diff --git a/crypto/evp/mac_lib.c b/crypto/evp/mac_lib.c index c6b021fcd89c39..b1198aef30e13e 100644 --- a/crypto/evp/mac_lib.c +++ b/crypto/evp/mac_lib.c @@ -118,6 +118,21 @@ int EVP_MAC_init(EVP_MAC_CTX *ctx, const unsigned char *key, size_t keylen, return ctx->meth->init(ctx->algctx, key, keylen, params); } +int EVP_MAC_init_SKEY(EVP_MAC_CTX *ctx, const EVP_SKEY *skey, const OSSL_PARAM params[]) +{ + if (ctx->meth->init_opaque == NULL) { + ERR_raise(ERR_R_EVP_LIB, ERR_R_UNSUPPORTED); + return 0; + } + + if (skey->keymgmt->prov != ctx->meth->prov) { + ERR_raise(ERR_R_EVP_LIB, ERR_R_UNSUPPORTED); + return 0; + } + + return ctx->meth->init_opaque(ctx->algctx, skey->keydata, params); +} + int EVP_MAC_update(EVP_MAC_CTX *ctx, const unsigned char *data, size_t datalen) { return ctx->meth->update(ctx->algctx, data, datalen); diff --git a/crypto/evp/mac_meth.c b/crypto/evp/mac_meth.c index a3e7a0220850db..44388499b5545f 100644 --- a/crypto/evp/mac_meth.c +++ b/crypto/evp/mac_meth.c @@ -143,9 +143,15 @@ static void *evp_mac_from_algorithm(int name_id, break; mac->set_ctx_params = OSSL_FUNC_mac_set_ctx_params(fns); break; + case OSSL_FUNC_MAC_INIT_OPAQUE: + if (mac->init_opaque != NULL) + break; + mac->init_opaque = OSSL_FUNC_mac_init_opaque(fns); + fnmaccnt++; + break; } } - if (fnmaccnt != 3 + if ((fnmaccnt != 3 && fnmaccnt != 4) || fnctxcnt != 2) { /* * In order to be a consistent set of functions we must have at least diff --git a/doc/man3/EVP_MAC.pod b/doc/man3/EVP_MAC.pod index defa4042689dc4..ed031644312a15 100644 --- a/doc/man3/EVP_MAC.pod +++ b/doc/man3/EVP_MAC.pod @@ -8,7 +8,7 @@ EVP_MAC_get0_provider, EVP_MAC_get_params, EVP_MAC_gettable_params, EVP_MAC_CTX, EVP_MAC_CTX_new, EVP_MAC_CTX_free, EVP_MAC_CTX_dup, EVP_MAC_CTX_get0_mac, EVP_MAC_CTX_get_params, EVP_MAC_CTX_set_params, EVP_MAC_CTX_get_mac_size, EVP_MAC_CTX_get_block_size, EVP_Q_mac, -EVP_MAC_init, EVP_MAC_update, EVP_MAC_final, EVP_MAC_finalXOF, +EVP_MAC_init, EVP_MAC_init_SKEY, EVP_MAC_update, EVP_MAC_final, EVP_MAC_finalXOF, EVP_MAC_gettable_ctx_params, EVP_MAC_settable_ctx_params, EVP_MAC_CTX_gettable_params, EVP_MAC_CTX_settable_params, EVP_MAC_do_all_provided - EVP MAC routines @@ -49,6 +49,7 @@ EVP_MAC_do_all_provided - EVP MAC routines unsigned char *out, size_t outsize, size_t *outlen); int EVP_MAC_init(EVP_MAC_CTX *ctx, const unsigned char *key, size_t keylen, const OSSL_PARAM params[]); + int EVP_MAC_init_SKEY(EVP_MAC_CTX *ctx, const EVP_SKEY *skey, const OSSL_PARAM params[]); int EVP_MAC_update(EVP_MAC_CTX *ctx, const unsigned char *data, size_t datalen); int EVP_MAC_final(EVP_MAC_CTX *ctx, unsigned char *out, size_t *outl, size_t outsize); @@ -151,6 +152,9 @@ has been called on the same object). See the NOTES section below. EVP_MAC_init() should be called before EVP_MAC_update() and EVP_MAC_final(). +EVP_MAC_init_SKEY() is similar to EVP_MAC_init() but accepts an opaque +B object as a key. + EVP_MAC_update() adds I bytes from I to the MAC input. EVP_MAC_final() does the final computation and stores the result in @@ -384,8 +388,8 @@ success, 0 on error. EVP_Q_mac() returns a pointer to the computed MAC value, or NULL on error. -EVP_MAC_init(), EVP_MAC_update(), EVP_MAC_final(), and EVP_MAC_finalXOF() -return 1 on success, 0 on error. +EVP_MAC_init(), EVP_MAC_init_SKEY(), EVP_MAC_update(), EVP_MAC_final(), and +EVP_MAC_finalXOF() return 1 on success, 0 on error. EVP_MAC_CTX_get_mac_size() returns the expected output size, or 0 if it isn't set. If it isn't set, a call to EVP_MAC_init() will set it. @@ -491,6 +495,8 @@ L These functions were added in OpenSSL 3.0. +The EVP_MAC_init_SKEY() function was added in OpenSSL 3.5. + =head1 COPYRIGHT Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved. diff --git a/include/crypto/evp.h b/include/crypto/evp.h index 16d43e434f9d7e..1a1370af08b50c 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -226,6 +226,7 @@ struct evp_mac_st { OSSL_FUNC_mac_get_params_fn *get_params; OSSL_FUNC_mac_get_ctx_params_fn *get_ctx_params; OSSL_FUNC_mac_set_ctx_params_fn *set_ctx_params; + OSSL_FUNC_mac_init_opaque_fn *init_opaque; }; struct evp_kdf_st { diff --git a/include/openssl/core_dispatch.h b/include/openssl/core_dispatch.h index b1584f5d4be8d4..2a97f605d3223b 100644 --- a/include/openssl/core_dispatch.h +++ b/include/openssl/core_dispatch.h @@ -417,6 +417,7 @@ OSSL_CORE_MAKE_FUNC(void, cipher_freeskey, (void *ptr)) # define OSSL_FUNC_MAC_GETTABLE_PARAMS 10 # define OSSL_FUNC_MAC_GETTABLE_CTX_PARAMS 11 # define OSSL_FUNC_MAC_SETTABLE_CTX_PARAMS 12 +# define OSSL_FUNC_MAC_INIT_OPAQUE 13 OSSL_CORE_MAKE_FUNC(void *, mac_newctx, (void *provctx)) OSSL_CORE_MAKE_FUNC(void *, mac_dupctx, (void *src)) @@ -438,6 +439,7 @@ OSSL_CORE_MAKE_FUNC(int, mac_get_ctx_params, (void *mctx, OSSL_PARAM params[])) OSSL_CORE_MAKE_FUNC(int, mac_set_ctx_params, (void *mctx, const OSSL_PARAM params[])) +OSSL_CORE_MAKE_FUNC(int, mac_init_opaque, (void *mctx, const void *key, const OSSL_PARAM params[])) /* KDFs and PRFs */ diff --git a/include/openssl/evp.h b/include/openssl/evp.h index d3bd0855321108..4988bdbeaaa156 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h @@ -1239,6 +1239,7 @@ unsigned char *EVP_Q_mac(OSSL_LIB_CTX *libctx, const char *name, const char *pro unsigned char *out, size_t outsize, size_t *outlen); int EVP_MAC_init(EVP_MAC_CTX *ctx, const unsigned char *key, size_t keylen, const OSSL_PARAM params[]); +int EVP_MAC_init_SKEY(EVP_MAC_CTX *ctx, const EVP_SKEY *skey, const OSSL_PARAM params[]); int EVP_MAC_update(EVP_MAC_CTX *ctx, const unsigned char *data, size_t datalen); int EVP_MAC_final(EVP_MAC_CTX *ctx, unsigned char *out, size_t *outl, size_t outsize); diff --git a/util/libcrypto.num b/util/libcrypto.num index 058c81fe76ebae..32685516c6adc3 100644 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -5759,3 +5759,4 @@ EVP_SKEY_free ? 3_5_0 EXIST::FUNCTION: EVP_SKEY_dup ? 3_5_0 EXIST::FUNCTION: EVP_KDF_derive_SKEY ? 3_5_0 EXIST::FUNCTION: EVP_PKEY_derive_SKEY ? 3_5_0 EXIST::FUNCTION: +EVP_MAC_init_SKEY ? 3_5_0 EXIST::FUNCTION: