provider hash-then-sign support

[GauriSpears]

raw SIGN/VERIFY (hash-then-sign) support

Problem

Node.js createSign('md_gost12_256').update(...).sign(key) ends in OpenSSL as:

1. hash message → digest bytes
2. EVP_PKEY_sign_init
3. EVP_PKEY_CTX_set_signature_md(md)
4. EVP_PKEY_sign(digest)

That requires the provider to export OSSL_FUNC_SIGNATURE_SIGN_INIT / SIGN (and verify counterparts) plus SET_CTX_PARAMS for the digest.

gost_prov_signature.c only registered DIGEST_SIGN / DIGEST_VERIFY.
Result: ERR_OSSL_EVP_PROVIDER_SIGNATURE_NOT_SUPPORTED (provider signature not supported).

crypto.sign('md_gost12_256', data, key) uses DigestSign and workes.

So in Node.JS:

const fs = require('fs');
const crypto = require('crypto');
const privateKey = fs.readFileSync('../key.pem');
const publicKey = fs.readFileSync('../cer.cer');

//it works:
const SignatureValue = crypto.sign('md_gost12_256', 'this is test string', privateKey);

//it fails:
const sign = crypto.createSign('md_gost12_256');
sign.update('this is test string');
const SignatureValue2 = sign.sign(privateKey,'base64');

//it works:
crypto.verify('md_gost12_256', 'this is test string', publicKey, SignatureValue);

//it fails:
const verify = crypto.createVerify('md_gost12_256');
verify.update('this is test string');
verify.verify(publicKey, SignatureValue , 'base64');

Fix

In gost_prov_signature.c:

• Implement signature_sign_init / signature_sign / signature_verify_init / signature_verify calling existing internal_pkey_ec_cp_sign / verify.
• Register them in id_signature_functions.
• Export SET_CTX_PARAMS / SETTABLE_CTX_PARAMS (handler already existed).

[chipitsine]

thank you for contribution.

do you plan to add tests as well ?

[GauriSpears]

thank you for contribution.

do you plan to add tests as well ?

Yes, I've got a clue, how to test it without Node.js.