crypto/evp/p_lib.c

   1 /*
   2  * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include "internal/refcount.h"
  13 #include <openssl/bn.h>
  14 #include <openssl/err.h>
  15 #include <openssl/objects.h>
  16 #include <openssl/evp.h>
  17 #include <openssl/x509.h>
  18 #include <openssl/rsa.h>
  19 #include <openssl/dsa.h>
  20 #include <openssl/dh.h>
  21 #include <openssl/cmac.h>
  22 #include <openssl/engine.h>
  23 #include <openssl/params.h>
  24 #include <openssl/serializer.h>
  25 #include <openssl/core_names.h>
  26
  27 #include "crypto/asn1.h"
  28 #include "crypto/evp.h"
  29 #include "internal/provider.h"
  30
  31 static void evp_pkey_free_it(EVP_PKEY *key);
  32
  33 #ifndef FIPS_MODE
  34
  35 int EVP_PKEY_bits(const EVP_PKEY *pkey)
  36 {
  37     if (pkey != NULL) {
  38         if (pkey->ameth == NULL)
  39             return pkey->cache.bits;
  40         else if (pkey->ameth->pkey_bits)
  41             return pkey->ameth->pkey_bits(pkey);
  42     }
  43     return 0;
  44 }
  45
  46 int EVP_PKEY_security_bits(const EVP_PKEY *pkey)
  47 {
  48     if (pkey == NULL)
  49         return 0;
  50     if (pkey->ameth == NULL)
  51         return pkey->cache.security_bits;
  52     if (pkey->ameth->pkey_security_bits == NULL)
  53         return -2;
  54     return pkey->ameth->pkey_security_bits(pkey);
  55 }
  56
  57 int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode)
  58 {
  59 # ifndef OPENSSL_NO_DSA
  60     if (pkey->type == EVP_PKEY_DSA) {
  61         int ret = pkey->save_parameters;
  62
  63         if (mode >= 0)
  64             pkey->save_parameters = mode;
  65         return ret;
  66     }
  67 # endif
  68 # ifndef OPENSSL_NO_EC
  69     if (pkey->type == EVP_PKEY_EC) {
  70         int ret = pkey->save_parameters;
  71
  72         if (mode >= 0)
  73             pkey->save_parameters = mode;
  74         return ret;
  75     }
  76 # endif
  77     return 0;
  78 }
  79
  80 int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  81 {
  82     if (to->type == EVP_PKEY_NONE) {
  83         if (EVP_PKEY_set_type(to, from->type) == 0)
  84             return 0;
  85     } else if (to->type != from->type) {
  86         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_KEY_TYPES);
  87         goto err;
  88     }
  89
  90     if (EVP_PKEY_missing_parameters(from)) {
  91         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_MISSING_PARAMETERS);
  92         goto err;
  93     }
  94
  95     if (!EVP_PKEY_missing_parameters(to)) {
  96         if (EVP_PKEY_cmp_parameters(to, from) == 1)
  97             return 1;
  98         EVPerr(EVP_F_EVP_PKEY_COPY_PARAMETERS, EVP_R_DIFFERENT_PARAMETERS);
  99         return 0;
 100     }
 101
 102     if (from->ameth && from->ameth->param_copy)
 103         return from->ameth->param_copy(to, from);
 104  err:
 105     return 0;
 106 }
 107
 108 int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey)
 109 {
 110     if (pkey != NULL && pkey->ameth && pkey->ameth->param_missing)
 111         return pkey->ameth->param_missing(pkey);
 112     return 0;
 113 }
 114
 115 int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
 116 {
 117     if (a->type != b->type)
 118         return -1;
 119     if (a->ameth && a->ameth->param_cmp)
 120         return a->ameth->param_cmp(a, b);
 121     return -2;
 122 }
 123
 124 int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
 125 {
 126     if (a->type != b->type)
 127         return -1;
 128
 129     if (a->ameth) {
 130         int ret;
 131         /* Compare parameters if the algorithm has them */
 132         if (a->ameth->param_cmp) {
 133             ret = a->ameth->param_cmp(a, b);
 134             if (ret <= 0)
 135                 return ret;
 136         }
 137
 138         if (a->ameth->pub_cmp)
 139             return a->ameth->pub_cmp(a, b);
 140     }
 141
 142     return -2;
 143 }
 144
 145
 146 /*
 147  * Setup a public key ASN1 method and ENGINE from a NID or a string. If pkey
 148  * is NULL just return 1 or 0 if the algorithm exists.
 149  */
 150
 151 static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
 152                          int len)
 153 {
 154     const EVP_PKEY_ASN1_METHOD *ameth;
 155     ENGINE **eptr = (e == NULL) ? &e :  NULL;
 156
 157     if (pkey) {
 158         if (pkey->pkey.ptr)
 159             evp_pkey_free_it(pkey);
 160         /*
 161          * If key type matches and a method exists then this lookup has
 162          * succeeded once so just indicate success.
 163          */
 164         if ((type == pkey->save_type) && pkey->ameth)
 165             return 1;
 166 # ifndef OPENSSL_NO_ENGINE
 167         /* If we have ENGINEs release them */
 168         ENGINE_finish(pkey->engine);
 169         pkey->engine = NULL;
 170         ENGINE_finish(pkey->pmeth_engine);
 171         pkey->pmeth_engine = NULL;
 172 # endif
 173     }
 174     if (str)
 175         ameth = EVP_PKEY_asn1_find_str(eptr, str, len);
 176     else
 177         ameth = EVP_PKEY_asn1_find(eptr, type);
 178 # ifndef OPENSSL_NO_ENGINE
 179     if (pkey == NULL && eptr != NULL)
 180         ENGINE_finish(e);
 181 # endif
 182     if (ameth == NULL) {
 183         EVPerr(EVP_F_PKEY_SET_TYPE, EVP_R_UNSUPPORTED_ALGORITHM);
 184         return 0;
 185     }
 186     if (pkey) {
 187         pkey->ameth = ameth;
 188         pkey->engine = e;
 189
 190         pkey->type = pkey->ameth->pkey_id;
 191         pkey->save_type = type;
 192     }
 193     return 1;
 194 }
 195
 196 EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
 197                                        const unsigned char *priv,
 198                                        size_t len)
 199 {
 200     EVP_PKEY *ret = EVP_PKEY_new();
 201
 202     if (ret == NULL
 203             || !pkey_set_type(ret, e, type, NULL, -1)) {
 204         /* EVPerr already called */
 205         goto err;
 206     }
 207
 208     if (ret->ameth->set_priv_key == NULL) {
 209         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY,
 210                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 211         goto err;
 212     }
 213
 214     if (!ret->ameth->set_priv_key(ret, priv, len)) {
 215         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PRIVATE_KEY, EVP_R_KEY_SETUP_FAILED);
 216         goto err;
 217     }
 218
 219     return ret;
 220
 221  err:
 222     EVP_PKEY_free(ret);
 223     return NULL;
 224 }
 225
 226 EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
 227                                       const unsigned char *pub,
 228                                       size_t len)
 229 {
 230     EVP_PKEY *ret = EVP_PKEY_new();
 231
 232     if (ret == NULL
 233             || !pkey_set_type(ret, e, type, NULL, -1)) {
 234         /* EVPerr already called */
 235         goto err;
 236     }
 237
 238     if (ret->ameth->set_pub_key == NULL) {
 239         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY,
 240                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 241         goto err;
 242     }
 243
 244     if (!ret->ameth->set_pub_key(ret, pub, len)) {
 245         EVPerr(EVP_F_EVP_PKEY_NEW_RAW_PUBLIC_KEY, EVP_R_KEY_SETUP_FAILED);
 246         goto err;
 247     }
 248
 249     return ret;
 250
 251  err:
 252     EVP_PKEY_free(ret);
 253     return NULL;
 254 }
 255
 256 int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
 257                                  size_t *len)
 258 {
 259      if (pkey->ameth->get_priv_key == NULL) {
 260         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY,
 261                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 262         return 0;
 263     }
 264
 265     if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
 266         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, EVP_R_GET_RAW_KEY_FAILED);
 267         return 0;
 268     }
 269
 270     return 1;
 271 }
 272
 273 int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
 274                                 size_t *len)
 275 {
 276      if (pkey->ameth->get_pub_key == NULL) {
 277         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY,
 278                EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 279         return 0;
 280     }
 281
 282     if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
 283         EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, EVP_R_GET_RAW_KEY_FAILED);
 284         return 0;
 285     }
 286
 287     return 1;
 288 }
 289
 290 EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
 291                                 size_t len, const EVP_CIPHER *cipher)
 292 {
 293 # ifndef OPENSSL_NO_CMAC
 294 #  ifndef OPENSSL_NO_ENGINE
 295     const char *engine_id = e != NULL ? ENGINE_get_id(e) : NULL;
 296 #  endif
 297     const char *cipher_name = EVP_CIPHER_name(cipher);
 298     const OSSL_PROVIDER *prov = EVP_CIPHER_provider(cipher);
 299     OPENSSL_CTX *libctx =
 300         prov == NULL ? NULL : ossl_provider_library_context(prov);
 301     EVP_PKEY *ret = EVP_PKEY_new();
 302     EVP_MAC *cmac = EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, NULL);
 303     EVP_MAC_CTX *cmctx = cmac != NULL ? EVP_MAC_CTX_new(cmac) : NULL;
 304     OSSL_PARAM params[4];
 305     size_t paramsn = 0;
 306
 307     if (ret == NULL
 308             || cmctx == NULL
 309             || !pkey_set_type(ret, e, EVP_PKEY_CMAC, NULL, -1)) {
 310         /* EVPerr already called */
 311         goto err;
 312     }
 313
 314 #  ifndef OPENSSL_NO_ENGINE
 315     if (engine_id != NULL)
 316         params[paramsn++] =
 317             OSSL_PARAM_construct_utf8_string("engine", (char *)engine_id, 0);
 318 #  endif
 319
 320     params[paramsn++] =
 321         OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER,
 322                                          (char *)cipher_name, 0);
 323     params[paramsn++] =
 324         OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
 325                                           (char *)priv, len);
 326     params[paramsn] = OSSL_PARAM_construct_end();
 327
 328     if (!EVP_MAC_CTX_set_params(cmctx, params)) {
 329         EVPerr(EVP_F_EVP_PKEY_NEW_CMAC_KEY, EVP_R_KEY_SETUP_FAILED);
 330         goto err;
 331     }
 332
 333     ret->pkey.ptr = cmctx;
 334     return ret;
 335
 336  err:
 337     EVP_PKEY_free(ret);
 338     EVP_MAC_CTX_free(cmctx);
 339     EVP_MAC_free(cmac);
 340     return NULL;
 341 # else
 342     EVPerr(EVP_F_EVP_PKEY_NEW_CMAC_KEY,
 343            EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
 344     return NULL;
 345 # endif
 346 }
 347
 348 int EVP_PKEY_set_type(EVP_PKEY *pkey, int type)
 349 {
 350     return pkey_set_type(pkey, NULL, type, NULL, -1);
 351 }
 352
 353 int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len)
 354 {
 355     return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, str, len);
 356 }
 357
 358 int EVP_PKEY_set_alias_type(EVP_PKEY *pkey, int type)
 359 {
 360     if (pkey->type == type) {
 361         return 1; /* it already is that type */
 362     }
 363
 364     /*
 365      * The application is requesting to alias this to a different pkey type,
 366      * but not one that resolves to the base type.
 367      */
 368     if (EVP_PKEY_type(type) != EVP_PKEY_base_id(pkey)) {
 369         EVPerr(EVP_F_EVP_PKEY_SET_ALIAS_TYPE, EVP_R_UNSUPPORTED_ALGORITHM);
 370         return 0;
 371     }
 372
 373     pkey->type = type;
 374     return 1;
 375 }
 376
 377 # ifndef OPENSSL_NO_ENGINE
 378 int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e)
 379 {
 380     if (e != NULL) {
 381         if (!ENGINE_init(e)) {
 382             EVPerr(EVP_F_EVP_PKEY_SET1_ENGINE, ERR_R_ENGINE_LIB);
 383             return 0;
 384         }
 385         if (ENGINE_get_pkey_meth(e, pkey->type) == NULL) {
 386             ENGINE_finish(e);
 387             EVPerr(EVP_F_EVP_PKEY_SET1_ENGINE, EVP_R_UNSUPPORTED_ALGORITHM);
 388             return 0;
 389         }
 390     }
 391     ENGINE_finish(pkey->pmeth_engine);
 392     pkey->pmeth_engine = e;
 393     return 1;
 394 }
 395
 396 ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey)
 397 {
 398     return pkey->engine;
 399 }
 400 # endif
 401 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key)
 402 {
 403     if (pkey == NULL || !EVP_PKEY_set_type(pkey, type))
 404         return 0;
 405     pkey->pkey.ptr = key;
 406     return (key != NULL);
 407 }
 408
 409 void *EVP_PKEY_get0(const EVP_PKEY *pkey)
 410 {
 411     return pkey->pkey.ptr;
 412 }
 413
 414 const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len)
 415 {
 416     ASN1_OCTET_STRING *os = NULL;
 417     if (pkey->type != EVP_PKEY_HMAC) {
 418         EVPerr(EVP_F_EVP_PKEY_GET0_HMAC, EVP_R_EXPECTING_AN_HMAC_KEY);
 419         return NULL;
 420     }
 421     os = EVP_PKEY_get0(pkey);
 422     *len = os->length;
 423     return os->data;
 424 }
 425
 426 # ifndef OPENSSL_NO_POLY1305
 427 const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len)
 428 {
 429     ASN1_OCTET_STRING *os = NULL;
 430     if (pkey->type != EVP_PKEY_POLY1305) {
 431         EVPerr(EVP_F_EVP_PKEY_GET0_POLY1305, EVP_R_EXPECTING_A_POLY1305_KEY);
 432         return NULL;
 433     }
 434     os = EVP_PKEY_get0(pkey);
 435     *len = os->length;
 436     return os->data;
 437 }
 438 # endif
 439
 440 # ifndef OPENSSL_NO_SIPHASH
 441 const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len)
 442 {
 443     ASN1_OCTET_STRING *os = NULL;
 444
 445     if (pkey->type != EVP_PKEY_SIPHASH) {
 446         EVPerr(EVP_F_EVP_PKEY_GET0_SIPHASH, EVP_R_EXPECTING_A_SIPHASH_KEY);
 447         return NULL;
 448     }
 449     os = EVP_PKEY_get0(pkey);
 450     *len = os->length;
 451     return os->data;
 452 }
 453 # endif
 454
 455 # ifndef OPENSSL_NO_RSA
 456 int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key)
 457 {
 458     int ret = EVP_PKEY_assign_RSA(pkey, key);
 459     if (ret)
 460         RSA_up_ref(key);
 461     return ret;
 462 }
 463
 464 RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey)
 465 {
 466     if (pkey->type != EVP_PKEY_RSA && pkey->type != EVP_PKEY_RSA_PSS) {
 467         EVPerr(EVP_F_EVP_PKEY_GET0_RSA, EVP_R_EXPECTING_AN_RSA_KEY);
 468         return NULL;
 469     }
 470     return pkey->pkey.rsa;
 471 }
 472
 473 RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey)
 474 {
 475     RSA *ret = EVP_PKEY_get0_RSA(pkey);
 476     if (ret != NULL)
 477         RSA_up_ref(ret);
 478     return ret;
 479 }
 480 # endif
 481
 482 # ifndef OPENSSL_NO_DSA
 483 int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
 484 {
 485     int ret = EVP_PKEY_assign_DSA(pkey, key);
 486     if (ret)
 487         DSA_up_ref(key);
 488     return ret;
 489 }
 490
 491 DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey)
 492 {
 493     if (pkey->type != EVP_PKEY_DSA) {
 494         EVPerr(EVP_F_EVP_PKEY_GET0_DSA, EVP_R_EXPECTING_A_DSA_KEY);
 495         return NULL;
 496     }
 497     return pkey->pkey.dsa;
 498 }
 499
 500 DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
 501 {
 502     DSA *ret = EVP_PKEY_get0_DSA(pkey);
 503     if (ret != NULL)
 504         DSA_up_ref(ret);
 505     return ret;
 506 }
 507 # endif
 508
 509 # ifndef OPENSSL_NO_EC
 510
 511 int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key)
 512 {
 513     int ret = EVP_PKEY_assign_EC_KEY(pkey, key);
 514     if (ret)
 515         EC_KEY_up_ref(key);
 516     return ret;
 517 }
 518
 519 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey)
 520 {
 521     if (pkey->type != EVP_PKEY_EC) {
 522         EVPerr(EVP_F_EVP_PKEY_GET0_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
 523         return NULL;
 524     }
 525     return pkey->pkey.ec;
 526 }
 527
 528 EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)
 529 {
 530     EC_KEY *ret = EVP_PKEY_get0_EC_KEY(pkey);
 531     if (ret != NULL)
 532         EC_KEY_up_ref(ret);
 533     return ret;
 534 }
 535 # endif
 536
 537 # ifndef OPENSSL_NO_DH
 538
 539 int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
 540 {
 541     int type = DH_get0_q(key) == NULL ? EVP_PKEY_DH : EVP_PKEY_DHX;
 542     int ret = EVP_PKEY_assign(pkey, type, key);
 543
 544     if (ret)
 545         DH_up_ref(key);
 546     return ret;
 547 }
 548
 549 DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey)
 550 {
 551     if (pkey->type != EVP_PKEY_DH && pkey->type != EVP_PKEY_DHX) {
 552         EVPerr(EVP_F_EVP_PKEY_GET0_DH, EVP_R_EXPECTING_A_DH_KEY);
 553         return NULL;
 554     }
 555     return pkey->pkey.dh;
 556 }
 557
 558 DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
 559 {
 560     DH *ret = EVP_PKEY_get0_DH(pkey);
 561     if (ret != NULL)
 562         DH_up_ref(ret);
 563     return ret;
 564 }
 565 # endif
 566
 567 int EVP_PKEY_type(int type)
 568 {
 569     int ret;
 570     const EVP_PKEY_ASN1_METHOD *ameth;
 571     ENGINE *e;
 572     ameth = EVP_PKEY_asn1_find(&e, type);
 573     if (ameth)
 574         ret = ameth->pkey_id;
 575     else
 576         ret = NID_undef;
 577 # ifndef OPENSSL_NO_ENGINE
 578     ENGINE_finish(e);
 579 # endif
 580     return ret;
 581 }
 582
 583 int EVP_PKEY_id(const EVP_PKEY *pkey)
 584 {
 585     return pkey->type;
 586 }
 587
 588 int EVP_PKEY_base_id(const EVP_PKEY *pkey)
 589 {
 590     return EVP_PKEY_type(pkey->type);
 591 }
 592
 593
 594 static int print_reset_indent(BIO **out, int pop_f_prefix, long saved_indent)
 595 {
 596     BIO_set_indent(*out, saved_indent);
 597     if (pop_f_prefix) {
 598         BIO *next = BIO_pop(*out);
 599
 600         BIO_free(*out);
 601         *out = next;
 602     }
 603     return 1;
 604 }
 605
 606 static int print_set_indent(BIO **out, int *pop_f_prefix, long *saved_indent,
 607                             long indent)
 608 {
 609     *pop_f_prefix = 0;
 610     *saved_indent = 0;
 611     if (indent > 0) {
 612         long i = BIO_get_indent(*out);
 613
 614         *saved_indent =  (i < 0 ? 0 : i);
 615         if (BIO_set_indent(*out, indent) <= 0) {
 616             if ((*out = BIO_push(BIO_new(BIO_f_prefix()), *out)) == NULL)
 617                 return 0;
 618             *pop_f_prefix = 1;
 619         }
 620         if (BIO_set_indent(*out, indent) <= 0) {
 621             print_reset_indent(out, *pop_f_prefix, *saved_indent);
 622             return 0;
 623         }
 624     }
 625     return 1;
 626 }
 627
 628 static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,
 629                      const char *kstr)
 630 {
 631     return BIO_indent(out, indent, 128)
 632         && BIO_printf(out, "%s algorithm \"%s\" unsupported\n",
 633                       kstr, OBJ_nid2ln(pkey->type)) > 0;
 634 }
 635
 636 static int print_pkey(const EVP_PKEY *pkey, BIO *out, int indent,
 637                       const char *propquery /* For provided serialization */,
 638                       int (*legacy_print)(BIO *out, const EVP_PKEY *pkey,
 639                                           int indent, ASN1_PCTX *pctx),
 640                       ASN1_PCTX *legacy_pctx /* For legacy print */)
 641 {
 642     int pop_f_prefix;
 643     long saved_indent;
 644     OSSL_SERIALIZER_CTX *ctx = NULL;
 645     int ret = -2;                /* default to unsupported */
 646
 647     if (!print_set_indent(&out, &pop_f_prefix, &saved_indent, indent))
 648         return 0;
 649
 650     ctx = OSSL_SERIALIZER_CTX_new_by_EVP_PKEY(pkey, propquery);
 651     if (OSSL_SERIALIZER_CTX_get_serializer(ctx) != NULL)
 652         ret = OSSL_SERIALIZER_to_bio(ctx, out);
 653     OSSL_SERIALIZER_CTX_free(ctx);
 654
 655     if (ret != -2)
 656         goto end;
 657
 658     /* legacy fallback */
 659     if (legacy_print != NULL)
 660         ret = legacy_print(out, pkey, 0, legacy_pctx);
 661     else
 662         ret = unsup_alg(out, pkey, 0, "Public Key");
 663
 664  end:
 665     print_reset_indent(&out, pop_f_prefix, saved_indent);
 666     return ret;
 667 }
 668
 669 int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey,
 670                           int indent, ASN1_PCTX *pctx)
 671 {
 672     return print_pkey(pkey, out, indent, OSSL_SERIALIZER_PUBKEY_TO_TEXT_PQ,
 673                       (pkey->ameth != NULL ? pkey->ameth->pub_print : NULL),
 674                       pctx);
 675 }
 676
 677 int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey,
 678                            int indent, ASN1_PCTX *pctx)
 679 {
 680     return print_pkey(pkey, out, indent, OSSL_SERIALIZER_PrivateKey_TO_TEXT_PQ,
 681                       (pkey->ameth != NULL ? pkey->ameth->priv_print : NULL),
 682                       pctx);
 683 }
 684
 685 int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
 686                           int indent, ASN1_PCTX *pctx)
 687 {
 688     return print_pkey(pkey, out, indent, OSSL_SERIALIZER_Parameters_TO_TEXT_PQ,
 689                       (pkey->ameth != NULL ? pkey->ameth->param_print : NULL),
 690                       pctx);
 691 }
 692
 693 static int evp_pkey_asn1_ctrl(EVP_PKEY *pkey, int op, int arg1, void *arg2)
 694 {
 695     if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL)
 696         return -2;
 697     return pkey->ameth->pkey_ctrl(pkey, op, arg1, arg2);
 698 }
 699
 700 int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
 701 {
 702     return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
 703 }
 704
 705 int EVP_PKEY_supports_digest_nid(EVP_PKEY *pkey, int nid)
 706 {
 707     int rv, default_nid;
 708
 709     rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SUPPORTS_MD_NID, nid, NULL);
 710     if (rv == -2) {
 711         /*
 712          * If there is a mandatory default digest and this isn't it, then
 713          * the answer is 'no'.
 714          */
 715         rv = EVP_PKEY_get_default_digest_nid(pkey, &default_nid);
 716         if (rv == 2)
 717             return (nid == default_nid);
 718         /* zero is an error from EVP_PKEY_get_default_digest_nid() */
 719         if (rv == 0)
 720             return -1;
 721     }
 722     return rv;
 723 }
 724
 725 int EVP_PKEY_set1_tls_encodedpoint(EVP_PKEY *pkey,
 726                                const unsigned char *pt, size_t ptlen)
 727 {
 728     if (ptlen > INT_MAX)
 729         return 0;
 730     if (evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SET1_TLS_ENCPT, ptlen,
 731                            (void *)pt) <= 0)
 732         return 0;
 733     return 1;
 734 }
 735
 736 size_t EVP_PKEY_get1_tls_encodedpoint(EVP_PKEY *pkey, unsigned char **ppt)
 737 {
 738     int rv;
 739     rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_GET1_TLS_ENCPT, 0, ppt);
 740     if (rv <= 0)
 741         return 0;
 742     return rv;
 743 }
 744
 745 #endif /* FIPS_MODE */
 746
 747 /*- All methods below can also be used in FIPS_MODE */
 748
 749 EVP_PKEY *EVP_PKEY_new(void)
 750 {
 751     EVP_PKEY *ret = OPENSSL_zalloc(sizeof(*ret));
 752
 753     if (ret == NULL) {
 754         EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
 755         return NULL;
 756     }
 757     ret->type = EVP_PKEY_NONE;
 758     ret->save_type = EVP_PKEY_NONE;
 759     ret->references = 1;
 760     ret->save_parameters = 1;
 761     ret->lock = CRYPTO_THREAD_lock_new();
 762     if (ret->lock == NULL) {
 763         EVPerr(EVP_F_EVP_PKEY_NEW, ERR_R_MALLOC_FAILURE);
 764         OPENSSL_free(ret);
 765         return NULL;
 766     }
 767     return ret;
 768 }
 769
 770 int EVP_PKEY_up_ref(EVP_PKEY *pkey)
 771 {
 772     int i;
 773
 774     if (CRYPTO_UP_REF(&pkey->references, &i, pkey->lock) <= 0)
 775         return 0;
 776
 777     REF_PRINT_COUNT("EVP_PKEY", pkey);
 778     REF_ASSERT_ISNT(i < 2);
 779     return ((i > 1) ? 1 : 0);
 780 }
 781
 782 static void evp_pkey_free_it(EVP_PKEY *x)
 783 {
 784     /* internal function; x is never NULL */
 785
 786     evp_keymgmt_clear_pkey_cache(x);
 787
 788     if (x->ameth && x->ameth->pkey_free) {
 789         x->ameth->pkey_free(x);
 790         x->pkey.ptr = NULL;
 791     }
 792 #if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODE)
 793     ENGINE_finish(x->engine);
 794     x->engine = NULL;
 795     ENGINE_finish(x->pmeth_engine);
 796     x->pmeth_engine = NULL;
 797 #endif
 798 }
 799
 800 void EVP_PKEY_free(EVP_PKEY *x)
 801 {
 802     int i;
 803
 804     if (x == NULL)
 805         return;
 806
 807     CRYPTO_DOWN_REF(&x->references, &i, x->lock);
 808     REF_PRINT_COUNT("EVP_PKEY", x);
 809     if (i > 0)
 810         return;
 811     REF_ASSERT_ISNT(i < 0);
 812     evp_pkey_free_it(x);
 813     CRYPTO_THREAD_lock_free(x->lock);
 814 #ifndef FIPS_MODE
 815     sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
 816 #endif
 817     OPENSSL_free(x);
 818 }
 819
 820 int EVP_PKEY_size(const EVP_PKEY *pkey)
 821 {
 822     if (pkey != NULL) {
 823         if (pkey->ameth == NULL)
 824             return pkey->cache.size;
 825         else if (pkey->ameth->pkey_size != NULL)
 826             return pkey->ameth->pkey_size(pkey);
 827     }
 828     return 0;
 829 }