Blake2b: Use OSSL_DIGEST_PARAM_SIZE as settable instead of XOFLEN

[t8m]

BLAKE2 is not really an extensible output function unlike SHAKE as the digest size must be set during the context initialization. Thus it makes no sense to use OSSL_DIGEST_PARAM_XOFLEN.

We also need to adjust EVP_DigestFinal_ex() to query the OSSL_DIGEST_PARAM_SIZE as gettable ctx param for the size.

Fixes #22488

Checklist

• documentation is added or updated
• tests are added or updated

[t8m]

This is an alternative to #22489

[t8m]

In the end I like this more. Although it breaks the invariant that EVP_DigestFinal_ex() does not write more than EVP_MAX_MD_SIZE, it does so only on explicit param setting so IMO not a big deal.

[t-j-h]

I like it. Someone else needs to indicate being comfortable with this change.

[mattcaswell]

This option is clearly preferably to #22489 IMO. One minor comment below.

[t8m]

@t-j-h please reconfirm

[mattcaswell]

Approved assuming CIs pass

[mattcaswell]

Needs a second approval asap to get this in the beta

[levitte]

I'm glad it was this easy after all

[paulidale]

Great work

[t-j-h]

Approved again.

[slontis]

Looks good to me..

As an aside, I am not sure but I think EVP_MD_get_size() probably doesnt work.. since evp_md_cache_constants() probably happens earlier than when a call to the set_ctx_params

[levitte]

As an aside, I am not sure but I think EVP_MD_get_size() probably doesnt work.. since evp_md_cache_constants() probably happens earlier than when a call to the set_ctx_params

There's a conceptual difference between EVP_TYPE_get_whatever() (which returns the default whatever) and EVP_TYPE_CTX_get_whatever() (which returns the actual whatever, which may be something other than the default whatever).

[paulidale]

It might need to invalidate the size cache in EVP_MD_CTX_set_params().
Worse, the cached size comes from the MD not the MD_CTX.
We might need to update evp_md_cache_constants() to query the context and if that fails to follow with the digest.
This, in turn, might require updates to crypto/evp/evp_utils.c.

Actually, it's nowhere near that bad because Blake2b already doesn't support any of this and this PR is doing the right thing by attempting to query the context in the final to get the correct size.

All it means is that EVP_MD_get_size() could return the wrong value for Blake2b if the size has been set to a non-default value. Without this change it will still do this because it's using xoflen and not updating the size at all.

Definitely not stopping this going into beta IMO.

[t8m]

EVP_MD_get_size() must return the default size. There is no way around that.

However there is a problem with EVP_MD_CTX_get_size() - that function is actually a macro EVP_MD_get_size(EVP_MD_CTX_get0_md(e)). But changing a macro definition or even changing a macro to a function would be an API break. This is IMO something to resolve later. We will probably need to add a completely new function call. But that can be done in 3.3.

[mattcaswell]

Pushed.