Allow EVP_SKEY_get0_raw_key() to return only the key length

There was no way to learn the length of an opaque EVP_SKEY without
exporting the raw key, which is impossible for non-exportable keys
(e.g. keys held in hardware).

Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case
only the length is returned. It is read from the
OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with
OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported.
The built-in generic and AES key managements now report that parameter.

Fixes: https://github.com/openssl/openssl/issues/32998

Assisted-by: Claude Code:claude-opus-5-5
Reviewed-by: Simo Sorce <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Merge-date: Mon Oct  5 10:28:09 2026
Merged-from: https://github.com/openssl/openssl/pull/33035

1 files changed, 4 insertions, 0 deletions

diff --git a/include/openssl/evp.h.in b/include/openssl/evp.h.in
index 7bad41ba794..d6f309b539f 100644
--- a/include/openssl/evp.h.in
+++ b/include/openssl/evp.h.in
@@ -1951,6 +1951,10 @@ EVP_SKEY *EVP_SKEY_import_raw_key(OSSL_LIB_CTX *libctx, const char *skeymgmtname
     const char *propquery);
 EVP_SKEY *EVP_SKEY_import_SKEYMGMT(OSSL_LIB_CTX *libctx, EVP_SKEYMGMT *skeymgmt,
     int selection, const OSSL_PARAM *params);
+/**
+ * @brief Get the raw bytes and/or the length of a symmetric key.
+ * @see EVP_SKEY_get0_raw_key(3)
+ */
 int EVP_SKEY_get0_raw_key(const EVP_SKEY *skey, const unsigned char **key,
     size_t *len);
 const char *EVP_SKEY_get0_key_id(const EVP_SKEY *skey);