Refactor raw public key handling and legacy EVP_PKEY methods

.gitignore

@@ -95,6 +95,7 @@ tests/rsa-keygen
 tests/ec-keygen
 tests/ec-derive
 tests/ec-derive-prov
+tests/ed25519-software-key
 tests/ed25519-keygen
 tests/ed448-keygen
 tests/ed25519-keygen-prov

src/Makefile.am

@@ -62,9 +62,9 @@ libeng_err_la_CFLAGS = $(AM_CFLAGS) $(OPENSSL_EXTRA_CFLAGS) $(OPENSSL_CFLAGS) \
 # because it is compiled as part of libp11_err.la (above).
 # ----------------------------------------------------------
 libp11_la_SOURCES = libpkcs11.c p11_attr.c p11_cert.c p11_ckr.c \
-	p11_key.c p11_load.c p11_misc.c p11_rsa.c p11_ec.c p11_eddsa.c \
-	p11_mldsa.c p11_slhdsa.c p11_falcon.c \
-	p11_pkey.c p11_slot.c p11_front.c p11_atfork.c libp11.exports
+	p11_key.c p11_load.c p11_misc.c p11_rsa.c p11_ec.c p11_rawkey.c \
+	p11_pkey.c p11_slot.c p11_front.c p11_atfork.c \
+	libp11.exports
 
 # Compiler flags for libp11
 libp11_la_CFLAGS = $(AM_CFLAGS) $(OPENSSL_CFLAGS)

src/Makefile.mak

@@ -4,8 +4,8 @@ TOPDIR = ..
 
 LIBP11_OBJECTS = libpkcs11.obj p11_attr.obj p11_cert.obj \
 	p11_err.obj p11_ckr.obj p11_key.obj p11_load.obj p11_misc.obj \
-	p11_rsa.obj p11_ec.obj p11_pkey.obj p11_slot.obj p11_front.obj \
-	p11_atfork.obj p11_eddsa.obj p11_mldsa.obj p11_slhdsa.obj p11_falcon.obj
+	p11_rsa.obj p11_ec.obj p11_rawkey.obj p11_pkey.obj \
+	p11_slot.obj p11_front.obj p11_atfork.obj
 LIBP11_LIB = libp11.lib
 LIBP11_TARGET = libp11.dll
 

src/libp11-int.h

@@ -1,6 +1,6 @@
 /* libp11, a simple layer on top of PKCS#11 API
  * Copyright (C) 2005 Olaf Kirch <okir@lst.de>
- * Copyright (C) 2015-2025 Michał Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 2015-2026 Michał Trojnara <Michal.Trojnara@stunnel.org>
  * Copyright © 2025-2026 Mobi - Com Polska Sp. z o.o.
  *
  *  This library is free software; you can redistribute it and/or
@@ -587,20 +587,6 @@ extern PKCS11_OBJECT_private *pkcs11_get_ex_data_ec(const EC_KEY *ec);
 extern void pkcs11_set_ex_data_ec(EC_KEY *ec, PKCS11_OBJECT_private *key);
 #endif /* OPENSSL_NO_EC */
 
-# if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
-/* Set PKCS11_OBJECT_private for an EVP_PKEY */
-extern void pkcs11_set_ex_data_pkey(EVP_PKEY *pkey, PKCS11_OBJECT_private *key);
-
-/* Retrieve PKCS11_OBJECT_private from an EVP_PKEY */
-extern PKCS11_OBJECT_private *pkcs11_get_ex_data_pkey(const EVP_PKEY *pkey);
-
-/* Allocate a global EVP_PKEY ex_data index */
-extern void alloc_pkey_ex_index(void);
-
-/* Free the allocated EVP_PKEY ex_data index. */
-extern void free_pkey_ex_index(void);
-# endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
-
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 /* Free the allocated EVP_PKEY ex_data index. */
 extern void free_evp_pkey_ex_index(void);
@@ -624,14 +610,6 @@ extern void pkcs11_ecdsa_method_free(void);
 /* Free the global ECDH_METHOD */
 extern void pkcs11_ecdh_method_free(void);
 
-#if !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L
-/* Free the global ED25519/ED448 EVP_PKEY_METHOD */
-extern void pkcs11_ed_key_method_free(void);
-
-/* Free the global X25519/X448 EVP_PKEY_METHOD */
-extern void pkcs11_xdh_key_method_free(void);
-#endif /* !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L */
-
 #if OPENSSL_VERSION_NUMBER < 0x100020d0L || defined(LIBRESSL_VERSION_NUMBER)
 /* Get sign_init and sign callbacks from EVP_PKEY_METHOD */
 extern void EVP_PKEY_meth_get_sign(EVP_PKEY_METHOD *pmeth,
@@ -641,11 +619,6 @@ extern void EVP_PKEY_meth_get_sign(EVP_PKEY_METHOD *pmeth,
 			const unsigned char *tbs, size_t tbslen));
 #endif /* OPENSSL_VERSION_NUMBER < 0x100020d0L || defined(LIBRESSL_VERSION_NUMBER) */
 
-#if OPENSSL_VERSION_NUMBER < 0x40000000L
-/* Attempt to sign using the PKCS#11-backed RSA implementation */
-extern EVP_PKEY_METHOD *pkcs11_pkey_method_rsa(void);
-#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
-
 #endif /* _LIBP11_INT_H */
 
 /* vim: set noexpandtab: */

src/p11_ec.c

@@ -387,11 +387,10 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(PKCS11_OBJECT_private *key)
 	ec = pkcs11_get_ec(key);
 	if (!ec)
 		return NULL;
+
 	pk = EVP_PKEY_new();
-	if (!pk) {
-		EC_KEY_free(ec);
-		return NULL;
-	}
+	if (!pk)
+		goto error;
 
 	if (key->object_class == CKO_PRIVATE_KEY) {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
@@ -400,17 +399,25 @@ static EVP_PKEY *pkcs11_get_evp_key_ec(PKCS11_OBJECT_private *key)
 		ECDSA_set_method(ec, PKCS11_get_ecdsa_method());
 		ECDH_set_method(ec, PKCS11_get_ecdh_method());
 #endif
-		/* This creates a new EC_KEY object which requires its own key object reference */
+		/* Keep the PKCS11_OBJECT_private alive while referenced from EC ex_data.
+		 * With EC_KEY_METHOD, pkcs11_ec_finish() releases this reference;
+		 * legacy ECDSA/ECDH methods have no equivalent finish hook. */
 		key = pkcs11_object_ref(key);
 		pkcs11_set_ex_data_ec(ec, key);
 	}
 	/* TODO: Retrieve the ECDSA private key object attributes instead,
 	 * unless the key has the "sensitive" attribute set */
 
-	EVP_PKEY_set1_EC_KEY(pk, ec); /* Also increments the ec ref count */
-	EC_KEY_free(ec); /* Drops our reference to it */
+	if (EVP_PKEY_set1_EC_KEY(pk, ec) != 1) /* Also increments the ec ref count */
+		goto error;
 
+	EC_KEY_free(ec); /* Drops our reference to it */
 	return pk;
+
+error:
+	EVP_PKEY_free(pk);
+	EC_KEY_free(ec);
+	return NULL;
 }
 
 /********** ECDSA signing */