match != NULL) {
276 tmp_keydata =
277 evp_pkey_export_to_provider((EVP_PKEY *)b, NULL, &keymgmt1, NULL);
278 if (tmp_keydata != NULL) {
279 keymgmt2 = keymgmt1;
280 keydata2 = tmp_keydata;
281 }
282 }
283
284 /* If we still don't have matching keymgmt implementations, we give up */
285 if (keymgmt1 != keymgmt2)
286 return -2;
287
a24b510c
RL
288 /* If the keymgmt implementations are NULL, the export failed */
289 if (keymgmt1 == NULL)
290 return -2;
291
1e9101c4
RL
292 return evp_keymgmt_match(keymgmt1, keydata1, keydata2, selection);
293}
294
c85c5e1a 295# ifndef OPENSSL_NO_DEPRECATED_3_0
af0f0f3e 296int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
c74aaa39
DDO
297{
298 return EVP_PKEY_parameters_eq(a, b);
299}
c85c5e1a 300#endif
c74aaa39
DDO
301
302int EVP_PKEY_parameters_eq(const EVP_PKEY *a, const EVP_PKEY *b)
0f113f3e 303{
1e9101c4 304 /*
37cddb2e 305 * This will just call evp_keymgmt_util_match when legacy support
1e9101c4
RL
306 * is gone.
307 */
308
309 if (a->keymgmt != NULL || b->keymgmt != NULL)
8158cf20 310 return evp_pkey_cmp_any(a, b, SELECT_PARAMETERS);
1e9101c4
RL
311
312 /* All legacy keys */
0f113f3e
MC
313 if (a->type != b->type)
314 return -1;
1e9101c4 315 if (a->ameth != NULL && a->ameth->param_cmp != NULL)
0f113f3e
MC
316 return a->ameth->param_cmp(a, b);
317 return -2;
318}
58964a49 319
c85c5e1a 320# ifndef OPENSSL_NO_DEPRECATED_3_0
af0f0f3e 321int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
c74aaa39
DDO
322{
323 return EVP_PKEY_eq(a, b);
324}
c85c5e1a 325#endif
c74aaa39
DDO
326
327int EVP_PKEY_eq(const EVP_PKEY *a, const EVP_PKEY *b)
0f113f3e 328{
1e9101c4 329 /*
37cddb2e 330 * This will just call evp_keymgmt_util_match when legacy support
1e9101c4
RL
331 * is gone.
332 */
333
5af6e154
TM
334 /* Trivial shortcuts */
335 if (a == b)
336 return 1;
337 if (a == NULL || b == NULL)
338 return 0;
339
1e9101c4 340 if (a->keymgmt != NULL || b->keymgmt != NULL)
8158cf20
RL
341 return evp_pkey_cmp_any(a, b, (SELECT_PARAMETERS
342 | OSSL_KEYMGMT_SELECT_PUBLIC_KEY));
1e9101c4
RL
343
344 /* All legacy keys */
0f113f3e
MC
345 if (a->type != b->type)
346 return -1;
347
1e9101c4 348 if (a->ameth != NULL) {
0f113f3e
MC
349 int ret;
350 /* Compare parameters if the algorithm has them */
1e9101c4 351 if (a->ameth->param_cmp != NULL) {
0f113f3e
MC
352 ret = a->ameth->param_cmp(a, b);
353 if (ret <= 0)
354 return ret;
355 }
356
1e9101c4 357 if (a->ameth->pub_cmp != NULL)
0f113f3e
MC
358 return a->ameth->pub_cmp(a, b);
359 }
360
361 return -2;
362}
e6526fbf 363
1c4f340d 364
b4250010 365static EVP_PKEY *new_raw_key_int(OSSL_LIB_CTX *libctx,
1c4f340d
MC
366 const char *strtype,
367 const char *propq,
368 int nidtype,
369 ENGINE *e,
370 const unsigned char *key,
371 size_t len,
372 int key_is_priv)
a08802ce 373{
1c4f340d
MC
374 EVP_PKEY *pkey = NULL;
375 EVP_PKEY_CTX *ctx = NULL;
376 const EVP_PKEY_ASN1_METHOD *ameth = NULL;
377 int result = 0;
378
379# ifndef OPENSSL_NO_ENGINE
380 /* Check if there is an Engine for this type */
381 if (e == NULL) {
382 ENGINE *tmpe = NULL;
383
384 if (strtype != NULL)
385 ameth = EVP_PKEY_asn1_find_str(&tmpe, strtype, -1);
386 else if (nidtype != EVP_PKEY_NONE)
387 ameth = EVP_PKEY_asn1_find(&tmpe, nidtype);
388
389 /* If tmpe is NULL then no engine is claiming to support this type */
390 if (tmpe == NULL)
391 ameth = NULL;
392
393 ENGINE_finish(tmpe);
394 }
395# endif
a08802ce 396
1c4f340d
MC
397 if (e == NULL && ameth == NULL) {
398 /*
399 * No engine is claiming to support this type, so lets see if we have
400 * a provider.
401 */
402 ctx = EVP_PKEY_CTX_new_from_name(libctx,
403 strtype != NULL ? strtype
404 : OBJ_nid2sn(nidtype),
405 propq);
4feda976 406 if (ctx == NULL)
1c4f340d 407 goto err;
1c4f340d
MC
408 /* May fail if no provider available */
409 ERR_set_mark();
2db985b7 410 if (EVP_PKEY_fromdata_init(ctx) == 1) {
1c4f340d
MC
411 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
412
413 ERR_clear_last_mark();
414 params[0] = OSSL_PARAM_construct_octet_string(
415 key_is_priv ? OSSL_PKEY_PARAM_PRIV_KEY
416 : OSSL_PKEY_PARAM_PUB_KEY,
417 (void *)key, len);
418
2db985b7 419 if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) != 1) {
9311d0c4 420 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
1c4f340d
MC
421 goto err;
422 }
423
424 EVP_PKEY_CTX_free(ctx);
425
426 return pkey;
427 }
428 ERR_pop_to_mark();
429 /* else not supported so fallback to legacy */
a08802ce
MC
430 }
431
1c4f340d
MC
432 /* Legacy code path */
433
434 pkey = EVP_PKEY_new();
435 if (pkey == NULL) {
9311d0c4 436 ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
a08802ce
MC
437 goto err;
438 }
439
1c4f340d
MC
440 if (!pkey_set_type(pkey, e, nidtype, strtype, -1, NULL)) {
441 /* EVPerr already called */
a08802ce
MC
442 goto err;
443 }
444
1c4f340d
MC
445 if (!ossl_assert(pkey->ameth != NULL))
446 goto err;
a08802ce 447
1c4f340d
MC
448 if (key_is_priv) {
449 if (pkey->ameth->set_priv_key == NULL) {
9311d0c4 450 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
1c4f340d
MC
451 goto err;
452 }
a08802ce 453
1c4f340d 454 if (!pkey->ameth->set_priv_key(pkey, key, len)) {
9311d0c4 455 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
1c4f340d
MC
456 goto err;
457 }
458 } else {
459 if (pkey->ameth->set_pub_key == NULL) {
9311d0c4 460 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
1c4f340d
MC
461 goto err;
462 }
a08802ce 463
1c4f340d 464 if (!pkey->ameth->set_pub_key(pkey, key, len)) {
9311d0c4 465 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
1c4f340d
MC
466 goto err;
467 }
a08802ce
MC
468 }
469
1c4f340d
MC
470 result = 1;
471 err:
472 if (!result) {
473 EVP_PKEY_free(pkey);
474 pkey = NULL;
a08802ce 475 }
1c4f340d
MC
476 EVP_PKEY_CTX_free(ctx);
477 return pkey;
478}
a08802ce 479
b4250010 480EVP_PKEY *EVP_PKEY_new_raw_private_key_ex(OSSL_LIB_CTX *libctx,
d8652be0
MC
481 const char *keytype,
482 const char *propq,
483 const unsigned char *priv, size_t len)
1c4f340d
MC
484{
485 return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, priv,
486 len, 1);
487}
a08802ce 488
1c4f340d
MC
489EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
490 const unsigned char *priv,
491 size_t len)
492{
493 return new_raw_key_int(NULL, NULL, NULL, type, e, priv, len, 1);
494}
a08802ce 495
b4250010 496EVP_PKEY *EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX *libctx,
d8652be0
MC
497 const char *keytype, const char *propq,
498 const unsigned char *pub, size_t len)
1c4f340d
MC
499{
500 return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, pub,
501 len, 0);
502}
503
504EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
505 const unsigned char *pub,
506 size_t len)
507{
508 return new_raw_key_int(NULL, NULL, NULL, type, e, pub, len, 0);
a08802ce
MC
509}
510
c19d8978
MC
511struct raw_key_details_st
512{
513 unsigned char **key;
514 size_t *len;
515 int selection;
516};
517
518static OSSL_CALLBACK get_raw_key_details;
519static int get_raw_key_details(const OSSL_PARAM params[], void *arg)
520{
521 const OSSL_PARAM *p = NULL;
522 struct raw_key_details_st *raw_key = arg;
523
524 if (raw_key->selection == OSSL_KEYMGMT_SELECT_PRIVATE_KEY) {
525 if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY))
526 != NULL)
527 return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
528 SIZE_MAX, raw_key->len);
529 } else if (raw_key->selection == OSSL_KEYMGMT_SELECT_PUBLIC_KEY) {
530 if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY))
531 != NULL)
532 return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
533 SIZE_MAX, raw_key->len);
534 }
535
536 return 0;
537}
538
0d124b0a
MC
539int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
540 size_t *len)
541{
c19d8978
MC
542 if (pkey->keymgmt != NULL) {
543 struct raw_key_details_st raw_key;
544
545 raw_key.key = priv == NULL ? NULL : &priv;
546 raw_key.len = len;
547 raw_key.selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
548
655f73ce
RL
549 return evp_keymgmt_util_export(pkey, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
550 get_raw_key_details, &raw_key);
c19d8978
MC
551 }
552
553 if (pkey->ameth == NULL) {
9311d0c4 554 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
c19d8978
MC
555 return 0;
556 }
557
558 if (pkey->ameth->get_priv_key == NULL) {
9311d0c4 559 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
0d124b0a
MC
560 return 0;
561 }
562
563 if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
9311d0c4 564 ERR_raise(ERR_LIB_EVP, EVP_R_GET_RAW_KEY_FAILED);
0d124b0a
MC
565 return 0;
566 }
567
568 return 1;
569}
570
571int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
572 size_t *len)
573{
c19d8978
MC
574 if (pkey->keymgmt != NULL) {
575 struct raw_key_details_st raw_key;
576
577 raw_key.key = pub == NULL ? NULL : &pub;
578 raw_key.len = len;
579 raw_key.selection = OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
580
655f73ce
RL
581 return evp_keymgmt_util_export(pkey, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
582 get_raw_key_details, &raw_key);
c19d8978
MC
583 }
584
585 if (pkey->ameth == NULL) {
9311d0c4 586 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
c19d8978
MC
587 return 0;
588 }
589
0d124b0a 590 if (pkey->ameth->get_pub_key == NULL) {
9311d0c4 591 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
0d124b0a
MC
592 return 0;
593 }
594
595 if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
9311d0c4 596 ERR_raise(ERR_LIB_EVP, EVP_R_GET_RAW_KEY_FAILED);
0d124b0a
MC
597 return 0;
598 }
599
600 return 1;
601}
602
a540ef90
MC
603static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len,
604 const char *cipher_name,
b4250010
DMSP
605 const EVP_CIPHER *cipher,
606 OSSL_LIB_CTX *libctx,
a540ef90 607 const char *propq, ENGINE *e)
b3831fbb 608{
e683582b
SL
609# ifndef OPENSSL_NO_CMAC
610# ifndef OPENSSL_NO_ENGINE
9a7846df 611 const char *engine_id = e != NULL ? ENGINE_get_id(e) : NULL;
e683582b 612# endif
2ef9a7ac 613 OSSL_PARAM params[5], *p = params;
a540ef90
MC
614 EVP_PKEY *pkey = NULL;
615 EVP_PKEY_CTX *ctx;
616
617 if (cipher != NULL)
618 cipher_name = EVP_CIPHER_name(cipher);
619
620 if (cipher_name == NULL) {
9311d0c4 621 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
a540ef90
MC
622 return NULL;
623 }
624
625 ctx = EVP_PKEY_CTX_new_from_name(libctx, "CMAC", propq);
20d56d6d 626 if (ctx == NULL)
a540ef90 627 goto err;
a540ef90 628
2db985b7 629 if (!EVP_PKEY_fromdata_init(ctx)) {
9311d0c4 630 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
b3831fbb
MC
631 goto err;
632 }
633
a540ef90
MC
634 *p++ = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PRIV_KEY,
635 (void *)priv, len);
636 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_CIPHER,
637 (char *)cipher_name, 0);
2ef9a7ac
MC
638 if (propq != NULL)
639 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_PROPERTIES,
640 (char *)propq, 0);
e683582b 641# ifndef OPENSSL_NO_ENGINE
9a7846df 642 if (engine_id != NULL)
a540ef90
MC
643 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_ENGINE,
644 (char *)engine_id, 0);
e683582b 645# endif
a540ef90 646 *p = OSSL_PARAM_construct_end();
3be06e0d 647
2db985b7 648 if (!EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params)) {
9311d0c4 649 ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
b3831fbb
MC
650 goto err;
651 }
652
b3831fbb 653 err:
a540ef90
MC
654 EVP_PKEY_CTX_free(ctx);
655
656 return pkey;
e683582b 657# else
9311d0c4 658 ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
df6d51e2 659 return NULL;
e683582b 660# endif
b3831fbb 661}
a08802ce 662
a540ef90
MC
663EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
664 size_t len, const EVP_CIPHER *cipher)
665{
666 return new_cmac_key_int(priv, len, NULL, cipher, NULL, NULL, e);
667}
668
01b8b3c7 669int EVP_PKEY_set_type(EVP_PKEY *pkey, int type)
0f113f3e 670{
8243d8d1 671 return pkey_set_type(pkey, NULL, type, NULL, -1, NULL);
0f113f3e 672}
01b8b3c7
DSH
673
674int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len)
0f113f3e 675{
8243d8d1 676 return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, str, len, NULL);
0f113f3e 677}
2f2e6b62 678
e683582b 679# ifndef OPENSSL_NO_ENGINE
d19b01ad
DSH
680int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e)
681{
682 if (e != NULL) {
683 if (!ENGINE_init(e)) {
9311d0c4 684 ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB);
d19b01ad
DSH
685 return 0;
686 }
687 if (ENGINE_get_pkey_meth(e, pkey->type) == NULL) {
688 ENGINE_finish(e);
9311d0c4 689 ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM);
d19b01ad
DSH
690 return 0;
691 }
692 }
693 ENGINE_finish(pkey->pmeth_engine);
694 pkey->pmeth_engine = e;
695 return 1;
696}
229f7b38
DB
697
698ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey)
699{
700 return pkey->engine;
701}
e683582b 702# endif
8e53d94d
MC
703
704# ifndef OPENSSL_NO_DEPRECATED_3_0
b247113c
TM
705static void detect_foreign_key(EVP_PKEY *pkey)
706{
707 switch (pkey->type) {
708 case EVP_PKEY_RSA:
709 pkey->foreign = pkey->pkey.rsa != NULL
710 && ossl_rsa_is_foreign(pkey->pkey.rsa);
711 break;
712# ifndef OPENSSL_NO_EC
713 case EVP_PKEY_SM2:
714 case EVP_PKEY_EC:
715 pkey->foreign = pkey->pkey.ec != NULL
716 && ossl_ec_key_is_foreign(pkey->pkey.ec);
717 break;
718# endif
719# ifndef OPENSSL_NO_DSA
720 case EVP_PKEY_DSA:
721 pkey->foreign = pkey->pkey.dsa != NULL
722 && ossl_dsa_is_foreign(pkey->pkey.dsa);
723 break;
724#endif
725# ifndef OPENSSL_NO_DH
726 case EVP_PKEY_DH:
727 pkey->foreign = pkey->pkey.dh != NULL
728 && ossl_dh_is_foreign(pkey->pkey.dh);
729 break;
730#endif
731 default:
732 pkey->foreign = 0;
733 break;
734 }
735}
736
01b8b3c7 737int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key)
0f113f3e 738{
8e53d94d 739# ifndef OPENSSL_NO_EC
28fd8953
MC
740 int pktype;
741
742 pktype = EVP_PKEY_type(type);
743 if ((key != NULL) && (pktype == EVP_PKEY_EC || pktype == EVP_PKEY_SM2)) {
f4e4382c
RL
744 const EC_GROUP *group = EC_KEY_get0_group(key);
745
28fd8953
MC
746 if (group != NULL) {
747 int curve = EC_GROUP_get_curve_name(group);
748
749 /*
750 * Regardless of what is requested the SM2 curve must be SM2 type,
751 * and non SM2 curves are EC type.
752 */
753 if (curve == NID_sm2 && pktype == EVP_PKEY_EC)
754 type = EVP_PKEY_SM2;
755 else if(curve != NID_sm2 && pktype == EVP_PKEY_SM2)
756 type = EVP_PKEY_EC;
757 }
f4e4382c 758 }
8e53d94d 759# endif
f4e4382c 760
e34c66c6 761 if (pkey == NULL || !EVP_PKEY_set_type(pkey, type))
0f113f3e 762 return 0;
28fd8953 763
0f113f3e 764 pkey->pkey.ptr = key;
b247113c
TM
765 detect_foreign_key(pkey);
766
0f113f3e
MC
767 return (key != NULL);
768}
8e53d94d 769# endif
d02b48c6 770
896dcda1 771void *EVP_PKEY_get0(const EVP_PKEY *pkey)
0f113f3e 772{
3c1ccfea
SL
773 if (pkey == NULL)
774 return NULL;
b574c6a9 775
896dcda1
DB
776 if (!evp_pkey_is_provided(pkey))
777 return pkey->pkey.ptr;
778
779 return NULL;
0f113f3e 780}
db98bbc1 781
ebad0b0b
NM
782const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len)
783{
7bc0fdd3 784 const ASN1_OCTET_STRING *os = NULL;
ebad0b0b 785 if (pkey->type != EVP_PKEY_HMAC) {
9311d0c4 786 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_AN_HMAC_KEY);
ebad0b0b
NM
787 return NULL;
788 }
896dcda1
DB
789 os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
790 if (os != NULL) {
791 *len = os->length;
792 return os->data;
793 }
794 return NULL;
ebad0b0b
NM
795}
796
e683582b 797# ifndef OPENSSL_NO_POLY1305
52ad5b60
TS
798const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len)
799{
7bc0fdd3 800 const ASN1_OCTET_STRING *os = NULL;
52ad5b60 801 if (pkey->type != EVP_PKEY_POLY1305) {
9311d0c4 802 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_POLY1305_KEY);
52ad5b60
TS
803 return NULL;
804 }
896dcda1
DB
805 os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
806 if (os != NULL) {
807 *len = os->length;
808 return os->data;
809 }
810 return NULL;
52ad5b60 811}
e683582b 812# endif
52ad5b60 813
e683582b 814# ifndef OPENSSL_NO_SIPHASH
3f5616d7
TS
815const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len)
816{
7bc0fdd3 817 const ASN1_OCTET_STRING *os = NULL;
3f5616d7
TS
818
819 if (pkey->type != EVP_PKEY_SIPHASH) {
9311d0c4 820 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_SIPHASH_KEY);
3f5616d7
TS
821 return NULL;
822 }
896dcda1
DB
823 os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
824 if (os != NULL) {
825 *len = os->length;
826 return os->data;
827 }
828 return NULL;
3f5616d7 829}
e683582b 830# endif
3f5616d7 831
e683582b 832# ifndef OPENSSL_NO_DSA
7bc0fdd3 833static DSA *evp_pkey_get0_DSA_int(const EVP_PKEY *pkey)
0f113f3e
MC
834{
835 if (pkey->type != EVP_PKEY_DSA) {
9311d0c4 836 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_DSA_KEY);
0f113f3e
MC
837 return NULL;
838 }
b574c6a9 839 return evp_pkey_get_legacy((EVP_PKEY *)pkey);
f769ce3e 840}
2872dbe1 841
7bc0fdd3
MC
842const DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey)
843{
844 return evp_pkey_get0_DSA_int(pkey);
845}
846
b03ec3b5
SL
847int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
848{
849 int ret = EVP_PKEY_assign_DSA(pkey, key);
850 if (ret)
851 DSA_up_ref(key);
852 return ret;
853}
2872dbe1
DSH
854DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
855{
7bc0fdd3
MC
856 DSA *ret = evp_pkey_get0_DSA_int(pkey);
857
2872dbe1
DSH
858 if (ret != NULL)
859 DSA_up_ref(ret);
860 return ret;
861}
b03ec3b5 862# endif /* OPENSSL_NO_DSA */
f769ce3e 863
e683582b 864# ifndef OPENSSL_NO_EC
7bc0fdd3 865static const ECX_KEY *evp_pkey_get0_ECX_KEY(const EVP_PKEY *pkey, int type)
7c664b1f 866{
7c664b1f
RL
867 if (EVP_PKEY_base_id(pkey) != type) {
868 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_ECX_KEY);
869 return NULL;
870 }
b574c6a9 871 return evp_pkey_get_legacy((EVP_PKEY *)pkey);
7c664b1f
RL
872}
873
25b16562 874static ECX_KEY *evp_pkey_get1_ECX_KEY(EVP_PKEY *pkey, int type)
7c664b1f 875{
7bc0fdd3 876 ECX_KEY *ret = (ECX_KEY *)evp_pkey_get0_ECX_KEY(pkey, type);
8eca93f8
P
877
878 if (ret != NULL && !ossl_ecx_key_up_ref(ret))
879 ret = NULL;
7c664b1f
RL
880 return ret;
881}
882
883# define IMPLEMENT_ECX_VARIANT(NAME) \
32ab57cb 884 ECX_KEY *ossl_evp_pkey_get1_##NAME(EVP_PKEY *pkey) \
7c664b1f 885 { \
25b16562 886 return evp_pkey_get1_ECX_KEY(pkey, EVP_PKEY_##NAME); \
7c664b1f
RL
887 }
888IMPLEMENT_ECX_VARIANT(X25519)
889IMPLEMENT_ECX_VARIANT(X448)
890IMPLEMENT_ECX_VARIANT(ED25519)
891IMPLEMENT_ECX_VARIANT(ED448)
892
e683582b 893# endif
4d94ae00 894
5a267416 895# if !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_DEPRECATED_3_0)
52664f50 896
f1ffaaee 897int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *dhkey)
52664f50 898{
f1ffaaee
SL
899 int ret, type;
900
901 /*
902 * ossl_dh_is_named_safe_prime_group() returns 1 for named safe prime groups
903 * related to ffdhe and modp (which cache q = (p - 1) / 2),
904 * and returns 0 for all other dh parameter generation types including
905 * RFC5114 named groups.
906 *
907 * The EVP_PKEY_DH type is used for dh parameter generation types:
908 * - named safe prime groups related to ffdhe and modp
909 * - safe prime generator
910 *
911 * The type EVP_PKEY_DHX is used for dh parameter generation types
912 * - fips186-4 and fips186-2
913 * - rfc5114 named groups.
914 *
915 * The EVP_PKEY_DH type is used to save PKCS#3 data than can be stored
916 * without a q value.
917 * The EVP_PKEY_DHX type is used to save X9.42 data that requires the
918 * q value to be stored.
919 */
920 if (ossl_dh_is_named_safe_prime_group(dhkey))
921 type = EVP_PKEY_DH;
922 else
923 type = DH_get0_q(dhkey) == NULL ? EVP_PKEY_DH : EVP_PKEY_DHX;
924
925 ret = EVP_PKEY_assign(pkey, type, dhkey);
32c869ff 926
0f113f3e 927 if (ret)
f1ffaaee 928 DH_up_ref(dhkey);
0f113f3e 929 return ret;
52664f50
DSH
930}
931
7bc0fdd3 932DH *evp_pkey_get0_DH_int(const EVP_PKEY *pkey)
0f113f3e
MC
933{
934 if (pkey->type != EVP_PKEY_DH && pkey->type != EVP_PKEY_DHX) {
9311d0c4 935 ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_DH_KEY);
0f113f3e
MC
936 return NULL;
937 }
b574c6a9 938 return evp_pkey_get_legacy((EVP_PKEY *)pkey);
f769ce3e 939}
2872dbe1 940
7bc0fdd3
MC
941const DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey)
942{
943 return evp_pkey_get0_DH_int(pkey);
944}
945
2872dbe1
DSH
946DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
947{
7bc0fdd3
MC
948 DH *ret = evp_pkey_get0_DH_int(pkey);
949
2872dbe1
DSH
950 if (ret != NULL)
951 DH_up_ref(ret);
952 return ret;
953}
e683582b 954# endif
f769ce3e 955
6b691a5c 956int EVP_PKEY_type(int type)
0f113f3e
MC
957{
958 int ret;
959 const EVP_PKEY_ASN1_METHOD *ameth;
960 ENGINE *e;
961 ameth = EVP_PKEY_asn1_find(&e, type);
962 if (ameth)
963 ret = ameth->pkey_id;
964 else
965 ret = NID_undef;
e683582b 966# ifndef OPENSSL_NO_ENGINE
7c96dbcd 967 ENGINE_finish(e);
e683582b 968# endif
0f113f3e
MC
969 return ret;
970}
d02b48c6 971
7f57b076 972int EVP_PKEY_id(const EVP_PKEY *pkey)
0f113f3e
MC
973{
974 return pkey->type;
975}
7f57b076
DSH
976
977int EVP_PKEY_base_id(const EVP_PKEY *pkey)
0f113f3e
MC
978{
979 return EVP_PKEY_type(pkey->type);
980}
7f57b076 981
977e95b9
RL
982/*
983 * These hard coded cases are pure hackery to get around the fact
984 * that names in crypto/objects/objects.txt are a mess. There is
985 * no "EC", and "RSA" leads to the NID for 2.5.8.1.1, an OID that's
986 * fallen out in favor of { pkcs-1 1 }, i.e. 1.2.840.113549.1.1.1,
987 * the NID of which is used for EVP_PKEY_RSA. Strangely enough,
988 * "DSA" is accurate... but still, better be safe and hard-code
989 * names that we know.
990 * On a similar topic, EVP_PKEY_type(EVP_PKEY_SM2) will result in
991 * EVP_PKEY_EC, because of aliasing.
37cddb2e 992 * This should be cleaned away along with all other #legacy support.
977e95b9
RL
993 */
994static const OSSL_ITEM standard_name2type[] = {
995 { EVP_PKEY_RSA, "RSA" },
996 { EVP_PKEY_RSA_PSS, "RSA-PSS" },
997 { EVP_PKEY_EC, "EC" },
998 { EVP_PKEY_ED25519, "ED25519" },
999 { EVP_PKEY_ED448, "ED448" },
1000 { EVP_PKEY_X25519, "X25519" },
1001 { EVP_PKEY_X448, "X448" },
1002 { EVP_PKEY_SM2, "SM2" },
1003 { EVP_PKEY_DH, "DH" },
1004 { EVP_PKEY_DHX, "X9.42 DH" },
1005 { EVP_PKEY_DHX, "DHX" },
1006 { EVP_PKEY_DSA, "DSA" },
1007};
1008
50914496
RL
1009int evp_pkey_name2type(const char *name)
1010{
977e95b9
RL
1011 int type;
1012 size_t i;
1013
1014 for (i = 0; i < OSSL_NELEM(standard_name2type); i++) {
1015 if (strcasecmp(name, standard_name2type[i].ptr) == 0)
1016 return (int)standard_name2type[i].id;
1017 }
1018
1019 if ((type = EVP_PKEY_type(OBJ_sn2nid(name))) != NID_undef)
1020 return type;
1021 return EVP_PKEY_type(OBJ_ln2nid(name));
1022}
1023
1024const char *evp_pkey_type2name(int type)
1025{
1026 size_t i;
1027
1028 for (i = 0; i < OSSL_NELEM(standard_name2type); i++) {
1029 if (type == (int)standard_name2type[i].id)
1030 return standard_name2type[i].ptr;
1031 }
1032
1033 return OBJ_nid2sn(type);
50914496 1034}
50914496 1035
4f76d62f
RL
1036int EVP_PKEY_is_a(const EVP_PKEY *pkey, const char *name)
1037{
4f76d62f 1038 if (pkey->keymgmt == NULL) {
50914496 1039 int type = evp_pkey_name2type(name);
4f76d62f 1040
50914496 1041 return pkey->type == type;
4f76d62f 1042 }
4f76d62f
RL
1043 return EVP_KEYMGMT_is_a(pkey->keymgmt, name);
1044}
1045
ddf0d149
TM
1046int EVP_PKEY_type_names_do_all(const EVP_PKEY *pkey,
1047 void (*fn)(const char *name, void *data),
1048 void *data)
ae12eac0
RL
1049{
1050 if (!evp_pkey_is_typed(pkey))
d84f5515 1051 return 0;
ae12eac0
RL
1052
1053 if (!evp_pkey_is_provided(pkey)) {
1054 const char *name = OBJ_nid2sn(EVP_PKEY_id(pkey));
1055
1056 fn(name, data);
d84f5515 1057 return 1;
ae12eac0 1058 }
d84f5515 1059 return EVP_KEYMGMT_names_do_all(pkey->keymgmt, fn, data);
ae12eac0
RL
1060}
1061
4f76d62f
RL
1062int EVP_PKEY_can_sign(const EVP_PKEY *pkey)
1063{
1064 if (pkey->keymgmt == NULL) {
1065 switch (EVP_PKEY_base_id(pkey)) {
1066 case EVP_PKEY_RSA:
1067 return 1;
0e2f87c0 1068# ifndef OPENSSL_NO_DSA
4f76d62f
RL
1069 case EVP_PKEY_DSA:
1070 return 1;
0e2f87c0
TM
1071# endif
1072# ifndef OPENSSL_NO_EC
4f76d62f
RL
1073 case EVP_PKEY_ED25519:
1074 case EVP_PKEY_ED448:
1075 return 1;
1076 case EVP_PKEY_EC: /* Including SM2 */
1077 return EC_KEY_can_sign(pkey->pkey.ec);
0e2f87c0 1078# endif
4f76d62f
RL
1079 default:
1080 break;
1081 }
1082 } else {
1083 const OSSL_PROVIDER *prov = EVP_KEYMGMT_provider(pkey->keymgmt);
a829b735 1084 OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
4f76d62f
RL
1085 const char *supported_sig =
1086 pkey->keymgmt->query_operation_name != NULL
1087 ? pkey->keymgmt->query_operation_name(OSSL_OP_SIGNATURE)
6c9bc258 1088 : EVP_KEYMGMT_name(pkey->keymgmt);
4f76d62f
RL
1089 EVP_SIGNATURE *signature = NULL;
1090
1091 signature = EVP_SIGNATURE_fetch(libctx, supported_sig, NULL);
1092 if (signature != NULL) {
1093 EVP_SIGNATURE_free(signature);
1094 return 1;
1095 }
1096 }
1097 return 0;
1098}
d02b48c6 1099
f1299839
RL
1100static int print_reset_indent(BIO **out, int pop_f_prefix, long saved_indent)
1101{
1102 BIO_set_indent(*out, saved_indent);
1103 if (pop_f_prefix) {
1104 BIO *next = BIO_pop(*out);
1105
1106 BIO_free(*out);
1107 *out = next;
1108 }
1109 return 1;
1110}
1111
1112static int print_set_indent(BIO **out, int *pop_f_prefix, long *saved_indent,
1113 long indent)
1114{
1115 *pop_f_prefix = 0;
1116 *saved_indent = 0;
1117 if (indent > 0) {
1118 long i = BIO_get_indent(*out);
1119
1120 *saved_indent = (i < 0 ? 0 : i);
1121 if (BIO_set_indent(*out, indent) <= 0) {
1122 if ((*out = BIO_push(BIO_new(BIO_f_prefix()), *out)) == NULL)
1123 return 0;
1124 *pop_f_prefix = 1;
1125 }
1126 if (BIO_set_indent(*out, indent) <= 0) {
1127 print_reset_indent(out, *pop_f_prefix, *saved_indent);
1128 return 0;
1129 }
1130 }
1131 return 1;
1132}
1133
35208f36 1134static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,
0f113f3e
MC
1135 const char *kstr)
1136{
5310a4e6
P
1137 return BIO_indent(out, indent, 128)
1138 && BIO_printf(out, "%s algorithm \"%s\" unsupported\n",
1139 kstr, OBJ_nid2ln(pkey->type)) > 0;
0f113f3e 1140}
35208f36 1141
f1299839 1142static int print_pkey(const EVP_PKEY *pkey, BIO *out, int indent,
97bb8dff 1143 int selection /* For provided encoding */,
ece9304c 1144 const char *propquery /* For provided encoding */,
f1299839
RL
1145 int (*legacy_print)(BIO *out, const EVP_PKEY *pkey,
1146 int indent, ASN1_PCTX *pctx),
1147 ASN1_PCTX *legacy_pctx /* For legacy print */)
0f113f3e 1148{
f1299839
RL
1149 int pop_f_prefix;
1150 long saved_indent;
ece9304c 1151 OSSL_ENCODER_CTX *ctx = NULL;
f1299839
RL
1152 int ret = -2; /* default to unsupported */
1153
1154 if (!print_set_indent(&out, &pop_f_prefix, &saved_indent, indent))
1155 return 0;
54c1711f 1156
fe75766c
TM
1157 ctx = OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, "TEXT", NULL,
1158 propquery);
97bb8dff 1159 if (OSSL_ENCODER_CTX_get_num_encoders(ctx) != 0)
ece9304c
RL
1160 ret = OSSL_ENCODER_to_bio(ctx, out);
1161 OSSL_ENCODER_CTX_free(ctx);
54c1711f
RL
1162
1163 if (ret != -2)
f1299839 1164 goto end;
54c1711f
RL
1165
1166 /* legacy fallback */
f1299839
RL
1167 if (legacy_print != NULL)
1168 ret = legacy_print(out, pkey, 0, legacy_pctx);
1169 else
1170 ret = unsup_alg(out, pkey, 0, "Public Key");
0f113f3e 1171
f1299839
RL
1172 end:
1173 print_reset_indent(&out, pop_f_prefix, saved_indent);
1174 return ret;
1175}
1176
1177int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey,
1178 int indent, ASN1_PCTX *pctx)
1179{
b03da688 1180 return print_pkey(pkey, out, indent, EVP_PKEY_PUBLIC_KEY, NULL,
f1299839
RL
1181 (pkey->ameth != NULL ? pkey->ameth->pub_print : NULL),
1182 pctx);
0f113f3e 1183}
35208f36
DSH
1184
1185int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey,
0f113f3e
MC
1186 int indent, ASN1_PCTX *pctx)
1187{
b03da688 1188 return print_pkey(pkey, out, indent, EVP_PKEY_KEYPAIR, NULL,
f1299839
RL
1189 (pkey->ameth != NULL ? pkey->ameth->priv_print : NULL),
1190 pctx);
0f113f3e 1191}
35208f36
DSH
1192
1193int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
0f113f3e
MC
1194 int indent, ASN1_PCTX *pctx)
1195{
b03da688 1196 return print_pkey(pkey, out, indent, EVP_PKEY_KEY_PARAMETERS, NULL,
f1299839
RL
1197 (pkey->ameth != NULL ? pkey->ameth->param_print : NULL),
1198 pctx);
0f113f3e 1199}
03919683 1200
0e2f87c0
TM
1201# ifndef OPENSSL_NO_STDIO
1202int EVP_PKEY_print_public_fp(FILE *fp, const EVP_PKEY *pkey,
1203 int indent, ASN1_PCTX *pctx)
1204{
1205 int ret;
1206 BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
1207
1208 if (b == NULL)
1209 return 0;
1210 ret = EVP_PKEY_print_public(b, pkey, indent, pctx);
1211 BIO_free(b);
1212 return ret;
1213}
1214
1215int EVP_PKEY_print_private_fp(FILE *fp, const EVP_PKEY *pkey,
1216 int indent, ASN1_PCTX *pctx)
1217{
1218 int ret;
1219 BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
1220
1221 if (b == NULL)
1222 return 0;
1223 ret = EVP_PKEY_print_private(b, pkey, indent, pctx);
1224 BIO_free(b);
1225 return ret;
1226}
1227
1228int EVP_PKEY_print_params_fp(FILE *fp, const EVP_PKEY *pkey,
1229 int indent, ASN1_PCTX *pctx)
1230{
1231 int ret;
1232 BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
1233
1234 if (b == NULL)
1235 return 0;
1236 ret = EVP_PKEY_print_params(b, pkey, indent, pctx);
1237 BIO_free(b);
1238 return ret;
1239}
1240# endif
1241
fc52ae8c 1242static void mdname2nid(const char *mdname, void *data)
5060cd5f
MC
1243{
1244 int *nid = (int *)data;
1245
1246 if (*nid != NID_undef)
1247 return;
1248
1249 *nid = OBJ_sn2nid(mdname);
1250 if (*nid == NID_undef)
1251 *nid = OBJ_ln2nid(mdname);
1252}
1253
ead0d234
RL
1254static int legacy_asn1_ctrl_to_param(EVP_PKEY *pkey, int op,
1255 int arg1, void *arg2)
1256{
3c6ed955 1257 if (pkey->keymgmt == NULL)
ead0d234
RL
1258 return 0;
1259 switch (op) {
1260 case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
1261 {
1262 char mdname[80] = "";
ead0d234
RL
1263 int rv = EVP_PKEY_get_default_digest_name(pkey, mdname,
1264 sizeof(mdname));
1265
90ef39f4 1266 if (rv > 0) {
5060cd5f
MC
1267 int mdnum;
1268 OSSL_LIB_CTX *libctx = ossl_provider_libctx(pkey->keymgmt->prov);
1269 /* Make sure the MD is in the namemap if available */
1270 EVP_MD *md = EVP_MD_fetch(libctx, mdname, NULL);
1271 OSSL_NAMEMAP *namemap = ossl_namemap_stored(libctx);
1272 int nid = NID_undef;
1273
1274 /*
1275 * The only reason to fetch the MD was to make sure it is in the
1276 * namemap. We can immediately free it.
1277 */
1278 EVP_MD_free(md);
1279 mdnum = ossl_namemap_name2num(namemap, mdname);
1280 if (mdnum == 0)
1281 return 0;
1282
1283 /*
1284 * We have the namemap number - now we need to find the
1285 * associated nid
1286 */
d84f5515
MC
1287 if (!ossl_namemap_doall_names(namemap, mdnum, mdname2nid, &nid))
1288 return 0;
90ef39f4
RL
1289 *(int *)arg2 = nid;
1290 }
1291 return rv;
ead0d234
RL
1292 }
1293 default:
1294 return -2;
1295 }
1296}
1297
5d6aaf8a 1298static int evp_pkey_asn1_ctrl(EVP_PKEY *pkey, int op, int arg1, void *arg2)
0f113f3e 1299{
ead0d234
RL
1300 if (pkey->ameth == NULL)
1301 return legacy_asn1_ctrl_to_param(pkey, op, arg1, arg2);
1302 if (pkey->ameth->pkey_ctrl == NULL)
0f113f3e 1303 return -2;
5d6aaf8a
DSH
1304 return pkey->ameth->pkey_ctrl(pkey, op, arg1, arg2);
1305}
1306
1307int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
1308{
1309 return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
1310}
1311
ead0d234
RL
1312int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
1313 char *mdname, size_t mdname_sz)
1314{
3b924da0
RL
1315 if (pkey->ameth == NULL)
1316 return evp_keymgmt_util_get_deflt_digest_name(pkey->keymgmt,
1317 pkey->keydata,
1318 mdname, mdname_sz);
ead0d234
RL
1319
1320 {
1321 int nid = NID_undef;
1322 int rv = EVP_PKEY_get_default_digest_nid(pkey, &nid);
1323 const char *name = rv > 0 ? OBJ_nid2sn(nid) : NULL;
1324
1325 if (rv > 0)
1326 OPENSSL_strlcpy(mdname, name, mdname_sz);
1327 return rv;
1328 }
1329}
1330
88bddad4
RL
1331int EVP_PKEY_get_group_name(const EVP_PKEY *pkey, char *gname, size_t gname_sz,
1332 size_t *gname_len)
1333{
6fcd92d3
RL
1334 return EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME,
1335 gname, gname_sz, gname_len);
88bddad4
RL
1336}
1337
e9fe0f7e
TM
1338int EVP_PKEY_digestsign_supports_digest(EVP_PKEY *pkey, OSSL_LIB_CTX *libctx,
1339 const char *name, const char *propq)
ecbb2fca 1340{
e9fe0f7e
TM
1341 int rv;
1342 EVP_MD_CTX *ctx = NULL;
ecbb2fca 1343
e9fe0f7e
TM
1344 if ((ctx = EVP_MD_CTX_new()) == NULL)
1345 return -1;
1346
1347 ERR_set_mark();
1348 rv = EVP_DigestSignInit_ex(ctx, NULL, name, libctx,
1349 propq, pkey, NULL);
1350 ERR_pop_to_mark();
1351
1352 EVP_MD_CTX_free(ctx);
ecbb2fca
DW
1353 return rv;
1354}
1355
5ac8fb58
MC
1356int EVP_PKEY_set1_encoded_public_key(EVP_PKEY *pkey, const unsigned char *pub,
1357 size_t publen)
5d6aaf8a 1358{
76624df1
RL
1359 if (pkey != NULL && evp_pkey_is_provided(pkey))
1360 return
1361 EVP_PKEY_set_octet_string_param(pkey,
1362 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1363 (unsigned char *)pub, publen);
6a9bd929 1364
5ac8fb58 1365 if (publen > INT_MAX)
5d6aaf8a 1366 return 0;
5ac8fb58
MC
1367 /* Historically this function was EVP_PKEY_set1_tls_encodedpoint */
1368 if (evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SET1_TLS_ENCPT, publen,
1369 (void *)pub) <= 0)
5d6aaf8a
DSH
1370 return 0;
1371 return 1;
1372}
1373
5ac8fb58 1374size_t EVP_PKEY_get1_encoded_public_key(EVP_PKEY *pkey, unsigned char **ppub)
5d6aaf8a
DSH
1375{
1376 int rv;
6a9bd929 1377
76624df1
RL
1378 if (pkey != NULL && evp_pkey_is_provided(pkey)) {
1379 size_t return_size = OSSL_PARAM_UNMODIFIED;
6a9bd929 1380
76624df1
RL
1381 /*
1382 * We know that this is going to fail, but it will give us a size
1383 * to allocate.
1384 */
1385 EVP_PKEY_get_octet_string_param(pkey,
1386 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1387 NULL, 0, &return_size);
1388 if (return_size == OSSL_PARAM_UNMODIFIED)
6a9bd929
MC
1389 return 0;
1390
76624df1 1391 *ppub = OPENSSL_malloc(return_size);
5ac8fb58 1392 if (*ppub == NULL)
6a9bd929
MC
1393 return 0;
1394
76624df1
RL
1395 if (!EVP_PKEY_get_octet_string_param(pkey,
1396 OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1397 *ppub, return_size, NULL))
6a9bd929 1398 return 0;
76624df1 1399 return return_size;
6a9bd929
MC
1400 }
1401
1402
5ac8fb58 1403 rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_GET1_TLS_ENCPT, 0, ppub);
5d6aaf8a
DSH
1404 if (rv <= 0)
1405 return 0;
1406 return rv;
0f113f3e 1407}
e683582b 1408
f844f9eb 1409#endif /* FIPS_MODULE */
e683582b 1410
f844f9eb 1411/*- All methods below can also be used in FIPS_MODULE */
e683582b
SL
1412
1413EVP_PKEY *EVP_PKEY_new(void)
1414{
1415 EVP_PKEY *ret = OPENSSL_zalloc(sizeof(*ret));
1416
1417 if (ret == NULL) {
9311d0c4 1418 ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
e683582b
SL
1419 return NULL;
1420 }
4ce1025a 1421
b574c6a9
MC
1422 ret->type = EVP_PKEY_NONE;
1423 ret->save_type = EVP_PKEY_NONE;
1424 ret->references = 1;
4ce1025a 1425
8dc34b1f
DB
1426 ret->lock = CRYPTO_THREAD_lock_new();
1427 if (ret->lock == NULL) {
1428 EVPerr(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
1429 goto err;
1430 }
1431
f844f9eb 1432#ifndef FIPS_MODULE
b247113c 1433 ret->save_parameters = 1;
ff1f7cde 1434 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, ret, &ret->ex_data)) {
9311d0c4 1435 ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
ff1f7cde 1436 goto err;
e683582b 1437 }
ff1f7cde 1438#endif
e683582b 1439 return ret;
ff1f7cde
AT
1440
1441 err:
1442 CRYPTO_THREAD_lock_free(ret->lock);
1443 OPENSSL_free(ret);
1444 return NULL;
e683582b
SL
1445}
1446
8243d8d1
RL
1447/*
1448 * Setup a public key management method.
1449 *
1450 * For legacy keys, either |type| or |str| is expected to have the type
1451 * information. In this case, the setup consists of finding an ASN1 method
1452 * and potentially an ENGINE, and setting those fields in |pkey|.
1453 *
1454 * For provider side keys, |keymgmt| is expected to be non-NULL. In this
1455 * case, the setup consists of setting the |keymgmt| field in |pkey|.
1456 *
1457 * If pkey is NULL just return 1 or 0 if the key management method exists.
1458 */
1459
1460static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
1461 int len, EVP_KEYMGMT *keymgmt)
1462{
f844f9eb 1463#ifndef FIPS_MODULE
8243d8d1
RL
1464 const EVP_PKEY_ASN1_METHOD *ameth = NULL;
1465 ENGINE **eptr = (e == NULL) ? &e : NULL;
1466#endif
1467
1468 /*
1469 * The setups can't set both legacy and provider side methods.
1470 * It is forbidden
1471 */
1472 if (!ossl_assert(type == EVP_PKEY_NONE || keymgmt == NULL)
1473 || !ossl_assert(e == NULL || keymgmt == NULL)) {
1474 ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
1475 return 0;
1476 }
1477
1478 if (pkey != NULL) {
1479 int free_it = 0;
1480
f844f9eb 1481#ifndef FIPS_MODULE
8243d8d1
RL
1482 free_it = free_it || pkey->pkey.ptr != NULL;
1483#endif
1484 free_it = free_it || pkey->keydata != NULL;
1485 if (free_it)
1486 evp_pkey_free_it(pkey);
f844f9eb 1487#ifndef FIPS_MODULE
8243d8d1
RL
1488 /*
1489 * If key type matches and a method exists then this lookup has
1490 * succeeded once so just indicate success.
1491 */
1492 if (pkey->type != EVP_PKEY_NONE
1493 && type == pkey->save_type
1494 && pkey->ameth != NULL)
1495 return 1;
1496# ifndef OPENSSL_NO_ENGINE
1497 /* If we have ENGINEs release them */
1498 ENGINE_finish(pkey->engine);
1499 pkey->engine = NULL;
1500 ENGINE_finish(pkey->pmeth_engine);
1501 pkey->pmeth_engine = NULL;
1502# endif
1503#endif
1504 }
f844f9eb 1505#ifndef FIPS_MODULE
8243d8d1
RL
1506 if (str != NULL)
1507 ameth = EVP_PKEY_asn1_find_str(eptr, str, len);
1508 else if (type != EVP_PKEY_NONE)
1509 ameth = EVP_PKEY_asn1_find(eptr, type);
1510# ifndef OPENSSL_NO_ENGINE
1511 if (pkey == NULL && eptr != NULL)
1512 ENGINE_finish(e);
1513# endif
1514#endif
1515
1516
1517 {
1518 int check = 1;
1519
f844f9eb 1520#ifndef FIPS_MODULE
8243d8d1
RL
1521 check = check && ameth == NULL;
1522#endif
1523 check = check && keymgmt == NULL;
1524 if (check) {
9311d0c4 1525 ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM);
8243d8d1
RL
1526 return 0;
1527 }
1528 }
1529 if (pkey != NULL) {
1530 if (keymgmt != NULL && !EVP_KEYMGMT_up_ref(keymgmt)) {
1531 ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
1532 return 0;
1533 }
1534
1535 pkey->keymgmt = keymgmt;
1536
1537 pkey->save_type = type;
1538 pkey->type = type;
1539
f844f9eb 1540#ifndef FIPS_MODULE
8243d8d1
RL
1541 /*
1542 * If the internal "origin" key is provider side, don't save |ameth|.
1543 * The main reason is that |ameth| is one factor to detect that the
1544 * internal "origin" key is a legacy one.
1545 */
1546 if (keymgmt == NULL)
1547 pkey->ameth = ameth;
1548 pkey->engine = e;
1549
1550 /*
5e5bc836
RL
1551 * The EVP_PKEY_ASN1_METHOD |pkey_id| retains its legacy key purpose
1552 * for any key type that has a legacy implementation, regardless of
1553 * if the internal key is a legacy or a provider side one. When
1554 * there is no legacy implementation for the key, the type becomes
1555 * EVP_PKEY_KEYMGMT, which indicates that one should be cautious
1556 * with functions that expect legacy internal keys.
8243d8d1 1557 */
28fd8953
MC
1558 if (ameth != NULL) {
1559 if (type == EVP_PKEY_NONE)
1560 pkey->type = ameth->pkey_id;
1561 } else {
5e5bc836 1562 pkey->type = EVP_PKEY_KEYMGMT;
28fd8953 1563 }
8243d8d1
RL
1564#endif
1565 }
1566 return 1;
1567}
1568
f844f9eb 1569#ifndef FIPS_MODULE
8243d8d1
RL
1570static void find_ameth(const char *name, void *data)
1571{
1572 const char **str = data;
1573
1574 /*
1575 * The error messages from pkey_set_type() are uninteresting here,
1576 * and misleading.
1577 */
1578 ERR_set_mark();
1579
1580 if (pkey_set_type(NULL, NULL, EVP_PKEY_NONE, name, strlen(name),
1581 NULL)) {
1582 if (str[0] == NULL)
1583 str[0] = name;
1584 else if (str[1] == NULL)
1585 str[1] = name;
1586 }
1587
1588 ERR_pop_to_mark();
1589}
1590#endif
1591
1592int EVP_PKEY_set_type_by_keymgmt(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt)
1593{
f844f9eb 1594#ifndef FIPS_MODULE
8243d8d1
RL
1595# define EVP_PKEY_TYPE_STR str[0]
1596# define EVP_PKEY_TYPE_STRLEN (str[0] == NULL ? -1 : (int)strlen(str[0]))
1597 /*
1598 * Find at most two strings that have an associated EVP_PKEY_ASN1_METHOD
1599 * Ideally, only one should be found. If two (or more) are found, the
1600 * match is ambiguous. This should never happen, but...
1601 */
1602 const char *str[2] = { NULL, NULL };
1603
d84f5515
MC
1604 if (!EVP_KEYMGMT_names_do_all(keymgmt, find_ameth, &str)
1605 || str[1] != NULL) {
8243d8d1
RL
1606 ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
1607 return 0;
1608 }
1609#else
1610# define EVP_PKEY_TYPE_STR NULL
1611# define EVP_PKEY_TYPE_STRLEN -1
1612#endif
1613 return pkey_set_type(pkey, NULL, EVP_PKEY_NONE,
1614 EVP_PKEY_TYPE_STR, EVP_PKEY_TYPE_STRLEN,
1615 keymgmt);
1616
1617#undef EVP_PKEY_TYPE_STR
1618#undef EVP_PKEY_TYPE_STRLEN
1619}
1620
e683582b
SL
1621int EVP_PKEY_up_ref(EVP_PKEY *pkey)
1622{
1623 int i;
1624
1625 if (CRYPTO_UP_REF(&pkey->references, &i, pkey->lock) <= 0)
1626 return 0;
1627
1628 REF_PRINT_COUNT("EVP_PKEY", pkey);
1629 REF_ASSERT_ISNT(i < 2);
1630 return ((i > 1) ? 1 : 0);
1631}
1632
f844f9eb 1633#ifndef FIPS_MODULE
2145ba5e
TM
1634EVP_PKEY *EVP_PKEY_dup(EVP_PKEY *pkey)
1635{
1636 EVP_PKEY *dup_pk;
1637
1638 if (pkey == NULL) {
1639 ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
1640 return NULL;
1641 }
1642
1643 if ((dup_pk = EVP_PKEY_new()) == NULL)
1644 return NULL;
1645
1646 if (evp_pkey_is_blank(pkey))
1647 goto done;
1648
1649 if (evp_pkey_is_provided(pkey)) {
1650 if (!evp_keymgmt_util_copy(dup_pk, pkey,
1651 OSSL_KEYMGMT_SELECT_ALL))
1652 goto err;
1653 goto done;
1654 }
1655
1656 if (evp_pkey_is_legacy(pkey)) {
1657 const EVP_PKEY_ASN1_METHOD *ameth = pkey->ameth;
1658
1659 if (ameth == NULL || ameth->copy == NULL) {
1660 if (pkey->pkey.ptr == NULL /* empty key, just set type */
1661 && EVP_PKEY_set_type(dup_pk, pkey->type) != 0)
1662 goto done;
1663 ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_KEY_TYPE);
1664 goto err;
1665 }
1666 if (!ameth->copy(dup_pk, pkey))
1667 goto err;
1668 goto done;
1669 }
1670
1671 goto err;
1672done:
1673 /* copy auxiliary data */
1674 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EVP_PKEY,
1675 &dup_pk->ex_data, &pkey->ex_data))
1676 goto err;
1677
1678 if (pkey->attributes != NULL) {
1679 if ((dup_pk->attributes = ossl_x509at_dup(pkey->attributes)) == NULL)
1680 goto err;
1681 }
1682 return dup_pk;
1683err:
1684 EVP_PKEY_free(dup_pk);
1685 return NULL;
1686}
1687
62924755 1688void evp_pkey_free_legacy(EVP_PKEY *x)
badf51c8 1689{
b574c6a9
MC
1690 const EVP_PKEY_ASN1_METHOD *ameth = x->ameth;
1691 ENGINE *tmpe = NULL;
1692
1693 if (ameth == NULL && x->legacy_cache_pkey.ptr != NULL)
1694 ameth = EVP_PKEY_asn1_find(&tmpe, x->type);
1695
1696 if (ameth != NULL) {
1697 if (x->legacy_cache_pkey.ptr != NULL) {
1698 /*
1699 * We should never have both a legacy origin key, and a key in the
1700 * legacy cache.
1701 */
1702 assert(x->pkey.ptr == NULL);
1703 /*
1704 * For the purposes of freeing we make the legacy cache look like
1705 * a legacy origin key.
1706 */
1707 x->pkey = x->legacy_cache_pkey;
1708 x->legacy_cache_pkey.ptr = NULL;
1709 }
1710 if (ameth->pkey_free != NULL)
1711 ameth->pkey_free(x);
badf51c8 1712 x->pkey.ptr = NULL;
badf51c8
RL
1713 }
1714# ifndef OPENSSL_NO_ENGINE
b574c6a9 1715 ENGINE_finish(tmpe);
badf51c8
RL
1716 ENGINE_finish(x->engine);
1717 x->engine = NULL;
1718 ENGINE_finish(x->pmeth_engine);
1719 x->pmeth_engine = NULL;
1720# endif
badf51c8 1721}
f844f9eb 1722#endif /* FIPS_MODULE */
badf51c8 1723
e683582b
SL
1724static void evp_pkey_free_it(EVP_PKEY *x)
1725{
1726 /* internal function; x is never NULL */
0b07db6f 1727 evp_keymgmt_util_clear_operation_cache(x, 1);
f844f9eb 1728#ifndef FIPS_MODULE
badf51c8
RL
1729 evp_pkey_free_legacy(x);
1730#endif
e683582b 1731
3c6ed955
RL
1732 if (x->keymgmt != NULL) {
1733 evp_keymgmt_freedata(x->keymgmt, x->keydata);
1734 EVP_KEYMGMT_free(x->keymgmt);
1735 x->keymgmt = NULL;
1736 x->keydata = NULL;
1737 }
5e5bc836 1738 x->type = EVP_PKEY_NONE;
e683582b
SL
1739}
1740
1741void EVP_PKEY_free(EVP_PKEY *x)
1742{
1743 int i;
1744
1745 if (x == NULL)
1746 return;
1747
1748 CRYPTO_DOWN_REF(&x->references, &i, x->lock);
1749 REF_PRINT_COUNT("EVP_PKEY", x);
1750 if (i > 0)
1751 return;
1752 REF_ASSERT_ISNT(i < 0);
1753 evp_pkey_free_it(x);
f844f9eb 1754#ifndef FIPS_MODULE
ff1f7cde
AT
1755 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, x, &x->ex_data);
1756#endif
e683582b 1757 CRYPTO_THREAD_lock_free(x->lock);
f844f9eb 1758#ifndef FIPS_MODULE
e683582b
SL
1759 sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
1760#endif
1761 OPENSSL_free(x);
1762}
1763
e683582b
SL
1764int EVP_PKEY_size(const EVP_PKEY *pkey)
1765{
adc9f731
RL
1766 int size = 0;
1767
6508e858 1768 if (pkey != NULL) {
adc9f731 1769 size = pkey->cache.size;
f844f9eb 1770#ifndef FIPS_MODULE
adc9f731
RL
1771 if (pkey->ameth != NULL && pkey->ameth->pkey_size != NULL)
1772 size = pkey->ameth->pkey_size(pkey);
1773#endif
6508e858 1774 }
030da844 1775 return size < 0 ? 0 : size;
e683582b 1776}
f6aa5774 1777
03888233
RL
1778const char *EVP_PKEY_description(const EVP_PKEY *pkey)
1779{
1780 if (!evp_pkey_is_assigned(pkey))
1781 return NULL;
1782
1783 if (evp_pkey_is_provided(pkey) && pkey->keymgmt->description != NULL)
1784 return pkey->keymgmt->description;
1785#ifndef FIPS_MODULE
1786 if (pkey->ameth != NULL)
1787 return pkey->ameth->info;
1788#endif
1789 return NULL;
1790}
1791
b4250010 1792void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
3c6ed955
RL
1793 EVP_KEYMGMT **keymgmt,
1794 const char *propquery)
f6aa5774
RL
1795{
1796 EVP_KEYMGMT *allocated_keymgmt = NULL;
1797 EVP_KEYMGMT *tmp_keymgmt = NULL;
b305452f 1798 void *keydata = NULL;
adc9f731 1799 int check;
f6aa5774
RL
1800
1801 if (pk == NULL)
1802 return NULL;
1803
adc9f731
RL
1804 /* No key data => nothing to export */
1805 check = 1;
f844f9eb 1806#ifndef FIPS_MODULE
adc9f731
RL
1807 check = check && pk->pkey.ptr == NULL;
1808#endif
1809 check = check && pk->keydata == NULL;
1810 if (check)
1811 return NULL;
1812
f844f9eb 1813#ifndef FIPS_MODULE
3f7ce7f1 1814 if (pk->pkey.ptr != NULL) {
3f7ce7f1 1815 /*
3c6ed955
RL
1816 * If the legacy key doesn't have an dirty counter or export function,
1817 * give up
3f7ce7f1 1818 */
3c6ed955
RL
1819 if (pk->ameth->dirty_cnt == NULL || pk->ameth->export_to == NULL)
1820 return NULL;
3f7ce7f1
RL
1821 }
1822#endif
1823
3c6ed955
RL
1824 if (keymgmt != NULL) {
1825 tmp_keymgmt = *keymgmt;
1826 *keymgmt = NULL;
1827 }
1828
4b9e90f4
RL
1829 /*
1830 * If no keymgmt was given or found, get a default keymgmt. We do so by
1831 * letting EVP_PKEY_CTX_new_from_pkey() do it for us, then we steal it.
1832 */
f6aa5774 1833 if (tmp_keymgmt == NULL) {
2ee4a50a 1834 EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pk, propquery);
f6aa5774 1835
4b9e90f4
RL
1836 tmp_keymgmt = ctx->keymgmt;
1837 ctx->keymgmt = NULL;
f6aa5774
RL
1838 EVP_PKEY_CTX_free(ctx);
1839 }
1840
3c6ed955 1841 /* If there's still no keymgmt to be had, give up */
3f7ce7f1
RL
1842 if (tmp_keymgmt == NULL)
1843 goto end;
f6aa5774 1844
f844f9eb 1845#ifndef FIPS_MODULE
3f7ce7f1 1846 if (pk->pkey.ptr != NULL) {
64954e2f 1847 OP_CACHE_ELEM *op;
3f7ce7f1
RL
1848
1849 /*
3c6ed955
RL
1850 * If the legacy "origin" hasn't changed since last time, we try
1851 * to find our keymgmt in the operation cache. If it has changed,
1852 * |i| remains zero, and we will clear the cache further down.
3f7ce7f1 1853 */
3c6ed955 1854 if (pk->ameth->dirty_cnt(pk) == pk->dirty_cnt_copy) {
0b07db6f
MC
1855 if (!CRYPTO_THREAD_read_lock(pk->lock))
1856 goto end;
64954e2f 1857 op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt);
3c6ed955
RL
1858
1859 /*
1860 * If |tmp_keymgmt| is present in the operation cache, it means
1861 * that export doesn't need to be redone. In that case, we take
1862 * token copies of the cached pointers, to have token success
1863 * values to return.
1864 */
64954e2f
P
1865 if (op != NULL && op->keymgmt != NULL) {
1866 keydata = op->keydata;
0b07db6f 1867 CRYPTO_THREAD_unlock(pk->lock);
3c6ed955
RL
1868 goto end;
1869 }
0b07db6f 1870 CRYPTO_THREAD_unlock(pk->lock);
3f7ce7f1
RL
1871 }
1872
3f7ce7f1 1873 /* Make sure that the keymgmt key type matches the legacy NID */
0fc39c90 1874 if (!EVP_KEYMGMT_is_a(tmp_keymgmt, OBJ_nid2sn(pk->type)))
3f7ce7f1
RL
1875 goto end;
1876
1877 if ((keydata = evp_keymgmt_newdata(tmp_keymgmt)) == NULL)
1878 goto end;
1879
76e23fc5 1880 if (!pk->ameth->export_to(pk, keydata, tmp_keymgmt, libctx, propquery)) {
3f7ce7f1
RL
1881 evp_keymgmt_freedata(tmp_keymgmt, keydata);
1882 keydata = NULL;
1883 goto end;
1884 }
1885
3c6ed955
RL
1886 /*
1887 * If the dirty counter changed since last time, then clear the
1888 * operation cache. In that case, we know that |i| is zero. Just
1889 * in case this is a re-export, we increment then decrement the
1890 * keymgmt reference counter.
1891 */
1892 if (!EVP_KEYMGMT_up_ref(tmp_keymgmt)) { /* refcnt++ */
1893 evp_keymgmt_freedata(tmp_keymgmt, keydata);
1894 keydata = NULL;
1895 goto end;
1896 }
0b07db6f
MC
1897
1898 if (!CRYPTO_THREAD_write_lock(pk->lock))
1899 goto end;
1900 if (pk->ameth->dirty_cnt(pk) != pk->dirty_cnt_copy
1901 && !evp_keymgmt_util_clear_operation_cache(pk, 0)) {
1902 CRYPTO_THREAD_unlock(pk->lock);
1903 evp_keymgmt_freedata(tmp_keymgmt, keydata);
1904 keydata = NULL;
1905 EVP_KEYMGMT_free(tmp_keymgmt);
1906 goto end;
1907 }
3c6ed955
RL
1908 EVP_KEYMGMT_free(tmp_keymgmt); /* refcnt-- */
1909
64954e2f
P
1910 /* Check to make sure some other thread didn't get there first */
1911 op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt);
1912 if (op != NULL && op->keymgmt != NULL) {
1913 void *tmp_keydata = op->keydata;
1914
1915 CRYPTO_THREAD_unlock(pk->lock);
1916 evp_keymgmt_freedata(tmp_keymgmt, keydata);
1917 keydata = tmp_keydata;
1918 goto end;
1919 }
1920
3c6ed955 1921 /* Add the new export to the operation cache */
64954e2f 1922 if (!evp_keymgmt_util_cache_keydata(pk, tmp_keymgmt, keydata)) {
0b07db6f 1923 CRYPTO_THREAD_unlock(pk->lock);
3c6ed955
RL
1924 evp_keymgmt_freedata(tmp_keymgmt, keydata);
1925 keydata = NULL;
1926 goto end;
1927 }
3f7ce7f1
RL
1928
1929 /* Synchronize the dirty count */
1930 pk->dirty_cnt_copy = pk->ameth->dirty_cnt(pk);
4a9fe33c 1931
0b07db6f 1932 CRYPTO_THREAD_unlock(pk->lock);
3f7ce7f1
RL
1933 goto end;
1934 }
f844f9eb 1935#endif /* FIPS_MODULE */
3f7ce7f1
RL
1936
1937 keydata = evp_keymgmt_util_export_to_provider(pk, tmp_keymgmt);
1938
1939 end:
f6aa5774
RL
1940 /*
1941 * If nothing was exported, |tmp_keymgmt| might point at a freed
1942 * EVP_KEYMGMT, so we clear it to be safe. It shouldn't be useful for
1943 * the caller either way in that case.
1944 */
b305452f 1945 if (keydata == NULL)
f6aa5774
RL
1946 tmp_keymgmt = NULL;
1947
1948 if (keymgmt != NULL)
1949 *keymgmt = tmp_keymgmt;
1950
1951 EVP_KEYMGMT_free(allocated_keymgmt);
b305452f 1952 return keydata;
f6aa5774 1953}
badf51c8 1954
f844f9eb 1955#ifndef FIPS_MODULE
4ce1025a 1956int evp_pkey_copy_downgraded(EVP_PKEY **dest, const EVP_PKEY *src)
badf51c8 1957{
4ce1025a
RL
1958 if (!ossl_assert(dest != NULL))
1959 return 0;
badf51c8 1960
4ce1025a
RL
1961 if (evp_pkey_is_assigned(src) && evp_pkey_is_provided(src)) {
1962 EVP_KEYMGMT *keymgmt = src->keymgmt;
1963 void *keydata = src->keydata;
1964 int type = src->type;
1965 const char *keytype = NULL;
acb90ba8 1966
6c9bc258 1967 keytype = EVP_KEYMGMT_name(keymgmt);
badf51c8 1968
4ce1025a
RL
1969 /*
1970 * If the type is EVP_PKEY_NONE, then we have a problem somewhere
1971 * else in our code. If it's not one of the well known EVP_PKEY_xxx
1972 * values, it should at least be EVP_PKEY_KEYMGMT at this point.
37cddb2e 1973 * The check is kept as a safety measure.
4ce1025a
RL
1974 */
1975 if (!ossl_assert(type != EVP_PKEY_NONE)) {
1976 ERR_raise_data(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR,
1977 "keymgmt key type = %s but legacy type = EVP_PKEY_NONE",
1978 keytype);
1979 return 0;
1980 }
badf51c8 1981
4ce1025a
RL
1982 /* Prefer the legacy key type name for error reporting */
1983 if (type != EVP_PKEY_KEYMGMT)
1984 keytype = OBJ_nid2sn(type);
5e5bc836 1985
4ce1025a 1986 /* Make sure we have a clean slate to copy into */
ec961f86 1987 if (*dest == NULL) {
4ce1025a 1988 *dest = EVP_PKEY_new();
ec961f86
MC
1989 if (*dest == NULL) {
1990 ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
1991 return 0;
1992 }
1993 } else {
4ce1025a 1994 evp_pkey_free_it(*dest);
ec961f86 1995 }
badf51c8 1996
4ce1025a
RL
1997 if (EVP_PKEY_set_type(*dest, type)) {
1998 /* If the key is typed but empty, we're done */
1999 if (keydata == NULL)
2000 return 1;
629c72db 2001
4ce1025a
RL
2002 if ((*dest)->ameth->import_from == NULL) {
2003 ERR_raise_data(ERR_LIB_EVP, EVP_R_NO_IMPORT_FUNCTION,
2004 "key type = %s", keytype);
2005 } else {
629c72db 2006 /*
4ce1025a
RL
2007 * We perform the export in the same libctx as the keymgmt
2008 * that we are using.
629c72db 2009 */
b4250010 2010 OSSL_LIB_CTX *libctx =
a829b735 2011 ossl_provider_libctx(keymgmt->prov);
4ce1025a
RL
2012 EVP_PKEY_CTX *pctx =
2013 EVP_PKEY_CTX_new_from_pkey(libctx, *dest, NULL);
629c72db 2014
4ce1025a
RL
2015 if (pctx == NULL)
2016 ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE);
629c72db 2017
4ce1025a
RL
2018 if (pctx != NULL
2019 && evp_keymgmt_export(keymgmt, keydata,
2020 OSSL_KEYMGMT_SELECT_ALL,
2021 (*dest)->ameth->import_from,
2022 pctx)) {
2023 /* Synchronize the dirty count */
2024 (*dest)->dirty_cnt_copy = (*dest)->ameth->dirty_cnt(*dest);
2025
2026 EVP_PKEY_CTX_free(pctx);
2027 return 1;
2028 }
2029 EVP_PKEY_CTX_free(pctx);
629c72db 2030 }
badf51c8 2031
4ce1025a
RL
2032 ERR_raise_data(ERR_LIB_EVP, EVP_R_KEYMGMT_EXPORT_FAILURE,
2033 "key type = %s", keytype);
2034 }
badf51c8
RL
2035 }
2036
4ce1025a
RL
2037 return 0;
2038}
2039
b574c6a9 2040void *evp_pkey_get_legacy(EVP_PKEY *pk)
4ce1025a 2041{
b574c6a9
MC
2042 EVP_PKEY *tmp_copy = NULL;
2043 void *ret = NULL;
a8154452
RL
2044
2045 if (!ossl_assert(pk != NULL))
b574c6a9 2046 return NULL;
a8154452
RL
2047
2048 /*
b574c6a9
MC
2049 * If this isn't an assigned provider side key, we just use any existing
2050 * origin legacy key.
a8154452 2051 */
b574c6a9
MC
2052 if (!evp_pkey_is_assigned(pk))
2053 return NULL;
2054 if (!evp_pkey_is_provided(pk))
2055 return pk->pkey.ptr;
4ce1025a 2056
b574c6a9
MC
2057 if (!CRYPTO_THREAD_read_lock(pk->lock))
2058 return NULL;
4ce1025a 2059
b574c6a9 2060 ret = pk->legacy_cache_pkey.ptr;
4ce1025a 2061
b574c6a9
MC
2062 if (!CRYPTO_THREAD_unlock(pk->lock))
2063 return NULL;
a8154452 2064
b574c6a9
MC
2065 if (ret != NULL)
2066 return ret;
4ce1025a 2067
b574c6a9
MC
2068 if (!evp_pkey_copy_downgraded(&tmp_copy, pk))
2069 return NULL;
4ce1025a 2070
b574c6a9
MC
2071 if (!CRYPTO_THREAD_write_lock(pk->lock))
2072 goto err;
4ce1025a 2073
b574c6a9
MC
2074 /* Check again in case some other thread has updated it in the meantime */
2075 ret = pk->legacy_cache_pkey.ptr;
2076 if (ret == NULL) {
2077 /* Steal the legacy key reference from the temporary copy */
2078 ret = pk->legacy_cache_pkey.ptr = tmp_copy->pkey.ptr;
2079 tmp_copy->pkey.ptr = NULL;
2080 }
4ce1025a 2081
b574c6a9
MC
2082 if (!CRYPTO_THREAD_unlock(pk->lock)) {
2083 ret = NULL;
2084 goto err;
acb90ba8 2085 }
4ce1025a 2086
b574c6a9
MC
2087 err:
2088 EVP_PKEY_free(tmp_copy);
2089
2090 return ret;
badf51c8 2091}
f844f9eb 2092#endif /* FIPS_MODULE */
96ebe52e 2093
a73a1892
RL
2094int EVP_PKEY_get_bn_param(const EVP_PKEY *pkey, const char *key_name,
2095 BIGNUM **bn)
96ebe52e
SL
2096{
2097 int ret = 0;
2098 OSSL_PARAM params[2];
2099 unsigned char buffer[2048];
96ebe52e
SL
2100 unsigned char *buf = NULL;
2101 size_t buf_sz = 0;
2102
d82c7f3d 2103 if (key_name == NULL
6084b5c2 2104 || bn == NULL)
96ebe52e
SL
2105 return 0;
2106
2107 memset(buffer, 0, sizeof(buffer));
2108 params[0] = OSSL_PARAM_construct_BN(key_name, buffer, sizeof(buffer));
96ebe52e 2109 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2110 if (!EVP_PKEY_get_params(pkey, params)) {
99ea4f02 2111 if (!OSSL_PARAM_modified(params) || params[0].return_size == 0)
96ebe52e
SL
2112 return 0;
2113 buf_sz = params[0].return_size;
2114 /*
2115 * If it failed because the buffer was too small then allocate the
2116 * required buffer size and retry.
2117 */
2118 buf = OPENSSL_zalloc(buf_sz);
2119 if (buf == NULL)
2120 return 0;
2121 params[0].data = buf;
2122 params[0].data_size = buf_sz;
2123
13e85fb3 2124 if (!EVP_PKEY_get_params(pkey, params))
96ebe52e
SL
2125 goto err;
2126 }
2127 /* Fail if the param was not found */
99ea4f02 2128 if (!OSSL_PARAM_modified(params))
96ebe52e
SL
2129 goto err;
2130 ret = OSSL_PARAM_get_BN(params, bn);
2131err:
2132 OPENSSL_free(buf);
2133 return ret;
2134}
2135
a73a1892 2136int EVP_PKEY_get_octet_string_param(const EVP_PKEY *pkey, const char *key_name,
96ebe52e
SL
2137 unsigned char *buf, size_t max_buf_sz,
2138 size_t *out_sz)
2139{
2140 OSSL_PARAM params[2];
76624df1 2141 int ret1 = 0, ret2 = 0;
96ebe52e 2142
6084b5c2 2143 if (key_name == NULL)
96ebe52e
SL
2144 return 0;
2145
2146 params[0] = OSSL_PARAM_construct_octet_string(key_name, buf, max_buf_sz);
96ebe52e 2147 params[1] = OSSL_PARAM_construct_end();
76624df1
RL
2148 if ((ret1 = EVP_PKEY_get_params(pkey, params)))
2149 ret2 = OSSL_PARAM_modified(params);
2150 if (ret2 && out_sz != NULL)
96ebe52e 2151 *out_sz = params[0].return_size;
76624df1 2152 return ret1 && ret2;
96ebe52e
SL
2153}
2154
a73a1892 2155int EVP_PKEY_get_utf8_string_param(const EVP_PKEY *pkey, const char *key_name,
96ebe52e
SL
2156 char *str, size_t max_buf_sz,
2157 size_t *out_sz)
2158{
2159 OSSL_PARAM params[2];
76624df1 2160 int ret1 = 0, ret2 = 0;
96ebe52e 2161
d82c7f3d 2162 if (key_name == NULL)
96ebe52e
SL
2163 return 0;
2164
2165 params[0] = OSSL_PARAM_construct_utf8_string(key_name, str, max_buf_sz);
96ebe52e 2166 params[1] = OSSL_PARAM_construct_end();
76624df1
RL
2167 if ((ret1 = EVP_PKEY_get_params(pkey, params)))
2168 ret2 = OSSL_PARAM_modified(params);
2169 if (ret2 && out_sz != NULL)
96ebe52e 2170 *out_sz = params[0].return_size;
76624df1 2171 return ret1 && ret2;
96ebe52e
SL
2172}
2173
a73a1892
RL
2174int EVP_PKEY_get_int_param(const EVP_PKEY *pkey, const char *key_name,
2175 int *out)
96ebe52e
SL
2176{
2177 OSSL_PARAM params[2];
96ebe52e 2178
d82c7f3d 2179 if (key_name == NULL)
96ebe52e
SL
2180 return 0;
2181
2182 params[0] = OSSL_PARAM_construct_int(key_name, out);
96ebe52e 2183 params[1] = OSSL_PARAM_construct_end();
13e85fb3
RL
2184 return EVP_PKEY_get_params(pkey, params)
2185 && OSSL_PARAM_modified(params);
96ebe52e
SL
2186}
2187
a73a1892
RL
2188int EVP_PKEY_get_size_t_param(const EVP_PKEY *pkey, const char *key_name,
2189 size_t *out)
96ebe52e
SL
2190{
2191 OSSL_PARAM params[2];
96ebe52e 2192
d82c7f3d 2193 if (key_name == NULL)
96ebe52e
SL
2194 return 0;
2195
2196 params[0] = OSSL_PARAM_construct_size_t(key_name, out);
96ebe52e 2197 params[1] = OSSL_PARAM_construct_end();
13e85fb3
RL
2198 return EVP_PKEY_get_params(pkey, params)
2199 && OSSL_PARAM_modified(params);
96ebe52e 2200}
98dbf2c1
SL
2201
2202int EVP_PKEY_set_int_param(EVP_PKEY *pkey, const char *key_name, int in)
2203{
2204 OSSL_PARAM params[2];
2205
d82c7f3d 2206 if (key_name == NULL)
98dbf2c1
SL
2207 return 0;
2208
2209 params[0] = OSSL_PARAM_construct_int(key_name, &in);
2210 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2211 return EVP_PKEY_set_params(pkey, params);
98dbf2c1
SL
2212}
2213
2214int EVP_PKEY_set_size_t_param(EVP_PKEY *pkey, const char *key_name, size_t in)
2215{
2216 OSSL_PARAM params[2];
2217
d82c7f3d 2218 if (key_name == NULL)
98dbf2c1
SL
2219 return 0;
2220
2221 params[0] = OSSL_PARAM_construct_size_t(key_name, &in);
2222 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2223 return EVP_PKEY_set_params(pkey, params);
98dbf2c1
SL
2224}
2225
13e85fb3
RL
2226int EVP_PKEY_set_bn_param(EVP_PKEY *pkey, const char *key_name,
2227 const BIGNUM *bn)
98dbf2c1
SL
2228{
2229 OSSL_PARAM params[2];
2230 unsigned char buffer[2048];
2231 int bsize = 0;
2232
d82c7f3d
RL
2233 if (key_name == NULL
2234 || bn == NULL
2235 || pkey == NULL
6fcd92d3 2236 || !evp_pkey_is_assigned(pkey))
98dbf2c1
SL
2237 return 0;
2238
2239 bsize = BN_num_bytes(bn);
2240 if (!ossl_assert(bsize <= (int)sizeof(buffer)))
2241 return 0;
2242
2243 if (BN_bn2nativepad(bn, buffer, bsize) < 0)
2244 return 0;
2245 params[0] = OSSL_PARAM_construct_BN(key_name, buffer, bsize);
2246 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2247 return EVP_PKEY_set_params(pkey, params);
98dbf2c1
SL
2248}
2249
2250int EVP_PKEY_set_utf8_string_param(EVP_PKEY *pkey, const char *key_name,
13e85fb3 2251 const char *str)
98dbf2c1
SL
2252{
2253 OSSL_PARAM params[2];
2254
d82c7f3d 2255 if (key_name == NULL)
98dbf2c1
SL
2256 return 0;
2257
13e85fb3 2258 params[0] = OSSL_PARAM_construct_utf8_string(key_name, (char *)str, 0);
98dbf2c1 2259 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2260 return EVP_PKEY_set_params(pkey, params);
98dbf2c1
SL
2261}
2262
2263int EVP_PKEY_set_octet_string_param(EVP_PKEY *pkey, const char *key_name,
13e85fb3 2264 const unsigned char *buf, size_t bsize)
98dbf2c1
SL
2265{
2266 OSSL_PARAM params[2];
2267
d82c7f3d 2268 if (key_name == NULL)
98dbf2c1
SL
2269 return 0;
2270
13e85fb3
RL
2271 params[0] = OSSL_PARAM_construct_octet_string(key_name,
2272 (unsigned char *)buf, bsize);
98dbf2c1 2273 params[1] = OSSL_PARAM_construct_end();
13e85fb3 2274 return EVP_PKEY_set_params(pkey, params);
98dbf2c1
SL
2275}
2276
d82c7f3d 2277const OSSL_PARAM *EVP_PKEY_settable_params(const EVP_PKEY *pkey)
98dbf2c1 2278{
d82c7f3d
RL
2279 return (pkey != NULL && evp_pkey_is_provided(pkey))
2280 ? EVP_KEYMGMT_settable_params(pkey->keymgmt)
2281 : NULL;
98dbf2c1
SL
2282}
2283
2284int EVP_PKEY_set_params(EVP_PKEY *pkey, OSSL_PARAM params[])
2285{
6fcd92d3
RL
2286 if (pkey != NULL) {
2287 if (evp_pkey_is_provided(pkey)) {
2288 pkey->dirty_cnt++;
2289 return evp_keymgmt_set_params(pkey->keymgmt, pkey->keydata, params);
2290 }
2291#ifndef FIPS_MODULE
2292 /*
6fcd92d3
RL
2293 * We will hopefully never find the need to set individual data in
2294 * EVP_PKEYs with a legacy internal key, but we can't be entirely
2295 * sure. This bit of code can be enabled if we find the need. If
2296 * not, it can safely be removed when #legacy support is removed.
2297 */
2298# if 0
2299 else if (evp_pkey_is_legacy(pkey)) {
2300 return evp_pkey_set_params_to_ctrl(pkey, params);
2301 }
2302# endif
2303#endif
2304 }
2305 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY);
2306 return 0;
98dbf2c1 2307}
3d34bedf 2308
13e85fb3
RL
2309const OSSL_PARAM *EVP_PKEY_gettable_params(const EVP_PKEY *pkey)
2310{
d82c7f3d
RL
2311 return (pkey != NULL && evp_pkey_is_provided(pkey))
2312 ? EVP_KEYMGMT_gettable_params(pkey->keymgmt)
2313 : NULL;
13e85fb3
RL
2314}
2315
2316int EVP_PKEY_get_params(const EVP_PKEY *pkey, OSSL_PARAM params[])
2317{
6fcd92d3
RL
2318 if (pkey != NULL) {
2319 if (evp_pkey_is_provided(pkey))
2320 return evp_keymgmt_get_params(pkey->keymgmt, pkey->keydata, params);
2321#ifndef FIPS_MODULE
2322 else if (evp_pkey_is_legacy(pkey))
2323 return evp_pkey_get_params_to_ctrl(pkey, params);
2324#endif
2325 }
2326 ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY);
2327 return 0;
13e85fb3
RL
2328}
2329
3d34bedf
MC
2330#ifndef FIPS_MODULE
2331int EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY *pkey)
2332{
2333 char name[80];
2334 size_t name_len;
2335
2336 if (pkey == NULL)
2337 return 0;
2338
2339 if (pkey->keymgmt == NULL
2340 || pkey->keydata == NULL) {
0e2f87c0 2341# ifndef OPENSSL_NO_EC
3d34bedf 2342 /* Might work through the legacy route */
7bc0fdd3 2343 const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
3d34bedf
MC
2344
2345 if (ec == NULL)
2346 return 0;
2347
2348 return EC_KEY_get_conv_form(ec);
0e2f87c0 2349# else
3d34bedf 2350 return 0;
0e2f87c0 2351# endif
3d34bedf
MC
2352 }
2353
2354 if (!EVP_PKEY_get_utf8_string_param(pkey,
2355 OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
2356 name, sizeof(name), &name_len))
2357 return 0;
2358
2359 if (strcmp(name, "uncompressed") == 0)
2360 return POINT_CONVERSION_UNCOMPRESSED;
2361
2362 if (strcmp(name, "compressed") == 0)
2363 return POINT_CONVERSION_COMPRESSED;
2364
2365 if (strcmp(name, "hybrid") == 0)
2366 return POINT_CONVERSION_HYBRID;
2367
2368 return 0;
2369}
2370
2371int EVP_PKEY_get_field_type(const EVP_PKEY *pkey)
2372{
2373 char fstr[80];
2374 size_t fstrlen;
2375
2376 if (pkey == NULL)
2377 return 0;
2378
2379 if (pkey->keymgmt == NULL
2380 || pkey->keydata == NULL) {
0e2f87c0 2381# ifndef OPENSSL_NO_EC
3d34bedf 2382 /* Might work through the legacy route */
7bc0fdd3 2383 const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
3d34bedf
MC
2384 const EC_GROUP *grp;
2385
2386 if (ec == NULL)
2387 return 0;
2388 grp = EC_KEY_get0_group(ec);
82a46200
TM
2389 if (grp == NULL)
2390 return 0;
3d34bedf
MC
2391
2392 return EC_GROUP_get_field_type(grp);
0e2f87c0 2393# else
3d34bedf 2394 return 0;
0e2f87c0 2395# endif
3d34bedf
MC
2396 }
2397
2398 if (!EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_EC_FIELD_TYPE,
2399 fstr, sizeof(fstr), &fstrlen))
2400 return 0;
2401
2402 if (strcmp(fstr, SN_X9_62_prime_field) == 0)
2403 return NID_X9_62_prime_field;
2404 else if (strcmp(fstr, SN_X9_62_characteristic_two_field))
2405 return NID_X9_62_characteristic_two_field;
2406
2407 return 0;
2408}
2409#endif