This PR implementes ECDH using the EVP interface when possible so it is more FIPS-compliant.
There is only one code-path that do low-level crypto operations outside the OpenSSL module: PrivateKeyECDH.PublicKey() needs to generate the public key bytes using EC_POINT_mul if the private key has been generated using NewPrivateKeyECDH instead of GenerateKeyECDH. This is because OpenSSL does not provide any method to generate the public key from the private one, so you either generate both at the same time, our you do it yourself. On the other hand, Go standard libraries only instantiate ECDH NIST keys using GenerateKeyECDH, so we should be fine. I'll document this fact anyway.
This is a follow up of #43.
This PR implementes ECDH using the EVP interface when possible so it is more FIPS-compliant.
There is only one code-path that do low-level crypto operations outside the OpenSSL module:
PrivateKeyECDH.PublicKey()needs to generate the public key bytes usingEC_POINT_mulif the private key has been generated usingNewPrivateKeyECDHinstead ofGenerateKeyECDH. This is because OpenSSL does not provide any method to generate the public key from the private one, so you either generate both at the same time, our you do it yourself. On the other hand, Go standard libraries only instantiate ECDH NIST keys usingGenerateKeyECDH, so we should be fine. I'll document this fact anyway.