crypto: Remove internal ENGINE usage from the subdirfeature/engineremoval

Engines can be removed safely from static and internal functions
clearing out our codebase.

Resolves: https://github.com/openssl/project/issues/1625

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/28629)

18 files changed, 106 insertions, 87 deletions

diff --git a/crypto/asn1/ameth_lib.c b/crypto/asn1/ameth_lib.c
index f97b6f96179..f56d05e1aeb 100644
--- a/crypto/asn1/ameth_lib.c
+++ b/crypto/asn1/ameth_lib.c
@@ -74,11 +74,10 @@ static const EVP_PKEY_ASN1_METHOD *pkey_asn1_find(int type)
 }
 
 /*
- * Find an implementation of an ASN1 algorithm. If 'pe' is not NULL also
- * search through engines and set *pe to a functional reference to the engine
- * implementing 'type' or NULL if no engine implements it.
+ * Return ASN1 method for desired `type`, returns NULL if no method is found for
+ * `type`. If pe is not NULL, the function will set *pe to NULL to indicate no
+ * engine is used.
  */
-
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type)
 {
     const EVP_PKEY_ASN1_METHOD *t;
diff --git a/crypto/cmac/cmac.c b/crypto/cmac/cmac.c
index 75c342a4a33..ad357c8b8c8 100644
--- a/crypto/cmac/cmac.c
+++ b/crypto/cmac/cmac.c
@@ -20,6 +20,7 @@
 #include <openssl/cmac.h>
 #include <openssl/err.h>
 #include "crypto/cmac.h"
+#include "internal/common.h"
 
 #define LOCAL_BUF_SIZE 2048
 struct CMAC_CTX_st {
@@ -109,14 +110,13 @@ int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
 }
 
 int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
-                   const EVP_CIPHER *cipher, ENGINE *impl,
-                   const OSSL_PARAM param[])
+                   const EVP_CIPHER *cipher, const OSSL_PARAM param[])
 {
     static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
     int block_len;
 
     /* All zeros means restart */
-    if (!key && !cipher && !impl && keylen == 0) {
+    if (key == NULL && cipher == NULL && keylen == 0) {
         /* Not initialised */
         if (ctx->nlast_block == -1)
             return 0;
@@ -133,13 +133,8 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
     if (cipher != NULL) {
         /* Ensure we can't use this ctx until we also have a key */
         ctx->nlast_block = -1;
-        if (impl != NULL) {
-            if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
-                return 0;
-        } else {
-            if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
-                return 0;
-        }
+        if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
+            return 0;
     }
     /* Non-NULL key means initialisation complete */
     if (key != NULL) {
@@ -174,7 +169,9 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
 int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
               const EVP_CIPHER *cipher, ENGINE *impl)
 {
-    return ossl_cmac_init(ctx, key, keylen, cipher, impl, NULL);
+    if (!ossl_assert(impl == NULL))
+        return 0;
+    return ossl_cmac_init(ctx, key, keylen, cipher, NULL);
 }
 
 int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c
index ed06d3dd4ba..6c714e41f24 100644
--- a/crypto/dh/dh_lib.c
+++ b/crypto/dh/dh_lib.c
@@ -19,11 +19,12 @@
 #include <openssl/core_names.h>
 #include "internal/cryptlib.h"
 #include "internal/refcount.h"
+#include "internal/common.h"
 #include "crypto/evp.h"
 #include "crypto/dh.h"
 #include "dh_local.h"
 
-static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx);
+static DH *dh_new_intern(OSSL_LIB_CTX *libctx);
 
 #ifndef FIPS_MODULE
 int DH_set_method(DH *dh, const DH_METHOD *meth)
@@ -49,22 +50,24 @@ const DH_METHOD *ossl_dh_get_method(const DH *dh)
 # ifndef OPENSSL_NO_DEPRECATED_3_0
 DH *DH_new(void)
 {
-    return dh_new_intern(NULL, NULL);
+    return dh_new_intern(NULL);
 }
 # endif
 
 DH *DH_new_method(ENGINE *engine)
 {
-    return dh_new_intern(engine, NULL);
+    if (!ossl_assert(engine == NULL))
+        return NULL;
+    return dh_new_intern(NULL);
 }
 #endif /* !FIPS_MODULE */
 
 DH *ossl_dh_new_ex(OSSL_LIB_CTX *libctx)
 {
-    return dh_new_intern(NULL, libctx);
+    return dh_new_intern(libctx);
 }
 
-static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
+static DH *dh_new_intern(OSSL_LIB_CTX *libctx)
 {
     DH *ret = OPENSSL_zalloc(sizeof(*ret));
 
diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c
index 6c09ebede7b..53097e73063 100644
--- a/crypto/dsa/dsa_lib.c
+++ b/crypto/dsa/dsa_lib.c
@@ -16,6 +16,7 @@
 #include <openssl/bn.h>
 #include "internal/cryptlib.h"
 #include "internal/refcount.h"
+#include "internal/common.h"
 #include "crypto/dsa.h"
 #include "crypto/dh.h" /* required by DSA_dup_DH() */
 #include "dsa_local.h"
@@ -163,9 +164,9 @@ static DSA *dsa_new_intern(OSSL_LIB_CTX *libctx)
     return NULL;
 }
 
-DSA *DSA_new_method(ossl_unused ENGINE *engine)
+DSA *DSA_new_method(ENGINE *engine)
 {
-    if (engine != NULL)
+    if (!ossl_assert(engine == NULL))
         return NULL;
     return dsa_new_intern(NULL);
 }
diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index 8086f101cd9..99623acc1f6 100644
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -17,6 +17,7 @@
 #include "internal/nelem.h"
 #include "internal/provider.h"
 #include "internal/core.h"
+#include "internal/common.h"
 #include "crypto/evp.h"
 #include "evp_local.h"
 
@@ -298,8 +299,8 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
 
 int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
 {
-    /* make the compiler happy */
-    (void)impl;
+    if (!ossl_assert(impl == NULL))
+        return 0;
     return evp_md_init_internal(ctx, type, NULL);
 }
 
@@ -641,13 +642,17 @@ int EVP_Digest(const void *data, size_t count,
                unsigned char *md, unsigned int *size, const EVP_MD *type,
                ENGINE *impl)
 {
-    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+    EVP_MD_CTX *ctx;
     int ret;
 
+    if (!ossl_assert(impl == NULL))
+        return 0;
+
+    ctx = EVP_MD_CTX_new();
     if (ctx == NULL)
         return 0;
     EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_ONESHOT);
-    ret = EVP_DigestInit_ex(ctx, type, impl)
+    ret = EVP_DigestInit_ex(ctx, type, NULL)
         && EVP_DigestUpdate(ctx, data, count)
         && EVP_DigestFinal_ex(ctx, md, size);
     EVP_MD_CTX_free(ctx);
diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 31ea539050b..92bf546327a 100644
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -18,6 +18,7 @@
 #include "internal/cryptlib.h"
 #include "internal/provider.h"
 #include "internal/core.h"
+#include "internal/common.h"
 #include "internal/safe_math.h"
 #include "crypto/evp.h"
 #include "evp_local.h"
@@ -579,8 +580,8 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
                       ENGINE *impl, const unsigned char *key,
                       const unsigned char *iv, int enc)
 {
-    /* to make the compilers happy */
-    (void)impl;
+    if (!ossl_assert(impl == NULL))
+        return 0;
     return evp_cipher_init_internal(ctx, cipher, key, iv, enc, 0, NULL);
 }
 
@@ -747,7 +748,9 @@ int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
                        ENGINE *impl, const unsigned char *key,
                        const unsigned char *iv)
 {
-    return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 1);
+    if (!ossl_assert(impl == NULL))
+        return 0;
+    return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 1);
 }
 
 int EVP_EncryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
@@ -767,7 +770,9 @@ int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
                        ENGINE *impl, const unsigned char *key,
                        const unsigned char *iv)
 {
-    return EVP_CipherInit_ex(ctx, cipher, impl, key, iv, 0);
+    if (!ossl_assert(impl == NULL))
+        return 0;
+    return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, 0);
 }
 
 int EVP_DecryptInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
diff --git a/crypto/evp/evp_pkey_type.c b/crypto/evp/evp_pkey_type.c
index 793a56f33ee..70ca5aee775 100644
--- a/crypto/evp/evp_pkey_type.c
+++ b/crypto/evp/evp_pkey_type.c
@@ -64,9 +64,8 @@ int EVP_PKEY_type(int type)
 #ifndef OPENSSL_NO_DEPRECATED_3_6
     int ret;
     const EVP_PKEY_ASN1_METHOD *ameth;
-    ENGINE *e;
 
-    ameth = EVP_PKEY_asn1_find(&e, type);
+    ameth = EVP_PKEY_asn1_find(NULL, type);
     if (ameth)
         ret = ameth->pkey_id;
     else
diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c
index 740b9d7387c..d15bece28b3 100644
--- a/crypto/evp/m_sigver.c
+++ b/crypto/evp/m_sigver.c
@@ -14,6 +14,7 @@
 #include "crypto/evp.h"
 #include "internal/provider.h"
 #include "internal/numbers.h"   /* includes SIZE_MAX */
+#include "internal/common.h"
 #include "evp_local.h"
 
 static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen)
@@ -37,7 +38,7 @@ static const char *canon_mdname(const char *mdname)
 static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                           const EVP_MD *type, const char *mdname,
                           OSSL_LIB_CTX *libctx, const char *props,
-                          ENGINE *e, EVP_PKEY *pkey, int ver,
+                          EVP_PKEY *pkey, int ver,
                           const OSSL_PARAM params[])
 {
     EVP_PKEY_CTX *locpctx = NULL;
@@ -55,10 +56,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
 
     if (ctx->pctx == NULL) {
         reinit = 0;
-        if (e == NULL)
-            ctx->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, props);
-        else
-            ctx->pctx = EVP_PKEY_CTX_new(pkey, e);
+        ctx->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, props);
     }
     if (ctx->pctx == NULL)
         return 0;
@@ -351,7 +349,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
         *pctx = ctx->pctx;
     if (ctx->pctx->pmeth->flags & EVP_PKEY_FLAG_SIGCTX_CUSTOM)
         return 1;
-    if (!EVP_DigestInit_ex(ctx, type, e))
+    if (!EVP_DigestInit_ex(ctx, type, NULL))
         return 0;
     /*
      * This indicates the current algorithm requires
@@ -375,14 +373,16 @@ int EVP_DigestSignInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                           const char *props, EVP_PKEY *pkey,
                           const OSSL_PARAM params[])
 {
-    return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, NULL, pkey, 0,
+    return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, pkey, 0,
                           params);
 }
 
 int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                        const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey)
 {
-    return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, e, pkey, 0,
+    if (!ossl_assert(e == NULL))
+        return 0;
+    return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, pkey, 0,
                           NULL);
 }
 
@@ -391,14 +391,16 @@ int EVP_DigestVerifyInit_ex(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                             const char *props, EVP_PKEY *pkey,
                             const OSSL_PARAM params[])
 {
-    return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, NULL, pkey, 1,
+    return do_sigver_init(ctx, pctx, NULL, mdname, libctx, props, pkey, 1,
                           params);
 }
 
 int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                          const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey)
 {
-    return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, e, pkey, 1,
+    if (!ossl_assert(e == NULL))
+        return 0;
+    return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, pkey, 1,
                           NULL);
 }
 
diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index 5ae44e35f70..c76e6c5ac37 100644
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -45,6 +45,7 @@
 # include "crypto/x509.h"
 #endif
 #include "internal/provider.h"
+#include "internal/common.h"
 #include "evp_local.h"
 
 static int pkey_set_type(EVP_PKEY *pkey, int type, const char *str,
@@ -514,8 +515,8 @@ EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
                                        const unsigned char *priv,
                                        size_t len)
 {
-    /* make the compiler happy */
-    (void)e;
+    if (!ossl_assert(e == NULL))
+        return NULL;
     return new_raw_key_int(NULL, NULL, NULL, type, priv, len, 1);
 }
 
@@ -531,8 +532,8 @@ EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
                                       const unsigned char *pub,
                                       size_t len)
 {
-    /* make the compiler happy */
-    (void)e;
+    if (!ossl_assert(e == NULL))
+        return NULL;
     return new_raw_key_int(NULL, NULL, NULL, type, pub, len, 0);
 }
 
@@ -684,6 +685,8 @@ static EVP_PKEY *new_cmac_key_int(const unsigned char *priv, size_t len,
 EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
                                 size_t len, const EVP_CIPHER *cipher)
 {
+    if (!ossl_assert(e == NULL))
+        return NULL;
     return new_cmac_key_int(priv, len, NULL, cipher, NULL, NULL);
 }
 
@@ -1702,10 +1705,9 @@ err:
 void evp_pkey_free_legacy(EVP_PKEY *x)
 {
     const EVP_PKEY_ASN1_METHOD *ameth = x->ameth;
-    ENGINE *tmpe = NULL;
 
     if (ameth == NULL && x->legacy_cache_pkey.ptr != NULL)
-        ameth = EVP_PKEY_asn1_find(&tmpe, x->type);
+        ameth = EVP_PKEY_asn1_find(NULL, x->type);
 
     if (ameth != NULL) {
         if (x->legacy_cache_pkey.ptr != NULL) {
diff --git a/crypto/evp/pmeth_gn.c b/crypto/evp/pmeth_gn.c
index 682980273a8..f71447f060b 100644
--- a/crypto/evp/pmeth_gn.c
+++ b/crypto/evp/pmeth_gn.c
@@ -13,6 +13,7 @@
 #include <openssl/core_names.h>
 #include "internal/cryptlib.h"
 #include "internal/core.h"
+#include "internal/common.h"
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include "crypto/bn.h"
@@ -318,7 +319,10 @@ EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e,
 {
     EVP_PKEY_CTX *mac_ctx = NULL;
     EVP_PKEY *mac_key = NULL;
-    mac_ctx = EVP_PKEY_CTX_new_id(type, e);
+
+    if (!ossl_assert(e == NULL))
+        return NULL;
+    mac_ctx = EVP_PKEY_CTX_new_id(type, NULL);
     if (!mac_ctx)
         return NULL;
     if (EVP_PKEY_keygen_init(mac_ctx) <= 0)
diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c
index fe0bb142fd6..06f52ea4634 100644
--- a/crypto/evp/pmeth_lib.c
+++ b/crypto/evp/pmeth_lib.c
@@ -30,6 +30,7 @@
 #include "internal/ffc.h"
 #include "internal/numbers.h"
 #include "internal/provider.h"
+#include "internal/common.h"
 #include "evp_local.h"
 
 #ifndef FIPS_MODULE
@@ -152,8 +153,7 @@ int evp_pkey_ctx_state(const EVP_PKEY_CTX *ctx)
     return EVP_PKEY_STATE_LEGACY;
 }
 
-static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx,
-                                 EVP_PKEY *pkey, ENGINE *e,
+static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx, EVP_PKEY *pkey,
                                  const char *keytype, const char *propquery,
                                  int id)
 
@@ -182,29 +182,16 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx,
         }
     }
     /* If no ID was found here, we can only resort to find a keymgmt */
-    if (id == -1) {
-#ifndef FIPS_MODULE
-        /* Using engine with a key without id will not work */
-        if (e != NULL) {
-            ERR_raise(ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM);
-            return NULL;
-        }
-#endif
+    if (id == -1)
         goto common;
-    }
 
 #ifndef FIPS_MODULE
     /*
      * Here, we extract what information we can for the purpose of
      * supporting usage with implementations from providers, to make
      * for a smooth transition from legacy stuff to provider based stuff.
-     *
-     * If an engine is given, this is entirely legacy, and we should not
-     * pretend anything else, so we clear the name.
      */
-    if (e != NULL)
-        keytype = NULL;
-    if (e == NULL && (pkey == NULL || pkey->foreign == 0))
+    if (pkey == NULL || pkey->foreign == 0)
         keytype = OBJ_nid2sn(id);
 
     if (pkey != NULL && pkey->foreign)
@@ -216,10 +203,10 @@ static EVP_PKEY_CTX *int_ctx_new(OSSL_LIB_CTX *libctx,
 #endif /* FIPS_MODULE */
  common:
     /*
-     * If there's no engine and no app supplied pmeth and there's a name, we try
+     * If there's no app supplied pmeth and there's a name, we try
      * fetching a provider implementation.
      */
-    if (e == NULL && app_pmeth == NULL && keytype != NULL) {
+    if (app_pmeth == NULL && keytype != NULL) {
         /*
          * If |pkey| is given and is provided, we take a reference to its
          * keymgmt.  Otherwise, we fetch one for the keytype we got. This
@@ -316,13 +303,13 @@ EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx,
                                          const char *name,
                                          const char *propquery)
 {
-    return int_ctx_new(libctx, NULL, NULL, name, propquery, -1);
+    return int_ctx_new(libctx, NULL, name, propquery, -1);
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OSSL_LIB_CTX *libctx, EVP_PKEY *pkey,
                                          const char *propquery)
 {
-    return int_ctx_new(libctx, pkey, NULL, NULL, propquery, -1);
+    return int_ctx_new(libctx, pkey, NULL, propquery, -1);
 }
 
 void evp_pkey_ctx_free_old_ops(EVP_PKEY_CTX *ctx)
@@ -409,12 +396,16 @@ void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth)
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e)
 {
-    return int_ctx_new(NULL, pkey, e, NULL, NULL, -1);
+    if (!ossl_assert(e == NULL))
+        return NULL;
+    return int_ctx_new(NULL, pkey, NULL, NULL, -1);
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e)
 {
-    return int_ctx_new(NULL, NULL, e, NULL, NULL, id);
+    if (!ossl_assert(e == NULL))
+        return NULL;
+    return int_ctx_new(NULL, NULL, NULL, NULL, id);
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *pctx)
diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index 19fc7d3b4f6..005ccb7727d 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -35,6 +35,9 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
     if (md != NULL && md != ctx->md && (key == NULL || len < 0))
         return 0;
 
+    if (impl != NULL)
+        return 0;
+
     if (md != NULL)
         ctx->md = md;
     else if (ctx->md != NULL)
@@ -50,7 +53,7 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         return 0;
 
 #ifdef OPENSSL_HMAC_S390X
-    rv = s390x_HMAC_init(ctx, key, len, impl);
+    rv = s390x_HMAC_init(ctx, key, len);
     if (rv >= 1)
         return rv;
 #endif
@@ -64,7 +67,7 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
         if (j < 0)
             return 0;
         if (j < len) {
-            if (!EVP_DigestInit_ex(ctx->md_ctx, md, impl)
+            if (!EVP_DigestInit_ex(ctx->md_ctx, md, NULL)
                     || !EVP_DigestUpdate(ctx->md_ctx, key, len)
                     || !EVP_DigestFinal_ex(ctx->md_ctx, keytmp,
                                            &keytmp_length))
@@ -81,14 +84,14 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
 
         for (i = 0; i < HMAC_MAX_MD_CBLOCK_SIZE; i++)
             pad[i] = 0x36 ^ keytmp[i];
-        if (!EVP_DigestInit_ex(ctx->i_ctx, md, impl)
+        if (!EVP_DigestInit_ex(ctx->i_ctx, md, NULL)
                 || !EVP_DigestUpdate(ctx->i_ctx, pad,
                                      EVP_MD_get_block_size(md)))
             goto err;
 
         for (i = 0; i < HMAC_MAX_MD_CBLOCK_SIZE; i++)
             pad[i] = 0x5c ^ keytmp[i];
-        if (!EVP_DigestInit_ex(ctx->o_ctx, md, impl)
+        if (!EVP_DigestInit_ex(ctx->o_ctx, md, NULL)
                 || !EVP_DigestUpdate(ctx->o_ctx, pad,
                                      EVP_MD_get_block_size(md)))
             goto err;
diff --git a/crypto/hmac/hmac_local.h b/crypto/hmac/hmac_local.h
index 1b871e73205..0b5c6146eb9 100644
--- a/crypto/hmac/hmac_local.h
+++ b/crypto/hmac/hmac_local.h
@@ -56,7 +56,7 @@ struct hmac_ctx_st {
 # ifdef OPENSSL_HMAC_S390X
 #  define HMAC_S390X_BUF_NUM_BLOCKS 64
 
-int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl);
+int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len);
 int s390x_HMAC_update(HMAC_CTX *ctx, const unsigned char *data, size_t len);
 int s390x_HMAC_final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
 int s390x_HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx);
diff --git a/crypto/hmac/hmac_s390x.c b/crypto/hmac/hmac_s390x.c
index edd1b5258a4..35a50fb15ca 100644
--- a/crypto/hmac/hmac_s390x.c
+++ b/crypto/hmac/hmac_s390x.c
@@ -67,7 +67,7 @@ static void s390x_call_kmac(HMAC_CTX *ctx, const unsigned char *in, size_t len)
     ctx->plat.s390x.ikp = 1;
 }
 
-int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl)
+int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len)
 {
     unsigned char *key_param;
     unsigned int key_param_len;
@@ -137,7 +137,7 @@ int s390x_HMAC_init(HMAC_CTX *ctx, const void *key, int key_len, ENGINE *impl)
             return 0;
 
         if (key_len > ctx->plat.s390x.blk_size) {
-            if (!EVP_DigestInit_ex(ctx->md_ctx, ctx->md, impl)
+            if (!EVP_DigestInit_ex(ctx->md_ctx, ctx->md, NULL)
                     || !EVP_DigestUpdate(ctx->md_ctx, key, key_len)
                     || !EVP_DigestFinal_ex(ctx->md_ctx, key_param,
                                            &key_param_len))
diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 282522a0864..b2c1ad50f02 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -157,8 +157,7 @@ static int check_pem(const char *nm, const char *name)
         const EVP_PKEY_ASN1_METHOD *ameth;
         slen = ossl_pem_check_suffix(nm, "PARAMETERS");
         if (slen > 0) {
-            ENGINE *e;
-            ameth = EVP_PKEY_asn1_find_str(&e, nm, slen);
+            ameth = EVP_PKEY_asn1_find_str(NULL, nm, slen);
             if (ameth) {
                 int r;
                 if (ameth->param_decode)
diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c
index f43efc57523..000d32d9083 100644
--- a/crypto/rand/rand_lib.c
+++ b/crypto/rand/rand_lib.c
@@ -23,6 +23,7 @@
 #include "rand_local.h"
 #include "crypto/context.h"
 #include "internal/provider.h"
+#include "internal/common.h"
 
 #ifndef OPENSSL_DEFAULT_SEED_SRC
 # define OPENSSL_DEFAULT_SEED_SRC SEED-SRC
@@ -222,8 +223,10 @@ int RAND_poll(void)
 
 # ifndef OPENSSL_NO_DEPRECATED_3_0
 static int rand_set_rand_method_internal(const RAND_METHOD *meth,
-                                         ossl_unused ENGINE *e)
+                                         ENGINE *e)
 {
+    if (!ossl_assert(e == NULL))
+        return 0;
     if (!RUN_ONCE(&rand_init, do_rand_init))
         return 0;
 
diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c
index b226d42b3ef..2484b1ca717 100644
--- a/crypto/rsa/rsa_lib.c
+++ b/crypto/rsa/rsa_lib.c
@@ -19,6 +19,7 @@
 #include <openssl/param_build.h>
 #include "internal/cryptlib.h"
 #include "internal/refcount.h"
+#include "internal/common.h"
 #include "crypto/bn.h"
 #include "crypto/evp.h"
 #include "crypto/rsa.h"
@@ -26,12 +27,12 @@
 #include "crypto/security_bits.h"
 #include "rsa_local.h"
 
-static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx);
+static RSA *rsa_new_intern(OSSL_LIB_CTX *libctx);
 
 #ifndef FIPS_MODULE
 RSA *RSA_new(void)
 {
-    return rsa_new_intern(NULL, NULL);
+    return rsa_new_intern(NULL);
 }
 
 const RSA_METHOD *RSA_get_method(const RSA *rsa)
@@ -57,16 +58,18 @@ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth)
 
 RSA *RSA_new_method(ENGINE *engine)
 {
-    return rsa_new_intern(engine, NULL);
+    if (!ossl_assert(engine == NULL))
+        return NULL;
+    return rsa_new_intern(NULL);
 }
 #endif
 
 RSA *ossl_rsa_new_with_ctx(OSSL_LIB_CTX *libctx)
 {
-    return rsa_new_intern(NULL, libctx);
+    return rsa_new_intern(libctx);
 }
 
-static RSA *rsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
+static RSA *rsa_new_intern(OSSL_LIB_CTX *libctx)
 {
     RSA *ret = OPENSSL_zalloc(sizeof(*ret));
 
diff --git a/crypto/store/store_register.c b/crypto/store/store_register.c
index 9f468f4aa11..a72dc20b4c8 100644
--- a/crypto/store/store_register.c
+++ b/crypto/store/store_register.c
@@ -13,6 +13,7 @@
 
 #include <openssl/err.h>
 #include <openssl/lhash.h>
+#include "internal/common.h"
 #include "store_local.h"
 
 static CRYPTO_RWLOCK *registry_lock;
@@ -32,6 +33,8 @@ OSSL_STORE_LOADER *OSSL_STORE_LOADER_new(ENGINE *e, const char *scheme)
 {
     OSSL_STORE_LOADER *res = NULL;
 
+    if (!ossl_assert(e == NULL))
+        return NULL;
     /*
      * We usually don't check NULL arguments.  For loaders, though, the
      * scheme is crucial and must never be NULL, or the user will get