Hide ECX_KEY again

ECX_KEY was not meant for public consumption, it was only to be
accessed indirectly via EVP routines.  However, we still need internal
access for our decoders.

This partially reverts 7c664b1f1b5f60bf896f5fdea5c08c401c541dfe

Fixes #12880

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12956)

diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index aae71b30e29dc05e7a3b29879cec264e2221a101..73502f1f62e9864f2b704765a2c3222077f88821 100644 (file)
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -870,15 +870,7 @@ EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)
     return ret;
 }
 
-static int EVP_PKEY_set1_ECX_KEY(EVP_PKEY *pkey, int type, ECX_KEY *key)
-{
-    int ret = EVP_PKEY_assign(pkey, type, key);
-    if (ret)
-        ecx_key_up_ref(key);
-    return ret;
-}
-
-static ECX_KEY *EVP_PKEY_get0_ECX_KEY(const EVP_PKEY *pkey, int type)
+static ECX_KEY *evp_pkey_get0_ECX_KEY(const EVP_PKEY *pkey, int type)
 {
     if (!evp_pkey_downgrade((EVP_PKEY *)pkey)) {
         ERR_raise(ERR_LIB_EVP, EVP_R_INACCESSIBLE_KEY);
@@ -891,26 +883,18 @@ static ECX_KEY *EVP_PKEY_get0_ECX_KEY(const EVP_PKEY *pkey, int type)
     return pkey->pkey.ecx;
 }
 
-static ECX_KEY *EVP_PKEY_get1_ECX_KEY(EVP_PKEY *pkey, int type)
+static ECX_KEY *evp_pkey_get1_ECX_KEY(EVP_PKEY *pkey, int type)
 {
-    ECX_KEY *ret = EVP_PKEY_get0_ECX_KEY(pkey, type);
+    ECX_KEY *ret = evp_pkey_get0_ECX_KEY(pkey, type);
     if (ret != NULL)
         ecx_key_up_ref(ret);
     return ret;
 }
 
 #  define IMPLEMENT_ECX_VARIANT(NAME)                                   \
-    int EVP_PKEY_set1_##NAME(EVP_PKEY *pkey, ECX_KEY *key)              \
-    {                                                                   \
-        return EVP_PKEY_set1_ECX_KEY(pkey, EVP_PKEY_##NAME, key);       \
-    }                                                                   \
-    ECX_KEY *EVP_PKEY_get0_##NAME(const EVP_PKEY *pkey)                 \
-    {                                                                   \
-        return EVP_PKEY_get0_ECX_KEY(pkey, EVP_PKEY_##NAME);            \
-    }                                                                   \
-    ECX_KEY *EVP_PKEY_get1_##NAME(EVP_PKEY *pkey)                       \
+    ECX_KEY *evp_pkey_get1_##NAME(EVP_PKEY *pkey)                       \
     {                                                                   \
-        return EVP_PKEY_get1_ECX_KEY(pkey, EVP_PKEY_##NAME);            \
+        return evp_pkey_get1_ECX_KEY(pkey, EVP_PKEY_##NAME);            \
     }
 IMPLEMENT_ECX_VARIANT(X25519)
 IMPLEMENT_ECX_VARIANT(X448)

diff --git a/doc/internal/man3/evp_pkey_get1_ED25519.pod b/doc/internal/man3/evp_pkey_get1_ED25519.pod
new file mode 100644 (file)
index 0000000..37b41e4
--- /dev/null
+++ b/doc/internal/man3/evp_pkey_get1_ED25519.pod
@@ -0,0 +1,43 @@
+=pod
+
+=head1 NAME
+
+evp_pkey_get1_ED25519, evp_pkey_get1_ED448,
+evp_pkey_get1_X25519, evp_pkey_get1_X448
+- internal ECX from EVP_PKEY getter functions
+
+=head1 SYNOPSIS
+
+ #include "internal/evp.h"
+
+ ECX_KEY *evp_pkey_get1_ED25519(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_ED448(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_X25519(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_X448(EVP_PKEY *pkey);
+
+=head1 DESCRIPTION
+
+evp_pkey_get1_ED25519(), evp_pkey_get1_ED448(), evp_pkey_get1_X25519() and
+evp_pkey_get1_X448() return the referenced key in I<pkey> or NULL if the key
+is not of the correct type.  The returned key must be freed after use.
+
+=head1 RETURN VALUES
+
+evp_pkey_get1_ED25519(), evp_pkey_get1_ED448(), evp_pkey_get1_X25519() and
+evp_pkey_get1_X448() return the referenced key or NULL if an error
+occurred.
+
+=head1 HISTORY
+
+This functionality was added to OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use this
+file except in compliance with the License.  You can obtain a copy in the file
+LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

diff --git a/doc/man3/EVP_PKEY_set1_RSA.pod b/doc/man3/EVP_PKEY_set1_RSA.pod
index 89737a3c8cac30d490c876a8a4b05acb5e747dc4..1a30b068cff8c77e5706aa92e11b9a5bb14084b0 100644 (file)
--- a/doc/man3/EVP_PKEY_set1_RSA.pod
+++ b/doc/man3/EVP_PKEY_set1_RSA.pod
@@ -3,18 +3,10 @@
 =head1 NAME
 
 EVP_PKEY_set1_RSA, EVP_PKEY_set1_DSA, EVP_PKEY_set1_DH, EVP_PKEY_set1_EC_KEY,
-EVP_PKEY_set1_ED25519, EVP_PKEY_set1_ED448,
-EVP_PKEY_set1_X25519, EVP_PKEY_set1_X448,
 EVP_PKEY_get1_RSA, EVP_PKEY_get1_DSA, EVP_PKEY_get1_DH, EVP_PKEY_get1_EC_KEY,
-EVP_PKEY_get1_ED25519, EVP_PKEY_get1_ED448,
-EVP_PKEY_get1_X25519, EVP_PKEY_get1_X448,
 EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY,
-EVP_PKEY_get0_ED25519, EVP_PKEY_get0_ED448,
-EVP_PKEY_get0_X25519, EVP_PKEY_get0_X448,
 EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH,
 EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH,
-EVP_PKEY_assign_ED25519, EVP_PKEY_assign_ED448,
-EVP_PKEY_assign_X25519, EVP_PKEY_assign_X448,
 EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash,
 EVP_PKEY_type, EVP_PKEY_id, EVP_PKEY_base_id, EVP_PKEY_set_alias_type,
 EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
@@ -27,19 +19,11 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
  int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key);
  int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key);
  int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
- int EVP_PKEY_set1_ED25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_ED448(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_X25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_X448(EVP_PKEY *pkey, ECX_KEY *key);
 
  RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
  DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
  DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey);
  EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_ED25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_ED448(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_X25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_X448(EVP_PKEY *pkey);
 
  const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len);
  const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len);
@@ -48,19 +32,11 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
  DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey);
  DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey);
  EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_ED25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_ED448(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_X25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_X448(EVP_PKEY *pkey);
 
  int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key);
  int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key);
  int EVP_PKEY_assign_DH(EVP_PKEY *pkey, DH *key);
  int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
- int EVP_PKEY_assign_ED25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_ED448(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_X25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_X448(EVP_PKEY *pkey, ECX_KEY *key);
  int EVP_PKEY_assign_POLY1305(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);
  int EVP_PKEY_assign_SIPHASH(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);
 
@@ -74,28 +50,21 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
 
 =head1 DESCRIPTION
 
-EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH(),
-EVP_PKEY_set1_EC_KEY(), EVP_PKEY_set1_ED25519(), EVP_PKEY_set1_ED448(),
-EVP_PKEY_set1_X25519() and EVP_PKEY_set1_X448() set the key referenced by
-I<pkey> to I<key>.
+EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() and
+EVP_PKEY_set1_EC_KEY() set the key referenced by I<pkey> to I<key>.
 
 EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and
-EVP_PKEY_get1_EC_KEY(), EVP_PKEY_get1_ED25519(), EVP_PKEY_get1_ED448(),
-EVP_PKEY_get1_X25519() and EVP_PKEY_get1_X448() return the referenced key in
-I<pkey> or NULL if the key is not of the correct type.  The returned key must
-be freed after use.
+EVP_PKEY_get1_EC_KEY() return the referenced key in I<pkey> or NULL if the
+key is not of the correct type.  The returned key must be freed after use.
 
 EVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(),
-EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH(),
-EVP_PKEY_get0_EC_KEY(), EVP_PKEY_get0_ED25519(), EVP_PKEY_get0_ED448(),
-EVP_PKEY_get0_X25519() and EVP_PKEY_get0_X448() return the referenced
-key in I<pkey> or NULL if the key is not of the correct type but the
-reference count of the returned key is B<not> incremented and so must not be
-freed after use.
+EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() and
+EVP_PKEY_get0_EC_KEY() return the referenced key in I<pkey> or NULL if the
+key is not of the correct type but the reference count of the returned key
+is B<not> incremented and so must not be freed after use.
 
 EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(),
-EVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_ED25519(), EVP_PKEY_assign_ED448(),
-EVP_PKEY_assign_X25519(), EVP_PKEY_assign_X448(), EVP_PKEY_assign_POLY1305() and
+EVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and
 EVP_PKEY_assign_SIPHASH() set the referenced key to I<key> however these use
 the supplied I<key> internally and so I<key> will be freed when the parent
 I<pkey> is freed.

diff --git a/include/crypto/ecx.h b/include/crypto/ecx.h
index 72cf5dd8430bb38464c704dbd415331c41ae64e6..8730f93872c726a1bc73df1421dae22dfc8f0a77 100644 (file)
--- a/include/crypto/ecx.h
+++ b/include/crypto/ecx.h
@@ -111,10 +111,15 @@ int X448(uint8_t out_shared_key[56], const uint8_t private_key[56],
 void X448_public_from_private(uint8_t out_public_value[56],
                               const uint8_t private_key[56]);
 
+
 /* Backend support */
 int ecx_public_from_private(ECX_KEY *key);
 int ecx_key_fromdata(ECX_KEY *ecx, const OSSL_PARAM params[],
                      int include_private);
 
+ECX_KEY *evp_pkey_get1_X25519(EVP_PKEY *pkey);
+ECX_KEY *evp_pkey_get1_X448(EVP_PKEY *pkey);
+ECX_KEY *evp_pkey_get1_ED25519(EVP_PKEY *pkey);
+ECX_KEY *evp_pkey_get1_ED448(EVP_PKEY *pkey);
 # endif /* OPENSSL_NO_EC */
 #endif

diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index e843a48b22cc3fb9383df2ce74fd1ee6784ccad6..ab5ca6b44020046d0aa4d5e3f1459639337e66ac 100644 (file)
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -465,14 +465,6 @@ typedef int (EVP_PBE_KEYGEN) (EVP_CIPHER_CTX *ctx, const char *pass,
 # ifndef OPENSSL_NO_EC
 #  define EVP_PKEY_assign_EC_KEY(pkey,eckey) EVP_PKEY_assign((pkey),EVP_PKEY_EC,\
                                         (eckey))
-#  define EVP_PKEY_assign_X25519(pkey,ecxkey) EVP_PKEY_assign((pkey),EVP_PKEY_X25519,\
-                                        (ecxkey))
-#  define EVP_PKEY_assign_X448(pkey,ecxkey) EVP_PKEY_assign((pkey),EVP_PKEY_X448,\
-                                        (ecxkey))
-#  define EVP_PKEY_assign_ED25519(pkey,ecxkey) EVP_PKEY_assign((pkey),EVP_PKEY_ED25519,\
-                                        (ecxkey))
-#  define EVP_PKEY_assign_ED448(pkey,ecxkey) EVP_PKEY_assign((pkey),EVP_PKEY_ED448,\
-                                        (ecxkey))
 # endif
 # ifndef OPENSSL_NO_SIPHASH
 #  define EVP_PKEY_assign_SIPHASH(pkey,shkey) EVP_PKEY_assign((pkey),\
@@ -1241,19 +1233,6 @@ struct ec_key_st;
 int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, struct ec_key_st *key);
 struct ec_key_st *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey);
 struct ec_key_st *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);
-struct ecx_key_st;
-int EVP_PKEY_set1_X25519(EVP_PKEY *pkey, struct ecx_key_st *key);
-struct ecx_key_st *EVP_PKEY_get0_X25519(const EVP_PKEY *pkey);
-struct ecx_key_st *EVP_PKEY_get1_X25519(EVP_PKEY *pkey);
-int EVP_PKEY_set1_X448(EVP_PKEY *pkey, struct ecx_key_st *key);
-struct ecx_key_st *EVP_PKEY_get0_X448(const EVP_PKEY *pkey);
-struct ecx_key_st *EVP_PKEY_get1_X448(EVP_PKEY *pkey);
-int EVP_PKEY_set1_ED25519(EVP_PKEY *pkey, struct ecx_key_st *key);
-struct ecx_key_st *EVP_PKEY_get0_ED25519(const EVP_PKEY *pkey);
-struct ecx_key_st *EVP_PKEY_get1_ED25519(EVP_PKEY *pkey);
-int EVP_PKEY_set1_ED448(EVP_PKEY *pkey, struct ecx_key_st *key);
-struct ecx_key_st *EVP_PKEY_get0_ED448(const EVP_PKEY *pkey);
-struct ecx_key_st *EVP_PKEY_get1_ED448(EVP_PKEY *pkey);
 # endif
 
 EVP_PKEY *EVP_PKEY_new(void);

diff --git a/providers/implementations/encode_decode/decode_der2key.c b/providers/implementations/encode_decode/decode_der2key.c
index f75faf2d111e6e25794ce11a45e073d332c3bfb9..12f5efd153a97687f63fd204039d169e326d61b9 100644 (file)
--- a/providers/implementations/encode_decode/decode_der2key.c
+++ b/providers/implementations/encode_decode/decode_der2key.c
@@ -304,12 +304,12 @@ IMPLEMENT_NEWCTX("DSA", DSA, dsa, EVP_PKEY_get1_DSA, DSA_free);
 #ifndef OPENSSL_NO_EC
 IMPLEMENT_NEWCTX("EC", EC, ec, EVP_PKEY_get1_EC_KEY, EC_KEY_free);
 IMPLEMENT_NEWCTX("X25519", X25519, x25519,
-                 EVP_PKEY_get1_X25519, ecx_key_free);
+                 evp_pkey_get1_X25519, ecx_key_free);
 IMPLEMENT_NEWCTX("X448", X448, x448,
-                 EVP_PKEY_get1_X448, ecx_key_free);
+                 evp_pkey_get1_X448, ecx_key_free);
 IMPLEMENT_NEWCTX("ED25519", ED25519, ed25519,
-                 EVP_PKEY_get1_ED25519, ecx_key_free);
-IMPLEMENT_NEWCTX("ED448", ED448, ed448, EVP_PKEY_get1_ED448, ecx_key_free);
+                 evp_pkey_get1_ED25519, ecx_key_free);
+IMPLEMENT_NEWCTX("ED448", ED448, ed448, evp_pkey_get1_ED448, ecx_key_free);
 #endif
 IMPLEMENT_NEWCTX("RSA", RSA, rsa, EVP_PKEY_get1_RSA, RSA_free);
 IMPLEMENT_NEWCTX("RSA-PSS", RSA_PSS, rsapss, EVP_PKEY_get1_RSA, RSA_free);

diff --git a/util/libcrypto.num b/util/libcrypto.num
index ceab5d3fd9838021c037b4227bfa99c0785f982d..851d5bb2dd7e6b33fa52fb6273f3e937624571bd 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5165,18 +5165,6 @@ ERR_load_OSSL_DECODER_strings           ?        3_0_0   EXIST::FUNCTION:
 OSSL_DECODER_gettable_params            ?      3_0_0   EXIST::FUNCTION:
 OSSL_DECODER_get_params                 ?      3_0_0   EXIST::FUNCTION:
 OSSL_DECODER_CTX_new_by_EVP_PKEY        ?      3_0_0   EXIST::FUNCTION:
-EVP_PKEY_set1_X25519                    ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get0_X25519                    ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get1_X25519                    ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_set1_X448                      ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get0_X448                      ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get1_X448                      ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_set1_ED25519                   ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get0_ED25519                   ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get1_ED25519                   ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_set1_ED448                     ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get0_ED448                     ?      3_0_0   EXIST::FUNCTION:EC
-EVP_PKEY_get1_ED448                     ?      3_0_0   EXIST::FUNCTION:EC
 OSSL_DECODER_CTX_set_construct          ?      3_0_0   EXIST::FUNCTION:
 OSSL_DECODER_CTX_set_construct_data     ?      3_0_0   EXIST::FUNCTION:
 OSSL_DECODER_CTX_set_cleanup            ?      3_0_0   EXIST::FUNCTION:

diff --git a/util/other.syms b/util/other.syms
index 6c7ec4c9ca13fe3663926eba33d8f282d9b1e839..395b4751597f519b280b2c9c3cc0308c52365ca8 100644 (file)
--- a/util/other.syms
+++ b/util/other.syms
@@ -304,10 +304,6 @@ EVP_PKEY_CTX_set_tls1_prf_md            define
 EVP_PKEY_assign_DH                      define
 EVP_PKEY_assign_DSA                     define
 EVP_PKEY_assign_EC_KEY                  define
-EVP_PKEY_assign_ED25519                 define
-EVP_PKEY_assign_ED448                   define
-EVP_PKEY_assign_X25519                  define
-EVP_PKEY_assign_X448                    define
 EVP_PKEY_assign_POLY1305                define
 EVP_PKEY_assign_RSA                     define
 EVP_PKEY_assign_SIPHASH                 define