OpensslPkg: Register ECX, ML-KEM, and hybrid algorithms

Extend the UEFI built-in OpenSSL provider (uefiprov.c) so that libssl
can discover the algorithms required for the post-quantum TLS 1.3 key
exchange groups defined by IANA codepoints 0x11EB (SecP256r1MLKEM768),
0x11EC (X25519MLKEM768), and 0x11ED (SecP384r1MLKEM1024), as well as
the classical X25519 / X448 groups.

The UEFI provider previously omitted ECX (X25519, X448), ML-KEM, and
the ML-KEM hybrid algorithms. Without keymgmt and KEM dispatch entries,
SSL_set1_groups_list() would reject those names and TlsSetEcCurve()
would return EFI_UNSUPPORTED for both classical and PQC groups.

Add the following entries (gated to match per-variant source coverage
in the OpensslLib*.inf files):

  * deflt_keyexch[]: X25519, X448 (gated by OPENSSL_NO_EC / OPENSSL_NO_ECX)
  * deflt_keymgmt[]: X25519, X448, ML-KEM-768/1024, X25519MLKEM768,
    SecP256r1MLKEM768, SecP384r1MLKEM1024
  * deflt_asym_kem[] (new table): RSA, EC, X25519, X448, ML-KEM-768/1024,
    and the three TLS hybrid KEMs
  * deflt_query(): dispatch OSSL_OP_KEM to the new deflt_asym_kem table

Verified against the TlsLib host unit tests: X25519 / X448 report
SUPPORTED, and all three PQC hybrid groups report SUPPORTED (3 / 3).
All 119 host unit tests continue to pass.

Signed-off-by: Doug Flick <dougflick@microsoft.com>

Author: Flickdm

OpensslPkg/Library/OpensslLib/OpensslStub/uefiprov.c

@@ -183,6 +183,10 @@ static const OSSL_ALGORITHM deflt_keyexch[] = {
 #endif
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_ECDH, "provider=default", ossl_ecdh_keyexch_functions },
+# ifndef OPENSSL_NO_ECX
+    { PROV_NAMES_X25519, "provider=default", ossl_x25519_keyexch_functions },
+    { PROV_NAMES_X448, "provider=default", ossl_x448_keyexch_functions },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, "provider=default", ossl_kdf_tls1_prf_keyexch_functions },
     { PROV_NAMES_HKDF, "provider=default", ossl_kdf_hkdf_keyexch_functions },
@@ -215,6 +219,29 @@ static const OSSL_ALGORITHM deflt_asym_cipher[] = {
     { NULL, NULL, NULL }
 };
 
+static const OSSL_ALGORITHM deflt_asym_kem[] = {
+    { PROV_NAMES_RSA, "provider=default", ossl_rsa_asym_kem_functions },
+#ifndef OPENSSL_NO_EC
+    { PROV_NAMES_EC, "provider=default", ossl_ec_asym_kem_functions },
+# ifndef OPENSSL_NO_ECX
+    { PROV_NAMES_X25519, "provider=default", ossl_ecx_asym_kem_functions },
+    { PROV_NAMES_X448, "provider=default", ossl_ecx_asym_kem_functions },
+# endif
+#endif
+#ifndef OPENSSL_NO_ML_KEM
+    { PROV_NAMES_ML_KEM_768, "provider=default", ossl_ml_kem_asym_kem_functions },
+    { PROV_NAMES_ML_KEM_1024, "provider=default", ossl_ml_kem_asym_kem_functions },
+# ifndef OPENSSL_NO_EC
+#  ifndef OPENSSL_NO_ECX
+    { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_kem_asym_kem_functions },
+#  endif
+    { PROV_NAMES_SecP256r1MLKEM768, "provider=default", ossl_mlx_kem_asym_kem_functions },
+    { PROV_NAMES_SecP384r1MLKEM1024, "provider=default", ossl_mlx_kem_asym_kem_functions },
+# endif
+#endif
+    { NULL, NULL, NULL }
+};
+
 static const OSSL_ALGORITHM deflt_keymgmt[] = {
 #ifndef OPENSSL_NO_DH
     { PROV_NAMES_DH, "provider=default", ossl_dh_keymgmt_functions,
@@ -230,6 +257,12 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
 #ifndef OPENSSL_NO_EC
     { PROV_NAMES_EC, "provider=default", ossl_ec_keymgmt_functions,
       PROV_DESCS_EC },
+# ifndef OPENSSL_NO_ECX
+    { PROV_NAMES_X25519, "provider=default", ossl_x25519_keymgmt_functions,
+      PROV_DESCS_X25519 },
+    { PROV_NAMES_X448, "provider=default", ossl_x448_keymgmt_functions,
+      PROV_DESCS_X448 },
+# endif
 #endif
     { PROV_NAMES_TLS1_PRF, "provider=default", ossl_kdf_keymgmt_functions,
       PROV_DESCS_TLS1_PRF_SIGN },
@@ -244,6 +277,22 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
       PROV_DESCS_ML_DSA_65 },
     { PROV_NAMES_ML_DSA_87, "provider=default", ossl_ml_dsa_87_keymgmt_functions,
       PROV_DESCS_ML_DSA_87 },
+#endif
+#ifndef OPENSSL_NO_ML_KEM
+    { PROV_NAMES_ML_KEM_768, "provider=default", ossl_ml_kem_768_keymgmt_functions,
+      PROV_DESCS_ML_KEM_768 },
+    { PROV_NAMES_ML_KEM_1024, "provider=default", ossl_ml_kem_1024_keymgmt_functions,
+      PROV_DESCS_ML_KEM_1024 },
+# ifndef OPENSSL_NO_EC
+#  ifndef OPENSSL_NO_ECX
+    { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_x25519_kem_kmgmt_functions,
+      PROV_DESCS_X25519MLKEM768 },
+#  endif
+    { PROV_NAMES_SecP256r1MLKEM768, "provider=default", ossl_mlx_p256_kem_kmgmt_functions,
+      PROV_DESCS_SecP256r1MLKEM768 },
+    { PROV_NAMES_SecP384r1MLKEM1024, "provider=default", ossl_mlx_p384_kem_kmgmt_functions,
+      PROV_DESCS_SecP384r1MLKEM1024 },
+# endif
 #endif
 
     { NULL, NULL, NULL }
@@ -279,6 +328,8 @@ static const OSSL_ALGORITHM *deflt_query(void *provctx, int operation_id,
         return deflt_signature;
     case OSSL_OP_ASYM_CIPHER:
         return deflt_asym_cipher;
+    case OSSL_OP_KEM:
+        return deflt_asym_kem;
     case OSSL_OP_DECODER:
         return deflt_decoder;
     }