88 files changed, 148 insertions, 69 deletions

diff --git a/providers/common/ciphers/build.info b/providers/common/ciphers/build.info
index 77376cce1e..b76b8ba10a 100644
--- a/providers/common/ciphers/build.info
+++ b/providers/common/ciphers/build.info
@@ -1,26 +1,5 @@
-# This source is common building blockss for all ciphers in all our providers.
+# This source is common building blocks for all ciphers in all our providers.
 SOURCE[../../libcommon.a]=\
         cipher_common.c cipher_common_hw.c block.c \
         cipher_gcm.c cipher_gcm_hw.c \
         cipher_ccm.c cipher_ccm_hw.c
-
-# These are our implementations
-$GOAL=../../libimplementations.a
-
-IF[{- !$disabled{des} -}]
-  $COMMON_DES=cipher_tdes.c cipher_tdes_hw.c
-ENDIF
-
-SOURCE[$GOAL]=\
-        cipher_aes.c cipher_aes_hw.c \
-        cipher_aes_xts.c cipher_aes_xts_hw.c \
-        cipher_aes_gcm.c cipher_aes_gcm_hw.c \
-        cipher_aes_ccm.c cipher_aes_ccm_hw.c \
-        cipher_aes_wrp.c \
-        $COMMON_DES
-# Because some default ciphers need it
-INCLUDE[$GOAL]=.
-
-# Finally, we have a few things that aren't FIPS agnostic
-SOURCE[../../libfips.a]=cipher_fips.c
-SOURCE[../../libnonfips.a]=cipher_fips.c
diff --git a/providers/common/ciphers/cipher_ccm.c b/providers/common/ciphers/cipher_ccm.c
index 3fbaef9a46..60fade83e0 100644
--- a/providers/common/ciphers/cipher_ccm.c
+++ b/providers/common/ciphers/cipher_ccm.c
@@ -9,8 +9,8 @@
 
 /* Dispatch functions for ccm mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_ccm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_ccm.h"
 #include "internal/providercommonerr.h"
 
 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
diff --git a/providers/common/ciphers/cipher_ccm_hw.c b/providers/common/ciphers/cipher_ccm_hw.c
index b093b768e7..5503a41687 100644
--- a/providers/common/ciphers/cipher_ccm_hw.c
+++ b/providers/common/ciphers/cipher_ccm_hw.c
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/ciphers/ciphercommon.h"
-#include "internal/ciphers/cipher_ccm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_ccm.h"
 
 int ccm_generic_setiv(PROV_CCM_CTX *ctx, const unsigned char *nonce,
                       size_t nlen, size_t mlen)
diff --git a/providers/common/ciphers/cipher_common_hw.c b/providers/common/ciphers/cipher_common_hw.c
index 6f1b4babd8..f1c466edc8 100644
--- a/providers/common/ciphers/cipher_common_hw.c
+++ b/providers/common/ciphers/cipher_common_hw.c
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "cipher_local.h"
+#include "prov/ciphercommon.h"
 
 /*-
  * The generic cipher functions for cipher modes cbc, ecb, ofb, cfb and ctr.
diff --git a/providers/common/ciphers/cipher_gcm.c b/providers/common/ciphers/cipher_gcm.c
index 59368dc81e..72d17d0073 100644
--- a/providers/common/ciphers/cipher_gcm.c
+++ b/providers/common/ciphers/cipher_gcm.c
@@ -9,8 +9,8 @@
 
 /* Dispatch functions for gcm mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_gcm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_gcm.h"
 #include "internal/providercommonerr.h"
 #include "crypto/rand.h"
 #include "internal/provider_ctx.h"
diff --git a/providers/common/ciphers/cipher_gcm_hw.c b/providers/common/ciphers/cipher_gcm_hw.c
index 1d9c3ea49c..09e3c27400 100644
--- a/providers/common/ciphers/cipher_gcm_hw.c
+++ b/providers/common/ciphers/cipher_gcm_hw.c
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_gcm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_gcm.h"
 
 
 int gcm_setiv(PROV_GCM_CTX *ctx, const unsigned char *iv, size_t ivlen)
diff --git a/providers/common/ciphers/cipher_local.h b/providers/common/ciphers/cipher_local.h
index 898c99b1d3..1c4716f357 100644
--- a/providers/common/ciphers/cipher_local.h
+++ b/providers/common/ciphers/cipher_local.h
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 void padblock(unsigned char *buf, size_t *buflen, size_t blocksize);
 int unpadblock(unsigned char *buf, size_t *buflen, size_t blocksize);
diff --git a/providers/common/include/internal/ciphers/cipher_aead.h b/providers/common/include/prov/cipher_aead.h
index 0b7d595b7d..0b7d595b7d 100644
--- a/providers/common/include/internal/ciphers/cipher_aead.h
+++ b/providers/common/include/prov/cipher_aead.h
diff --git a/providers/common/include/internal/ciphers/cipher_ccm.h b/providers/common/include/prov/cipher_ccm.h
index 2214b5fc64..2214b5fc64 100644
--- a/providers/common/include/internal/ciphers/cipher_ccm.h
+++ b/providers/common/include/prov/cipher_ccm.h
diff --git a/providers/common/include/internal/ciphers/cipher_gcm.h b/providers/common/include/prov/cipher_gcm.h
index 711b40cdd4..711b40cdd4 100644
--- a/providers/common/include/internal/ciphers/cipher_gcm.h
+++ b/providers/common/include/prov/cipher_gcm.h
diff --git a/providers/common/include/internal/ciphers/ciphercommon.h b/providers/common/include/prov/ciphercommon.h
index 2f77f48712..2f77f48712 100644
--- a/providers/common/include/internal/ciphers/ciphercommon.h
+++ b/providers/common/include/prov/ciphercommon.h
diff --git a/providers/default/build.info b/providers/default/build.info
index 9a9760b799..139590ae45 100644
--- a/providers/default/build.info
+++ b/providers/default/build.info
@@ -1,4 +1,2 @@
-SUBDIRS=ciphers
 $GOAL=../../libcrypto
 SOURCE[$GOAL]=defltprov.c
-INCLUDE[$GOAL]=include
diff --git a/providers/implementations/build.info b/providers/implementations/build.info
index 86c581d7f7..0fc0822074 100644
--- a/providers/implementations/build.info
+++ b/providers/implementations/build.info
@@ -1 +1 @@
-SUBDIRS=digests macs kdfs exchange keymgmt signature
+SUBDIRS=digests ciphers macs kdfs exchange keymgmt signature
diff --git a/providers/implementations/ciphers/build.info b/providers/implementations/ciphers/build.info
new file mode 100644
index 0000000000..fb2b53e58a
--- /dev/null
+++ b/providers/implementations/ciphers/build.info
@@ -0,0 +1,102 @@
+# We make separate GOAL variables for each algorithm, to make it easy to
+# switch each to the Legacy provider when needed.
+#
+# $TDES_1_GOAL and $TDES_2_GOAL separate FIPSable and non-FIPSable TDES.
+# The latter may become legacy sooner, so it's comfortable to have two
+# variables already now, to switch the non-FIPSable TDES to legacy if needed.
+
+$AES_GOAL=../../libimplementations.a
+$TDES_1_GOAL=../../libimplementations.a
+$TDES_2_GOAL=../../libimplementations.a
+$DES_GOAL=../../libimplementations.a
+$ARIA_GOAL=../../libimplementations.a
+$CAMELLIA_GOAL=../../libimplementations.a
+$BLOWFISH_GOAL=../../libimplementations.a
+$IDEA_GOAL=../../libimplementations.a
+$CAST5_GOAL=../../libimplementations.a
+$SEED_GOAL=../../libimplementations.a
+$SM4_GOAL=../../libimplementations.a
+$RC4_GOAL=../../libimplementations.a
+$RC5_GOAL=../../libimplementations.a
+$RC2_GOAL=../../libimplementations.a
+
+IF[{- !$disabled{des} -}]
+  SOURCE[$TDES_1_GOAL]=cipher_tdes.c cipher_tdes_hw.c
+ENDIF
+
+SOURCE[$AES_GOAL]=\
+        cipher_aes.c cipher_aes_hw.c \
+        cipher_aes_xts.c cipher_aes_xts_hw.c \
+        cipher_aes_gcm.c cipher_aes_gcm_hw.c \
+        cipher_aes_ccm.c cipher_aes_ccm_hw.c \
+        cipher_aes_wrp.c
+# Extra code to satisfy the FIPS and non-FIPS separation.
+# When the AES-xxx-XTS moves to legacy, this can be removed.
+SOURCE[../../libfips.a]=cipher_aes_xts_fips.c
+SOURCE[../../libnonfips.a]=cipher_aes_xts_fips.c
+
+IF[{- !$disabled{des} -}]
+  SOURCE[$TDES_2_GOAL]=\
+      cipher_tdes_default.c cipher_tdes_default_hw.c \
+      cipher_tdes_wrap.c cipher_tdes_wrap_hw.c
+  SOURCE[$DES_GOAL]=\
+      cipher_desx.c cipher_desx_hw.c \
+      cipher_des.c cipher_des_hw.c
+ENDIF
+
+IF[{- !$disabled{aria} -}]
+  SOURCE[$ARIA_GOAL]=\
+      cipher_aria.c cipher_aria_hw.c \
+      cipher_aria_gcm.c cipher_aria_gcm_hw.c \
+      cipher_aria_ccm.c cipher_aria_ccm_hw.c
+ENDIF
+
+IF[{- !$disabled{camellia} -}]
+  SOURCE[$CAMELLIA_GOAL]=\
+      cipher_camellia.c cipher_camellia_hw.c
+ENDIF
+
+IF[{- !$disabled{bf} -}]
+  SOURCE[$BLOWFISH_GOAL]=\
+      cipher_blowfish.c cipher_blowfish_hw.c
+ENDIF
+
+IF[{- !$disabled{idea} -}]
+  SOURCE[$IDEA_GOAL]=\
+      cipher_idea.c cipher_idea_hw.c
+ENDIF
+
+IF[{- !$disabled{cast} -}]
+  SOURCE[$CAST5_GOAL]=\
+      cipher_cast5.c cipher_cast5_hw.c
+ENDIF
+
+IF[{- !$disabled{seed} -}]
+  SOURCE[$SEED_GOAL]=\
+      cipher_seed.c cipher_seed_hw.c
+ENDIF
+
+IF[{- !$disabled{sm4} -}]
+  SOURCE[$SM4_GOAL]=\
+      cipher_sm4.c cipher_sm4_hw.c
+ENDIF
+
+IF[{- !$disabled{ocb} -}]
+  SOURCE[$AES_GOAL]=\
+       cipher_aes_ocb.c cipher_aes_ocb_hw.c
+ENDIF
+
+IF[{- !$disabled{rc4} -}]
+  SOURCE[$RC4_GOAL]=\
+      cipher_rc4.c cipher_rc4_hw.c
+ENDIF
+
+IF[{- !$disabled{rc5} -}]
+  SOURCE[$RC5_GOAL]=\
+      cipher_rc5.c cipher_rc5_hw.c
+ENDIF
+
+IF[{- !$disabled{rc2} -}]
+  SOURCE[$RC2_GOAL]=\
+      cipher_rc2.c cipher_rc2_hw.c
+ENDIF
diff --git a/providers/common/ciphers/cipher_aes.c b/providers/implementations/ciphers/cipher_aes.c
index 46880e0bf7..46880e0bf7 100644
--- a/providers/common/ciphers/cipher_aes.c
+++ b/providers/implementations/ciphers/cipher_aes.c
diff --git a/providers/common/ciphers/cipher_aes.h b/providers/implementations/ciphers/cipher_aes.h
index 741b20f6e3..d00fab13ef 100644
--- a/providers/common/ciphers/cipher_aes.h
+++ b/providers/implementations/ciphers/cipher_aes.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/aes.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_aes_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/common/ciphers/cipher_aes_ccm.c b/providers/implementations/ciphers/cipher_aes_ccm.c
index cffca06c80..59fc7274c9 100644
--- a/providers/common/ciphers/cipher_aes_ccm.c
+++ b/providers/implementations/ciphers/cipher_aes_ccm.c
@@ -9,8 +9,8 @@
 
 /* Dispatch functions for AES CCM mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_ccm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_ccm.h"
 #include "internal/provider_algs.h"
 
 static void *aes_ccm_newctx(void *provctx, size_t keybits)
diff --git a/providers/common/ciphers/cipher_aes_ccm_hw.c b/providers/implementations/ciphers/cipher_aes_ccm_hw.c
index ba7ce4dcab..ae200ebada 100644
--- a/providers/common/ciphers/cipher_aes_ccm_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_ccm_hw.c
@@ -9,8 +9,8 @@
 
 /* AES CCM mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_ccm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_ccm.h"
 
 #define AES_HW_CCM_SET_KEY_FN(fn_set_enc_key, fn_blk, fn_ccm_enc, fn_ccm_dec)  \
     fn_set_enc_key(key, keylen * 8, &actx->ccm.ks.ks);                         \
diff --git a/providers/common/ciphers/cipher_aes_ccm_hw_aesni.inc b/providers/implementations/ciphers/cipher_aes_ccm_hw_aesni.inc
index 3a5e4a740d..3a5e4a740d 100644
--- a/providers/common/ciphers/cipher_aes_ccm_hw_aesni.inc
+++ b/providers/implementations/ciphers/cipher_aes_ccm_hw_aesni.inc
diff --git a/providers/common/ciphers/cipher_aes_ccm_hw_s390x.inc b/providers/implementations/ciphers/cipher_aes_ccm_hw_s390x.inc
index a5025e5960..a5025e5960 100644
--- a/providers/common/ciphers/cipher_aes_ccm_hw_s390x.inc
+++ b/providers/implementations/ciphers/cipher_aes_ccm_hw_s390x.inc
diff --git a/providers/common/ciphers/cipher_aes_ccm_hw_t4.inc b/providers/implementations/ciphers/cipher_aes_ccm_hw_t4.inc
index 21bf6861e0..21bf6861e0 100644
--- a/providers/common/ciphers/cipher_aes_ccm_hw_t4.inc
+++ b/providers/implementations/ciphers/cipher_aes_ccm_hw_t4.inc
diff --git a/providers/common/ciphers/cipher_aes_gcm.c b/providers/implementations/ciphers/cipher_aes_gcm.c
index ef015bff21..1df1c1dba9 100644
--- a/providers/common/ciphers/cipher_aes_gcm.c
+++ b/providers/implementations/ciphers/cipher_aes_gcm.c
@@ -9,8 +9,8 @@
 
 /* Dispatch functions for AES GCM mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_gcm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_gcm.h"
 #include "internal/provider_algs.h"
 
 static void *aes_gcm_newctx(void *provctx, size_t keybits)
diff --git a/providers/common/ciphers/cipher_aes_gcm_hw.c b/providers/implementations/ciphers/cipher_aes_gcm_hw.c
index 5263bdd6dd..f5dc0c4eed 100644
--- a/providers/common/ciphers/cipher_aes_gcm_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_gcm_hw.c
@@ -9,8 +9,8 @@
 
 /* Dispatch functions for AES GCM mode */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_gcm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_gcm.h"
 
 static int generic_aes_gcm_initkey(PROV_GCM_CTX *ctx, const unsigned char *key,
                                    size_t keylen)
diff --git a/providers/common/ciphers/cipher_aes_gcm_hw_aesni.inc b/providers/implementations/ciphers/cipher_aes_gcm_hw_aesni.inc
index eb2a3f343a..eb2a3f343a 100644
--- a/providers/common/ciphers/cipher_aes_gcm_hw_aesni.inc
+++ b/providers/implementations/ciphers/cipher_aes_gcm_hw_aesni.inc
diff --git a/providers/common/ciphers/cipher_aes_gcm_hw_s390x.inc b/providers/implementations/ciphers/cipher_aes_gcm_hw_s390x.inc
index 44c3bf332d..44c3bf332d 100644
--- a/providers/common/ciphers/cipher_aes_gcm_hw_s390x.inc
+++ b/providers/implementations/ciphers/cipher_aes_gcm_hw_s390x.inc
diff --git a/providers/common/ciphers/cipher_aes_gcm_hw_t4.inc b/providers/implementations/ciphers/cipher_aes_gcm_hw_t4.inc
index 19e9ccb760..19e9ccb760 100644
--- a/providers/common/ciphers/cipher_aes_gcm_hw_t4.inc
+++ b/providers/implementations/ciphers/cipher_aes_gcm_hw_t4.inc
diff --git a/providers/common/ciphers/cipher_aes_hw.c b/providers/implementations/ciphers/cipher_aes_hw.c
index e9b6388300..e9b6388300 100644
--- a/providers/common/ciphers/cipher_aes_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_hw.c
diff --git a/providers/common/ciphers/cipher_aes_hw_aesni.inc b/providers/implementations/ciphers/cipher_aes_hw_aesni.inc
index 6070939dee..6070939dee 100644
--- a/providers/common/ciphers/cipher_aes_hw_aesni.inc
+++ b/providers/implementations/ciphers/cipher_aes_hw_aesni.inc
diff --git a/providers/common/ciphers/cipher_aes_hw_s390x.inc b/providers/implementations/ciphers/cipher_aes_hw_s390x.inc
index 805fa91e5f..805fa91e5f 100644
--- a/providers/common/ciphers/cipher_aes_hw_s390x.inc
+++ b/providers/implementations/ciphers/cipher_aes_hw_s390x.inc
diff --git a/providers/common/ciphers/cipher_aes_hw_t4.inc b/providers/implementations/ciphers/cipher_aes_hw_t4.inc
index 21b672710a..21b672710a 100644
--- a/providers/common/ciphers/cipher_aes_hw_t4.inc
+++ b/providers/implementations/ciphers/cipher_aes_hw_t4.inc
diff --git a/providers/default/ciphers/cipher_aes_ocb.c b/providers/implementations/ciphers/cipher_aes_ocb.c
index 95c0658fee..5ab0b8fd15 100644
--- a/providers/default/ciphers/cipher_aes_ocb.c
+++ b/providers/implementations/ciphers/cipher_aes_ocb.c
@@ -9,7 +9,7 @@
 
 #include "cipher_aes_ocb.h"
 #include "internal/providercommonerr.h"
-#include "internal/ciphers/cipher_aead.h"
+#include "prov/cipher_aead.h"
 #include "internal/provider_algs.h"
 
 #define AES_OCB_FLAGS AEAD_FLAGS
diff --git a/providers/default/ciphers/cipher_aes_ocb.h b/providers/implementations/ciphers/cipher_aes_ocb.h
index 7750e97615..ba515241e2 100644
--- a/providers/default/ciphers/cipher_aes_ocb.h
+++ b/providers/implementations/ciphers/cipher_aes_ocb.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/aes.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 #define OCB_MAX_TAG_LEN     AES_BLOCK_SIZE
 #define OCB_MAX_DATA_LEN    AES_BLOCK_SIZE
diff --git a/providers/default/ciphers/cipher_aes_ocb_hw.c b/providers/implementations/ciphers/cipher_aes_ocb_hw.c
index 49f387b5ba..49f387b5ba 100644
--- a/providers/default/ciphers/cipher_aes_ocb_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_ocb_hw.c
diff --git a/providers/common/ciphers/cipher_aes_wrp.c b/providers/implementations/ciphers/cipher_aes_wrp.c
index 1bf4c1793a..1bf4c1793a 100644
--- a/providers/common/ciphers/cipher_aes_wrp.c
+++ b/providers/implementations/ciphers/cipher_aes_wrp.c
diff --git a/providers/common/ciphers/cipher_aes_xts.c b/providers/implementations/ciphers/cipher_aes_xts.c
index d0b999081e..d0b999081e 100644
--- a/providers/common/ciphers/cipher_aes_xts.c
+++ b/providers/implementations/ciphers/cipher_aes_xts.c
diff --git a/providers/common/ciphers/cipher_aes_xts.h b/providers/implementations/ciphers/cipher_aes_xts.h
index 16fb8c34cd..615ee61905 100644
--- a/providers/common/ciphers/cipher_aes_xts.h
+++ b/providers/implementations/ciphers/cipher_aes_xts.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/aes.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 /*
  * Available in cipher_fips.c, and compiled with different values depending
diff --git a/providers/common/ciphers/cipher_fips.c b/providers/implementations/ciphers/cipher_aes_xts_fips.c
index c99d6ed2f4..c99d6ed2f4 100644
--- a/providers/common/ciphers/cipher_fips.c
+++ b/providers/implementations/ciphers/cipher_aes_xts_fips.c
diff --git a/providers/common/ciphers/cipher_aes_xts_hw.c b/providers/implementations/ciphers/cipher_aes_xts_hw.c
index 9ac70c4fa8..9ac70c4fa8 100644
--- a/providers/common/ciphers/cipher_aes_xts_hw.c
+++ b/providers/implementations/ciphers/cipher_aes_xts_hw.c
diff --git a/providers/default/ciphers/cipher_aria.c b/providers/implementations/ciphers/cipher_aria.c
index 861b28268b..861b28268b 100644
--- a/providers/default/ciphers/cipher_aria.c
+++ b/providers/implementations/ciphers/cipher_aria.c
diff --git a/providers/default/ciphers/cipher_aria.h b/providers/implementations/ciphers/cipher_aria.h
index e95e4ca93c..282408c58e 100644
--- a/providers/default/ciphers/cipher_aria.h
+++ b/providers/implementations/ciphers/cipher_aria.h
@@ -8,7 +8,7 @@
  */
 
 #include "crypto/aria.h"
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_aria_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_aria_ccm.c b/providers/implementations/ciphers/cipher_aria_ccm.c
index 97e8137db8..97e8137db8 100644
--- a/providers/default/ciphers/cipher_aria_ccm.c
+++ b/providers/implementations/ciphers/cipher_aria_ccm.c
diff --git a/providers/default/ciphers/cipher_aria_ccm.h b/providers/implementations/ciphers/cipher_aria_ccm.h
index fe0a3908bc..301ce14306 100644
--- a/providers/default/ciphers/cipher_aria_ccm.h
+++ b/providers/implementations/ciphers/cipher_aria_ccm.h
@@ -8,8 +8,8 @@
  */
 
 #include "crypto/aria.h"
-#include "internal/ciphers/ciphercommon.h"
-#include "internal/ciphers/cipher_ccm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_ccm.h"
 
 typedef struct prov_aria_ccm_ctx_st {
     PROV_CCM_CTX base; /* Must be first */
diff --git a/providers/default/ciphers/cipher_aria_ccm_hw.c b/providers/implementations/ciphers/cipher_aria_ccm_hw.c
index db3a9c8ea8..db3a9c8ea8 100644
--- a/providers/default/ciphers/cipher_aria_ccm_hw.c
+++ b/providers/implementations/ciphers/cipher_aria_ccm_hw.c
diff --git a/providers/default/ciphers/cipher_aria_gcm.c b/providers/implementations/ciphers/cipher_aria_gcm.c
index 7c9fa3d211..7c9fa3d211 100644
--- a/providers/default/ciphers/cipher_aria_gcm.c
+++ b/providers/implementations/ciphers/cipher_aria_gcm.c
diff --git a/providers/default/ciphers/cipher_aria_gcm.h b/providers/implementations/ciphers/cipher_aria_gcm.h
index ac5c248201..13fbe175d9 100644
--- a/providers/default/ciphers/cipher_aria_gcm.h
+++ b/providers/implementations/ciphers/cipher_aria_gcm.h
@@ -8,8 +8,8 @@
  */
 
 #include "crypto/aria.h"
-#include "internal/ciphers/ciphercommon.h"
-#include "internal/ciphers/cipher_gcm.h"
+#include "prov/ciphercommon.h"
+#include "prov/cipher_gcm.h"
 
 typedef struct prov_aria_gcm_ctx_st {
     PROV_GCM_CTX base;              /* must be first entry in struct */
diff --git a/providers/default/ciphers/cipher_aria_gcm_hw.c b/providers/implementations/ciphers/cipher_aria_gcm_hw.c
index ed1e1851dc..ed1e1851dc 100644
--- a/providers/default/ciphers/cipher_aria_gcm_hw.c
+++ b/providers/implementations/ciphers/cipher_aria_gcm_hw.c
diff --git a/providers/default/ciphers/cipher_aria_hw.c b/providers/implementations/ciphers/cipher_aria_hw.c
index b644be8dda..b644be8dda 100644
--- a/providers/default/ciphers/cipher_aria_hw.c
+++ b/providers/implementations/ciphers/cipher_aria_hw.c
diff --git a/providers/default/ciphers/cipher_blowfish.c b/providers/implementations/ciphers/cipher_blowfish.c
index 4730f1fd40..4730f1fd40 100644
--- a/providers/default/ciphers/cipher_blowfish.c
+++ b/providers/implementations/ciphers/cipher_blowfish.c
diff --git a/providers/default/ciphers/cipher_blowfish.h b/providers/implementations/ciphers/cipher_blowfish.h
index 819a61f140..2d66d1bc0e 100644
--- a/providers/default/ciphers/cipher_blowfish.h
+++ b/providers/implementations/ciphers/cipher_blowfish.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/blowfish.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_blowfish_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_blowfish_hw.c b/providers/implementations/ciphers/cipher_blowfish_hw.c
index 137aeef5ca..137aeef5ca 100644
--- a/providers/default/ciphers/cipher_blowfish_hw.c
+++ b/providers/implementations/ciphers/cipher_blowfish_hw.c
diff --git a/providers/default/ciphers/cipher_camellia.c b/providers/implementations/ciphers/cipher_camellia.c
index 68c0e91355..68c0e91355 100644
--- a/providers/default/ciphers/cipher_camellia.c
+++ b/providers/implementations/ciphers/cipher_camellia.c
diff --git a/providers/default/ciphers/cipher_camellia.h b/providers/implementations/ciphers/cipher_camellia.h
index 521c03e261..58636f1d32 100644
--- a/providers/default/ciphers/cipher_camellia.h
+++ b/providers/implementations/ciphers/cipher_camellia.h
@@ -8,7 +8,7 @@
  */
 
 #include "openssl/camellia.h"
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_camellia_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_camellia_hw.c b/providers/implementations/ciphers/cipher_camellia_hw.c
index 39ba4bd0ac..39ba4bd0ac 100644
--- a/providers/default/ciphers/cipher_camellia_hw.c
+++ b/providers/implementations/ciphers/cipher_camellia_hw.c
diff --git a/providers/default/ciphers/cipher_camellia_hw_t4.inc b/providers/implementations/ciphers/cipher_camellia_hw_t4.inc
index 24e104646b..24e104646b 100644
--- a/providers/default/ciphers/cipher_camellia_hw_t4.inc
+++ b/providers/implementations/ciphers/cipher_camellia_hw_t4.inc
diff --git a/providers/default/ciphers/cipher_cast.h b/providers/implementations/ciphers/cipher_cast.h
index 279f92216f..218f5c4fb5 100644
--- a/providers/default/ciphers/cipher_cast.h
+++ b/providers/implementations/ciphers/cipher_cast.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/cast.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_cast_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_cast5.c b/providers/implementations/ciphers/cipher_cast5.c
index eb79aad820..eb79aad820 100644
--- a/providers/default/ciphers/cipher_cast5.c
+++ b/providers/implementations/ciphers/cipher_cast5.c
diff --git a/providers/default/ciphers/cipher_cast5_hw.c b/providers/implementations/ciphers/cipher_cast5_hw.c
index 227e90d7a7..227e90d7a7 100644
--- a/providers/default/ciphers/cipher_cast5_hw.c
+++ b/providers/implementations/ciphers/cipher_cast5_hw.c
diff --git a/providers/default/ciphers/cipher_des.c b/providers/implementations/ciphers/cipher_des.c
index 4530114187..5781aa4706 100644
--- a/providers/default/ciphers/cipher_des.c
+++ b/providers/implementations/ciphers/cipher_des.c
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "cipher_local.h"
+#include "prov/ciphercommon.h"
 #include "cipher_des.h"
 #include "crypto/rand.h"
 #include "internal/provider_algs.h"
diff --git a/providers/default/ciphers/cipher_des.h b/providers/implementations/ciphers/cipher_des.h
index 92dcfa11e9..92dcfa11e9 100644
--- a/providers/default/ciphers/cipher_des.h
+++ b/providers/implementations/ciphers/cipher_des.h
diff --git a/providers/default/ciphers/cipher_des_hw.c b/providers/implementations/ciphers/cipher_des_hw.c
index 78107062a5..c3a67080fd 100644
--- a/providers/default/ciphers/cipher_des_hw.c
+++ b/providers/implementations/ciphers/cipher_des_hw.c
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 #include "cipher_des.h"
 
 static int cipher_hw_des_initkey(PROV_CIPHER_CTX *ctx,
diff --git a/providers/default/ciphers/cipher_desx.c b/providers/implementations/ciphers/cipher_desx.c
index 4a232cd080..4a232cd080 100644
--- a/providers/default/ciphers/cipher_desx.c
+++ b/providers/implementations/ciphers/cipher_desx.c
diff --git a/providers/default/ciphers/cipher_desx_hw.c b/providers/implementations/ciphers/cipher_desx_hw.c
index ef1b3b0694..ef1b3b0694 100644
--- a/providers/default/ciphers/cipher_desx_hw.c
+++ b/providers/implementations/ciphers/cipher_desx_hw.c
diff --git a/providers/default/ciphers/cipher_idea.c b/providers/implementations/ciphers/cipher_idea.c
index 6bb5419b6d..6bb5419b6d 100644
--- a/providers/default/ciphers/cipher_idea.c
+++ b/providers/implementations/ciphers/cipher_idea.c
diff --git a/providers/default/ciphers/cipher_idea.h b/providers/implementations/ciphers/cipher_idea.h
index 8e096bfe9f..ebe590b93c 100644
--- a/providers/default/ciphers/cipher_idea.h
+++ b/providers/implementations/ciphers/cipher_idea.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/idea.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_idea_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_idea_hw.c b/providers/implementations/ciphers/cipher_idea_hw.c
index d722cc7a27..d722cc7a27 100644
--- a/providers/default/ciphers/cipher_idea_hw.c
+++ b/providers/implementations/ciphers/cipher_idea_hw.c
diff --git a/providers/default/ciphers/cipher_rc2.c b/providers/implementations/ciphers/cipher_rc2.c
index f7ee268276..f7ee268276 100644
--- a/providers/default/ciphers/cipher_rc2.c
+++ b/providers/implementations/ciphers/cipher_rc2.c
diff --git a/providers/default/ciphers/cipher_rc2.h b/providers/implementations/ciphers/cipher_rc2.h
index 7a7928925b..82f0f6ca74 100644
--- a/providers/default/ciphers/cipher_rc2.h
+++ b/providers/implementations/ciphers/cipher_rc2.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/rc2.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_rc2_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_rc2_hw.c b/providers/implementations/ciphers/cipher_rc2_hw.c
index 83d7560d41..83d7560d41 100644
--- a/providers/default/ciphers/cipher_rc2_hw.c
+++ b/providers/implementations/ciphers/cipher_rc2_hw.c
diff --git a/providers/default/ciphers/cipher_rc4.c b/providers/implementations/ciphers/cipher_rc4.c
index d81b776bc2..d81b776bc2 100644
--- a/providers/default/ciphers/cipher_rc4.c
+++ b/providers/implementations/ciphers/cipher_rc4.c
diff --git a/providers/default/ciphers/cipher_rc4.h b/providers/implementations/ciphers/cipher_rc4.h
index df61f7c265..a2d0a50f21 100644
--- a/providers/default/ciphers/cipher_rc4.h
+++ b/providers/implementations/ciphers/cipher_rc4.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/rc4.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_rc4_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_rc4_hw.c b/providers/implementations/ciphers/cipher_rc4_hw.c
index 503a618914..503a618914 100644
--- a/providers/default/ciphers/cipher_rc4_hw.c
+++ b/providers/implementations/ciphers/cipher_rc4_hw.c
diff --git a/providers/default/ciphers/cipher_rc5.c b/providers/implementations/ciphers/cipher_rc5.c
index 645a6b8b64..645a6b8b64 100644
--- a/providers/default/ciphers/cipher_rc5.c
+++ b/providers/implementations/ciphers/cipher_rc5.c
diff --git a/providers/default/ciphers/cipher_rc5.h b/providers/implementations/ciphers/cipher_rc5.h
index c415e18c59..fe0d09f710 100644
--- a/providers/default/ciphers/cipher_rc5.h
+++ b/providers/implementations/ciphers/cipher_rc5.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/rc5.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_blowfish_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_rc5_hw.c b/providers/implementations/ciphers/cipher_rc5_hw.c
index a9a05ba32f..a9a05ba32f 100644
--- a/providers/default/ciphers/cipher_rc5_hw.c
+++ b/providers/implementations/ciphers/cipher_rc5_hw.c
diff --git a/providers/default/ciphers/cipher_seed.c b/providers/implementations/ciphers/cipher_seed.c
index 397671dd06..397671dd06 100644
--- a/providers/default/ciphers/cipher_seed.c
+++ b/providers/implementations/ciphers/cipher_seed.c
diff --git a/providers/default/ciphers/cipher_seed.h b/providers/implementations/ciphers/cipher_seed.h
index 093cd3bb5d..976af35005 100644
--- a/providers/default/ciphers/cipher_seed.h
+++ b/providers/implementations/ciphers/cipher_seed.h
@@ -8,7 +8,7 @@
  */
 
 #include <openssl/seed.h>
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 
 typedef struct prov_seed_ctx_st {
     PROV_CIPHER_CTX base;      /* Must be first */
diff --git a/providers/default/ciphers/cipher_seed_hw.c b/providers/implementations/ciphers/cipher_seed_hw.c
index 3bd3323dc0..3bd3323dc0 100644
--- a/providers/default/ciphers/cipher_seed_hw.c
+++ b/providers/implementations/ciphers/cipher_seed_hw.c
diff --git a/providers/default/ciphers/cipher_sm4.c b/providers/implementations/ciphers/cipher_sm4.c
index 2c1e587863..2c1e587863 100644
--- a/providers/default/ciphers/cipher_sm4.c
+++ b/providers/implementations/ciphers/cipher_sm4.c
diff --git a/providers/default/ciphers/cipher_sm4.h b/providers/implementations/ciphers/cipher_sm4.h
index 4740bb3355..d5c9633552 100644
--- a/providers/default/ciphers/cipher_sm4.h
+++ b/providers/implementations/ciphers/cipher_sm4.h
@@ -7,7 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/ciphers/ciphercommon.h"
+#include "prov/ciphercommon.h"
 #include "crypto/sm4.h"
 
 typedef struct prov_cast_ctx_st {
diff --git a/providers/default/ciphers/cipher_sm4_hw.c b/providers/implementations/ciphers/cipher_sm4_hw.c
index 9ecaf0b997..9ecaf0b997 100644
--- a/providers/default/ciphers/cipher_sm4_hw.c
+++ b/providers/implementations/ciphers/cipher_sm4_hw.c
diff --git a/providers/common/ciphers/cipher_tdes.c b/providers/implementations/ciphers/cipher_tdes.c
index e5fa16358c..9c032902e9 100644
--- a/providers/common/ciphers/cipher_tdes.c
+++ b/providers/implementations/ciphers/cipher_tdes.c
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_tdes.h"
+#include "prov/ciphercommon.h"
+#include "cipher_tdes.h"
 #include "crypto/rand.h"
 #include "internal/provider_algs.h"
 #include "internal/providercommonerr.h"
diff --git a/providers/common/include/internal/ciphers/cipher_tdes.h b/providers/implementations/ciphers/cipher_tdes.h
index 7bb879fb4f..7bb879fb4f 100644
--- a/providers/common/include/internal/ciphers/cipher_tdes.h
+++ b/providers/implementations/ciphers/cipher_tdes.h
diff --git a/providers/default/ciphers/cipher_tdes_default.c b/providers/implementations/ciphers/cipher_tdes_default.c
index 73a78e8089..73a78e8089 100644
--- a/providers/default/ciphers/cipher_tdes_default.c
+++ b/providers/implementations/ciphers/cipher_tdes_default.c
diff --git a/providers/default/ciphers/cipher_tdes_default.h b/providers/implementations/ciphers/cipher_tdes_default.h
index c809993795..0bc499fc86 100644
--- a/providers/default/ciphers/cipher_tdes_default.h
+++ b/providers/implementations/ciphers/cipher_tdes_default.h
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/ciphers/ciphercommon.h"
-#include "internal/ciphers/cipher_tdes.h"
+#include "prov/ciphercommon.h"
+#include "cipher_tdes.h"
 
 const PROV_CIPHER_HW *PROV_CIPHER_HW_tdes_ede3_ofb(void);
 const PROV_CIPHER_HW *PROV_CIPHER_HW_tdes_ede3_cfb(void);
diff --git a/providers/default/ciphers/cipher_tdes_default_hw.c b/providers/implementations/ciphers/cipher_tdes_default_hw.c
index 73169a0e56..73169a0e56 100644
--- a/providers/default/ciphers/cipher_tdes_default_hw.c
+++ b/providers/implementations/ciphers/cipher_tdes_default_hw.c
diff --git a/providers/common/ciphers/cipher_tdes_hw.c b/providers/implementations/ciphers/cipher_tdes_hw.c
index 10ba5a24da..208e83df0f 100644
--- a/providers/common/ciphers/cipher_tdes_hw.c
+++ b/providers/implementations/ciphers/cipher_tdes_hw.c
@@ -7,8 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "cipher_local.h"
-#include "internal/ciphers/cipher_tdes.h"
+#include "prov/ciphercommon.h"
+#include "cipher_tdes.h"
 
 #define ks1 tks.ks[0]
 #define ks2 tks.ks[1]
diff --git a/providers/default/ciphers/cipher_tdes_wrap.c b/providers/implementations/ciphers/cipher_tdes_wrap.c
index 1ee0044489..1ee0044489 100644
--- a/providers/default/ciphers/cipher_tdes_wrap.c
+++ b/providers/implementations/ciphers/cipher_tdes_wrap.c
diff --git a/providers/default/ciphers/cipher_tdes_wrap_hw.c b/providers/implementations/ciphers/cipher_tdes_wrap_hw.c
index 09155b6f48..09155b6f48 100644
--- a/providers/default/ciphers/cipher_tdes_wrap_hw.c
+++ b/providers/implementations/ciphers/cipher_tdes_wrap_hw.c