grpc 1.84.0.pre1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/evp/evp_ctx.cc

@@ -19,292 +19,318 @@
 #include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
+#include <openssl/params.h>
 
 #include "../internal.h"
+#include "../mem_internal.h"
+#include "../params_internal.h"
 #include "internal.h"
 
 
-static const EVP_PKEY_METHOD *const evp_methods[] = {
-    &rsa_pkey_meth,    &ec_pkey_meth,   &ed25519_pkey_meth,
-    &x25519_pkey_meth, &hkdf_pkey_meth,
-};
+using namespace bssl;
 
-static const EVP_PKEY_METHOD *evp_pkey_meth_find(int type) {
-  for (size_t i = 0; i < sizeof(evp_methods) / sizeof(EVP_PKEY_METHOD *); i++) {
-    if (evp_methods[i]->pkey_id == type) {
-      return evp_methods[i];
-    }
-  }
-
-  return NULL;
-}
-
-static EVP_PKEY_CTX *evp_pkey_ctx_new(EVP_PKEY *pkey, ENGINE *e,
-                                      const EVP_PKEY_METHOD *pmeth) {
-  EVP_PKEY_CTX *ret =
-      reinterpret_cast<EVP_PKEY_CTX *>(OPENSSL_zalloc(sizeof(EVP_PKEY_CTX)));
+static UniquePtr<EvpPkeyCtx> evp_pkey_ctx_new(
+    EvpPkey *pkey, const EVP_PKEY_ALG *alg, const EVP_PKEY_CTX_METHOD *pmeth) {
+  assert(pkey != nullptr || alg != nullptr);
+  UniquePtr<EvpPkeyCtx> ret = MakeUnique<EvpPkeyCtx>();
   if (!ret) {
-    return NULL;
+    return nullptr;
   }
 
-  ret->engine = e;
   ret->pmeth = pmeth;
   ret->operation = EVP_PKEY_OP_UNDEFINED;
+  ret->pkey = UpRef(pkey);
 
-  if (pkey) {
-    EVP_PKEY_up_ref(pkey);
-    ret->pkey = pkey;
-  }
-
-  if (pmeth->init) {
-    if (pmeth->init(ret) <= 0) {
-      EVP_PKEY_free(ret->pkey);
-      OPENSSL_free(ret);
-      return NULL;
-    }
+  if (pmeth->init && pmeth->init(ret.get(), alg) <= 0) {
+    ret->pmeth = nullptr;  // Don't call `pmeth->cleanup`.
+    return nullptr;
   }
 
   return ret;
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e) {
-  if (pkey == NULL || pkey->ameth == NULL) {
+  auto *pkey_impl = FromOpaque(pkey);
+  if (pkey_impl == nullptr || pkey_impl->ameth == nullptr) {
     OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return nullptr;
+  }
+  if (pkey_impl->pkey == nullptr) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
+    return nullptr;
   }
 
-  const EVP_PKEY_METHOD *pkey_method = pkey->ameth->pkey_method;
-  if (pkey_method == NULL) {
+  const EVP_PKEY_CTX_METHOD *pkey_method = pkey_impl->ameth->pkey_method;
+  if (pkey_method == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
-    ERR_add_error_dataf("algorithm %d", pkey->ameth->pkey_id);
-    return NULL;
+    ERR_add_error_dataf("algorithm %d", pkey_impl->ameth->pkey_id);
+    return nullptr;
   }
 
-  return evp_pkey_ctx_new(pkey, e, pkey_method);
+  return evp_pkey_ctx_new(pkey_impl, nullptr, pkey_method).release();
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e) {
-  const EVP_PKEY_METHOD *pkey_method = evp_pkey_meth_find(id);
-  if (pkey_method == NULL) {
+  // `EVP_PKEY_RSA_PSS` is intentionally omitted from this list. These are types
+  // that can be created without an `EVP_PKEY`, and we do not support
+  // `EVP_PKEY_RSA_PSS` keygen.
+  const EVP_PKEY_ALG *alg = nullptr;
+  switch (id) {
+    case EVP_PKEY_RSA:
+      alg = EVP_pkey_rsa();
+      break;
+    case EVP_PKEY_EC:
+      alg = evp_pkey_ec_no_curve();
+      break;
+    case EVP_PKEY_ED25519:
+      alg = EVP_pkey_ed25519();
+      break;
+    case EVP_PKEY_X25519:
+      alg = EVP_pkey_x25519();
+      break;
+    case EVP_PKEY_HKDF:
+      alg = evp_pkey_hkdf();
+      break;
+    case EVP_PKEY_ML_DSA_44:
+      alg = EVP_pkey_ml_dsa_44();
+      break;
+    case EVP_PKEY_ML_DSA_65:
+      alg = EVP_pkey_ml_dsa_65();
+      break;
+    case EVP_PKEY_ML_DSA_87:
+      alg = EVP_pkey_ml_dsa_87();
+      break;
+    case EVP_PKEY_ML_KEM_768:
+      alg = EVP_pkey_ml_kem_768();
+      break;
+    case EVP_PKEY_ML_KEM_1024:
+      alg = EVP_pkey_ml_kem_1024();
+      break;
+  }
+  if (alg == nullptr || alg->pkey_method == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
     ERR_add_error_dataf("algorithm %d", id);
-    return NULL;
+    return nullptr;
   }
+  return evp_pkey_ctx_new_alg(alg).release();
+}
 
-  return evp_pkey_ctx_new(NULL, e, pkey_method);
+UniquePtr<EvpPkeyCtx> bssl::evp_pkey_ctx_new_alg(const EVP_PKEY_ALG *alg) {
+  return evp_pkey_ctx_new(nullptr, alg, alg->pkey_method);
 }
 
-void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx) {
-  if (ctx == NULL) {
-    return;
-  }
-  if (ctx->pmeth && ctx->pmeth->cleanup) {
-    ctx->pmeth->cleanup(ctx);
+EvpPkeyCtx::~EvpPkeyCtx() {
+  if (pmeth && pmeth->cleanup) {
+    pmeth->cleanup(this);
   }
-  EVP_PKEY_free(ctx->pkey);
-  EVP_PKEY_free(ctx->peerkey);
-  OPENSSL_free(ctx);
 }
 
-EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx) {
-  if (!ctx->pmeth || !ctx->pmeth->copy) {
-    return NULL;
-  }
+void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx) { Delete(FromOpaque(ctx)); }
 
-  EVP_PKEY_CTX *ret =
-      reinterpret_cast<EVP_PKEY_CTX *>(OPENSSL_zalloc(sizeof(EVP_PKEY_CTX)));
-  if (!ret) {
-    return NULL;
-  }
-
-  ret->pmeth = ctx->pmeth;
-  ret->engine = ctx->engine;
-  ret->operation = ctx->operation;
+EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx) {
+  auto *impl = FromOpaque(ctx);
 
-  if (ctx->pkey != NULL) {
-    EVP_PKEY_up_ref(ctx->pkey);
-    ret->pkey = ctx->pkey;
+  if (!impl->pmeth || !impl->pmeth->copy) {
+    return nullptr;
   }
 
-  if (ctx->peerkey != NULL) {
-    EVP_PKEY_up_ref(ctx->peerkey);
-    ret->peerkey = ctx->peerkey;
+  UniquePtr<EvpPkeyCtx> ret = MakeUnique<EvpPkeyCtx>();
+  if (!ret) {
+    return nullptr;
   }
 
-  if (ctx->pmeth->copy(ret, ctx) <= 0) {
-    ret->pmeth = NULL;
-    EVP_PKEY_CTX_free(ret);
+  ret->pmeth = impl->pmeth;
+  ret->operation = impl->operation;
+  ret->pkey = UpRef(impl->pkey);
+  ret->peerkey = UpRef(impl->peerkey);
+  if (impl->pmeth->copy(ret.get(), impl) <= 0) {
     OPENSSL_PUT_ERROR(EVP, ERR_LIB_EVP);
-    return NULL;
+    return nullptr;
   }
 
-  return ret;
+  return ret.release();
 }
 
-EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx) { return ctx->pkey; }
+EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx) {
+  auto *impl = FromOpaque(ctx);
+  return impl->pkey.get();
+}
 
-int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd,
-                      int p1, void *p2) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->ctrl) {
+int bssl::EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd,
+                            int p1, void *p2) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->ctrl) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
     return 0;
   }
-  if (keytype != -1 && ctx->pmeth->pkey_id != keytype) {
+  if (keytype != -1 && impl->pmeth->pkey_id != keytype) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
 
-  if (ctx->operation == EVP_PKEY_OP_UNDEFINED) {
+  if (impl->operation == EVP_PKEY_OP_UNDEFINED) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_OPERATION_SET);
     return 0;
   }
 
-  if (optype != -1 && !(ctx->operation & optype)) {
+  if (optype != -1 && !(impl->operation & optype)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_OPERATION);
     return 0;
   }
 
-  return ctx->pmeth->ctrl(ctx, cmd, p1, p2);
+  return impl->pmeth->ctrl(impl, cmd, p1, p2);
 }
 
 int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx) {
-  if (ctx == NULL || ctx->pmeth == NULL ||
-      (ctx->pmeth->sign == NULL && ctx->pmeth->sign_message == NULL)) {
+  auto *impl = FromOpaque(ctx);
+  if (!ctx || impl->pmeth == nullptr ||
+      (impl->pmeth->sign == nullptr && impl->pmeth->sign_message == nullptr)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
 
-  ctx->operation = EVP_PKEY_OP_SIGN;
+  impl->operation = EVP_PKEY_OP_SIGN;
   return 1;
 }
 
 int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *sig_len,
                   const uint8_t *digest, size_t digest_len) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->sign) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->sign) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_SIGN) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_SIGN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->sign(ctx, sig, sig_len, digest, digest_len);
+  return impl->pmeth->sign(impl, sig, sig_len, digest, digest_len);
 }
 
 int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx) {
-  if (ctx == NULL || ctx->pmeth == NULL ||
-      (ctx->pmeth->verify == NULL && ctx->pmeth->verify_message == NULL)) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || impl->pmeth == nullptr ||
+      (impl->pmeth->verify == nullptr &&
+       impl->pmeth->verify_message == nullptr)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_VERIFY;
+  impl->operation = EVP_PKEY_OP_VERIFY;
   return 1;
 }
 
 int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t sig_len,
                     const uint8_t *digest, size_t digest_len) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->verify) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->verify) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_VERIFY) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_VERIFY) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->verify(ctx, sig, sig_len, digest, digest_len);
+  return impl->pmeth->verify(impl, sig, sig_len, digest, digest_len);
 }
 
 int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->encrypt) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->encrypt) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_ENCRYPT;
+  impl->operation = EVP_PKEY_OP_ENCRYPT;
   return 1;
 }
 
 int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *outlen,
                      const uint8_t *in, size_t inlen) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->encrypt) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->encrypt) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_ENCRYPT) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_ENCRYPT) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->encrypt(ctx, out, outlen, in, inlen);
+  return impl->pmeth->encrypt(impl, out, outlen, in, inlen);
 }
 
 int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->decrypt) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->decrypt) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_DECRYPT;
+  impl->operation = EVP_PKEY_OP_DECRYPT;
   return 1;
 }
 
 int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *outlen,
                      const uint8_t *in, size_t inlen) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->decrypt) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->decrypt) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_DECRYPT) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_DECRYPT) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->decrypt(ctx, out, outlen, in, inlen);
+  return impl->pmeth->decrypt(impl, out, outlen, in, inlen);
 }
 
 int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->verify_recover) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->verify_recover) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_VERIFYRECOVER;
+  impl->operation = EVP_PKEY_OP_VERIFYRECOVER;
   return 1;
 }
 
 int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len,
                             const uint8_t *sig, size_t sig_len) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->verify_recover) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->verify_recover) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_VERIFYRECOVER) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_VERIFYRECOVER) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->verify_recover(ctx, out, out_len, sig, sig_len);
+  return impl->pmeth->verify_recover(impl, out, out_len, sig, sig_len);
 }
 
 int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->derive) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->derive) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_DERIVE;
+  impl->operation = EVP_PKEY_OP_DERIVE;
   return 1;
 }
 
 int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer) {
-  int ret;
-  if (!ctx || !ctx->pmeth ||
-      !(ctx->pmeth->derive || ctx->pmeth->encrypt || ctx->pmeth->decrypt) ||
-      !ctx->pmeth->ctrl) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth ||
+      !(impl->pmeth->derive || impl->pmeth->encrypt || impl->pmeth->decrypt) ||
+      !impl->pmeth->ctrl) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_DERIVE &&
-      ctx->operation != EVP_PKEY_OP_ENCRYPT &&
-      ctx->operation != EVP_PKEY_OP_DECRYPT) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_DERIVE &&
+      impl->operation != EVP_PKEY_OP_ENCRYPT &&
+      impl->operation != EVP_PKEY_OP_DECRYPT) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
 
-  ret = ctx->pmeth->ctrl(ctx, EVP_PKEY_CTRL_PEER_KEY, 0, peer);
+  int ret = impl->pmeth->ctrl(impl, EVP_PKEY_CTRL_PEER_KEY, 0, peer);
 
   if (ret <= 0) {
     return 0;
@@ -314,69 +340,74 @@ int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer) {
     return 1;
   }
 
-  if (!ctx->pkey) {
+  if (!impl->pkey || !FromOpaque(peer)->pkey) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
     return 0;
   }
 
-  if (ctx->pkey->type != peer->type) {
+  if (EVP_PKEY_id(impl->pkey.get()) != EVP_PKEY_id(peer)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DIFFERENT_KEY_TYPES);
     return 0;
   }
 
-  // ran@cryptocom.ru: For clarity.  The error is if parameters in peer are
-  // present (!missing) but don't match.  EVP_PKEY_cmp_parameters may return
-  // 1 (match), 0 (don't match) and -2 (comparison is not defined).  -1
-  // (different key types) is impossible here because it is checked earlier.
-  // -2 is OK for us here, as well as 1, so we can check for 0 only.
   if (!EVP_PKEY_missing_parameters(peer) &&
-      !EVP_PKEY_cmp_parameters(ctx->pkey, peer)) {
+      !EVP_PKEY_parameters_eq(impl->pkey.get(), peer)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DIFFERENT_PARAMETERS);
     return 0;
   }
 
-  EVP_PKEY_free(ctx->peerkey);
-  ctx->peerkey = peer;
-
-  ret = ctx->pmeth->ctrl(ctx, EVP_PKEY_CTRL_PEER_KEY, 1, peer);
-
+  impl->peerkey = UpRef(FromOpaque(peer));
+  ret = impl->pmeth->ctrl(impl, EVP_PKEY_CTRL_PEER_KEY, 1, peer);
   if (ret <= 0) {
-    ctx->peerkey = NULL;
+    impl->peerkey = nullptr;
     return 0;
   }
 
-  EVP_PKEY_up_ref(peer);
   return 1;
 }
 
 int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, uint8_t *key, size_t *out_key_len) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->derive) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->derive) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_DERIVE) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_DERIVE) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
-  return ctx->pmeth->derive(ctx, key, out_key_len);
+  return impl->pmeth->derive(impl, key, out_key_len);
+}
+
+EVP_PKEY *EVP_PKEY_generate_from_alg(const EVP_PKEY_ALG *alg) {
+  UniquePtr<EvpPkeyCtx> ctx = evp_pkey_ctx_new_alg(alg);
+  EVP_PKEY *pkey = nullptr;
+  if (ctx == nullptr ||                    //
+      !EVP_PKEY_keygen_init(ctx.get()) ||  //
+      !EVP_PKEY_keygen(ctx.get(), &pkey)) {
+    return nullptr;
+  }
+  return pkey;
 }
 
 int EVP_PKEY_keygen_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->keygen) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->keygen) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_KEYGEN;
+  impl->operation = EVP_PKEY_OP_KEYGEN;
   return 1;
 }
 
 int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **out_pkey) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->keygen) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->keygen) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_KEYGEN) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_KEYGEN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
 
@@ -392,30 +423,32 @@ int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **out_pkey) {
     }
   }
 
-  if (!ctx->pmeth->keygen(ctx, *out_pkey)) {
+  if (!impl->pmeth->keygen(impl, FromOpaque(*out_pkey))) {
     EVP_PKEY_free(*out_pkey);
-    *out_pkey = NULL;
+    *out_pkey = nullptr;
     return 0;
   }
   return 1;
 }
 
 int EVP_PKEY_paramgen_init(EVP_PKEY_CTX *ctx) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->paramgen) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->paramgen) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  ctx->operation = EVP_PKEY_OP_PARAMGEN;
+  impl->operation = EVP_PKEY_OP_PARAMGEN;
   return 1;
 }
 
 int EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **out_pkey) {
-  if (!ctx || !ctx->pmeth || !ctx->pmeth->paramgen) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->paramgen) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
   }
-  if (ctx->operation != EVP_PKEY_OP_PARAMGEN) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED);
+  if (impl->operation != EVP_PKEY_OP_PARAMGEN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
     return 0;
   }
 
@@ -431,10 +464,78 @@ int EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **out_pkey) {
     }
   }
 
-  if (!ctx->pmeth->paramgen(ctx, *out_pkey)) {
+  if (!impl->pmeth->paramgen(impl, FromOpaque(*out_pkey))) {
     EVP_PKEY_free(*out_pkey);
-    *out_pkey = NULL;
+    *out_pkey = nullptr;
+    return 0;
+  }
+  return 1;
+}
+
+int EVP_PKEY_encapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params) {
+  if (params != nullptr && !IsEndParam(*params)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PARAMETERS);
     return 0;
   }
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->encap) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+    return 0;
+  }
+  impl->operation = EVP_PKEY_OP_ENCAPSULATE;
   return 1;
 }
+
+int EVP_PKEY_encapsulate(EVP_PKEY_CTX *ctx, uint8_t *out_ciphertext,
+                         size_t *out_ciphertext_len, uint8_t *out_secret,
+                         size_t *out_secret_len) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->encap) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+    return 0;
+  }
+  if (impl->operation != EVP_PKEY_OP_ENCAPSULATE) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
+    return 0;
+  }
+  if (!impl->pkey) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
+    return 0;
+  }
+  return impl->pmeth->encap(impl, out_ciphertext, out_ciphertext_len,
+                            out_secret, out_secret_len);
+}
+
+int EVP_PKEY_decapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM *params) {
+  if (params != nullptr && !IsEndParam(*params)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PARAMETERS);
+    return 0;
+  }
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->decap) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+    return 0;
+  }
+  impl->operation = EVP_PKEY_OP_DECAPSULATE;
+  return 1;
+}
+
+int EVP_PKEY_decapsulate(EVP_PKEY_CTX *ctx, uint8_t *out_secret,
+                         size_t *out_secret_len, const uint8_t *ciphertext,
+                         size_t ciphertext_len) {
+  auto *impl = FromOpaque(ctx);
+  if (!impl || !impl->pmeth || !impl->pmeth->decap) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+    return 0;
+  }
+  if (impl->operation != EVP_PKEY_OP_DECAPSULATE) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_INITIALIZED);
+    return 0;
+  }
+  if (!impl->pkey) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
+    return 0;
+  }
+  return impl->pmeth->decap(impl, out_secret, out_secret_len, ciphertext,
+                            ciphertext_len);
+}