• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2  * All rights reserved.
3  *
4  * This package is an SSL implementation written
5  * by Eric Young (eay@cryptsoft.com).
6  * The implementation was written so as to conform with Netscapes SSL.
7  *
8  * This library is free for commercial and non-commercial use as long as
9  * the following conditions are aheared to.  The following conditions
10  * apply to all code found in this distribution, be it the RC4, RSA,
11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
12  * included with this distribution is covered by the same copyright terms
13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14  *
15  * Copyright remains Eric Young's, and as such any Copyright notices in
16  * the code are not to be removed.
17  * If this package is used in a product, Eric Young should be given attribution
18  * as the author of the parts of the library used.
19  * This can be in the form of a textual message at program startup or
20  * in documentation (online or textual) provided with the package.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  * 1. Redistributions of source code must retain the copyright
26  *    notice, this list of conditions and the following disclaimer.
27  * 2. Redistributions in binary form must reproduce the above copyright
28  *    notice, this list of conditions and the following disclaimer in the
29  *    documentation and/or other materials provided with the distribution.
30  * 3. All advertising materials mentioning features or use of this software
31  *    must display the following acknowledgement:
32  *    "This product includes cryptographic software written by
33  *     Eric Young (eay@cryptsoft.com)"
34  *    The word 'cryptographic' can be left out if the rouines from the library
35  *    being used are not cryptographic related :-).
36  * 4. If you include any Windows specific code (or a derivative thereof) from
37  *    the apps directory (application code) you must include an acknowledgement:
38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39  *
40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50  * SUCH DAMAGE.
51  *
52  * The licence and distribution terms for any publically available version or
53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
54  * copied and put under another distribution licence
55  * [including the GNU Public Licence.] */
56 
57 #ifndef OPENSSL_HEADER_EVP_H
58 #define OPENSSL_HEADER_EVP_H
59 
60 #include <openssl/base.h>
61 
62 #include <openssl/thread.h>
63 
64 // OpenSSL included digest and cipher functions in this header so we include
65 // them for users that still expect that.
66 //
67 // TODO(fork): clean up callers so that they include what they use.
68 #include <openssl/aead.h>
69 #include <openssl/base64.h>
70 #include <openssl/cipher.h>
71 #include <openssl/digest.h>
72 #include <openssl/nid.h>
73 
74 #if defined(__cplusplus)
75 extern "C" {
76 #endif
77 
78 
79 // EVP abstracts over public/private key algorithms.
80 
81 
82 // Public key objects.
83 
84 // EVP_PKEY_new creates a new, empty public-key object and returns it or NULL
85 // on allocation failure.
86 OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_new(void);
87 
88 // EVP_PKEY_free frees all data referenced by |pkey| and then frees |pkey|
89 // itself.
90 OPENSSL_EXPORT void EVP_PKEY_free(EVP_PKEY *pkey);
91 
92 // EVP_PKEY_up_ref increments the reference count of |pkey| and returns one.
93 OPENSSL_EXPORT int EVP_PKEY_up_ref(EVP_PKEY *pkey);
94 
95 // EVP_PKEY_is_opaque returns one if |pkey| is opaque. Opaque keys are backed by
96 // custom implementations which do not expose key material and parameters. It is
97 // an error to attempt to duplicate, export, or compare an opaque key.
98 OPENSSL_EXPORT int EVP_PKEY_is_opaque(const EVP_PKEY *pkey);
99 
100 // EVP_PKEY_cmp compares |a| and |b| and returns one if they are equal, zero if
101 // not and a negative number on error.
102 //
103 // WARNING: this differs from the traditional return value of a "cmp"
104 // function.
105 OPENSSL_EXPORT int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b);
106 
107 // EVP_PKEY_copy_parameters sets the parameters of |to| to equal the parameters
108 // of |from|. It returns one on success and zero on error.
109 OPENSSL_EXPORT int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from);
110 
111 // EVP_PKEY_missing_parameters returns one if |pkey| is missing needed
112 // parameters or zero if not, or if the algorithm doesn't take parameters.
113 OPENSSL_EXPORT int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey);
114 
115 // EVP_PKEY_size returns the maximum size, in bytes, of a signature signed by
116 // |pkey|. For an RSA key, this returns the number of bytes needed to represent
117 // the modulus. For an EC key, this returns the maximum size of a DER-encoded
118 // ECDSA signature.
119 OPENSSL_EXPORT int EVP_PKEY_size(const EVP_PKEY *pkey);
120 
121 // EVP_PKEY_bits returns the "size", in bits, of |pkey|. For an RSA key, this
122 // returns the bit length of the modulus. For an EC key, this returns the bit
123 // length of the group order.
124 OPENSSL_EXPORT int EVP_PKEY_bits(EVP_PKEY *pkey);
125 
126 // EVP_PKEY_id returns the type of |pkey|, which is one of the |EVP_PKEY_*|
127 // values.
128 OPENSSL_EXPORT int EVP_PKEY_id(const EVP_PKEY *pkey);
129 
130 // EVP_PKEY_type returns |nid| if |nid| is a known key type and |NID_undef|
131 // otherwise.
132 OPENSSL_EXPORT int EVP_PKEY_type(int nid);
133 
134 
135 // Getting and setting concrete public key types.
136 //
137 // The following functions get and set the underlying public key in an
138 // |EVP_PKEY| object. The |set1| functions take an additional reference to the
139 // underlying key and return one on success or zero on error. The |assign|
140 // functions adopt the caller's reference. The |get1| functions return a fresh
141 // reference to the underlying object or NULL if |pkey| is not of the correct
142 // type. The |get0| functions behave the same but return a non-owning
143 // pointer.
144 
145 OPENSSL_EXPORT int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key);
146 OPENSSL_EXPORT int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key);
147 OPENSSL_EXPORT RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey);
148 OPENSSL_EXPORT RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
149 
150 OPENSSL_EXPORT int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key);
151 OPENSSL_EXPORT int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key);
152 OPENSSL_EXPORT DSA *EVP_PKEY_get0_DSA(EVP_PKEY *pkey);
153 OPENSSL_EXPORT DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
154 
155 OPENSSL_EXPORT int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
156 OPENSSL_EXPORT int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
157 OPENSSL_EXPORT EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey);
158 OPENSSL_EXPORT EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);
159 
160 // EVP_PKEY_new_ed25519_public returns a newly allocated |EVP_PKEY| wrapping an
161 // Ed25519 public key, or NULL on allocation error.
162 OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_new_ed25519_public(
163     const uint8_t public_key[32]);
164 
165 // EVP_PKEY_new_ed25519_private returns a newly allocated |EVP_PKEY| wrapping an
166 // Ed25519 private key, or NULL on allocation error.
167 OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_new_ed25519_private(
168     const uint8_t private_key[64]);
169 
170 #define EVP_PKEY_NONE NID_undef
171 #define EVP_PKEY_RSA NID_rsaEncryption
172 #define EVP_PKEY_DSA NID_dsa
173 #define EVP_PKEY_EC NID_X9_62_id_ecPublicKey
174 #define EVP_PKEY_ED25519 NID_ED25519
175 
176 // EVP_PKEY_assign sets the underlying key of |pkey| to |key|, which must be of
177 // the given type. The |type| argument should be one of the |EVP_PKEY_*|
178 // values.
179 OPENSSL_EXPORT int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key);
180 
181 // EVP_PKEY_set_type sets the type of |pkey| to |type|, which should be one of
182 // the |EVP_PKEY_*| values. It returns one if successful or zero otherwise. If
183 // |pkey| is NULL, it simply reports whether the type is known.
184 OPENSSL_EXPORT int EVP_PKEY_set_type(EVP_PKEY *pkey, int type);
185 
186 // EVP_PKEY_cmp_parameters compares the parameters of |a| and |b|. It returns
187 // one if they match, zero if not, or a negative number of on error.
188 //
189 // WARNING: the return value differs from the usual return value convention.
190 OPENSSL_EXPORT int EVP_PKEY_cmp_parameters(const EVP_PKEY *a,
191                                            const EVP_PKEY *b);
192 
193 
194 // ASN.1 functions
195 
196 // EVP_parse_public_key decodes a DER-encoded SubjectPublicKeyInfo structure
197 // (RFC 5280) from |cbs| and advances |cbs|. It returns a newly-allocated
198 // |EVP_PKEY| or NULL on error.
199 //
200 // The caller must check the type of the parsed public key to ensure it is
201 // suitable and validate other desired key properties such as RSA modulus size
202 // or EC curve.
203 OPENSSL_EXPORT EVP_PKEY *EVP_parse_public_key(CBS *cbs);
204 
205 // EVP_marshal_public_key marshals |key| as a DER-encoded SubjectPublicKeyInfo
206 // structure (RFC 5280) and appends the result to |cbb|. It returns one on
207 // success and zero on error.
208 OPENSSL_EXPORT int EVP_marshal_public_key(CBB *cbb, const EVP_PKEY *key);
209 
210 // EVP_parse_private_key decodes a DER-encoded PrivateKeyInfo structure (RFC
211 // 5208) from |cbs| and advances |cbs|. It returns a newly-allocated |EVP_PKEY|
212 // or NULL on error.
213 //
214 // The caller must check the type of the parsed private key to ensure it is
215 // suitable and validate other desired key properties such as RSA modulus size
216 // or EC curve.
217 //
218 // A PrivateKeyInfo ends with an optional set of attributes. These are not
219 // processed and so this function will silently ignore any trailing data in the
220 // structure.
221 OPENSSL_EXPORT EVP_PKEY *EVP_parse_private_key(CBS *cbs);
222 
223 // EVP_marshal_private_key marshals |key| as a DER-encoded PrivateKeyInfo
224 // structure (RFC 5208) and appends the result to |cbb|. It returns one on
225 // success and zero on error.
226 OPENSSL_EXPORT int EVP_marshal_private_key(CBB *cbb, const EVP_PKEY *key);
227 
228 
229 // Signing
230 
231 // EVP_DigestSignInit sets up |ctx| for a signing operation with |type| and
232 // |pkey|. The |ctx| argument must have been initialised with
233 // |EVP_MD_CTX_init|. If |pctx| is not NULL, the |EVP_PKEY_CTX| of the signing
234 // operation will be written to |*pctx|; this can be used to set alternative
235 // signing options.
236 //
237 // For single-shot signing algorithms which do not use a pre-hash, such as
238 // Ed25519, |type| should be NULL. The |EVP_MD_CTX| itself is unused but is
239 // present so the API is uniform. See |EVP_DigestSign|.
240 //
241 // It returns one on success, or zero on error.
242 OPENSSL_EXPORT int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
243                                       const EVP_MD *type, ENGINE *e,
244                                       EVP_PKEY *pkey);
245 
246 // EVP_DigestSignUpdate appends |len| bytes from |data| to the data which will
247 // be signed in |EVP_DigestSignFinal|. It returns one.
248 //
249 // This function performs a streaming signing operation and will fail for
250 // signature algorithms which do not support this. Use |EVP_DigestSign| for a
251 // single-shot operation.
252 OPENSSL_EXPORT int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data,
253                                         size_t len);
254 
255 // EVP_DigestSignFinal signs the data that has been included by one or more
256 // calls to |EVP_DigestSignUpdate|. If |out_sig| is NULL then |*out_sig_len| is
257 // set to the maximum number of output bytes. Otherwise, on entry,
258 // |*out_sig_len| must contain the length of the |out_sig| buffer. If the call
259 // is successful, the signature is written to |out_sig| and |*out_sig_len| is
260 // set to its length.
261 //
262 // This function performs a streaming signing operation and will fail for
263 // signature algorithms which do not support this. Use |EVP_DigestSign| for a
264 // single-shot operation.
265 //
266 // It returns one on success, or zero on error.
267 OPENSSL_EXPORT int EVP_DigestSignFinal(EVP_MD_CTX *ctx, uint8_t *out_sig,
268                                        size_t *out_sig_len);
269 
270 // EVP_DigestSign signs |data_len| bytes from |data| using |ctx|. If |out_sig|
271 // is NULL then |*out_sig_len| is set to the maximum number of output
272 // bytes. Otherwise, on entry, |*out_sig_len| must contain the length of the
273 // |out_sig| buffer. If the call is successful, the signature is written to
274 // |out_sig| and |*out_sig_len| is set to its length.
275 //
276 // It returns one on success and zero on error.
277 OPENSSL_EXPORT int EVP_DigestSign(EVP_MD_CTX *ctx, uint8_t *out_sig,
278                                   size_t *out_sig_len, const uint8_t *data,
279                                   size_t data_len);
280 
281 
282 // Verifying
283 
284 // EVP_DigestVerifyInit sets up |ctx| for a signature verification operation
285 // with |type| and |pkey|. The |ctx| argument must have been initialised with
286 // |EVP_MD_CTX_init|. If |pctx| is not NULL, the |EVP_PKEY_CTX| of the signing
287 // operation will be written to |*pctx|; this can be used to set alternative
288 // signing options.
289 //
290 // For single-shot signing algorithms which do not use a pre-hash, such as
291 // Ed25519, |type| should be NULL. The |EVP_MD_CTX| itself is unused but is
292 // present so the API is uniform. See |EVP_DigestVerify|.
293 //
294 // It returns one on success, or zero on error.
295 OPENSSL_EXPORT int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
296                                         const EVP_MD *type, ENGINE *e,
297                                         EVP_PKEY *pkey);
298 
299 // EVP_DigestVerifyUpdate appends |len| bytes from |data| to the data which
300 // will be verified by |EVP_DigestVerifyFinal|. It returns one.
301 //
302 // This function performs streaming signature verification and will fail for
303 // signature algorithms which do not support this. Use |EVP_PKEY_verify_message|
304 // for a single-shot verification.
305 OPENSSL_EXPORT int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data,
306                                           size_t len);
307 
308 // EVP_DigestVerifyFinal verifies that |sig_len| bytes of |sig| are a valid
309 // signature for the data that has been included by one or more calls to
310 // |EVP_DigestVerifyUpdate|. It returns one on success and zero otherwise.
311 //
312 // This function performs streaming signature verification and will fail for
313 // signature algorithms which do not support this. Use |EVP_PKEY_verify_message|
314 // for a single-shot verification.
315 OPENSSL_EXPORT int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const uint8_t *sig,
316                                          size_t sig_len);
317 
318 // EVP_DigestVerify verifies that |sig_len| bytes from |sig| are a valid
319 // signature for |data|. It returns one on success or zero on error.
320 OPENSSL_EXPORT int EVP_DigestVerify(EVP_MD_CTX *ctx, const uint8_t *sig,
321                                     size_t sig_len, const uint8_t *data,
322                                     size_t len);
323 
324 
325 // Signing (old functions)
326 
327 // EVP_SignInit_ex configures |ctx|, which must already have been initialised,
328 // for a fresh signing operation using the hash function |type|. It returns one
329 // on success and zero otherwise.
330 //
331 // (In order to initialise |ctx|, either obtain it initialised with
332 // |EVP_MD_CTX_create|, or use |EVP_MD_CTX_init|.)
333 OPENSSL_EXPORT int EVP_SignInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type,
334                                    ENGINE *impl);
335 
336 // EVP_SignInit is a deprecated version of |EVP_SignInit_ex|.
337 //
338 // TODO(fork): remove.
339 OPENSSL_EXPORT int EVP_SignInit(EVP_MD_CTX *ctx, const EVP_MD *type);
340 
341 // EVP_SignUpdate appends |len| bytes from |data| to the data which will be
342 // signed in |EVP_SignFinal|.
343 OPENSSL_EXPORT int EVP_SignUpdate(EVP_MD_CTX *ctx, const void *data,
344                                   size_t len);
345 
346 // EVP_SignFinal signs the data that has been included by one or more calls to
347 // |EVP_SignUpdate|, using the key |pkey|, and writes it to |sig|. On entry,
348 // |sig| must point to at least |EVP_PKEY_size(pkey)| bytes of space. The
349 // actual size of the signature is written to |*out_sig_len|.
350 //
351 // It returns one on success and zero otherwise.
352 //
353 // It does not modify |ctx|, thus it's possible to continue to use |ctx| in
354 // order to sign a longer message.
355 OPENSSL_EXPORT int EVP_SignFinal(const EVP_MD_CTX *ctx, uint8_t *sig,
356                                  unsigned int *out_sig_len, EVP_PKEY *pkey);
357 
358 
359 // Verifying (old functions)
360 
361 // EVP_VerifyInit_ex configures |ctx|, which must already have been
362 // initialised, for a fresh signature verification operation using the hash
363 // function |type|. It returns one on success and zero otherwise.
364 //
365 // (In order to initialise |ctx|, either obtain it initialised with
366 // |EVP_MD_CTX_create|, or use |EVP_MD_CTX_init|.)
367 OPENSSL_EXPORT int EVP_VerifyInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type,
368                                      ENGINE *impl);
369 
370 // EVP_VerifyInit is a deprecated version of |EVP_VerifyInit_ex|.
371 //
372 // TODO(fork): remove.
373 OPENSSL_EXPORT int EVP_VerifyInit(EVP_MD_CTX *ctx, const EVP_MD *type);
374 
375 // EVP_VerifyUpdate appends |len| bytes from |data| to the data which will be
376 // signed in |EVP_VerifyFinal|.
377 OPENSSL_EXPORT int EVP_VerifyUpdate(EVP_MD_CTX *ctx, const void *data,
378                                     size_t len);
379 
380 // EVP_VerifyFinal verifies that |sig_len| bytes of |sig| are a valid
381 // signature, by |pkey|, for the data that has been included by one or more
382 // calls to |EVP_VerifyUpdate|.
383 //
384 // It returns one on success and zero otherwise.
385 //
386 // It does not modify |ctx|, thus it's possible to continue to use |ctx| in
387 // order to sign a longer message.
388 OPENSSL_EXPORT int EVP_VerifyFinal(EVP_MD_CTX *ctx, const uint8_t *sig,
389                                    size_t sig_len, EVP_PKEY *pkey);
390 
391 
392 // Printing
393 
394 // EVP_PKEY_print_public prints a textual representation of the public key in
395 // |pkey| to |out|. Returns one on success or zero otherwise.
396 OPENSSL_EXPORT int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey,
397                                          int indent, ASN1_PCTX *pctx);
398 
399 // EVP_PKEY_print_private prints a textual representation of the private key in
400 // |pkey| to |out|. Returns one on success or zero otherwise.
401 OPENSSL_EXPORT int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey,
402                                           int indent, ASN1_PCTX *pctx);
403 
404 // EVP_PKEY_print_params prints a textual representation of the parameters in
405 // |pkey| to |out|. Returns one on success or zero otherwise.
406 OPENSSL_EXPORT int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey,
407                                          int indent, ASN1_PCTX *pctx);
408 
409 
410 // Password stretching.
411 //
412 // Password stretching functions take a low-entropy password and apply a slow
413 // function that results in a key suitable for use in symmetric
414 // cryptography.
415 
416 // PKCS5_PBKDF2_HMAC computes |iterations| iterations of PBKDF2 of |password|
417 // and |salt|, using |digest|, and outputs |key_len| bytes to |out_key|. It
418 // returns one on success and zero on error.
419 OPENSSL_EXPORT int PKCS5_PBKDF2_HMAC(const char *password, size_t password_len,
420                                      const uint8_t *salt, size_t salt_len,
421                                      unsigned iterations, const EVP_MD *digest,
422                                      size_t key_len, uint8_t *out_key);
423 
424 // PKCS5_PBKDF2_HMAC_SHA1 is the same as PKCS5_PBKDF2_HMAC, but with |digest|
425 // fixed to |EVP_sha1|.
426 OPENSSL_EXPORT int PKCS5_PBKDF2_HMAC_SHA1(const char *password,
427                                           size_t password_len,
428                                           const uint8_t *salt, size_t salt_len,
429                                           unsigned iterations, size_t key_len,
430                                           uint8_t *out_key);
431 
432 // EVP_PBE_scrypt expands |password| into a secret key of length |key_len| using
433 // scrypt, as described in RFC 7914, and writes the result to |out_key|. It
434 // returns one on success and zero on error.
435 //
436 // |N|, |r|, and |p| are as described in RFC 7914 section 6. They determine the
437 // cost of the operation. If the memory required exceeds |max_mem|, the
438 // operation will fail instead. If |max_mem| is zero, a defult limit of 32MiB
439 // will be used.
440 OPENSSL_EXPORT int EVP_PBE_scrypt(const char *password, size_t password_len,
441                                   const uint8_t *salt, size_t salt_len,
442                                   uint64_t N, uint64_t r, uint64_t p,
443                                   size_t max_mem, uint8_t *out_key,
444                                   size_t key_len);
445 
446 
447 // Public key contexts.
448 //
449 // |EVP_PKEY_CTX| objects hold the context of an operation (e.g. signing or
450 // encrypting) that uses a public key.
451 
452 // EVP_PKEY_CTX_new allocates a fresh |EVP_PKEY_CTX| for use with |pkey|. It
453 // returns the context or NULL on error.
454 OPENSSL_EXPORT EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
455 
456 // EVP_PKEY_CTX_new_id allocates a fresh |EVP_PKEY_CTX| for a key of type |id|
457 // (e.g. |EVP_PKEY_HMAC|). This can be used for key generation where
458 // |EVP_PKEY_CTX_new| can't be used because there isn't an |EVP_PKEY| to pass
459 // it. It returns the context or NULL on error.
460 OPENSSL_EXPORT EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e);
461 
462 // EVP_PKEY_CTX_free frees |ctx| and the data it owns.
463 OPENSSL_EXPORT void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
464 
465 // EVP_PKEY_CTX_dup allocates a fresh |EVP_PKEY_CTX| and sets it equal to the
466 // state of |ctx|. It returns the fresh |EVP_PKEY_CTX| or NULL on error.
467 OPENSSL_EXPORT EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx);
468 
469 // EVP_PKEY_CTX_get0_pkey returns the |EVP_PKEY| associated with |ctx|.
470 OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx);
471 
472 // EVP_PKEY_sign_init initialises an |EVP_PKEY_CTX| for a signing operation. It
473 // should be called before |EVP_PKEY_sign|.
474 //
475 // It returns one on success or zero on error.
476 OPENSSL_EXPORT int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx);
477 
478 // EVP_PKEY_sign signs |digest_len| bytes from |digest| using |ctx|. If |sig| is
479 // NULL, the maximum size of the signature is written to
480 // |out_sig_len|. Otherwise, |*sig_len| must contain the number of bytes of
481 // space available at |sig|. If sufficient, the signature will be written to
482 // |sig| and |*sig_len| updated with the true length.
483 //
484 // This function expects a pre-hashed input and will fail for signature
485 // algorithms which do not support this. Use |EVP_DigestSignInit| to sign an
486 // unhashed input.
487 //
488 // WARNING: Setting |sig| to NULL only gives the maximum size of the
489 // signature. The actual signature may be smaller.
490 //
491 // It returns one on success or zero on error. (Note: this differs from
492 // OpenSSL, which can also return negative values to indicate an error. )
493 OPENSSL_EXPORT int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, uint8_t *sig,
494                                  size_t *sig_len, const uint8_t *digest,
495                                  size_t digest_len);
496 
497 // EVP_PKEY_verify_init initialises an |EVP_PKEY_CTX| for a signature
498 // verification operation. It should be called before |EVP_PKEY_verify|.
499 //
500 // It returns one on success or zero on error.
501 OPENSSL_EXPORT int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx);
502 
503 // EVP_PKEY_verify verifies that |sig_len| bytes from |sig| are a valid
504 // signature for |digest|.
505 //
506 // This function expects a pre-hashed input and will fail for signature
507 // algorithms which do not support this. Use |EVP_DigestVerifyInit| to verify a
508 // signature given the unhashed input.
509 //
510 // It returns one on success or zero on error.
511 OPENSSL_EXPORT int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, const uint8_t *sig,
512                                    size_t sig_len, const uint8_t *digest,
513                                    size_t digest_len);
514 
515 // EVP_PKEY_encrypt_init initialises an |EVP_PKEY_CTX| for an encryption
516 // operation. It should be called before |EVP_PKEY_encrypt|.
517 //
518 // It returns one on success or zero on error.
519 OPENSSL_EXPORT int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx);
520 
521 // EVP_PKEY_encrypt encrypts |in_len| bytes from |in|. If |out| is NULL, the
522 // maximum size of the ciphertext is written to |out_len|. Otherwise, |*out_len|
523 // must contain the number of bytes of space available at |out|. If sufficient,
524 // the ciphertext will be written to |out| and |*out_len| updated with the true
525 // length.
526 //
527 // WARNING: Setting |out| to NULL only gives the maximum size of the
528 // ciphertext. The actual ciphertext may be smaller.
529 //
530 // It returns one on success or zero on error.
531 OPENSSL_EXPORT int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx, uint8_t *out,
532                                     size_t *out_len, const uint8_t *in,
533                                     size_t in_len);
534 
535 // EVP_PKEY_decrypt_init initialises an |EVP_PKEY_CTX| for a decryption
536 // operation. It should be called before |EVP_PKEY_decrypt|.
537 //
538 // It returns one on success or zero on error.
539 OPENSSL_EXPORT int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx);
540 
541 // EVP_PKEY_decrypt decrypts |in_len| bytes from |in|. If |out| is NULL, the
542 // maximum size of the plaintext is written to |out_len|. Otherwise, |*out_len|
543 // must contain the number of bytes of space available at |out|. If sufficient,
544 // the ciphertext will be written to |out| and |*out_len| updated with the true
545 // length.
546 //
547 // WARNING: Setting |out| to NULL only gives the maximum size of the
548 // plaintext. The actual plaintext may be smaller.
549 //
550 // It returns one on success or zero on error.
551 OPENSSL_EXPORT int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx, uint8_t *out,
552                                     size_t *out_len, const uint8_t *in,
553                                     size_t in_len);
554 
555 // EVP_PKEY_verify_recover_init initialises an |EVP_PKEY_CTX| for a public-key
556 // decryption operation. It should be called before |EVP_PKEY_verify_recover|.
557 //
558 // Public-key decryption is a very obscure operation that is only implemented
559 // by RSA keys. It is effectively a signature verification operation that
560 // returns the signed message directly. It is almost certainly not what you
561 // want.
562 //
563 // It returns one on success or zero on error.
564 OPENSSL_EXPORT int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx);
565 
566 // EVP_PKEY_verify_recover decrypts |sig_len| bytes from |sig|. If |out| is
567 // NULL, the maximum size of the plaintext is written to |out_len|. Otherwise,
568 // |*out_len| must contain the number of bytes of space available at |out|. If
569 // sufficient, the ciphertext will be written to |out| and |*out_len| updated
570 // with the true length.
571 //
572 // WARNING: Setting |out| to NULL only gives the maximum size of the
573 // plaintext. The actual plaintext may be smaller.
574 //
575 // See the warning about this operation in |EVP_PKEY_verify_recover_init|. It
576 // is probably not what you want.
577 //
578 // It returns one on success or zero on error.
579 OPENSSL_EXPORT int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx, uint8_t *out,
580                                            size_t *out_len, const uint8_t *sig,
581                                            size_t siglen);
582 
583 // EVP_PKEY_derive_init initialises an |EVP_PKEY_CTX| for a key derivation
584 // operation. It should be called before |EVP_PKEY_derive_set_peer| and
585 // |EVP_PKEY_derive|.
586 //
587 // It returns one on success or zero on error.
588 OPENSSL_EXPORT int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx);
589 
590 // EVP_PKEY_derive_set_peer sets the peer's key to be used for key derivation
591 // by |ctx| to |peer|. It should be called after |EVP_PKEY_derive_init|. (For
592 // example, this is used to set the peer's key in (EC)DH.) It returns one on
593 // success and zero on error.
594 OPENSSL_EXPORT int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer);
595 
596 // EVP_PKEY_derive derives a shared key between the two keys configured in
597 // |ctx|. If |key| is non-NULL then, on entry, |out_key_len| must contain the
598 // amount of space at |key|. If sufficient then the shared key will be written
599 // to |key| and |*out_key_len| will be set to the length. If |key| is NULL then
600 // |out_key_len| will be set to the maximum length.
601 //
602 // WARNING: Setting |out| to NULL only gives the maximum size of the key. The
603 // actual key may be smaller.
604 //
605 // It returns one on success and zero on error.
606 OPENSSL_EXPORT int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, uint8_t *key,
607                                    size_t *out_key_len);
608 
609 // EVP_PKEY_keygen_init initialises an |EVP_PKEY_CTX| for a key generation
610 // operation. It should be called before |EVP_PKEY_keygen|.
611 //
612 // It returns one on success or zero on error.
613 OPENSSL_EXPORT int EVP_PKEY_keygen_init(EVP_PKEY_CTX *ctx);
614 
615 // EVP_PKEY_keygen performs a key generation operation using the values from
616 // |ctx| and sets |*ppkey| to a fresh |EVP_PKEY| containing the resulting key.
617 // It returns one on success or zero on error.
618 OPENSSL_EXPORT int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey);
619 
620 
621 // Generic control functions.
622 
623 // EVP_PKEY_CTX_set_signature_md sets |md| as the digest to be used in a
624 // signature operation. It returns one on success or zero on error.
625 OPENSSL_EXPORT int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx,
626                                                  const EVP_MD *md);
627 
628 // EVP_PKEY_CTX_get_signature_md sets |*out_md| to the digest to be used in a
629 // signature operation. It returns one on success or zero on error.
630 OPENSSL_EXPORT int EVP_PKEY_CTX_get_signature_md(EVP_PKEY_CTX *ctx,
631                                                  const EVP_MD **out_md);
632 
633 
634 // RSA specific control functions.
635 
636 // EVP_PKEY_CTX_set_rsa_padding sets the padding type to use. It should be one
637 // of the |RSA_*_PADDING| values. Returns one on success or zero on error.
638 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int padding);
639 
640 // EVP_PKEY_CTX_get_rsa_padding sets |*out_padding| to the current padding
641 // value, which is one of the |RSA_*_PADDING| values. Returns one on success or
642 // zero on error.
643 OPENSSL_EXPORT int EVP_PKEY_CTX_get_rsa_padding(EVP_PKEY_CTX *ctx,
644                                                 int *out_padding);
645 
646 // EVP_PKEY_CTX_set_rsa_pss_saltlen sets the length of the salt in a PSS-padded
647 // signature. A value of -1 cause the salt to be the same length as the digest
648 // in the signature. A value of -2 causes the salt to be the maximum length
649 // that will fit when signing and recovered from the signature when verifying.
650 // Otherwise the value gives the size of the salt in bytes.
651 //
652 // If unsure, use -1.
653 //
654 // Returns one on success or zero on error.
655 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx,
656                                                     int salt_len);
657 
658 // EVP_PKEY_CTX_get_rsa_pss_saltlen sets |*out_salt_len| to the salt length of
659 // a PSS-padded signature. See the documentation for
660 // |EVP_PKEY_CTX_set_rsa_pss_saltlen| for details of the special values that it
661 // can take.
662 //
663 // Returns one on success or zero on error.
664 OPENSSL_EXPORT int EVP_PKEY_CTX_get_rsa_pss_saltlen(EVP_PKEY_CTX *ctx,
665                                                     int *out_salt_len);
666 
667 // EVP_PKEY_CTX_set_rsa_keygen_bits sets the size of the desired RSA modulus,
668 // in bits, for key generation. Returns one on success or zero on
669 // error.
670 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx,
671                                                     int bits);
672 
673 // EVP_PKEY_CTX_set_rsa_keygen_pubexp sets |e| as the public exponent for key
674 // generation. Returns one on success or zero on error.
675 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_keygen_pubexp(EVP_PKEY_CTX *ctx,
676                                                       BIGNUM *e);
677 
678 // EVP_PKEY_CTX_set_rsa_oaep_md sets |md| as the digest used in OAEP padding.
679 // Returns one on success or zero on error.
680 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_oaep_md(EVP_PKEY_CTX *ctx,
681                                                 const EVP_MD *md);
682 
683 // EVP_PKEY_CTX_get_rsa_oaep_md sets |*out_md| to the digest function used in
684 // OAEP padding. Returns one on success or zero on error.
685 OPENSSL_EXPORT int EVP_PKEY_CTX_get_rsa_oaep_md(EVP_PKEY_CTX *ctx,
686                                                 const EVP_MD **out_md);
687 
688 // EVP_PKEY_CTX_set_rsa_mgf1_md sets |md| as the digest used in MGF1. Returns
689 // one on success or zero on error.
690 OPENSSL_EXPORT int EVP_PKEY_CTX_set_rsa_mgf1_md(EVP_PKEY_CTX *ctx,
691                                                 const EVP_MD *md);
692 
693 // EVP_PKEY_CTX_get_rsa_mgf1_md sets |*out_md| to the digest function used in
694 // MGF1. Returns one on success or zero on error.
695 OPENSSL_EXPORT int EVP_PKEY_CTX_get_rsa_mgf1_md(EVP_PKEY_CTX *ctx,
696                                                 const EVP_MD **out_md);
697 
698 // EVP_PKEY_CTX_set0_rsa_oaep_label sets |label_len| bytes from |label| as the
699 // label used in OAEP. DANGER: On success, this call takes ownership of |label|
700 // and will call |OPENSSL_free| on it when |ctx| is destroyed.
701 //
702 // Returns one on success or zero on error.
703 OPENSSL_EXPORT int EVP_PKEY_CTX_set0_rsa_oaep_label(EVP_PKEY_CTX *ctx,
704                                                     uint8_t *label,
705                                                     size_t label_len);
706 
707 // EVP_PKEY_CTX_get0_rsa_oaep_label sets |*out_label| to point to the internal
708 // buffer containing the OAEP label (which may be NULL) and returns the length
709 // of the label or a negative value on error.
710 //
711 // WARNING: the return value differs from the usual return value convention.
712 OPENSSL_EXPORT int EVP_PKEY_CTX_get0_rsa_oaep_label(EVP_PKEY_CTX *ctx,
713                                                     const uint8_t **out_label);
714 
715 
716 // Deprecated functions.
717 
718 // EVP_PKEY_DH is defined for compatibility, but it is impossible to create an
719 // |EVP_PKEY| of that type.
720 #define EVP_PKEY_DH NID_dhKeyAgreement
721 
722 // EVP_PKEY_RSA2 was historically an alternate form for RSA public keys (OID
723 // 2.5.8.1.1), but is no longer accepted.
724 #define EVP_PKEY_RSA2 NID_rsa
725 
726 // OpenSSL_add_all_algorithms does nothing.
727 OPENSSL_EXPORT void OpenSSL_add_all_algorithms(void);
728 
729 // OPENSSL_add_all_algorithms_conf does nothing.
730 OPENSSL_EXPORT void OPENSSL_add_all_algorithms_conf(void);
731 
732 // OpenSSL_add_all_ciphers does nothing.
733 OPENSSL_EXPORT void OpenSSL_add_all_ciphers(void);
734 
735 // OpenSSL_add_all_digests does nothing.
736 OPENSSL_EXPORT void OpenSSL_add_all_digests(void);
737 
738 // EVP_cleanup does nothing.
739 OPENSSL_EXPORT void EVP_cleanup(void);
740 
741 OPENSSL_EXPORT void EVP_CIPHER_do_all_sorted(
742     void (*callback)(const EVP_CIPHER *cipher, const char *name,
743                      const char *unused, void *arg),
744     void *arg);
745 
746 OPENSSL_EXPORT void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
747                                                           const char *name,
748                                                           const char *unused,
749                                                           void *arg),
750                                          void *arg);
751 
752 // i2d_PrivateKey marshals a private key from |key| to an ASN.1, DER
753 // structure. If |outp| is not NULL then the result is written to |*outp| and
754 // |*outp| is advanced just past the output. It returns the number of bytes in
755 // the result, whether written or not, or a negative value on error.
756 //
757 // RSA keys are serialized as a DER-encoded RSAPublicKey (RFC 3447) structure.
758 // EC keys are serialized as a DER-encoded ECPrivateKey (RFC 5915) structure.
759 //
760 // Use |RSA_marshal_private_key| or |EC_KEY_marshal_private_key| instead.
761 OPENSSL_EXPORT int i2d_PrivateKey(const EVP_PKEY *key, uint8_t **outp);
762 
763 // i2d_PublicKey marshals a public key from |key| to a type-specific format.
764 // If |outp| is not NULL then the result is written to |*outp| and
765 // |*outp| is advanced just past the output. It returns the number of bytes in
766 // the result, whether written or not, or a negative value on error.
767 //
768 // RSA keys are serialized as a DER-encoded RSAPublicKey (RFC 3447) structure.
769 // EC keys are serialized as an EC point per SEC 1.
770 //
771 // Use |RSA_marshal_public_key| or |EC_POINT_point2cbb| instead.
772 OPENSSL_EXPORT int i2d_PublicKey(EVP_PKEY *key, uint8_t **outp);
773 
774 // d2i_PrivateKey parses an ASN.1, DER-encoded, private key from |len| bytes at
775 // |*inp|. If |out| is not NULL then, on exit, a pointer to the result is in
776 // |*out|. Note that, even if |*out| is already non-NULL on entry, it will not
777 // be written to. Rather, a fresh |EVP_PKEY| is allocated and the previous one
778 // is freed. On successful exit, |*inp| is advanced past the DER structure. It
779 // returns the result or NULL on error.
780 //
781 // This function tries to detect one of several formats. Instead, use
782 // |EVP_parse_private_key| for a PrivateKeyInfo, |RSA_parse_private_key| for an
783 // RSAPrivateKey, and |EC_parse_private_key| for an ECPrivateKey.
784 OPENSSL_EXPORT EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **out,
785                                         const uint8_t **inp, long len);
786 
787 // d2i_AutoPrivateKey acts the same as |d2i_PrivateKey|, but detects the type
788 // of the private key.
789 //
790 // This function tries to detect one of several formats. Instead, use
791 // |EVP_parse_private_key| for a PrivateKeyInfo, |RSA_parse_private_key| for an
792 // RSAPrivateKey, and |EC_parse_private_key| for an ECPrivateKey.
793 OPENSSL_EXPORT EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **out, const uint8_t **inp,
794                                             long len);
795 
796 // EVP_PKEY_get0_DH returns NULL.
797 OPENSSL_EXPORT DH *EVP_PKEY_get0_DH(EVP_PKEY *pkey);
798 
799 
800 // Private structures.
801 
802 struct evp_pkey_st {
803   CRYPTO_refcount_t references;
804 
805   // type contains one of the EVP_PKEY_* values or NID_undef and determines
806   // which element (if any) of the |pkey| union is valid.
807   int type;
808 
809   union {
810     void *ptr;
811     RSA *rsa;
812     DSA *dsa;
813     DH *dh;
814     EC_KEY *ec;
815   } pkey;
816 
817   // ameth contains a pointer to a method table that contains many ASN.1
818   // methods for the key type.
819   const EVP_PKEY_ASN1_METHOD *ameth;
820 } /* EVP_PKEY */;
821 
822 
823 #if defined(__cplusplus)
824 }  // extern C
825 
826 extern "C++" {
827 namespace bssl {
828 
829 BORINGSSL_MAKE_DELETER(EVP_PKEY, EVP_PKEY_free)
830 BORINGSSL_MAKE_DELETER(EVP_PKEY_CTX, EVP_PKEY_CTX_free)
831 
832 }  // namespace bssl
833 
834 }  // extern C++
835 
836 #endif
837 
838 #define EVP_R_BUFFER_TOO_SMALL 100
839 #define EVP_R_COMMAND_NOT_SUPPORTED 101
840 #define EVP_R_DECODE_ERROR 102
841 #define EVP_R_DIFFERENT_KEY_TYPES 103
842 #define EVP_R_DIFFERENT_PARAMETERS 104
843 #define EVP_R_ENCODE_ERROR 105
844 #define EVP_R_EXPECTING_AN_EC_KEY_KEY 106
845 #define EVP_R_EXPECTING_AN_RSA_KEY 107
846 #define EVP_R_EXPECTING_A_DSA_KEY 108
847 #define EVP_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE 109
848 #define EVP_R_INVALID_DIGEST_LENGTH 110
849 #define EVP_R_INVALID_DIGEST_TYPE 111
850 #define EVP_R_INVALID_KEYBITS 112
851 #define EVP_R_INVALID_MGF1_MD 113
852 #define EVP_R_INVALID_OPERATION 114
853 #define EVP_R_INVALID_PADDING_MODE 115
854 #define EVP_R_INVALID_PSS_SALTLEN 116
855 #define EVP_R_KEYS_NOT_SET 117
856 #define EVP_R_MISSING_PARAMETERS 118
857 #define EVP_R_NO_DEFAULT_DIGEST 119
858 #define EVP_R_NO_KEY_SET 120
859 #define EVP_R_NO_MDC2_SUPPORT 121
860 #define EVP_R_NO_NID_FOR_CURVE 122
861 #define EVP_R_NO_OPERATION_SET 123
862 #define EVP_R_NO_PARAMETERS_SET 124
863 #define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 125
864 #define EVP_R_OPERATON_NOT_INITIALIZED 126
865 #define EVP_R_UNKNOWN_PUBLIC_KEY_TYPE 127
866 #define EVP_R_UNSUPPORTED_ALGORITHM 128
867 #define EVP_R_UNSUPPORTED_PUBLIC_KEY_TYPE 129
868 #define EVP_R_NOT_A_PRIVATE_KEY 130
869 #define EVP_R_INVALID_SIGNATURE 131
870 #define EVP_R_MEMORY_LIMIT_EXCEEDED 132
871 #define EVP_R_INVALID_PARAMETERS 133
872 
873 #endif  // OPENSSL_HEADER_EVP_H
874