p_lib.c 70 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458
  1. /*
  2. * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * DSA low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <assert.h>
  15. #include <stdio.h>
  16. #include "internal/cryptlib.h"
  17. #include "internal/refcount.h"
  18. #include "internal/namemap.h"
  19. #include <openssl/bn.h>
  20. #include <openssl/err.h>
  21. #include <openssl/objects.h>
  22. #include <openssl/evp.h>
  23. #include <openssl/rsa.h>
  24. #include <openssl/dsa.h>
  25. #include <openssl/dh.h>
  26. #include <openssl/ec.h>
  27. #include <openssl/cmac.h>
  28. #ifndef FIPS_MODULE
  29. # include <openssl/engine.h>
  30. #endif
  31. #include <openssl/params.h>
  32. #include <openssl/param_build.h>
  33. #include <openssl/encoder.h>
  34. #include <openssl/core_names.h>
  35. #include "internal/numbers.h" /* includes SIZE_MAX */
  36. #include "internal/ffc.h"
  37. #include "crypto/evp.h"
  38. #include "crypto/dh.h"
  39. #include "crypto/dsa.h"
  40. #include "crypto/ec.h"
  41. #include "crypto/ecx.h"
  42. #include "crypto/rsa.h"
  43. #ifndef FIPS_MODULE
  44. # include "crypto/asn1.h"
  45. # include "crypto/x509.h"
  46. #endif
  47. #include "internal/provider.h"
  48. #include "evp_local.h"
  49. static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
  50. int len, EVP_KEYMGMT *keymgmt);
  51. static void evp_pkey_free_it(EVP_PKEY *key);
  52. #ifndef FIPS_MODULE
  53. /* The type of parameters selected in key parameter functions */
  54. # define SELECT_PARAMETERS OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS
  55. int EVP_PKEY_get_bits(const EVP_PKEY *pkey)
  56. {
  57. int size = 0;
  58. if (pkey != NULL) {
  59. size = pkey->cache.bits;
  60. if (pkey->ameth != NULL && pkey->ameth->pkey_bits != NULL)
  61. size = pkey->ameth->pkey_bits(pkey);
  62. }
  63. return size < 0 ? 0 : size;
  64. }
  65. int EVP_PKEY_get_security_bits(const EVP_PKEY *pkey)
  66. {
  67. int size = 0;
  68. if (pkey != NULL) {
  69. size = pkey->cache.security_bits;
  70. if (pkey->ameth != NULL && pkey->ameth->pkey_security_bits != NULL)
  71. size = pkey->ameth->pkey_security_bits(pkey);
  72. }
  73. return size < 0 ? 0 : size;
  74. }
  75. int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode)
  76. {
  77. # ifndef OPENSSL_NO_DSA
  78. if (pkey->type == EVP_PKEY_DSA) {
  79. int ret = pkey->save_parameters;
  80. if (mode >= 0)
  81. pkey->save_parameters = mode;
  82. return ret;
  83. }
  84. # endif
  85. # ifndef OPENSSL_NO_EC
  86. if (pkey->type == EVP_PKEY_EC) {
  87. int ret = pkey->save_parameters;
  88. if (mode >= 0)
  89. pkey->save_parameters = mode;
  90. return ret;
  91. }
  92. # endif
  93. return 0;
  94. }
  95. int EVP_PKEY_set_ex_data(EVP_PKEY *key, int idx, void *arg)
  96. {
  97. return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
  98. }
  99. void *EVP_PKEY_get_ex_data(const EVP_PKEY *key, int idx)
  100. {
  101. return CRYPTO_get_ex_data(&key->ex_data, idx);
  102. }
  103. int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
  104. {
  105. /*
  106. * Clean up legacy stuff from this function when legacy support is gone.
  107. */
  108. EVP_PKEY *downgraded_from = NULL;
  109. int ok = 0;
  110. /*
  111. * If |to| is a legacy key and |from| isn't, we must make a downgraded
  112. * copy of |from|. If that fails, this function fails.
  113. */
  114. if (evp_pkey_is_legacy(to) && evp_pkey_is_provided(from)) {
  115. if (!evp_pkey_copy_downgraded(&downgraded_from, from))
  116. goto end;
  117. from = downgraded_from;
  118. }
  119. /*
  120. * Make sure |to| is typed. Content is less important at this early
  121. * stage.
  122. *
  123. * 1. If |to| is untyped, assign |from|'s key type to it.
  124. * 2. If |to| contains a legacy key, compare its |type| to |from|'s.
  125. * (|from| was already downgraded above)
  126. *
  127. * If |to| is a provided key, there's nothing more to do here, functions
  128. * like evp_keymgmt_util_copy() and evp_pkey_export_to_provider() called
  129. * further down help us find out if they are the same or not.
  130. */
  131. if (evp_pkey_is_blank(to)) {
  132. if (evp_pkey_is_legacy(from)) {
  133. if (EVP_PKEY_set_type(to, from->type) == 0)
  134. goto end;
  135. } else {
  136. if (EVP_PKEY_set_type_by_keymgmt(to, from->keymgmt) == 0)
  137. goto end;
  138. }
  139. } else if (evp_pkey_is_legacy(to)) {
  140. if (to->type != from->type) {
  141. ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES);
  142. goto end;
  143. }
  144. }
  145. if (EVP_PKEY_missing_parameters(from)) {
  146. ERR_raise(ERR_LIB_EVP, EVP_R_MISSING_PARAMETERS);
  147. goto end;
  148. }
  149. if (!EVP_PKEY_missing_parameters(to)) {
  150. if (EVP_PKEY_parameters_eq(to, from) == 1)
  151. ok = 1;
  152. else
  153. ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_PARAMETERS);
  154. goto end;
  155. }
  156. /* For purely provided keys, we just call the keymgmt utility */
  157. if (to->keymgmt != NULL && from->keymgmt != NULL) {
  158. ok = evp_keymgmt_util_copy(to, (EVP_PKEY *)from, SELECT_PARAMETERS);
  159. goto end;
  160. }
  161. /*
  162. * If |to| is provided, we know that |from| is legacy at this point.
  163. * Try exporting |from| to |to|'s keymgmt, then use evp_keymgmt_dup()
  164. * to copy the appropriate data to |to|'s keydata.
  165. * We cannot override existing data so do it only if there is no keydata
  166. * in |to| yet.
  167. */
  168. if (to->keymgmt != NULL && to->keydata == NULL) {
  169. EVP_KEYMGMT *to_keymgmt = to->keymgmt;
  170. void *from_keydata =
  171. evp_pkey_export_to_provider((EVP_PKEY *)from, NULL, &to_keymgmt,
  172. NULL);
  173. /*
  174. * If we get a NULL, it could be an internal error, or it could be
  175. * that there's a key mismatch. We're pretending the latter...
  176. */
  177. if (from_keydata == NULL)
  178. ERR_raise(ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES);
  179. else
  180. ok = (to->keydata = evp_keymgmt_dup(to->keymgmt,
  181. from_keydata,
  182. SELECT_PARAMETERS)) != NULL;
  183. goto end;
  184. }
  185. /* Both keys are legacy */
  186. if (from->ameth != NULL && from->ameth->param_copy != NULL)
  187. ok = from->ameth->param_copy(to, from);
  188. end:
  189. EVP_PKEY_free(downgraded_from);
  190. return ok;
  191. }
  192. int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey)
  193. {
  194. if (pkey != NULL) {
  195. if (pkey->keymgmt != NULL)
  196. return !evp_keymgmt_util_has((EVP_PKEY *)pkey, SELECT_PARAMETERS);
  197. else if (pkey->ameth != NULL && pkey->ameth->param_missing != NULL)
  198. return pkey->ameth->param_missing(pkey);
  199. }
  200. return 0;
  201. }
  202. /*
  203. * This function is called for any mixture of keys except pure legacy pair.
  204. * When legacy keys are gone, we replace a call to this functions with
  205. * a call to evp_keymgmt_util_match().
  206. */
  207. static int evp_pkey_cmp_any(const EVP_PKEY *a, const EVP_PKEY *b,
  208. int selection)
  209. {
  210. EVP_KEYMGMT *keymgmt1 = NULL, *keymgmt2 = NULL;
  211. void *keydata1 = NULL, *keydata2 = NULL, *tmp_keydata = NULL;
  212. /* If none of them are provided, this function shouldn't have been called */
  213. if (!ossl_assert(evp_pkey_is_provided(a) || evp_pkey_is_provided(b)))
  214. return -2;
  215. /* For purely provided keys, we just call the keymgmt utility */
  216. if (evp_pkey_is_provided(a) && evp_pkey_is_provided(b))
  217. return evp_keymgmt_util_match((EVP_PKEY *)a, (EVP_PKEY *)b, selection);
  218. /*
  219. * At this point, one of them is provided, the other not. This allows
  220. * us to compare types using legacy NIDs.
  221. */
  222. if (evp_pkey_is_legacy(a)
  223. && !EVP_KEYMGMT_is_a(b->keymgmt, OBJ_nid2sn(a->type)))
  224. return -1; /* not the same key type */
  225. if (evp_pkey_is_legacy(b)
  226. && !EVP_KEYMGMT_is_a(a->keymgmt, OBJ_nid2sn(b->type)))
  227. return -1; /* not the same key type */
  228. /*
  229. * We've determined that they both are the same keytype, so the next
  230. * step is to do a bit of cross export to ensure we have keydata for
  231. * both keys in the same keymgmt.
  232. */
  233. keymgmt1 = a->keymgmt;
  234. keydata1 = a->keydata;
  235. keymgmt2 = b->keymgmt;
  236. keydata2 = b->keydata;
  237. if (keymgmt2 != NULL && keymgmt2->match != NULL) {
  238. tmp_keydata =
  239. evp_pkey_export_to_provider((EVP_PKEY *)a, NULL, &keymgmt2, NULL);
  240. if (tmp_keydata != NULL) {
  241. keymgmt1 = keymgmt2;
  242. keydata1 = tmp_keydata;
  243. }
  244. }
  245. if (tmp_keydata == NULL && keymgmt1 != NULL && keymgmt1->match != NULL) {
  246. tmp_keydata =
  247. evp_pkey_export_to_provider((EVP_PKEY *)b, NULL, &keymgmt1, NULL);
  248. if (tmp_keydata != NULL) {
  249. keymgmt2 = keymgmt1;
  250. keydata2 = tmp_keydata;
  251. }
  252. }
  253. /* If we still don't have matching keymgmt implementations, we give up */
  254. if (keymgmt1 != keymgmt2)
  255. return -2;
  256. /* If the keymgmt implementations are NULL, the export failed */
  257. if (keymgmt1 == NULL)
  258. return -2;
  259. return evp_keymgmt_match(keymgmt1, keydata1, keydata2, selection);
  260. }
  261. # ifndef OPENSSL_NO_DEPRECATED_3_0
  262. int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
  263. {
  264. return EVP_PKEY_parameters_eq(a, b);
  265. }
  266. #endif
  267. int EVP_PKEY_parameters_eq(const EVP_PKEY *a, const EVP_PKEY *b)
  268. {
  269. /*
  270. * This will just call evp_keymgmt_util_match when legacy support
  271. * is gone.
  272. */
  273. if (a->keymgmt != NULL || b->keymgmt != NULL)
  274. return evp_pkey_cmp_any(a, b, SELECT_PARAMETERS);
  275. /* All legacy keys */
  276. if (a->type != b->type)
  277. return -1;
  278. if (a->ameth != NULL && a->ameth->param_cmp != NULL)
  279. return a->ameth->param_cmp(a, b);
  280. return -2;
  281. }
  282. # ifndef OPENSSL_NO_DEPRECATED_3_0
  283. int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  284. {
  285. return EVP_PKEY_eq(a, b);
  286. }
  287. #endif
  288. int EVP_PKEY_eq(const EVP_PKEY *a, const EVP_PKEY *b)
  289. {
  290. /*
  291. * This will just call evp_keymgmt_util_match when legacy support
  292. * is gone.
  293. */
  294. /* Trivial shortcuts */
  295. if (a == b)
  296. return 1;
  297. if (a == NULL || b == NULL)
  298. return 0;
  299. if (a->keymgmt != NULL || b->keymgmt != NULL) {
  300. int selection = SELECT_PARAMETERS;
  301. if (evp_keymgmt_util_has((EVP_PKEY *)a, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
  302. && evp_keymgmt_util_has((EVP_PKEY *)b, OSSL_KEYMGMT_SELECT_PUBLIC_KEY))
  303. selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
  304. else
  305. selection |= OSSL_KEYMGMT_SELECT_KEYPAIR;
  306. return evp_pkey_cmp_any(a, b, selection);
  307. }
  308. /* All legacy keys */
  309. if (a->type != b->type)
  310. return -1;
  311. if (a->ameth != NULL) {
  312. int ret;
  313. /* Compare parameters if the algorithm has them */
  314. if (a->ameth->param_cmp != NULL) {
  315. ret = a->ameth->param_cmp(a, b);
  316. if (ret <= 0)
  317. return ret;
  318. }
  319. if (a->ameth->pub_cmp != NULL)
  320. return a->ameth->pub_cmp(a, b);
  321. }
  322. return -2;
  323. }
  324. static EVP_PKEY *new_raw_key_int(OSSL_LIB_CTX *libctx,
  325. const char *strtype,
  326. const char *propq,
  327. int nidtype,
  328. ENGINE *e,
  329. const unsigned char *key,
  330. size_t len,
  331. int key_is_priv)
  332. {
  333. EVP_PKEY *pkey = NULL;
  334. EVP_PKEY_CTX *ctx = NULL;
  335. const EVP_PKEY_ASN1_METHOD *ameth = NULL;
  336. int result = 0;
  337. # ifndef OPENSSL_NO_ENGINE
  338. /* Check if there is an Engine for this type */
  339. if (e == NULL) {
  340. ENGINE *tmpe = NULL;
  341. if (strtype != NULL)
  342. ameth = EVP_PKEY_asn1_find_str(&tmpe, strtype, -1);
  343. else if (nidtype != EVP_PKEY_NONE)
  344. ameth = EVP_PKEY_asn1_find(&tmpe, nidtype);
  345. /* If tmpe is NULL then no engine is claiming to support this type */
  346. if (tmpe == NULL)
  347. ameth = NULL;
  348. ENGINE_finish(tmpe);
  349. }
  350. # endif
  351. if (e == NULL && ameth == NULL) {
  352. /*
  353. * No engine is claiming to support this type, so lets see if we have
  354. * a provider.
  355. */
  356. ctx = EVP_PKEY_CTX_new_from_name(libctx,
  357. strtype != NULL ? strtype
  358. : OBJ_nid2sn(nidtype),
  359. propq);
  360. if (ctx == NULL)
  361. goto err;
  362. /* May fail if no provider available */
  363. ERR_set_mark();
  364. if (EVP_PKEY_fromdata_init(ctx) == 1) {
  365. OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
  366. ERR_clear_last_mark();
  367. params[0] = OSSL_PARAM_construct_octet_string(
  368. key_is_priv ? OSSL_PKEY_PARAM_PRIV_KEY
  369. : OSSL_PKEY_PARAM_PUB_KEY,
  370. (void *)key, len);
  371. if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) != 1) {
  372. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  373. goto err;
  374. }
  375. EVP_PKEY_CTX_free(ctx);
  376. return pkey;
  377. }
  378. ERR_pop_to_mark();
  379. /* else not supported so fallback to legacy */
  380. }
  381. /* Legacy code path */
  382. pkey = EVP_PKEY_new();
  383. if (pkey == NULL) {
  384. ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
  385. goto err;
  386. }
  387. if (!pkey_set_type(pkey, e, nidtype, strtype, -1, NULL)) {
  388. /* ERR_raise(ERR_LIB_EVP, ...) already called */
  389. goto err;
  390. }
  391. if (!ossl_assert(pkey->ameth != NULL))
  392. goto err;
  393. if (key_is_priv) {
  394. if (pkey->ameth->set_priv_key == NULL) {
  395. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  396. goto err;
  397. }
  398. if (!pkey->ameth->set_priv_key(pkey, key, len)) {
  399. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  400. goto err;
  401. }
  402. } else {
  403. if (pkey->ameth->set_pub_key == NULL) {
  404. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  405. goto err;
  406. }
  407. if (!pkey->ameth->set_pub_key(pkey, key, len)) {
  408. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  409. goto err;
  410. }
  411. }
  412. result = 1;
  413. err:
  414. if (!result) {
  415. EVP_PKEY_free(pkey);
  416. pkey = NULL;
  417. }
  418. EVP_PKEY_CTX_free(ctx);
  419. return pkey;
  420. }
  421. EVP_PKEY *EVP_PKEY_new_raw_private_key_ex(OSSL_LIB_CTX *libctx,
  422. const char *keytype,
  423. const char *propq,
  424. const unsigned char *priv, size_t len)
  425. {
  426. return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, priv,
  427. len, 1);
  428. }
  429. EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
  430. const unsigned char *priv,
  431. size_t len)
  432. {
  433. return new_raw_key_int(NULL, NULL, NULL, type, e, priv, len, 1);
  434. }
  435. EVP_PKEY *EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX *libctx,
  436. const char *keytype, const char *propq,
  437. const unsigned char *pub, size_t len)
  438. {
  439. return new_raw_key_int(libctx, keytype, propq, EVP_PKEY_NONE, NULL, pub,
  440. len, 0);
  441. }
  442. EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
  443. const unsigned char *pub,
  444. size_t len)
  445. {
  446. return new_raw_key_int(NULL, NULL, NULL, type, e, pub, len, 0);
  447. }
  448. struct raw_key_details_st
  449. {
  450. unsigned char **key;
  451. size_t *len;
  452. int selection;
  453. };
  454. static OSSL_CALLBACK get_raw_key_details;
  455. static int get_raw_key_details(const OSSL_PARAM params[], void *arg)
  456. {
  457. const OSSL_PARAM *p = NULL;
  458. struct raw_key_details_st *raw_key = arg;
  459. if (raw_key->selection == OSSL_KEYMGMT_SELECT_PRIVATE_KEY) {
  460. if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY))
  461. != NULL)
  462. return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
  463. raw_key->key == NULL ? 0 : *raw_key->len,
  464. raw_key->len);
  465. } else if (raw_key->selection == OSSL_KEYMGMT_SELECT_PUBLIC_KEY) {
  466. if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY))
  467. != NULL)
  468. return OSSL_PARAM_get_octet_string(p, (void **)raw_key->key,
  469. raw_key->key == NULL ? 0 : *raw_key->len,
  470. raw_key->len);
  471. }
  472. return 0;
  473. }
  474. int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
  475. size_t *len)
  476. {
  477. if (pkey->keymgmt != NULL) {
  478. struct raw_key_details_st raw_key;
  479. raw_key.key = priv == NULL ? NULL : &priv;
  480. raw_key.len = len;
  481. raw_key.selection = OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
  482. return evp_keymgmt_util_export(pkey, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
  483. get_raw_key_details, &raw_key);
  484. }
  485. if (pkey->ameth == NULL) {
  486. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  487. return 0;
  488. }
  489. if (pkey->ameth->get_priv_key == NULL) {
  490. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  491. return 0;
  492. }
  493. if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
  494. ERR_raise(ERR_LIB_EVP, EVP_R_GET_RAW_KEY_FAILED);
  495. return 0;
  496. }
  497. return 1;
  498. }
  499. int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
  500. size_t *len)
  501. {
  502. if (pkey->keymgmt != NULL) {
  503. struct raw_key_details_st raw_key;
  504. raw_key.key = pub == NULL ? NULL : &pub;
  505. raw_key.len = len;
  506. raw_key.selection = OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
  507. return evp_keymgmt_util_export(pkey, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
  508. get_raw_key_details, &raw_key);
  509. }
  510. if (pkey->ameth == NULL) {
  511. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  512. return 0;
  513. }
  514. if (pkey->ameth->get_pub_key == NULL) {
  515. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  516. return 0;
  517. }
  518. if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
  519. ERR_raise(ERR_LIB_EVP, EVP_R_GET_RAW_KEY_FAILED);
  520. return 0;
  521. }
  522. return 1;
  523. }
  524. static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len,
  525. const char *cipher_name,
  526. const EVP_CIPHER *cipher,
  527. OSSL_LIB_CTX *libctx,
  528. const char *propq, ENGINE *e)
  529. {
  530. # ifndef OPENSSL_NO_CMAC
  531. # ifndef OPENSSL_NO_ENGINE
  532. const char *engine_id = e != NULL ? ENGINE_get_id(e) : NULL;
  533. # endif
  534. OSSL_PARAM params[5], *p = params;
  535. EVP_PKEY *pkey = NULL;
  536. EVP_PKEY_CTX *ctx;
  537. if (cipher != NULL)
  538. cipher_name = EVP_CIPHER_get0_name(cipher);
  539. if (cipher_name == NULL) {
  540. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  541. return NULL;
  542. }
  543. ctx = EVP_PKEY_CTX_new_from_name(libctx, "CMAC", propq);
  544. if (ctx == NULL)
  545. goto err;
  546. if (EVP_PKEY_fromdata_init(ctx) <= 0) {
  547. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  548. goto err;
  549. }
  550. *p++ = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_PRIV_KEY,
  551. (void *)priv, len);
  552. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_CIPHER,
  553. (char *)cipher_name, 0);
  554. if (propq != NULL)
  555. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_PROPERTIES,
  556. (char *)propq, 0);
  557. # ifndef OPENSSL_NO_ENGINE
  558. if (engine_id != NULL)
  559. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_ENGINE,
  560. (char *)engine_id, 0);
  561. # endif
  562. *p = OSSL_PARAM_construct_end();
  563. if (EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) {
  564. ERR_raise(ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED);
  565. goto err;
  566. }
  567. err:
  568. EVP_PKEY_CTX_free(ctx);
  569. return pkey;
  570. # else
  571. ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  572. return NULL;
  573. # endif
  574. }
  575. EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
  576. size_t len, const EVP_CIPHER *cipher)
  577. {
  578. return new_cmac_key_int(priv, len, NULL, cipher, NULL, NULL, e);
  579. }
  580. int EVP_PKEY_set_type(EVP_PKEY *pkey, int type)
  581. {
  582. return pkey_set_type(pkey, NULL, type, NULL, -1, NULL);
  583. }
  584. int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len)
  585. {
  586. return pkey_set_type(pkey, NULL, EVP_PKEY_NONE, str, len, NULL);
  587. }
  588. # ifndef OPENSSL_NO_ENGINE
  589. int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *e)
  590. {
  591. if (e != NULL) {
  592. if (!ENGINE_init(e)) {
  593. ERR_raise(ERR_LIB_EVP, ERR_R_ENGINE_LIB);
  594. return 0;
  595. }
  596. if (ENGINE_get_pkey_meth(e, pkey->type) == NULL) {
  597. ENGINE_finish(e);
  598. ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  599. return 0;
  600. }
  601. }
  602. ENGINE_finish(pkey->pmeth_engine);
  603. pkey->pmeth_engine = e;
  604. return 1;
  605. }
  606. ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey)
  607. {
  608. return pkey->engine;
  609. }
  610. # endif
  611. # ifndef OPENSSL_NO_DEPRECATED_3_0
  612. static void detect_foreign_key(EVP_PKEY *pkey)
  613. {
  614. switch (pkey->type) {
  615. case EVP_PKEY_RSA:
  616. pkey->foreign = pkey->pkey.rsa != NULL
  617. && ossl_rsa_is_foreign(pkey->pkey.rsa);
  618. break;
  619. # ifndef OPENSSL_NO_EC
  620. case EVP_PKEY_SM2:
  621. case EVP_PKEY_EC:
  622. pkey->foreign = pkey->pkey.ec != NULL
  623. && ossl_ec_key_is_foreign(pkey->pkey.ec);
  624. break;
  625. # endif
  626. # ifndef OPENSSL_NO_DSA
  627. case EVP_PKEY_DSA:
  628. pkey->foreign = pkey->pkey.dsa != NULL
  629. && ossl_dsa_is_foreign(pkey->pkey.dsa);
  630. break;
  631. #endif
  632. # ifndef OPENSSL_NO_DH
  633. case EVP_PKEY_DH:
  634. pkey->foreign = pkey->pkey.dh != NULL
  635. && ossl_dh_is_foreign(pkey->pkey.dh);
  636. break;
  637. #endif
  638. default:
  639. pkey->foreign = 0;
  640. break;
  641. }
  642. }
  643. int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key)
  644. {
  645. # ifndef OPENSSL_NO_EC
  646. int pktype;
  647. pktype = EVP_PKEY_type(type);
  648. if ((key != NULL) && (pktype == EVP_PKEY_EC || pktype == EVP_PKEY_SM2)) {
  649. const EC_GROUP *group = EC_KEY_get0_group(key);
  650. if (group != NULL) {
  651. int curve = EC_GROUP_get_curve_name(group);
  652. /*
  653. * Regardless of what is requested the SM2 curve must be SM2 type,
  654. * and non SM2 curves are EC type.
  655. */
  656. if (curve == NID_sm2 && pktype == EVP_PKEY_EC)
  657. type = EVP_PKEY_SM2;
  658. else if(curve != NID_sm2 && pktype == EVP_PKEY_SM2)
  659. type = EVP_PKEY_EC;
  660. }
  661. }
  662. # endif
  663. if (pkey == NULL || !EVP_PKEY_set_type(pkey, type))
  664. return 0;
  665. pkey->pkey.ptr = key;
  666. detect_foreign_key(pkey);
  667. return (key != NULL);
  668. }
  669. # endif
  670. void *EVP_PKEY_get0(const EVP_PKEY *pkey)
  671. {
  672. if (pkey == NULL)
  673. return NULL;
  674. if (!evp_pkey_is_provided(pkey))
  675. return pkey->pkey.ptr;
  676. return NULL;
  677. }
  678. const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len)
  679. {
  680. const ASN1_OCTET_STRING *os = NULL;
  681. if (pkey->type != EVP_PKEY_HMAC) {
  682. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_AN_HMAC_KEY);
  683. return NULL;
  684. }
  685. os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
  686. if (os != NULL) {
  687. *len = os->length;
  688. return os->data;
  689. }
  690. return NULL;
  691. }
  692. # ifndef OPENSSL_NO_POLY1305
  693. const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len)
  694. {
  695. const ASN1_OCTET_STRING *os = NULL;
  696. if (pkey->type != EVP_PKEY_POLY1305) {
  697. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_POLY1305_KEY);
  698. return NULL;
  699. }
  700. os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
  701. if (os != NULL) {
  702. *len = os->length;
  703. return os->data;
  704. }
  705. return NULL;
  706. }
  707. # endif
  708. # ifndef OPENSSL_NO_SIPHASH
  709. const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len)
  710. {
  711. const ASN1_OCTET_STRING *os = NULL;
  712. if (pkey->type != EVP_PKEY_SIPHASH) {
  713. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_SIPHASH_KEY);
  714. return NULL;
  715. }
  716. os = evp_pkey_get_legacy((EVP_PKEY *)pkey);
  717. if (os != NULL) {
  718. *len = os->length;
  719. return os->data;
  720. }
  721. return NULL;
  722. }
  723. # endif
  724. # ifndef OPENSSL_NO_DSA
  725. static DSA *evp_pkey_get0_DSA_int(const EVP_PKEY *pkey)
  726. {
  727. if (pkey->type != EVP_PKEY_DSA) {
  728. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_DSA_KEY);
  729. return NULL;
  730. }
  731. return evp_pkey_get_legacy((EVP_PKEY *)pkey);
  732. }
  733. const DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey)
  734. {
  735. return evp_pkey_get0_DSA_int(pkey);
  736. }
  737. int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key)
  738. {
  739. int ret = EVP_PKEY_assign_DSA(pkey, key);
  740. if (ret)
  741. DSA_up_ref(key);
  742. return ret;
  743. }
  744. DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
  745. {
  746. DSA *ret = evp_pkey_get0_DSA_int(pkey);
  747. if (ret != NULL)
  748. DSA_up_ref(ret);
  749. return ret;
  750. }
  751. # endif /* OPENSSL_NO_DSA */
  752. # ifndef OPENSSL_NO_EC
  753. static const ECX_KEY *evp_pkey_get0_ECX_KEY(const EVP_PKEY *pkey, int type)
  754. {
  755. if (EVP_PKEY_get_base_id(pkey) != type) {
  756. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_ECX_KEY);
  757. return NULL;
  758. }
  759. return evp_pkey_get_legacy((EVP_PKEY *)pkey);
  760. }
  761. static ECX_KEY *evp_pkey_get1_ECX_KEY(EVP_PKEY *pkey, int type)
  762. {
  763. ECX_KEY *ret = (ECX_KEY *)evp_pkey_get0_ECX_KEY(pkey, type);
  764. if (ret != NULL && !ossl_ecx_key_up_ref(ret))
  765. ret = NULL;
  766. return ret;
  767. }
  768. # define IMPLEMENT_ECX_VARIANT(NAME) \
  769. ECX_KEY *ossl_evp_pkey_get1_##NAME(EVP_PKEY *pkey) \
  770. { \
  771. return evp_pkey_get1_ECX_KEY(pkey, EVP_PKEY_##NAME); \
  772. }
  773. IMPLEMENT_ECX_VARIANT(X25519)
  774. IMPLEMENT_ECX_VARIANT(X448)
  775. IMPLEMENT_ECX_VARIANT(ED25519)
  776. IMPLEMENT_ECX_VARIANT(ED448)
  777. # endif
  778. # if !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_DEPRECATED_3_0)
  779. int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *dhkey)
  780. {
  781. int ret, type;
  782. /*
  783. * ossl_dh_is_named_safe_prime_group() returns 1 for named safe prime groups
  784. * related to ffdhe and modp (which cache q = (p - 1) / 2),
  785. * and returns 0 for all other dh parameter generation types including
  786. * RFC5114 named groups.
  787. *
  788. * The EVP_PKEY_DH type is used for dh parameter generation types:
  789. * - named safe prime groups related to ffdhe and modp
  790. * - safe prime generator
  791. *
  792. * The type EVP_PKEY_DHX is used for dh parameter generation types
  793. * - fips186-4 and fips186-2
  794. * - rfc5114 named groups.
  795. *
  796. * The EVP_PKEY_DH type is used to save PKCS#3 data than can be stored
  797. * without a q value.
  798. * The EVP_PKEY_DHX type is used to save X9.42 data that requires the
  799. * q value to be stored.
  800. */
  801. if (ossl_dh_is_named_safe_prime_group(dhkey))
  802. type = EVP_PKEY_DH;
  803. else
  804. type = DH_get0_q(dhkey) == NULL ? EVP_PKEY_DH : EVP_PKEY_DHX;
  805. ret = EVP_PKEY_assign(pkey, type, dhkey);
  806. if (ret)
  807. DH_up_ref(dhkey);
  808. return ret;
  809. }
  810. DH *evp_pkey_get0_DH_int(const EVP_PKEY *pkey)
  811. {
  812. if (pkey->type != EVP_PKEY_DH && pkey->type != EVP_PKEY_DHX) {
  813. ERR_raise(ERR_LIB_EVP, EVP_R_EXPECTING_A_DH_KEY);
  814. return NULL;
  815. }
  816. return evp_pkey_get_legacy((EVP_PKEY *)pkey);
  817. }
  818. const DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey)
  819. {
  820. return evp_pkey_get0_DH_int(pkey);
  821. }
  822. DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey)
  823. {
  824. DH *ret = evp_pkey_get0_DH_int(pkey);
  825. if (ret != NULL)
  826. DH_up_ref(ret);
  827. return ret;
  828. }
  829. # endif
  830. int EVP_PKEY_type(int type)
  831. {
  832. int ret;
  833. const EVP_PKEY_ASN1_METHOD *ameth;
  834. ENGINE *e;
  835. ameth = EVP_PKEY_asn1_find(&e, type);
  836. if (ameth)
  837. ret = ameth->pkey_id;
  838. else
  839. ret = NID_undef;
  840. # ifndef OPENSSL_NO_ENGINE
  841. ENGINE_finish(e);
  842. # endif
  843. return ret;
  844. }
  845. int EVP_PKEY_get_id(const EVP_PKEY *pkey)
  846. {
  847. return pkey->type;
  848. }
  849. int EVP_PKEY_get_base_id(const EVP_PKEY *pkey)
  850. {
  851. return EVP_PKEY_type(pkey->type);
  852. }
  853. /*
  854. * These hard coded cases are pure hackery to get around the fact
  855. * that names in crypto/objects/objects.txt are a mess. There is
  856. * no "EC", and "RSA" leads to the NID for 2.5.8.1.1, an OID that's
  857. * fallen out in favor of { pkcs-1 1 }, i.e. 1.2.840.113549.1.1.1,
  858. * the NID of which is used for EVP_PKEY_RSA. Strangely enough,
  859. * "DSA" is accurate... but still, better be safe and hard-code
  860. * names that we know.
  861. * On a similar topic, EVP_PKEY_type(EVP_PKEY_SM2) will result in
  862. * EVP_PKEY_EC, because of aliasing.
  863. * This should be cleaned away along with all other #legacy support.
  864. */
  865. static const OSSL_ITEM standard_name2type[] = {
  866. { EVP_PKEY_RSA, "RSA" },
  867. { EVP_PKEY_RSA_PSS, "RSA-PSS" },
  868. { EVP_PKEY_EC, "EC" },
  869. { EVP_PKEY_ED25519, "ED25519" },
  870. { EVP_PKEY_ED448, "ED448" },
  871. { EVP_PKEY_X25519, "X25519" },
  872. { EVP_PKEY_X448, "X448" },
  873. { EVP_PKEY_SM2, "SM2" },
  874. { EVP_PKEY_DH, "DH" },
  875. { EVP_PKEY_DHX, "X9.42 DH" },
  876. { EVP_PKEY_DHX, "DHX" },
  877. { EVP_PKEY_DSA, "DSA" },
  878. };
  879. int evp_pkey_name2type(const char *name)
  880. {
  881. int type;
  882. size_t i;
  883. for (i = 0; i < OSSL_NELEM(standard_name2type); i++) {
  884. if (OPENSSL_strcasecmp(name, standard_name2type[i].ptr) == 0)
  885. return (int)standard_name2type[i].id;
  886. }
  887. if ((type = EVP_PKEY_type(OBJ_sn2nid(name))) != NID_undef)
  888. return type;
  889. return EVP_PKEY_type(OBJ_ln2nid(name));
  890. }
  891. const char *evp_pkey_type2name(int type)
  892. {
  893. size_t i;
  894. for (i = 0; i < OSSL_NELEM(standard_name2type); i++) {
  895. if (type == (int)standard_name2type[i].id)
  896. return standard_name2type[i].ptr;
  897. }
  898. return OBJ_nid2sn(type);
  899. }
  900. int EVP_PKEY_is_a(const EVP_PKEY *pkey, const char *name)
  901. {
  902. if (pkey == NULL)
  903. return 0;
  904. if (pkey->keymgmt == NULL)
  905. return pkey->type == evp_pkey_name2type(name);
  906. return EVP_KEYMGMT_is_a(pkey->keymgmt, name);
  907. }
  908. int EVP_PKEY_type_names_do_all(const EVP_PKEY *pkey,
  909. void (*fn)(const char *name, void *data),
  910. void *data)
  911. {
  912. if (!evp_pkey_is_typed(pkey))
  913. return 0;
  914. if (!evp_pkey_is_provided(pkey)) {
  915. const char *name = OBJ_nid2sn(EVP_PKEY_get_id(pkey));
  916. fn(name, data);
  917. return 1;
  918. }
  919. return EVP_KEYMGMT_names_do_all(pkey->keymgmt, fn, data);
  920. }
  921. int EVP_PKEY_can_sign(const EVP_PKEY *pkey)
  922. {
  923. if (pkey->keymgmt == NULL) {
  924. switch (EVP_PKEY_get_base_id(pkey)) {
  925. case EVP_PKEY_RSA:
  926. return 1;
  927. # ifndef OPENSSL_NO_DSA
  928. case EVP_PKEY_DSA:
  929. return 1;
  930. # endif
  931. # ifndef OPENSSL_NO_EC
  932. case EVP_PKEY_ED25519:
  933. case EVP_PKEY_ED448:
  934. return 1;
  935. case EVP_PKEY_EC: /* Including SM2 */
  936. return EC_KEY_can_sign(pkey->pkey.ec);
  937. # endif
  938. default:
  939. break;
  940. }
  941. } else {
  942. const OSSL_PROVIDER *prov = EVP_KEYMGMT_get0_provider(pkey->keymgmt);
  943. OSSL_LIB_CTX *libctx = ossl_provider_libctx(prov);
  944. const char *supported_sig =
  945. pkey->keymgmt->query_operation_name != NULL
  946. ? pkey->keymgmt->query_operation_name(OSSL_OP_SIGNATURE)
  947. : EVP_KEYMGMT_get0_name(pkey->keymgmt);
  948. EVP_SIGNATURE *signature = NULL;
  949. signature = EVP_SIGNATURE_fetch(libctx, supported_sig, NULL);
  950. if (signature != NULL) {
  951. EVP_SIGNATURE_free(signature);
  952. return 1;
  953. }
  954. }
  955. return 0;
  956. }
  957. static int print_reset_indent(BIO **out, int pop_f_prefix, long saved_indent)
  958. {
  959. BIO_set_indent(*out, saved_indent);
  960. if (pop_f_prefix) {
  961. BIO *next = BIO_pop(*out);
  962. BIO_free(*out);
  963. *out = next;
  964. }
  965. return 1;
  966. }
  967. static int print_set_indent(BIO **out, int *pop_f_prefix, long *saved_indent,
  968. long indent)
  969. {
  970. *pop_f_prefix = 0;
  971. *saved_indent = 0;
  972. if (indent > 0) {
  973. long i = BIO_get_indent(*out);
  974. *saved_indent = (i < 0 ? 0 : i);
  975. if (BIO_set_indent(*out, indent) <= 0) {
  976. BIO *prefbio = BIO_new(BIO_f_prefix());
  977. if (prefbio == NULL)
  978. return 0;
  979. *out = BIO_push(prefbio, *out);
  980. *pop_f_prefix = 1;
  981. }
  982. if (BIO_set_indent(*out, indent) <= 0) {
  983. print_reset_indent(out, *pop_f_prefix, *saved_indent);
  984. return 0;
  985. }
  986. }
  987. return 1;
  988. }
  989. static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,
  990. const char *kstr)
  991. {
  992. return BIO_indent(out, indent, 128)
  993. && BIO_printf(out, "%s algorithm \"%s\" unsupported\n",
  994. kstr, OBJ_nid2ln(pkey->type)) > 0;
  995. }
  996. static int print_pkey(const EVP_PKEY *pkey, BIO *out, int indent,
  997. int selection /* For provided encoding */,
  998. const char *propquery /* For provided encoding */,
  999. int (*legacy_print)(BIO *out, const EVP_PKEY *pkey,
  1000. int indent, ASN1_PCTX *pctx),
  1001. ASN1_PCTX *legacy_pctx /* For legacy print */)
  1002. {
  1003. int pop_f_prefix;
  1004. long saved_indent;
  1005. OSSL_ENCODER_CTX *ctx = NULL;
  1006. int ret = -2; /* default to unsupported */
  1007. if (!print_set_indent(&out, &pop_f_prefix, &saved_indent, indent))
  1008. return 0;
  1009. ctx = OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, "TEXT", NULL,
  1010. propquery);
  1011. if (OSSL_ENCODER_CTX_get_num_encoders(ctx) != 0)
  1012. ret = OSSL_ENCODER_to_bio(ctx, out);
  1013. OSSL_ENCODER_CTX_free(ctx);
  1014. if (ret != -2)
  1015. goto end;
  1016. /* legacy fallback */
  1017. if (legacy_print != NULL)
  1018. ret = legacy_print(out, pkey, 0, legacy_pctx);
  1019. else
  1020. ret = unsup_alg(out, pkey, 0, "Public Key");
  1021. end:
  1022. print_reset_indent(&out, pop_f_prefix, saved_indent);
  1023. return ret;
  1024. }
  1025. int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey,
  1026. int indent, ASN1_PCTX *pctx)
  1027. {
  1028. return print_pkey(pkey, out, indent, EVP_PKEY_PUBLIC_KEY, NULL,
  1029. (pkey->ameth != NULL ? pkey->ameth->pub_print : NULL),
  1030. pctx);
  1031. }
  1032. int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey,
  1033. int indent, ASN1_PCTX *pctx)
  1034. {
  1035. return print_pkey(pkey, out, indent, EVP_PKEY_KEYPAIR, NULL,
  1036. (pkey->ameth != NULL ? pkey->ameth->priv_print : NULL),
  1037. pctx);
  1038. }
  1039. int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
  1040. int indent, ASN1_PCTX *pctx)
  1041. {
  1042. return print_pkey(pkey, out, indent, EVP_PKEY_KEY_PARAMETERS, NULL,
  1043. (pkey->ameth != NULL ? pkey->ameth->param_print : NULL),
  1044. pctx);
  1045. }
  1046. # ifndef OPENSSL_NO_STDIO
  1047. int EVP_PKEY_print_public_fp(FILE *fp, const EVP_PKEY *pkey,
  1048. int indent, ASN1_PCTX *pctx)
  1049. {
  1050. int ret;
  1051. BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
  1052. if (b == NULL)
  1053. return 0;
  1054. ret = EVP_PKEY_print_public(b, pkey, indent, pctx);
  1055. BIO_free(b);
  1056. return ret;
  1057. }
  1058. int EVP_PKEY_print_private_fp(FILE *fp, const EVP_PKEY *pkey,
  1059. int indent, ASN1_PCTX *pctx)
  1060. {
  1061. int ret;
  1062. BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
  1063. if (b == NULL)
  1064. return 0;
  1065. ret = EVP_PKEY_print_private(b, pkey, indent, pctx);
  1066. BIO_free(b);
  1067. return ret;
  1068. }
  1069. int EVP_PKEY_print_params_fp(FILE *fp, const EVP_PKEY *pkey,
  1070. int indent, ASN1_PCTX *pctx)
  1071. {
  1072. int ret;
  1073. BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
  1074. if (b == NULL)
  1075. return 0;
  1076. ret = EVP_PKEY_print_params(b, pkey, indent, pctx);
  1077. BIO_free(b);
  1078. return ret;
  1079. }
  1080. # endif
  1081. static void mdname2nid(const char *mdname, void *data)
  1082. {
  1083. int *nid = (int *)data;
  1084. if (*nid != NID_undef)
  1085. return;
  1086. *nid = OBJ_sn2nid(mdname);
  1087. if (*nid == NID_undef)
  1088. *nid = OBJ_ln2nid(mdname);
  1089. }
  1090. static int legacy_asn1_ctrl_to_param(EVP_PKEY *pkey, int op,
  1091. int arg1, void *arg2)
  1092. {
  1093. if (pkey->keymgmt == NULL)
  1094. return 0;
  1095. switch (op) {
  1096. case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
  1097. {
  1098. char mdname[80] = "";
  1099. int rv = EVP_PKEY_get_default_digest_name(pkey, mdname,
  1100. sizeof(mdname));
  1101. if (rv > 0) {
  1102. int mdnum;
  1103. OSSL_LIB_CTX *libctx = ossl_provider_libctx(pkey->keymgmt->prov);
  1104. /* Make sure the MD is in the namemap if available */
  1105. EVP_MD *md;
  1106. OSSL_NAMEMAP *namemap;
  1107. int nid = NID_undef;
  1108. (void)ERR_set_mark();
  1109. md = EVP_MD_fetch(libctx, mdname, NULL);
  1110. (void)ERR_pop_to_mark();
  1111. namemap = ossl_namemap_stored(libctx);
  1112. /*
  1113. * The only reason to fetch the MD was to make sure it is in the
  1114. * namemap. We can immediately free it.
  1115. */
  1116. EVP_MD_free(md);
  1117. mdnum = ossl_namemap_name2num(namemap, mdname);
  1118. if (mdnum == 0)
  1119. return 0;
  1120. /*
  1121. * We have the namemap number - now we need to find the
  1122. * associated nid
  1123. */
  1124. if (!ossl_namemap_doall_names(namemap, mdnum, mdname2nid, &nid))
  1125. return 0;
  1126. *(int *)arg2 = nid;
  1127. }
  1128. return rv;
  1129. }
  1130. default:
  1131. return -2;
  1132. }
  1133. }
  1134. static int evp_pkey_asn1_ctrl(EVP_PKEY *pkey, int op, int arg1, void *arg2)
  1135. {
  1136. if (pkey->ameth == NULL)
  1137. return legacy_asn1_ctrl_to_param(pkey, op, arg1, arg2);
  1138. if (pkey->ameth->pkey_ctrl == NULL)
  1139. return -2;
  1140. return pkey->ameth->pkey_ctrl(pkey, op, arg1, arg2);
  1141. }
  1142. int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid)
  1143. {
  1144. return evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_DEFAULT_MD_NID, 0, pnid);
  1145. }
  1146. int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
  1147. char *mdname, size_t mdname_sz)
  1148. {
  1149. if (pkey->ameth == NULL)
  1150. return evp_keymgmt_util_get_deflt_digest_name(pkey->keymgmt,
  1151. pkey->keydata,
  1152. mdname, mdname_sz);
  1153. {
  1154. int nid = NID_undef;
  1155. int rv = EVP_PKEY_get_default_digest_nid(pkey, &nid);
  1156. const char *name = rv > 0 ? OBJ_nid2sn(nid) : NULL;
  1157. if (rv > 0)
  1158. OPENSSL_strlcpy(mdname, name, mdname_sz);
  1159. return rv;
  1160. }
  1161. }
  1162. int EVP_PKEY_get_group_name(const EVP_PKEY *pkey, char *gname, size_t gname_sz,
  1163. size_t *gname_len)
  1164. {
  1165. return EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME,
  1166. gname, gname_sz, gname_len);
  1167. }
  1168. int EVP_PKEY_digestsign_supports_digest(EVP_PKEY *pkey, OSSL_LIB_CTX *libctx,
  1169. const char *name, const char *propq)
  1170. {
  1171. int rv;
  1172. EVP_MD_CTX *ctx = NULL;
  1173. if ((ctx = EVP_MD_CTX_new()) == NULL)
  1174. return -1;
  1175. ERR_set_mark();
  1176. rv = EVP_DigestSignInit_ex(ctx, NULL, name, libctx,
  1177. propq, pkey, NULL);
  1178. ERR_pop_to_mark();
  1179. EVP_MD_CTX_free(ctx);
  1180. return rv;
  1181. }
  1182. int EVP_PKEY_set1_encoded_public_key(EVP_PKEY *pkey, const unsigned char *pub,
  1183. size_t publen)
  1184. {
  1185. if (pkey != NULL && evp_pkey_is_provided(pkey))
  1186. return
  1187. EVP_PKEY_set_octet_string_param(pkey,
  1188. OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
  1189. (unsigned char *)pub, publen);
  1190. if (publen > INT_MAX)
  1191. return 0;
  1192. /* Historically this function was EVP_PKEY_set1_tls_encodedpoint */
  1193. if (evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_SET1_TLS_ENCPT, publen,
  1194. (void *)pub) <= 0)
  1195. return 0;
  1196. return 1;
  1197. }
  1198. size_t EVP_PKEY_get1_encoded_public_key(EVP_PKEY *pkey, unsigned char **ppub)
  1199. {
  1200. int rv;
  1201. if (pkey != NULL && evp_pkey_is_provided(pkey)) {
  1202. size_t return_size = OSSL_PARAM_UNMODIFIED;
  1203. unsigned char *buf;
  1204. /*
  1205. * We know that this is going to fail, but it will give us a size
  1206. * to allocate.
  1207. */
  1208. EVP_PKEY_get_octet_string_param(pkey,
  1209. OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
  1210. NULL, 0, &return_size);
  1211. if (return_size == OSSL_PARAM_UNMODIFIED)
  1212. return 0;
  1213. *ppub = NULL;
  1214. buf = OPENSSL_malloc(return_size);
  1215. if (buf == NULL)
  1216. return 0;
  1217. if (!EVP_PKEY_get_octet_string_param(pkey,
  1218. OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
  1219. buf, return_size, NULL)) {
  1220. OPENSSL_free(buf);
  1221. return 0;
  1222. }
  1223. *ppub = buf;
  1224. return return_size;
  1225. }
  1226. rv = evp_pkey_asn1_ctrl(pkey, ASN1_PKEY_CTRL_GET1_TLS_ENCPT, 0, ppub);
  1227. if (rv <= 0)
  1228. return 0;
  1229. return rv;
  1230. }
  1231. #endif /* FIPS_MODULE */
  1232. /*- All methods below can also be used in FIPS_MODULE */
  1233. EVP_PKEY *EVP_PKEY_new(void)
  1234. {
  1235. EVP_PKEY *ret = OPENSSL_zalloc(sizeof(*ret));
  1236. if (ret == NULL)
  1237. return NULL;
  1238. ret->type = EVP_PKEY_NONE;
  1239. ret->save_type = EVP_PKEY_NONE;
  1240. ret->references = 1;
  1241. ret->lock = CRYPTO_THREAD_lock_new();
  1242. if (ret->lock == NULL) {
  1243. ERR_raise(ERR_LIB_EVP, ERR_R_CRYPTO_LIB);
  1244. goto err;
  1245. }
  1246. #ifndef FIPS_MODULE
  1247. ret->save_parameters = 1;
  1248. if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, ret, &ret->ex_data)) {
  1249. ERR_raise(ERR_LIB_EVP, ERR_R_CRYPTO_LIB);
  1250. goto err;
  1251. }
  1252. #endif
  1253. return ret;
  1254. err:
  1255. CRYPTO_THREAD_lock_free(ret->lock);
  1256. OPENSSL_free(ret);
  1257. return NULL;
  1258. }
  1259. /*
  1260. * Setup a public key management method.
  1261. *
  1262. * For legacy keys, either |type| or |str| is expected to have the type
  1263. * information. In this case, the setup consists of finding an ASN1 method
  1264. * and potentially an ENGINE, and setting those fields in |pkey|.
  1265. *
  1266. * For provider side keys, |keymgmt| is expected to be non-NULL. In this
  1267. * case, the setup consists of setting the |keymgmt| field in |pkey|.
  1268. *
  1269. * If pkey is NULL just return 1 or 0 if the key management method exists.
  1270. */
  1271. static int pkey_set_type(EVP_PKEY *pkey, ENGINE *e, int type, const char *str,
  1272. int len, EVP_KEYMGMT *keymgmt)
  1273. {
  1274. #ifndef FIPS_MODULE
  1275. const EVP_PKEY_ASN1_METHOD *ameth = NULL;
  1276. ENGINE **eptr = (e == NULL) ? &e : NULL;
  1277. #endif
  1278. /*
  1279. * The setups can't set both legacy and provider side methods.
  1280. * It is forbidden
  1281. */
  1282. if (!ossl_assert(type == EVP_PKEY_NONE || keymgmt == NULL)
  1283. || !ossl_assert(e == NULL || keymgmt == NULL)) {
  1284. ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
  1285. return 0;
  1286. }
  1287. if (pkey != NULL) {
  1288. int free_it = 0;
  1289. #ifndef FIPS_MODULE
  1290. free_it = free_it || pkey->pkey.ptr != NULL;
  1291. #endif
  1292. free_it = free_it || pkey->keydata != NULL;
  1293. if (free_it)
  1294. evp_pkey_free_it(pkey);
  1295. #ifndef FIPS_MODULE
  1296. /*
  1297. * If key type matches and a method exists then this lookup has
  1298. * succeeded once so just indicate success.
  1299. */
  1300. if (pkey->type != EVP_PKEY_NONE
  1301. && type == pkey->save_type
  1302. && pkey->ameth != NULL)
  1303. return 1;
  1304. # ifndef OPENSSL_NO_ENGINE
  1305. /* If we have ENGINEs release them */
  1306. ENGINE_finish(pkey->engine);
  1307. pkey->engine = NULL;
  1308. ENGINE_finish(pkey->pmeth_engine);
  1309. pkey->pmeth_engine = NULL;
  1310. # endif
  1311. #endif
  1312. }
  1313. #ifndef FIPS_MODULE
  1314. if (str != NULL)
  1315. ameth = EVP_PKEY_asn1_find_str(eptr, str, len);
  1316. else if (type != EVP_PKEY_NONE)
  1317. ameth = EVP_PKEY_asn1_find(eptr, type);
  1318. # ifndef OPENSSL_NO_ENGINE
  1319. if (pkey == NULL && eptr != NULL)
  1320. ENGINE_finish(e);
  1321. # endif
  1322. #endif
  1323. {
  1324. int check = 1;
  1325. #ifndef FIPS_MODULE
  1326. check = check && ameth == NULL;
  1327. #endif
  1328. check = check && keymgmt == NULL;
  1329. if (check) {
  1330. ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  1331. return 0;
  1332. }
  1333. }
  1334. if (pkey != NULL) {
  1335. if (keymgmt != NULL && !EVP_KEYMGMT_up_ref(keymgmt)) {
  1336. ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
  1337. return 0;
  1338. }
  1339. pkey->keymgmt = keymgmt;
  1340. pkey->save_type = type;
  1341. pkey->type = type;
  1342. #ifndef FIPS_MODULE
  1343. /*
  1344. * If the internal "origin" key is provider side, don't save |ameth|.
  1345. * The main reason is that |ameth| is one factor to detect that the
  1346. * internal "origin" key is a legacy one.
  1347. */
  1348. if (keymgmt == NULL)
  1349. pkey->ameth = ameth;
  1350. /*
  1351. * The EVP_PKEY_ASN1_METHOD |pkey_id| retains its legacy key purpose
  1352. * for any key type that has a legacy implementation, regardless of
  1353. * if the internal key is a legacy or a provider side one. When
  1354. * there is no legacy implementation for the key, the type becomes
  1355. * EVP_PKEY_KEYMGMT, which indicates that one should be cautious
  1356. * with functions that expect legacy internal keys.
  1357. */
  1358. if (ameth != NULL) {
  1359. if (type == EVP_PKEY_NONE)
  1360. pkey->type = ameth->pkey_id;
  1361. } else {
  1362. pkey->type = EVP_PKEY_KEYMGMT;
  1363. }
  1364. # ifndef OPENSSL_NO_ENGINE
  1365. if (eptr == NULL && e != NULL && !ENGINE_init(e)) {
  1366. ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
  1367. return 0;
  1368. }
  1369. # endif
  1370. pkey->engine = e;
  1371. #endif
  1372. }
  1373. return 1;
  1374. }
  1375. #ifndef FIPS_MODULE
  1376. static void find_ameth(const char *name, void *data)
  1377. {
  1378. const char **str = data;
  1379. /*
  1380. * The error messages from pkey_set_type() are uninteresting here,
  1381. * and misleading.
  1382. */
  1383. ERR_set_mark();
  1384. if (pkey_set_type(NULL, NULL, EVP_PKEY_NONE, name, strlen(name),
  1385. NULL)) {
  1386. if (str[0] == NULL)
  1387. str[0] = name;
  1388. else if (str[1] == NULL)
  1389. str[1] = name;
  1390. }
  1391. ERR_pop_to_mark();
  1392. }
  1393. #endif
  1394. int EVP_PKEY_set_type_by_keymgmt(EVP_PKEY *pkey, EVP_KEYMGMT *keymgmt)
  1395. {
  1396. #ifndef FIPS_MODULE
  1397. # define EVP_PKEY_TYPE_STR str[0]
  1398. # define EVP_PKEY_TYPE_STRLEN (str[0] == NULL ? -1 : (int)strlen(str[0]))
  1399. /*
  1400. * Find at most two strings that have an associated EVP_PKEY_ASN1_METHOD
  1401. * Ideally, only one should be found. If two (or more) are found, the
  1402. * match is ambiguous. This should never happen, but...
  1403. */
  1404. const char *str[2] = { NULL, NULL };
  1405. if (!EVP_KEYMGMT_names_do_all(keymgmt, find_ameth, &str)
  1406. || str[1] != NULL) {
  1407. ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
  1408. return 0;
  1409. }
  1410. #else
  1411. # define EVP_PKEY_TYPE_STR NULL
  1412. # define EVP_PKEY_TYPE_STRLEN -1
  1413. #endif
  1414. return pkey_set_type(pkey, NULL, EVP_PKEY_NONE,
  1415. EVP_PKEY_TYPE_STR, EVP_PKEY_TYPE_STRLEN,
  1416. keymgmt);
  1417. #undef EVP_PKEY_TYPE_STR
  1418. #undef EVP_PKEY_TYPE_STRLEN
  1419. }
  1420. int EVP_PKEY_up_ref(EVP_PKEY *pkey)
  1421. {
  1422. int i;
  1423. if (CRYPTO_UP_REF(&pkey->references, &i, pkey->lock) <= 0)
  1424. return 0;
  1425. REF_PRINT_COUNT("EVP_PKEY", pkey);
  1426. REF_ASSERT_ISNT(i < 2);
  1427. return ((i > 1) ? 1 : 0);
  1428. }
  1429. #ifndef FIPS_MODULE
  1430. EVP_PKEY *EVP_PKEY_dup(EVP_PKEY *pkey)
  1431. {
  1432. EVP_PKEY *dup_pk;
  1433. if (pkey == NULL) {
  1434. ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
  1435. return NULL;
  1436. }
  1437. if ((dup_pk = EVP_PKEY_new()) == NULL)
  1438. return NULL;
  1439. if (evp_pkey_is_blank(pkey))
  1440. goto done;
  1441. if (evp_pkey_is_provided(pkey)) {
  1442. if (!evp_keymgmt_util_copy(dup_pk, pkey,
  1443. OSSL_KEYMGMT_SELECT_ALL))
  1444. goto err;
  1445. goto done;
  1446. }
  1447. if (evp_pkey_is_legacy(pkey)) {
  1448. const EVP_PKEY_ASN1_METHOD *ameth = pkey->ameth;
  1449. if (ameth == NULL || ameth->copy == NULL) {
  1450. if (pkey->pkey.ptr == NULL /* empty key, just set type */
  1451. && EVP_PKEY_set_type(dup_pk, pkey->type) != 0)
  1452. goto done;
  1453. ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_KEY_TYPE);
  1454. goto err;
  1455. }
  1456. if (!ameth->copy(dup_pk, pkey))
  1457. goto err;
  1458. goto done;
  1459. }
  1460. goto err;
  1461. done:
  1462. /* copy auxiliary data */
  1463. if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EVP_PKEY,
  1464. &dup_pk->ex_data, &pkey->ex_data))
  1465. goto err;
  1466. if (pkey->attributes != NULL) {
  1467. if ((dup_pk->attributes = ossl_x509at_dup(pkey->attributes)) == NULL)
  1468. goto err;
  1469. }
  1470. return dup_pk;
  1471. err:
  1472. EVP_PKEY_free(dup_pk);
  1473. return NULL;
  1474. }
  1475. void evp_pkey_free_legacy(EVP_PKEY *x)
  1476. {
  1477. const EVP_PKEY_ASN1_METHOD *ameth = x->ameth;
  1478. ENGINE *tmpe = NULL;
  1479. if (ameth == NULL && x->legacy_cache_pkey.ptr != NULL)
  1480. ameth = EVP_PKEY_asn1_find(&tmpe, x->type);
  1481. if (ameth != NULL) {
  1482. if (x->legacy_cache_pkey.ptr != NULL) {
  1483. /*
  1484. * We should never have both a legacy origin key, and a key in the
  1485. * legacy cache.
  1486. */
  1487. assert(x->pkey.ptr == NULL);
  1488. /*
  1489. * For the purposes of freeing we make the legacy cache look like
  1490. * a legacy origin key.
  1491. */
  1492. x->pkey = x->legacy_cache_pkey;
  1493. x->legacy_cache_pkey.ptr = NULL;
  1494. }
  1495. if (ameth->pkey_free != NULL)
  1496. ameth->pkey_free(x);
  1497. x->pkey.ptr = NULL;
  1498. }
  1499. # ifndef OPENSSL_NO_ENGINE
  1500. ENGINE_finish(tmpe);
  1501. ENGINE_finish(x->engine);
  1502. x->engine = NULL;
  1503. ENGINE_finish(x->pmeth_engine);
  1504. x->pmeth_engine = NULL;
  1505. # endif
  1506. }
  1507. #endif /* FIPS_MODULE */
  1508. static void evp_pkey_free_it(EVP_PKEY *x)
  1509. {
  1510. /* internal function; x is never NULL */
  1511. evp_keymgmt_util_clear_operation_cache(x, 1);
  1512. #ifndef FIPS_MODULE
  1513. evp_pkey_free_legacy(x);
  1514. #endif
  1515. if (x->keymgmt != NULL) {
  1516. evp_keymgmt_freedata(x->keymgmt, x->keydata);
  1517. EVP_KEYMGMT_free(x->keymgmt);
  1518. x->keymgmt = NULL;
  1519. x->keydata = NULL;
  1520. }
  1521. x->type = EVP_PKEY_NONE;
  1522. }
  1523. void EVP_PKEY_free(EVP_PKEY *x)
  1524. {
  1525. int i;
  1526. if (x == NULL)
  1527. return;
  1528. CRYPTO_DOWN_REF(&x->references, &i, x->lock);
  1529. REF_PRINT_COUNT("EVP_PKEY", x);
  1530. if (i > 0)
  1531. return;
  1532. REF_ASSERT_ISNT(i < 0);
  1533. evp_pkey_free_it(x);
  1534. #ifndef FIPS_MODULE
  1535. CRYPTO_free_ex_data(CRYPTO_EX_INDEX_EVP_PKEY, x, &x->ex_data);
  1536. #endif
  1537. CRYPTO_THREAD_lock_free(x->lock);
  1538. #ifndef FIPS_MODULE
  1539. sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
  1540. #endif
  1541. OPENSSL_free(x);
  1542. }
  1543. int EVP_PKEY_get_size(const EVP_PKEY *pkey)
  1544. {
  1545. int size = 0;
  1546. if (pkey != NULL) {
  1547. size = pkey->cache.size;
  1548. #ifndef FIPS_MODULE
  1549. if (pkey->ameth != NULL && pkey->ameth->pkey_size != NULL)
  1550. size = pkey->ameth->pkey_size(pkey);
  1551. #endif
  1552. }
  1553. return size < 0 ? 0 : size;
  1554. }
  1555. const char *EVP_PKEY_get0_description(const EVP_PKEY *pkey)
  1556. {
  1557. if (!evp_pkey_is_assigned(pkey))
  1558. return NULL;
  1559. if (evp_pkey_is_provided(pkey) && pkey->keymgmt->description != NULL)
  1560. return pkey->keymgmt->description;
  1561. #ifndef FIPS_MODULE
  1562. if (pkey->ameth != NULL)
  1563. return pkey->ameth->info;
  1564. #endif
  1565. return NULL;
  1566. }
  1567. void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
  1568. EVP_KEYMGMT **keymgmt,
  1569. const char *propquery)
  1570. {
  1571. EVP_KEYMGMT *allocated_keymgmt = NULL;
  1572. EVP_KEYMGMT *tmp_keymgmt = NULL;
  1573. int selection = OSSL_KEYMGMT_SELECT_ALL;
  1574. void *keydata = NULL;
  1575. int check;
  1576. if (pk == NULL)
  1577. return NULL;
  1578. /* No key data => nothing to export */
  1579. check = 1;
  1580. #ifndef FIPS_MODULE
  1581. check = check && pk->pkey.ptr == NULL;
  1582. #endif
  1583. check = check && pk->keydata == NULL;
  1584. if (check)
  1585. return NULL;
  1586. #ifndef FIPS_MODULE
  1587. if (pk->pkey.ptr != NULL) {
  1588. /*
  1589. * If the legacy key doesn't have an dirty counter or export function,
  1590. * give up
  1591. */
  1592. if (pk->ameth->dirty_cnt == NULL || pk->ameth->export_to == NULL)
  1593. return NULL;
  1594. }
  1595. #endif
  1596. if (keymgmt != NULL) {
  1597. tmp_keymgmt = *keymgmt;
  1598. *keymgmt = NULL;
  1599. }
  1600. /*
  1601. * If no keymgmt was given or found, get a default keymgmt. We do so by
  1602. * letting EVP_PKEY_CTX_new_from_pkey() do it for us, then we steal it.
  1603. */
  1604. if (tmp_keymgmt == NULL) {
  1605. EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pk, propquery);
  1606. if (ctx == NULL)
  1607. goto end;
  1608. allocated_keymgmt = tmp_keymgmt = ctx->keymgmt;
  1609. ctx->keymgmt = NULL;
  1610. EVP_PKEY_CTX_free(ctx);
  1611. }
  1612. /* If there's still no keymgmt to be had, give up */
  1613. if (tmp_keymgmt == NULL)
  1614. goto end;
  1615. #ifndef FIPS_MODULE
  1616. if (pk->pkey.ptr != NULL) {
  1617. OP_CACHE_ELEM *op;
  1618. /*
  1619. * If the legacy "origin" hasn't changed since last time, we try
  1620. * to find our keymgmt in the operation cache. If it has changed,
  1621. * |i| remains zero, and we will clear the cache further down.
  1622. */
  1623. if (pk->ameth->dirty_cnt(pk) == pk->dirty_cnt_copy) {
  1624. if (!CRYPTO_THREAD_read_lock(pk->lock))
  1625. goto end;
  1626. op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt,
  1627. selection);
  1628. /*
  1629. * If |tmp_keymgmt| is present in the operation cache, it means
  1630. * that export doesn't need to be redone. In that case, we take
  1631. * token copies of the cached pointers, to have token success
  1632. * values to return.
  1633. */
  1634. if (op != NULL && op->keymgmt != NULL) {
  1635. keydata = op->keydata;
  1636. CRYPTO_THREAD_unlock(pk->lock);
  1637. goto end;
  1638. }
  1639. CRYPTO_THREAD_unlock(pk->lock);
  1640. }
  1641. /* Make sure that the keymgmt key type matches the legacy NID */
  1642. if (!EVP_KEYMGMT_is_a(tmp_keymgmt, OBJ_nid2sn(pk->type)))
  1643. goto end;
  1644. if ((keydata = evp_keymgmt_newdata(tmp_keymgmt)) == NULL)
  1645. goto end;
  1646. if (!pk->ameth->export_to(pk, keydata, tmp_keymgmt->import,
  1647. libctx, propquery)) {
  1648. evp_keymgmt_freedata(tmp_keymgmt, keydata);
  1649. keydata = NULL;
  1650. goto end;
  1651. }
  1652. /*
  1653. * If the dirty counter changed since last time, then clear the
  1654. * operation cache. In that case, we know that |i| is zero. Just
  1655. * in case this is a re-export, we increment then decrement the
  1656. * keymgmt reference counter.
  1657. */
  1658. if (!EVP_KEYMGMT_up_ref(tmp_keymgmt)) { /* refcnt++ */
  1659. evp_keymgmt_freedata(tmp_keymgmt, keydata);
  1660. keydata = NULL;
  1661. goto end;
  1662. }
  1663. if (!CRYPTO_THREAD_write_lock(pk->lock))
  1664. goto end;
  1665. if (pk->ameth->dirty_cnt(pk) != pk->dirty_cnt_copy
  1666. && !evp_keymgmt_util_clear_operation_cache(pk, 0)) {
  1667. CRYPTO_THREAD_unlock(pk->lock);
  1668. evp_keymgmt_freedata(tmp_keymgmt, keydata);
  1669. keydata = NULL;
  1670. EVP_KEYMGMT_free(tmp_keymgmt);
  1671. goto end;
  1672. }
  1673. EVP_KEYMGMT_free(tmp_keymgmt); /* refcnt-- */
  1674. /* Check to make sure some other thread didn't get there first */
  1675. op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt, selection);
  1676. if (op != NULL && op->keymgmt != NULL) {
  1677. void *tmp_keydata = op->keydata;
  1678. CRYPTO_THREAD_unlock(pk->lock);
  1679. evp_keymgmt_freedata(tmp_keymgmt, keydata);
  1680. keydata = tmp_keydata;
  1681. goto end;
  1682. }
  1683. /* Add the new export to the operation cache */
  1684. if (!evp_keymgmt_util_cache_keydata(pk, tmp_keymgmt, keydata,
  1685. selection)) {
  1686. CRYPTO_THREAD_unlock(pk->lock);
  1687. evp_keymgmt_freedata(tmp_keymgmt, keydata);
  1688. keydata = NULL;
  1689. goto end;
  1690. }
  1691. /* Synchronize the dirty count */
  1692. pk->dirty_cnt_copy = pk->ameth->dirty_cnt(pk);
  1693. CRYPTO_THREAD_unlock(pk->lock);
  1694. goto end;
  1695. }
  1696. #endif /* FIPS_MODULE */
  1697. keydata = evp_keymgmt_util_export_to_provider(pk, tmp_keymgmt, selection);
  1698. end:
  1699. /*
  1700. * If nothing was exported, |tmp_keymgmt| might point at a freed
  1701. * EVP_KEYMGMT, so we clear it to be safe. It shouldn't be useful for
  1702. * the caller either way in that case.
  1703. */
  1704. if (keydata == NULL)
  1705. tmp_keymgmt = NULL;
  1706. if (keymgmt != NULL && tmp_keymgmt != NULL) {
  1707. *keymgmt = tmp_keymgmt;
  1708. allocated_keymgmt = NULL;
  1709. }
  1710. EVP_KEYMGMT_free(allocated_keymgmt);
  1711. return keydata;
  1712. }
  1713. #ifndef FIPS_MODULE
  1714. int evp_pkey_copy_downgraded(EVP_PKEY **dest, const EVP_PKEY *src)
  1715. {
  1716. EVP_PKEY *allocpkey = NULL;
  1717. if (!ossl_assert(dest != NULL))
  1718. return 0;
  1719. if (evp_pkey_is_assigned(src) && evp_pkey_is_provided(src)) {
  1720. EVP_KEYMGMT *keymgmt = src->keymgmt;
  1721. void *keydata = src->keydata;
  1722. int type = src->type;
  1723. const char *keytype = NULL;
  1724. keytype = EVP_KEYMGMT_get0_name(keymgmt);
  1725. /*
  1726. * If the type is EVP_PKEY_NONE, then we have a problem somewhere
  1727. * else in our code. If it's not one of the well known EVP_PKEY_xxx
  1728. * values, it should at least be EVP_PKEY_KEYMGMT at this point.
  1729. * The check is kept as a safety measure.
  1730. */
  1731. if (!ossl_assert(type != EVP_PKEY_NONE)) {
  1732. ERR_raise_data(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR,
  1733. "keymgmt key type = %s but legacy type = EVP_PKEY_NONE",
  1734. keytype);
  1735. return 0;
  1736. }
  1737. /* Prefer the legacy key type name for error reporting */
  1738. if (type != EVP_PKEY_KEYMGMT)
  1739. keytype = OBJ_nid2sn(type);
  1740. /* Make sure we have a clean slate to copy into */
  1741. if (*dest == NULL) {
  1742. allocpkey = *dest = EVP_PKEY_new();
  1743. if (*dest == NULL) {
  1744. ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
  1745. return 0;
  1746. }
  1747. } else {
  1748. evp_pkey_free_it(*dest);
  1749. }
  1750. if (EVP_PKEY_set_type(*dest, type)) {
  1751. /* If the key is typed but empty, we're done */
  1752. if (keydata == NULL)
  1753. return 1;
  1754. if ((*dest)->ameth->import_from == NULL) {
  1755. ERR_raise_data(ERR_LIB_EVP, EVP_R_NO_IMPORT_FUNCTION,
  1756. "key type = %s", keytype);
  1757. } else {
  1758. /*
  1759. * We perform the export in the same libctx as the keymgmt
  1760. * that we are using.
  1761. */
  1762. OSSL_LIB_CTX *libctx =
  1763. ossl_provider_libctx(keymgmt->prov);
  1764. EVP_PKEY_CTX *pctx =
  1765. EVP_PKEY_CTX_new_from_pkey(libctx, *dest, NULL);
  1766. if (pctx == NULL)
  1767. ERR_raise(ERR_LIB_EVP, ERR_R_EVP_LIB);
  1768. if (pctx != NULL
  1769. && evp_keymgmt_export(keymgmt, keydata,
  1770. OSSL_KEYMGMT_SELECT_ALL,
  1771. (*dest)->ameth->import_from,
  1772. pctx)) {
  1773. /* Synchronize the dirty count */
  1774. (*dest)->dirty_cnt_copy = (*dest)->ameth->dirty_cnt(*dest);
  1775. EVP_PKEY_CTX_free(pctx);
  1776. return 1;
  1777. }
  1778. EVP_PKEY_CTX_free(pctx);
  1779. }
  1780. ERR_raise_data(ERR_LIB_EVP, EVP_R_KEYMGMT_EXPORT_FAILURE,
  1781. "key type = %s", keytype);
  1782. }
  1783. }
  1784. if (allocpkey != NULL) {
  1785. EVP_PKEY_free(allocpkey);
  1786. *dest = NULL;
  1787. }
  1788. return 0;
  1789. }
  1790. void *evp_pkey_get_legacy(EVP_PKEY *pk)
  1791. {
  1792. EVP_PKEY *tmp_copy = NULL;
  1793. void *ret = NULL;
  1794. if (!ossl_assert(pk != NULL))
  1795. return NULL;
  1796. /*
  1797. * If this isn't an assigned provider side key, we just use any existing
  1798. * origin legacy key.
  1799. */
  1800. if (!evp_pkey_is_assigned(pk))
  1801. return NULL;
  1802. if (!evp_pkey_is_provided(pk))
  1803. return pk->pkey.ptr;
  1804. if (!CRYPTO_THREAD_read_lock(pk->lock))
  1805. return NULL;
  1806. ret = pk->legacy_cache_pkey.ptr;
  1807. if (!CRYPTO_THREAD_unlock(pk->lock))
  1808. return NULL;
  1809. if (ret != NULL)
  1810. return ret;
  1811. if (!evp_pkey_copy_downgraded(&tmp_copy, pk))
  1812. goto err;
  1813. if (!CRYPTO_THREAD_write_lock(pk->lock))
  1814. goto err;
  1815. /* Check again in case some other thread has updated it in the meantime */
  1816. ret = pk->legacy_cache_pkey.ptr;
  1817. if (ret == NULL) {
  1818. /* Steal the legacy key reference from the temporary copy */
  1819. ret = pk->legacy_cache_pkey.ptr = tmp_copy->pkey.ptr;
  1820. tmp_copy->pkey.ptr = NULL;
  1821. }
  1822. if (!CRYPTO_THREAD_unlock(pk->lock)) {
  1823. ret = NULL;
  1824. goto err;
  1825. }
  1826. err:
  1827. EVP_PKEY_free(tmp_copy);
  1828. return ret;
  1829. }
  1830. #endif /* FIPS_MODULE */
  1831. int EVP_PKEY_get_bn_param(const EVP_PKEY *pkey, const char *key_name,
  1832. BIGNUM **bn)
  1833. {
  1834. int ret = 0;
  1835. OSSL_PARAM params[2];
  1836. unsigned char buffer[2048];
  1837. unsigned char *buf = NULL;
  1838. size_t buf_sz = 0;
  1839. if (key_name == NULL
  1840. || bn == NULL)
  1841. return 0;
  1842. memset(buffer, 0, sizeof(buffer));
  1843. params[0] = OSSL_PARAM_construct_BN(key_name, buffer, sizeof(buffer));
  1844. params[1] = OSSL_PARAM_construct_end();
  1845. if (!EVP_PKEY_get_params(pkey, params)) {
  1846. if (!OSSL_PARAM_modified(params) || params[0].return_size == 0)
  1847. return 0;
  1848. buf_sz = params[0].return_size;
  1849. /*
  1850. * If it failed because the buffer was too small then allocate the
  1851. * required buffer size and retry.
  1852. */
  1853. buf = OPENSSL_zalloc(buf_sz);
  1854. if (buf == NULL)
  1855. return 0;
  1856. params[0].data = buf;
  1857. params[0].data_size = buf_sz;
  1858. if (!EVP_PKEY_get_params(pkey, params))
  1859. goto err;
  1860. }
  1861. /* Fail if the param was not found */
  1862. if (!OSSL_PARAM_modified(params))
  1863. goto err;
  1864. ret = OSSL_PARAM_get_BN(params, bn);
  1865. err:
  1866. OPENSSL_free(buf);
  1867. return ret;
  1868. }
  1869. int EVP_PKEY_get_octet_string_param(const EVP_PKEY *pkey, const char *key_name,
  1870. unsigned char *buf, size_t max_buf_sz,
  1871. size_t *out_len)
  1872. {
  1873. OSSL_PARAM params[2];
  1874. int ret1 = 0, ret2 = 0;
  1875. if (key_name == NULL)
  1876. return 0;
  1877. params[0] = OSSL_PARAM_construct_octet_string(key_name, buf, max_buf_sz);
  1878. params[1] = OSSL_PARAM_construct_end();
  1879. if ((ret1 = EVP_PKEY_get_params(pkey, params)))
  1880. ret2 = OSSL_PARAM_modified(params);
  1881. if (ret2 && out_len != NULL)
  1882. *out_len = params[0].return_size;
  1883. return ret1 && ret2;
  1884. }
  1885. int EVP_PKEY_get_utf8_string_param(const EVP_PKEY *pkey, const char *key_name,
  1886. char *str, size_t max_buf_sz,
  1887. size_t *out_len)
  1888. {
  1889. OSSL_PARAM params[2];
  1890. int ret1 = 0, ret2 = 0;
  1891. if (key_name == NULL)
  1892. return 0;
  1893. params[0] = OSSL_PARAM_construct_utf8_string(key_name, str, max_buf_sz);
  1894. params[1] = OSSL_PARAM_construct_end();
  1895. if ((ret1 = EVP_PKEY_get_params(pkey, params)))
  1896. ret2 = OSSL_PARAM_modified(params);
  1897. if (ret2 && out_len != NULL)
  1898. *out_len = params[0].return_size;
  1899. if (ret2 && params[0].return_size == max_buf_sz)
  1900. /* There was no space for a NUL byte */
  1901. return 0;
  1902. /* Add a terminating NUL byte for good measure */
  1903. if (ret2 && str != NULL)
  1904. str[params[0].return_size] = '\0';
  1905. return ret1 && ret2;
  1906. }
  1907. int EVP_PKEY_get_int_param(const EVP_PKEY *pkey, const char *key_name,
  1908. int *out)
  1909. {
  1910. OSSL_PARAM params[2];
  1911. if (key_name == NULL)
  1912. return 0;
  1913. params[0] = OSSL_PARAM_construct_int(key_name, out);
  1914. params[1] = OSSL_PARAM_construct_end();
  1915. return EVP_PKEY_get_params(pkey, params)
  1916. && OSSL_PARAM_modified(params);
  1917. }
  1918. int EVP_PKEY_get_size_t_param(const EVP_PKEY *pkey, const char *key_name,
  1919. size_t *out)
  1920. {
  1921. OSSL_PARAM params[2];
  1922. if (key_name == NULL)
  1923. return 0;
  1924. params[0] = OSSL_PARAM_construct_size_t(key_name, out);
  1925. params[1] = OSSL_PARAM_construct_end();
  1926. return EVP_PKEY_get_params(pkey, params)
  1927. && OSSL_PARAM_modified(params);
  1928. }
  1929. int EVP_PKEY_set_int_param(EVP_PKEY *pkey, const char *key_name, int in)
  1930. {
  1931. OSSL_PARAM params[2];
  1932. if (key_name == NULL)
  1933. return 0;
  1934. params[0] = OSSL_PARAM_construct_int(key_name, &in);
  1935. params[1] = OSSL_PARAM_construct_end();
  1936. return EVP_PKEY_set_params(pkey, params);
  1937. }
  1938. int EVP_PKEY_set_size_t_param(EVP_PKEY *pkey, const char *key_name, size_t in)
  1939. {
  1940. OSSL_PARAM params[2];
  1941. if (key_name == NULL)
  1942. return 0;
  1943. params[0] = OSSL_PARAM_construct_size_t(key_name, &in);
  1944. params[1] = OSSL_PARAM_construct_end();
  1945. return EVP_PKEY_set_params(pkey, params);
  1946. }
  1947. int EVP_PKEY_set_bn_param(EVP_PKEY *pkey, const char *key_name,
  1948. const BIGNUM *bn)
  1949. {
  1950. OSSL_PARAM params[2];
  1951. unsigned char buffer[2048];
  1952. int bsize = 0;
  1953. if (key_name == NULL
  1954. || bn == NULL
  1955. || pkey == NULL
  1956. || !evp_pkey_is_assigned(pkey))
  1957. return 0;
  1958. bsize = BN_num_bytes(bn);
  1959. if (!ossl_assert(bsize <= (int)sizeof(buffer)))
  1960. return 0;
  1961. if (BN_bn2nativepad(bn, buffer, bsize) < 0)
  1962. return 0;
  1963. params[0] = OSSL_PARAM_construct_BN(key_name, buffer, bsize);
  1964. params[1] = OSSL_PARAM_construct_end();
  1965. return EVP_PKEY_set_params(pkey, params);
  1966. }
  1967. int EVP_PKEY_set_utf8_string_param(EVP_PKEY *pkey, const char *key_name,
  1968. const char *str)
  1969. {
  1970. OSSL_PARAM params[2];
  1971. if (key_name == NULL)
  1972. return 0;
  1973. params[0] = OSSL_PARAM_construct_utf8_string(key_name, (char *)str, 0);
  1974. params[1] = OSSL_PARAM_construct_end();
  1975. return EVP_PKEY_set_params(pkey, params);
  1976. }
  1977. int EVP_PKEY_set_octet_string_param(EVP_PKEY *pkey, const char *key_name,
  1978. const unsigned char *buf, size_t bsize)
  1979. {
  1980. OSSL_PARAM params[2];
  1981. if (key_name == NULL)
  1982. return 0;
  1983. params[0] = OSSL_PARAM_construct_octet_string(key_name,
  1984. (unsigned char *)buf, bsize);
  1985. params[1] = OSSL_PARAM_construct_end();
  1986. return EVP_PKEY_set_params(pkey, params);
  1987. }
  1988. const OSSL_PARAM *EVP_PKEY_settable_params(const EVP_PKEY *pkey)
  1989. {
  1990. return (pkey != NULL && evp_pkey_is_provided(pkey))
  1991. ? EVP_KEYMGMT_settable_params(pkey->keymgmt)
  1992. : NULL;
  1993. }
  1994. int EVP_PKEY_set_params(EVP_PKEY *pkey, OSSL_PARAM params[])
  1995. {
  1996. if (pkey != NULL) {
  1997. if (evp_pkey_is_provided(pkey)) {
  1998. pkey->dirty_cnt++;
  1999. return evp_keymgmt_set_params(pkey->keymgmt, pkey->keydata, params);
  2000. }
  2001. #ifndef FIPS_MODULE
  2002. /*
  2003. * We will hopefully never find the need to set individual data in
  2004. * EVP_PKEYs with a legacy internal key, but we can't be entirely
  2005. * sure. This bit of code can be enabled if we find the need. If
  2006. * not, it can safely be removed when #legacy support is removed.
  2007. */
  2008. # if 0
  2009. else if (evp_pkey_is_legacy(pkey)) {
  2010. return evp_pkey_set_params_to_ctrl(pkey, params);
  2011. }
  2012. # endif
  2013. #endif
  2014. }
  2015. ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY);
  2016. return 0;
  2017. }
  2018. const OSSL_PARAM *EVP_PKEY_gettable_params(const EVP_PKEY *pkey)
  2019. {
  2020. return (pkey != NULL && evp_pkey_is_provided(pkey))
  2021. ? EVP_KEYMGMT_gettable_params(pkey->keymgmt)
  2022. : NULL;
  2023. }
  2024. int EVP_PKEY_get_params(const EVP_PKEY *pkey, OSSL_PARAM params[])
  2025. {
  2026. if (pkey != NULL) {
  2027. if (evp_pkey_is_provided(pkey))
  2028. return evp_keymgmt_get_params(pkey->keymgmt, pkey->keydata, params) > 0;
  2029. #ifndef FIPS_MODULE
  2030. else if (evp_pkey_is_legacy(pkey))
  2031. return evp_pkey_get_params_to_ctrl(pkey, params) > 0;
  2032. #endif
  2033. }
  2034. ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_KEY);
  2035. return 0;
  2036. }
  2037. #ifndef FIPS_MODULE
  2038. int EVP_PKEY_get_ec_point_conv_form(const EVP_PKEY *pkey)
  2039. {
  2040. char name[80];
  2041. size_t name_len;
  2042. if (pkey == NULL)
  2043. return 0;
  2044. if (pkey->keymgmt == NULL
  2045. || pkey->keydata == NULL) {
  2046. # ifndef OPENSSL_NO_EC
  2047. /* Might work through the legacy route */
  2048. const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
  2049. if (ec == NULL)
  2050. return 0;
  2051. return EC_KEY_get_conv_form(ec);
  2052. # else
  2053. return 0;
  2054. # endif
  2055. }
  2056. if (!EVP_PKEY_get_utf8_string_param(pkey,
  2057. OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
  2058. name, sizeof(name), &name_len))
  2059. return 0;
  2060. if (strcmp(name, "uncompressed") == 0)
  2061. return POINT_CONVERSION_UNCOMPRESSED;
  2062. if (strcmp(name, "compressed") == 0)
  2063. return POINT_CONVERSION_COMPRESSED;
  2064. if (strcmp(name, "hybrid") == 0)
  2065. return POINT_CONVERSION_HYBRID;
  2066. return 0;
  2067. }
  2068. int EVP_PKEY_get_field_type(const EVP_PKEY *pkey)
  2069. {
  2070. char fstr[80];
  2071. size_t fstrlen;
  2072. if (pkey == NULL)
  2073. return 0;
  2074. if (pkey->keymgmt == NULL
  2075. || pkey->keydata == NULL) {
  2076. # ifndef OPENSSL_NO_EC
  2077. /* Might work through the legacy route */
  2078. const EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
  2079. const EC_GROUP *grp;
  2080. if (ec == NULL)
  2081. return 0;
  2082. grp = EC_KEY_get0_group(ec);
  2083. if (grp == NULL)
  2084. return 0;
  2085. return EC_GROUP_get_field_type(grp);
  2086. # else
  2087. return 0;
  2088. # endif
  2089. }
  2090. if (!EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_EC_FIELD_TYPE,
  2091. fstr, sizeof(fstr), &fstrlen))
  2092. return 0;
  2093. if (strcmp(fstr, SN_X9_62_prime_field) == 0)
  2094. return NID_X9_62_prime_field;
  2095. else if (strcmp(fstr, SN_X9_62_characteristic_two_field))
  2096. return NID_X9_62_characteristic_two_field;
  2097. return 0;
  2098. }
  2099. #endif