Refactor OpenSSL 'ECDSA' EVP_SIGNATURE to also include ECDSA+hash composites

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24992)

7 files changed, 836 insertions, 156 deletions

diff --git a/providers/defltprov.c b/providers/defltprov.c
index 380db83675..58075cde9d 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -434,6 +434,15 @@ static const OSSL_ALGORITHM deflt_signature[] = {
     { PROV_NAMES_ED448ph, "provider=default", ossl_ed448ph_signature_functions },
 # endif
     { PROV_NAMES_ECDSA, "provider=default", ossl_ecdsa_signature_functions },
+    { PROV_NAMES_ECDSA_SHA1, "provider=default", ossl_ecdsa_sha1_signature_functions },
+    { PROV_NAMES_ECDSA_SHA224, "provider=default", ossl_ecdsa_sha224_signature_functions },
+    { PROV_NAMES_ECDSA_SHA256, "provider=default", ossl_ecdsa_sha256_signature_functions },
+    { PROV_NAMES_ECDSA_SHA384, "provider=default", ossl_ecdsa_sha384_signature_functions },
+    { PROV_NAMES_ECDSA_SHA512, "provider=default", ossl_ecdsa_sha512_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_224, "provider=default", ossl_ecdsa_sha3_224_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_256, "provider=default", ossl_ecdsa_sha3_256_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_384, "provider=default", ossl_ecdsa_sha3_384_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_512, "provider=default", ossl_ecdsa_sha3_512_signature_functions },
 # ifndef OPENSSL_NO_SM2
     { PROV_NAMES_SM2, "provider=default", ossl_sm2_signature_functions },
 # endif
diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index f2ab35d2ae..c446367dea 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -460,6 +460,15 @@ static const OSSL_ALGORITHM fips_signature[] = {
       ossl_ed448ph_signature_functions },
 # endif
     { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions },
+    { PROV_NAMES_ECDSA_SHA1, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha1_signature_functions },
+    { PROV_NAMES_ECDSA_SHA224, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha224_signature_functions },
+    { PROV_NAMES_ECDSA_SHA256, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha256_signature_functions },
+    { PROV_NAMES_ECDSA_SHA384, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha384_signature_functions },
+    { PROV_NAMES_ECDSA_SHA512, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha512_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_224, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha3_224_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_256, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha3_256_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_384, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha3_384_signature_functions },
+    { PROV_NAMES_ECDSA_SHA3_512, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_sha3_512_signature_functions },
 #endif
     { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES,
       ossl_mac_legacy_hmac_signature_functions },
diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h
index 61d8ee0cf0..7f1facb054 100644
--- a/providers/implementations/include/prov/implementations.h
+++ b/providers/implementations/include/prov/implementations.h
@@ -368,6 +368,15 @@ extern const OSSL_DISPATCH ossl_ed25519ctx_signature_functions[];
 extern const OSSL_DISPATCH ossl_ed448_signature_functions[];
 extern const OSSL_DISPATCH ossl_ed448ph_signature_functions[];
 extern const OSSL_DISPATCH ossl_ecdsa_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha1_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha224_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha256_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha384_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha512_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha3_224_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha3_256_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha3_384_signature_functions[];
+extern const OSSL_DISPATCH ossl_ecdsa_sha3_512_signature_functions[];
 extern const OSSL_DISPATCH ossl_mac_legacy_hmac_signature_functions[];
 extern const OSSL_DISPATCH ossl_mac_legacy_siphash_signature_functions[];
 extern const OSSL_DISPATCH ossl_mac_legacy_poly1305_signature_functions[];
diff --git a/providers/implementations/include/prov/names.h b/providers/implementations/include/prov/names.h
index 4b7a62494e..fccfd9e376 100644
--- a/providers/implementations/include/prov/names.h
+++ b/providers/implementations/include/prov/names.h
@@ -322,6 +322,15 @@
 #define PROV_NAMES_ECDH "ECDH"
 #define PROV_DESCS_ECDH "OpenSSL ECDH implementation"
 #define PROV_NAMES_ECDSA "ECDSA"
+#define PROV_NAMES_ECDSA_SHA1 "ECDSA-SHA1:ECDSA-SHA-1:ecdsa-with-SHA1:1.2.840.10045.4.1"
+#define PROV_NAMES_ECDSA_SHA224 "ECDSA-SHA2-224:ECDSA-SHA224:ecdsa-with-SHA224:1.2.840.10045.4.3.1"
+#define PROV_NAMES_ECDSA_SHA256 "ECDSA-SHA2-256:ECDSA-SHA256:ecdsa-with-SHA256:1.2.840.10045.4.3.2"
+#define PROV_NAMES_ECDSA_SHA384 "ECDSA-SHA2-384:ECDSA-SHA384:ecdsa-with-SHA384:1.2.840.10045.4.3.3"
+#define PROV_NAMES_ECDSA_SHA512 "ECDSA-SHA2-512:ECDSA-SHA512:ecdsa-with-SHA512:1.2.840.10045.4.3.4"
+#define PROV_NAMES_ECDSA_SHA3_224 "ECDSA-SHA3-224:ecdsa_with_SHA3-224:id-ecdsa-with-sha3-224:2.16.840.1.101.3.4.3.9"
+#define PROV_NAMES_ECDSA_SHA3_256 "ECDSA-SHA3-256:ecdsa_with_SHA3-256:id-ecdsa-with-sha3-256:2.16.840.1.101.3.4.3.10"
+#define PROV_NAMES_ECDSA_SHA3_384 "ECDSA-SHA3-384:ecdsa_with_SHA3-384:id-ecdsa-with-sha3-384:2.16.840.1.101.3.4.3.11"
+#define PROV_NAMES_ECDSA_SHA3_512 "ECDSA-SHA3-512:ecdsa_with_SHA3-512:id-ecdsa-with-sha3-512:2.16.840.1.101.3.4.3.12"
 #define PROV_DESCS_ECDSA "OpenSSL ECDSA implementation"
 #define PROV_NAMES_X25519 "X25519:1.3.101.110"
 #define PROV_DESCS_X25519 "OpenSSL X25519 implementation"
@@ -342,15 +351,15 @@
 #define PROV_NAMES_DHX "DHX:X9.42 DH:dhpublicnumber:1.2.840.10046.2.1"
 #define PROV_DESCS_DHX "OpenSSL X9.42 DH implementation"
 #define PROV_NAMES_DSA "DSA:dsaEncryption:1.2.840.10040.4.1"
-#define PROV_NAMES_DSA_SHA1 "DSA-SHA1:DSA-SHA-1:sha1WithDSAEncryption:1.2.840.10040.4.3"
+#define PROV_NAMES_DSA_SHA1 "DSA-SHA1:DSA-SHA-1:dsaWithSHA1:1.2.840.10040.4.3"
 #define PROV_NAMES_DSA_SHA224 "DSA-SHA2-224:DSA-SHA224:dsa_with_SHA224:2.16.840.1.101.3.4.3.1"
 #define PROV_NAMES_DSA_SHA256 "DSA-SHA2-256:DSA-SHA256:dsa_with_SHA256:2.16.840.1.101.3.4.3.2"
-#define PROV_NAMES_DSA_SHA384 "DSA-SHA2-384:DSA-SHA384:id-dsa-with-sha384:1.2.840.1.101.3.4.3.3"
-#define PROV_NAMES_DSA_SHA512 "DSA-SHA2-512:DSA-SHA512:id-dsa-with-sha512:1.2.840.1.101.3.4.3.4"
-#define PROV_NAMES_DSA_SHA3_224 "DSA-SHA3-224:id-dsa-with-sha3-224:2.16.840.1.101.3.4.3.5"
-#define PROV_NAMES_DSA_SHA3_256 "DSA-SHA3-256:id-dsa-with-sha3-256:2.16.840.1.101.3.4.3.6"
-#define PROV_NAMES_DSA_SHA3_384 "DSA-SHA3-384:id-dsa-with-sha3-384:2.16.840.1.101.3.4.3.7"
-#define PROV_NAMES_DSA_SHA3_512 "DSA-SHA3-512:id-dsa-with-sha3-512:2.16.840.1.101.3.4.3.8"
+#define PROV_NAMES_DSA_SHA384 "DSA-SHA2-384:DSA-SHA384:dsa_with_SHA384:id-dsa-with-sha384:1.2.840.1.101.3.4.3.3"
+#define PROV_NAMES_DSA_SHA512 "DSA-SHA2-512:DSA-SHA512:dsa_with_SHA512:id-dsa-with-sha512:1.2.840.1.101.3.4.3.4"
+#define PROV_NAMES_DSA_SHA3_224 "DSA-SHA3-224:dsa_with_SHA3-224:id-dsa-with-sha3-224:2.16.840.1.101.3.4.3.5"
+#define PROV_NAMES_DSA_SHA3_256 "DSA-SHA3-256:dsa_with_SHA3-256:id-dsa-with-sha3-256:2.16.840.1.101.3.4.3.6"
+#define PROV_NAMES_DSA_SHA3_384 "DSA-SHA3-384:dsa_with_SHA3-384:id-dsa-with-sha3-384:2.16.840.1.101.3.4.3.7"
+#define PROV_NAMES_DSA_SHA3_512 "DSA-SHA3-512:dsa_with_SHA3-512:id-dsa-with-sha3-512:2.16.840.1.101.3.4.3.8"
 #define PROV_DESCS_DSA "OpenSSL DSA implementation"
 #define PROV_NAMES_RSA "RSA:rsaEncryption:1.2.840.113549.1.1.1"
 #define PROV_NAMES_RSA_MD2 "RSA-MD2:md2WithRSAEncryption:1.2.840.113549.1.1.2"
diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
index 46d100995c..4cbad1c38e 100644
--- a/providers/implementations/signature/ecdsa_sig.c
+++ b/providers/implementations/signature/ecdsa_sig.c
@@ -30,14 +30,18 @@
 #include "prov/implementations.h"
 #include "prov/provider_ctx.h"
 #include "prov/securitycheck.h"
-#include "crypto/ec.h"
 #include "prov/der_ec.h"
+#include "crypto/ec.h"
 
 static OSSL_FUNC_signature_newctx_fn ecdsa_newctx;
 static OSSL_FUNC_signature_sign_init_fn ecdsa_sign_init;
 static OSSL_FUNC_signature_verify_init_fn ecdsa_verify_init;
 static OSSL_FUNC_signature_sign_fn ecdsa_sign;
+static OSSL_FUNC_signature_sign_message_update_fn ecdsa_signverify_message_update;
+static OSSL_FUNC_signature_sign_message_final_fn ecdsa_sign_message_final;
 static OSSL_FUNC_signature_verify_fn ecdsa_verify;
+static OSSL_FUNC_signature_verify_message_update_fn ecdsa_signverify_message_update;
+static OSSL_FUNC_signature_verify_message_final_fn ecdsa_verify_message_final;
 static OSSL_FUNC_signature_digest_sign_init_fn ecdsa_digest_sign_init;
 static OSSL_FUNC_signature_digest_sign_update_fn ecdsa_digest_signverify_update;
 static OSSL_FUNC_signature_digest_sign_final_fn ecdsa_digest_sign_final;
@@ -46,6 +50,7 @@ static OSSL_FUNC_signature_digest_verify_update_fn ecdsa_digest_signverify_updat
 static OSSL_FUNC_signature_digest_verify_final_fn ecdsa_digest_verify_final;
 static OSSL_FUNC_signature_freectx_fn ecdsa_freectx;
 static OSSL_FUNC_signature_dupctx_fn ecdsa_dupctx;
+static OSSL_FUNC_signature_query_key_types_fn ecdsa_sigalg_query_key_types;
 static OSSL_FUNC_signature_get_ctx_params_fn ecdsa_get_ctx_params;
 static OSSL_FUNC_signature_gettable_ctx_params_fn ecdsa_gettable_ctx_params;
 static OSSL_FUNC_signature_set_ctx_params_fn ecdsa_set_ctx_params;
@@ -54,6 +59,8 @@ static OSSL_FUNC_signature_get_ctx_md_params_fn ecdsa_get_ctx_md_params;
 static OSSL_FUNC_signature_gettable_ctx_md_params_fn ecdsa_gettable_ctx_md_params;
 static OSSL_FUNC_signature_set_ctx_md_params_fn ecdsa_set_ctx_md_params;
 static OSSL_FUNC_signature_settable_ctx_md_params_fn ecdsa_settable_ctx_md_params;
+static OSSL_FUNC_signature_set_ctx_params_fn ecdsa_sigalg_set_ctx_params;
+static OSSL_FUNC_signature_settable_ctx_params_fn ecdsa_sigalg_settable_ctx_params;
 
 /*
  * What's passed as an actual key is defined by the KEYMGMT interface.
@@ -65,9 +72,20 @@ typedef struct {
     OSSL_LIB_CTX *libctx;
     char *propq;
     EC_KEY *ec;
-    char mdname[OSSL_MAX_NAME_SIZE];
+    /* |operation| reuses EVP's operation bitfield */
+    int operation;
 
     /*
+     * Flag to determine if a full sigalg is run (1) or if a composable
+     * signature algorithm is run (0).
+     *
+     * When a full sigalg is run (1), this currently affects the following
+     * other flags, which are to remain untouched after their initialization:
+     *
+     * - flag_allow_md (initialized to 0)
+     */
+    unsigned int flag_sigalg : 1;
+    /*
      * Flag to determine if the hash function can be changed (1) or not (0)
      * Because it's dangerous to change during a DigestSign or DigestVerify
      * operation, this flag is cleared by their Init function, and set again
@@ -79,11 +97,17 @@ typedef struct {
     unsigned char aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
     unsigned char *aid;
     size_t  aid_len;
-    size_t mdsize;
-    int operation;
 
+    /* main digest */
+    char mdname[OSSL_MAX_NAME_SIZE];
     EVP_MD *md;
     EVP_MD_CTX *mdctx;
+    size_t mdsize;
+
+    /* Signature, for verification */
+    unsigned char *sig;
+    size_t siglen;
+
     /*
      * Internally used to cache the results of calling the EC group
      * sign_setup() methods which are then passed to the sign operation.
@@ -140,9 +164,103 @@ static void *ecdsa_newctx(void *provctx, const char *propq)
     return ctx;
 }
 
-static int ecdsa_signverify_init(PROV_ECDSA_CTX *ctx, void *ec,
-                                 const OSSL_PARAM params[], int operation,
-                                 const char *desc)
+static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx,
+                          const char *mdname, const char *mdprops,
+                          const char *desc)
+{
+    EVP_MD *md = NULL;
+    size_t mdname_len;
+    int md_nid, md_size;
+    WPACKET pkt;
+
+    if (mdname == NULL)
+        return 1;
+
+    mdname_len = strlen(mdname);
+    if (mdname_len >= sizeof(ctx->mdname)) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
+                       "%s exceeds name buffer length", mdname);
+        return 0;
+    }
+    if (mdprops == NULL)
+        mdprops = ctx->propq;
+    md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
+    if (md == NULL) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
+                       "%s could not be fetched", mdname);
+        return 0;
+    }
+    md_size = EVP_MD_get_size(md);
+    if (md_size <= 0) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
+                       "%s has invalid md size %d", mdname, md_size);
+        goto err;
+    }
+    md_nid = ossl_digest_get_approved_nid(md);
+    if (md_nid < 0) {
+        ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
+                       "digest=%s", mdname);
+        goto err;
+    }
+    /* XOF digests don't work */
+    if (EVP_MD_xof(md)) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
+        goto err;
+    }
+
+#ifdef FIPS_MODULE
+    {
+        int sha1_allowed
+            = ((ctx->operation
+                & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_SIGNMSG)) == 0);
+
+        if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx),
+                                             OSSL_FIPS_IND_SETTABLE1,
+                                             ctx->libctx,
+                                             md_nid, sha1_allowed, desc,
+                                             ossl_fips_config_signature_digest_check))
+            goto err;
+    }
+#endif
+
+    if (!ctx->flag_allow_md) {
+        if (ctx->mdname[0] != '\0' && !EVP_MD_is_a(md, ctx->mdname)) {
+            ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
+                           "digest %s != %s", mdname, ctx->mdname);
+            goto err;
+        }
+        EVP_MD_free(md);
+        return 1;
+    }
+
+    EVP_MD_CTX_free(ctx->mdctx);
+    EVP_MD_free(ctx->md);
+
+    ctx->aid_len = 0;
+    if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
+        && ossl_DER_w_algorithmIdentifier_ECDSA_with_MD(&pkt, -1, ctx->ec,
+                                                        md_nid)
+        && WPACKET_finish(&pkt)) {
+        WPACKET_get_total_written(&pkt, &ctx->aid_len);
+        ctx->aid = WPACKET_get_curr(&pkt);
+    }
+    WPACKET_cleanup(&pkt);
+    ctx->mdctx = NULL;
+    ctx->md = md;
+    ctx->mdsize = (size_t)md_size;
+    OPENSSL_strlcpy(ctx->mdname, mdname, sizeof(ctx->mdname));
+
+    return 1;
+ err:
+    EVP_MD_free(md);
+    return 0;
+}
+
+static int
+ecdsa_signverify_init(PROV_ECDSA_CTX *ctx, void *ec,
+                      OSSL_FUNC_signature_set_ctx_params_fn *set_ctx_params,
+                      const OSSL_PARAM params[], int operation,
+                      const char *desc)
 {
     if (!ossl_prov_is_running()
             || ctx == NULL)
@@ -163,13 +281,14 @@ static int ecdsa_signverify_init(PROV_ECDSA_CTX *ctx, void *ec,
     ctx->operation = operation;
 
     OSSL_FIPS_IND_SET_APPROVED(ctx)
-    if (!ecdsa_set_ctx_params(ctx, params))
+    if (!set_ctx_params(ctx, params))
         return 0;
 #ifdef FIPS_MODULE
     if (!ossl_fips_ind_ec_key_check(OSSL_FIPS_IND_GET(ctx),
                                     OSSL_FIPS_IND_SETTABLE0, ctx->libctx,
                                     EC_KEY_get0_group(ctx->ec), desc,
-                                    operation == EVP_PKEY_OP_SIGN))
+                                    (operation & (EVP_PKEY_OP_SIGN
+                                                  | EVP_PKEY_OP_SIGNMSG)) != 0))
         return 0;
 #endif
     return 1;
@@ -182,23 +301,17 @@ static int ecdsa_sign_init(void *vctx, void *ec, const OSSL_PARAM params[])
 #ifdef FIPS_MODULE
     ctx->verify_message = 1;
 #endif
-    return ecdsa_signverify_init(ctx, ec, params, EVP_PKEY_OP_SIGN,
-                                 "ECDSA Sign Init");
-}
-
-static int ecdsa_verify_init(void *vctx, void *ec, const OSSL_PARAM params[])
-{
-    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
-
-#ifdef FIPS_MODULE
-    ctx->verify_message = 0;
-#endif
-    return ecdsa_signverify_init(ctx, ec, params, EVP_PKEY_OP_VERIFY,
-                                 "ECDSA Verify Init");
+    return ecdsa_signverify_init(ctx, ec, ecdsa_set_ctx_params, params,
+                                 EVP_PKEY_OP_SIGN, "ECDSA Sign Init");
 }
 
-static int ecdsa_sign(void *vctx, unsigned char *sig, size_t *siglen,
-                      size_t sigsize, const unsigned char *tbs, size_t tbslen)
+/*
+ * Sign tbs without digesting it first.  This is suitable for "primitive"
+ * signing and signing the digest of a message.
+ */
+static int ecdsa_sign_directly(void *vctx,
+                               unsigned char *sig, size_t *siglen, size_t sigsize,
+                               const unsigned char *tbs, size_t tbslen)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
     int ret;
@@ -240,105 +353,141 @@ static int ecdsa_sign(void *vctx, unsigned char *sig, size_t *siglen,
     return 1;
 }
 
-static int ecdsa_verify(void *vctx, const unsigned char *sig, size_t siglen,
-                        const unsigned char *tbs, size_t tbslen)
+static int ecdsa_signverify_message_update(void *vctx,
+                                         const unsigned char *data,
+                                         size_t datalen)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
-    if (!ossl_prov_is_running() || (ctx->mdsize != 0 && tbslen != ctx->mdsize))
+    if (ctx == NULL)
         return 0;
 
-    return ECDSA_verify(0, tbs, tbslen, sig, siglen, ctx->ec);
+    return EVP_DigestUpdate(ctx->mdctx, data, datalen);
 }
 
-static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, const char *mdname,
-                          const char *mdprops, const char *desc)
+static int ecdsa_sign_message_final(void *vctx, unsigned char *sig,
+                                  size_t *siglen, size_t sigsize)
 {
-    EVP_MD *md = NULL;
-    size_t mdname_len;
-    int md_nid, md_size;
-    WPACKET pkt;
-
-    if (mdname == NULL)
-        return 1;
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+    unsigned char digest[EVP_MAX_MD_SIZE];
+    unsigned int dlen = 0;
 
-    mdname_len = strlen(mdname);
-    if (mdname_len >= sizeof(ctx->mdname)) {
-        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
-                       "%s exceeds name buffer length", mdname);
+    if (!ossl_prov_is_running() || ctx == NULL)
         return 0;
-    }
-    if (mdprops == NULL)
-        mdprops = ctx->propq;
-    md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
-    if (md == NULL) {
-        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
-                       "%s could not be fetched", mdname);
+    if (ctx->mdctx == NULL)
         return 0;
-    }
-    md_size = EVP_MD_get_size(md);
-    if (md_size <= 0) {
-        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
-                       "%s has invalid md size %d", mdname, md_size);
-        goto err;
-    }
-    md_nid = ossl_digest_get_approved_nid(md);
-    if (md_nid < 0) {
-        ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
-                       "digest=%s", mdname);
-        goto err;
-    }
-    /* XOF digests don't work */
-    if (EVP_MD_xof(md)) {
-        ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
-        goto err;
-    }
+    /*
+     * If sig is NULL then we're just finding out the sig size. Other fields
+     * are ignored. Defer to ecdsa_sign.
+     */
+    if (sig != NULL
+        && !EVP_DigestFinal_ex(ctx->mdctx, digest, &dlen))
+        return 0;
+    return ecdsa_sign_directly(vctx, sig, siglen, sigsize, digest, dlen);
+}
 
-#ifdef FIPS_MODULE
-    {
-        int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
+/*
+ * If signing a message, digest tbs and sign the result.
+ * Otherwise, sign tbs directly.
+ */
+static int ecdsa_sign(void *vctx, unsigned char *sig, size_t *siglen,
+                    size_t sigsize, const unsigned char *tbs, size_t tbslen)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
-        if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx),
-                                             OSSL_FIPS_IND_SETTABLE1, ctx->libctx,
-                                             md_nid, sha1_allowed, desc,
-                                             ossl_fips_config_signature_digest_check))
-            goto err;
+    if (ctx->operation == EVP_PKEY_OP_SIGNMSG) {
+        /*
+         * If |sig| is NULL, the caller is only looking for the sig length.
+         * DO NOT update the input in this case.
+         */
+        if (sig == NULL)
+            return ecdsa_sign_message_final(ctx, sig, siglen, sigsize);
+
+        if (ecdsa_signverify_message_update(ctx, tbs, tbslen) <= 0)
+            return 0;
+        return ecdsa_sign_message_final(ctx, sig, siglen, sigsize);
     }
+    return ecdsa_sign_directly(ctx, sig, siglen, sigsize, tbs, tbslen);
+}
+
+static int ecdsa_verify_init(void *vctx, void *ec, const OSSL_PARAM params[])
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+
+#ifdef FIPS_MODULE
+    ctx->verify_message = 0;
 #endif
+    return ecdsa_signverify_init(ctx, ec, ecdsa_set_ctx_params, params,
+                                 EVP_PKEY_OP_VERIFY, "ECDSA Verify Init");
+}
 
-    if (!ctx->flag_allow_md) {
-        if (ctx->mdname[0] != '\0' && !EVP_MD_is_a(md, ctx->mdname)) {
-            ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
-                           "digest %s != %s", mdname, ctx->mdname);
-            goto err;
-        }
-        EVP_MD_free(md);
-        return 1;
-    }
+static int ecdsa_verify_directly(void *vctx,
+                                 const unsigned char *sig, size_t siglen,
+                                 const unsigned char *tbs, size_t tbslen)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
-    EVP_MD_CTX_free(ctx->mdctx);
-    EVP_MD_free(ctx->md);
+    if (!ossl_prov_is_running() || (ctx->mdsize != 0 && tbslen != ctx->mdsize))
+        return 0;
 
-    ctx->aid_len = 0;
-    if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
-        && ossl_DER_w_algorithmIdentifier_ECDSA_with_MD(&pkt, -1, ctx->ec,
-                                                        md_nid)
-        && WPACKET_finish(&pkt)) {
-        WPACKET_get_total_written(&pkt, &ctx->aid_len);
-        ctx->aid = WPACKET_get_curr(&pkt);
-    }
-    WPACKET_cleanup(&pkt);
-    ctx->mdctx = NULL;
-    ctx->md = md;
-    ctx->mdsize = (size_t)md_size;
-    OPENSSL_strlcpy(ctx->mdname, mdname, sizeof(ctx->mdname));
+    return ECDSA_verify(0, tbs, tbslen, sig, siglen, ctx->ec);
+}
 
-    return 1;
-err:
-    EVP_MD_free(md);
-    return 0;
+static int ecdsa_verify_set_sig(void *vctx,
+                                const unsigned char *sig, size_t siglen)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+    OSSL_PARAM params[2];
+
+    params[0] =
+        OSSL_PARAM_construct_octet_string(OSSL_SIGNATURE_PARAM_SIGNATURE,
+                                          (unsigned char *)sig, siglen);
+    params[1] = OSSL_PARAM_construct_end();
+    return ecdsa_sigalg_set_ctx_params(ctx, params);
+}
+
+static int ecdsa_verify_message_final(void *vctx)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+    unsigned char digest[EVP_MAX_MD_SIZE];
+    unsigned int dlen = 0;
+
+    if (!ossl_prov_is_running() || ctx == NULL || ctx->mdctx == NULL)
+        return 0;
+
+    /*
+     * The digests used here are all known (see ecdsa_get_md_nid()), so they
+     * should not exceed the internal buffer size of EVP_MAX_MD_SIZE.
+     */
+    if (!EVP_DigestFinal_ex(ctx->mdctx, digest, &dlen))
+        return 0;
+
+    return ecdsa_verify_directly(vctx, ctx->sig, ctx->siglen,
+                               digest, dlen);
 }
 
+/*
+ * If verifying a message, digest tbs and verify the result.
+ * Otherwise, verify tbs directly.
+ */
+static int ecdsa_verify(void *vctx,
+                      const unsigned char *sig, size_t siglen,
+                      const unsigned char *tbs, size_t tbslen)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+
+    if (ctx->operation == EVP_PKEY_OP_VERIFYMSG) {
+        if (ecdsa_verify_set_sig(ctx, sig, siglen) <= 0)
+            return 0;
+        if (ecdsa_signverify_message_update(ctx, tbs, tbslen) <= 0)
+            return 0;
+        return ecdsa_verify_message_final(ctx);
+    }
+    return ecdsa_verify_directly(ctx, sig, siglen, tbs, tbslen);
+}
+
+/* DigestSign/DigestVerify wrappers */
+
 static int ecdsa_digest_signverify_init(void *vctx, const char *mdname,
                                         void *ec, const OSSL_PARAM params[],
                                         int operation, const char *desc)
@@ -351,8 +500,14 @@ static int ecdsa_digest_signverify_init(void *vctx, const char *mdname,
 #ifdef FIPS_MODULE
     ctx->verify_message = 1;
 #endif
-    if (!ecdsa_signverify_init(ctx, ec, params, operation, desc)
-        || !ecdsa_setup_md(ctx, mdname, NULL, desc))
+    if (!ecdsa_signverify_init(vctx, ec, ecdsa_set_ctx_params, params,
+                               operation, desc))
+        return 0;
+
+    if (mdname != NULL
+        /* was ecdsa_setup_md already called in ecdsa_signverify_init()? */
+        && (mdname[0] == '\0' || OPENSSL_strcasecmp(ctx->mdname, mdname) != 0)
+        && !ecdsa_setup_md(ctx, mdname, NULL, desc))
         return 0;
 
     ctx->flag_allow_md = 0;
@@ -376,77 +531,80 @@ static int ecdsa_digest_sign_init(void *vctx, const char *mdname, void *ec,
                                   const OSSL_PARAM params[])
 {
     return ecdsa_digest_signverify_init(vctx, mdname, ec, params,
-                                        EVP_PKEY_OP_SIGN,
+                                        EVP_PKEY_OP_SIGNMSG,
                                         "ECDSA Digest Sign Init");
 }
 
-static int ecdsa_digest_verify_init(void *vctx, const char *mdname, void *ec,
-                                    const OSSL_PARAM params[])
-{
-    return ecdsa_digest_signverify_init(vctx, mdname, ec, params,
-                                        EVP_PKEY_OP_VERIFY,
-                                        "ECDSA Digest Verify Init");
-}
-
-int ecdsa_digest_signverify_update(void *vctx, const unsigned char *data,
-                                   size_t datalen)
+static int ecdsa_digest_signverify_update(void *vctx, const unsigned char *data,
+                                          size_t datalen)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
     if (ctx == NULL || ctx->mdctx == NULL)
         return 0;
+    /* Sigalg implementations shouldn't do digest_sign */
+    if (ctx->flag_sigalg)
+        return 0;
 
-    return EVP_DigestUpdate(ctx->mdctx, data, datalen);
+    return ecdsa_signverify_message_update(vctx, data, datalen);
 }
 
 int ecdsa_digest_sign_final(void *vctx, unsigned char *sig, size_t *siglen,
                             size_t sigsize)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
-    unsigned char digest[EVP_MAX_MD_SIZE];
-    unsigned int dlen = 0;
+    int ok = 0;
 
-    if (!ossl_prov_is_running() || ctx == NULL || ctx->mdctx == NULL)
+    if (ctx == NULL)
         return 0;
-
-    /*
-     * If sig is NULL then we're just finding out the sig size. Other fields
-     * are ignored. Defer to ecdsa_sign.
-     */
-    if (sig != NULL
-        && !EVP_DigestFinal_ex(ctx->mdctx, digest, &dlen))
+    /* Sigalg implementations shouldn't do digest_sign */
+    if (ctx->flag_sigalg)
         return 0;
+
+    ok = ecdsa_sign_message_final(ctx, sig, siglen, sigsize);
+
     ctx->flag_allow_md = 1;
-    return ecdsa_sign(vctx, sig, siglen, sigsize, digest, (size_t)dlen);
+
+    return ok;
+}
+
+static int ecdsa_digest_verify_init(void *vctx, const char *mdname, void *ec,
+                                    const OSSL_PARAM params[])
+{
+    return ecdsa_digest_signverify_init(vctx, mdname, ec, params,
+                                        EVP_PKEY_OP_VERIFYMSG,
+                                        "ECDSA Digest Verify Init");
 }
 
 int ecdsa_digest_verify_final(void *vctx, const unsigned char *sig,
                               size_t siglen)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
-    unsigned char digest[EVP_MAX_MD_SIZE];
-    unsigned int dlen = 0;
+    int ok = 0;
 
     if (!ossl_prov_is_running() || ctx == NULL || ctx->mdctx == NULL)
         return 0;
 
-    if (!EVP_DigestFinal_ex(ctx->mdctx, digest, &dlen))
+    /* Sigalg implementations shouldn't do digest_verify */
+    if (ctx->flag_sigalg)
         return 0;
+
+    if (ecdsa_verify_set_sig(ctx, sig, siglen))
+        ok = ecdsa_verify_message_final(ctx);
+
     ctx->flag_allow_md = 1;
-    return ecdsa_verify(ctx, sig, siglen, digest, (size_t)dlen);
+
+    return ok;
 }
 
 static void ecdsa_freectx(void *vctx)
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
-    OPENSSL_free(ctx->propq);
     EVP_MD_CTX_free(ctx->mdctx);
     EVP_MD_free(ctx->md);
-    ctx->propq = NULL;
-    ctx->mdctx = NULL;
-    ctx->md = NULL;
-    ctx->mdsize = 0;
+    OPENSSL_free(ctx->propq);
+    OPENSSL_free(ctx->sig);
     EC_KEY_free(ctx->ec);
     BN_clear_free(ctx->kinv);
     BN_clear_free(ctx->r);
@@ -467,8 +625,6 @@ static void *ecdsa_dupctx(void *vctx)
 
     *dstctx = *srcctx;
     dstctx->ec = NULL;
-    dstctx->md = NULL;
-    dstctx->mdctx = NULL;
     dstctx->propq = NULL;
 
     if (srcctx->ec != NULL && !EC_KEY_up_ref(srcctx->ec))
@@ -556,11 +712,11 @@ static const OSSL_PARAM *ecdsa_gettable_ctx_params(ossl_unused void *vctx,
     return known_gettable_ctx_params;
 }
 
-static int ecdsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
+/* The common params for ecdsa_set_ctx_params and ecdsa_sigalg_set_ctx_params */
+static int ecdsa_common_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
     const OSSL_PARAM *p;
-    size_t mdsize = 0;
 
     if (ctx == NULL)
         return 0;
@@ -580,6 +736,33 @@ static int ecdsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
         return 0;
 #endif
 
+    p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE);
+    if (p != NULL
+        && !OSSL_PARAM_get_uint(p, &ctx->nonce_type))
+        return 0;
+    return 1;
+}
+
+#define ECDSA_COMMON_SETTABLE_CTX_PARAMS                                      \
+    OSSL_PARAM_uint(OSSL_SIGNATURE_PARAM_KAT, NULL),                          \
+    OSSL_PARAM_uint(OSSL_SIGNATURE_PARAM_NONCE_TYPE, NULL),                   \
+    OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_SIGNATURE_PARAM_FIPS_KEY_CHECK)     \
+    OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_SIGNATURE_PARAM_FIPS_DIGEST_CHECK)  \
+    OSSL_PARAM_END
+
+static int ecdsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+    const OSSL_PARAM *p;
+    size_t mdsize = 0;
+    int ret;
+
+    if ((ret = ecdsa_common_set_ctx_params(ctx, params)) <= 0)
+        return ret;
+
+    if (params == NULL)
+        return 1;
+
     p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_DIGEST);
     if (p != NULL) {
         char mdname[OSSL_MAX_NAME_SIZE] = "", *pmdname = mdname;
@@ -604,10 +787,6 @@ static int ecdsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
             return 0;
         ctx->mdsize = mdsize;
     }
-    p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE);
-    if (p != NULL
-        && !OSSL_PARAM_get_uint(p, &ctx->nonce_type))
-        return 0;
     return 1;
 }
 
@@ -615,11 +794,7 @@ static const OSSL_PARAM settable_ctx_params[] = {
     OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
     OSSL_PARAM_size_t(OSSL_SIGNATURE_PARAM_DIGEST_SIZE, NULL),
     OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PROPERTIES, NULL, 0),
-    OSSL_PARAM_uint(OSSL_SIGNATURE_PARAM_KAT, NULL),
-    OSSL_PARAM_uint(OSSL_SIGNATURE_PARAM_NONCE_TYPE, NULL),
-    OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_SIGNATURE_PARAM_FIPS_KEY_CHECK)
-    OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_SIGNATURE_PARAM_FIPS_DIGEST_CHECK)
-    OSSL_PARAM_END
+    ECDSA_COMMON_SETTABLE_CTX_PARAMS
 };
 
 static const OSSL_PARAM settable_ctx_params_no_digest[] = {
@@ -713,3 +888,210 @@ const OSSL_DISPATCH ossl_ecdsa_signature_functions[] = {
       (void (*)(void))ecdsa_settable_ctx_md_params },
     OSSL_DISPATCH_END
 };
+
+/* ------------------------------------------------------------------ */
+
+/*
+ * So called sigalgs (composite ECDSA+hash) implemented below.  They
+ * are pretty much hard coded.
+ */
+
+static OSSL_FUNC_signature_query_key_types_fn ecdsa_sigalg_query_key_types;
+static OSSL_FUNC_signature_settable_ctx_params_fn ecdsa_sigalg_settable_ctx_params;
+static OSSL_FUNC_signature_set_ctx_params_fn ecdsa_sigalg_set_ctx_params;
+
+/*
+ * ecdsa_sigalg_signverify_init() is almost like ecdsa_digest_signverify_init(),
+ * just doesn't allow fetching an MD from whatever the user chooses.
+ */
+static int ecdsa_sigalg_signverify_init(void *vctx, void *vec,
+                                      OSSL_FUNC_signature_set_ctx_params_fn *set_ctx_params,
+                                      const OSSL_PARAM params[],
+                                      const char *mdname,
+                                      int operation, const char *desc)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+
+    if (!ossl_prov_is_running())
+        return 0;
+
+    if (!ecdsa_signverify_init(vctx, vec, set_ctx_params, params, operation,
+                               desc))
+        return 0;
+
+    if (!ecdsa_setup_md(ctx, mdname, NULL, desc))
+        return 0;
+
+    ctx->flag_sigalg = 1;
+    ctx->flag_allow_md = 0;
+
+    if (ctx->mdctx == NULL) {
+        ctx->mdctx = EVP_MD_CTX_new();
+        if (ctx->mdctx == NULL)
+            goto error;
+    }
+
+    if (!EVP_DigestInit_ex2(ctx->mdctx, ctx->md, params))
+        goto error;
+
+    return 1;
+
+ error:
+    EVP_MD_CTX_free(ctx->mdctx);
+    ctx->mdctx = NULL;
+    return 0;
+}
+
+static const char **ecdsa_sigalg_query_key_types(void)
+{
+    static const char *keytypes[] = { "EC", NULL };
+
+    return keytypes;
+}
+
+static const OSSL_PARAM settable_sigalg_ctx_params[] = {
+    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_SIGNATURE, NULL, 0),
+    ECDSA_COMMON_SETTABLE_CTX_PARAMS
+};
+
+static const OSSL_PARAM *ecdsa_sigalg_settable_ctx_params(void *vctx,
+                                                        ossl_unused void *provctx)
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+
+    if (ctx != NULL && ctx->operation == EVP_PKEY_OP_VERIFYMSG)
+        return settable_sigalg_ctx_params;
+    return NULL;
+}
+
+static int ecdsa_sigalg_set_ctx_params(void *vctx, const OSSL_PARAM params[])
+{
+    PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
+    const OSSL_PARAM *p;
+    int ret;
+
+    if ((ret = ecdsa_common_set_ctx_params(ctx, params)) <= 0)
+        return ret;
+
+    if (params == NULL)
+        return 1;
+
+    if (ctx->operation == EVP_PKEY_OP_VERIFYMSG) {
+        p = OSSL_PARAM_locate_const(params, OSSL_SIGNATURE_PARAM_SIGNATURE);
+        if (p != NULL) {
+            OPENSSL_free(ctx->sig);
+            ctx->sig = NULL;
+            ctx->siglen = 0;
+            if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->sig,
+                                             0, &ctx->siglen))
+                return 0;
+        }
+    }
+    return 1;
+}
+
+#define IMPL_ECDSA_SIGALG(md, MD)                                       \
+    static OSSL_FUNC_signature_sign_init_fn ecdsa_##md##_sign_init;     \
+    static OSSL_FUNC_signature_sign_message_init_fn                     \
+        ecdsa_##md##_sign_message_init;                                 \
+    static OSSL_FUNC_signature_verify_init_fn ecdsa_##md##_verify_init; \
+    static OSSL_FUNC_signature_verify_message_init_fn                   \
+        ecdsa_##md##_verify_message_init;                               \
+                                                                        \
+    static int                                                          \
+    ecdsa_##md##_sign_init(void *vctx, void *vec,                       \
+                         const OSSL_PARAM params[])                     \
+    {                                                                   \
+        static const char desc[] = "ECDSA-" #MD " Sign Init";           \
+                                                                        \
+        return ecdsa_sigalg_signverify_init(vctx, vec,                  \
+                                            ecdsa_sigalg_set_ctx_params, \
+                                            params, #MD,                \
+                                            EVP_PKEY_OP_SIGN,           \
+                                            desc);                      \
+    }                                                                   \
+                                                                        \
+    static int                                                          \
+    ecdsa_##md##_sign_message_init(void *vctx, void *vec,               \
+                                   const OSSL_PARAM params[])           \
+    {                                                                   \
+        static const char desc[] = "ECDSA-" #MD " Sign Message Init";   \
+                                                                        \
+        return ecdsa_sigalg_signverify_init(vctx, vec,                  \
+                                            ecdsa_sigalg_set_ctx_params, \
+                                            params, #MD,                \
+                                            EVP_PKEY_OP_SIGNMSG,        \
+                                            desc);                      \
+    }                                                                   \
+                                                                        \
+    static int                                                          \
+    ecdsa_##md##_verify_init(void *vctx, void *vec,                     \
+                           const OSSL_PARAM params[])                   \
+    {                                                                   \
+        static const char desc[] = "ECDSA-" #MD " Verify Init";         \
+                                                                        \
+        return ecdsa_sigalg_signverify_init(vctx, vec,                  \
+                                            ecdsa_sigalg_set_ctx_params, \
+                                            params, #MD,                \
+                                            EVP_PKEY_OP_VERIFY,         \
+                                            desc);                      \
+    }                                                                   \
+                                                                        \
+    static int                                                          \
+    ecdsa_##md##_verify_message_init(void *vctx, void *vec,             \
+                                     const OSSL_PARAM params[])         \
+    {                                                                   \
+        static const char desc[] = "ECDSA-" #MD " Verify Message Init"; \
+                                                                        \
+        return ecdsa_sigalg_signverify_init(vctx, vec,                  \
+                                            ecdsa_sigalg_set_ctx_params, \
+                                            params, #MD,                \
+                                            EVP_PKEY_OP_VERIFYMSG,      \
+                                            desc);                      \
+    }                                                                   \
+                                                                        \
+    const OSSL_DISPATCH ossl_ecdsa_##md##_signature_functions[] = {     \
+        { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ecdsa_newctx },   \
+        { OSSL_FUNC_SIGNATURE_SIGN_INIT,                                \
+          (void (*)(void))ecdsa_##md##_sign_init },                     \
+        { OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))ecdsa_sign },       \
+        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT,                        \
+          (void (*)(void))ecdsa_##md##_sign_message_init },             \
+        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_UPDATE,                      \
+          (void (*)(void))ecdsa_signverify_message_update },            \
+        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_FINAL,                       \
+          (void (*)(void))ecdsa_sign_message_final },                   \
+        { OSSL_FUNC_SIGNATURE_VERIFY_INIT,                              \
+          (void (*)(void))ecdsa_##md##_verify_init },                   \
+        { OSSL_FUNC_SIGNATURE_VERIFY,                                   \
+          (void (*)(void))ecdsa_verify },                               \
+        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_INIT,                      \
+          (void (*)(void))ecdsa_##md##_verify_message_init },           \
+        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_UPDATE,                    \
+          (void (*)(void))ecdsa_signverify_message_update },            \
+        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_FINAL,                     \
+          (void (*)(void))ecdsa_verify_message_final },                 \
+        { OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))ecdsa_freectx }, \
+        { OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))ecdsa_dupctx },   \
+        { OSSL_FUNC_SIGNATURE_QUERY_KEY_TYPES,                          \
+          (void (*)(void))ecdsa_sigalg_query_key_types },               \
+        { OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS,                           \
+          (void (*)(void))ecdsa_get_ctx_params },                       \
+        { OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS,                      \
+          (void (*)(void))ecdsa_gettable_ctx_params },                  \
+        { OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS,                           \
+          (void (*)(void))ecdsa_sigalg_set_ctx_params },                \
+        { OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS,                      \
+          (void (*)(void))ecdsa_sigalg_settable_ctx_params },           \
+        OSSL_DISPATCH_END                                               \
+    }
+
+IMPL_ECDSA_SIGALG(sha1, SHA1);
+IMPL_ECDSA_SIGALG(sha224, SHA2-224);
+IMPL_ECDSA_SIGALG(sha256, SHA2-256);
+IMPL_ECDSA_SIGALG(sha384, SHA2-384);
+IMPL_ECDSA_SIGALG(sha512, SHA2-512);
+IMPL_ECDSA_SIGALG(sha3_224, SHA3-224);
+IMPL_ECDSA_SIGALG(sha3_256, SHA3-256);
+IMPL_ECDSA_SIGALG(sha3_384, SHA3-384);
+IMPL_ECDSA_SIGALG(sha3_512, SHA3-512);
diff --git a/test/recipes/30-test_evp.t b/test/recipes/30-test_evp.t
index e8dcbfce98..07444bf06f 100644
--- a/test/recipes/30-test_evp.t
+++ b/test/recipes/30-test_evp.t
@@ -87,6 +87,7 @@ push @files, qw(
                 evppkey_ecc.txt
                 evppkey_ecdh.txt
                 evppkey_ecdsa.txt
+                evppkey_ecdsa_sigalg.txt
                 evppkey_kas.txt
                 evppkey_mismatch.txt
                ) unless $no_ec;
diff --git a/test/recipes/30-test_evp_data/evppkey_ecdsa_sigalg.txt b/test/recipes/30-test_evp_data/evppkey_ecdsa_sigalg.txt
new file mode 100644
index 0000000000..7c339c272b
--- /dev/null
+++ b/test/recipes/30-test_evp_data/evppkey_ecdsa_sigalg.txt
@@ -0,0 +1,261 @@
+#
+# Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+# Tests start with one of these keywords
+#       Cipher Decrypt Derive Digest Encoding KDF MAC PBE
+#       PrivPubKeyPair Sign Verify VerifyRecover
+# and continue until a blank line. Lines starting with a pound sign are ignored.
+# The keyword Availablein must appear before the test name if needed.
+
+# Public key algorithm tests
+
+# Private keys used for PKEY operations.
+
+# EC P-256 key
+
+PrivateKey=P-256
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiocvtiiTxNH/xbnw
++RdYBp+DUuCPoFpJ+NuSbLVyhyWhRANCAAQsFQ9CnOcPIWwlLPXgYs4fY5zV0WXH
++JQkBywnGX14szuSDpXNtmTpkNzwz+oNlOKo5q+dDlgFbmUxBJJbn+bJ
+-----END PRIVATE KEY-----
+
+# EC public key for above
+
+PublicKey=P-256-PUBLIC
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELBUPQpznDyFsJSz14GLOH2Oc1dFl
+x/iUJAcsJxl9eLM7kg6VzbZk6ZDc8M/qDZTiqOavnQ5YBW5lMQSSW5/myQ==
+-----END PUBLIC KEY-----
+
+PrivPubKeyPair = P-256:P-256-PUBLIC
+
+Title = ECDSA tests
+
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+
+# Digest too long
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF12345"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+Result = VERIFY_ERROR
+
+# Digest too short
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF123"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+Result = VERIFY_ERROR
+
+# Digest invalid
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1235"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+Result = VERIFY_ERROR
+
+# Invalid signature
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec7
+Result = VERIFY_ERROR
+
+# Garbage after signature
+Availablein = default
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec800
+Result = VERIFY_ERROR
+
+# BER signature
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1234"
+Output = 3080022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec80000
+Result = VERIFY_ERROR
+
+FIPSversion = >=3.4.0
+Verify = ECDSA-SHA1:P-256-PUBLIC
+Input = "0123456789ABCDEF1234"
+Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
+
+Title = Sign-Message and Verify-Message
+
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA256:P-256-PUBLIC
+Input = "Hello World"
+Output = 3046022100e7515177ec3817b77a4a94066ab3070817b7aa9d44a8a09f040da250116e8972022100ba59b0f631258e59a9026be5d84f60685f4cf22b9165a0c2736d5c21c8ec1862
+
+PublicKey=P-384-PUBLIC
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAES/TlL5WEJ+u1kV+4yVlVUbTTo/2rZ7rd
+nWwwk/QlukNjDfcfQvDrfOqpTZ9kSKhd0wMxWIJJ/S/cCzCex+2EgbwW8ngAwT19
+twD8guGxyFRaoMDTtW47/nifwYqRaIfC
+-----END PUBLIC KEY-----
+
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA384:P-384-PUBLIC
+Input = "123400"
+Output = 304d0218389cb27e0bc8d21fa7e5f24cb74f58851313e696333ad68b023100ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52970
+
+# Oneshot tests
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA256:P-256-PUBLIC
+Input = "Hello World"
+Output = 3046022100e7515177ec3817b77a4a94066ab3070817b7aa9d44a8a09f040da250116e8972022100ba59b0f631258e59a9026be5d84f60685f4cf22b9165a0c2736d5c21c8ec1862
+
+# Test that mdsize != tbssize fails
+FIPSversion = >=3.4.0
+Sign = ECDSA-SHA256:P-256
+Input = "0123456789ABCDEF1234"
+Result = KEYOP_ERROR
+
+PrivateKey = P-256_NAMED_CURVE_EXPLICIT
+-----BEGIN PRIVATE KEY-----
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg
+9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8A
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgiUTxtr5vLVjj
+0BOXUa/4r82DJ30QoupYS/wlilW4gWehRANCAATM0n3q2UaDyaQ7OxzJM3B6prhW
+3ev1gTwRBduzqqlwd54AUSgI+pjttW8zrWNitO8H1sf59MPWOESKxNtZ1+Nl
+-----END PRIVATE KEY-----
+
+PrivateKey = EC_EXPLICIT
+-----BEGIN PRIVATE KEY-----
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEE5JcIvn36opqjEm/k59Al40rBAxWM2TPG
+l0L13Je51zHpfXQ9Z2o7IQicMXP4wSfJ0qCgg2bgydqoxlYrlLGuVQIhAP////8A
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgec92jwduadCk
+OjoNRI+YT5Be5TkzZXzYCyTLkMOikDmhRANCAATtECEhQbLEaiUj/Wu0qjcr81lL
+46dx5zYgArz/iaSNJ3W80oO+F7v04jlQ7wxQzg96R0bwKiMeq5CcW9ZFt6xg
+-----END PRIVATE KEY-----
+
+PrivateKey = B-163
+-----BEGIN PRIVATE KEY-----
+MGMCAQAwEAYHKoZIzj0CAQYFK4EEAA8ETDBKAgEBBBUDnQW0mLiHVha/jqFznX/K
+DnVlDgChLgMsAAQB1qZ00fPIct+QN8skv1XIHtBNp3EGLytJV0tsAUTYtGhtrzRj
+e3GzYyg=
+-----END PRIVATE KEY-----
+
+PrivateKey = secp256k1
+-----BEGIN PRIVATE KEY-----
+MIGEAgEAMBAGByqGSM49AgEGBSuBBAAKBG0wawIBAQQgsLpFV9joHc0bisyV53XL
+mrG6/Gu6ZaHoXtKP/VFX44ehRANCAARLYWGgp5nP4N8guypLSbYGCVN6ZPCnWW4x
+srYkcpdbxr4neRT3zC62keCKgPbJf5SIHkJ2Tcaw6hVSrBOUFtix
+-----END PRIVATE KEY-----
+
+Title = FIPS tests
+
+# Test that a nist curve with < 112 bits is allowed in fips mode for verifying
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA256:B-163
+Input = "Hello World"
+Output = 302e0215027bb891747468b4b59ca2a2bf8f42d29d08866cf5021502cc311b25e9a2168e42240b07a6071070f687eb3b
+
+# Test that a nist curve with SHA3 is allowed in fips mode
+# The sign will get a mismatch error since the output signature changes on each run
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA3-512:P-256
+Input = "Hello World"
+Result = KEYOP_MISMATCH
+
+# Test that a explicit curve that is a named curve is allowed in fips mode
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA256:P-256_NAMED_CURVE_EXPLICIT
+Input = "Hello World"
+Output = 30450220796fcf472882ed5779226dcd0217b9d2b9acfe4fa2fb0109c8ee63c63adc1033022100e306c69f7e31b9a5d54eb12ba813cddf4de4af933e4f6cea38a0817d9d831d91
+
+Title = FIPS Negative tests (using different curves and digests)
+
+# Test that a explicit curve is not allowed in fips mode
+Availablein = fips
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-SHA256:EC_EXPLICIT
+Input = "Hello World"
+Result = KEYOP_INIT_ERROR
+
+# Test that a curve with < 112 bits is not allowed in fips mode for signing
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA3-512:B-163
+Securitycheck = 1
+Input = "Hello World"
+Result = KEYOP_INIT_ERROR
+
+# Test that a non nist curve is not allowed in fips mode
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA3-512:secp256k1
+Securitycheck = 1
+Input = "Hello World"
+Result = KEYOP_INIT_ERROR
+
+# Test that SHA1 is not allowed in fips mode for signing
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA1:B-163
+Securitycheck = 1
+Input = "Hello World"
+Result = KEYOP_INIT_ERROR
+
+# Test that SHA1 is not allowed in fips mode for signing
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign = ECDSA-SHA1:P-256
+Securitycheck = 1
+Input = "0123456789ABCDEF1234"
+Result = KEYOP_INIT_ERROR
+
+# Invalid non-approved digest
+Availablein = fips
+FIPSversion = >=3.4.0
+Verify-Message = ECDSA-MD5:P-256-PUBLIC
+Securitycheck = 1
+Result = KEYOP_INIT_ERROR
+
+Title = FIPS Indicator tests
+# Check that the indicator callback is triggered
+# We check for signature mismatch since the signature is unique
+
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA3-512:B-163
+Securitycheck = 1
+Unapproved = 1
+CtrlInit = key-check:0
+Input = "Hello World"
+Result = KEYOP_MISMATCH
+
+# Test that SHA1 is not allowed in fips mode for signing
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign-Message = ECDSA-SHA1:P-256
+Securitycheck = 1
+Unapproved = 1
+CtrlInit = digest-check:0
+Input = "Hello World"
+Result = KEYOP_MISMATCH
+
+# Test that SHA1 is not allowed in fips mode for signing
+Availablein = fips
+FIPSversion = >=3.4.0
+Sign = ECDSA-SHA1:P-256
+Securitycheck = 1
+Unapproved = 1
+CtrlInit = digest-check:0
+Input = "0123456789ABCDEF1234"
+Result = KEYOP_MISMATCH