Commit 1fbe7151a1 for openssl.org

commit 1fbe7151a1d4e056de354053aa5e9f9ce65836c4
Author: olszomal <Malgorzata.Olszowka@stunnel.org>
Date:   Wed Jul 22 13:33:05 2026 +0200

    DOCS: Fix derive_skey provider documentation

    Correct the OSSL_FUNC_keyexch_derive_skey() return type, derive_skey
    return-value descriptions, stale function names, and broken links.

    Signed-off-by: olszomal <Malgorzata.Olszowka@stunnel.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Merge-date: Fri Aug 28 11:13:06 2026
    Merged-from: https://github.com/openssl/openssl/pull/32046

diff --git a/doc/man7/provider-kdf.pod b/doc/man7/provider-kdf.pod
index 432b67472f..9ede5fb2c6 100644
--- a/doc/man7/provider-kdf.pod
+++ b/doc/man7/provider-kdf.pod
@@ -341,7 +341,10 @@ It is defined as per RFC 7292 section B.3.
 OSSL_FUNC_kdf_newctx() and OSSL_FUNC_kdf_dupctx() should return the newly created
 provider side KDF context, or NULL on failure.

-OSSL_FUNC_kdf_derive(), OSSL_FUNC_kdf_derive_skey(), OSSL_FUNC_kdf_get_params(),
+OSSL_FUNC_kdf_derive_skey() should return the newly created opaque
+provider-side key object, or NULL on failure.
+
+OSSL_FUNC_kdf_derive(), OSSL_FUNC_kdf_get_params(),
 OSSL_FUNC_kdf_get_ctx_params(), OSSL_FUNC_kdf_set_ctx_params() and
 OSSL_FUNC_kdf_set_skey() should return 1 for success or 0 on error.

diff --git a/doc/man7/provider-keyexch.pod b/doc/man7/provider-keyexch.pod
index d5d2d4769c..8a8bc64fe7 100644
--- a/doc/man7/provider-keyexch.pod
+++ b/doc/man7/provider-keyexch.pod
@@ -28,9 +28,10 @@ provider-keyexch - The keyexch library E<lt>-E<gt> provider functions
  int OSSL_FUNC_keyexch_set_peer(void *ctx, void *provkey);
  int OSSL_FUNC_keyexch_derive(void *ctx, unsigned char *secret, size_t *secretlen,
                               size_t outlen);
- int OSSL_FUNC_keyexch_derive_skey(void *ctx, const char *key_type, void *provctx,
-                                   OSSL_FUNC_skeymgmt_import_fn *import,
-                                   size_t keylen, const OSSL_PARAM params[]);
+ void *OSSL_FUNC_keyexch_derive_skey(void *ctx, const char *key_type,
+                                     void *provctx,
+                                     OSSL_FUNC_skeymgmt_import_fn *import,
+                                     size_t keylen, const OSSL_PARAM params[]);

  /* Key Exchange parameters */
  int OSSL_FUNC_keyexch_set_ctx_params(void *ctx, const OSSL_PARAM params[]);
@@ -115,10 +116,10 @@ OSSL_FUNC_keyexch_init() initialises a key exchange operation given a provider s
 exchange context in the I<ctx> parameter, and a pointer to a provider key object
 in the I<provkey> parameter.
 The I<params>, if not NULL, should be set on the context in a manner similar to
-using OSSL_FUNC_keyexch_set_params().
+using OSSL_FUNC_keyexch_set_ctx_params().
 The key object should have been previously
 generated, loaded or imported into the provider using the key management
-(OSSL_OP_KEYMGMT) operation (see provider-keymgmt(7)>.
+(OSSL_OP_KEYMGMT) operation (see L<provider-keymgmt(7)>.

 OSSL_FUNC_keyexch_set_peer() is called to supply the peer's public key (in the
 I<provkey> parameter) to be used when deriving the shared secret.
@@ -126,7 +127,7 @@ It is also passed a previously initialised key exchange context in the I<ctx>
 parameter.
 The key object should have been previously generated, loaded or imported into
 the provider using the key management (OSSL_OP_KEYMGMT) operation (see
-provider-keymgmt(7)>.
+L<provider-keymgmt(7)>.

 OSSL_FUNC_keyexch_derive() performs the actual key exchange itself by deriving a shared
 secret.
@@ -143,7 +144,7 @@ uses an opaque object for storing the derived key. It accepts I<key_type>
 parameter to give a hint to the provider what type of the key (e.g. generic or
 AES) would be generated and I<import> function from the B<EVP_SKEYMGMT> object
 to be associated with the key. The B<EVP_SKEYMGMT> object comes from the same
-provider as the KDF itself.
+provider as the key exchange implementation.

 =head2 Key Exchange Parameters Functions

@@ -253,10 +254,12 @@ to return 0.
 OSSL_FUNC_keyexch_newctx() and OSSL_FUNC_keyexch_dupctx() should return the newly created
 provider side key exchange context, or NULL on failure.

-OSSL_FUNC_keyexch_init(), OSSL_FUNC_keyexch_set_peer(), OSSL_FUNC_keyexch_derive(),
-OSSL_FUNC_keyexch_derive_skey(),
-OSSL_FUNC_keyexch_set_params(), and OSSL_FUNC_keyexch_get_params() should return 1 for success
-or 0 on error.
+OSSL_FUNC_keyexch_derive_skey() should return the newly created opaque
+provider-side key object, or NULL on failure.
+
+OSSL_FUNC_keyexch_init(), OSSL_FUNC_keyexch_set_peer(),
+OSSL_FUNC_keyexch_derive(), OSSL_FUNC_keyexch_set_ctx_params(), and
+OSSL_FUNC_keyexch_get_ctx_params() should return 1 for success or 0 on error.

 OSSL_FUNC_keyexch_settable_ctx_params() and OSSL_FUNC_keyexch_gettable_ctx_params() should
 always return a constant L<OSSL_PARAM(3)> array.