crypto/evp/asymcipher.c

   1 /*
   2  * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include <stdlib.h>
  12 #include <openssl/objects.h>
  13 #include <openssl/evp.h>
  14 #include "internal/cryptlib.h"
  15 #include "internal/provider.h"
  16 #include "internal/core.h"
  17 #include "crypto/evp.h"
  18 #include "evp_local.h"
  19
  20 static int evp_pkey_asym_cipher_init(EVP_PKEY_CTX *ctx, int operation,
  21                                      const OSSL_PARAM params[])
  22 {
  23     int ret = 0;
  24     void *provkey = NULL;
  25     EVP_ASYM_CIPHER *cipher = NULL;
  26     EVP_KEYMGMT *tmp_keymgmt = NULL;
  27     const OSSL_PROVIDER *tmp_prov = NULL;
  28     const char *supported_ciph = NULL;
  29     int iter;
  30
  31     if (ctx == NULL) {
  32         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  33         return -2;
  34     }
  35
  36     evp_pkey_ctx_free_old_ops(ctx);
  37     ctx->operation = operation;
  38
  39     ERR_set_mark();
  40
  41     if (evp_pkey_ctx_is_legacy(ctx))
  42         goto legacy;
  43
  44     if (ctx->pkey == NULL) {
  45         ERR_clear_last_mark();
  46         ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
  47         goto err;
  48     }
  49
  50     /*
  51      * Try to derive the supported asym cipher from |ctx->keymgmt|.
  52      */
  53     if (!ossl_assert(ctx->pkey->keymgmt == NULL
  54                      || ctx->pkey->keymgmt == ctx->keymgmt)) {
  55         ERR_clear_last_mark();
  56         ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
  57         goto err;
  58     }
  59     supported_ciph
  60         = evp_keymgmt_util_query_operation_name(ctx->keymgmt,
  61                                                 OSSL_OP_ASYM_CIPHER);
  62     if (supported_ciph == NULL) {
  63         ERR_clear_last_mark();
  64         ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
  65         goto err;
  66     }
  67
  68     /*
  69      * We perform two iterations:
  70      *
  71      * 1.  Do the normal asym cipher fetch, using the fetching data given by
  72      *     the EVP_PKEY_CTX.
  73      * 2.  Do the provider specific asym cipher fetch, from the same provider
  74      *     as |ctx->keymgmt|
  75      *
  76      * We then try to fetch the keymgmt from the same provider as the
  77      * asym cipher, and try to export |ctx->pkey| to that keymgmt (when
  78      * this keymgmt happens to be the same as |ctx->keymgmt|, the export
  79      * is a no-op, but we call it anyway to not complicate the code even
  80      * more).
  81      * If the export call succeeds (returns a non-NULL provider key pointer),
  82      * we're done and can perform the operation itself.  If not, we perform
  83      * the second iteration, or jump to legacy.
  84      */
  85     for (iter = 1, provkey = NULL; iter < 3 && provkey == NULL; iter++) {
  86         EVP_KEYMGMT *tmp_keymgmt_tofree;
  87
  88         /*
  89          * If we're on the second iteration, free the results from the first.
  90          * They are NULL on the first iteration, so no need to check what
  91          * iteration we're on.
  92          */
  93         EVP_ASYM_CIPHER_free(cipher);
  94         EVP_KEYMGMT_free(tmp_keymgmt);
  95
  96         switch (iter) {
  97         case 1:
  98             cipher = EVP_ASYM_CIPHER_fetch(ctx->libctx, supported_ciph,
  99                                            ctx->propquery);
 100             if (cipher != NULL)
 101                 tmp_prov = EVP_ASYM_CIPHER_get0_provider(cipher);
 102             break;
 103         case 2:
 104             tmp_prov = EVP_KEYMGMT_get0_provider(ctx->keymgmt);
 105             cipher =
 106                 evp_asym_cipher_fetch_from_prov((OSSL_PROVIDER *)tmp_prov,
 107                                                 supported_ciph, ctx->propquery);
 108             if (cipher == NULL)
 109                 goto legacy;
 110             break;
 111         }
 112         if (cipher == NULL)
 113             continue;
 114
 115         /*
 116          * Ensure that the key is provided, either natively, or as a cached
 117          * export.  We start by fetching the keymgmt with the same name as
 118          * |ctx->pkey|, but from the provider of the asym cipher method, using
 119          * the same property query as when fetching the asym cipher method.
 120          * With the keymgmt we found (if we did), we try to export |ctx->pkey|
 121          * to it (evp_pkey_export_to_provider() is smart enough to only actually
 122          * export it if |tmp_keymgmt| is different from |ctx->pkey|'s keymgmt)
 123          */
 124         tmp_keymgmt_tofree = tmp_keymgmt
 125             = evp_keymgmt_fetch_from_prov((OSSL_PROVIDER *)tmp_prov,
 126                                           EVP_KEYMGMT_get0_name(ctx->keymgmt),
 127                                           ctx->propquery);
 128         if (tmp_keymgmt != NULL)
 129             provkey = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
 130                                                   &tmp_keymgmt, ctx->propquery);
 131         if (tmp_keymgmt == NULL)
 132             EVP_KEYMGMT_free(tmp_keymgmt_tofree);
 133     }
 134
 135     if (provkey == NULL) {
 136         EVP_ASYM_CIPHER_free(cipher);
 137         goto legacy;
 138     }
 139
 140     ERR_pop_to_mark();
 141
 142     /* No more legacy from here down to legacy: */
 143
 144     ctx->op.ciph.cipher = cipher;
 145     ctx->op.ciph.algctx = cipher->newctx(ossl_provider_ctx(cipher->prov));
 146     if (ctx->op.ciph.algctx == NULL) {
 147         /* The provider key can stay in the cache */
 148         ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
 149         goto err;
 150     }
 151
 152     switch (operation) {
 153     case EVP_PKEY_OP_ENCRYPT:
 154         if (cipher->encrypt_init == NULL) {
 155             ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 156             ret = -2;
 157             goto err;
 158         }
 159         ret = cipher->encrypt_init(ctx->op.ciph.algctx, provkey, params);
 160         break;
 161     case EVP_PKEY_OP_DECRYPT:
 162         if (cipher->decrypt_init == NULL) {
 163             ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 164             ret = -2;
 165             goto err;
 166         }
 167         ret = cipher->decrypt_init(ctx->op.ciph.algctx, provkey, params);
 168         break;
 169     default:
 170         ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
 171         goto err;
 172     }
 173
 174     if (ret <= 0)
 175         goto err;
 176     EVP_KEYMGMT_free(tmp_keymgmt);
 177     return 1;
 178
 179  legacy:
 180     /*
 181      * If we don't have the full support we need with provided methods,
 182      * let's go see if legacy does.
 183      */
 184     ERR_pop_to_mark();
 185     EVP_KEYMGMT_free(tmp_keymgmt);
 186     tmp_keymgmt = NULL;
 187
 188     if (ctx->pmeth == NULL || ctx->pmeth->encrypt == NULL) {
 189         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 190         return -2;
 191     }
 192     switch (ctx->operation) {
 193     case EVP_PKEY_OP_ENCRYPT:
 194         if (ctx->pmeth->encrypt_init == NULL)
 195             return 1;
 196         ret = ctx->pmeth->encrypt_init(ctx);
 197         break;
 198     case EVP_PKEY_OP_DECRYPT:
 199         if (ctx->pmeth->decrypt_init == NULL)
 200             return 1;
 201         ret = ctx->pmeth->decrypt_init(ctx);
 202         break;
 203     default:
 204         ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
 205         ret = -1;
 206     }
 207
 208  err:
 209     if (ret <= 0) {
 210         evp_pkey_ctx_free_old_ops(ctx);
 211         ctx->operation = EVP_PKEY_OP_UNDEFINED;
 212     }
 213     EVP_KEYMGMT_free(tmp_keymgmt);
 214     return ret;
 215 }
 216
 217 int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx)
 218 {
 219     return evp_pkey_asym_cipher_init(ctx, EVP_PKEY_OP_ENCRYPT, NULL);
 220 }
 221
 222 int EVP_PKEY_encrypt_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[])
 223 {
 224     return evp_pkey_asym_cipher_init(ctx, EVP_PKEY_OP_ENCRYPT, params);
 225 }
 226
 227 int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
 228                      unsigned char *out, size_t *outlen,
 229                      const unsigned char *in, size_t inlen)
 230 {
 231     int ret;
 232
 233     if (ctx == NULL) {
 234         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 235         return -2;
 236     }
 237
 238     if (ctx->operation != EVP_PKEY_OP_ENCRYPT) {
 239         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED);
 240         return -1;
 241     }
 242
 243     if (ctx->op.ciph.algctx == NULL)
 244         goto legacy;
 245
 246     ret = ctx->op.ciph.cipher->encrypt(ctx->op.ciph.algctx, out, outlen,
 247                                        (out == NULL ? 0 : *outlen), in, inlen);
 248     return ret;
 249
 250  legacy:
 251     if (ctx->pmeth == NULL || ctx->pmeth->encrypt == NULL) {
 252         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 253         return -2;
 254     }
 255     M_check_autoarg(ctx, out, outlen, EVP_F_EVP_PKEY_ENCRYPT)
 256         return ctx->pmeth->encrypt(ctx, out, outlen, in, inlen);
 257 }
 258
 259 int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx)
 260 {
 261     return evp_pkey_asym_cipher_init(ctx, EVP_PKEY_OP_DECRYPT, NULL);
 262 }
 263
 264 int EVP_PKEY_decrypt_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[])
 265 {
 266     return evp_pkey_asym_cipher_init(ctx, EVP_PKEY_OP_DECRYPT, params);
 267 }
 268
 269 int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx,
 270                      unsigned char *out, size_t *outlen,
 271                      const unsigned char *in, size_t inlen)
 272 {
 273     int ret;
 274
 275     if (ctx == NULL) {
 276         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 277         return -2;
 278     }
 279
 280     if (ctx->operation != EVP_PKEY_OP_DECRYPT) {
 281         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED);
 282         return -1;
 283     }
 284
 285     if (ctx->op.ciph.algctx == NULL)
 286         goto legacy;
 287
 288     ret = ctx->op.ciph.cipher->decrypt(ctx->op.ciph.algctx, out, outlen,
 289                                        (out == NULL ? 0 : *outlen), in, inlen);
 290     return ret;
 291
 292  legacy:
 293     if (ctx->pmeth == NULL || ctx->pmeth->decrypt == NULL) {
 294         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 295         return -2;
 296     }
 297     M_check_autoarg(ctx, out, outlen, EVP_F_EVP_PKEY_DECRYPT)
 298         return ctx->pmeth->decrypt(ctx, out, outlen, in, inlen);
 299 }
 300
 301 /* decrypt to new buffer of dynamic size, checking any pre-determined size */
 302 int evp_pkey_decrypt_alloc(EVP_PKEY_CTX *ctx, unsigned char **outp,
 303                            size_t *outlenp, size_t expected_outlen,
 304                            const unsigned char *in, size_t inlen)
 305 {
 306     if (EVP_PKEY_decrypt(ctx, NULL, outlenp, in, inlen) <= 0
 307             || (*outp = OPENSSL_malloc(*outlenp)) == NULL)
 308         return -1;
 309     if (EVP_PKEY_decrypt(ctx, *outp, outlenp, in, inlen) <= 0
 310             || *outlenp == 0
 311             || (expected_outlen != 0 && *outlenp != expected_outlen)) {
 312         ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
 313         OPENSSL_clear_free(*outp, *outlenp);
 314         *outp = NULL;
 315         return 0;
 316     }
 317     return 1;
 318 }
 319
 320 static EVP_ASYM_CIPHER *evp_asym_cipher_new(OSSL_PROVIDER *prov)
 321 {
 322     EVP_ASYM_CIPHER *cipher = OPENSSL_zalloc(sizeof(EVP_ASYM_CIPHER));
 323
 324     if (cipher == NULL)
 325         return NULL;
 326
 327     if (!CRYPTO_NEW_REF(&cipher->refcnt, 1)) {
 328         OPENSSL_free(cipher);
 329         return NULL;
 330     }
 331     cipher->prov = prov;
 332     ossl_provider_up_ref(prov);
 333
 334     return cipher;
 335 }
 336
 337 static void *evp_asym_cipher_from_algorithm(int name_id,
 338                                             const OSSL_ALGORITHM *algodef,
 339                                             OSSL_PROVIDER *prov)
 340 {
 341     const OSSL_DISPATCH *fns = algodef->implementation;
 342     EVP_ASYM_CIPHER *cipher = NULL;
 343     int ctxfncnt = 0, encfncnt = 0, decfncnt = 0;
 344     int gparamfncnt = 0, sparamfncnt = 0;
 345
 346     if ((cipher = evp_asym_cipher_new(prov)) == NULL) {
 347         ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
 348         goto err;
 349     }
 350
 351     cipher->name_id = name_id;
 352     if ((cipher->type_name = ossl_algorithm_get1_first_name(algodef)) == NULL)
 353         goto err;
 354     cipher->description = algodef->algorithm_description;
 355
 356     for (; fns->function_id != 0; fns++) {
 357         switch (fns->function_id) {
 358         case OSSL_FUNC_ASYM_CIPHER_NEWCTX:
 359             if (cipher->newctx != NULL)
 360                 break;
 361             cipher->newctx = OSSL_FUNC_asym_cipher_newctx(fns);
 362             ctxfncnt++;
 363             break;
 364         case OSSL_FUNC_ASYM_CIPHER_ENCRYPT_INIT:
 365             if (cipher->encrypt_init != NULL)
 366                 break;
 367             cipher->encrypt_init = OSSL_FUNC_asym_cipher_encrypt_init(fns);
 368             encfncnt++;
 369             break;
 370         case OSSL_FUNC_ASYM_CIPHER_ENCRYPT:
 371             if (cipher->encrypt != NULL)
 372                 break;
 373             cipher->encrypt = OSSL_FUNC_asym_cipher_encrypt(fns);
 374             encfncnt++;
 375             break;
 376         case OSSL_FUNC_ASYM_CIPHER_DECRYPT_INIT:
 377             if (cipher->decrypt_init != NULL)
 378                 break;
 379             cipher->decrypt_init = OSSL_FUNC_asym_cipher_decrypt_init(fns);
 380             decfncnt++;
 381             break;
 382         case OSSL_FUNC_ASYM_CIPHER_DECRYPT:
 383             if (cipher->decrypt != NULL)
 384                 break;
 385             cipher->decrypt = OSSL_FUNC_asym_cipher_decrypt(fns);
 386             decfncnt++;
 387             break;
 388         case OSSL_FUNC_ASYM_CIPHER_FREECTX:
 389             if (cipher->freectx != NULL)
 390                 break;
 391             cipher->freectx = OSSL_FUNC_asym_cipher_freectx(fns);
 392             ctxfncnt++;
 393             break;
 394         case OSSL_FUNC_ASYM_CIPHER_DUPCTX:
 395             if (cipher->dupctx != NULL)
 396                 break;
 397             cipher->dupctx = OSSL_FUNC_asym_cipher_dupctx(fns);
 398             break;
 399         case OSSL_FUNC_ASYM_CIPHER_GET_CTX_PARAMS:
 400             if (cipher->get_ctx_params != NULL)
 401                 break;
 402             cipher->get_ctx_params
 403                 = OSSL_FUNC_asym_cipher_get_ctx_params(fns);
 404             gparamfncnt++;
 405             break;
 406         case OSSL_FUNC_ASYM_CIPHER_GETTABLE_CTX_PARAMS:
 407             if (cipher->gettable_ctx_params != NULL)
 408                 break;
 409             cipher->gettable_ctx_params
 410                 = OSSL_FUNC_asym_cipher_gettable_ctx_params(fns);
 411             gparamfncnt++;
 412             break;
 413         case OSSL_FUNC_ASYM_CIPHER_SET_CTX_PARAMS:
 414             if (cipher->set_ctx_params != NULL)
 415                 break;
 416             cipher->set_ctx_params
 417                 = OSSL_FUNC_asym_cipher_set_ctx_params(fns);
 418             sparamfncnt++;
 419             break;
 420         case OSSL_FUNC_ASYM_CIPHER_SETTABLE_CTX_PARAMS:
 421             if (cipher->settable_ctx_params != NULL)
 422                 break;
 423             cipher->settable_ctx_params
 424                 = OSSL_FUNC_asym_cipher_settable_ctx_params(fns);
 425             sparamfncnt++;
 426             break;
 427         }
 428     }
 429     if (ctxfncnt != 2
 430         || (encfncnt != 0 && encfncnt != 2)
 431         || (decfncnt != 0 && decfncnt != 2)
 432         || (encfncnt != 2 && decfncnt != 2)
 433         || (gparamfncnt != 0 && gparamfncnt != 2)
 434         || (sparamfncnt != 0 && sparamfncnt != 2)) {
 435         /*
 436          * In order to be a consistent set of functions we must have at least
 437          * a set of context functions (newctx and freectx) as well as a pair of
 438          * "cipher" functions: (encrypt_init, encrypt) or
 439          * (decrypt_init decrypt). set_ctx_params and settable_ctx_params are
 440          * optional, but if one of them is present then the other one must also
 441          * be present. The same applies to get_ctx_params and
 442          * gettable_ctx_params. The dupctx function is optional.
 443          */
 444         ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_PROVIDER_FUNCTIONS);
 445         goto err;
 446     }
 447
 448     return cipher;
 449  err:
 450     EVP_ASYM_CIPHER_free(cipher);
 451     return NULL;
 452 }
 453
 454 void EVP_ASYM_CIPHER_free(EVP_ASYM_CIPHER *cipher)
 455 {
 456     int i;
 457
 458     if (cipher == NULL)
 459         return;
 460     CRYPTO_DOWN_REF(&cipher->refcnt, &i);
 461     if (i > 0)
 462         return;
 463     OPENSSL_free(cipher->type_name);
 464     ossl_provider_free(cipher->prov);
 465     CRYPTO_FREE_REF(&cipher->refcnt);
 466     OPENSSL_free(cipher);
 467 }
 468
 469 int EVP_ASYM_CIPHER_up_ref(EVP_ASYM_CIPHER *cipher)
 470 {
 471     int ref = 0;
 472
 473     CRYPTO_UP_REF(&cipher->refcnt, &ref);
 474     return 1;
 475 }
 476
 477 OSSL_PROVIDER *EVP_ASYM_CIPHER_get0_provider(const EVP_ASYM_CIPHER *cipher)
 478 {
 479     return cipher->prov;
 480 }
 481
 482 EVP_ASYM_CIPHER *EVP_ASYM_CIPHER_fetch(OSSL_LIB_CTX *ctx, const char *algorithm,
 483                                        const char *properties)
 484 {
 485     return evp_generic_fetch(ctx, OSSL_OP_ASYM_CIPHER, algorithm, properties,
 486                              evp_asym_cipher_from_algorithm,
 487                              (int (*)(void *))EVP_ASYM_CIPHER_up_ref,
 488                              (void (*)(void *))EVP_ASYM_CIPHER_free);
 489 }
 490
 491 EVP_ASYM_CIPHER *evp_asym_cipher_fetch_from_prov(OSSL_PROVIDER *prov,
 492                                                  const char *algorithm,
 493                                                  const char *properties)
 494 {
 495     return evp_generic_fetch_from_prov(prov, OSSL_OP_ASYM_CIPHER,
 496                                        algorithm, properties,
 497                                        evp_asym_cipher_from_algorithm,
 498                                        (int (*)(void *))EVP_ASYM_CIPHER_up_ref,
 499                                        (void (*)(void *))EVP_ASYM_CIPHER_free);
 500 }
 501
 502 int EVP_ASYM_CIPHER_is_a(const EVP_ASYM_CIPHER *cipher, const char *name)
 503 {
 504     return evp_is_a(cipher->prov, cipher->name_id, NULL, name);
 505 }
 506
 507 int evp_asym_cipher_get_number(const EVP_ASYM_CIPHER *cipher)
 508 {
 509     return cipher->name_id;
 510 }
 511
 512 const char *EVP_ASYM_CIPHER_get0_name(const EVP_ASYM_CIPHER *cipher)
 513 {
 514     return cipher->type_name;
 515 }
 516
 517 const char *EVP_ASYM_CIPHER_get0_description(const EVP_ASYM_CIPHER *cipher)
 518 {
 519     return cipher->description;
 520 }
 521
 522 void EVP_ASYM_CIPHER_do_all_provided(OSSL_LIB_CTX *libctx,
 523                                      void (*fn)(EVP_ASYM_CIPHER *cipher,
 524                                                 void *arg),
 525                                      void *arg)
 526 {
 527     evp_generic_do_all(libctx, OSSL_OP_ASYM_CIPHER,
 528                        (void (*)(void *, void *))fn, arg,
 529                        evp_asym_cipher_from_algorithm,
 530                        (int (*)(void *))EVP_ASYM_CIPHER_up_ref,
 531                        (void (*)(void *))EVP_ASYM_CIPHER_free);
 532 }
 533
 534
 535 int EVP_ASYM_CIPHER_names_do_all(const EVP_ASYM_CIPHER *cipher,
 536                                  void (*fn)(const char *name, void *data),
 537                                  void *data)
 538 {
 539     if (cipher->prov != NULL)
 540         return evp_names_do_all(cipher->prov, cipher->name_id, fn, data);
 541
 542     return 1;
 543 }
 544
 545 const OSSL_PARAM *EVP_ASYM_CIPHER_gettable_ctx_params(const EVP_ASYM_CIPHER *cip)
 546 {
 547     void *provctx;
 548
 549     if (cip == NULL || cip->gettable_ctx_params == NULL)
 550         return NULL;
 551
 552     provctx = ossl_provider_ctx(EVP_ASYM_CIPHER_get0_provider(cip));
 553     return cip->gettable_ctx_params(NULL, provctx);
 554 }
 555
 556 const OSSL_PARAM *EVP_ASYM_CIPHER_settable_ctx_params(const EVP_ASYM_CIPHER *cip)
 557 {
 558     void *provctx;
 559
 560     if (cip == NULL || cip->settable_ctx_params == NULL)
 561         return NULL;
 562
 563     provctx = ossl_provider_ctx(EVP_ASYM_CIPHER_get0_provider(cip));
 564     return cip->settable_ctx_params(NULL, provctx);
 565 }