diff -up openssl-1.1.1j/crypto/err/openssl.txt.evp-kdf openssl-1.1.1j/crypto/err/openssl.txt

--- openssl-1.1.1j/crypto/err/openssl.txt.evp-kdf   2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/err/openssl.txt   2021-03-03 14:10:13.729466935 +0100

@@ -748,6 +748,9 @@ EVP_F_EVP_DIGESTINIT_EX:128:EVP_DigestIn

 EVP_F_EVP_ENCRYPTDECRYPTUPDATE:219:evp_EncryptDecryptUpdate

 EVP_F_EVP_ENCRYPTFINAL_EX:127:EVP_EncryptFinal_ex

 EVP_F_EVP_ENCRYPTUPDATE:167:EVP_EncryptUpdate

+EVP_F_EVP_KDF_CTRL:224:EVP_KDF_ctrl

+EVP_F_EVP_KDF_CTRL_STR:225:EVP_KDF_ctrl_str

+EVP_F_EVP_KDF_CTX_NEW_ID:226:EVP_KDF_CTX_new_id

 EVP_F_EVP_MD_CTX_COPY_EX:110:EVP_MD_CTX_copy_ex

 EVP_F_EVP_MD_SIZE:162:EVP_MD_size

 EVP_F_EVP_OPENINIT:102:EVP_OpenInit

@@ -810,12 +813,31 @@ EVP_F_PKCS5_PBE_KEYIVGEN:117:PKCS5_PBE_k

 EVP_F_PKCS5_V2_PBE_KEYIVGEN:118:PKCS5_v2_PBE_keyivgen

 EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN:164:PKCS5_v2_PBKDF2_keyivgen

 EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN:180:PKCS5_v2_scrypt_keyivgen

+EVP_F_PKEY_KDF_CTRL:227:pkey_kdf_ctrl

 EVP_F_PKEY_SET_TYPE:158:pkey_set_type

 EVP_F_RC2_MAGIC_TO_METH:109:rc2_magic_to_meth

 EVP_F_RC5_CTRL:125:rc5_ctrl

 EVP_F_R_32_12_16_INIT_KEY:242:r_32_12_16_init_key

 EVP_F_S390X_AES_GCM_CTRL:201:s390x_aes_gcm_ctrl

+EVP_F_SCRYPT_ALG:228:scrypt_alg

 EVP_F_UPDATE:173:update

+KDF_F_HKDF_EXTRACT:112:HKDF_Extract

+KDF_F_KDF_HKDF_DERIVE:113:kdf_hkdf_derive

+KDF_F_KDF_HKDF_NEW:114:kdf_hkdf_new

+KDF_F_KDF_HKDF_SIZE:115:kdf_hkdf_size

+KDF_F_KDF_MD2CTRL:116:kdf_md2ctrl

+KDF_F_KDF_PBKDF2_CTRL_STR:117:kdf_pbkdf2_ctrl_str

+KDF_F_KDF_PBKDF2_DERIVE:118:kdf_pbkdf2_derive

+KDF_F_KDF_PBKDF2_NEW:119:kdf_pbkdf2_new

+KDF_F_KDF_SCRYPT_CTRL_STR:120:kdf_scrypt_ctrl_str

+KDF_F_KDF_SCRYPT_CTRL_UINT32:121:kdf_scrypt_ctrl_uint32

+KDF_F_KDF_SCRYPT_CTRL_UINT64:122:kdf_scrypt_ctrl_uint64

+KDF_F_KDF_SCRYPT_DERIVE:123:kdf_scrypt_derive

+KDF_F_KDF_SCRYPT_NEW:124:kdf_scrypt_new

+KDF_F_KDF_TLS1_PRF_CTRL_STR:125:kdf_tls1_prf_ctrl_str

+KDF_F_KDF_TLS1_PRF_DERIVE:126:kdf_tls1_prf_derive

+KDF_F_KDF_TLS1_PRF_NEW:127:kdf_tls1_prf_new

+KDF_F_PBKDF2_SET_MEMBUF:128:pbkdf2_set_membuf

 KDF_F_PKEY_HKDF_CTRL_STR:103:pkey_hkdf_ctrl_str

 KDF_F_PKEY_HKDF_DERIVE:102:pkey_hkdf_derive

 KDF_F_PKEY_HKDF_INIT:108:pkey_hkdf_init

@@ -827,6 +849,7 @@ KDF_F_PKEY_SCRYPT_SET_MEMBUF:107:pkey_sc

 KDF_F_PKEY_TLS1_PRF_CTRL_STR:100:pkey_tls1_prf_ctrl_str

 KDF_F_PKEY_TLS1_PRF_DERIVE:101:pkey_tls1_prf_derive

 KDF_F_PKEY_TLS1_PRF_INIT:110:pkey_tls1_prf_init

+KDF_F_SCRYPT_SET_MEMBUF:129:scrypt_set_membuf

 KDF_F_TLS1_PRF_ALG:111:tls1_prf_alg

 OBJ_F_OBJ_ADD_OBJECT:105:OBJ_add_object

 OBJ_F_OBJ_ADD_SIGID:107:OBJ_add_sigid

@@ -2284,6 +2307,7 @@ EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_K

    operation not supported for this keytype

 EVP_R_OPERATON_NOT_INITIALIZED:151:operaton not initialized

 EVP_R_OUTPUT_WOULD_OVERFLOW:184:output would overflow

+EVP_R_PARAMETER_TOO_LARGE:187:parameter too large

 EVP_R_PARTIALLY_OVERLAPPING:162:partially overlapping buffers

 EVP_R_PBKDF2_ERROR:181:pbkdf2 error

 EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED:179:\

@@ -2320,6 +2344,7 @@ KDF_R_MISSING_SEED:106:missing seed

 KDF_R_UNKNOWN_PARAMETER_TYPE:103:unknown parameter type

 KDF_R_VALUE_ERROR:108:value error

 KDF_R_VALUE_MISSING:102:value missing

+KDF_R_WRONG_OUTPUT_BUFFER_SIZE:112:wrong output buffer size

 OBJ_R_OID_EXISTS:102:oid exists

 OBJ_R_UNKNOWN_NID:101:unknown nid

 OCSP_R_CERTIFICATE_VERIFY_ERROR:101:certificate verify error

diff -up openssl-1.1.1j/crypto/evp/build.info.evp-kdf openssl-1.1.1j/crypto/evp/build.info

--- openssl-1.1.1j/crypto/evp/build.info.evp-kdf    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/build.info    2021-03-03 14:08:02.490294839 +0100

@@ -9,7 +9,8 @@ SOURCE[../../libcrypto]=\

         p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c \

         bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \

         c_allc.c c_alld.c evp_lib.c bio_ok.c \

-        evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c pbe_scrypt.c \

+        evp_pkey.c kdf_lib.c evp_pbe.c p5_crpt.c p5_crpt2.c pbe_scrypt.c \

+        pkey_kdf.c \

         e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \

         e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \

         e_chacha20_poly1305.c cmeth_lib.c

diff -up openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c.evp-kdf openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c

--- openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/e_chacha20_poly1305.c 2021-03-03 14:08:02.490294839 +0100

@@ -14,9 +14,9 @@

 # include <openssl/evp.h>

 # include <openssl/objects.h>

-# include "evp_local.h"

 # include "crypto/evp.h"

 # include "crypto/chacha.h"

+# include "evp_local.h"

 typedef struct {

     union {

diff -up openssl-1.1.1j/crypto/evp/encode.c.evp-kdf openssl-1.1.1j/crypto/evp/encode.c

--- openssl-1.1.1j/crypto/evp/encode.c.evp-kdf  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/encode.c  2021-03-03 14:08:02.491294847 +0100

@@ -11,8 +11,8 @@

 #include <limits.h>

 #include "internal/cryptlib.h"

 #include <openssl/evp.h>

-#include "evp_local.h"

 #include "crypto/evp.h"

+#include "evp_local.h"

 static unsigned char conv_ascii2bin(unsigned char a,

                                     const unsigned char *table);

diff -up openssl-1.1.1j/crypto/evp/evp_err.c.evp-kdf openssl-1.1.1j/crypto/evp/evp_err.c

--- openssl-1.1.1j/crypto/evp/evp_err.c.evp-kdf 2021-03-03 14:08:02.469294651 +0100

+++ openssl-1.1.1j/crypto/evp/evp_err.c 2021-03-03 14:12:08.272351600 +0100

@@ -60,6 +60,9 @@ static const ERR_STRING_DATA EVP_str_fun

     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_ENCRYPTFINAL_EX, 0),

      "EVP_EncryptFinal_ex"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_ENCRYPTUPDATE, 0), "EVP_EncryptUpdate"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_KDF_CTRL, 0), "EVP_KDF_ctrl"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_KDF_CTRL_STR, 0), "EVP_KDF_ctrl_str"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_KDF_CTX_NEW_ID, 0), "EVP_KDF_CTX_new_id"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MD_CTX_COPY_EX, 0), "EVP_MD_CTX_copy_ex"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_MD_SIZE, 0), "EVP_MD_size"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_OPENINIT, 0), "EVP_OpenInit"},

@@ -151,12 +154,14 @@ static const ERR_STRING_DATA EVP_str_fun

      "PKCS5_v2_PBKDF2_keyivgen"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_PKCS5_V2_SCRYPT_KEYIVGEN, 0),

      "PKCS5_v2_scrypt_keyivgen"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_PKEY_KDF_CTRL, 0), "pkey_kdf_ctrl"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_PKEY_SET_TYPE, 0), "pkey_set_type"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_RC2_MAGIC_TO_METH, 0), "rc2_magic_to_meth"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_RC5_CTRL, 0), "rc5_ctrl"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_R_32_12_16_INIT_KEY, 0),

      "r_32_12_16_init_key"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_S390X_AES_GCM_CTRL, 0), "s390x_aes_gcm_ctrl"},

+    {ERR_PACK(ERR_LIB_EVP, EVP_F_SCRYPT_ALG, 0), "scrypt_alg"},

     {ERR_PACK(ERR_LIB_EVP, EVP_F_UPDATE, 0), "update"},

     {0, NULL}

 };

@@ -243,6 +248,8 @@ static const ERR_STRING_DATA EVP_str_rea

     "operaton not initialized"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OUTPUT_WOULD_OVERFLOW),

     "output would overflow"},

+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARAMETER_TOO_LARGE),

+    "parameter too large"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARTIALLY_OVERLAPPING),

     "partially overlapping buffers"},

     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PBKDF2_ERROR), "pbkdf2 error"},

diff -up openssl-1.1.1j/crypto/evp/evp_local.h.evp-kdf openssl-1.1.1j/crypto/evp/evp_local.h

--- openssl-1.1.1j/crypto/evp/evp_local.h.evp-kdf   2021-03-03 14:08:02.362293695 +0100

+++ openssl-1.1.1j/crypto/evp/evp_local.h   2021-03-03 14:08:02.491294847 +0100

@@ -41,6 +41,11 @@ struct evp_cipher_ctx_st {

     unsigned char final[EVP_MAX_BLOCK_LENGTH]; /* possible final block */

 } /* EVP_CIPHER_CTX */ ;

+struct evp_kdf_ctx_st {

+    const EVP_KDF_METHOD *kmeth;

+    EVP_KDF_IMPL *impl;          /* Algorithm-specific data */

+} /* EVP_KDF_CTX */ ;

+

 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,

                              int passlen, ASN1_TYPE *param,

                              const EVP_CIPHER *c, const EVP_MD *md,

diff -up openssl-1.1.1j/crypto/evp/evp_pbe.c.evp-kdf openssl-1.1.1j/crypto/evp/evp_pbe.c

--- openssl-1.1.1j/crypto/evp/evp_pbe.c.evp-kdf 2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/evp_pbe.c 2021-03-03 14:08:02.491294847 +0100

@@ -12,6 +12,7 @@

 #include <openssl/evp.h>

 #include <openssl/pkcs12.h>

 #include <openssl/x509.h>

+#include "crypto/evp.h"

 #include "evp_local.h"

 /* Password based encryption (PBE) functions */

diff -up openssl-1.1.1j/crypto/evp/kdf_lib.c.evp-kdf openssl-1.1.1j/crypto/evp/kdf_lib.c

--- openssl-1.1.1j/crypto/evp/kdf_lib.c.evp-kdf 2021-03-03 14:08:02.491294847 +0100

+++ openssl-1.1.1j/crypto/evp/kdf_lib.c 2021-03-03 14:08:02.491294847 +0100

@@ -0,0 +1,165 @@

+/*

+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.

+ * Copyright (c) 2018, Oracle and/or its affiliates.  All rights reserved.

+ *

+ * Licensed under the Apache License 2.0 (the "License").  You may not use

+ * this file except in compliance with the License.  You can obtain a copy

+ * in the file LICENSE in the source distribution or at

+ * https://www.openssl.org/source/license.html

+ */

+

+#include <stdio.h>

+#include <stdlib.h>

+#include "internal/cryptlib.h"

+#include <openssl/engine.h>

+#include <openssl/evp.h>

+#include <openssl/x509v3.h>

+#include <openssl/kdf.h>

+#include "crypto/asn1.h"

+#include "crypto/evp.h"

+#include "internal/numbers.h"

+#include "evp_local.h"

+

+typedef int sk_cmp_fn_type(const char *const *a, const char *const *b);

+

+/* This array needs to be in order of NIDs */

+static const EVP_KDF_METHOD *standard_methods[] = {

+    &pbkdf2_kdf_meth,

+#ifndef OPENSSL_NO_SCRYPT

+    &scrypt_kdf_meth,

+#endif

+    &tls1_prf_kdf_meth,

+    &hkdf_kdf_meth

+};

+

+DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_KDF_METHOD *, const EVP_KDF_METHOD *,

+                           kmeth);

+

+static int kmeth_cmp(const EVP_KDF_METHOD *const *a,

+                     const EVP_KDF_METHOD *const *b)

+{

+    return ((*a)->type - (*b)->type);

+}

+

+IMPLEMENT_OBJ_BSEARCH_CMP_FN(const EVP_KDF_METHOD *, const EVP_KDF_METHOD *,

+                             kmeth);

+

+static const EVP_KDF_METHOD *kdf_meth_find(int type)

+{

+    EVP_KDF_METHOD tmp;

+    const EVP_KDF_METHOD *t = &tmp, **ret;

+

+    tmp.type = type;

+    ret = OBJ_bsearch_kmeth(&t, standard_methods,

+                            OSSL_NELEM(standard_methods));

+    if (ret == NULL || *ret == NULL)

+        return NULL;

+

+    return *ret;

+}

+

+EVP_KDF_CTX *EVP_KDF_CTX_new_id(int id)

+{

+    EVP_KDF_CTX *ret;

+    const EVP_KDF_METHOD *kmeth;

+

+    kmeth = kdf_meth_find(id);

+    if (kmeth == NULL) {

+        EVPerr(EVP_F_EVP_KDF_CTX_NEW_ID, EVP_R_UNSUPPORTED_ALGORITHM);

+        return NULL;

+    }

+

+    ret = OPENSSL_zalloc(sizeof(*ret));

+    if (ret == NULL) {

+        EVPerr(EVP_F_EVP_KDF_CTX_NEW_ID, ERR_R_MALLOC_FAILURE);

+        return NULL;

+    }

+

+    if (kmeth->new != NULL && (ret->impl = kmeth->new()) == NULL) {

+        EVP_KDF_CTX_free(ret);

+        return NULL;

+    }

+

+    ret->kmeth = kmeth;

+    return ret;

+}

+

+void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx)

+{

+    if (ctx == NULL)

+        return;

+

+    ctx->kmeth->free(ctx->impl);

+    OPENSSL_free(ctx);

+}

+

+void EVP_KDF_reset(EVP_KDF_CTX *ctx)

+{

+    if (ctx == NULL)

+        return;

+

+    if (ctx->kmeth->reset != NULL)

+        ctx->kmeth->reset(ctx->impl);

+}

+

+int EVP_KDF_ctrl(EVP_KDF_CTX *ctx, int cmd, ...)

+{

+    int ret;

+    va_list args;

+

+    va_start(args, cmd);

+    ret = EVP_KDF_vctrl(ctx, cmd, args);

+    va_end(args);

+

+    if (ret == -2)

+        EVPerr(EVP_F_EVP_KDF_CTRL, EVP_R_COMMAND_NOT_SUPPORTED);

+

+    return ret;

+}

+

+int EVP_KDF_vctrl(EVP_KDF_CTX *ctx, int cmd, va_list args)

+{

+    if (ctx == NULL)

+        return 0;

+

+    return ctx->kmeth->ctrl(ctx->impl, cmd, args);

+}

+

+int EVP_KDF_ctrl_str(EVP_KDF_CTX *ctx, const char *type, const char *value)

+{

+    int ret;

+

+    if (ctx == NULL)

+        return 0;

+

+    if (ctx->kmeth->ctrl_str == NULL) {

+        EVPerr(EVP_F_EVP_KDF_CTRL_STR, EVP_R_COMMAND_NOT_SUPPORTED);

+        return -2;

+    }

+

+    ret = ctx->kmeth->ctrl_str(ctx->impl, type, value);

+    if (ret == -2)

+        EVPerr(EVP_F_EVP_KDF_CTRL_STR, EVP_R_COMMAND_NOT_SUPPORTED);

+

+    return ret;

+}

+

+size_t EVP_KDF_size(EVP_KDF_CTX *ctx)

+{

+    if (ctx == NULL)

+        return 0;

+

+    if (ctx->kmeth->size == NULL)

+        return SIZE_MAX;

+

+    return ctx->kmeth->size(ctx->impl);

+}

+

+int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen)

+{

+    if (ctx == NULL)

+        return 0;

+

+    return ctx->kmeth->derive(ctx->impl, key, keylen);

+}

+

diff -up openssl-1.1.1j/crypto/evp/p5_crpt2.c.evp-kdf openssl-1.1.1j/crypto/evp/p5_crpt2.c

--- openssl-1.1.1j/crypto/evp/p5_crpt2.c.evp-kdf    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/p5_crpt2.c    2021-03-03 14:08:02.491294847 +0100

@@ -1,5 +1,5 @@

 /*

- * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.

+ * Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.

  *

  * Licensed under the OpenSSL license (the "License").  You may not use

  * this file except in compliance with the License.  You can obtain a copy

@@ -10,105 +10,51 @@

 #include <stdio.h>

 #include <stdlib.h>

 #include "internal/cryptlib.h"

-# include <openssl/x509.h>

-# include <openssl/evp.h>

-# include <openssl/hmac.h>

-# include "evp_local.h"

+#include <openssl/x509.h>

+#include <openssl/evp.h>

+#include <openssl/kdf.h>

+#include <openssl/hmac.h>

+#include "crypto/evp.h"

+#include "evp_local.h"

 /* set this to print out info about the keygen algorithm */

 /* #define OPENSSL_DEBUG_PKCS5V2 */

-# ifdef OPENSSL_DEBUG_PKCS5V2

+#ifdef OPENSSL_DEBUG_PKCS5V2

 static void h__dump(const unsigned char *p, int len);

-# endif

-

-/*

- * This is an implementation of PKCS#5 v2.0 password based encryption key

- * derivation function PBKDF2. SHA1 version verified against test vectors

- * posted by Peter Gutmann to the PKCS-TNG mailing list.

- */

+#endif

 int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,

                       const unsigned char *salt, int saltlen, int iter,

                       const EVP_MD *digest, int keylen, unsigned char *out)

 {

     const char *empty = "";

-    unsigned char digtmp[EVP_MAX_MD_SIZE], *p, itmp[4];

-    int cplen, j, k, tkeylen, mdlen;

-    unsigned long i = 1;

-    HMAC_CTX *hctx_tpl = NULL, *hctx = NULL;

-

-    mdlen = EVP_MD_size(digest);

-    if (mdlen < 0)

-        return 0;

+    int rv = 1;

+    EVP_KDF_CTX *kctx;

-    hctx_tpl = HMAC_CTX_new();

-    if (hctx_tpl == NULL)

-        return 0;

-    p = out;

-    tkeylen = keylen;

+    /* Keep documented behaviour. */

     if (pass == NULL) {

         pass = empty;

         passlen = 0;

     } else if (passlen == -1) {

         passlen = strlen(pass);

     }

-    if (!HMAC_Init_ex(hctx_tpl, pass, passlen, digest, NULL)) {

-        HMAC_CTX_free(hctx_tpl);

-        return 0;

-    }

-    hctx = HMAC_CTX_new();

-    if (hctx == NULL) {

-        HMAC_CTX_free(hctx_tpl);

+    if (salt == NULL && saltlen == 0)

+        salt = (unsigned char *)empty;

+

+    kctx = EVP_KDF_CTX_new_id(EVP_KDF_PBKDF2);

+    if (kctx == NULL)

         return 0;

-    }

-    while (tkeylen) {

-        if (tkeylen > mdlen)

-            cplen = mdlen;

-        else

-            cplen = tkeylen;

-        /*

-         * We are unlikely to ever use more than 256 blocks (5120 bits!) but

-         * just in case...

-         */

-        itmp[0] = (unsigned char)((i >> 24) & 0xff);

-        itmp[1] = (unsigned char)((i >> 16) & 0xff);

-        itmp[2] = (unsigned char)((i >> 8) & 0xff);

-        itmp[3] = (unsigned char)(i & 0xff);

-        if (!HMAC_CTX_copy(hctx, hctx_tpl)) {

-            HMAC_CTX_free(hctx);

-            HMAC_CTX_free(hctx_tpl);

-            return 0;

-        }

-        if (!HMAC_Update(hctx, salt, saltlen)

-            || !HMAC_Update(hctx, itmp, 4)

-            || !HMAC_Final(hctx, digtmp, NULL)) {

-            HMAC_CTX_free(hctx);

-            HMAC_CTX_free(hctx_tpl);

-            return 0;

-        }

-        memcpy(p, digtmp, cplen);

-        for (j = 1; j < iter; j++) {

-            if (!HMAC_CTX_copy(hctx, hctx_tpl)) {

-                HMAC_CTX_free(hctx);

-                HMAC_CTX_free(hctx_tpl);

-                return 0;

-            }

-            if (!HMAC_Update(hctx, digtmp, mdlen)

-                || !HMAC_Final(hctx, digtmp, NULL)) {

-                HMAC_CTX_free(hctx);

-                HMAC_CTX_free(hctx_tpl);

-                return 0;

-            }

-            for (k = 0; k < cplen; k++)

-                p[k] ^= digtmp[k];

-        }

-        tkeylen -= cplen;

-        i++;

-        p += cplen;

-    }

-    HMAC_CTX_free(hctx);

-    HMAC_CTX_free(hctx_tpl);

+    if (EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, pass, (size_t)passlen) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,

+                            salt, (size_t)saltlen) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_ITER, iter) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, digest) != 1

+            || EVP_KDF_derive(kctx, out, keylen) != 1)

+        rv = 0;

+

+    EVP_KDF_CTX_free(kctx);

+

 # ifdef OPENSSL_DEBUG_PKCS5V2

     fprintf(stderr, "Password:\n");

     h__dump(pass, passlen);

@@ -118,7 +64,7 @@ int PKCS5_PBKDF2_HMAC(const char *pass,

     fprintf(stderr, "Key:\n");

     h__dump(out, keylen);

 # endif

-    return 1;

+    return rv;

 }

 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,

diff -up openssl-1.1.1j/crypto/evp/pbe_scrypt.c.evp-kdf openssl-1.1.1j/crypto/evp/pbe_scrypt.c

--- openssl-1.1.1j/crypto/evp/pbe_scrypt.c.evp-kdf  2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/evp/pbe_scrypt.c  2021-03-03 14:08:02.491294847 +0100

@@ -7,135 +7,12 @@

  * https://www.openssl.org/source/license.html

  */

-#include <stddef.h>

-#include <stdio.h>

-#include <string.h>

 #include <openssl/evp.h>

 #include <openssl/err.h>

-#include "internal/numbers.h"

+#include <openssl/kdf.h>

 #ifndef OPENSSL_NO_SCRYPT

-#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))

-static void salsa208_word_specification(uint32_t inout[16])

-{

-    int i;

-    uint32_t x[16];

-    memcpy(x, inout, sizeof(x));

-    for (i = 8; i > 0; i -= 2) {

-        x[4] ^= R(x[0] + x[12], 7);

-        x[8] ^= R(x[4] + x[0], 9);

-        x[12] ^= R(x[8] + x[4], 13);

-        x[0] ^= R(x[12] + x[8], 18);

-        x[9] ^= R(x[5] + x[1], 7);

-        x[13] ^= R(x[9] + x[5], 9);

-        x[1] ^= R(x[13] + x[9], 13);

-        x[5] ^= R(x[1] + x[13], 18);

-        x[14] ^= R(x[10] + x[6], 7);

-        x[2] ^= R(x[14] + x[10], 9);

-        x[6] ^= R(x[2] + x[14], 13);

-        x[10] ^= R(x[6] + x[2], 18);

-        x[3] ^= R(x[15] + x[11], 7);

-        x[7] ^= R(x[3] + x[15], 9);

-        x[11] ^= R(x[7] + x[3], 13);

-        x[15] ^= R(x[11] + x[7], 18);

-        x[1] ^= R(x[0] + x[3], 7);

-        x[2] ^= R(x[1] + x[0], 9);

-        x[3] ^= R(x[2] + x[1], 13);

-        x[0] ^= R(x[3] + x[2], 18);

-        x[6] ^= R(x[5] + x[4], 7);

-        x[7] ^= R(x[6] + x[5], 9);

-        x[4] ^= R(x[7] + x[6], 13);

-        x[5] ^= R(x[4] + x[7], 18);

-        x[11] ^= R(x[10] + x[9], 7);

-        x[8] ^= R(x[11] + x[10], 9);

-        x[9] ^= R(x[8] + x[11], 13);

-        x[10] ^= R(x[9] + x[8], 18);

-        x[12] ^= R(x[15] + x[14], 7);

-        x[13] ^= R(x[12] + x[15], 9);

-        x[14] ^= R(x[13] + x[12], 13);

-        x[15] ^= R(x[14] + x[13], 18);

-    }

-    for (i = 0; i < 16; ++i)

-        inout[i] += x[i];

-    OPENSSL_cleanse(x, sizeof(x));

-}

-

-static void scryptBlockMix(uint32_t *B_, uint32_t *B, uint64_t r)

-{

-    uint64_t i, j;

-    uint32_t X[16], *pB;

-

-    memcpy(X, B + (r * 2 - 1) * 16, sizeof(X));

-    pB = B;

-    for (i = 0; i < r * 2; i++) {

-        for (j = 0; j < 16; j++)

-            X[j] ^= *pB++;

-        salsa208_word_specification(X);

-        memcpy(B_ + (i / 2 + (i & 1) * r) * 16, X, sizeof(X));

-    }

-    OPENSSL_cleanse(X, sizeof(X));

-}

-

-static void scryptROMix(unsigned char *B, uint64_t r, uint64_t N,

-                        uint32_t *X, uint32_t *T, uint32_t *V)

-{

-    unsigned char *pB;

-    uint32_t *pV;

-    uint64_t i, k;

-

-    /* Convert from little endian input */

-    for (pV = V, i = 0, pB = B; i < 32 * r; i++, pV++) {

-        *pV = *pB++;

-        *pV |= *pB++ << 8;

-        *pV |= *pB++ << 16;

-        *pV |= (uint32_t)*pB++ << 24;

-    }

-

-    for (i = 1; i < N; i++, pV += 32 * r)

-        scryptBlockMix(pV, pV - 32 * r, r);

-

-    scryptBlockMix(X, V + (N - 1) * 32 * r, r);

-

-    for (i = 0; i < N; i++) {

-        uint32_t j;

-        j = X[16 * (2 * r - 1)] % N;

-        pV = V + 32 * r * j;

-        for (k = 0; k < 32 * r; k++)

-            T[k] = X[k] ^ *pV++;

-        scryptBlockMix(X, T, r);

-    }

-    /* Convert output to little endian */

-    for (i = 0, pB = B; i < 32 * r; i++) {

-        uint32_t xtmp = X[i];

-        *pB++ = xtmp & 0xff;

-        *pB++ = (xtmp >> 8) & 0xff;

-        *pB++ = (xtmp >> 16) & 0xff;

-        *pB++ = (xtmp >> 24) & 0xff;

-    }

-}

-

-#ifndef SIZE_MAX

-# define SIZE_MAX    ((size_t)-1)

-#endif

-

-/*

- * Maximum power of two that will fit in uint64_t: this should work on

- * most (all?) platforms.

- */

-

-#define LOG2_UINT64_MAX         (sizeof(uint64_t) * 8 - 1)

-

-/*

- * Maximum value of p * r:

- * p <= ((2^32-1) * hLen) / MFLen =>

- * p <= ((2^32-1) * 32) / (128 * r) =>

- * p * r <= (2^30-1)

- *

- */

-

-#define SCRYPT_PR_MAX   ((1 << 30) - 1)

-

 /*

  * Maximum permitted memory allow this to be overridden with Configuration

  * option: e.g. -DSCRYPT_MAX_MEM=0 for maximum possible.

@@ -160,107 +37,43 @@ int EVP_PBE_scrypt(const char *pass, siz

                    uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem,

                    unsigned char *key, size_t keylen)

 {

-    int rv = 0;

-    unsigned char *B;

-    uint32_t *X, *V, *T;

-    uint64_t i, Blen, Vlen;

-

-    /* Sanity check parameters */

-    /* initial check, r,p must be non zero, N >= 2 and a power of 2 */

-    if (r == 0 || p == 0 || N < 2 || (N & (N - 1)))

-        return 0;

-    /* Check p * r < SCRYPT_PR_MAX avoiding overflow */

-    if (p > SCRYPT_PR_MAX / r) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

-        return 0;

-    }

-

-    /*

-     * Need to check N: if 2^(128 * r / 8) overflows limit this is

-     * automatically satisfied since N <= UINT64_MAX.

-     */

-

-    if (16 * r <= LOG2_UINT64_MAX) {

-        if (N >= (((uint64_t)1) << (16 * r))) {

-            EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

-            return 0;

-        }

-    }

+    const char *empty = "";

+    int rv = 1;

+    EVP_KDF_CTX *kctx;

-    /* Memory checks: check total allocated buffer size fits in uint64_t */

-

-    /*

-     * B size in section 5 step 1.S

-     * Note: we know p * 128 * r < UINT64_MAX because we already checked

-     * p * r < SCRYPT_PR_MAX

-     */

-    Blen = p * 128 * r;

-    /*

-     * Yet we pass it as integer to PKCS5_PBKDF2_HMAC... [This would

-     * have to be revised when/if PKCS5_PBKDF2_HMAC accepts size_t.]

-     */

-    if (Blen > INT_MAX) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

+    if (r > UINT32_MAX || p > UINT32_MAX) {

+        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_PARAMETER_TOO_LARGE);

         return 0;

     }

-    /*

-     * Check 32 * r * (N + 2) * sizeof(uint32_t) fits in uint64_t

-     * This is combined size V, X and T (section 4)

-     */

-    i = UINT64_MAX / (32 * sizeof(uint32_t));

-    if (N + 2 > i / r) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

-        return 0;

+    /* Maintain existing behaviour. */

+    if (pass == NULL) {

+        pass = empty;

+        passlen = 0;

     }

-    Vlen = 32 * r * (N + 2) * sizeof(uint32_t);

-

-    /* check total allocated size fits in uint64_t */

-    if (Blen > UINT64_MAX - Vlen) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

-        return 0;

+    if (salt == NULL) {

+        salt = (const unsigned char *)empty;

+        saltlen = 0;

     }

-

     if (maxmem == 0)

         maxmem = SCRYPT_MAX_MEM;

-    /* Check that the maximum memory doesn't exceed a size_t limits */

-    if (maxmem > SIZE_MAX)

-        maxmem = SIZE_MAX;

-

-    if (Blen + Vlen > maxmem) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_MEMORY_LIMIT_EXCEEDED);

+    kctx = EVP_KDF_CTX_new_id(EVP_KDF_SCRYPT);

+    if (kctx == NULL)

         return 0;

-    }

-    /* If no key return to indicate parameters are OK */

-    if (key == NULL)

-        return 1;

-

-    B = OPENSSL_malloc((size_t)(Blen + Vlen));

-    if (B == NULL) {

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, ERR_R_MALLOC_FAILURE);

-        return 0;

-    }

-    X = (uint32_t *)(B + Blen);

-    T = X + 32 * r;

-    V = T + 32 * r;

-    if (PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, 1, EVP_sha256(),

-                          (int)Blen, B) == 0)

-        goto err;

-

-    for (i = 0; i < p; i++)

-        scryptROMix(B + 128 * r * i, r, N, X, T, V);

-

-    if (PKCS5_PBKDF2_HMAC(pass, passlen, B, (int)Blen, 1, EVP_sha256(),

-                          keylen, key) == 0)

-        goto err;

-    rv = 1;

- err:

-    if (rv == 0)

-        EVPerr(EVP_F_EVP_PBE_SCRYPT, EVP_R_PBKDF2_ERROR);

+    if (EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_PASS, pass, (size_t)passlen) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,

+                            salt, (size_t)saltlen) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_N, N) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_R, (uint32_t)r) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SCRYPT_P, (uint32_t)p) != 1

+            || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MAXMEM_BYTES, maxmem) != 1

+            || EVP_KDF_derive(kctx, key, keylen) != 1)

+        rv = 0;

-    OPENSSL_clear_free(B, (size_t)(Blen + Vlen));

+    EVP_KDF_CTX_free(kctx);

     return rv;

 }

+

 #endif

diff -up openssl-1.1.1j/crypto/evp/pkey_kdf.c.evp-kdf openssl-1.1.1j/crypto/evp/pkey_kdf.c

--- openssl-1.1.1j/crypto/evp/pkey_kdf.c.evp-kdf    2021-03-03 14:08:02.491294847 +0100

+++ openssl-1.1.1j/crypto/evp/pkey_kdf.c    2021-03-03 14:08:02.491294847 +0100

@@ -0,0 +1,255 @@

+/*

+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.

+ * Copyright (c) 2018, Oracle and/or its affiliates.  All rights reserved.

+ *

+ * Licensed under the Apache License 2.0 (the "License").  You may not use

+ * this file except in compliance with the License.  You can obtain a copy

+ * in the file LICENSE in the source distribution or at

+ * https://www.openssl.org/source/license.html

+ */

+

+#include <string.h>

+#include <openssl/evp.h>

+#include <openssl/err.h>

+#include <openssl/kdf.h>

+#include "crypto/evp.h"

+

+static int pkey_kdf_init(EVP_PKEY_CTX *ctx)

+{

+    EVP_KDF_CTX *kctx;

+

+    kctx = EVP_KDF_CTX_new_id(ctx->pmeth->pkey_id);

+    if (kctx == NULL)

+        return 0;

+

+    ctx->data = kctx;

+    return 1;

+}

+

+static void pkey_kdf_cleanup(EVP_PKEY_CTX *ctx)

+{

+    EVP_KDF_CTX *kctx = ctx->data;

+

+    EVP_KDF_CTX_free(kctx);

+}

+

+static int pkey_kdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)

+{

+    EVP_KDF_CTX *kctx = ctx->data;

+    uint64_t u64_value;

+    int cmd;

+    int ret;

+

+    switch (type) {

+    case EVP_PKEY_CTRL_PASS:

+        cmd = EVP_KDF_CTRL_SET_PASS;

+        break;

+    case EVP_PKEY_CTRL_HKDF_SALT:

+    case EVP_PKEY_CTRL_SCRYPT_SALT:

+        cmd = EVP_KDF_CTRL_SET_SALT;

+        break;

+    case EVP_PKEY_CTRL_TLS_MD:

+    case EVP_PKEY_CTRL_HKDF_MD:

+        cmd = EVP_KDF_CTRL_SET_MD;

+        break;

+    case EVP_PKEY_CTRL_TLS_SECRET:

+        cmd = EVP_KDF_CTRL_SET_TLS_SECRET;

+        ret = EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_RESET_TLS_SEED);

+        if (ret < 1)

+            return ret;

+        break;

+    case EVP_PKEY_CTRL_TLS_SEED:

+        cmd = EVP_KDF_CTRL_ADD_TLS_SEED;

+        break;

+    case EVP_PKEY_CTRL_HKDF_KEY:

+        cmd = EVP_KDF_CTRL_SET_KEY;

+        break;

+    case EVP_PKEY_CTRL_HKDF_INFO:

+        cmd = EVP_KDF_CTRL_ADD_HKDF_INFO;

+        break;

+    case EVP_PKEY_CTRL_HKDF_MODE:

+        cmd = EVP_KDF_CTRL_SET_HKDF_MODE;

+        break;

+    case EVP_PKEY_CTRL_SCRYPT_N:

+        cmd = EVP_KDF_CTRL_SET_SCRYPT_N;

+        break;

+    case EVP_PKEY_CTRL_SCRYPT_R:

+        cmd = EVP_KDF_CTRL_SET_SCRYPT_R;

+        break;

+    case EVP_PKEY_CTRL_SCRYPT_P:

+        cmd = EVP_KDF_CTRL_SET_SCRYPT_P;

+        break;

+    case EVP_PKEY_CTRL_SCRYPT_MAXMEM_BYTES:

+        cmd = EVP_KDF_CTRL_SET_MAXMEM_BYTES;

+        break;

+    default:

+        return -2;

+    }

+

+    switch (cmd) {

+    case EVP_KDF_CTRL_SET_PASS:

+    case EVP_KDF_CTRL_SET_SALT:

+    case EVP_KDF_CTRL_SET_KEY:

+    case EVP_KDF_CTRL_SET_TLS_SECRET:

+    case EVP_KDF_CTRL_ADD_TLS_SEED:

+    case EVP_KDF_CTRL_ADD_HKDF_INFO:

+        return EVP_KDF_ctrl(kctx, cmd, (const unsigned char *)p2, (size_t)p1);

+

+    case EVP_KDF_CTRL_SET_MD:

+        return EVP_KDF_ctrl(kctx, cmd, (const EVP_MD *)p2);

+

+    case EVP_KDF_CTRL_SET_HKDF_MODE:

+        return EVP_KDF_ctrl(kctx, cmd, (int)p1);

+

+    case EVP_KDF_CTRL_SET_SCRYPT_R:

+    case EVP_KDF_CTRL_SET_SCRYPT_P:

+        u64_value = *(uint64_t *)p2;

+        if (u64_value > UINT32_MAX) {

+            EVPerr(EVP_F_PKEY_KDF_CTRL, EVP_R_PARAMETER_TOO_LARGE);

+            return 0;

+        }

+

+        return EVP_KDF_ctrl(kctx, cmd, (uint32_t)u64_value);

+

+    case EVP_KDF_CTRL_SET_SCRYPT_N:

+    case EVP_KDF_CTRL_SET_MAXMEM_BYTES:

+        return EVP_KDF_ctrl(kctx, cmd, *(uint64_t *)p2);

+

+    default:

+        return 0;

+    }

+}

+

+static int pkey_kdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,

+                             const char *value)

+{

+    EVP_KDF_CTX *kctx = ctx->data;

+

+    if (strcmp(type, "md") == 0)

+        return EVP_KDF_ctrl_str(kctx, "digest", value);

+    return EVP_KDF_ctrl_str(kctx, type, value);

+}

+

+static int pkey_kdf_derive_init(EVP_PKEY_CTX *ctx)

+{

+    EVP_KDF_CTX *kctx = ctx->data;

+

+    EVP_KDF_reset(kctx);

+    return 1;

+}

+

+/*

+ * For fixed-output algorithms the keylen parameter is an "out" parameter

+ * otherwise it is an "in" parameter.

+ */

+static int pkey_kdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,

+                           size_t *keylen)

+{

+    EVP_KDF_CTX *kctx = ctx->data;

+    size_t outlen = EVP_KDF_size(kctx);

+

+    if (outlen == 0 || outlen == SIZE_MAX) {

+        /* Variable-output algorithm */

+        if (key == NULL)

+            return 0;

+    } else {

+        /* Fixed-output algorithm */

+        *keylen = outlen;

+        if (key == NULL)

+            return 1;

+    }

+    return EVP_KDF_derive(kctx, key, *keylen);

+}

+

+#ifndef OPENSSL_NO_SCRYPT

+const EVP_PKEY_METHOD scrypt_pkey_meth = {

+    EVP_PKEY_SCRYPT,

+    0,

+    pkey_kdf_init,

+    0,

+    pkey_kdf_cleanup,

+

+    0, 0,

+    0, 0,

+

+    0,

+    0,

+

+    0,

+    0,

+

+    0, 0,

+

+    0, 0, 0, 0,

+

+    0, 0,

+

+    0, 0,

+

+    pkey_kdf_derive_init,

+    pkey_kdf_derive,

+    pkey_kdf_ctrl,

+    pkey_kdf_ctrl_str

+};

+#endif

+

+const EVP_PKEY_METHOD tls1_prf_pkey_meth = {

+    EVP_PKEY_TLS1_PRF,

+    EVP_PKEY_FLAG_FIPS,

+    pkey_kdf_init,

+    0,

+    pkey_kdf_cleanup,

+

+    0, 0,

+    0, 0,

+

+    0,

+    0,

+

+    0,

+    0,

+

+    0, 0,

+

+    0, 0, 0, 0,

+

+    0, 0,

+

+    0, 0,

+

+    pkey_kdf_derive_init,

+    pkey_kdf_derive,

+    pkey_kdf_ctrl,

+    pkey_kdf_ctrl_str

+};

+

+const EVP_PKEY_METHOD hkdf_pkey_meth = {

+    EVP_PKEY_HKDF,

+    EVP_PKEY_FLAG_FIPS,

+    pkey_kdf_init,

+    0,

+    pkey_kdf_cleanup,

+

+    0, 0,

+    0, 0,

+

+    0,

+    0,

+

+    0,

+    0,

+

+    0, 0,

+

+    0, 0, 0, 0,

+

+    0, 0,

+

+    0, 0,

+

+    pkey_kdf_derive_init,

+    pkey_kdf_derive,

+    pkey_kdf_ctrl,

+    pkey_kdf_ctrl_str

+};

+

diff -up openssl-1.1.1j/crypto/kdf/build.info.evp-kdf openssl-1.1.1j/crypto/kdf/build.info

--- openssl-1.1.1j/crypto/kdf/build.info.evp-kdf    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/kdf/build.info    2021-03-03 14:08:02.491294847 +0100

@@ -1,3 +1,3 @@

 LIBS=../../libcrypto

 SOURCE[../../libcrypto]=\

-        tls1_prf.c kdf_err.c hkdf.c scrypt.c

+        tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c

diff -up openssl-1.1.1j/crypto/kdf/hkdf.c.evp-kdf openssl-1.1.1j/crypto/kdf/hkdf.c

--- openssl-1.1.1j/crypto/kdf/hkdf.c.evp-kdf    2021-02-16 16:24:01.000000000 +0100

+++ openssl-1.1.1j/crypto/kdf/hkdf.c    2021-03-03 14:08:02.492294856 +0100

@@ -8,32 +8,33 @@

  */

 #include <stdlib.h>

+#include <stdarg.h>

 #include <string.h>

 #include <openssl/hmac.h>

 #include <openssl/kdf.h>

 #include <openssl/evp.h>

 #include "internal/cryptlib.h"

 #include "crypto/evp.h"

+#include "kdf_local.h"

 #define HKDF_MAXBUF 1024

-static unsigned char *HKDF(const EVP_MD *evp_md,

-                           const unsigned char *salt, size_t salt_len,

-                           const unsigned char *key, size_t key_len,

-                           const unsigned char *info, size_t info_len,

-                           unsigned char *okm, size_t okm_len);

-

-static unsigned char *HKDF_Extract(const EVP_MD *evp_md,

-                                   const unsigned char *salt, size_t salt_len,

-                                   const unsigned char *key, size_t key_len,

-                                   unsigned char *prk, size_t *prk_len);

-

-static unsigned char *HKDF_Expand(const EVP_MD *evp_md,

-                                  const unsigned char *prk, size_t prk_len,

-                                  const unsigned char *info, size_t info_len,

-                                  unsigned char *okm, size_t okm_len);

+static void kdf_hkdf_reset(EVP_KDF_IMPL *impl);

+static int HKDF(const EVP_MD *evp_md,

+                const unsigned char *salt, size_t salt_len,

+                const unsigned char *key, size_t key_len,

+                const unsigned char *info, size_t info_len,

+                unsigned char *okm, size_t okm_len);

+static int HKDF_Extract(const EVP_MD *evp_md,

+                        const unsigned char *salt, size_t salt_len,

+                        const unsigned char *key, size_t key_len,

+                        unsigned char *prk, size_t prk_len);

+static int HKDF_Expand(const EVP_MD *evp_md,

+                       const unsigned char *prk, size_t prk_len,

+                       const unsigned char *info, size_t info_len,

+                       unsigned char *okm, size_t okm_len);

-typedef struct {

+struct evp_kdf_impl_st {

     int mode;

     const EVP_MD *md;

     unsigned char *salt;

@@ -42,230 +43,208 @@ typedef struct {

     size_t key_len;

     unsigned char info[HKDF_MAXBUF];

     size_t info_len;

-} HKDF_PKEY_CTX;

+};

-static int pkey_hkdf_init(EVP_PKEY_CTX *ctx)

+static EVP_KDF_IMPL *kdf_hkdf_new(void)

 {

-    HKDF_PKEY_CTX *kctx;

-

-    if ((kctx = OPENSSL_zalloc(sizeof(*kctx))) == NULL) {

-        KDFerr(KDF_F_PKEY_HKDF_INIT, ERR_R_MALLOC_FAILURE);

-        return 0;

-    }

+    EVP_KDF_IMPL *impl;

-    ctx->data = kctx;

+    if ((impl = OPENSSL_zalloc(sizeof(*impl))) == NULL)

+        KDFerr(KDF_F_KDF_HKDF_NEW, ERR_R_MALLOC_FAILURE);

+    return impl;

+}

-    return 1;

+static void kdf_hkdf_free(EVP_KDF_IMPL *impl)

+{

+    kdf_hkdf_reset(impl);

+    OPENSSL_free(impl);

 }

-static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx)

+static void kdf_hkdf_reset(EVP_KDF_IMPL *impl)

 {

-    HKDF_PKEY_CTX *kctx = ctx->data;

-    OPENSSL_clear_free(kctx->salt, kctx->salt_len);

-    OPENSSL_clear_free(kctx->key, kctx->key_len);

-    OPENSSL_cleanse(kctx->info, kctx->info_len);

-    OPENSSL_free(kctx);

+    OPENSSL_free(impl->salt);

+    OPENSSL_clear_free(impl->key, impl->key_len);

+    OPENSSL_cleanse(impl->info, impl->info_len);

+    memset(impl, 0, sizeof(*impl));

 }

-static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)

+static int kdf_hkdf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)

 {

-    HKDF_PKEY_CTX *kctx = ctx->data;

+    const unsigned char *p;

+    size_t len;

+    const EVP_MD *md;

-    switch (type) {

-    case EVP_PKEY_CTRL_HKDF_MD:

-        if (p2 == NULL)

+    switch (cmd) {

+    case EVP_KDF_CTRL_SET_MD:

+        md = va_arg(args, const EVP_MD *);

+        if (md == NULL)

             return 0;

-        kctx->md = p2;

+        impl->md = md;

         return 1;

-    case EVP_PKEY_CTRL_HKDF_MODE:

-        kctx->mode = p1;

+    case EVP_KDF_CTRL_SET_HKDF_MODE:

+        impl->mode = va_arg(args, int);

         return 1;

-    case EVP_PKEY_CTRL_HKDF_SALT:

-        if (p1 == 0 || p2 == NULL)

+    case EVP_KDF_CTRL_SET_SALT:

+        p = va_arg(args, const unsigned char *);

+        len = va_arg(args, size_t);

+        if (len == 0 || p == NULL)

             return 1;

-        if (p1 < 0)

+        OPENSSL_free(impl->salt);

+        impl->salt = OPENSSL_memdup(p, len);

+        if (impl->salt == NULL)

             return 0;

-        if (kctx->salt != NULL)

-            OPENSSL_clear_free(kctx->salt, kctx->salt_len);

-

-        kctx->salt = OPENSSL_memdup(p2, p1);

-        if (kctx->salt == NULL)

-            return 0;

-

-        kctx->salt_len = p1;

+        impl->salt_len = len;

         return 1;

-    case EVP_PKEY_CTRL_HKDF_KEY:

-        if (p1 < 0)

+    case EVP_KDF_CTRL_SET_KEY:

+        p = va_arg(args, const unsigned char *);

+        len = va_arg(args, size_t);

+        OPENSSL_clear_free(impl->key, impl->key_len);

+        impl->key = OPENSSL_memdup(p, len);

+        if (impl->key == NULL)

             return 0;

-        if (kctx->key != NULL)

-            OPENSSL_clear_free(kctx->key, kctx->key_len);

-

-        kctx->key = OPENSSL_memdup(p2, p1);

-        if (kctx->key == NULL)

-            return 0;

+        impl->key_len  = len;

+        return 1;

-        kctx->key_len  = p1;

+    case EVP_KDF_CTRL_RESET_HKDF_INFO:

+        OPENSSL_cleanse(impl->info, impl->info_len);

+        impl->info_len = 0;

         return 1;

-    case EVP_PKEY_CTRL_HKDF_INFO:

-        if (p1 == 0 || p2 == NULL)

+    case EVP_KDF_CTRL_ADD_HKDF_INFO:

+        p = va_arg(args, const unsigned char *);

+        len = va_arg(args, size_t);

+        if (len == 0 || p == NULL)

             return 1;

-        if (p1 < 0 || p1 > (int)(HKDF_MAXBUF - kctx->info_len))

+        if (len > (HKDF_MAXBUF - impl->info_len))

             return 0;

-        memcpy(kctx->info + kctx->info_len, p2, p1);

-        kctx->info_len += p1;

+        memcpy(impl->info + impl->info_len, p, len);

+        impl->info_len += len;

         return 1;

     default:

         return -2;

-

     }

 }

-static int pkey_hkdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,

-                              const char *value)

+static int kdf_hkdf_ctrl_str(EVP_KDF_IMPL *impl, const char *type,

+                             const char *value)

 {

     if (strcmp(type, "mode") == 0) {

         int mode;

         if (strcmp(value, "EXTRACT_AND_EXPAND") == 0)

-            mode = EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND;

+            mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;

         else if (strcmp(value, "EXTRACT_ONLY") == 0)

-            mode = EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY;

+            mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;

         else if (strcmp(value, "EXPAND_ONLY") == 0)

-            mode = EVP_PKEY_HKDEF_MODE_EXPAND_ONLY;

+            mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;

         else

             return 0;

-        return EVP_PKEY_CTX_hkdf_mode(ctx, mode);

+        return call_ctrl(kdf_hkdf_ctrl, impl, EVP_KDF_CTRL_SET_HKDF_MODE, mode);

     }

-    if (strcmp(type, "md") == 0)

-        return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_DERIVE,

-                               EVP_PKEY_CTRL_HKDF_MD, value);

+    if (strcmp(type, "digest") == 0)

+        return kdf_md2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);

     if (strcmp(type, "salt") == 0)

-        return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_SALT, value);

+        return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_SALT, value);

     if (strcmp(type, "hexsalt") == 0)

-        return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_SALT, value);

+        return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_SALT, value);

     if (strcmp(type, "key") == 0)

-        return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_KEY, value);

+        return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_KEY, value);

     if (strcmp(type, "hexkey") == 0)

-        return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_KEY, value);

+        return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_KEY, value);

     if (strcmp(type, "info") == 0)

-        return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_INFO, value);

+        return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_ADD_HKDF_INFO,

+                            value);

     if (strcmp(type, "hexinfo") == 0)

-        return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_INFO, value);

+        return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_ADD_HKDF_INFO,

+                            value);

-    KDFerr(KDF_F_PKEY_HKDF_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);

     return -2;

 }

-static int pkey_hkdf_derive_init(EVP_PKEY_CTX *ctx)

+static size_t kdf_hkdf_size(EVP_KDF_IMPL *impl)

 {

-    HKDF_PKEY_CTX *kctx = ctx->data;

+    if (impl->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY)

+        return SIZE_MAX;

-    OPENSSL_clear_free(kctx->key, kctx->key_len);

-    OPENSSL_clear_free(kctx->salt, kctx->salt_len);

-    OPENSSL_cleanse(kctx->info, kctx->info_len);

-    memset(kctx, 0, sizeof(*kctx));

-

-    return 1;

+    if (impl->md == NULL) {

+        KDFerr(KDF_F_KDF_HKDF_SIZE, KDF_R_MISSING_MESSAGE_DIGEST);

+        return 0;

+    }

+    return EVP_MD_size(impl->md);

 }

-static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,

-                            size_t *keylen)

+static int kdf_hkdf_derive(EVP_KDF_IMPL *impl, unsigned char *key,

+                           size_t keylen)

 {

-    HKDF_PKEY_CTX *kctx = ctx->data;

-

-    if (kctx->md == NULL) {

-        KDFerr(KDF_F_PKEY_HKDF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);

+    if (impl->md == NULL) {

+        KDFerr(KDF_F_KDF_HKDF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);

         return 0;

     }

-    if (kctx->key == NULL) {

-        KDFerr(KDF_F_PKEY_HKDF_DERIVE, KDF_R_MISSING_KEY);

+    if (impl->key == NULL) {

+        KDFerr(KDF_F_KDF_HKDF_DERIVE, KDF_R_MISSING_KEY);

         return 0;

     }

-    switch (kctx->mode) {

-    case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:

-        return HKDF(kctx->md, kctx->salt, kctx->salt_len, kctx->key,

-                    kctx->key_len, kctx->info, kctx->info_len, key,

-                    *keylen) != NULL;

-

-    case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:

-        if (key == NULL) {

-            *keylen = EVP_MD_size(kctx->md);

-            return 1;

-        }

-        return HKDF_Extract(kctx->md, kctx->salt, kctx->salt_len, kctx->key,

-                            kctx->key_len, key, keylen) != NULL;