Extend the EVP_PKEY KDF to KDF provider bridge to also support HKDF

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12573)

3 files changed, 75 insertions, 57 deletions

diff --git a/providers/defltprov.c b/providers/defltprov.c
index 5b6d6a677e..f2fe98fc7f 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -339,7 +339,8 @@ static const OSSL_ALGORITHM deflt_keyexch[] = {
     { "X25519", "provider=default", x25519_keyexch_functions },
     { "X448", "provider=default", x448_keyexch_functions },
 #endif
-    { "TLS1-PRF", "provider=default", kdf_keyexch_functions },
+    { "TLS1-PRF", "provider=default", kdf_tls1_prf_keyexch_functions },
+    { "HKDF", "provider=default", kdf_hkdf_keyexch_functions },
     { NULL, NULL, NULL }
 };
 
@@ -386,6 +387,7 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
     { "ED448", "provider=default", ed448_keymgmt_functions },
 #endif
     { "TLS1-PRF", "provider=default", kdf_keymgmt_functions },
+    { "HKDF", "provider=default", kdf_keymgmt_functions },
     { NULL, NULL, NULL }
 };
 
diff --git a/providers/implementations/exchange/kdf_exch.c b/providers/implementations/exchange/kdf_exch.c
index 41278e6389..e238b0307b 100644
--- a/providers/implementations/exchange/kdf_exch.c
+++ b/providers/implementations/exchange/kdf_exch.c
@@ -16,13 +16,15 @@
 #include "prov/provider_ctx.h"
 #include "prov/kdfexchange.h"
 
-static OSSL_FUNC_keyexch_newctx_fn kdf_newctx;
+static OSSL_FUNC_keyexch_newctx_fn kdf_tls1_prf_newctx;
+static OSSL_FUNC_keyexch_newctx_fn kdf_hkdf_newctx;
 static OSSL_FUNC_keyexch_init_fn kdf_init;
 static OSSL_FUNC_keyexch_derive_fn kdf_derive;
 static OSSL_FUNC_keyexch_freectx_fn kdf_freectx;
 static OSSL_FUNC_keyexch_dupctx_fn kdf_dupctx;
 static OSSL_FUNC_keyexch_set_ctx_params_fn kdf_set_ctx_params;
-static OSSL_FUNC_keyexch_settable_ctx_params_fn kdf_settable_ctx_params;
+static OSSL_FUNC_keyexch_settable_ctx_params_fn kdf_tls1_prf_settable_ctx_params;
+static OSSL_FUNC_keyexch_settable_ctx_params_fn kdf_hkdf_settable_ctx_params;
 
 typedef struct {
     void *provctx;
@@ -30,30 +32,35 @@ typedef struct {
     KDF_DATA *kdfdata;
 } PROV_KDF_CTX;
 
-static void *kdf_newctx(void *provctx)
-{
-    PROV_KDF_CTX *kdfctx = OPENSSL_zalloc(sizeof(PROV_KDF_CTX));
-    EVP_KDF *kdf = NULL;
-
-    if (kdfctx == NULL)
-        return NULL;
-
-    kdfctx->provctx = provctx;
-
-    kdf = EVP_KDF_fetch(PROV_LIBRARY_CONTEXT_OF(provctx), "TLS1-PRF", NULL);
-    if (kdf == NULL)
-        goto err;
-    kdfctx->kdfctx = EVP_KDF_new_ctx(kdf);
-    EVP_KDF_free(kdf);
+#define KDF_NEWCTX(funcname, kdfname) \
+    static void *kdf_##funcname##_newctx(void *provctx) \
+    { \
+        PROV_KDF_CTX *kdfctx = OPENSSL_zalloc(sizeof(PROV_KDF_CTX)); \
+        EVP_KDF *kdf = NULL; \
+        \
+        if (kdfctx == NULL) \
+            return NULL; \
+        \
+        kdfctx->provctx = provctx; \
+        \
+        kdf = EVP_KDF_fetch(PROV_LIBRARY_CONTEXT_OF(provctx), kdfname, NULL); \
+        if (kdf == NULL) \
+            goto err; \
+        kdfctx->kdfctx = EVP_KDF_CTX_new(kdf); \
+        EVP_KDF_free(kdf); \
+        \
+        if (kdfctx->kdfctx == NULL) \
+            goto err; \
+        \
+        return kdfctx; \
+    err: \
+        OPENSSL_free(kdfctx); \
+        return NULL; \
+    }
 
-    if (kdfctx->kdfctx == NULL)
-        goto err;
+KDF_NEWCTX(tls1_prf, "TLS1-PRF")
+KDF_NEWCTX(hkdf, "HKDF")
 
-    return kdfctx;
- err:
-    OPENSSL_free(kdfctx);
-    return NULL;
-}
 
 static int kdf_init(void *vpkdfctx, void *vkdf)
 {
@@ -95,7 +102,7 @@ static void *kdf_dupctx(void *vpkdfctx)
 
     *dstctx = *srcctx;
 
-    dstctx->kdfctx = EVP_KDF_dup_ctx(srcctx->kdfctx);
+    dstctx->kdfctx = EVP_KDF_CTX_dup(srcctx->kdfctx);
     if (dstctx->kdfctx == NULL) {
         OPENSSL_free(dstctx);
         return NULL;
@@ -113,36 +120,44 @@ static int kdf_set_ctx_params(void *vpkdfctx, const OSSL_PARAM params[])
 {
     PROV_KDF_CTX *pkdfctx = (PROV_KDF_CTX *)vpkdfctx;
 
-    return EVP_KDF_set_ctx_params(pkdfctx->kdfctx, params);
+    return EVP_KDF_CTX_set_params(pkdfctx->kdfctx, params);
 }
 
+#define KDF_SETTABLE_CTX_PARAMS(funcname, kdfname) \
+    static const OSSL_PARAM *kdf_##funcname##_settable_ctx_params(void) \
+    { \
+        /* \
+        * TODO(3.0): FIXME FIXME!! These settable_ctx_params functions should \
+        * should have a provctx argument so we can get hold of the libctx. \
+        */ \
+        EVP_KDF *kdf = EVP_KDF_fetch(NULL, kdfname, NULL); \
+        const OSSL_PARAM *params; \
+        \
+        if (kdf == NULL) \
+            return NULL; \
+        \
+        params = EVP_KDF_settable_ctx_params(kdf); \
+        EVP_KDF_free(kdf); \
+        \
+        return params; \
+    }
 
-static const OSSL_PARAM *kdf_settable_ctx_params(void)
-{
-    /*
-     * TODO(3.0): FIXME FIXME!! These settable_ctx_params functions should
-     * should have a provctx argument so we can get hold of the libctx.
-     */
-    EVP_KDF *kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
-    const OSSL_PARAM *params;
-
-    if (kdf == NULL)
-        return NULL;
-
-    params = EVP_KDF_settable_ctx_params(kdf);
-    EVP_KDF_free(kdf);
-
-    return params;
-}
-
-const OSSL_DISPATCH kdf_keyexch_functions[] = {
-    { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))kdf_newctx },
-    { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))kdf_init },
-    { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))kdf_derive },
-    { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))kdf_freectx },
-    { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))kdf_dupctx },
-    { OSSL_FUNC_KEYEXCH_SET_CTX_PARAMS, (void (*)(void))kdf_set_ctx_params },
-    { OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS,
-      (void (*)(void))kdf_settable_ctx_params },
-    { 0, NULL }
-};
+KDF_SETTABLE_CTX_PARAMS(tls1_prf, "TLS1-PRF")
+KDF_SETTABLE_CTX_PARAMS(hkdf, "HKDF")
+
+
+#define KDF_KEYEXCH_FUNCTIONS(funcname) \
+    const OSSL_DISPATCH kdf_##funcname##_keyexch_functions[] = { \
+        { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))kdf_##funcname##_newctx }, \
+        { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))kdf_init }, \
+        { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))kdf_derive }, \
+        { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))kdf_freectx }, \
+        { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))kdf_dupctx }, \
+        { OSSL_FUNC_KEYEXCH_SET_CTX_PARAMS, (void (*)(void))kdf_set_ctx_params }, \
+        { OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS, \
+        (void (*)(void))kdf_##funcname##_settable_ctx_params }, \
+        { 0, NULL } \
+    };
+
+KDF_KEYEXCH_FUNCTIONS(tls1_prf)
+KDF_KEYEXCH_FUNCTIONS(hkdf)
diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h
index e862e3f8e8..d30a105d2d 100644
--- a/providers/implementations/include/prov/implementations.h
+++ b/providers/implementations/include/prov/implementations.h
@@ -282,7 +282,8 @@ extern const OSSL_DISPATCH dh_keyexch_functions[];
 extern const OSSL_DISPATCH x25519_keyexch_functions[];
 extern const OSSL_DISPATCH x448_keyexch_functions[];
 extern const OSSL_DISPATCH ecdh_keyexch_functions[];
-extern const OSSL_DISPATCH kdf_keyexch_functions[];
+extern const OSSL_DISPATCH kdf_tls1_prf_keyexch_functions[];
+extern const OSSL_DISPATCH kdf_hkdf_keyexch_functions[];
 
 /* Signature */
 extern const OSSL_DISPATCH dsa_signature_functions[];