Make EVP_CIPHER_[gs]et_asn1_iv() local to evp_cipher

These formerly public functions have only ever been called from
EVP_CIPHER_asn1_to_param() and EVP_CPIHER_param_to_asn1(), either
directly if the EVP_CIPH_FLAG_DEFAULT_ASN1 flag is set, or indirectly
when set as the .[gs]et_asn1_parameters() method of the EVP_CIPHER.
This commit removes their use in .[gs]et_asn1_parameters() dating back
to long before the EVP_CIPH_FLAG_DEFAULT_ASN1 was introduced in 2010.

This way the only remaining consumer of .[gs]et_asn1_parameters() is RC2.

ok jsing

9 files changed, 174 insertions, 153 deletions

diff --git a/src/lib/libcrypto/evp/e_bf.c b/src/lib/libcrypto/evp/e_bf.c
index 4f3799975b..8c32a5658e 100644
--- a/src/lib/libcrypto/evp/e_bf.c
+++ b/src/lib/libcrypto/evp/e_bf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_bf.c,v 1.19 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_bf.c,v 1.20 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -162,13 +162,14 @@ static const EVP_CIPHER bf_cbc = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CBC_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = bf_init_key,
         .do_cipher = bf_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_BF_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -184,13 +185,14 @@ static const EVP_CIPHER bf_cfb64 = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = bf_init_key,
         .do_cipher = bf_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_BF_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -206,13 +208,14 @@ static const EVP_CIPHER bf_ofb = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_OFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = bf_init_key,
         .do_cipher = bf_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_BF_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -228,13 +231,14 @@ static const EVP_CIPHER bf_ecb = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 0,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_ECB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = bf_init_key,
         .do_cipher = bf_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_BF_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
diff --git a/src/lib/libcrypto/evp/e_camellia.c b/src/lib/libcrypto/evp/e_camellia.c
index 5538281e75..8da46275a3 100644
--- a/src/lib/libcrypto/evp/e_camellia.c
+++ b/src/lib/libcrypto/evp/e_camellia.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_camellia.c,v 1.21 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: e_camellia.c,v 1.22 2025/05/27 03:58:12 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
  *
@@ -163,13 +163,13 @@ static const EVP_CIPHER camellia_128_cbc = {
         .block_size = 16,
         .key_len = 16,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -185,13 +185,13 @@ static const EVP_CIPHER camellia_128_cfb128 = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_cfb128_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -207,13 +207,13 @@ static const EVP_CIPHER camellia_128_ofb = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_OFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -229,13 +229,13 @@ static const EVP_CIPHER camellia_128_ecb = {
         .block_size = 16,
         .key_len = 16,
         .iv_len = 0,
-        .flags = 0 | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_ECB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -321,13 +321,13 @@ static const EVP_CIPHER camellia_192_cbc = {
         .block_size = 16,
         .key_len = 24,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -343,13 +343,13 @@ static const EVP_CIPHER camellia_192_cfb128 = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_cfb128_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -365,13 +365,13 @@ static const EVP_CIPHER camellia_192_ofb = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_OFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -387,13 +387,13 @@ static const EVP_CIPHER camellia_192_ecb = {
         .block_size = 16,
         .key_len = 24,
         .iv_len = 0,
-        .flags = 0 | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_ECB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -479,13 +479,13 @@ static const EVP_CIPHER camellia_256_cbc = {
         .block_size = 16,
         .key_len = 32,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -501,13 +501,13 @@ static const EVP_CIPHER camellia_256_cfb128 = {
         .block_size = 1,
         .key_len = 32,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_cfb128_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -523,13 +523,13 @@ static const EVP_CIPHER camellia_256_ofb = {
         .block_size = 1,
         .key_len = 32,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_OFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -545,13 +545,13 @@ static const EVP_CIPHER camellia_256_ecb = {
         .block_size = 16,
         .key_len = 32,
         .iv_len = 0,
-        .flags = 0 | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_ECB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -589,13 +589,13 @@ static const EVP_CIPHER camellia_128_cfb1 = {
         .block_size = 1,
         .key_len = 128/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_cfb1_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -633,13 +633,13 @@ static const EVP_CIPHER camellia_192_cfb1 = {
         .block_size = 1,
         .key_len = 192/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_cfb1_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -677,13 +677,13 @@ static const EVP_CIPHER camellia_256_cfb1 = {
         .block_size = 1,
         .key_len = 256/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_cfb1_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -720,13 +720,13 @@ static const EVP_CIPHER camellia_128_cfb8 = {
         .block_size = 1,
         .key_len = 128/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_128_cfb8_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -762,13 +762,13 @@ static const EVP_CIPHER camellia_192_cfb8 = {
         .block_size = 1,
         .key_len = 192/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_192_cfb8_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -804,13 +804,13 @@ static const EVP_CIPHER camellia_256_cfb8 = {
         .block_size = 1,
         .key_len = 256/8,
         .iv_len = 16,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = camellia_init_key,
         .do_cipher = camellia_256_cfb8_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAMELLIA_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
diff --git a/src/lib/libcrypto/evp/e_cast.c b/src/lib/libcrypto/evp/e_cast.c
index 1575a7a5bb..283cb8cf63 100644
--- a/src/lib/libcrypto/evp/e_cast.c
+++ b/src/lib/libcrypto/evp/e_cast.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_cast.c,v 1.18 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_cast.c,v 1.19 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -162,13 +162,14 @@ static const EVP_CIPHER cast5_cbc = {
         .block_size = 8,
         .key_len = CAST_KEY_LENGTH,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CBC_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = cast_init_key,
         .do_cipher = cast5_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAST_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -184,13 +185,14 @@ static const EVP_CIPHER cast5_cfb64 = {
         .block_size = 1,
         .key_len = CAST_KEY_LENGTH,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = cast_init_key,
         .do_cipher = cast5_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAST_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -206,13 +208,14 @@ static const EVP_CIPHER cast5_ofb = {
         .block_size = 1,
         .key_len = CAST_KEY_LENGTH,
         .iv_len = 8,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_OFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = cast_init_key,
         .do_cipher = cast5_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAST_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -228,13 +231,14 @@ static const EVP_CIPHER cast5_ecb = {
         .block_size = 8,
         .key_len = CAST_KEY_LENGTH,
         .iv_len = 0,
-        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_VARIABLE_LENGTH | EVP_CIPH_ECB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = cast_init_key,
         .do_cipher = cast5_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(EVP_CAST_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
diff --git a/src/lib/libcrypto/evp/e_des.c b/src/lib/libcrypto/evp/e_des.c
index fb335e95b1..680f77a723 100644
--- a/src/lib/libcrypto/evp/e_des.c
+++ b/src/lib/libcrypto/evp/e_des.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_des.c,v 1.24 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_des.c,v 1.25 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -226,13 +226,14 @@ static const EVP_CIPHER des_cbc = {
         .block_size = 8,
         .key_len = 8,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
@@ -248,13 +249,14 @@ static const EVP_CIPHER des_cfb64 = {
         .block_size = 1,
         .key_len = 8,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
@@ -270,13 +272,14 @@ static const EVP_CIPHER des_ofb = {
         .block_size = 1,
         .key_len = 8,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_OFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
@@ -292,13 +295,14 @@ static const EVP_CIPHER des_ecb = {
         .block_size = 8,
         .key_len = 8,
         .iv_len = 0,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
@@ -314,13 +318,14 @@ static const EVP_CIPHER des_cfb1 = {
         .block_size = 1,
         .key_len = 8,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_cfb1_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
@@ -336,13 +341,14 @@ static const EVP_CIPHER des_cfb8 = {
         .block_size = 1,
         .key_len = 8,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_init_key,
         .do_cipher = des_cfb8_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_key_schedule),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des_ctrl,
 };
 
diff --git a/src/lib/libcrypto/evp/e_des3.c b/src/lib/libcrypto/evp/e_des3.c
index 48fbcdb366..f3eb4cce1b 100644
--- a/src/lib/libcrypto/evp/e_des3.c
+++ b/src/lib/libcrypto/evp/e_des3.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_des3.c,v 1.30 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_des3.c,v 1.31 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -258,13 +258,14 @@ static const EVP_CIPHER des_ede_cbc = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE |
+           EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede_init_key,
         .do_cipher = des_ede_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -280,13 +281,14 @@ static const EVP_CIPHER des_ede_cfb64 = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede_init_key,
         .do_cipher = des_ede_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -307,8 +309,8 @@ static const EVP_CIPHER des_ede_ofb = {
         .do_cipher = des_ede_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -324,13 +326,14 @@ static const EVP_CIPHER des_ede_ecb = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 0,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede_init_key,
         .do_cipher = des_ede_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -352,13 +355,14 @@ static const EVP_CIPHER des_ede3_cbc = {
         .block_size = 8,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CBC_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -374,13 +378,14 @@ static const EVP_CIPHER des_ede3_cfb64 = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -396,13 +401,14 @@ static const EVP_CIPHER des_ede3_ofb = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_OFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -418,13 +424,14 @@ static const EVP_CIPHER des_ede3_ecb = {
         .block_size = 8,
         .key_len = 24,
         .iv_len = 0,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_ECB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -441,13 +448,14 @@ static const EVP_CIPHER des_ede3_cfb1 = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_cfb1_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
@@ -464,13 +472,14 @@ static const EVP_CIPHER des_ede3_cfb8 = {
         .block_size = 1,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_RAND_KEY | EVP_CIPH_CFB_MODE |
+            EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = des_ede3_init_key,
         .do_cipher = des_ede3_cfb8_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DES_EDE_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = des3_ctrl,
 };
 
diff --git a/src/lib/libcrypto/evp/e_idea.c b/src/lib/libcrypto/evp/e_idea.c
index 86cf77602a..5d33a110fd 100644
--- a/src/lib/libcrypto/evp/e_idea.c
+++ b/src/lib/libcrypto/evp/e_idea.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_idea.c,v 1.22 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_idea.c,v 1.23 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -181,13 +181,13 @@ static const EVP_CIPHER idea_cbc = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 8,
-        .flags = 0 | EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = idea_init_key,
         .do_cipher = idea_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(IDEA_KEY_SCHEDULE),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -203,13 +203,13 @@ static const EVP_CIPHER idea_cfb64 = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 8,
-        .flags = 0 | EVP_CIPH_CFB_MODE,
+        .flags = EVP_CIPH_CFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = idea_init_key,
         .do_cipher = idea_cfb64_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(IDEA_KEY_SCHEDULE),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -225,13 +225,13 @@ static const EVP_CIPHER idea_ofb = {
         .block_size = 1,
         .key_len = 16,
         .iv_len = 8,
-        .flags = 0 | EVP_CIPH_OFB_MODE,
+        .flags = EVP_CIPH_OFB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = idea_init_key,
         .do_cipher = idea_ofb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(IDEA_KEY_SCHEDULE),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
@@ -247,13 +247,13 @@ static const EVP_CIPHER idea_ecb = {
         .block_size = 8,
         .key_len = 16,
         .iv_len = 0,
-        .flags = 0 | EVP_CIPH_ECB_MODE,
+        .flags = EVP_CIPH_ECB_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = idea_init_key,
         .do_cipher = idea_ecb_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(IDEA_KEY_SCHEDULE),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
diff --git a/src/lib/libcrypto/evp/e_xcbc_d.c b/src/lib/libcrypto/evp/e_xcbc_d.c
index 1e3bee0791..1c5e6c32b2 100644
--- a/src/lib/libcrypto/evp/e_xcbc_d.c
+++ b/src/lib/libcrypto/evp/e_xcbc_d.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_xcbc_d.c,v 1.18 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: e_xcbc_d.c,v 1.19 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -88,13 +88,13 @@ static const EVP_CIPHER d_xcbc_cipher = {
         .block_size = 8,
         .key_len = 24,
         .iv_len = 8,
-        .flags = EVP_CIPH_CBC_MODE,
+        .flags = EVP_CIPH_CBC_MODE | EVP_CIPH_FLAG_DEFAULT_ASN1,
         .init = desx_cbc_init_key,
         .do_cipher = desx_cbc_cipher,
         .cleanup = NULL,
         .ctx_size = sizeof(DESX_CBC_KEY),
-        .set_asn1_parameters = EVP_CIPHER_set_asn1_iv,
-        .get_asn1_parameters = EVP_CIPHER_get_asn1_iv,
+        .set_asn1_parameters = NULL,
+        .get_asn1_parameters = NULL,
         .ctrl = NULL,
 };
 
diff --git a/src/lib/libcrypto/evp/evp_cipher.c b/src/lib/libcrypto/evp/evp_cipher.c
index 09e6a881cf..b60f3ca78a 100644
--- a/src/lib/libcrypto/evp/evp_cipher.c
+++ b/src/lib/libcrypto/evp/evp_cipher.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_cipher.c,v 1.25 2025/05/26 12:58:42 tb Exp $ */
+/* $OpenBSD: evp_cipher.c,v 1.26 2025/05/27 03:58:12 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -947,7 +947,7 @@ LCRYPTO_ALIAS(EVP_CIPHER_CTX_flags);
  * Used by CMS and its predecessors. Only RC2 has a custom method.
  */
 
-int
+static int
 EVP_CIPHER_get_asn1_iv(EVP_CIPHER_CTX *ctx, ASN1_TYPE *type)
 {
         int iv_len;
@@ -981,7 +981,7 @@ EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *ctx, ASN1_TYPE *type)
         return -1;
 }
 
-int
+static int
 EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *ctx, ASN1_TYPE *type)
 {
         int iv_len;
diff --git a/src/lib/libcrypto/evp/evp_local.h b/src/lib/libcrypto/evp/evp_local.h
index 54cd65d0af..76465643c6 100644
--- a/src/lib/libcrypto/evp/evp_local.h
+++ b/src/lib/libcrypto/evp/evp_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_local.h,v 1.25 2024/08/29 16:58:19 tb Exp $ */
+/* $OpenBSD: evp_local.h,v 1.26 2025/05/27 03:58:12 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -353,9 +353,7 @@ struct evp_aead_ctx_st {
 };
 
 /* Legacy EVP_CIPHER methods used by CMS and its predecessors. */
-int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *cipher, ASN1_TYPE *type);
 int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *cipher, ASN1_TYPE *type);
-int EVP_CIPHER_get_asn1_iv(EVP_CIPHER_CTX *cipher, ASN1_TYPE *type);
 int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *cipher, ASN1_TYPE *type);
 
 int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,