Adapt existing SERIALIZER implementations to the redesigned interface

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11006)

14 files changed, 352 insertions, 181 deletions

diff --git a/providers/defltprov.c b/providers/defltprov.c
index 166281f..8d89322 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -417,19 +417,19 @@ static const OSSL_ALGORITHM deflt_serializer[] = {
       dh_priv_text_serializer_functions },
     { "DH", "default=yes,format=text,type=public",
       dh_pub_text_serializer_functions },
-    { "DH", "default=yes,format=text,type=domainparams",
+    { "DH", "default=yes,format=text,type=parameters",
       dh_param_text_serializer_functions },
     { "DH", "default=yes,format=der,type=private",
       dh_priv_der_serializer_functions },
     { "DH", "default=yes,format=der,type=public",
       dh_pub_der_serializer_functions },
-    { "DH", "default=yes,format=der,type=domainparams",
+    { "DH", "default=yes,format=der,type=parameters",
       dh_param_der_serializer_functions },
     { "DH", "default=yes,format=pem,type=private",
       dh_priv_pem_serializer_functions },
     { "DH", "default=yes,format=pem,type=public",
       dh_pub_pem_serializer_functions },
-    { "DH", "default=yes,format=pem,type=domainparams",
+    { "DH", "default=yes,format=pem,type=parameters",
       dh_param_pem_serializer_functions },
 #endif
 
@@ -438,19 +438,19 @@ static const OSSL_ALGORITHM deflt_serializer[] = {
       dsa_priv_text_serializer_functions },
     { "DSA", "default=yes,format=text,type=public",
       dsa_pub_text_serializer_functions },
-    { "DSA", "default=yes,format=text,type=domainparams",
+    { "DSA", "default=yes,format=text,type=parameters",
       dsa_param_text_serializer_functions },
     { "DSA", "default=yes,format=der,type=private",
       dsa_priv_der_serializer_functions },
     { "DSA", "default=yes,format=der,type=public",
       dsa_pub_der_serializer_functions },
-    { "DSA", "default=yes,format=der,type=domainparams",
+    { "DSA", "default=yes,format=der,type=parameters",
       dsa_param_der_serializer_functions },
     { "DSA", "default=yes,format=pem,type=private",
       dsa_priv_pem_serializer_functions },
     { "DSA", "default=yes,format=pem,type=public",
       dsa_pub_pem_serializer_functions },
-    { "DSA", "default=yes,format=pem,type=domainparams",
+    { "DSA", "default=yes,format=pem,type=parameters",
       dsa_param_pem_serializer_functions },
 #endif
 
diff --git a/providers/implementations/serializers/serializer_common.c b/providers/implementations/serializers/serializer_common.c
index cc6f179..daceb11 100644
--- a/providers/implementations/serializers/serializer_common.c
+++ b/providers/implementations/serializers/serializer_common.c
@@ -112,12 +112,32 @@ static X509_PUBKEY *ossl_prov_pubkey_from_obj(const void *obj, int obj_nid,
     return xpk;
 }
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_importkey(const OSSL_DISPATCH *fns)
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_new(const OSSL_DISPATCH *fns)
 {
     /* Pilfer the keymgmt dispatch table */
     for (; fns->function_id != 0; fns++)
-        if (fns->function_id == OSSL_FUNC_KEYMGMT_IMPORTKEY)
-            return OSSL_get_OP_keymgmt_importkey(fns);
+        if (fns->function_id == OSSL_FUNC_KEYMGMT_NEW)
+            return OSSL_get_OP_keymgmt_new(fns);
+
+    return NULL;
+}
+
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_free(const OSSL_DISPATCH *fns)
+{
+    /* Pilfer the keymgmt dispatch table */
+    for (; fns->function_id != 0; fns++)
+        if (fns->function_id == OSSL_FUNC_KEYMGMT_FREE)
+            return OSSL_get_OP_keymgmt_free(fns);
+
+    return NULL;
+}
+
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_import(const OSSL_DISPATCH *fns)
+{
+    /* Pilfer the keymgmt dispatch table */
+    for (; fns->function_id != 0; fns++)
+        if (fns->function_id == OSSL_FUNC_KEYMGMT_IMPORT)
+            return OSSL_get_OP_keymgmt_import(fns);
 
     return NULL;
 }
diff --git a/providers/implementations/serializers/serializer_dh.c b/providers/implementations/serializers/serializer_dh.c
index 313fae0..da74e22 100644
--- a/providers/implementations/serializers/serializer_dh.c
+++ b/providers/implementations/serializers/serializer_dh.c
@@ -14,9 +14,19 @@
 #include "prov/providercommonerr.h" /* PROV_R_BN_ERROR */
 #include "serializer_local.h"
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_dh_importkey(void)
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_dh_new(void)
 {
-    return ossl_prov_get_importkey(dh_keymgmt_functions);
+    return ossl_prov_get_keymgmt_new(dh_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_dh_free(void)
+{
+    return ossl_prov_get_keymgmt_free(dh_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_dh_import(void)
+{
+    return ossl_prov_get_keymgmt_import(dh_keymgmt_functions);
 }
 
 int ossl_prov_print_dh(BIO *out, DH *dh, enum dh_print_type type)
@@ -51,7 +61,7 @@ int ossl_prov_print_dh(BIO *out, DH *dh, enum dh_print_type type)
     }
 
     p = DH_get0_p(dh);
-    g = DH_get0_p(dh);
+    g = DH_get0_g(dh);
     if (p == NULL || g == NULL)
         goto null_err;
 
diff --git a/providers/implementations/serializers/serializer_dh_param.c b/providers/implementations/serializers/serializer_dh_param.c
index ca3371e..b445a25 100644
--- a/providers/implementations/serializers/serializer_dh_param.c
+++ b/providers/implementations/serializers/serializer_dh_param.c
@@ -45,15 +45,20 @@ static void dh_param_freectx(void *ctx)
 static int dh_param_der_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_param_der(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dh_param_der(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
@@ -66,17 +71,22 @@ static int dh_param_der(void *ctx, void *dh, BIO *out,
 
 /* Public key : PEM */
 static int dh_param_pem_data(void *ctx, const OSSL_PARAM params[], BIO *out,
-                            OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_param_pem(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dh_param_pem(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
@@ -88,17 +98,22 @@ static int dh_param_pem(void *ctx, void *dh, BIO *out,
 }
 
 static int dh_param_print_data(void *ctx, const OSSL_PARAM params[], BIO *out,
-                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                               OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_param_print(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dh_param_print(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
diff --git a/providers/implementations/serializers/serializer_dh_priv.c b/providers/implementations/serializers/serializer_dh_priv.c
index a6427dc..c22f534 100644
--- a/providers/implementations/serializers/serializer_dh_priv.c
+++ b/providers/implementations/serializers/serializer_dh_priv.c
@@ -112,18 +112,22 @@ static int dh_priv_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 
 /* Private key : DER */
 static int dh_priv_der_data(void *vctx, const OSSL_PARAM params[], BIO *out,
-                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                            OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct dh_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx->provctx, params);
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_priv_der(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        if ((dh = dh_new(ctx->provctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_priv_der(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
@@ -147,24 +151,28 @@ static int dh_priv_der(void *vctx, void *dh, BIO *out,
 
 /* Private key : PEM */
 static int dh_pem_priv_data(void *vctx, const OSSL_PARAM params[], BIO *out,
-                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                            OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct dh_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params);
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_pem_priv(ctx->provctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        if ((dh = dh_new(ctx->provctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_pem_priv(ctx->provctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
 
 static int dh_pem_priv(void *vctx, void *dh, BIO *out,
-                        OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                       OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct dh_priv_ctx_st *ctx = vctx;
     int ret;
@@ -192,25 +200,29 @@ static void dh_print_freectx(void *ctx)
 {
 }
 
-static int dh_priv_print_data(void *provctx, const OSSL_PARAM params[],
-                               BIO *out,
-                               OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+static int dh_priv_print_data(void *vctx, const OSSL_PARAM params[], BIO *out,
+                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    struct dh_priv_ctx_st *ctx = vctx;
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(provctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_priv_print(provctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        if ((dh = dh_new(ctx->provctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_priv_print(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
 
 static int dh_priv_print(void *ctx, void *dh, BIO *out,
-                          OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                         OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     return ossl_prov_print_dh(out, dh, dh_print_priv);
 }
diff --git a/providers/implementations/serializers/serializer_dh_pub.c b/providers/implementations/serializers/serializer_dh_pub.c
index 73095c8..9e8d46f 100644
--- a/providers/implementations/serializers/serializer_dh_pub.c
+++ b/providers/implementations/serializers/serializer_dh_pub.c
@@ -45,15 +45,20 @@ static void dh_pub_freectx(void *ctx)
 static int dh_pub_der_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_pub_der(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_pub_der(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
@@ -70,15 +75,20 @@ static int dh_pub_der(void *ctx, void *dh, BIO *out,
 static int dh_pub_pem_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_pub_pem(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_pub_pem(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
@@ -95,15 +105,20 @@ static int dh_pub_pem(void *ctx, void *dh, BIO *out,
 static int dh_pub_print_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                               OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dh_importkey =
-        ossl_prov_get_dh_importkey();
+    OSSL_OP_keymgmt_new_fn *dh_new = ossl_prov_get_keymgmt_dh_new();
+    OSSL_OP_keymgmt_free_fn *dh_free = ossl_prov_get_keymgmt_dh_free();
+    OSSL_OP_keymgmt_import_fn *dh_import = ossl_prov_get_keymgmt_dh_import();
     int ok = 0;
 
-    if (dh_importkey != NULL) {
-        DH *dh = dh_importkey(ctx, params); /* ctx == provctx */
+    if (dh_import != NULL) {
+        DH *dh;
 
-        ok = dh_pub_print(ctx, dh, out, cb, cbarg);
-        DH_free(dh);
+        /* ctx == provctx */
+        if ((dh = dh_new(ctx)) != NULL
+            && dh_import(dh, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dh_pub_print(ctx, dh, out, cb, cbarg))
+            ok = 1;
+        dh_free(dh);
     }
     return ok;
 }
diff --git a/providers/implementations/serializers/serializer_dsa.c b/providers/implementations/serializers/serializer_dsa.c
index 7578c4e..e24d66f 100644
--- a/providers/implementations/serializers/serializer_dsa.c
+++ b/providers/implementations/serializers/serializer_dsa.c
@@ -14,9 +14,19 @@
 #include "prov/providercommonerr.h" /* PROV_R_BN_ERROR */
 #include "serializer_local.h"
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_dsa_importkey(void)
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_dsa_new(void)
 {
-    return ossl_prov_get_importkey(dsa_keymgmt_functions);
+    return ossl_prov_get_keymgmt_new(dsa_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_dsa_free(void)
+{
+    return ossl_prov_get_keymgmt_free(dsa_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_dsa_import(void)
+{
+    return ossl_prov_get_keymgmt_import(dsa_keymgmt_functions);
 }
 
 int ossl_prov_print_dsa(BIO *out, DSA *dsa, enum dsa_print_type type)
diff --git a/providers/implementations/serializers/serializer_dsa_param.c b/providers/implementations/serializers/serializer_dsa_param.c
index 3a108f6..5954988 100644
--- a/providers/implementations/serializers/serializer_dsa_param.c
+++ b/providers/implementations/serializers/serializer_dsa_param.c
@@ -43,68 +43,83 @@ static void dsa_param_freectx(void *ctx)
 
 /* Public key : DER */
 static int dsa_param_der_data(void *ctx, const OSSL_PARAM params[], BIO *out,
-                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_param_der(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dsa_param_der(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
 
 static int dsa_param_der(void *ctx, void *dsa, BIO *out,
-                        OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                         OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     return i2d_DSAparams_bio(out, dsa);
 }
 
 /* Public key : PEM */
 static int dsa_param_pem_data(void *ctx, const OSSL_PARAM params[], BIO *out,
-                            OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_param_pem(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dsa_param_pem(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
 
 static int dsa_param_pem(void *ctx, void *dsa, BIO *out,
-                       OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                         OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     return PEM_write_bio_DSAparams(out, dsa);
 }
 
 static int dsa_param_print_data(void *ctx, const OSSL_PARAM params[], BIO *out,
-                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                                OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_param_print(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, params)
+            && dsa_param_print(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
 
 static int dsa_param_print(void *ctx, void *dsa, BIO *out,
-                         OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
+                           OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     return ossl_prov_print_dsa(out, dsa, dsa_print_params);
 }
diff --git a/providers/implementations/serializers/serializer_dsa_priv.c b/providers/implementations/serializers/serializer_dsa_priv.c
index fc0a340..f3a9ef8 100644
--- a/providers/implementations/serializers/serializer_dsa_priv.c
+++ b/providers/implementations/serializers/serializer_dsa_priv.c
@@ -115,15 +115,19 @@ static int dsa_priv_der_data(void *vctx, const OSSL_PARAM params[], BIO *out,
                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct dsa_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx->provctx, params);
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_priv_der(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        if ((dsa = dsa_new(ctx->provctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_priv_der(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
@@ -147,15 +151,19 @@ static int dsa_pem_priv_data(void *vctx, const OSSL_PARAM params[], BIO *out,
                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct dsa_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params);
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_pem_priv(ctx->provctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        if ((dsa = dsa_new(ctx->provctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_pem_priv(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
@@ -186,19 +194,24 @@ static void dsa_print_freectx(void *ctx)
 {
 }
 
-static int dsa_priv_print_data(void *provctx, const OSSL_PARAM params[],
+static int dsa_priv_print_data(void *vctx, const OSSL_PARAM params[],
                                BIO *out,
                                OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    struct dsa_priv_ctx_st *ctx = vctx;
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(provctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_priv_print(provctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        if ((dsa = dsa_new(ctx->provctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_priv_print(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
diff --git a/providers/implementations/serializers/serializer_dsa_pub.c b/providers/implementations/serializers/serializer_dsa_pub.c
index 0901718..933f1ef 100644
--- a/providers/implementations/serializers/serializer_dsa_pub.c
+++ b/providers/implementations/serializers/serializer_dsa_pub.c
@@ -45,15 +45,20 @@ static void dsa_pub_freectx(void *ctx)
 static int dsa_pub_der_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_pub_der(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_pub_der(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
@@ -82,15 +87,20 @@ static int dsa_pub_der(void *ctx, void *dsa, BIO *out,
 static int dsa_pub_pem_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_pub_pem(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_pub_pem(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
@@ -106,15 +116,20 @@ static int dsa_pub_pem(void *ctx, void *dsa, BIO *out,
 static int dsa_pub_print_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                               OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *dsa_importkey =
-        ossl_prov_get_dsa_importkey();
+    OSSL_OP_keymgmt_new_fn *dsa_new = ossl_prov_get_keymgmt_dsa_new();
+    OSSL_OP_keymgmt_free_fn *dsa_free = ossl_prov_get_keymgmt_dsa_free();
+    OSSL_OP_keymgmt_import_fn *dsa_import = ossl_prov_get_keymgmt_dsa_import();
     int ok = 0;
 
-    if (dsa_importkey != NULL) {
-        DSA *dsa = dsa_importkey(ctx, params); /* ctx == provctx */
+    if (dsa_import != NULL) {
+        DSA *dsa;
 
-        ok = dsa_pub_print(ctx, dsa, out, cb, cbarg);
-        DSA_free(dsa);
+        /* ctx == provctx */
+        if ((dsa = dsa_new(ctx)) != NULL
+            && dsa_import(dsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && dsa_pub_print(ctx, dsa, out, cb, cbarg))
+            ok = 1;
+        dsa_free(dsa);
     }
     return ok;
 }
diff --git a/providers/implementations/serializers/serializer_local.h b/providers/implementations/serializers/serializer_local.h
index 8507a74..801d221 100644
--- a/providers/implementations/serializers/serializer_local.h
+++ b/providers/implementations/serializers/serializer_local.h
@@ -30,11 +30,19 @@ struct pkcs8_encrypt_ctx_st {
     void *cbarg;
 };
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_importkey(const OSSL_DISPATCH *fns);
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_new(const OSSL_DISPATCH *fns);
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_free(const OSSL_DISPATCH *fns);
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_import(const OSSL_DISPATCH *fns);
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_rsa_importkey(void);
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_dh_importkey(void);
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_dsa_importkey(void);
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_rsa_new(void);
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_rsa_free(void);
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_rsa_import(void);
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_dh_new(void);
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_dh_free(void);
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_dh_import(void);
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_dsa_new(void);
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_dsa_free(void);
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_dsa_import(void);
 
 int ossl_prov_prepare_dh_params(const void *dh, int nid,
                                 ASN1_STRING **pstr, int *pstrtype);
diff --git a/providers/implementations/serializers/serializer_rsa.c b/providers/implementations/serializers/serializer_rsa.c
index ac8e4a2..9aaefb5 100644
--- a/providers/implementations/serializers/serializer_rsa.c
+++ b/providers/implementations/serializers/serializer_rsa.c
@@ -14,9 +14,19 @@
 
 DEFINE_SPECIAL_STACK_OF_CONST(BIGNUM_const, BIGNUM)
 
-OSSL_OP_keymgmt_importkey_fn *ossl_prov_get_rsa_importkey(void)
+OSSL_OP_keymgmt_new_fn *ossl_prov_get_keymgmt_rsa_new(void)
 {
-    return ossl_prov_get_importkey(rsa_keymgmt_functions);
+    return ossl_prov_get_keymgmt_new(rsa_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_free_fn *ossl_prov_get_keymgmt_rsa_free(void)
+{
+    return ossl_prov_get_keymgmt_free(rsa_keymgmt_functions);
+}
+
+OSSL_OP_keymgmt_import_fn *ossl_prov_get_keymgmt_rsa_import(void)
+{
+    return ossl_prov_get_keymgmt_import(rsa_keymgmt_functions);
 }
 
 int ossl_prov_print_rsa(BIO *out, RSA *rsa, int priv)
diff --git a/providers/implementations/serializers/serializer_rsa_priv.c b/providers/implementations/serializers/serializer_rsa_priv.c
index 3d16e43..c236739 100644
--- a/providers/implementations/serializers/serializer_rsa_priv.c
+++ b/providers/implementations/serializers/serializer_rsa_priv.c
@@ -143,15 +143,19 @@ static int rsa_priv_der_data(void *vctx, const OSSL_PARAM params[], BIO *out,
                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct rsa_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(ctx->provctx, params);
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_priv_der(vctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        if ((rsa = rsa_new(ctx->provctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_priv_der(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }
@@ -178,15 +182,19 @@ static int rsa_pem_priv_data(void *vctx, const OSSL_PARAM params[], BIO *out,
                              OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
     struct rsa_priv_ctx_st *ctx = vctx;
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(ctx, params);
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_pem_priv(vctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        if ((rsa = rsa_new(ctx->provctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_pem_priv(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }
@@ -220,19 +228,24 @@ static void rsa_print_freectx(void *ctx)
 {
 }
 
-static int rsa_priv_print_data(void *provctx, const OSSL_PARAM params[],
+static int rsa_priv_print_data(void *vctx, const OSSL_PARAM params[],
                                BIO *out,
                                OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    struct rsa_priv_ctx_st *ctx = vctx;
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(provctx, params); /* ctx == provctx */
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_priv_print(provctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        if ((rsa = rsa_new(ctx->provctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_priv_print(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }
diff --git a/providers/implementations/serializers/serializer_rsa_pub.c b/providers/implementations/serializers/serializer_rsa_pub.c
index c975499..f7eccf7 100644
--- a/providers/implementations/serializers/serializer_rsa_pub.c
+++ b/providers/implementations/serializers/serializer_rsa_pub.c
@@ -45,15 +45,20 @@ static void rsa_pub_freectx(void *ctx)
 static int rsa_pub_der_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(ctx, params); /* ctx == provctx */
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_pub_der(ctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        /* ctx == provctx */
+        if ((rsa = rsa_new(ctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_pub_der(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }
@@ -68,15 +73,20 @@ static int rsa_pub_der(void *ctx, void *rsa, BIO *out,
 static int rsa_pub_pem_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                             OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(ctx, params); /* ctx == provctx */
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_pub_pem(ctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        /* ctx == provctx */
+        if ((rsa = rsa_new(ctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_pub_pem(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }
@@ -90,15 +100,20 @@ static int rsa_pub_pem(void *ctx, void *rsa, BIO *out,
 static int rsa_pub_print_data(void *ctx, const OSSL_PARAM params[], BIO *out,
                               OSSL_PASSPHRASE_CALLBACK *cb, void *cbarg)
 {
-    OSSL_OP_keymgmt_importkey_fn *rsa_importkey =
-        ossl_prov_get_rsa_importkey();
+    OSSL_OP_keymgmt_new_fn *rsa_new = ossl_prov_get_keymgmt_rsa_new();
+    OSSL_OP_keymgmt_free_fn *rsa_free = ossl_prov_get_keymgmt_rsa_free();
+    OSSL_OP_keymgmt_import_fn *rsa_import = ossl_prov_get_keymgmt_rsa_import();
     int ok = 0;
 
-    if (rsa_importkey != NULL) {
-        RSA *rsa = rsa_importkey(ctx, params); /* ctx == provctx */
+    if (rsa_import != NULL) {
+        RSA *rsa;
 
-        ok = rsa_pub_print(ctx, rsa, out, cb, cbarg);
-        RSA_free(rsa);
+        /* ctx == provctx */
+        if ((rsa = rsa_new(ctx)) != NULL
+            && rsa_import(rsa, OSSL_KEYMGMT_SELECT_KEYPAIR, params)
+            && rsa_pub_print(ctx, rsa, out, cb, cbarg))
+            ok = 1;
+        rsa_free(rsa);
     }
     return ok;
 }