crypto: fix Argon2 bypassing FIPS mode

The private OSSL_LIB_CTX used for OSSL_set_max_threads() inherits no
configuration, so Argon2 escaped FIPS mode and --openssl-config.

Check availability against the default context, and create the private
one only when lanes > 1.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64776
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: panva

deps/ncrypto/ncrypto.cc

@@ -2832,15 +2832,24 @@ DataPointer argon2(const Buffer<const char>& pass,
       return {};
   }
 
-  // creates a new library context to avoid locking when running concurrently
-  auto ctx = DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free>{OSSL_LIB_CTX_new()};
-  if (!ctx) {
-    return {};
-  }
+  // A new library context is only needed for OSSL_set_max_threads(), which is
+  // per-context. It inherits no configuration, so availability is checked
+  // against the default context, otherwise Argon2 works in FIPS mode.
+  DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> ctx;
+  if (lanes > 1) {
+    if (!DeleteFnPtr<EVP_KDF, EVP_KDF_free>{
+            EVP_KDF_fetch(nullptr, algorithm.data(), nullptr)}) {
+      return {};
+    }
 
-  // required if threads > 1
-  if (lanes > 1 && OSSL_set_max_threads(ctx.get(), lanes) != 1) {
-    return {};
+    ctx.reset(OSSL_LIB_CTX_new());
+    if (!ctx) {
+      return {};
+    }
+
+    if (OSSL_set_max_threads(ctx.get(), lanes) != 1) {
+      return {};
+    }
   }
 
   auto kdf = DeleteFnPtr<EVP_KDF, EVP_KDF_free>{