EVP: deprecate the EVP_X_meth_ functions.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11082)

19 files changed, 469 insertions, 430 deletions

diff --git a/apps/genpkey.c b/apps/genpkey.c
index 17fb42eba6..389f0e620c 100644
--- a/apps/genpkey.c
+++ b/apps/genpkey.c
@@ -280,7 +280,7 @@ int init_gen_str(EVP_PKEY_CTX **pctx,
 
     ameth = EVP_PKEY_asn1_find_str(&tmpeng, algname, -1);
 
-#ifndef OPENSSL_NO_ENGINE
+#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     if (!ameth && e)
         ameth = ENGINE_get_pkey_asn1_meth_str(e, algname, -1);
 #endif
@@ -293,7 +293,7 @@ int init_gen_str(EVP_PKEY_CTX **pctx,
     ERR_clear_error();
 
     EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
-#ifndef OPENSSL_NO_ENGINE
+#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     ENGINE_finish(tmpeng);
 #endif
     ctx = EVP_PKEY_CTX_new_id(pkey_id, e);
diff --git a/apps/list.c b/apps/list.c
index f0ea7dc6ae..b58871b1c5 100644
--- a/apps/list.c
+++ b/apps/list.c
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
+/* We need to use some deprecated APIs */
 #define OPENSSL_SUPPRESS_DEPRECATED
 
 #include <string.h>
@@ -509,6 +509,7 @@ static void list_pkey(void)
     }
 }
 
+#ifndef OPENSSL_NO_DEPRECATED_3_0
 static void list_pkey_meth(void)
 {
     size_t i;
@@ -524,6 +525,7 @@ static void list_pkey_meth(void)
                    pkey_flags & ASN1_PKEY_DYNAMIC ?  "External" : "Builtin");
     }
 }
+#endif
 
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 static void list_engines(void)
@@ -727,9 +729,9 @@ const OPTIONS list_options[] = {
      "List of cipher algorithms"},
     {"public-key-algorithms", OPT_PK_ALGORITHMS, '-',
      "List of public key algorithms"},
+#ifndef OPENSSL_NO_DEPRECATED_3_0
     {"public-key-methods", OPT_PK_METHOD, '-',
      "List of public key methods"},
-#ifndef OPENSSL_NO_DEPRECATED_3_0
     {"engines", OPT_ENGINES, '-',
      "List of loaded engines"},
 #endif
@@ -867,9 +869,9 @@ opthelp:
         list_ciphers();
     if (todo.pk_algorithms)
         list_pkey();
+#ifndef OPENSSL_NO_DEPRECATED_3_0
     if (todo.pk_method)
         list_pkey_meth();
-#ifndef OPENSSL_NO_DEPRECATED_3_0
     if (todo.engines)
         list_engines();
 #endif
diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c
index a2149ce002..30d38b5fd6 100644
--- a/crypto/cms/cms_kari.c
+++ b/crypto/cms/cms_kari.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * Low level key APIs (DH etc) are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include "internal/cryptlib.h"
 #include <openssl/asn1t.h>
 #include <openssl/pem.h>
@@ -429,6 +435,7 @@ static int cms_wrap_init(CMS_KeyAgreeRecipientInfo *kari,
         return 0;
     keylen = EVP_CIPHER_key_length(cipher);
     if ((EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_GET_WRAP_CIPHER) != 0) {
+        /* TODO: make this not get a method we can call directly */
         ret = EVP_CIPHER_meth_get_ctrl(cipher)(NULL, EVP_CTRL_GET_WRAP_CIPHER,
                                                0, &kekcipher);
         if (ret <= 0)
diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c
index 32e6f4e19f..2374af8ae9 100644
--- a/crypto/engine/eng_openssl.c
+++ b/crypto/engine/eng_openssl.c
@@ -12,8 +12,8 @@
 #define OPENSSL_SUPPRESS_DEPRECATED
 
 /*
- * RC4 and SHA-1 low level APIs are deprecated for public use, but still ok
- * for internal use.
+ * RC4 and SHA-1 low level APIs and EVP _meth_ APISs are deprecated for public
+ * use, but still ok for internal use.
  */
 #include "internal/deprecated.h"
 
diff --git a/crypto/engine/tb_pkmeth.c b/crypto/engine/tb_pkmeth.c
index 65ae42d33b..267640ae9b 100644
--- a/crypto/engine/tb_pkmeth.c
+++ b/crypto/engine/tb_pkmeth.c
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
+/* We need to use some  deprecated APIs */
+#include "internal/deprecated.h"
 
 #include "eng_local.h"
 #include <openssl/evp.h>
diff --git a/crypto/evp/cmeth_lib.c b/crypto/evp/cmeth_lib.c
index 37cca7a256..55f77133b5 100644
--- a/crypto/evp/cmeth_lib.c
+++ b/crypto/evp/cmeth_lib.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * EVP _meth_ APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <string.h>
 
 #include <openssl/evp.h>
diff --git a/crypto/evp/evp_lib.c b/crypto/evp/evp_lib.c
index ef978ec6f1..9f2165dc59 100644
--- a/crypto/evp/evp_lib.c
+++ b/crypto/evp/evp_lib.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * EVP _meth_ APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <stdio.h>
 #include "internal/cryptlib.h"
 #include <openssl/evp.h>
diff --git a/doc/man3/EVP_CIPHER_meth_new.pod b/doc/man3/EVP_CIPHER_meth_new.pod
index 2e4cea289e..dd73ee693c 100644
--- a/doc/man3/EVP_CIPHER_meth_new.pod
+++ b/doc/man3/EVP_CIPHER_meth_new.pod
@@ -17,6 +17,10 @@ EVP_CIPHER_meth_get_ctrl
 
  #include <openssl/evp.h>
 
+Deprecated since OpenSSL 3.0, can be hidden entirely by defining
+B<OPENSSL_API_COMPAT> with a suitable version value, see
+L<openssl_user_macros(7)>:
+
  EVP_CIPHER *EVP_CIPHER_meth_new(int cipher_type, int block_size, int key_len);
  EVP_CIPHER *EVP_CIPHER_meth_dup(const EVP_CIPHER *cipher);
  void EVP_CIPHER_meth_free(EVP_CIPHER *cipher);
@@ -65,6 +69,9 @@ EVP_CIPHER_meth_get_ctrl
 
 =head1 DESCRIPTION
 
+All of the functions described on this page are deprecated.
+Applications should instead use the OSSL_PROVIDER APIs.
+
 The B<EVP_CIPHER> type is a structure for symmetric cipher method
 implementation.
 
@@ -234,6 +241,8 @@ L<EVP_EncryptInit(3)>
 
 =head1 HISTORY
 
+All of these functions were deprecated in OpenSSL 3.0.
+
 The functions described here were added in OpenSSL 1.1.0.
 The B<EVP_CIPHER> structure created with these functions became reference
 counted in OpenSSL 3.0.
diff --git a/doc/man3/EVP_MD_meth_new.pod b/doc/man3/EVP_MD_meth_new.pod
index 7777a33586..7beaaebc0b 100644
--- a/doc/man3/EVP_MD_meth_new.pod
+++ b/doc/man3/EVP_MD_meth_new.pod
@@ -18,6 +18,10 @@ EVP_MD_meth_get_ctrl
 
  #include <openssl/evp.h>
 
+Deprecated since OpenSSL 3.0, can be hidden entirely by defining
+B<OPENSSL_API_COMPAT> with a suitable version value, see
+L<openssl_user_macros(7)>:
+
  EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type);
  void EVP_MD_meth_free(EVP_MD *md);
  EVP_MD *EVP_MD_meth_dup(const EVP_MD *md);
@@ -56,6 +60,9 @@ EVP_MD_meth_get_ctrl
 
 =head1 DESCRIPTION
 
+All of the functions described on this page are deprecated.
+Applications should instead use the OSSL_PROVIDER APIs.
+
 The B<EVP_MD> type is a structure for digest method implementation.
 It can also have associated public/private key signing and verifying
 routines.
@@ -177,6 +184,8 @@ L<EVP_DigestInit(3)>, L<EVP_SignInit(3)>, L<EVP_VerifyInit(3)>
 
 =head1 HISTORY
 
+All of these functions were deprecated in OpenSSL 3.0.
+
 The B<EVP_MD> structure was openly available in OpenSSL before version
 1.1.
 The functions described here were added in OpenSSL 1.1.
diff --git a/doc/man3/EVP_PKEY_meth_get_count.pod b/doc/man3/EVP_PKEY_meth_get_count.pod
index 03dca86700..7b56de5c8a 100644
--- a/doc/man3/EVP_PKEY_meth_get_count.pod
+++ b/doc/man3/EVP_PKEY_meth_get_count.pod
@@ -8,6 +8,10 @@ EVP_PKEY_meth_get_count, EVP_PKEY_meth_get0, EVP_PKEY_meth_get0_info - enumerate
 
  #include <openssl/evp.h>
 
+Deprecated since OpenSSL 3.0, can be hidden entirely by defining
+B<OPENSSL_API_COMPAT> with a suitable version value, see
+L<openssl_user_macros(7)>:
+
  size_t EVP_PKEY_meth_get_count(void);
  const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx);
  void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
@@ -15,6 +19,9 @@ EVP_PKEY_meth_get_count, EVP_PKEY_meth_get0, EVP_PKEY_meth_get0_info - enumerate
 
 =head1 DESCRIPTION
 
+All of the functions described on this page are deprecated.
+Applications should instead use the OSSL_PROVIDER APIs.
+
 EVP_PKEY_meth_count() returns a count of the number of public key methods
 available: it includes standard methods and any methods added by the
 application.
@@ -38,6 +45,10 @@ EVP_PKEY_meth_get0_info() does not return a value.
 
 L<EVP_PKEY_new(3)>
 
+=head1 HISTORY
+
+All of these functions were deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2002-2017 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/doc/man3/EVP_PKEY_meth_new.pod b/doc/man3/EVP_PKEY_meth_new.pod
index 643798f1fd..48df32f65b 100644
--- a/doc/man3/EVP_PKEY_meth_new.pod
+++ b/doc/man3/EVP_PKEY_meth_new.pod
@@ -29,6 +29,10 @@ EVP_PKEY_meth_remove
 
  #include <openssl/evp.h>
 
+Deprecated since OpenSSL 3.0, can be hidden entirely by defining
+B<OPENSSL_API_COMPAT> with a suitable version value, see
+L<openssl_user_macros(7)>:
+
  typedef struct evp_pkey_method_st EVP_PKEY_METHOD;
 
  EVP_PKEY_METHOD *EVP_PKEY_meth_new(int id, int flags);
@@ -240,6 +244,9 @@ EVP_PKEY_meth_remove
 
 =head1 DESCRIPTION
 
+All of the functions described on this page are deprecated.
+Applications should instead use the OSSL_PROVIDER APIs.
+
 B<EVP_PKEY_METHOD> is a structure which holds a set of methods for a
 specific public key cryptographic algorithm. Those methods are usually
 used to perform different jobs, such as generating a key, signing or
@@ -440,6 +447,10 @@ All EVP_PKEY_meth_set and EVP_PKEY_meth_get functions have no return
 values. For the 'get' functions, function pointers are returned by
 arguments.
 
+=head1 HISTORY
+
+All of these functions were deprecated in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index 923550e9db..78771ca251 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -89,42 +89,47 @@ int EVP_default_properties_enable_fips(OPENSSL_CTX *libctx, int enable);
 # define EVP_PKEY_MO_DECRYPT     0x0008
 
 # ifndef EVP_MD
-EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type);
-EVP_MD *EVP_MD_meth_dup(const EVP_MD *md);
-void EVP_MD_meth_free(EVP_MD *md);
-
-int EVP_MD_meth_set_input_blocksize(EVP_MD *md, int blocksize);
-int EVP_MD_meth_set_result_size(EVP_MD *md, int resultsize);
-int EVP_MD_meth_set_app_datasize(EVP_MD *md, int datasize);
-int EVP_MD_meth_set_flags(EVP_MD *md, unsigned long flags);
-int EVP_MD_meth_set_init(EVP_MD *md, int (*init)(EVP_MD_CTX *ctx));
-int EVP_MD_meth_set_update(EVP_MD *md, int (*update)(EVP_MD_CTX *ctx,
-                                                     const void *data,
-                                                     size_t count));
-int EVP_MD_meth_set_final(EVP_MD *md, int (*final)(EVP_MD_CTX *ctx,
-                                                   unsigned char *md));
-int EVP_MD_meth_set_copy(EVP_MD *md, int (*copy)(EVP_MD_CTX *to,
-                                                 const EVP_MD_CTX *from));
-int EVP_MD_meth_set_cleanup(EVP_MD *md, int (*cleanup)(EVP_MD_CTX *ctx));
-int EVP_MD_meth_set_ctrl(EVP_MD *md, int (*ctrl)(EVP_MD_CTX *ctx, int cmd,
-                                                 int p1, void *p2));
-
-int EVP_MD_meth_get_input_blocksize(const EVP_MD *md);
-int EVP_MD_meth_get_result_size(const EVP_MD *md);
-int EVP_MD_meth_get_app_datasize(const EVP_MD *md);
-unsigned long EVP_MD_meth_get_flags(const EVP_MD *md);
-int (*EVP_MD_meth_get_init(const EVP_MD *md))(EVP_MD_CTX *ctx);
-int (*EVP_MD_meth_get_update(const EVP_MD *md))(EVP_MD_CTX *ctx,
-                                                const void *data,
-                                                size_t count);
-int (*EVP_MD_meth_get_final(const EVP_MD *md))(EVP_MD_CTX *ctx,
-                                               unsigned char *md);
-int (*EVP_MD_meth_get_copy(const EVP_MD *md))(EVP_MD_CTX *to,
-                                              const EVP_MD_CTX *from);
-int (*EVP_MD_meth_get_cleanup(const EVP_MD *md))(EVP_MD_CTX *ctx);
-int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd,
-                                              int p1, void *p2);
-
+DEPRECATEDIN_3_0(EVP_MD *EVP_MD_meth_new(int md_type, int pkey_type))
+DEPRECATEDIN_3_0(EVP_MD *EVP_MD_meth_dup(const EVP_MD *md))
+DEPRECATEDIN_3_0(void EVP_MD_meth_free(EVP_MD *md))
+
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_input_blocksize(EVP_MD *md, int blocksize))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_result_size(EVP_MD *md, int resultsize))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_app_datasize(EVP_MD *md, int datasize))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_flags(EVP_MD *md, unsigned long flags))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_init(EVP_MD *md,
+                                          int (*init)(EVP_MD_CTX *ctx)))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_update(EVP_MD *md,
+                                            int (*update)(EVP_MD_CTX *ctx,
+                                                          const void *data,
+                                                          size_t count)))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_final(EVP_MD *md,
+                                           int (*final)(EVP_MD_CTX *ctx,
+                                                        unsigned char *md)))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_copy(EVP_MD *md,
+                                          int (*copy)(EVP_MD_CTX *to,
+                                                      const EVP_MD_CTX *from)))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_cleanup(EVP_MD *md,
+                                             int (*cleanup)(EVP_MD_CTX *ctx)))
+DEPRECATEDIN_3_0(int EVP_MD_meth_set_ctrl(EVP_MD *md,
+                                          int (*ctrl)(EVP_MD_CTX *ctx, int cmd,
+                                                      int p1, void *p2)))
+
+DEPRECATEDIN_3_0(int EVP_MD_meth_get_input_blocksize(const EVP_MD *md))
+DEPRECATEDIN_3_0(int EVP_MD_meth_get_result_size(const EVP_MD *md))
+DEPRECATEDIN_3_0(int EVP_MD_meth_get_app_datasize(const EVP_MD *md))
+DEPRECATEDIN_3_0(unsigned long EVP_MD_meth_get_flags(const EVP_MD *md))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_init(const EVP_MD *md))(EVP_MD_CTX *ctx))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_update(const EVP_MD *md))
+    (EVP_MD_CTX *ctx, const void *data, size_t count))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_final(const EVP_MD *md))
+    (EVP_MD_CTX *ctx, unsigned char *md))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_copy(const EVP_MD *md))
+    (EVP_MD_CTX *to, const EVP_MD_CTX *from))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_cleanup(const EVP_MD *md))
+    (EVP_MD_CTX *ctx))
+DEPRECATEDIN_3_0(int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))
+    (EVP_MD_CTX *ctx, int cmd, int p1, void *p2))
 /* digest can only handle a single block */
 #  define EVP_MD_FLAG_ONESHOT     0x0001
 
@@ -199,51 +204,53 @@ int (*EVP_MD_meth_get_ctrl(const EVP_MD *md))(EVP_MD_CTX *ctx, int cmd,
 # define EVP_MD_CTX_FLAG_FINALISE        0x0200
 /* NOTE: 0x0400 is reserved for internal usage */
 
-EVP_CIPHER *EVP_CIPHER_meth_new(int cipher_type, int block_size, int key_len);
-EVP_CIPHER *EVP_CIPHER_meth_dup(const EVP_CIPHER *cipher);
-void EVP_CIPHER_meth_free(EVP_CIPHER *cipher);
-
-int EVP_CIPHER_meth_set_iv_length(EVP_CIPHER *cipher, int iv_len);
-int EVP_CIPHER_meth_set_flags(EVP_CIPHER *cipher, unsigned long flags);
-int EVP_CIPHER_meth_set_impl_ctx_size(EVP_CIPHER *cipher, int ctx_size);
-int EVP_CIPHER_meth_set_init(EVP_CIPHER *cipher,
+DEPRECATEDIN_3_0(EVP_CIPHER *EVP_CIPHER_meth_new(int cipher_type,
+                                                 int block_size, int key_len))
+DEPRECATEDIN_3_0(EVP_CIPHER *EVP_CIPHER_meth_dup(const EVP_CIPHER *cipher))
+DEPRECATEDIN_3_0(void EVP_CIPHER_meth_free(EVP_CIPHER *cipher))
+
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_iv_length(EVP_CIPHER *cipher,
+                                                   int iv_len))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_flags(EVP_CIPHER *cipher,
+                                               unsigned long flags))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_impl_ctx_size(EVP_CIPHER *cipher,
+                                                       int ctx_size))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_init(EVP_CIPHER *cipher,
                              int (*init) (EVP_CIPHER_CTX *ctx,
                                           const unsigned char *key,
                                           const unsigned char *iv,
-                                          int enc));
-int EVP_CIPHER_meth_set_do_cipher(EVP_CIPHER *cipher,
-                                  int (*do_cipher) (EVP_CIPHER_CTX *ctx,
-                                                    unsigned char *out,
-                                                    const unsigned char *in,
-                                                    size_t inl));
-int EVP_CIPHER_meth_set_cleanup(EVP_CIPHER *cipher,
-                                int (*cleanup) (EVP_CIPHER_CTX *));
-int EVP_CIPHER_meth_set_set_asn1_params(EVP_CIPHER *cipher,
-                                        int (*set_asn1_parameters) (EVP_CIPHER_CTX *,
-                                                                    ASN1_TYPE *));
-int EVP_CIPHER_meth_set_get_asn1_params(EVP_CIPHER *cipher,
-                                        int (*get_asn1_parameters) (EVP_CIPHER_CTX *,
-                                                                    ASN1_TYPE *));
-int EVP_CIPHER_meth_set_ctrl(EVP_CIPHER *cipher,
-                             int (*ctrl) (EVP_CIPHER_CTX *, int type,
-                                          int arg, void *ptr));
-
-int (*EVP_CIPHER_meth_get_init(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *ctx,
-                                                          const unsigned char *key,
-                                                          const unsigned char *iv,
-                                                          int enc);
-int (*EVP_CIPHER_meth_get_do_cipher(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *ctx,
-                                                               unsigned char *out,
-                                                               const unsigned char *in,
-                                                               size_t inl);
-int (*EVP_CIPHER_meth_get_cleanup(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *);
-int (*EVP_CIPHER_meth_get_set_asn1_params(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *,
-                                                                     ASN1_TYPE *);
-int (*EVP_CIPHER_meth_get_get_asn1_params(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *,
-                                                               ASN1_TYPE *);
-int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *,
-                                                          int type, int arg,
-                                                          void *ptr);
+                                          int enc)))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_do_cipher
+    (EVP_CIPHER *cipher, int (*do_cipher) (EVP_CIPHER_CTX *ctx,
+                                           unsigned char *out,
+                                           const unsigned char *in,
+                                           size_t inl)))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_cleanup
+    (EVP_CIPHER *cipher, int (*cleanup) (EVP_CIPHER_CTX *)))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_set_asn1_params
+    (EVP_CIPHER *cipher, int (*set_asn1_parameters) (EVP_CIPHER_CTX *,
+                                                     ASN1_TYPE *)))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_get_asn1_params
+    (EVP_CIPHER *cipher, int (*get_asn1_parameters) (EVP_CIPHER_CTX *,
+                                                     ASN1_TYPE *)))
+DEPRECATEDIN_3_0(int EVP_CIPHER_meth_set_ctrl
+    (EVP_CIPHER *cipher, int (*ctrl) (EVP_CIPHER_CTX *, int type, int arg,
+                                      void *ptr)))
+
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_init
+    (const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                                const unsigned char *iv, int enc))
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_do_cipher(const EVP_CIPHER *cipher))
+    (EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
+     size_t inl))
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_cleanup(const EVP_CIPHER *cipher))
+    (EVP_CIPHER_CTX *))
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_set_asn1_params(const EVP_CIPHER *cipher))
+    (EVP_CIPHER_CTX *, ASN1_TYPE *))
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_get_asn1_params(const EVP_CIPHER *cipher))
+    (EVP_CIPHER_CTX *, ASN1_TYPE *))
+DEPRECATEDIN_3_0(int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))
+    (EVP_CIPHER_CTX *, int type, int arg, void *ptr))
 
 /* Values for cipher flags */
 
@@ -1528,16 +1535,17 @@ int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
  */
 # define EVP_PKEY_FLAG_SIGCTX_CUSTOM     4
 
-const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type);
-EVP_PKEY_METHOD *EVP_PKEY_meth_new(int id, int flags);
-void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
-                             const EVP_PKEY_METHOD *meth);
-void EVP_PKEY_meth_copy(EVP_PKEY_METHOD *dst, const EVP_PKEY_METHOD *src);
-void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth);
-int EVP_PKEY_meth_add0(const EVP_PKEY_METHOD *pmeth);
-int EVP_PKEY_meth_remove(const EVP_PKEY_METHOD *pmeth);
-size_t EVP_PKEY_meth_get_count(void);
-const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx);
+DEPRECATEDIN_3_0(const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type))
+DEPRECATEDIN_3_0(EVP_PKEY_METHOD *EVP_PKEY_meth_new(int id, int flags))
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
+                                              const EVP_PKEY_METHOD *meth))
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_copy(EVP_PKEY_METHOD *dst,
+                                         const EVP_PKEY_METHOD *src))
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth))
+DEPRECATEDIN_3_0(int EVP_PKEY_meth_add0(const EVP_PKEY_METHOD *pmeth))
+DEPRECATEDIN_3_0(int EVP_PKEY_meth_remove(const EVP_PKEY_METHOD *pmeth))
+DEPRECATEDIN_3_0(size_t EVP_PKEY_meth_get_count(void))
+DEPRECATEDIN_3_0(const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx))
 
 EVP_KEYMGMT *EVP_KEYMGMT_fetch(OPENSSL_CTX *ctx, const char *algorithm,
                                const char *properties);
@@ -1710,243 +1718,185 @@ EVP_PKEY_gen_cb *EVP_PKEY_CTX_get_cb(EVP_PKEY_CTX *ctx);
 
 int EVP_PKEY_CTX_get_keygen_info(EVP_PKEY_CTX *ctx, int idx);
 
-void EVP_PKEY_meth_set_init(EVP_PKEY_METHOD *pmeth,
-                            int (*init) (EVP_PKEY_CTX *ctx));
-
-void EVP_PKEY_meth_set_copy(EVP_PKEY_METHOD *pmeth,
-                            int (*copy) (EVP_PKEY_CTX *dst,
-                                         const EVP_PKEY_CTX *src));
-
-void EVP_PKEY_meth_set_cleanup(EVP_PKEY_METHOD *pmeth,
-                               void (*cleanup) (EVP_PKEY_CTX *ctx));
-
-void EVP_PKEY_meth_set_paramgen(EVP_PKEY_METHOD *pmeth,
-                                int (*paramgen_init) (EVP_PKEY_CTX *ctx),
-                                int (*paramgen) (EVP_PKEY_CTX *ctx,
-                                                 EVP_PKEY *pkey));
-
-void EVP_PKEY_meth_set_keygen(EVP_PKEY_METHOD *pmeth,
-                              int (*keygen_init) (EVP_PKEY_CTX *ctx),
-                              int (*keygen) (EVP_PKEY_CTX *ctx,
-                                             EVP_PKEY *pkey));
-
-void EVP_PKEY_meth_set_sign(EVP_PKEY_METHOD *pmeth,
-                            int (*sign_init) (EVP_PKEY_CTX *ctx),
-                            int (*sign) (EVP_PKEY_CTX *ctx,
-                                         unsigned char *sig, size_t *siglen,
-                                         const unsigned char *tbs,
-                                         size_t tbslen));
-
-void EVP_PKEY_meth_set_verify(EVP_PKEY_METHOD *pmeth,
-                              int (*verify_init) (EVP_PKEY_CTX *ctx),
-                              int (*verify) (EVP_PKEY_CTX *ctx,
-                                             const unsigned char *sig,
-                                             size_t siglen,
-                                             const unsigned char *tbs,
-                                             size_t tbslen));
-
-void EVP_PKEY_meth_set_verify_recover(EVP_PKEY_METHOD *pmeth,
-                                      int (*verify_recover_init) (EVP_PKEY_CTX
-                                                                  *ctx),
-                                      int (*verify_recover) (EVP_PKEY_CTX
-                                                             *ctx,
-                                                             unsigned char
-                                                             *sig,
-                                                             size_t *siglen,
-                                                             const unsigned
-                                                             char *tbs,
-                                                             size_t tbslen));
-
-void EVP_PKEY_meth_set_signctx(EVP_PKEY_METHOD *pmeth,
-                               int (*signctx_init) (EVP_PKEY_CTX *ctx,
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_init(EVP_PKEY_METHOD *pmeth,
+                                             int (*init) (EVP_PKEY_CTX *ctx)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_copy
+    (EVP_PKEY_METHOD *pmeth, int (*copy) (EVP_PKEY_CTX *dst,
+                                          const EVP_PKEY_CTX *src)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_cleanup
+    (EVP_PKEY_METHOD *pmeth, void (*cleanup) (EVP_PKEY_CTX *ctx)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_paramgen
+    (EVP_PKEY_METHOD *pmeth, int (*paramgen_init) (EVP_PKEY_CTX *ctx),
+     int (*paramgen) (EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_keygen
+    (EVP_PKEY_METHOD *pmeth, int (*keygen_init) (EVP_PKEY_CTX *ctx),
+     int (*keygen) (EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_sign
+    (EVP_PKEY_METHOD *pmeth, int (*sign_init) (EVP_PKEY_CTX *ctx),
+     int (*sign) (EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
+                  const unsigned char *tbs, size_t tbslen)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_verify
+    (EVP_PKEY_METHOD *pmeth, int (*verify_init) (EVP_PKEY_CTX *ctx),
+     int (*verify) (EVP_PKEY_CTX *ctx, const unsigned char *sig, size_t siglen,
+                    const unsigned char *tbs, size_t tbslen)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_verify_recover
+    (EVP_PKEY_METHOD *pmeth, int (*verify_recover_init) (EVP_PKEY_CTX *ctx),
+     int (*verify_recover) (EVP_PKEY_CTX *ctx, unsigned char *sig,
+                            size_t *siglen, const unsigned char *tbs,
+                            size_t tbslen)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_signctx
+    (EVP_PKEY_METHOD *pmeth, int (*signctx_init) (EVP_PKEY_CTX *ctx,
+                                                  EVP_MD_CTX *mctx),
+     int (*signctx) (EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen,
+                     EVP_MD_CTX *mctx)))
+
+DEPRECATEDIN_3_0(void EVP_PKEY_meth_set_verifyctx
+    (EVP_PKEY_METHOD *pmeth, int (*verifyctx_init) (EVP_PKEY_CTX *ctx,
                                                     EVP_MD_CTX *mctx),
-                               int (*signctx) (EVP_PKEY_CTX *ctx,
-                                               unsigned char *sig,
-                                               size_t *siglen,
-                                               EVP_MD_CTX *mctx));
-
-void EVP_PKEY_meth_set_verifyctx(EVP_PKEY_METHOD *pmeth,
-                                 int (*verifyctx_init) (EVP_PKEY_CTX *ctx,
-                                                        EVP_MD_CTX *mctx),
-                                 int (*verifyctx) (EVP_PKEY_CTX *ctx,
-                                                   const unsigned char *sig,
-                                                   int siglen,
-                                                   EVP_MD_CTX *mctx));
-
-void EVP_PKEY_meth_set_encrypt(EVP_PKEY_METHOD *pmeth,
-                               int (*encrypt_init) (EVP_PKEY_CTX *ctx),
-                               int (*encryptfn) (EVP_PKEY_CTX *ctx,
-                                                 unsigned char *out,
-                                                 size_t *outlen,
-                                                 const unsigned char *in,
-                                                 size_t inlen));
-
-void EVP_PKEY_meth_set_decrypt(EVP_PKEY_METHOD *pmeth,
-                               int (*decrypt_init) (EVP_PKEY_CTX *ctx),
-                               int (*decrypt) (EVP_PKEY_CTX *ctx,
-                                               unsigned char *out,
-                                               size_t *outlen,
-                                               const unsigned char *in,
-                                               size_t inlen));
-
-void EVP_PKEY_meth_set_derive(EVP_PKEY_METHOD *pmeth,
-                              int (*derive_init) (EVP_PKEY_CTX *ctx),
-                              int (*derive) (EVP_PKEY_CTX *ctx,
-                                             unsigned char *key,
-                                             size_t *keylen));
-
-void EVP_PKEY_meth_set_ctrl(EVP_PKEY_METHOD *pmeth,
-                            int (*ctrl) (EVP_PKEY_CTX *ctx, int type, int p1,
-                                         void *p2),
-                            int (*ctrl_str) (EVP_PKEY_CTX *ctx,
-                                             const char *type,
-                                             const char *value));
-
-void EVP_PKEY_meth_set_digestsign(EVP_PKEY_METHOD *pmeth,
-                                  int (*digestsign) (EVP_MD_CTX *ctx,
-                                                     unsigned char *sig,
-                                                     size_t *siglen,
-                                                     const unsigned char *tbs,
-                                                     size_t tbslen));
-
-void EVP_PKEY_meth_set_digestverify(EVP_PKEY_METHOD *pmeth,
-                                    int (*digestverify) (EVP_MD_CTX *ctx,
-                                                         const unsigned char *sig,
-                                                         size_t siglen,
-                                                         const unsigned char *tbs,
-                                                         size_t tbslen));
-
-void EVP_PKEY_meth_set_check(EVP_PKEY_METHOD *pmeth,
-                             int (*check) (EVP_PKEY *pkey));
-
-void EVP_PKEY_meth_set_public_check(EVP_PKEY_METHOD *pmeth,
-                                    int (*check) (EVP_PKEY *pkey));
-
-void EVP_PKEY_meth_set_param_check(EVP_PKEY_METHOD *pmeth,
-                                   int (*check) (EVP_PKEY *pkey));
-
-void EVP_PKEY_meth_set_digest_custom(EVP_PKEY_METHOD *pmeth,
-                                     int (*digest_custom) (EVP_PKEY_CTX *ctx,
-                                                           EVP_MD_CTX *mctx));
-
-void EVP_PKEY_meth_get_init(const EVP_PKEY_METHOD *pmeth,
-                            int (**pinit) (EVP_PKEY_CTX *ctx));
-
-void EVP_PKEY_meth_get_copy(const EVP_PKEY_METHOD *pmeth,
-                            int (**pcopy) (EVP_PKEY_CTX *dst,
-                                           const EVP_PKEY_CTX *src));
-
-void EVP_PKEY_meth_get_cleanup(const EVP_PKEY_METHOD *pmeth,
-                               void (**pcleanup) (EVP_PKEY_CTX *ctx));
-
-void EVP_PKEY_meth_get_paramgen(const EVP_PKEY_METHOD *pmeth,
-                                int (**pparamgen_init) (EVP_PKEY_CTX *ctx),
-                                int (**pparamgen) (EVP_PKEY_CTX *ctx,
-                                                   EVP_PKEY *pkey));
-
-void EVP_PKEY