openssl: Provider fetch not working as expected

I have a problem with fetching algorithms from a provider. Either this is a bug, or my expectation is wrong 😃

I have implemented my own provider, lets call it “myprov”. That provider implements some algorithms, but not all of them. I.e. it implements the KEYMGMT for RSA, RSA-PSS and EC, as well as the ASYM-CIPHER für RSA, and SIGNATURE for RSA, RSA-PSS, and EC. It uses "provider=myprov" as property for all the algorithms it implements.

In an application I create new library context via OSSL_LIB_CTX_new(), load my provider "myprov" with that context, and also load the default provider into the same context. I then set that library context as default via OSSL_LIB_CTX_set0_default(). Furthermore, I set the default properties for that library context via EVP_set_default_properties() to "?provider=myprov" (myprov is optional but preferred).

The intention is that it fetches the algorithms from my provider, if it implements it, but falls back to the default provider for all the other algorithms. This is for implicit fetches, where no specific property query is specified (i.e. property query is NULL), or an older function from before provider support is used.

The application the generates a PKEY context to generate an RSA key via EVP_PKEY_CTX_new_id(EVP_PKEY_RSA) or EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL) followed by EVP_PKEY_keygen_init() and EVP_PKEY_gen(). I would expect that it fetches my provider for that, since it implements RSA (and the KEYMGMT key gen functions). However, it is fetching the default provider.

If I use EVP_PKEY_CTX_new_from_name(NULL, "RSA", "provider=myprov"), then it fetches mine, but I would have expected that it also fetches mine because of the default properties being “?provider=myprov”.

Is what I am trying to do supposed to work that way? Or how else can a provider implement only some algorithms, with a fallback to the default provider?

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 23 (23 by maintainers)

Commits related to this issue

Most upvoted comments

I have cherrypicked the commit(s) from the PR and I can confirm that it fixes the problem. Thanks a lot for the very quick turn around!

In other words, we simply cannot pre-parse the default properties, that will have to be done when it’s time to use them, i.e. late. That will have to be done every time, 'cause the next query for an OSSL_ALGORITHM array may come with new property values, unseen until that point.

In view of that, I wonder of “contamination” isn’t preferable after all…