Implements Hybrid Public Key Encryption (HPKE) as per RFC9180.

This supports all the modes, suites and export mechanisms defined
in RFC9180 and should be relatively easily extensible if/as new
suites are added.  The APIs are based on the pseudo-code from the
RFC, e.g. OSS_HPKE_encap() roughly maps to SetupBaseS().  External
APIs are defined in include/openssl/hpke.h and documented in
doc/man3/OSSL_HPKE_CTX_new.pod.  Tests (test/hpke_test.c) include
verifying a number of the test vectors from the RFC as well as
round-tripping for all the modes and suites.  We have demonstrated
interoperability with other HPKE implementations via a fork [1]
that implements TLS Encrypted ClientHello (ECH) which uses HPKE.

@slontis provided huge help in getting this done and this makes
extensive use of the KEM handling code from his PR#19068.

[1] https://github.com/sftcd/openssl/tree/ECH-draft-13c

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17172)

1 files changed, 0 insertions, 47 deletions

diff --git a/include/crypto/hpke.h b/include/crypto/hpke.h
deleted file mode 100644
index e3596fdb90..0000000000
--- a/include/crypto/hpke.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef OSSL_CRYPTO_HPKE_H
-# define OSSL_CRYPTO_HPKE_H
-# pragma once
-
-/* Constants from RFC 9180 Section 7.1 and 7.3 */
-#define OSSL_HPKE_MAX_SECRET 64
-#define OSSL_HPKE_MAX_PUBLIC 133
-#define OSSL_HPKE_MAX_PRIVATE 66
-#define OSSL_HPKE_MAX_NONCE 12
-#define OSSL_HPKE_MAX_KDF_INPUTLEN 64
-
-int ossl_hpke_kdf_extract(EVP_KDF_CTX *kctx,
-                          unsigned char *prk, size_t prklen,
-                          const unsigned char *salt, size_t saltlen,
-                          const unsigned char *ikm, size_t ikmlen);
-
-int ossl_hpke_kdf_expand(EVP_KDF_CTX *kctx,
-                         unsigned char *okm, size_t okmlen,
-                         const unsigned char *prk, size_t prklen,
-                         const unsigned char *info, size_t infolen);
-
-int ossl_hpke_labeled_extract(EVP_KDF_CTX *kctx,
-                              unsigned char *prk, size_t prklen,
-                              const unsigned char *salt, size_t saltlen,
-                              const unsigned char *suiteid, size_t suiteidlen,
-                              const char *label,
-                              const unsigned char *ikm, size_t ikmlen);
-int ossl_hpke_labeled_expand(EVP_KDF_CTX *kctx,
-                             unsigned char *okm, size_t okmlen,
-                             const unsigned char *prk, size_t prklen,
-                             const unsigned char *suiteid, size_t suiteidlen,
-                             const char *label,
-                             const unsigned char *info, size_t infolen);
-
-EVP_KDF_CTX *ossl_kdf_ctx_create(const char *kdfname, const char *mdname,
-                                 OSSL_LIB_CTX *libctx, const char *propq);
-
-#endif