Hide ECX_KEY again

ECX_KEY was not meant for public consumption, it was only to be
accessed indirectly via EVP routines.  However, we still need internal
access for our decoders.

This partially reverts 7c664b1f1b5f60bf896f5fdea5c08c401c541dfe

Fixes #12880

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12956)

2 files changed, 52 insertions, 40 deletions

diff --git a/doc/internal/man3/evp_pkey_get1_ED25519.pod b/doc/internal/man3/evp_pkey_get1_ED25519.pod
new file mode 100644
index 0000000000..37b41e4591
--- /dev/null
+++ b/doc/internal/man3/evp_pkey_get1_ED25519.pod
@@ -0,0 +1,43 @@
+=pod
+
+=head1 NAME
+
+evp_pkey_get1_ED25519, evp_pkey_get1_ED448,
+evp_pkey_get1_X25519, evp_pkey_get1_X448
+- internal ECX from EVP_PKEY getter functions
+
+=head1 SYNOPSIS
+
+ #include "internal/evp.h"
+
+ ECX_KEY *evp_pkey_get1_ED25519(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_ED448(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_X25519(EVP_PKEY *pkey);
+ ECX_KEY *evp_pkey_get1_X448(EVP_PKEY *pkey);
+
+=head1 DESCRIPTION
+
+evp_pkey_get1_ED25519(), evp_pkey_get1_ED448(), evp_pkey_get1_X25519() and
+evp_pkey_get1_X448() return the referenced key in I<pkey> or NULL if the key
+is not of the correct type.  The returned key must be freed after use.
+
+=head1 RETURN VALUES
+
+evp_pkey_get1_ED25519(), evp_pkey_get1_ED448(), evp_pkey_get1_X25519() and
+evp_pkey_get1_X448() return the referenced key or NULL if an error
+occurred.
+
+=head1 HISTORY
+
+This functionality was added to OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use this
+file except in compliance with the License.  You can obtain a copy in the file
+LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/EVP_PKEY_set1_RSA.pod b/doc/man3/EVP_PKEY_set1_RSA.pod
index 89737a3c8c..1a30b068cf 100644
--- a/doc/man3/EVP_PKEY_set1_RSA.pod
+++ b/doc/man3/EVP_PKEY_set1_RSA.pod
@@ -3,18 +3,10 @@
 =head1 NAME
 
 EVP_PKEY_set1_RSA, EVP_PKEY_set1_DSA, EVP_PKEY_set1_DH, EVP_PKEY_set1_EC_KEY,
-EVP_PKEY_set1_ED25519, EVP_PKEY_set1_ED448,
-EVP_PKEY_set1_X25519, EVP_PKEY_set1_X448,
 EVP_PKEY_get1_RSA, EVP_PKEY_get1_DSA, EVP_PKEY_get1_DH, EVP_PKEY_get1_EC_KEY,
-EVP_PKEY_get1_ED25519, EVP_PKEY_get1_ED448,
-EVP_PKEY_get1_X25519, EVP_PKEY_get1_X448,
 EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY,
-EVP_PKEY_get0_ED25519, EVP_PKEY_get0_ED448,
-EVP_PKEY_get0_X25519, EVP_PKEY_get0_X448,
 EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH,
 EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH,
-EVP_PKEY_assign_ED25519, EVP_PKEY_assign_ED448,
-EVP_PKEY_assign_X25519, EVP_PKEY_assign_X448,
 EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash,
 EVP_PKEY_type, EVP_PKEY_id, EVP_PKEY_base_id, EVP_PKEY_set_alias_type,
 EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
@@ -27,19 +19,11 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
  int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key);
  int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key);
  int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
- int EVP_PKEY_set1_ED25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_ED448(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_X25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_set1_X448(EVP_PKEY *pkey, ECX_KEY *key);
 
  RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
  DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
  DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey);
  EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_ED25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_ED448(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_X25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get1_X448(EVP_PKEY *pkey);
 
  const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len);
  const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len);
@@ -48,19 +32,11 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
  DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey);
  DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey);
  EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_ED25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_ED448(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_X25519(EVP_PKEY *pkey);
- ECX_KEY *EVP_PKEY_get0_X448(EVP_PKEY *pkey);
 
  int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key);
  int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key);
  int EVP_PKEY_assign_DH(EVP_PKEY *pkey, DH *key);
  int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
- int EVP_PKEY_assign_ED25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_ED448(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_X25519(EVP_PKEY *pkey, ECX_KEY *key);
- int EVP_PKEY_assign_X448(EVP_PKEY *pkey, ECX_KEY *key);
  int EVP_PKEY_assign_POLY1305(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);
  int EVP_PKEY_assign_SIPHASH(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);
 
@@ -74,28 +50,21 @@ EVP_PKEY_set1_engine, EVP_PKEY_get0_engine - EVP_PKEY assignment functions
 
 =head1 DESCRIPTION
 
-EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH(),
-EVP_PKEY_set1_EC_KEY(), EVP_PKEY_set1_ED25519(), EVP_PKEY_set1_ED448(),
-EVP_PKEY_set1_X25519() and EVP_PKEY_set1_X448() set the key referenced by
-I<pkey> to I<key>.
+EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() and
+EVP_PKEY_set1_EC_KEY() set the key referenced by I<pkey> to I<key>.
 
 EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and
-EVP_PKEY_get1_EC_KEY(), EVP_PKEY_get1_ED25519(), EVP_PKEY_get1_ED448(),
-EVP_PKEY_get1_X25519() and EVP_PKEY_get1_X448() return the referenced key in
-I<pkey> or NULL if the key is not of the correct type.  The returned key must
-be freed after use.
+EVP_PKEY_get1_EC_KEY() return the referenced key in I<pkey> or NULL if the
+key is not of the correct type.  The returned key must be freed after use.
 
 EVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(),
-EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH(),
-EVP_PKEY_get0_EC_KEY(), EVP_PKEY_get0_ED25519(), EVP_PKEY_get0_ED448(),
-EVP_PKEY_get0_X25519() and EVP_PKEY_get0_X448() return the referenced
-key in I<pkey> or NULL if the key is not of the correct type but the
-reference count of the returned key is B<not> incremented and so must not be
-freed after use.
+EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() and
+EVP_PKEY_get0_EC_KEY() return the referenced key in I<pkey> or NULL if the
+key is not of the correct type but the reference count of the returned key
+is B<not> incremented and so must not be freed after use.
 
 EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(),
-EVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_ED25519(), EVP_PKEY_assign_ED448(),
-EVP_PKEY_assign_X25519(), EVP_PKEY_assign_X448(), EVP_PKEY_assign_POLY1305() and
+EVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and
 EVP_PKEY_assign_SIPHASH() set the referenced key to I<key> however these use
 the supplied I<key> internally and so I<key> will be freed when the parent
 I<pkey> is freed.