Correction: my rationale for this patch was wrong. Implicit digests DO reach providers. evp_md_init_internal() re-fetches an MD with type->prov == NULL by name, so EVP_sha256() and EVP_get_digestbynid() end up provider-backed. The probe I cited measured ctx->reqdigest, the MD passed in, not the one used. Details and a corrected probe are on the cryptohash thread [1].
So this patch is not a bypass fix. What survives: the internal fetch hardcodes libctx=NULL and propq="", so a non-default OSSL_LIB_CTX gets no provider control, and a registered ENGINE bypasses providers outright. Control and clarity, not bypass. Michael, you named channel binding as your interest, so you should have that before spending time on it. The patch behavior is unchanged, and the question about freeing the EVP_MD on every error path still stands. Repost on the narrower basis, or withdraw? [1] https://postgr.es/m/178596055358.1584287.8485463954311014881%40reviewcommit.com -- Mark
