[PHP-DEV] [RFC] OpenSSL provider-based algorithms and post-quantum cryptography support

Hi internals,

I'd like to start a discussion about improving support for modern 
OpenSSL provider-based asymmetric algorithms in ext/openssl, in 
particular post-quantum cryptography (PQC).

This is related to the following existing issues:

https://github.com/php/php-src/issues/22862
https://github.com/php/php-src/issues/23421

With recent OpenSSL versions, standardized post-quantum algorithms such 
as ML-KEM, ML-DSA and SLH-DSA are available through the EVP/provider APIs.

However, PHP's OpenSSL extension currently exposes asymmetric 
cryptography largely through a fixed set of OPENSSL_KEYTYPE_* constants 
and does not expose the generic KEM encapsulation/decapsulation 
operations provided by OpenSSL.

Rather than adding individual PHP constants and APIs for each PQC 
algorithm, I would like to explore exposing the underlying OpenSSL 
provider model more generically.

The initial idea is to cover:

* asymmetric key generation using an OpenSSL algorithm name;
* provider-backed algorithms which do not have a dedicated 
OPENSSL_KEYTYPE_* constant;
* generic KEM encapsulation and decapsulation;
* support for provider-backed signature algorithms such as ML-DSA and 
SLH-DSA through the existing signing APIs where possible.

An important goal would be to keep this generic rather than making the 
PHP API specific to ML-KEM or other currently standardized PQC 
algorithms. This would allow future algorithms and potentially 
third-party OpenSSL providers to use the same API.

I should also mention that I am probably not the right person to 
implement the C side of this proposal myself. My C experience is 
somewhat rusty and, given that this concerns security-sensitive 
cryptographic functionality, I would strongly prefer the implementation 
to be done or at least closely guided and reviewed by someone who is 
already familiar with ext/openssl and its internals.

 From my current understanding, the implementation effort should be 
relatively contained, since the cryptographic primitives themselves are 
already implemented by OpenSSL. The main task would be exposing the 
corresponding existing EVP/provider functionality through ext/openssl 
and integrating it consistently with PHP's existing OpenSSL APIs.

That said, I don't want to underestimate the details involved in safely 
exposing these APIs, particularly around key handling, provider 
compatibility, error handling and maintaining compatibility with the 
OpenSSL versions supported by PHP.

I am happy to work on the RFC, API design, documentation and testing, 
and to help with the implementation where I can. I would particularly 
appreciate involvement from someone already working on ext/openssl for 
the actual C implementation.

I am currently preparing an RFC and would especially appreciate feedback 
from people familiar with ext/openssl on the general direction and API 
design before finalizing the proposal.

In particular, I'd be interested in opinions on whether provider-based 
key support and the KEM API should be addressed in a single RFC or split 
into separate proposals.

Thanks,
Timo