[MarkAtwood]

wolfprovider registers DH as "DH" only, openssl's default provider uses DH:dhKeyAgreement:1.2.840.113549.1.3.1 and libcrypto fetches by dhKeyAgreement from EVP_PKEY_CTX_new_id(EVP_PKEY_DH) and EVP_PKEY_set1_DH() keys. single threaded it works because the legacy name copy aliases it, but that copy isn't locked, so threads hitting a fresh libctx together can lose the alias for good:

EVP_KEYMGMT_fetch(libctx, "dhKeyAgreement", NULL);   /* NULL, 18 of 50 libctxs */

fix gives WP_NAMES_DH the openssl names, same pattern as RSA and EC, no crypto changes. test_dh_name_dhkeyagreement checks the names against the default provider and races 8 threads in 20 fresh libctxs, fails without the fix. tested on cd8836f, openssl 3.5.4, wolfssl 5.9.4, default, replace-default, and fips ready all pass

[Copilot]

🟢 Approval recommended

The focused alias change and regression coverage have no identified blocking issues.

0 open findings

What changed in this PR

Aligns wolfProvider’s DH aliases with OpenSSL’s default provider to prevent name-fetch failures during concurrent first use. No cryptographic behavior changes.

Changes:

• Registers dhKeyAgreement and its OID as DH aliases.
• Adds regression coverage for alias parity and concurrent first-use lookups.

File	Description
test/​unit.h	Declares the new DH regression test.
test/​unit.c	Registers the regression test.
test/​test_dh.c	Tests alias parity and concurrent DH lookups.
include/​wolfprovider/​alg_funcs.h	Adds the DH name and OID aliases.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.