From 307c00415c5972aa6c5b3555bfe8920f69b3e183 Mon Sep 17 00:00:00 2001
From: Nikola Pajkovsky <nikolap@openssl.org>
Date: Thu, 19 Feb 2026 12:51:52 +0100
Subject: [PATCH] evp_kdf: add freeze option

  $ ./evp_kdf -o evp_isolated 64 -f
  Average time per computation: 8181.213888us
  $ ./evp_kdf -o evp_isolated 64
  Average time per computation: 8307.157135us

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
---
 README.md             |  3 ++-
 source/CMakeLists.txt |  6 ++++++
 source/evp_kdf.c      | 28 +++++++++++++++++++++++++++-
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index e3697ea..da99d1f 100644
--- a/README.md
+++ b/README.md
@@ -329,9 +329,10 @@ Four modes of operation:
 - deprecated_isolated: Use legacy API and don't allow shared data between computations
 
 ```
-Usage: evp_kdf [-h] [-t] [-o operation] [-V] thread-count
+Usage: evp_kdf [-h] [-t] [-f] [-o operation] [-V] thread-count
 -h - print this help output
 -t - terse output
+-f - freeze default context (available only with openssl >= 4.x.x)
 -o operation - mode of operation. One of [evp_isolated, evp_shared, deprecated_isolated, deprecated_shared] (default: evp_shared)
 -V - print version information and exit
 thread-count - number of threads
diff --git a/source/CMakeLists.txt b/source/CMakeLists.txt
index c044443..17c7f03 100644
--- a/source/CMakeLists.txt
+++ b/source/CMakeLists.txt
@@ -346,6 +346,12 @@ list(APPEND run_opts run_writeread_buffers)
 add_executable(evp_hash evp_hash.c)
 target_link_libraries(evp_hash PRIVATE perf)
 list(APPEND run_tests evp_hash)
+if( HAVE_OSSL_LIB_CTX_FREEZE )
+    set(run_evp_kdf_freeze
+        evp_kdf "" "" "-f"
+        CACHE STRING "Freeze LIB_CTX for evp_kdf")
+    list(APPEND run_opts run_evp_kdf_freeze)
+endif()
 set(run_evp_hash_operations
     evp_hash "" "" "-o deprecated" "-o evp_isolated" "-o evp_shared"
     CACHE STRING "Modes of operation for evp_hash")
diff --git a/source/evp_kdf.c b/source/evp_kdf.c
index ea38e7f..2ba4d64 100644
--- a/source/evp_kdf.c
+++ b/source/evp_kdf.c
@@ -14,6 +14,7 @@
 
 #define OPENSSL_SUPPRESS_DEPRECATED
 
+#include "config.h"
 #include <stdlib.h>
 #include <stdio.h>
 #ifndef _WIN32
@@ -169,9 +170,16 @@ static void do_deprecated_shared(size_t num)
 
 static void print_help(FILE *file)
 {
+#ifdef HAVE_OSSL_LIB_CTX_FREEZE
+    fprintf(file, "Usage: evp_kdf [-h] [-t] [-f] [-o operation] [-V] thread-count\n");
+#else
     fprintf(file, "Usage: evp_kdf [-h] [-t] [-o operation] [-V] thread-count\n");
+#endif
     fprintf(file, "-h - print this help output\n");
     fprintf(file, "-t - terse output\n");
+#ifdef HAVE_OSSL_LIB_CTX_FREEZE
+    printf("-f - freeze default context\n");
+#endif
     fprintf(file, "-o operation - mode of operation. One of [evp_isolated, evp_shared, deprecated_isolated, deprecated_shared] (default: evp_shared)\n");
     fprintf(file, "-V - print version information and exit\n");
     fprintf(file, "thread-count - number of threads\n");
@@ -184,9 +192,19 @@ int main(int argc, char *argv[])
     double av;
     int terse = 0, operation = EVP_SHARED;
     int j, opt, rc = EXIT_FAILURE;
+    char *getopt_options = "Vhto:";
+#ifdef HAVE_OSSL_LIB_CTX_FREEZE
+    int freeze = 0;
+    getopt_options = "Vhto:f";
+#endif
 
-    while ((opt = getopt(argc, argv, "Vhto:")) != -1) {
+    while ((opt = getopt(argc, argv, getopt_options)) != -1) {
         switch (opt) {
+#ifdef HAVE_OSSL_LIB_CTX_FREEZE
+        case 'f':
+            freeze = 1;
+            break;
+#endif
         case 't':
             terse = 1;
             break;
@@ -242,6 +260,14 @@ int main(int argc, char *argv[])
 
     max_time = ossl_time_add(ossl_time_now(), ossl_seconds2time(RUN_TIME));
 
+#ifdef HAVE_OSSL_LIB_CTX_FREEZE
+    if (freeze) {
+        if (OSSL_LIB_CTX_freeze(NULL, NULL) == 0) {
+            fprintf(stderr, "Freezing LIB CTX failed\n");
+            goto err;
+        }
+    }
+#endif
     switch (operation) {
     case EVP_SHARED:
         run_err = !perflib_run_multi_thread_test(do_evp_shared, threadcount, &duration) || run_err;