configure: introduce no-ecx to remove ECX related feature

This can effectively reduce the binary size for platforms
that don't need ECX feature(~100KB).

Signed-off-by: Yi Li <yi1.li@intel.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20781)

13 files changed, 91 insertions, 49 deletions

diff --git a/providers/common/der/build.info b/providers/common/der/build.info
index b81413e11b..764bff539e 100644
--- a/providers/common/der/build.info
+++ b/providers/common/der/build.info
@@ -57,7 +57,7 @@ IF[{- !$disabled{ec} -}]
 ENDIF
 
 #----- ECX
-IF[{- !$disabled{ec} -}]
+IF[{- !$disabled{ecx} -}]
   $DER_ECX_H=$INCDIR/der_ecx.h
   $DER_ECX_GEN=der_ecx_gen.c
   $DER_ECX_AUX=der_ecx_key.c
@@ -107,7 +107,9 @@ ENDIF
 
 IF[{- !$disabled{ec} -}]
   $COMMON = $COMMON $DER_EC_GEN $DER_EC_AUX
-  $COMMON = $COMMON $DER_ECX_GEN $DER_ECX_AUX
+  IF[{- !$disabled{ecx} -}]
+    $COMMON = $COMMON $DER_ECX_GEN $DER_ECX_AUX
+  ENDIF
 ENDIF
 
 IF[{- !$disabled{sm2} -}]
diff --git a/providers/decoders.inc b/providers/decoders.inc
index edca39ea36..f0bbad807c 100644
--- a/providers/decoders.inc
+++ b/providers/decoders.inc
@@ -58,6 +58,7 @@ DECODER_w_structure("EC", der, PrivateKeyInfo, ec, yes),
 DECODER_w_structure("EC", der, SubjectPublicKeyInfo, ec, yes),
 DECODER_w_structure("EC", der, type_specific_no_pub, ec, yes),
 DECODER_w_structure("EC", der, EC, ec, yes),
+# ifndef OPENSSL_NO_ECX
 DECODER_w_structure("ED25519", der, PrivateKeyInfo, ed25519, yes),
 DECODER_w_structure("ED25519", der, SubjectPublicKeyInfo, ed25519, yes),
 DECODER_w_structure("ED448", der, PrivateKeyInfo, ed448, yes),
@@ -66,6 +67,7 @@ DECODER_w_structure("X25519", der, PrivateKeyInfo, x25519, yes),
 DECODER_w_structure("X25519", der, SubjectPublicKeyInfo, x25519, yes),
 DECODER_w_structure("X448", der, PrivateKeyInfo, x448, yes),
 DECODER_w_structure("X448", der, SubjectPublicKeyInfo, x448, yes),
+# endif
 # ifndef OPENSSL_NO_SM2
 DECODER_w_structure("SM2", der, PrivateKeyInfo, sm2, no),
 DECODER_w_structure("SM2", der, SubjectPublicKeyInfo, sm2, no),
diff --git a/providers/defltprov.c b/providers/defltprov.c
index 4f8921f80a..8b2ae6bfbf 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -369,8 +369,10 @@ static const OSSL_ALGORITHM deflt_keyexch[] = {
 #endif
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_ECDH, "provider=default", ossl_ecdh_keyexch_functions },
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_X25519, "provider=default", ossl_x25519_keyexch_functions },
     { PROV_NAMES_X448, "provider=default", ossl_x448_keyexch_functions },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, "provider=default", ossl_kdf_tls1_prf_keyexch_functions },
     { PROV_NAMES_HKDF, "provider=default", ossl_kdf_hkdf_keyexch_functions },
@@ -394,8 +396,10 @@ static const OSSL_ALGORITHM deflt_signature[] = {
 #endif
     { PROV_NAMES_RSA, "provider=default", ossl_rsa_signature_functions },
 #ifndef OPENSSL_NO_EC
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_ED25519, "provider=default", ossl_ed25519_signature_functions },
     { PROV_NAMES_ED448, "provider=default", ossl_ed448_signature_functions },
+# endif
     { PROV_NAMES_ECDSA, "provider=default", ossl_ecdsa_signature_functions },
 # ifndef OPENSSL_NO_SM2
     { PROV_NAMES_SM2, "provider=default", ossl_sm2_signature_functions },
@@ -425,8 +429,10 @@ static const OSSL_ALGORITHM deflt_asym_cipher[] = {
 static const OSSL_ALGORITHM deflt_asym_kem[] = {
     { PROV_NAMES_RSA, "provider=default", ossl_rsa_asym_kem_functions },
 #ifndef OPENSSL_NO_EC
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_X25519, "provider=default", ossl_ecx_asym_kem_functions },
     { PROV_NAMES_X448, "provider=default", ossl_ecx_asym_kem_functions },
+# endif
     { PROV_NAMES_EC, "provider=default", ossl_ec_asym_kem_functions },
 #endif
     { NULL, NULL, NULL }
@@ -450,6 +456,7 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_EC, "provider=default", ossl_ec_keymgmt_functions,
       PROV_DESCS_EC },
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_X25519, "provider=default", ossl_x25519_keymgmt_functions,
       PROV_DESCS_X25519 },
     { PROV_NAMES_X448, "provider=default", ossl_x448_keymgmt_functions,
@@ -458,6 +465,7 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
       PROV_DESCS_ED25519 },
     { PROV_NAMES_ED448, "provider=default", ossl_ed448_keymgmt_functions,
       PROV_DESCS_ED448 },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, "provider=default", ossl_kdf_keymgmt_functions,
       PROV_DESCS_TLS1_PRF_SIGN },
diff --git a/providers/encoders.inc b/providers/encoders.inc
index 95e287c8b9..e36b99957f 100644
--- a/providers/encoders.inc
+++ b/providers/encoders.inc
@@ -57,10 +57,12 @@ ENCODER_TEXT("DSA", dsa, yes),
 #endif
 #ifndef OPENSSL_NO_EC
 ENCODER_TEXT("EC", ec, yes),
+# ifndef OPENSSL_NO_ECX
 ENCODER_TEXT("ED25519", ed25519, yes),
 ENCODER_TEXT("ED448", ed448, yes),
 ENCODER_TEXT("X25519", x25519, yes),
 ENCODER_TEXT("X448", x448, yes),
+# endif
 # ifndef OPENSSL_NO_SM2
 ENCODER_TEXT("SM2", sm2, no),
 # endif
@@ -181,6 +183,7 @@ ENCODER_w_structure("EC", ec, yes, pem, PrivateKeyInfo),
 ENCODER_w_structure("EC", ec, yes, der, SubjectPublicKeyInfo),
 ENCODER_w_structure("EC", ec, yes, pem, SubjectPublicKeyInfo),
 
+#ifndef OPENSSL_NO_ECX
 ENCODER_w_structure("X25519", x25519, yes, der, EncryptedPrivateKeyInfo),
 ENCODER_w_structure("X25519", x25519, yes, pem, EncryptedPrivateKeyInfo),
 ENCODER_w_structure("X25519", x25519, yes, der, PrivateKeyInfo),
@@ -208,6 +211,7 @@ ENCODER_w_structure("ED448", ed448, yes, der, PrivateKeyInfo),
 ENCODER_w_structure("ED448", ed448, yes, pem, PrivateKeyInfo),
 ENCODER_w_structure("ED448", ed448, yes, der, SubjectPublicKeyInfo),
 ENCODER_w_structure("ED448", ed448, yes, pem, SubjectPublicKeyInfo),
+# endif
 
 # ifndef OPENSSL_NO_SM2
 ENCODER_w_structure("SM2", sm2, no, der, EncryptedPrivateKeyInfo),
diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index cac97b7bc9..fb64633b7e 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -409,8 +409,10 @@ static const OSSL_ALGORITHM fips_keyexch[] = {
 #endif
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_ECDH, FIPS_DEFAULT_PROPERTIES, ossl_ecdh_keyexch_functions },
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keyexch_functions },
     { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keyexch_functions },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES,
       ossl_kdf_tls1_prf_keyexch_functions },
@@ -424,9 +426,11 @@ static const OSSL_ALGORITHM fips_signature[] = {
 #endif
     { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_signature_functions },
 #ifndef OPENSSL_NO_EC
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES,
       ossl_ed25519_signature_functions },
     { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions },
+# endif
     { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions },
 #endif
     { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES,
@@ -466,6 +470,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_EC, FIPS_DEFAULT_PROPERTIES, ossl_ec_keymgmt_functions,
       PROV_DESCS_EC },
+# ifndef OPENSSL_NO_ECX
     { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keymgmt_functions,
       PROV_DESCS_X25519 },
     { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keymgmt_functions,
@@ -474,6 +479,7 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
       PROV_DESCS_ED25519 },
     { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_keymgmt_functions,
       PROV_DESCS_ED448 },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_keymgmt_functions,
       PROV_DESCS_TLS1_PRF_SIGN },
diff --git a/providers/implementations/encode_decode/decode_der2key.c b/providers/implementations/encode_decode/decode_der2key.c
index d8231fdbc3..2657760a62 100644
--- a/providers/implementations/encode_decode/decode_der2key.c
+++ b/providers/implementations/encode_decode/decode_der2key.c
@@ -417,6 +417,7 @@ static void ec_adjust(void *key, struct der2key_ctx_st *ctx)
     ossl_ec_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 }
 
+# ifndef OPENSSL_NO_ECX
 /*
  * ED25519, ED448, X25519, X448 only implement PKCS#8 and SubjectPublicKeyInfo,
  * so no d2i functions to be had.
@@ -434,45 +435,46 @@ static void ecx_key_adjust(void *key, struct der2key_ctx_st *ctx)
     ossl_ecx_key_set0_libctx(key, PROV_LIBCTX_OF(ctx->provctx));
 }
 
-# define ed25519_evp_type               EVP_PKEY_ED25519
-# define ed25519_d2i_private_key        NULL
-# define ed25519_d2i_public_key         NULL
-# define ed25519_d2i_key_params         NULL
-# define ed25519_d2i_PKCS8              ecx_d2i_PKCS8
-# define ed25519_d2i_PUBKEY             (d2i_of_void *)ossl_d2i_ED25519_PUBKEY
-# define ed25519_free                   (free_key_fn *)ossl_ecx_key_free
-# define ed25519_check                  NULL
-# define ed25519_adjust                 ecx_key_adjust
-
-# define ed448_evp_type                 EVP_PKEY_ED448
-# define ed448_d2i_private_key          NULL
-# define ed448_d2i_public_key           NULL
-# define ed448_d2i_key_params           NULL
-# define ed448_d2i_PKCS8                ecx_d2i_PKCS8
-# define ed448_d2i_PUBKEY               (d2i_of_void *)ossl_d2i_ED448_PUBKEY
-# define ed448_free                     (free_key_fn *)ossl_ecx_key_free
-# define ed448_check                    NULL
-# define ed448_adjust                   ecx_key_adjust
-
-# define x25519_evp_type                EVP_PKEY_X25519
-# define x25519_d2i_private_key         NULL
-# define x25519_d2i_public_key          NULL
-# define x25519_d2i_key_params          NULL
-# define x25519_d2i_PKCS8               ecx_d2i_PKCS8
-# define x25519_d2i_PUBKEY              (d2i_of_void *)ossl_d2i_X25519_PUBKEY
-# define x25519_free                    (free_key_fn *)ossl_ecx_key_free
-# define x25519_check                   NULL
-# define x25519_adjust                  ecx_key_adjust
-
-# define x448_evp_type                  EVP_PKEY_X448
-# define x448_d2i_private_key           NULL
-# define x448_d2i_public_key            NULL
-# define x448_d2i_key_params            NULL
-# define x448_d2i_PKCS8                 ecx_d2i_PKCS8
-# define x448_d2i_PUBKEY                (d2i_of_void *)ossl_d2i_X448_PUBKEY
-# define x448_free                      (free_key_fn *)ossl_ecx_key_free
-# define x448_check                     NULL
-# define x448_adjust                    ecx_key_adjust
+#  define ed25519_evp_type               EVP_PKEY_ED25519
+#  define ed25519_d2i_private_key        NULL
+#  define ed25519_d2i_public_key         NULL
+#  define ed25519_d2i_key_params         NULL
+#  define ed25519_d2i_PKCS8              ecx_d2i_PKCS8
+#  define ed25519_d2i_PUBKEY             (d2i_of_void *)ossl_d2i_ED25519_PUBKEY
+#  define ed25519_free                   (free_key_fn *)ossl_ecx_key_free
+#  define ed25519_check                  NULL
+#  define ed25519_adjust                 ecx_key_adjust
+
+#  define ed448_evp_type                 EVP_PKEY_ED448
+#  define ed448_d2i_private_key          NULL
+#  define ed448_d2i_public_key           NULL
+#  define ed448_d2i_key_params           NULL
+#  define ed448_d2i_PKCS8                ecx_d2i_PKCS8
+#  define ed448_d2i_PUBKEY               (d2i_of_void *)ossl_d2i_ED448_PUBKEY
+#  define ed448_free                     (free_key_fn *)ossl_ecx_key_free
+#  define ed448_check                    NULL
+#  define ed448_adjust                   ecx_key_adjust
+
+#  define x25519_evp_type                EVP_PKEY_X25519
+#  define x25519_d2i_private_key         NULL
+#  define x25519_d2i_public_key          NULL
+#  define x25519_d2i_key_params          NULL
+#  define x25519_d2i_PKCS8               ecx_d2i_PKCS8
+#  define x25519_d2i_PUBKEY              (d2i_of_void *)ossl_d2i_X25519_PUBKEY
+#  define x25519_free                    (free_key_fn *)ossl_ecx_key_free
+#  define x25519_check                   NULL
+#  define x25519_adjust                  ecx_key_adjust
+
+#  define x448_evp_type                  EVP_PKEY_X448
+#  define x448_d2i_private_key           NULL
+#  define x448_d2i_public_key            NULL
+#  define x448_d2i_key_params            NULL
+#  define x448_d2i_PKCS8                 ecx_d2i_PKCS8
+#  define x448_d2i_PUBKEY                (d2i_of_void *)ossl_d2i_X448_PUBKEY
+#  define x448_free                      (free_key_fn *)ossl_ecx_key_free
+#  define x448_check                     NULL
+#  define x448_adjust                    ecx_key_adjust
+# endif /* OPENSSL_NO_ECX */
 
 # ifndef OPENSSL_NO_SM2
 #  define sm2_evp_type                  EVP_PKEY_SM2
@@ -773,6 +775,7 @@ MAKE_DECODER("EC", ec, ec, PrivateKeyInfo);
 MAKE_DECODER("EC", ec, ec, SubjectPublicKeyInfo);
 MAKE_DECODER("EC", ec, ec, type_specific_no_pub);
 MAKE_DECODER("EC", ec, ec, EC);
+# ifndef OPENSSL_NO_ECX
 MAKE_DECODER("X25519", x25519, ecx, PrivateKeyInfo);
 MAKE_DECODER("X25519", x25519, ecx, SubjectPublicKeyInfo);
 MAKE_DECODER("X448", x448, ecx, PrivateKeyInfo);
@@ -781,6 +784,7 @@ MAKE_DECODER("ED25519", ed25519, ecx, PrivateKeyInfo);
 MAKE_DECODER("ED25519", ed25519, ecx, SubjectPublicKeyInfo);
 MAKE_DECODER("ED448", ed448, ecx, PrivateKeyInfo);
 MAKE_DECODER("ED448", ed448, ecx, SubjectPublicKeyInfo);
+# endif
 # ifndef OPENSSL_NO_SM2
 MAKE_DECODER("SM2", sm2, ec, PrivateKeyInfo);
 MAKE_DECODER("SM2", sm2, ec, SubjectPublicKeyInfo);
diff --git a/providers/implementations/encode_decode/encode_key2any.c b/providers/implementations/encode_decode/encode_key2any.c
index 55b2b56766..df0b0fd608 100644
--- a/providers/implementations/encode_decode/encode_key2any.c
+++ b/providers/implementations/encode_decode/encode_key2any.c
@@ -748,7 +748,7 @@ static int ec_pki_priv_to_der(const void *veckey, unsigned char **pder)
 
 /* ---------------------------------------------------------------------- */
 
-#ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_ECX
 # define prepare_ecx_params NULL
 
 static int ecx_spki_pub_to_der(const void *vecxkey, unsigned char **pder)
@@ -1391,6 +1391,7 @@ MAKE_ENCODER(sm2, ec, EVP_PKEY_EC, PrivateKeyInfo, pem);
 MAKE_ENCODER(sm2, ec, EVP_PKEY_EC, SubjectPublicKeyInfo, der);
 MAKE_ENCODER(sm2, ec, EVP_PKEY_EC, SubjectPublicKeyInfo, pem);
 # endif
+# ifndef OPENSSL_NO_ECX
 MAKE_ENCODER(ed25519, ecx, EVP_PKEY_ED25519, EncryptedPrivateKeyInfo, der);
 MAKE_ENCODER(ed25519, ecx, EVP_PKEY_ED25519, EncryptedPrivateKeyInfo, pem);
 MAKE_ENCODER(ed25519, ecx, EVP_PKEY_ED25519, PrivateKeyInfo, der);
@@ -1415,6 +1416,7 @@ MAKE_ENCODER(x448, ecx, EVP_PKEY_ED448, PrivateKeyInfo, der);
 MAKE_ENCODER(x448, ecx, EVP_PKEY_ED448, PrivateKeyInfo, pem);
 MAKE_ENCODER(x448, ecx, EVP_PKEY_ED448, SubjectPublicKeyInfo, der);
 MAKE_ENCODER(x448, ecx, EVP_PKEY_ED448, SubjectPublicKeyInfo, pem);
+# endif
 #endif
 
 /*
diff --git a/providers/implementations/encode_decode/encode_key2text.c b/providers/implementations/encode_decode/encode_key2text.c
index ff4de1926f..1692c1da64 100644
--- a/providers/implementations/encode_decode/encode_key2text.c
+++ b/providers/implementations/encode_decode/encode_key2text.c
@@ -566,7 +566,7 @@ err:
 
 /* ---------------------------------------------------------------------- */
 
-#ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_ECX
 static int ecx_to_text(BIO *out, const void *key, int selection)
 {
     const ECX_KEY *ecx = key;
@@ -882,10 +882,12 @@ MAKE_TEXT_ENCODER(ec, ec);
 # ifndef OPENSSL_NO_SM2
 MAKE_TEXT_ENCODER(sm2, ec);
 # endif
+# ifndef OPENSSL_NO_ECX
 MAKE_TEXT_ENCODER(ed25519, ecx);
 MAKE_TEXT_ENCODER(ed448, ecx);
 MAKE_TEXT_ENCODER(x25519, ecx);
 MAKE_TEXT_ENCODER(x448, ecx);
+# endif
 #endif
 MAKE_TEXT_ENCODER(rsa, rsa);
 MAKE_TEXT_ENCODER(rsapss, rsa);
diff --git a/providers/implementations/exchange/build.info b/providers/implementations/exchange/build.info
index 3c1e5c58f1..0333c9f49c 100644
--- a/providers/implementations/exchange/build.info
+++ b/providers/implementations/exchange/build.info
@@ -21,8 +21,10 @@ IF[{- !$disabled{asm} -}]
 ENDIF
 
 IF[{- !$disabled{ec} -}]
-  SOURCE[$ECX_GOAL]=ecx_exch.c
-  DEFINE[$ECX_GOAL]=$ECDEF
+  IF[{- !$disabled{ecx} -}]
+    SOURCE[$ECX_GOAL]=ecx_exch.c
+    DEFINE[$ECX_GOAL]=$ECDEF
+  ENDIF
   SOURCE[$ECDH_GOAL]=ecdh_exch.c
 ENDIF
 
diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h
index 804763159a..2c3c54155f 100644
--- a/providers/implementations/include/prov/implementations.h
+++ b/providers/implementations/include/prov/implementations.h
@@ -300,10 +300,12 @@ extern const OSSL_DISPATCH ossl_dhx_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_dsa_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_rsa_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_rsapss_keymgmt_functions[];
+#ifndef OPENSSL_NO_ECX
 extern const OSSL_DISPATCH ossl_x25519_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_x448_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_ed25519_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_ed448_keymgmt_functions[];
+#endif
 extern const OSSL_DISPATCH ossl_ec_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_kdf_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_mac_legacy_keymgmt_functions[];
diff --git a/providers/implementations/kem/build.info b/providers/implementations/kem/build.info
index 6addb9b2c7..d6a6698da1 100644
--- a/providers/implementations/kem/build.info
+++ b/providers/implementations/kem/build.info
@@ -7,5 +7,8 @@ $EC_KEM_GOAL=../../libdefault.a
 SOURCE[$RSA_KEM_GOAL]=rsa_kem.c
 
 IF[{- !$disabled{ec} -}]
-  SOURCE[$EC_KEM_GOAL]=ecx_kem.c kem_util.c ec_kem.c
+  SOURCE[$EC_KEM_GOAL]=kem_util.c ec_kem.c
+  IF[{- !$disabled{ecx} -}]
+    SOURCE[$EC_KEM_GOAL]=ecx_kem.c
+  ENDIF
 ENDIF
diff --git a/providers/implementations/keymgmt/build.info b/providers/implementations/keymgmt/build.info
index 0d86907aed..6fb506b5a9 100644
--- a/providers/implementations/keymgmt/build.info
+++ b/providers/implementations/keymgmt/build.info
@@ -30,8 +30,10 @@ IF[{- !$disabled{asm} -}]
 ENDIF
 
 IF[{- !$disabled{ec} -}]
-  SOURCE[$ECX_GOAL]=ecx_kmgmt.c
-  DEFINE[$ECX_GOAL]=$ECDEF
+  IF[{- !$disabled{ecx} -}]
+    SOURCE[$ECX_GOAL]=ecx_kmgmt.c
+    DEFINE[$ECX_GOAL]=$ECDEF
+  ENDIF
 ENDIF
 
 SOURCE[$RSA_GOAL]=rsa_kmgmt.c
diff --git a/providers/implementations/signature/build.info b/providers/implementations/signature/build.info
index fd3be7f3b9..6987a12250 100644
--- a/providers/implementations/signature/build.info
+++ b/providers/implementations/signature/build.info
@@ -12,7 +12,10 @@ IF[{- !$disabled{dsa} -}]
 ENDIF
 
 IF[{- !$disabled{ec} -}]
-  SOURCE[$EC_GOAL]=eddsa_sig.c ecdsa_sig.c
+  SOURCE[$EC_GOAL]=ecdsa_sig.c
+  IF[{- !$disabled{ecx} -}]
+    SOURCE[$EC_GOAL]=eddsa_sig.c
+  ENDIF
 ENDIF
 
 IF[{- !$disabled{sm2} -}]