Move X25519/X448 to the default provider

[mattcaswell]

This doesn't yet implement the required serializers. That will come in a subsequent PR.

[paulidale]

Travis is also relevant.

[slontis]

Looks pretty good apart from a few small NITS.

[romen]

Just cross-mentioning the related issues: #10353 and #10354

[mattcaswell]

Fixup commits pushed addressing the above comments and the travis failure.

Please take another look.

[mattcaswell]

Oh...and also I realised I missed off the s390 support. Now added.

@p-steuer

[slontis]

Where has this file come from?

[p-steuer]

Its generated by s390xcpuid.pl, @mattcaswell probably added it accidentially.

[mattcaswell]

Yes I did. I'll remove it.

[slontis]

It LGTM..
I would prefer if @p-steuer reviewed the s390 bits though.

[mattcaswell]

Fixed the s390xcpuid.S issue. The travis red cross was due to a bad auto-merge with master during the travis build. I've rebased to resolve that issue.

Please take another look.

[p-steuer]

With moving the s390 code to provider, the corresponding run-time feature detection was lost. My tests of the S390X_EC_ASM build pass on z15 but it should SIGILL on any older machine, since ECC instruction set extension is not available there.

Specifically im talking about the following (non provider) code from crypto/ec/ecx_meth.c:

const EVP_PKEY_METHOD *ecx25519_pkey_method(void)
{
#ifdef S390X_EC_ASM
    if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519))
        return &ecx25519_s390x_pkey_meth;
#endif
    return &ecx25519_pkey_meth;
}

const EVP_PKEY_METHOD *ecx448_pkey_method(void)
{
#ifdef S390X_EC_ASM
    if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448))
        return &ecx448_s390x_pkey_meth;
#endif
    return &ecx448_pkey_meth;
}

This could be easily fixed by checking the above conditions inside provider code's S390X_EC_ASM ifdefs (before every operation).

However, since this check is only required one time at init, i would prefer a solution similar to the non-provider code (to also get rid of a lot of ifdefs and to facilitate integration of future platform specific hw support). E.g. replace member pointing to an OPENSSL_DISPATCH object in OPENSSL_ALGORITHM structure by a member pointing to a function returning such objects. That way, you could define both a platform-spefific and a generic OPENSSL_DISPATCH array, and said function could chose which one to return, based on the hw capabilities detected on init (analogous to what i did to the standard_methods array here: 19bd1fa).

[mattcaswell]

This could be easily fixed by checking the above conditions inside provider code's S390X_EC_ASM ifdefs (before every operation).

Fixed. I have gone with this simple solution for now. I did look at an option for a one time capability check. We actually have a mechanism for that for ciphers. See:

openssl/providers/defltprov.c

Lines 190 to 197 in 7fa8bcf

	ALGC("AES-128-CBC-HMAC-SHA1", aes128cbc_hmac_sha1_functions,
	cipher_capable_aes_cbc_hmac_sha1),
	ALGC("AES-256-CBC-HMAC-SHA1", aes256cbc_hmac_sha1_functions,
	cipher_capable_aes_cbc_hmac_sha1),
	ALGC("AES-128-CBC-HMAC-SHA256", aes128cbc_hmac_sha256_functions,
	cipher_capable_aes_cbc_hmac_sha256),
	ALGC("AES-256-CBC-HMAC-SHA256", aes256cbc_hmac_sha256_functions,
	cipher_capable_aes_cbc_hmac_sha256),

It would not take much to extend that to key exchange. However in this case I think the benefit is very minimal at the cost of quite a lot of extra plumbing. I'm not actually sure you would gain anything very much.

[p-steuer]

S390X_SCALAR_MULTIPLY_X448 -> S390X_SCALAR_MULTIPLY_X25519

[mattcaswell]

Oops. Fixed.

[slontis]

needs a rebase

[slontis]

@mattcaswell

[mattcaswell]

needs a rebase

Sigh. Needs a bit more work due to the all the keymgmt changes in master.

[mattcaswell]

I rebased this and reworked it to take account of the refactored keymgmt in master.

Please take another look and reconfirm?

[mattcaswell]

Fixups pushed addressing both of those issues.

[p-steuer]

Looks good to me now.

[openssl-machine]

This pull request is ready to merge

[mattcaswell]

Pushed. Thanks.