Annotate why EVP_PKEY_CTX_ctrl_str() will stay for a while

Add tls1_prf_pkey_meth to pkey_methods

ok jsing

Hide public symbols in evp.h

largely mechanically done by the guentherizer 9000

ok tb@

Unhook and remove GOST and STREEBOG

This stops compiling the GOST source. The current implementation is low
quality and got in the way, especially in libssl. While we would be open
for GOST support,

Unhook and remove GOST and STREEBOG

This stops compiling the GOST source. The current implementation is low
quality and got in the way, especially in libssl. While we would be open
for GOST support, it needs to be significantly better than what we have
had and it also needs a maintainer.

Add OPENSSL_NO_GOST to opensslfeatures and stop installing gost.h.
Some code wrapped in #ifndef OPENSSL_NO_GOST will be removed later.

ok jsing

show more ...

Remove EVP_PKEY_meth_*() API

After ameth, the second bit of custom EVP_PKEY API removal.

ok jsing

Prepare to remove the EVP_PKEY_meth_* API

After removing the last caller of EVP_PKEY_meth_find() from libssl, none
of these is used. And with EVP_PKEY_meth_new() gone, there will no longer
be a way

Prepare to remove the EVP_PKEY_meth_* API

After removing the last caller of EVP_PKEY_meth_find() from libssl, none
of these is used. And with EVP_PKEY_meth_new() gone, there will no longer
be a way to get your hands onto an EVP_PKEY_METHOD that is writable, so
none of the silent failures (because they're void functions) should matter
in the few weeks until we bump.

ok jsing

show more ...

Disable EVP_PKEY_meth_* extensibility

This removes the global pkey_app_methods stack that was never cleaned up
and makes EVP_PKEY_meth_add0() always fail and push an error on the stack.
EVP_PKEY_met

Disable EVP_PKEY_meth_* extensibility

This removes the global pkey_app_methods stack that was never cleaned up
and makes EVP_PKEY_meth_add0() always fail and push an error on the stack.
EVP_PKEY_meth_find() can now walk the list of PKEY_METHODs forward and
things become a bit cleaner. It's still all way more complicated than it
needs to be...

ok jsing

show more ...

Ignore ENGINE at the API boundary

This removes the remaining ENGINE members from various internal structs
and functions. Any ENGINE passed into a public API is now completely
ignored functions retur

Ignore ENGINE at the API boundary

This removes the remaining ENGINE members from various internal structs
and functions. Any ENGINE passed into a public API is now completely
ignored functions returning an ENGINE always return NULL.

ok jsing

show more ...

Unifdef OPENSSL_NO_ENGINE in pmeth_lib.c

This includes a manual intervention for the call to EVP_PKEY_meth_find()
which ended up in the middle of nowhere.

ok jsing

Unbreak the namespace build after a broken mk.conf and tool misfire had
me aliasing symbols not in the headers I was procesing.

This unbreaks the namespace build so it will pass again

ok tb@

Hide symbols in hkdf, evp, err, ecdsa, and ec

(part 2 of commit)

ok jsing@

Rename all occurrences of e in this file to engine

Requested by jsing

Rename int_ctx_new() into evp_pkey_ctx_new()

int_ctx_new() is a bad, generic, nondescriptive name.

requested by jsing

Clean up and fix int_ctx_new()

Compare explicitly against NULL, ensure the engine is always finished on
error, switch to using calloc() instead of malloc() + forgetting to set
some members to 0, use

Clean up and fix int_ctx_new()

Compare explicitly against NULL, ensure the engine is always finished on
error, switch to using calloc() instead of malloc() + forgetting to set
some members to 0, use EVP_PKEY_up_ref() and also use pkey_ctx instead of
ret for the newly created EVP_PKEY_CTX.

ok jsing

show more ...

Clean up EVP_PKEY_CTX_meth_dup()

Explicitly check against NULL, replace malloc() plus manual zeroing with
calloc(). Use EVP_PKEY_up_ref() rather than handrolling it and use a more
normal error idiom

Clean up EVP_PKEY_CTX_meth_dup()

Explicitly check against NULL, replace malloc() plus manual zeroing with
calloc(). Use EVP_PKEY_up_ref() rather than handrolling it and use a more
normal error idiom.

There still seems to be a bug in here in that the ENGINE's refcount isn't
bumped, but that will be investigated and fixed separately.

ok jsing

show more ...

spelling fixes; from paul tagliamonte
i removed the arithmetics -> arithmetic changes, as i felt they
were not clearly correct

ok tb

Make internal header file names consistent

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names
used for internal headers. Move all these headers we inherited from
OpenSSL to *_l

Make internal header file names consistent

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names
used for internal headers. Move all these headers we inherited from
OpenSSL to *_local.h, reserving the name *_internal.h for our own code.
Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h.
constant_time_locl.h is moved to constant_time.h since it's special.

Adjust all .c files in libcrypto, libssl and regress.

The diff is mechanical with the exception of tls13_quic.c, where
#include <ssl_locl.h> was fixed manually.

discussed with jsing,
no objection bcook

show more ...

Implement EVP interfaces for Ed25519 and X25519.

ok beck@ tb@

Clean up EVP_PKEY_METHOD related tables and code.

This is effectively the same as done for EVP_PKEY_ASN1_METHOD, although
this table only has nine entries.

ok tb@

Sort EVP_PKEY_METHOD externs.

Add hkdf_pkey_meth to the standard_methods[]

ok beck jsing

Provide versions of EVP_PKEY_CTX_{str,hex}2ctrl() for internal use.

ok beck jsing

Prepare to provide EVP_PKEY_{public,param}_check

This implements checking of a public key and of key generation
parameters for DH and EC keys. With the same logic and setters
and const quirks as for

Prepare to provide EVP_PKEY_{public,param}_check

This implements checking of a public key and of key generation
parameters for DH and EC keys. With the same logic and setters
and const quirks as for EVP_PKEY_check().

There are a couple of quirks: For DH no default EVP_PKEY_check()
is implemented, instead EVP_PKEY_param_check() calls DH_check_ex()
even though DH_param_check_ex() was added for this purpose.
EVP_PKEY_public_check() for EC curves also checks the private key
if present.

ok inoguchi jsing

show more ...

Prepare to provide EVP_PKEY_check()

This allows checking the validity of an EVP_PKEY. Only RSA and EC keys
are supported. If a check function is set the EVP_PKEY_METHOD, it will
be used, otherwise t

Prepare to provide EVP_PKEY_check()

This allows checking the validity of an EVP_PKEY. Only RSA and EC keys
are supported. If a check function is set the EVP_PKEY_METHOD, it will
be used, otherwise the check function on the EVP_PKEY_ASN1_METHOD is
used. The default ASN.1 methods wrap RSA_check_key() and
EC_KEY_check_key(), respectively.

The corresponding setters are EVP_PKEY_{asn1,meth}_set_check().

It is unclear why the PKEY method has no const while the ASN.1 method
has const.

Requested by tobhe and used by PHP 8.1.
Based on OpenSSL commit 2aee35d3

ok inoguchi jsing

show more ...

Use calloc() in EVP_PKEY_meth_new() instead of malloc() and setting
almost all members to 0. Just set the two things that need setting.

ok jsing