Support serializing SymCrypt hash objects

const.go

@@ -50,7 +50,7 @@ const ( //checkheader:ignore
 	// KDF names
 	_OSSL_KDF_NAME_HKDF      cString = "HKDF\x00"
 	_OSSL_KDF_NAME_PBKDF2    cString = "PBKDF2\x00"
-	_OSSL_KDF_NAME_TLS1_PRF	 cString = "TLS1-PRF\x00"
+	_OSSL_KDF_NAME_TLS1_PRF  cString = "TLS1-PRF\x00"
 	_OSSL_KDF_NAME_TLS13_KDF cString = "TLS13-KDF\x00"
 	_OSSL_MAC_NAME_HMAC      cString = "HMAC\x00"
 

evp.go

@@ -63,11 +63,22 @@ func hashFuncToMD(fn func() hash.Hash) (ossl.EVP_MD_PTR, error) {
 	return md, nil
 }
 
+// provider is an identifier for a known provider.
+type provider uint8
+
+const (
+	providerNone provider = iota
+	providerOSSLDefault
+	providerOSSLFIPS
+	providerSymCrypt
+)
+
 type hashAlgorithm struct {
 	md             ossl.EVP_MD_PTR
 	ch             crypto.Hash
 	size           int
 	blockSize      int
+	provider       provider
 	marshallable   bool
 	magic          string
 	marshalledSize int
@@ -87,14 +98,14 @@ func loadHash(ch crypto.Hash) *hashAlgorithm {
 		hash.md = ossl.EVP_md4()
 	case crypto.MD5:
 		hash.md = ossl.EVP_md5()
-		hash.magic = md5Magic
-		hash.marshalledSize = md5MarshaledSize
+		hash.magic = magicMD5
+		hash.marshalledSize = marshaledSizeMD5
 	case crypto.MD5SHA1:
 		hash.md = ossl.EVP_md5_sha1()
 	case crypto.SHA1:
 		hash.md = ossl.EVP_sha1()
-		hash.magic = sha1Magic
-		hash.marshalledSize = sha1MarshaledSize
+		hash.magic = magic1
+		hash.marshalledSize = marshaledSize1
 	case crypto.SHA224:
 		hash.md = ossl.EVP_sha224()
 		hash.magic = magic224
@@ -159,7 +170,34 @@ func loadHash(ch crypto.Hash) *hashAlgorithm {
 			hash.md = md
 		}
 	}
-	hash.marshallable = hash.magic != "" && isHashMarshallable(hash.md)
+	if hash.magic != "" {
+		if hash.marshalledSize == 0 {
+			panic("marshalledSize must be set for " + hash.magic)
+		}
+	}
+
+	switch vMajor {
+	case 1:
+		hash.provider = providerOSSLDefault
+	case 3:
+		if prov := ossl.EVP_MD_get0_provider(hash.md); prov != nil {
+			cname := ossl.OSSL_PROVIDER_get0_name(prov)
+			switch C.GoString((*C.char)(unsafe.Pointer(cname))) {
+			case "default":
+				hash.provider = providerOSSLDefault
+				hash.marshallable = hash.magic != ""
+			case "fips":
+				hash.provider = providerOSSLFIPS
+				hash.marshallable = hash.magic != ""
+			case "symcryptprovider":
+				hash.provider = providerSymCrypt
+				hash.marshallable = hash.magic != "" && isSymCryptHashStateSerializable(hash.md)
+			}
+		}
+	default:
+		panic(errUnsupportedVersion())
+	}
+
 	cacheMD.Store(ch, &hash)
 	return &hash
 }