Prefer using non-deprecated EC OSSL APIs where possible by PranavSenthilnathan · Pull Request #127190 · dotnet/runtime

PranavSenthilnathan · 2026-04-20T23:34:49Z

Adds new native entry points that use the modern OpenSSL 3.0 EVP_PKEY parameter and keygen APIs for EC key
generation, import, and export, avoiding the deprecated EC_KEY APIs where possible.

On pre-3.0 OpenSSL, the existing EC_KEY code paths are preserved as fallbacks. All new lightup APIs are guarded with
API_EXISTS under FEATURE_DISTRO_AGNOSTIC_SSL.

Unified EC APIs (EC_GROUP_get/set_curve, EC_POINT_get/set_affine_coordinates) are promoted to REQUIRED (available
since OpenSSL 1.1.1, which is the minimum supported version).

dotnet-policy-service · 2026-04-20T23:35:40Z

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR introduces new OpenSSL 3.0+ EVP_PKEY-based EC key generation/import paths (to avoid deprecated EC_KEY APIs where possible), with managed code updated to prefer these paths and fall back to legacy behavior when needed.

Changes:

Add native CryptoNative exports to generate/import EC keys via EVP_PKEY (named curves and explicit parameters).
Update managed ECOpenSsl/ECDH code to use the new EVP_PKEY paths first, with legacy EC_KEY fallback.
Extend the OpenSSL shim to light up additional OpenSSL 3.0 param-building/keygen APIs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.h	Adds new native API declarations for EVP_PKEY EC key generation/import.
src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c	Implements EVP_PKEY-based EC keygen and fromdata import (named + explicit).
src/native/libs/System.Security.Cryptography.Native/opensslshim.h	Lights up OpenSSL 3.0 param_build and related functions used by new native code.
src/native/libs/System.Security.Cryptography.Native/entrypoints.c	Exposes the new native functions via the CryptoNative entrypoint table.
src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs	Prefers EVP_PKEY EC keygen/import for OpenSSL 3.0 with fallback to EC_KEY.
src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs	Stores/uses EVP_PKEY handles directly instead of wrapping EC_KEY.
src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs	Uses EVP_PKEY curve-name detection and imports via new ECOpenSsl helpers.
src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs	Adds P/Invoke wrappers for the new CryptoNative EVP_PKEY EC APIs.

Copilot · 2026-04-20T23:40:06Z

        internal static SafeEvpPKeyHandle GenerateECKey(ECCurve curve, out int keySize)
        {
-            return  ImportECKeyCore(new ECOpenSsl(curve), out keySize);
+            if (curve.IsNamed)
+            {
+                string oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName!;
+
+                SafeEvpPKeyHandle? pkey = Interop.Crypto.EvpPKeyGenerateByEcKeyOid(oid);


GenerateECKey(ECCurve curve, out int keySize) uses curve.Oid.Value / curve.Oid.FriendlyName! without calling curve.Validate() first. Since ECCurve is a struct, callers can pass a default/invalid named curve (e.g., CurveType = Named with Oid == null), which would currently throw a NullReferenceException instead of the expected crypto/PlatformNotSupported exception. Consider calling curve.Validate() up front (matching ECOpenSsl.GenerateKey) before trying the EVP_PKEY path/fallback.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 13 comments.

Copilot · 2026-04-22T23:23:51Z

        internal static SafeEvpPKeyHandle GenerateECKey(ECCurve curve, out int keySize)
        {
-            return  ImportECKeyCore(new ECOpenSsl(curve), out keySize);
+            if (curve.IsNamed)
+            {
+                string oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName!;
+
+                SafeEvpPKeyHandle? pkey = Interop.Crypto.EvpPKeyGenerateByEcKeyOid(oid);
+
+                if (pkey is not null)
+                {
+                    keySize = Interop.Crypto.EvpPKeyGetEcFieldDegree(pkey);
+                    return pkey;
+                }
+            }
+            else if (curve.IsPrime || curve.IsCharacteristic2)
+            {
+                byte[] pField = curve.IsPrime ? curve.Prime! : curve.Polynomial!;
+


GenerateECKey(ECCurve curve, ...) now reads explicit-curve fields (Prime/Polynomial/A/B/G/Order/Cofactor) without validating the input first. This can throw NullReferenceException for malformed curves and bypass the normal curve.Validate() error behavior. Consider calling curve.Validate() at the start (matching ECOpenSsl.GenerateKey) before branching on curve.IsNamed/IsPrime/....

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Copilot · 2026-04-24T18:50:02Z

    REQUIRED_FUNCTION(EC_GROUP_get0_seed) \
    REQUIRED_FUNCTION(EC_GROUP_get_cofactor) \
    REQUIRED_FUNCTION(EC_GROUP_get_curve_GFp) \
+    REQUIRED_FUNCTION(EC_GROUP_get_curve) \


The shim marks EC_GROUP_get_curve as a REQUIRED function, but this symbol is not declared in osslcompat_30.h and is not available on OpenSSL < 3.0. This will break portable builds (compile-time) and/or runtime loading on systems with OpenSSL 1.x. Consider making this a LIGHTUP function and only calling it under NEED_OPENSSL_3_0, with the existing EC_GROUP_get_curve_GFp/GF2m fallback for older versions.

Suggested change

REQUIRED_FUNCTION(EC_GROUP_get_curve) \

LIGHTUP_FUNCTION(EC_GROUP_get_curve) \

EC_GROUP_get_curve is available in 1.1.1.

Copilot · 2026-04-24T18:50:02Z

    REQUIRED_FUNCTION(EC_POINT_get_affine_coordinates_GFp) \
+    REQUIRED_FUNCTION(EC_POINT_get_affine_coordinates) \
    REQUIRED_FUNCTION(EC_POINT_mul) \
    REQUIRED_FUNCTION(EC_POINT_new) \
+    REQUIRED_FUNCTION(EC_POINT_point2oct) \


The shim adds the generic EC_POINT_get_affine_coordinates / EC_POINT_set_affine_coordinates / EC_POINT_point2oct as REQUIRED functions. These APIs are OpenSSL 3.x additions and will prevent loading against OpenSSL 1.x in distro-agnostic builds. These should be LIGHTUP (or wrapped) and only used when NEED_OPENSSL_3_0 is in effect, with GFp/GF2m alternatives otherwise.

These are available in 1.1.1.

Copilot · 2026-04-24T18:50:03Z

-#endif
-
-    return 1;
+    return EC_POINT_get_affine_coordinates(group, p, x, y, NULL) ? 1 : 0;


EcPointGetAffineCoordinates now unconditionally calls EC_POINT_get_affine_coordinates, which is not available on OpenSSL < 3.0. This will break builds targeting OpenSSL 1.x. Please keep the previous GFp/GF2m branching for older OpenSSL, and only use EC_POINT_get_affine_coordinates when building/running with OpenSSL 3 (NEED_OPENSSL_3_0 + API_EXISTS).

Suggested change

return EC_POINT_get_affine_coordinates(group, p, x, y, NULL) ? 1 : 0;

#ifdef NEED_OPENSSL_3_0

if (API_EXISTS(EC_POINT_get_affine_coordinates))

return EC_POINT_get_affine_coordinates(group, p, x, y, NULL) ? 1 : 0;

#endif

const EC_METHOD* method = EC_GROUP_method_of(group);

if (method == NULL)

return 0;

switch (MethodToCurveType(method))

{

case PrimeMontgomery:

case PrimeShortWeierstrass:

return EC_POINT_get_affine_coordinates_GFp(group, p, x, y, NULL) ? 1 : 0;

#if HAVE_OPENSSL_EC2M

case Characteristic2:

if (API_EXISTS(EC_POINT_get_affine_coordinates_GF2m))

return EC_POINT_get_affine_coordinates_GF2m(group, p, x, y, NULL) ? 1 : 0;

return 0;

#endif

default:

return 0;

}

They're in OSSL 1.1.1.

Copilot · 2026-04-24T18:50:03Z

+    if (!EC_GROUP_get_curve(group, pBn, aBn, bBn, NULL))
+        goto error;


CryptoNative_GetECCurveParameters switched to EC_GROUP_get_curve, which is an OpenSSL 3.x API and isn’t declared in osslcompat_30.h. This will fail to compile when building against OpenSSL < 3.0. Please keep the existing EC_GROUP_get_curve_GFp/GF2m fallback for older OpenSSL, and only call EC_GROUP_get_curve when OpenSSL 3 APIs are available.

They're in OSSL 1.1.1.

Copilot · 2026-04-24T18:50:03Z

+    if (!EC_GROUP_set_curve(group, pBn, aBn, bBn, NULL))
+        goto error;


CryptoNative_EcKeyCreateByExplicitParameters now calls EC_GROUP_set_curve / EC_POINT_set_affine_coordinates, which are OpenSSL 3.x APIs. Since this function is used for OpenSSL 1.x builds too, it needs to retain the GFp/GF2m variants (or otherwise guard these calls under NEED_OPENSSL_3_0 with fallbacks).

They're in OSSL 1.1.1.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Copilot · 2026-04-24T19:22:01Z

+    int nid = 0;
+    if (CryptoNative_EvpPKeyGetEcGroupNid(pkey, &nid) && nid != NID_undef)
+    {
+        EC_GROUP* group = EC_GROUP_new_by_curve_name(nid);
+        if (group)
+        {
+            isChar2 = (EC_GROUP_get_field_type(group) == NID_X9_62_characteristic_two_field);
+            EC_GROUP_free(group);
+        }
+    }


CryptoNative_EvpPKeyGetEcFieldDegree only falls back to reading OSSL_PKEY_PARAM_EC_FIELD_TYPE when CryptoNative_EvpPKeyGetEcGroupNid fails. If the NID is available but EC_GROUP_new_by_curve_name(nid) fails (returns NULL), isChar2 stays at the default (prime-field) and the degree calculation for binary curves will be wrong. Consider adding a fallback to query OSSL_PKEY_PARAM_EC_FIELD_TYPE when group could not be created as well.

If nid is available then group creation should not fail.

Copilot · 2026-04-24T19:22:01Z

+    if (!API_EXISTS(EVP_PKEY_fromdata) ||
+        !API_EXISTS(EVP_PKEY_fromdata_init) ||
+        !API_EXISTS(EVP_PKEY_CTX_new_from_name) ||
+        !API_EXISTS(OSSL_PARAM_BLD_new))


In the portable (FEATURE_DISTRO_AGNOSTIC_SSL) build, this function gates on OSSL_PARAM_BLD_new but then unconditionally calls other OSSL_PARAM_BLD_* and OSSL_PARAM_free symbols. Since these are LIGHTUP functions in the shim, the guard should also verify all required OSSL_PARAM_BLD_push_*, OSSL_PARAM_BLD_to_param, OSSL_PARAM_BLD_free, and OSSL_PARAM_free APIs are present to avoid calling through a missing function pointer at runtime.

Suggested change

!API_EXISTS(OSSL_PARAM_BLD_new))

!API_EXISTS(OSSL_PARAM_BLD_new) ||

!API_EXISTS(OSSL_PARAM_BLD_push_utf8_string) ||

!API_EXISTS(OSSL_PARAM_BLD_push_octet_string) ||

!API_EXISTS(OSSL_PARAM_BLD_to_param) ||

!API_EXISTS(OSSL_PARAM_BLD_free) ||

!API_EXISTS(OSSL_PARAM_free))

_new should cover all the others too since they were shipped together.

Copilot · 2026-04-24T19:22:01Z

+        !API_EXISTS(EVP_PKEY_CTX_new_from_name) ||
+        !API_EXISTS(EVP_PKEY_CTX_new_from_pkey) ||
+        !API_EXISTS(EVP_PKEY_generate) ||
+        !API_EXISTS(OSSL_PARAM_BLD_new))


Same as above: the FEATURE_DISTRO_AGNOSTIC_SSL guard only checks OSSL_PARAM_BLD_new, but the implementation relies on multiple OSSL_PARAM_BLD_* functions and OSSL_PARAM_free. Please extend the API_EXISTS checks to cover every LIGHTUP symbol used in this code path so portable builds running on older OpenSSL versions don’t crash when a symbol is absent.

Suggested change

!API_EXISTS(OSSL_PARAM_BLD_new))

!API_EXISTS(OSSL_PARAM_BLD_new) ||

!API_EXISTS(OSSL_PARAM_BLD_push_BN) ||

!API_EXISTS(OSSL_PARAM_BLD_push_octet_string) ||

!API_EXISTS(OSSL_PARAM_BLD_to_param) ||

!API_EXISTS(OSSL_PARAM_BLD_free) ||

!API_EXISTS(OSSL_PARAM_free))

_new should cover all the others too since they were shipped together.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

…precations-ec

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Copilot · 2026-04-24T23:26:24Z

+                bool? explicitEncoding = Interop.Crypto.EvpPKeyEcHasExplicitEncoding(_key.Value);
+                if (explicitEncoding.HasValue)
                {
-                    // This may happen when EVP_PKEY was created by provider and getting EC_KEY is not possible.
-                    thisIsNamed = Interop.Crypto.EvpPKeyHasCurveName(_key.Value);
+                    thisIsNamed = !explicitEncoding.Value;
                }


EvpPKeyEcHasExplicitEncoding returns false both for named-curve encoding and when the encoding cannot be read (native returns 0 for either case). The current logic treats false as "named" (thisIsNamed = !explicitEncoding.Value) and similarly for otherIsNamed, which can misclassify explicit keys from providers that don't expose OSSL_PKEY_PARAM_EC_ENCODING. Consider disambiguating by also checking whether the key has a group name (e.g., Interop.Crypto.EvpPKeyHasCurveName) when the encoding result is false, or change the native API to return a distinct value for "unavailable/unknown".

Not being able to read the encoding means it's named.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

bartonjs

I still have most of the native code to review, but here is the feedback so far.

bartonjs · 2026-04-24T22:24:27Z

+            byte[]? qx, int qxLength,
+            byte[]? qy, int qyLength,
+            byte[]? d, int dLength)


For the internal calls, do we need both qx and qxLength? Can this just be ReadOnlySpan so they're tracked together? (Or, if the array-ness is useful. does the caller always pass array.Length? If so, the internal call can take that away)

bartonjs · 2026-04-24T22:28:04Z

+                throw new PlatformNotSupportedException(SR.Format(SR.Cryptography_CurveNotSupported, oid));
+            }
+
+            if (rc != 1 || pkey.IsInvalid)


Why does it make sense that we'd get not-success, but just clear the error queue and return null? If this code is right, it probably needs some comments.

bartonjs · 2026-04-24T22:29:32Z

+            SafeEvpPKeyHandle pkey;
+            int rc = EvpPKeyCreateByEcKeyParameters(out pkey, oid, qx, qxLength, qy, qyLength, d, dLength);
+
+            if (rc == -1)


In our shim, -1 usually means "the caller (this code) did something nonsensical". Communicating a "normal" error should use something else, like 2. (If this is exactly matching what we did with EC_KEY, then, well... it could be better)

bartonjs · 2026-04-24T22:30:27Z

+        }
+
+        [LibraryImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_EvpPKeyGenerateByEcKeyOid", StringMarshalling = StringMarshalling.Utf8)]
+        private static partial int EvpPKeyGenerateByEcKeyOid(


maybe you mean by EcCurveOid? "EcKey", especially in this file, means EC_KEY

bartonjs · 2026-04-24T22:34:36Z

                {
-                    thisIsNamed = Interop.Crypto.EcKeyHasCurveName(ecKey);
+                    // Pre-3.0 fallback: check via EC_KEY.
+                    using (SafeEcKeyHandle ecKey = Interop.Crypto.EvpPkeyGetEcKey(_key.Value))


Is this always what the fallback code will look like? Does it exist in more than one place? If yes+yes, move it into EvpPKeyEcHasExplicitEncoding and get rid of the nullable bool.

bartonjs · 2026-04-28T00:22:41Z

+        [InlineData(ECDSA_P256_OID_VALUE)]
+        [InlineData(ECDSA_P384_OID_VALUE)]
+        [InlineData(ECDSA_P521_OID_VALUE)]
+        public void EcKeyAndEvpPKeySignVerifyCrossCompatible(string oid)


I'm not really sure about any of the "compare EC_KEY with EVP_PKEY" tests. What we really want is "does the EC_KEY ctor work?", given that we already have "do the non-interop paths work" (and maybe we should have more "here's an EVP_PKEY" tests, but I don't know that we care to smash them off each other)

That feels like

Named, explicit-prime, explicit-char2 exports work as expected.

ECDH

From-EC_KEY works as the left side and right side of a DeriveKey

From-EC_KEY(public only) fails as the left side of DeriveKey

ECDSA

From-EC_KEY(public only) throws something sensible from Sign

From-EC_KEY(public only) verifies a known signature

From-EC_KEY(public private) signs a thing that platform-import-this-key can verify.

Maybe what I've seen is just those 8 tests, but it feels like more than that.

This would, of course, be easier if the ECDH/ECDSA tests were written more like the MLDSA tests... we'd just extend the KAT-verifying base class (which also would check things like signing with a public key) to do a mode where it imports the key via EC_KEY instead of using the platform public "figure it out, so probably EVP_PKEY" approach. (That's not "go rewrite the tests for this", but rather "a musing out loud from a hindsight perspective" thing)

bartonjs · 2026-04-28T00:26:58Z

    LIGHTUP_FUNCTION(EVP_PKEY_CTX_new_from_name) \
    LIGHTUP_FUNCTION(EVP_PKEY_CTX_new_from_pkey) \
-    REQUIRED_FUNCTION(EVP_PKEY_new_raw_private_key) \
-    REQUIRED_FUNCTION(EVP_PKEY_new_raw_public_key) \


Is this a bad merge from X25519?

bartonjs · 2026-04-28T00:41:19Z

+#ifdef NEED_OPENSSL_3_0
+
+    int nid = OBJ_txt2nid(oid);
+    if (!nid)


Other code compares != NID_undef. This should for consistency.

bartonjs · 2026-04-28T00:43:50Z

+        return -1;
+    }
+
+    const char* groupName = OBJ_nid2sn(nid);


Can you cite something from the OSSL project that says to use sn here? It looks like their CMS uses OBJ_obj2txt which prefers ln over sn.

Really it's anything that turns the SPKI form into a key object, since that form will receive the curve by OID.

bartonjs · 2026-04-28T00:45:14Z

+    }
+#endif
+
+#ifdef NEED_OPENSSL_3_0


It feels weird to me that we're not using the same function for 3+ and 1.1.1 to generate an EVP_PKEY from a curve OID... even if the 1.1.1 version makes an EC_KEY and wraps it in EVP_PKEY before returning. (Ideally we want to insulate the managed code, as much as possible, from knowing the difference)

ec changes

d64dad9

PranavSenthilnathan self-assigned this Apr 20, 2026

Copilot AI review requested due to automatic review settings April 20, 2026 23:34

PranavSenthilnathan added the area-System.Security label Apr 20, 2026

Copilot started reviewing on behalf of PranavSenthilnathan April 20, 2026 23:35 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

This was referenced Apr 21, 2026

Android arm32 device not found (armeabi-v7a architecture unavailable) #125440

Open

Libraries .NET 4.8.1 build failing #127007

Closed

PranavSenthilnathan added 3 commits April 20, 2026 23:24

fix pub key computation and key size

43775ae

missed case with GenerateECKey creating EC_KEY

6afa0f7

add tests

a619c89

Copilot AI review requested due to automatic review settings April 22, 2026 23:16

Copilot started reviewing on behalf of PranavSenthilnathan April 22, 2026 23:16 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

PranavSenthilnathan added 3 commits April 23, 2026 16:48

remove EC2M paths where possible and cleanup

6535dcc

some more cleanup

3bdb9d7

style and cleanup

556f5d5

Copilot AI review requested due to automatic review settings April 24, 2026 18:40

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 18:41 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

PranavSenthilnathan added 2 commits April 24, 2026 12:06

PR comments

883529f

validate curve

d0b37ac

Copilot AI review requested due to automatic review settings April 24, 2026 19:14

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 19:15 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

PR comments

4cf0d13

PranavSenthilnathan marked this pull request as ready for review April 24, 2026 19:57

PranavSenthilnathan requested review from bartonjs and Copilot April 24, 2026 19:57

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 19:58 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

PranavSenthilnathan added 3 commits April 24, 2026 13:59

more PR comments

49ec2ab

fix build

754e355

Merge branch 'main' of https://github.com/dotnet/runtime into ossl-de…

a21d366

…precations-ec

Copilot AI review requested due to automatic review settings April 24, 2026 23:17

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 23:18 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

PranavSenthilnathan added 2 commits April 24, 2026 16:46

fix 1.1 build

d0c06d8

Addressing more PR comments

d7068b7

Copilot AI review requested due to automatic review settings April 25, 2026 00:39

Copilot started reviewing on behalf of PranavSenthilnathan April 25, 2026 00:40 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

address PR comments

a214223

PranavSenthilnathan changed the title ~~[WIP] Prefer using non-deprecated EC OSSL APIs where possible~~ Prefer using non-deprecated EC OSSL APIs where possible Apr 27, 2026

bartonjs reviewed Apr 28, 2026

View reviewed changes

	REQUIRED_FUNCTION(EC_GROUP_get_curve) \
	LIGHTUP_FUNCTION(EC_GROUP_get_curve) \

-    return EC_POINT_get_affine_coordinates(group, p, x, y, NULL) ? 1 : 0;
+#ifdef NEED_OPENSSL_3_0
+    if (API_EXISTS(EC_POINT_get_affine_coordinates))
+        return EC_POINT_get_affine_coordinates(group, p, x, y, NULL) ? 1 : 0;
+#endif
+    const EC_METHOD* method = EC_GROUP_method_of(group);
+    if (method == NULL)
+        return 0;
+    switch (MethodToCurveType(method))
+    {
+        case PrimeMontgomery:
+        case PrimeShortWeierstrass:
+            return EC_POINT_get_affine_coordinates_GFp(group, p, x, y, NULL) ? 1 : 0;
+#if HAVE_OPENSSL_EC2M
+        case Characteristic2:
+            if (API_EXISTS(EC_POINT_get_affine_coordinates_GF2m))
+                return EC_POINT_get_affine_coordinates_GF2m(group, p, x, y, NULL) ? 1 : 0;
+            return 0;
+#endif
+        default:
+            return 0;
+    }

		if (!EC_GROUP_get_curve(group, pBn, aBn, bBn, NULL))
		goto error;

		if (!EC_GROUP_set_curve(group, pBn, aBn, bBn, NULL))
		goto error;

-        !API_EXISTS(OSSL_PARAM_BLD_new))
+        !API_EXISTS(OSSL_PARAM_BLD_new) ||
+        !API_EXISTS(OSSL_PARAM_BLD_push_utf8_string) ||
+        !API_EXISTS(OSSL_PARAM_BLD_push_octet_string) ||
+        !API_EXISTS(OSSL_PARAM_BLD_to_param) ||
+        !API_EXISTS(OSSL_PARAM_BLD_free) ||
+        !API_EXISTS(OSSL_PARAM_free))

Conversation

PranavSenthilnathan commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

PranavSenthilnathan commented Apr 20, 2026 •

edited

Loading