tree cbccf40f6f618455bfef822f3ba150cb278fca97
parent 021ec339112553e3211cdeea98d29fd659d455ef
author David Benjamin <davidben@google.com> 1710654003 +1000
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1710992071 +0000

Add some barebones support for DH in EVP

OpenSSH needs this. Features that have been intentionally omitted for
now:

- X9.42-style Diffie-Hellman ("DHX"). We continue not to support this.
  Use ECDH or X25519 instead.

- SPKI and PKCS#8 serialization. Use ECDH or X25519 instead. The format
  is a bit ill-defined. Moreover, until we solve the serialization
  aspects of https://crbug.com/boringssl/497, adding them would put this
  legacy algorithm on path for every caller.

- Most of the random options like stapling a KDF, etc. Though I did add
  EVP_PKEY_CTX_set_dh_pad because it's the only way to undo OpenSSL's
  bug where they chop off leading zeros by default.

- Parameter generation. Diffie-Hellman parameters should not be
  generated at runtime.

This means you need to bootstrap with a DH object and then wrap it in an
EVP_PKEY. This matches the limitations of the EVP API in OpenSSL 1.1.x.
Unfortunately the OpenSSL 3.x APIs are unsuitable for many, many
reasons, so I expect when we get further along in
https://crbug.com/boringssl/535, we'll have established some patterns
here that we can apply to EVP_PKEY_DH too.

Change-Id: I34b4e8799afb266ea5602a70115cc2146f19c6a7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/67207
Reviewed-by: Theo Buehler <theorbuehler@gmail.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>