* deprecate the constant time bytes comparison path old python 2.7.x uses

* pep8

* Fixed build errors on HP-UX.

* PEP 8 style fix.

* No return for void function.

* PEP 8 style fix, take 2.

Internal block size isn't a particularly useful piece of information and
constructions like SHA3 make it even harder to determine what that
really means. Accordingly, we're removing it from the interface (but
leaving it on all existing hashes)

This removes:

- ERR_get_state which really shouldn't be public API.

- A bunch of functions that are really mostly useful within the library
  to add new errors. NB: I say mostly because they are also useful when
  trying to register a new error library, as osrandom does, but osrandom
  is written in C. Python code is more likely to be consuming errors.

- All function codes but EVP_F_EVP_ENCRYPTFINAL_EX because tests still
  reference it. Per PR #3609, function codes are kind of unstable. This
  finishes that up and cleans up the bindings.

- The "line" versions of querying the error queue, just because no one
  seems to be using them and there's a lot.

- Error-printing functions, which make less sense in Python since you'd
  probably wrap in an exception.

Error codes probably could also do with cleaning, but I've left them
alone for now.

They are unused.

These functions have two purposes. They can be used to pass your own
value of k, or to amoritize the cost of generating k. Messing up k is
catastrophic to ECDSA, so best not to expose that one. ECDSA signing is
also quite fast, so there isn't much point in the latter. (The API comes
from DSA, which is a bit slower.) Moreover, ECDSA_sign is not the same
as ECDSA_sign_setup + ECDSA_sign_ex. OpenSSL has some nonce hardening
features that have to get skipped when doing this.

* Future proofing use of the six python version constants

After reading [1], noticed that cryptography uses a lot of if six.PY3
blocks. The issue with this is that whenever Python 4 is released,
this code in the else block will be executed even though it was
only intended for Python 2.

[1] http://astrofrog.github.io/blog/2016/01/12/stop-writing-python-4-incompatible-code/

Signed-off-by: Eric Brown <browne@vmware.com>

* Use not PY2 instead

RSA_blinding_off is a silly function. RSA_SSLV23_PADDING and
RSA_X931_PADDING are obsolete. The low-level padding functions appear
unused and the EVP_PKEY stuff is probably a bit nicer than expecting
callers to RSA_NO_PADDING and do the padding by hand.

* Validate the public/private halves of EC keys on import.

OpenSSL's API is a little finicky. If one sets the public key before the
private key, it does not validate that they match. If set in the other
order, it does validate this.

In particular, KASValidityTest_ECCStaticUnified_NOKC_ZZOnly_init.fax
describes error code 7 as:

  Result = F (7 - IUT's Static private key d changed-prikey validity)

Reordering the two operations makes those tests to fail on key import,
which is what CAVP appears to have intended.

* Wrap to 79 rather than 80 columns

This is a remnant of the function code checking when this logic looked
at both encrypt/decrypt versions of this error code.

These are unused. (And not especially useful.)