Correction: my rationale for this patch was wrong.
Implicit digests DO reach providers. evp_md_init_internal() re-fetches an MD
with type->prov == NULL by name, so EVP_sha256() and EVP_get_digestbynid()
end up provider-backed. The probe I cited measured ctx->reqdigest, the MD
passed in, not the one used. Details and a corrected probe are on the
cryptohash thread [1].
So this patch is not a bypass fix. What survives: the internal fetch
hardcodes libctx=NULL and propq="", so a non-default OSSL_LIB_CTX gets no
provider control, and a registered ENGINE bypasses providers outright.
Control and clarity, not bypass.
Michael, you named channel binding as your interest, so you should have that
before spending time on it. The patch behavior is unchanged, and the question
about freeing the EVP_MD on every error path still stands.
Repost on the narrower basis, or withdraw?
[1] https://postgr.es/m/178596055358.1584287.8485463954311014881%40reviewcommit.com
--
Mark
