OpenSSL ENGINE support

src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EvpPkey.cs

@@ -214,6 +214,52 @@ internal static ArraySegment<byte> RentEncodeSubjectPublicKeyInfo(SafeEvpPKeyHan
  }
  }
 
+ [LibraryImport(Libraries.CryptoNative, StringMarshalling = StringMarshalling.Utf8)]
+ private static partial SafeEvpPKeyHandle CryptoNative_LoadPrivateKeyFromEngine(
+ string engineName,
+ string keyName);
+
+ internal static SafeEvpPKeyHandle LoadPrivateKeyFromEngine(
+ string engineName,
+ string keyName)
+ {
+ Debug.Assert(engineName is not null);
+ Debug.Assert(keyName is not null);
+
+ SafeEvpPKeyHandle pkey = CryptoNative_LoadPrivateKeyFromEngine(engineName, keyName);
+
+ if (pkey.IsInvalid)
+ {
+ pkey.Dispose();
+ throw CreateOpenSslCryptographicException();
+ }
+
+ return pkey;
+ }
+
+ [LibraryImport(Libraries.CryptoNative, StringMarshalling = StringMarshalling.Utf8)]
+ private static partial SafeEvpPKeyHandle CryptoNative_LoadPublicKeyFromEngine(
+ string engineName,
+ string keyName);
+
+ internal static SafeEvpPKeyHandle LoadPublicKeyFromEngine(
+ string engineName,
+ string keyName)
+ {
+ Debug.Assert(engineName is not null);
+ Debug.Assert(keyName is not null);
+
+ SafeEvpPKeyHandle pkey = CryptoNative_LoadPublicKeyFromEngine(engineName, keyName);
+
+ if (pkey.IsInvalid)
+ {
+ pkey.Dispose();
+ throw CreateOpenSslCryptographicException();
+ }
+
+ return pkey;
+ }
+
  internal enum EvpAlgorithmId
  {
  Unknown = 0,

src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Unix.cs

@@ -111,7 +111,7 @@ public static bool OpenSslPresentOnSystem
  {
  get
  {
- if (IsAndroid || UsesMobileAppleCrypto || IsBrowser)
+ if (IsWindows || IsAndroid || UsesMobileAppleCrypto || IsBrowser)
  {
  return false;
  }

src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs

@@ -253,6 +253,7 @@ public static bool IsMetadataTokenSupported
  public static bool IsNotDomainJoinedMachine => !IsDomainJoinedMachine;
 
  public static bool IsOpenSslSupported => IsLinux || IsFreeBSD || Isillumos || IsSolaris;
+ public static bool OpenSslNotPresentOnSystem => !OpenSslPresentOnSystem;
 
  public static bool UsesAppleCrypto => IsOSX || IsMacCatalyst || IsiOS || IstvOS;
  public static bool UsesMobileAppleCrypto => IsMacCatalyst || IsiOS || IstvOS;

src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs

@@ -2245,6 +2245,18 @@ public sealed partial class SafeEvpPKeyHandle : System.Runtime.InteropServices.S
  [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("windows")]
  public static long OpenSslVersion { get { throw null; } }
  public System.Security.Cryptography.SafeEvpPKeyHandle DuplicateHandle() { throw null; }
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("android")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("browser")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("ios")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("tvos")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("windows")]
+ public static System.Security.Cryptography.SafeEvpPKeyHandle OpenPrivateKeyFromEngine(string engineName, string keyId) { throw null; }
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("android")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("browser")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("ios")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("tvos")]
+ [System.Runtime.Versioning.UnsupportedOSPlatformAttribute("windows")]
+ public static System.Security.Cryptography.SafeEvpPKeyHandle OpenPublicKeyFromEngine(string engineName, string keyId) { throw null; }
  protected override bool ReleaseHandle() { throw null; }
  }
  public abstract partial class SHA1 : System.Security.Cryptography.HashAlgorithm

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/OpenSsl.NotSupported.cs

@@ -263,6 +263,22 @@ public SafeEvpPKeyHandle(IntPtr handle, bool ownsHandle) : base(handle, ownsHand
  public static long OpenSslVersion =>
  throw new PlatformNotSupportedException(SR.PlatformNotSupported_CryptographyOpenSSL);
 
+ [UnsupportedOSPlatform("android")]
+ [UnsupportedOSPlatform("browser")]
+ [UnsupportedOSPlatform("ios")]
+ [UnsupportedOSPlatform("tvos")]
+ [UnsupportedOSPlatform("windows")]
+ public static SafeEvpPKeyHandle OpenPrivateKeyFromEngine(string engineName, string keyId) =>
+ throw new PlatformNotSupportedException(SR.PlatformNotSupported_CryptographyOpenSSL);
+
+ [UnsupportedOSPlatform("android")]
+ [UnsupportedOSPlatform("browser")]
+ [UnsupportedOSPlatform("ios")]
+ [UnsupportedOSPlatform("tvos")]
+ [UnsupportedOSPlatform("windows")]
+ public static SafeEvpPKeyHandle OpenPublicKeyFromEngine(string engineName, string keyId) =>
+ throw new PlatformNotSupportedException(SR.PlatformNotSupported_CryptographyOpenSSL);
+
  public SafeEvpPKeyHandle DuplicateHandle() => null!;
  public override bool IsInvalid => true;
  protected override bool ReleaseHandle() => false;

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/SafeEvpPKeyHandle.OpenSsl.cs

@@ -86,5 +86,110 @@ public SafeEvpPKeyHandle DuplicateHandle()
  [UnsupportedOSPlatform("tvos")]
  [UnsupportedOSPlatform("windows")]
  public static long OpenSslVersion { get; } = Interop.OpenSsl.OpenSslVersionNumber();
+
+ /// <summary>
+ /// Open a named private key using a named OpenSSL <code>ENGINE</code>.
+ /// </summary>
+ /// <param name="engineName">
+ /// The name of the <code>ENGINE</code> to process the private key open request.
+ /// </param>
+ /// <param name="keyId">
+ /// The name of the key to open.
+ /// </param>
+ /// <returns>
+ /// The opened key.
+ /// </returns>
+ /// <exception cref="ArgumentNullException">
+ /// <paramref name="engineName"/> or <paramref name="keyId"/> is <see langword="null" />.
+ /// </exception>
+ /// <exception cref="ArgumentException">
+ /// <paramref name="engineName"/> or <paramref name="keyId"/> is the empty string.
+ /// </exception>
+ /// <exception cref="CryptographicException">
+ /// the key could not be opened via the specified ENGINE.
+ /// </exception>
+ /// <remarks>
+ /// <para>
+ /// This operation will fail if OpenSSL cannot successfully load the named <code>ENGINE</code>,
+ /// or if the named <code>ENGINE</code> cannot load the named key.
+ /// </para>
+ /// <para>
+ /// Not all <code>ENGINE</code>s support loading private keys.
+ /// </para>
+ /// <para>
+ /// The syntax for <paramref name="keyId"/> is determined by each individual
+ /// <code>ENGINE</code>.
+ /// </para>
+ /// </remarks>
+ [UnsupportedOSPlatform("android")]
+ [UnsupportedOSPlatform("browser")]
+ [UnsupportedOSPlatform("ios")]
+ [UnsupportedOSPlatform("tvos")]
+ [UnsupportedOSPlatform("windows")]
+ public static SafeEvpPKeyHandle OpenPrivateKeyFromEngine(string engineName, string keyId)
+ {
+ ArgumentException.ThrowIfNullOrEmpty(engineName);
+ ArgumentException.ThrowIfNullOrEmpty(keyId);
+
+ if (!Interop.OpenSslNoInit.OpenSslIsAvailable)
+ {
+ throw new PlatformNotSupportedException(SR.PlatformNotSupported_CryptographyOpenSSL);
+ }
+
+ return Interop.Crypto.LoadPrivateKeyFromEngine(engineName, keyId);
+ }
+
+ /// <summary>
+ /// Open a named public key using a named OpenSSL <code>ENGINE</code>.
+ /// </summary>
+ /// <param name="engineName">
+ /// The name of the <code>ENGINE</code> to process the public key open request.
+ /// </param>
+ /// <param name="keyId">
+ /// The name of the key to open.
+ /// </param>
+ /// <returns>
+ /// The opened key.
+ /// </returns>
+ /// <exception cref="ArgumentNullException">
+ /// <paramref name="engineName"/> or <paramref name="keyId"/> is <see langword="null" />.
+ /// </exception>
+ /// <exception cref="ArgumentException">
+ /// <paramref name="engineName"/> or <paramref name="keyId"/> is the empty string.
+ /// </exception>
+ /// <exception cref="CryptographicException">
+ /// the key could not be opened via the specified ENGINE.
+ /// </exception>
+ /// <remarks>
+ /// <para>
+ /// This operation will fail if OpenSSL cannot successfully load the named <code>ENGINE</code>,
+ /// or if the named <code>ENGINE</code> cannot load the named key.
+ /// </para>
+ /// <para>
+ /// Not all <code>ENGINE</code>s support loading public keys, even ones that support
+ /// loading private keys.
+ /// </para>
+ /// <para>
+ /// The syntax for <paramref name="keyId"/> is determined by each individual
+ /// <code>ENGINE</code>.
+ /// </para>
+ /// </remarks>
+ [UnsupportedOSPlatform("android")]
+ [UnsupportedOSPlatform("browser")]
+ [UnsupportedOSPlatform("ios")]
+ [UnsupportedOSPlatform("tvos")]
+ [UnsupportedOSPlatform("windows")]
+ public static SafeEvpPKeyHandle OpenPublicKeyFromEngine(string engineName, string keyId)
+ {
+ ArgumentException.ThrowIfNullOrEmpty(engineName);
+ ArgumentException.ThrowIfNullOrEmpty(keyId);
+
+ if (!Interop.OpenSslNoInit.OpenSslIsAvailable)
+ {
+ throw new PlatformNotSupportedException(SR.PlatformNotSupported_CryptographyOpenSSL);
+ }
+
+ return Interop.Crypto.LoadPublicKeyFromEngine(engineName, keyId);
+ }
  }
 }