aws-crt 0.1.9 → 0.2.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (581) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +5 -0
  3. data/VERSION +1 -1
  4. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/auth.h +1 -0
  5. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/aws_imds_client.h +5 -0
  6. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/credentials.h +5 -0
  7. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/private/aws_signing.h +1 -0
  8. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/private/credentials_utils.h +2 -0
  9. data/aws-crt-ffi/crt/aws-c-auth/include/aws/auth/signing_config.h +1 -0
  10. data/aws-crt-ffi/crt/aws-c-auth/source/auth.c +3 -1
  11. data/aws-crt-ffi/crt/aws-c-auth/source/aws_imds_client.c +146 -63
  12. data/aws-crt-ffi/crt/aws-c-auth/source/aws_signing.c +41 -19
  13. data/aws-crt-ffi/crt/aws-c-auth/source/credentials_provider_imds.c +1 -0
  14. data/aws-crt-ffi/crt/aws-c-auth/source/credentials_utils.c +1 -0
  15. data/aws-crt-ffi/crt/aws-c-auth/source/signable_http_request.c +2 -1
  16. data/aws-crt-ffi/crt/aws-c-auth/source/signing_config.c +25 -0
  17. data/aws-crt-ffi/crt/aws-c-auth/tests/CMakeLists.txt +3 -0
  18. data/aws-crt-ffi/crt/aws-c-auth/tests/aws_imds_client_test.c +197 -31
  19. data/aws-crt-ffi/crt/aws-c-auth/tests/credentials_provider_imds_tests.c +16 -18
  20. data/aws-crt-ffi/crt/aws-c-auth/tests/sigv4_signing_tests.c +3 -1
  21. data/aws-crt-ffi/crt/aws-c-cal/include/aws/cal/private/opensslcrypto_common.h +22 -0
  22. data/aws-crt-ffi/crt/aws-c-cal/source/darwin/commoncrypto_aes.c +46 -17
  23. data/aws-crt-ffi/crt/aws-c-cal/source/unix/openssl_aes.c +1 -0
  24. data/aws-crt-ffi/crt/aws-c-cal/source/unix/openssl_platform_init.c +7 -0
  25. data/aws-crt-ffi/crt/aws-c-cal/source/unix/openssl_rsa.c +59 -2
  26. data/aws-crt-ffi/crt/aws-c-cal/source/unix/opensslcrypto_ecc.c +1 -0
  27. data/aws-crt-ffi/crt/aws-c-common/CMakeLists.txt +13 -1
  28. data/aws-crt-ffi/crt/aws-c-common/THIRD-PARTY-LICENSES.txt +28 -7
  29. data/aws-crt-ffi/crt/aws-c-common/bin/system_info/CMakeLists.txt +18 -0
  30. data/aws-crt-ffi/crt/aws-c-common/bin/system_info/print_system_info.c +48 -0
  31. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/allocator.h +23 -0
  32. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/byte_buf.h +12 -0
  33. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/cross_process_lock.h +35 -0
  34. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/hash_table.h +1 -0
  35. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/priority_queue.h +24 -0
  36. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/private/system_info_priv.h +37 -0
  37. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/system_info.h +47 -0
  38. data/aws-crt-ffi/crt/aws-c-common/include/aws/common/system_resource_util.h +30 -0
  39. data/aws-crt-ffi/crt/aws-c-common/include/aws/testing/aws_test_harness.h +3 -2
  40. data/aws-crt-ffi/crt/aws-c-common/source/allocator.c +64 -13
  41. data/aws-crt-ffi/crt/aws-c-common/source/android/logging.c +14 -0
  42. data/aws-crt-ffi/crt/aws-c-common/source/common.c +3 -3
  43. data/aws-crt-ffi/crt/aws-c-common/source/file.c +96 -35
  44. data/aws-crt-ffi/crt/aws-c-common/source/linux/system_info.c +24 -0
  45. data/aws-crt-ffi/crt/aws-c-common/source/memtrace.c +10 -3
  46. data/aws-crt-ffi/crt/aws-c-common/source/platform_fallback_stubs/system_info.c +21 -0
  47. data/aws-crt-ffi/crt/aws-c-common/source/posix/cross_process_lock.c +141 -0
  48. data/aws-crt-ffi/crt/aws-c-common/source/posix/system_info.c +1 -1
  49. data/aws-crt-ffi/crt/aws-c-common/source/posix/system_resource_utils.c +32 -0
  50. data/aws-crt-ffi/crt/aws-c-common/source/priority_queue.c +24 -0
  51. data/aws-crt-ffi/crt/aws-c-common/source/system_info.c +80 -0
  52. data/aws-crt-ffi/crt/aws-c-common/source/task_scheduler.c +2 -2
  53. data/aws-crt-ffi/crt/aws-c-common/source/windows/cross_process_lock.c +93 -0
  54. data/aws-crt-ffi/crt/aws-c-common/source/windows/system_resource_utils.c +31 -0
  55. data/aws-crt-ffi/crt/aws-c-common/tests/CMakeLists.txt +16 -0
  56. data/aws-crt-ffi/crt/aws-c-common/tests/alloc_test.c +83 -22
  57. data/aws-crt-ffi/crt/aws-c-common/tests/cross_process_lock_tests.c +116 -0
  58. data/aws-crt-ffi/crt/aws-c-common/tests/file_test.c +103 -0
  59. data/aws-crt-ffi/crt/aws-c-common/tests/priority_queue_test.c +36 -0
  60. data/aws-crt-ffi/crt/aws-c-common/tests/system_info_tests.c +19 -0
  61. data/aws-crt-ffi/crt/aws-c-common/tests/system_resource_util_test.c +37 -0
  62. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/connection.h +9 -0
  63. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/http.h +1 -0
  64. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/private/connection_impl.h +5 -4
  65. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/private/connection_manager_system_vtable.h +10 -18
  66. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/private/proxy_impl.h +5 -1
  67. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/private/request_response_impl.h +5 -0
  68. data/aws-crt-ffi/crt/aws-c-http/include/aws/http/request_response.h +10 -0
  69. data/aws-crt-ffi/crt/aws-c-http/source/connection.c +5 -2
  70. data/aws-crt-ffi/crt/aws-c-http/source/connection_manager.c +22 -21
  71. data/aws-crt-ffi/crt/aws-c-http/source/h1_connection.c +102 -17
  72. data/aws-crt-ffi/crt/aws-c-http/source/h1_stream.c +1 -0
  73. data/aws-crt-ffi/crt/aws-c-http/source/http.c +3 -0
  74. data/aws-crt-ffi/crt/aws-c-http/source/proxy_connection.c +2 -2
  75. data/aws-crt-ffi/crt/aws-c-http/tests/CMakeLists.txt +2 -0
  76. data/aws-crt-ffi/crt/aws-c-http/tests/test_connection_manager.c +18 -18
  77. data/aws-crt-ffi/crt/aws-c-http/tests/test_h1_client.c +111 -1
  78. data/aws-crt-ffi/crt/aws-c-http/tests/test_proxy.c +2 -2
  79. data/aws-crt-ffi/crt/aws-c-http/tests/test_stream_manager.c +2 -2
  80. data/aws-crt-ffi/crt/aws-c-io/include/aws/io/retry_strategy.h +1 -1
  81. data/aws-crt-ffi/crt/aws-c-io/source/exponential_backoff_retry_strategy.c +1 -1
  82. data/aws-crt-ffi/crt/aws-c-io/source/pkcs11_tls_op_handler.c +2 -4
  83. data/aws-crt-ffi/crt/aws-lc/CMakeLists.txt +16 -8
  84. data/aws-crt-ffi/crt/aws-lc/cmake/go.cmake +6 -0
  85. data/aws-crt-ffi/crt/aws-lc/crypto/CMakeLists.txt +6 -9
  86. data/aws-crt-ffi/crt/aws-lc/crypto/asn1/a_time.c +34 -1
  87. data/aws-crt-ffi/crt/aws-lc/crypto/asn1/a_utctm.c +4 -1
  88. data/aws-crt-ffi/crt/aws-lc/crypto/asn1/asn1_test.cc +41 -0
  89. data/aws-crt-ffi/crt/aws-lc/crypto/bio/bio_mem.c +6 -7
  90. data/aws-crt-ffi/crt/aws-lc/crypto/bio/bio_test.cc +152 -16
  91. data/aws-crt-ffi/crt/aws-lc/crypto/bio/connect.c +6 -12
  92. data/aws-crt-ffi/crt/aws-lc/crypto/bio/fd.c +2 -2
  93. data/aws-crt-ffi/crt/aws-lc/crypto/bio/file.c +20 -8
  94. data/aws-crt-ffi/crt/aws-lc/crypto/bio/socket.c +2 -2
  95. data/aws-crt-ffi/crt/aws-lc/crypto/bio/socket_helper.c +2 -2
  96. data/aws-crt-ffi/crt/aws-lc/crypto/blake2/blake2.c +11 -1
  97. data/aws-crt-ffi/crt/aws-lc/crypto/bytestring/cbb.c +13 -3
  98. data/aws-crt-ffi/crt/aws-lc/crypto/bytestring/cbs.c +9 -0
  99. data/aws-crt-ffi/crt/aws-lc/crypto/chacha/asm/chacha-armv8.pl +1 -1
  100. data/aws-crt-ffi/crt/aws-lc/crypto/chacha/chacha.c +49 -8
  101. data/aws-crt-ffi/crt/aws-lc/crypto/chacha/chacha_test.cc +110 -0
  102. data/aws-crt-ffi/crt/aws-lc/crypto/chacha/internal.h +8 -1
  103. data/aws-crt-ffi/crt/aws-lc/crypto/compiler_test.cc +4 -1
  104. data/aws-crt-ffi/crt/aws-lc/crypto/conf/conf_test.cc +1 -0
  105. data/aws-crt-ffi/crt/aws-lc/crypto/crypto_test.cc +9 -0
  106. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/curve25519.c +189 -108
  107. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/curve25519_nohw.c +78 -6
  108. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/ed25519_test.cc +9 -0
  109. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/internal.h +24 -10
  110. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/spake25519.c +4 -4
  111. data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/x25519_test.cc +80 -11
  112. data/aws-crt-ffi/crt/aws-lc/crypto/decrepit/evp/evp_do_all.c +2 -0
  113. data/aws-crt-ffi/crt/aws-lc/crypto/digest_extra/digest_extra.c +8 -0
  114. data/aws-crt-ffi/crt/aws-lc/crypto/digest_extra/digest_test.cc +110 -45
  115. data/aws-crt-ffi/crt/aws-lc/crypto/dsa/dsa_test.cc +8 -2
  116. data/aws-crt-ffi/crt/aws-lc/crypto/dsa/internal.h +18 -0
  117. data/aws-crt-ffi/crt/aws-lc/crypto/dynamic_loading_test.c +8 -5
  118. data/aws-crt-ffi/crt/aws-lc/crypto/ec_extra/ec_derive.c +4 -3
  119. data/aws-crt-ffi/crt/aws-lc/crypto/ec_extra/hash_to_curve.c +6 -18
  120. data/aws-crt-ffi/crt/aws-lc/crypto/endian_test.cc +308 -0
  121. data/aws-crt-ffi/crt/aws-lc/crypto/err/ssl.errordata +2 -0
  122. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_extra_test.cc +2 -0
  123. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_test.cc +11 -1
  124. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/evp_tests.txt +25 -0
  125. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_ec_asn1.c +1 -1
  126. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_kem.c +2 -2
  127. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/p_rsa_asn1.c +1 -0
  128. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/print.c +7 -6
  129. data/aws-crt-ffi/crt/aws-lc/crypto/evp_extra/scrypt.c +13 -1
  130. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/CMakeLists.txt +13 -4
  131. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/aes/aes_nohw.c +18 -6
  132. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bcm.c +12 -4
  133. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/bn_assert_test.cc +77 -0
  134. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/bn_test.cc +30 -0
  135. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/bytes.c +112 -22
  136. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/div.c +12 -5
  137. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/exponentiation.c +54 -1
  138. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/gcd.c +5 -6
  139. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/internal.h +37 -15
  140. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/montgomery.c +4 -11
  141. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/bn/montgomery_inv.c +51 -15
  142. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/cipher/aead.c +2 -2
  143. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/digest.c +29 -6
  144. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/digests.c +89 -0
  145. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/internal.h +4 -0
  146. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec.c +19 -36
  147. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_key.c +3 -3
  148. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_montgomery.c +9 -7
  149. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_test.cc +33 -9
  150. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/internal.h +17 -12
  151. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p224-64.c +5 -8
  152. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p256-nistz.c +8 -8
  153. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p256.c +9 -8
  154. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p384.c +33 -16
  155. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p521.c +14 -6
  156. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/scalar.c +26 -24
  157. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/simple_mul.c +8 -5
  158. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/wnaf.c +3 -3
  159. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ecdsa/ecdsa.c +9 -3
  160. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/evp/evp.c +43 -12
  161. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/evp/p_ec.c +4 -3
  162. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/hmac/hmac.c +3 -1
  163. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/modes/xts.c +26 -3
  164. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rand/cpu_jitter_test.cc +1 -1
  165. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rand/internal.h +20 -11
  166. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rand/rand.c +10 -10
  167. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rand/urandom.c +2 -2
  168. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rsa/internal.h +59 -0
  169. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rsa/padding.c +9 -3
  170. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rsa/rsa.c +7 -0
  171. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/rsa/rsa_impl.c +51 -60
  172. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/service_indicator/service_indicator.c +5 -2
  173. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/service_indicator/service_indicator_test.cc +205 -5
  174. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/asm/sha1-armv8.pl +1 -1
  175. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/asm/sha512-armv8.pl +1 -1
  176. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/internal.h +8 -0
  177. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/sha3.c +37 -15
  178. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/sha3_test.cc +115 -110
  179. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sha/sha512.c +55 -1
  180. data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/sshkdf/sshkdf.c +2 -2
  181. data/aws-crt-ffi/crt/aws-lc/crypto/hmac_extra/hmac_test.cc +12 -0
  182. data/aws-crt-ffi/crt/aws-lc/crypto/hmac_extra/hmac_tests.txt +10 -0
  183. data/aws-crt-ffi/crt/aws-lc/crypto/hrss/asm/poly_rq_mul.S +2 -6
  184. data/aws-crt-ffi/crt/aws-lc/crypto/impl_dispatch_test.cc +9 -1
  185. data/aws-crt-ffi/crt/aws-lc/crypto/internal.h +90 -8
  186. data/aws-crt-ffi/crt/aws-lc/crypto/kem/kem.c +28 -27
  187. data/aws-crt-ffi/crt/aws-lc/crypto/kyber/kem_kyber.h +14 -0
  188. data/aws-crt-ffi/crt/aws-lc/crypto/obj/obj_dat.h +52 -2
  189. data/aws-crt-ffi/crt/aws-lc/crypto/obj/obj_mac.num +5 -0
  190. data/aws-crt-ffi/crt/aws-lc/crypto/obj/objects.txt +7 -0
  191. data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/arm-xlate.pl +3 -14
  192. data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/ppc-xlate.pl +1 -5
  193. data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/x86_64-xlate.pl +4 -15
  194. data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/x86asm.pl +4 -13
  195. data/aws-crt-ffi/crt/aws-lc/crypto/poly1305/poly1305_arm_asm.S +3 -13
  196. data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/deterministic.c +4 -3
  197. data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/fuchsia.c +4 -4
  198. data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/rand_test.cc +0 -63
  199. data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/windows.c +41 -19
  200. data/aws-crt-ffi/crt/aws-lc/crypto/rsa_extra/rsa_test.cc +3 -3
  201. data/aws-crt-ffi/crt/aws-lc/crypto/siphash/siphash.c +12 -5
  202. data/aws-crt-ffi/crt/aws-lc/crypto/siphash/siphash_test.cc +5 -5
  203. data/aws-crt-ffi/crt/aws-lc/crypto/stack/stack.c +68 -46
  204. data/aws-crt-ffi/crt/aws-lc/crypto/trust_token/pmbtoken.c +4 -4
  205. data/aws-crt-ffi/crt/aws-lc/crypto/trust_token/voprf.c +2 -2
  206. data/aws-crt-ffi/crt/aws-lc/crypto/x509/by_dir.c +0 -6
  207. data/aws-crt-ffi/crt/aws-lc/crypto/x509/internal.h +4 -1
  208. data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_lu.c +33 -9
  209. data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_test.cc +87 -0
  210. data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_trs.c +1 -1
  211. data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_vfy.c +35 -13
  212. data/aws-crt-ffi/crt/aws-lc/crypto/x509v3/v3_lib.c +2 -0
  213. data/aws-crt-ffi/crt/aws-lc/crypto/x509v3/v3_purp.c +4 -6
  214. data/aws-crt-ffi/crt/aws-lc/generated-src/crypto_test_data.cc +179 -151
  215. data/aws-crt-ffi/crt/aws-lc/generated-src/err_data.c +353 -349
  216. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/chacha/chacha-armv8.S +4 -14
  217. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S +4 -14
  218. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/aesv8-armx.S +3 -13
  219. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/aesv8-gcm-armv8-unroll8.S +3 -13
  220. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/aesv8-gcm-armv8.S +3 -13
  221. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/armv8-mont.S +4 -14
  222. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/bn-armv8.S +4 -14
  223. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/ghash-neon-armv8.S +4 -14
  224. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/ghashv8-armx.S +3 -13
  225. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/keccak1600-armv8.S +3 -13
  226. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/md5-armv8.S +3 -13
  227. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/p256-armv8-asm.S +4 -14
  228. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S +4 -14
  229. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/sha1-armv8.S +4 -14
  230. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/sha256-armv8.S +4 -14
  231. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/sha512-armv8.S +4 -14
  232. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/fipsmodule/vpaes-armv8.S +3 -13
  233. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-aarch64/crypto/test/trampoline-armv8.S +4 -14
  234. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/chacha/chacha-armv4.S +3 -13
  235. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/aesv8-armx.S +3 -13
  236. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/armv4-mont.S +3 -13
  237. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/bsaes-armv7.S +3 -13
  238. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/ghash-armv4.S +3 -13
  239. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/ghashv8-armx.S +3 -13
  240. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/sha1-armv4-large.S +3 -13
  241. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/sha256-armv4.S +3 -13
  242. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/sha512-armv4.S +3 -13
  243. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/fipsmodule/vpaes-armv7.S +3 -13
  244. data/aws-crt-ffi/crt/aws-lc/generated-src/ios-arm/crypto/test/trampoline-armv4.S +3 -13
  245. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/chacha/chacha-armv8.S +4 -14
  246. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S +4 -14
  247. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/aesv8-armx.S +3 -13
  248. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/aesv8-gcm-armv8-unroll8.S +3 -13
  249. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/aesv8-gcm-armv8.S +3 -13
  250. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/armv8-mont.S +4 -14
  251. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/bn-armv8.S +3 -13
  252. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S +3 -13
  253. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/ghashv8-armx.S +3 -13
  254. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/keccak1600-armv8.S +3 -13
  255. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/md5-armv8.S +3 -13
  256. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S +4 -14
  257. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S +4 -14
  258. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/sha1-armv8.S +4 -14
  259. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/sha256-armv8.S +4 -14
  260. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/sha512-armv8.S +4 -14
  261. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/fipsmodule/vpaes-armv8.S +3 -13
  262. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-aarch64/crypto/test/trampoline-armv8.S +3 -13
  263. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/chacha/chacha-armv4.S +3 -13
  264. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/aesv8-armx.S +3 -13
  265. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/armv4-mont.S +3 -13
  266. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/bsaes-armv7.S +3 -13
  267. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/ghash-armv4.S +3 -13
  268. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/ghashv8-armx.S +3 -13
  269. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/sha1-armv4-large.S +3 -13
  270. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/sha256-armv4.S +3 -13
  271. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/sha512-armv4.S +3 -13
  272. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/fipsmodule/vpaes-armv7.S +3 -13
  273. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-arm/crypto/test/trampoline-armv4.S +3 -13
  274. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-ppc64le/crypto/fipsmodule/aesp8-ppc.S +1 -5
  275. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-ppc64le/crypto/fipsmodule/ghashp8-ppc.S +1 -5
  276. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-ppc64le/crypto/test/trampoline-ppc.S +1 -5
  277. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/chacha/chacha-x86.S +3 -12
  278. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/aesni-x86.S +3 -12
  279. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/bn-586.S +4 -13
  280. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/co-586.S +4 -13
  281. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/ghash-ssse3-x86.S +3 -12
  282. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/ghash-x86.S +3 -12
  283. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/md5-586.S +4 -13
  284. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/sha1-586.S +4 -13
  285. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/sha256-586.S +3 -12
  286. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/sha512-586.S +3 -12
  287. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/vpaes-x86.S +3 -12
  288. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/fipsmodule/x86-mont.S +3 -12
  289. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86/crypto/test/trampoline-x86.S +3 -12
  290. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/chacha/chacha-x86_64.S +2 -11
  291. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S +2 -11
  292. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/cipher_extra/aesni-sha1-x86_64.S +2 -11
  293. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/cipher_extra/aesni-sha256-x86_64.S +2 -11
  294. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S +2 -11
  295. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/aesni-gcm-avx512.S +2 -11
  296. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S +2 -11
  297. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/aesni-x86_64.S +2 -11
  298. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/aesni-xts-avx512.S +2 -11
  299. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.S +2 -11
  300. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/ghash-x86_64.S +2 -11
  301. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/md5-x86_64.S +2 -11
  302. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S +2 -11
  303. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.S +2 -11
  304. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/rdrand-x86_64.S +2 -11
  305. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/rsaz-avx2.S +2 -11
  306. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/sha1-x86_64.S +2 -11
  307. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/sha256-x86_64.S +2 -11
  308. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/sha512-x86_64.S +2 -11
  309. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/vpaes-x86_64.S +2 -11
  310. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/x86_64-mont.S +2 -11
  311. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/fipsmodule/x86_64-mont5.S +2 -11
  312. data/aws-crt-ffi/crt/aws-lc/generated-src/linux-x86_64/crypto/test/trampoline-x86_64.S +2 -11
  313. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/chacha/chacha-x86.S +3 -12
  314. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/aesni-x86.S +3 -12
  315. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/bn-586.S +3 -12
  316. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/co-586.S +3 -12
  317. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/ghash-ssse3-x86.S +3 -12
  318. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/ghash-x86.S +3 -12
  319. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/md5-586.S +3 -12
  320. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/sha1-586.S +3 -12
  321. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/sha256-586.S +3 -12
  322. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/sha512-586.S +3 -12
  323. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/vpaes-x86.S +3 -12
  324. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/fipsmodule/x86-mont.S +3 -12
  325. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86/crypto/test/trampoline-x86.S +3 -12
  326. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/chacha/chacha-x86_64.S +2 -11
  327. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S +2 -11
  328. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/cipher_extra/aesni-sha1-x86_64.S +2 -11
  329. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/cipher_extra/aesni-sha256-x86_64.S +2 -11
  330. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S +2 -11
  331. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/aesni-gcm-avx512.S +2 -11
  332. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S +2 -11
  333. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/aesni-x86_64.S +2 -11
  334. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/aesni-xts-avx512.S +2 -11
  335. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.S +2 -11
  336. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/ghash-x86_64.S +2 -11
  337. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/md5-x86_64.S +2 -11
  338. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/p256-x86_64-asm.S +2 -11
  339. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.S +2 -11
  340. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/rdrand-x86_64.S +2 -11
  341. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/rsaz-avx2.S +2 -11
  342. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/sha1-x86_64.S +2 -11
  343. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/sha256-x86_64.S +2 -11
  344. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/sha512-x86_64.S +2 -11
  345. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/vpaes-x86_64.S +2 -11
  346. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/x86_64-mont.S +2 -11
  347. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/fipsmodule/x86_64-mont5.S +2 -11
  348. data/aws-crt-ffi/crt/aws-lc/generated-src/mac-x86_64/crypto/test/trampoline-x86_64.S +2 -11
  349. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/chacha/chacha-armv8.S +4 -14
  350. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S +4 -14
  351. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/aesv8-armx.S +3 -13
  352. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/aesv8-gcm-armv8-unroll8.S +3 -13
  353. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/aesv8-gcm-armv8.S +3 -13
  354. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/armv8-mont.S +4 -14
  355. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/bn-armv8.S +4 -14
  356. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/ghash-neon-armv8.S +4 -14
  357. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/ghashv8-armx.S +3 -13
  358. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/keccak1600-armv8.S +3 -13
  359. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/md5-armv8.S +3 -13
  360. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/p256-armv8-asm.S +4 -14
  361. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S +4 -14
  362. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/sha1-armv8.S +4 -14
  363. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/sha256-armv8.S +4 -14
  364. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/sha512-armv8.S +4 -14
  365. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/fipsmodule/vpaes-armv8.S +3 -13
  366. data/aws-crt-ffi/crt/aws-lc/generated-src/win-aarch64/crypto/test/trampoline-armv8.S +4 -14
  367. data/aws-crt-ffi/crt/aws-lc/go.mod +4 -4
  368. data/aws-crt-ffi/crt/aws-lc/go.sum +8 -10
  369. data/aws-crt-ffi/crt/aws-lc/include/openssl/aead.h +2 -2
  370. data/aws-crt-ffi/crt/aws-lc/include/openssl/arm_arch.h +4 -119
  371. data/aws-crt-ffi/crt/aws-lc/include/openssl/asm_base.h +185 -0
  372. data/aws-crt-ffi/crt/aws-lc/include/openssl/asn1.h +5 -0
  373. data/aws-crt-ffi/crt/aws-lc/include/openssl/base.h +31 -134
  374. data/aws-crt-ffi/crt/aws-lc/include/openssl/bio.h +30 -18
  375. data/aws-crt-ffi/crt/aws-lc/include/openssl/bn.h +0 -2
  376. data/aws-crt-ffi/crt/aws-lc/include/openssl/chacha.h +6 -0
  377. data/aws-crt-ffi/crt/aws-lc/include/openssl/cipher.h +2 -2
  378. data/aws-crt-ffi/crt/aws-lc/include/openssl/digest.h +9 -6
  379. data/aws-crt-ffi/crt/aws-lc/include/openssl/dsa.h +0 -21
  380. data/aws-crt-ffi/crt/aws-lc/include/openssl/ec.h +1 -1
  381. data/aws-crt-ffi/crt/aws-lc/include/openssl/err.h +1 -1
  382. data/aws-crt-ffi/crt/aws-lc/include/openssl/evp.h +8 -5
  383. data/aws-crt-ffi/crt/aws-lc/include/openssl/nid.h +21 -0
  384. data/aws-crt-ffi/crt/aws-lc/include/openssl/rsa.h +1 -65
  385. data/aws-crt-ffi/crt/aws-lc/include/openssl/sha.h +22 -1
  386. data/aws-crt-ffi/crt/aws-lc/include/openssl/ssl.h +121 -13
  387. data/aws-crt-ffi/crt/aws-lc/include/openssl/stack.h +229 -208
  388. data/aws-crt-ffi/crt/aws-lc/include/openssl/target.h +166 -0
  389. data/aws-crt-ffi/crt/aws-lc/include/openssl/x509.h +30 -10
  390. data/aws-crt-ffi/crt/aws-lc/include/openssl/x509v3.h +6 -4
  391. data/aws-crt-ffi/crt/aws-lc/sources.cmake +2 -0
  392. data/aws-crt-ffi/crt/aws-lc/ssl/extensions.cc +12 -7
  393. data/aws-crt-ffi/crt/aws-lc/ssl/handshake_server.cc +28 -18
  394. data/aws-crt-ffi/crt/aws-lc/ssl/internal.h +41 -6
  395. data/aws-crt-ffi/crt/aws-lc/ssl/s3_both.cc +9 -17
  396. data/aws-crt-ffi/crt/aws-lc/ssl/ssl_cipher.cc +13 -5
  397. data/aws-crt-ffi/crt/aws-lc/ssl/ssl_key_share.cc +542 -2
  398. data/aws-crt-ffi/crt/aws-lc/ssl/ssl_lib.cc +35 -0
  399. data/aws-crt-ffi/crt/aws-lc/ssl/ssl_test.cc +1847 -14
  400. data/aws-crt-ffi/crt/aws-lc/ssl/ssl_x509.cc +128 -0
  401. data/aws-crt-ffi/crt/aws-lc/ssl/test/PORTING.md +10 -7
  402. data/aws-crt-ffi/crt/aws-lc/ssl/test/bssl_shim.cc +133 -77
  403. data/aws-crt-ffi/crt/aws-lc/ssl/test/handshake_util.cc +3 -3
  404. data/aws-crt-ffi/crt/aws-lc/ssl/test/handshaker.cc +4 -0
  405. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/handshake_client.go +6 -2
  406. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/handshake_messages.go +894 -1042
  407. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/handshake_server.go +24 -23
  408. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/prf.go +6 -5
  409. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/runner.go +56 -55
  410. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/shim_dispatcher.go +188 -0
  411. data/aws-crt-ffi/crt/aws-lc/ssl/test/runner/ticket.go +37 -39
  412. data/aws-crt-ffi/crt/aws-lc/ssl/test/test_config.cc +59 -24
  413. data/aws-crt-ffi/crt/aws-lc/ssl/test/test_config.h +3 -2
  414. data/aws-crt-ffi/crt/aws-lc/ssl/tls13_server.cc +10 -11
  415. data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/app.py +4 -4
  416. data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/cdk/{aws_lc_mac_arm_ci_stack.py → aws_lc_ec2_test_framework_ci_stack.py} +13 -29
  417. data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/cdk/ssm/general_test_run_ssm_document.yaml +43 -0
  418. data/aws-crt-ffi/crt/aws-lc/tests/ci/common_posix_setup.sh +10 -0
  419. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-aarch/amazonlinux-2023_base/Dockerfile +5 -1
  420. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-aarch/ubuntu-22.04_base/Dockerfile +19 -3
  421. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/amazonlinux-2_gcc-7x-intel-sde/Dockerfile +5 -4
  422. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/build_images.sh +1 -0
  423. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/push_images.sh +2 -1
  424. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-20.04_clang-10x_formal-verification/create_image.sh +1 -1
  425. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-22.04_base/Dockerfile +1 -0
  426. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-22.04_clang-14x-sde/Dockerfile +42 -0
  427. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/windows/vs2017/Dockerfile +14 -0
  428. data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/windows/windows_base/Dockerfile +3 -0
  429. data/aws-crt-ffi/crt/aws-lc/tests/ci/integration/README.md +12 -0
  430. data/aws-crt-ffi/crt/aws-lc/tests/ci/integration/nginx_patch/aws-lc-nginx.patch +68 -23
  431. data/aws-crt-ffi/crt/aws-lc/tests/ci/integration/run_crt_integration.sh +27 -0
  432. data/aws-crt-ffi/crt/aws-lc/tests/ci/integration/run_monit_integration.sh +56 -0
  433. data/aws-crt-ffi/crt/aws-lc/tests/ci/integration/sslproxy_patch/aws-lc-sslproxy.patch +2 -2
  434. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_ec2_test_framework.sh +135 -0
  435. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_fips_tests.sh +14 -2
  436. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_tests_with_sde.sh +4 -1
  437. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_tests_with_sde_asan.sh +14 -0
  438. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_windows_tests.bat +39 -3
  439. data/aws-crt-ffi/crt/aws-lc/third_party/fiat/README.md +21 -6
  440. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/bignum_madd_n25519.S +284 -0
  441. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/bignum_madd_n25519_alt.S +210 -0
  442. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/bignum_mod_n25519.S +186 -0
  443. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/bignum_neg_p25519.S +65 -0
  444. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519.S +1043 -352
  445. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519_alt.S +1043 -352
  446. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519_byte.S +1043 -352
  447. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519_byte_alt.S +1043 -352
  448. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519base.S +1042 -352
  449. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519base_alt.S +1042 -352
  450. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519base_byte.S +1042 -352
  451. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/curve25519_x25519base_byte_alt.S +1043 -354
  452. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_decode.S +700 -0
  453. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_decode_alt.S +563 -0
  454. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_encode.S +131 -0
  455. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_scalarmulbase.S +9626 -0
  456. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_scalarmulbase_alt.S +9468 -0
  457. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_scalarmuldouble.S +3157 -0
  458. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/curve25519/edwards25519_scalarmuldouble_alt.S +2941 -0
  459. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/p384/Makefile +1 -1
  460. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/arm/p521/Makefile +1 -1
  461. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/include/s2n-bignum_aws-lc.h +34 -0
  462. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/bignum_madd_n25519.S +219 -0
  463. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/bignum_madd_n25519_alt.S +245 -0
  464. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/bignum_mod_n25519.S +228 -0
  465. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/bignum_neg_p25519.S +86 -0
  466. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/curve25519_x25519.S +1350 -407
  467. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/curve25519_x25519_alt.S +1350 -407
  468. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/curve25519_x25519base.S +1344 -400
  469. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/curve25519_x25519base_alt.S +1348 -402
  470. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_decode.S +670 -0
  471. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_decode_alt.S +751 -0
  472. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_encode.S +81 -0
  473. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_scalarmulbase.S +9910 -0
  474. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_scalarmulbase_alt.S +9986 -0
  475. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_scalarmuldouble.S +3619 -0
  476. data/aws-crt-ffi/crt/aws-lc/third_party/s2n-bignum/x86_att/curve25519/edwards25519_scalarmuldouble_alt.S +3736 -0
  477. data/aws-crt-ffi/crt/aws-lc/third_party/wycheproof_testvectors/hmac_sha512_224_test.json +1978 -0
  478. data/aws-crt-ffi/crt/aws-lc/third_party/wycheproof_testvectors/hmac_sha512_224_test.txt +1403 -0
  479. data/aws-crt-ffi/crt/aws-lc/third_party/wycheproof_testvectors/hmac_sha512_256_test.json +1993 -0
  480. data/aws-crt-ffi/crt/aws-lc/third_party/wycheproof_testvectors/hmac_sha512_256_test.txt +1416 -0
  481. data/aws-crt-ffi/crt/aws-lc/tool/digest.cc +4 -0
  482. data/aws-crt-ffi/crt/aws-lc/tool/internal.h +1 -0
  483. data/aws-crt-ffi/crt/aws-lc/tool/speed.cc +53 -6
  484. data/aws-crt-ffi/crt/aws-lc/util/all_tests.go +43 -12
  485. data/aws-crt-ffi/crt/aws-lc/util/all_tests.json +13 -5
  486. data/aws-crt-ffi/crt/aws-lc/util/bot/DEPS +4 -4
  487. data/aws-crt-ffi/crt/aws-lc/util/bot/update_clang.py +8 -2
  488. data/aws-crt-ffi/crt/aws-lc/util/codecov-ci.sh +82 -0
  489. data/aws-crt-ffi/crt/aws-lc/util/convert_wycheproof/convert_wycheproof.go +7 -5
  490. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/ACVP.md +7 -0
  491. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/subprocess/hash.go +24 -9
  492. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/subprocess/rsa.go +3 -4
  493. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/subprocess/subprocess.go +15 -10
  494. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/expected/HMAC-SHA2-512-224.bz2 +0 -0
  495. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/expected/SHA2-512-224.bz2 +0 -0
  496. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/expected/SHAKE-128.bz2 +0 -0
  497. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/expected/SHAKE-256.bz2 +0 -0
  498. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/sha-tests/sha512-224-tests.json +1 -0
  499. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/sha-tests/shake-128-tests.json +1 -0
  500. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/sha-tests/shake-256-tests.json +1 -0
  501. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/tests.json +1 -0
  502. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/vectors/HMAC-SHA2-512-224.bz2 +0 -0
  503. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/vectors/SHA2-512-224.bz2 +0 -0
  504. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/vectors/SHAKE-128.bz2 +0 -0
  505. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/acvptool/test/vectors/SHAKE-256.bz2 +0 -0
  506. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/modulewrapper/main.cc +4 -0
  507. data/aws-crt-ffi/crt/aws-lc/util/fipstools/acvp/modulewrapper/modulewrapper.cc +144 -1
  508. data/aws-crt-ffi/crt/aws-lc/util/fipstools/delocate/delocate.go +9 -3
  509. data/aws-crt-ffi/crt/aws-lc/util/fipstools/delocate/testdata/aarch64-Basic/in.s +4 -0
  510. data/aws-crt-ffi/crt/aws-lc/util/fipstools/delocate/testdata/aarch64-Basic/out.s +11 -0
  511. data/aws-crt-ffi/crt/aws-lc/util/fipstools/inject_hash/inject_hash.go +13 -4
  512. data/aws-crt-ffi/crt/aws-lc/util/fipstools/test-break-kat.sh +2 -0
  513. data/aws-crt-ffi/crt/aws-lc/util/testconfig/testconfig.go +2 -1
  514. data/aws-crt-ffi/crt/s2n/api/s2n.h +9 -5
  515. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/benches/handshake.rs +9 -6
  516. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/benches/resumption.rs +14 -14
  517. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/benches/throughput.rs +9 -6
  518. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/harness.rs +106 -102
  519. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/openssl.rs +24 -20
  520. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/rustls.rs +28 -24
  521. data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/s2n_tls.rs +52 -50
  522. data/aws-crt-ffi/crt/s2n/bindings/rust/generate/Cargo.toml +1 -0
  523. data/aws-crt-ffi/crt/s2n/bindings/rust/integration/Cargo.toml +3 -0
  524. data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls/Cargo.toml +2 -2
  525. data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls/src/connection.rs +9 -0
  526. data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls-sys/templates/Cargo.template +2 -1
  527. data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls-tokio/Cargo.toml +2 -2
  528. data/aws-crt-ffi/crt/s2n/tests/cbmc/sources/make_common_datastructures.c +9 -2
  529. data/aws-crt-ffi/crt/s2n/tests/fuzz/s2n_client_cert_verify_recv_test.c +1 -1
  530. data/aws-crt-ffi/crt/s2n/tests/fuzz/s2n_hybrid_ecdhe_kyber_r3_fuzz_test.c +1 -1
  531. data/aws-crt-ffi/crt/s2n/tests/fuzz/s2n_tls13_cert_verify_recv_test.c +1 -1
  532. data/aws-crt-ffi/crt/s2n/tests/integrationv2/test_version_negotiation.py +4 -4
  533. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_auth_selection_test.c +19 -9
  534. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_client_auth_handshake_test.c +3 -3
  535. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_client_cert_verify_test.c +1 -1
  536. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_client_hello_recv_test.c +1 -1
  537. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_client_hello_test.c +4 -4
  538. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_client_signature_algorithms_extension_test.c +4 -5
  539. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_connection_protocol_versions_test.c +390 -0
  540. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_connection_test.c +8 -4
  541. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_handshake_test.c +2 -1
  542. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_quic_support_io_test.c +106 -0
  543. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_security_policies_test.c +6 -2
  544. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_self_talk_offload_signing_test.c +3 -3
  545. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_self_talk_session_resumption_test.c +135 -0
  546. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_server_new_session_ticket_test.c +32 -0
  547. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_server_signature_algorithms_extension_test.c +1 -1
  548. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_signature_algorithms_test.c +307 -283
  549. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_tls13_cert_request_test.c +1 -1
  550. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_tls13_cert_verify_test.c +18 -17
  551. data/aws-crt-ffi/crt/s2n/tests/unit/s2n_x509_validator_test.c +125 -0
  552. data/aws-crt-ffi/crt/s2n/tls/extensions/s2n_client_signature_algorithms.c +8 -1
  553. data/aws-crt-ffi/crt/s2n/tls/extensions/s2n_client_supported_versions.c +43 -11
  554. data/aws-crt-ffi/crt/s2n/tls/extensions/s2n_client_supported_versions.h +3 -0
  555. data/aws-crt-ffi/crt/s2n/tls/extensions/s2n_server_signature_algorithms.c +8 -1
  556. data/aws-crt-ffi/crt/s2n/tls/s2n_auth_selection.c +4 -2
  557. data/aws-crt-ffi/crt/s2n/tls/s2n_client_cert_verify.c +7 -10
  558. data/aws-crt-ffi/crt/s2n/tls/s2n_client_hello.c +2 -2
  559. data/aws-crt-ffi/crt/s2n/tls/s2n_connection.c +75 -14
  560. data/aws-crt-ffi/crt/s2n/tls/s2n_handshake.h +2 -2
  561. data/aws-crt-ffi/crt/s2n/tls/s2n_post_handshake.c +1 -1
  562. data/aws-crt-ffi/crt/s2n/tls/s2n_post_handshake.h +1 -0
  563. data/aws-crt-ffi/crt/s2n/tls/s2n_quic_support.c +29 -0
  564. data/aws-crt-ffi/crt/s2n/tls/s2n_quic_support.h +5 -0
  565. data/aws-crt-ffi/crt/s2n/tls/s2n_security_policies.c +40 -0
  566. data/aws-crt-ffi/crt/s2n/tls/s2n_security_policies.h +4 -0
  567. data/aws-crt-ffi/crt/s2n/tls/s2n_server_cert_request.c +1 -1
  568. data/aws-crt-ffi/crt/s2n/tls/s2n_server_hello.c +0 -3
  569. data/aws-crt-ffi/crt/s2n/tls/s2n_server_key_exchange.c +8 -9
  570. data/aws-crt-ffi/crt/s2n/tls/s2n_server_new_session_ticket.c +8 -0
  571. data/aws-crt-ffi/crt/s2n/tls/s2n_signature_algorithms.c +111 -72
  572. data/aws-crt-ffi/crt/s2n/tls/s2n_signature_algorithms.h +11 -9
  573. data/aws-crt-ffi/crt/s2n/tls/s2n_signature_scheme.c +9 -0
  574. data/aws-crt-ffi/crt/s2n/tls/s2n_signature_scheme.h +2 -0
  575. data/aws-crt-ffi/crt/s2n/tls/s2n_tls13_certificate_verify.c +12 -18
  576. data/aws-crt-ffi/crt/s2n/tls/s2n_x509_validator.c +7 -7
  577. data/aws-crt-ffi/src/api.h +1 -0
  578. data/lib/aws-crt/native.rb +1 -1
  579. metadata +68 -5
  580. data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/cdk/ssm/m1_tests_ssm_document.yaml +0 -34
  581. data/aws-crt-ffi/crt/aws-lc/tests/ci/run_m1_ec2_instance.sh +0 -96
@@ -31,6 +31,28 @@
31
31
  #include "../internal.h"
32
32
  #include "../fipsmodule/cpucap/internal.h"
33
33
 
34
+ // X25519 [1] and Ed25519 [2] is an ECDHE protocol and signature scheme,
35
+ // respectively. This file contains an implementation of both using two
36
+ // different backends:
37
+ // 1) One backend is a pure C backend that should work on any platform.
38
+ // 2) The other backend is machine-optimized using s2n-bignum [3] as backend.
39
+ //
40
+ // [1]: https://datatracker.ietf.org/doc/html/rfc7748
41
+ // [2]: https://datatracker.ietf.org/doc/html/rfc8032
42
+ // [3]: https://github.com/awslabs/s2n-bignum
43
+ //
44
+ // "Clamping":
45
+ // Both X25519 and Ed25519 contain "clamping" steps; bit-twiddling, masking or
46
+ // setting specific bits. Generally, the bit-twiddling is to avoid common
47
+ // implementation errors and weak instances. Details can be found through the
48
+ // following two references:
49
+ // * https://mailarchive.ietf.org/arch/msg/cfrg/pt2bt3fGQbNF8qdEcorp-rJSJrc/
50
+ // * https://neilmadden.blog/2020/05/28/whats-the-curve25519-clamping-all-about
51
+ //
52
+ // Ed25519 domain and pre-hash functions:
53
+ // For Ed25519, dom2(F,C) is the empty string and PH the identify function,
54
+ // cf. rfc8032 5.1.
55
+
34
56
  // If (1) x86_64 or aarch64, (2) linux or apple, and (3) OPENSSL_NO_ASM is not
35
57
  // set, s2n-bignum path is capable.
36
58
  #if ((defined(OPENSSL_X86_64) && \
@@ -43,7 +65,7 @@
43
65
  #endif
44
66
 
45
67
 
46
- OPENSSL_INLINE int x25519_s2n_bignum_capable(void) {
68
+ OPENSSL_INLINE int curve25519_s2n_bignum_capable(void) {
47
69
  #if defined(CURVE25519_S2N_BIGNUM_CAPABLE)
48
70
  return 1;
49
71
  #else
@@ -51,6 +73,11 @@ OPENSSL_INLINE int x25519_s2n_bignum_capable(void) {
51
73
  #endif
52
74
  }
53
75
 
76
+ // Return 0 until ED25519 lands in s2n-bignum
77
+ OPENSSL_INLINE int ed25519_s2n_bignum_capable(void) {
78
+ return 0;
79
+ }
80
+
54
81
  // Stub functions if implementations are not compiled.
55
82
  // These functions have to abort, otherwise we risk applications assuming they
56
83
  // did work without actually doing anything.
@@ -84,20 +111,20 @@ void curve25519_x25519base_byte_alt(uint8_t res[32], const uint8_t scalar[32]) {
84
111
 
85
112
  // Run-time detection for each implementation
86
113
 
87
- OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void);
88
- OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void);
114
+ OPENSSL_INLINE int curve25519_s2n_bignum_alt_capable(void);
115
+ OPENSSL_INLINE int curve25519_s2n_bignum_no_alt_capable(void);
89
116
 
90
- // For aarch64, |x25519_s2n_bignum_alt_capable| returns 1 if we categorize the
91
- // CPU as a CPU having a wide multiplier (i.e. "higher" throughput). CPUs with
92
- // this feature are e.g.: AWS Graviton 3 and Apple M1. Return 0 otherwise, so we
93
- // don't match CPUs without wide multipliers.
117
+ // For aarch64, |curve25519_s2n_bignum_alt_capable| returns 1 if we categorize
118
+ // the CPU as a CPU having a wide multiplier (i.e. "higher" throughput). CPUs
119
+ // with this feature are e.g.: AWS Graviton 3 and Apple M1. Return 0 otherwise,
120
+ // so we don't match CPUs without wide multipliers.
94
121
  //
95
- // For x86_64, |x25519_s2n_bignum_alt_capable| always returns 1. If x25519
122
+ // For x86_64, |curve25519_s2n_bignum_alt_capable| always returns 1. If x25519
96
123
  // s2n-bignum capable, the x86_64 s2n-bignum-alt version should be supported on
97
124
  // pretty much any x86_64 CPU.
98
125
  //
99
126
  // For all other architectures, return 0.
100
- OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void) {
127
+ OPENSSL_INLINE int curve25519_s2n_bignum_alt_capable(void) {
101
128
  #if defined(OPENSSL_X86_64)
102
129
  return 1;
103
130
  #elif defined(OPENSSL_AARCH64)
@@ -111,15 +138,15 @@ OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void) {
111
138
  #endif
112
139
  }
113
140
 
114
- // For aarch64, |x25519_s2n_bignum_no_alt_capable| always returns 1. If x25519
115
- // s2n-bignum capable, the Armv8 s2n-bignum-alt version should be supported on
116
- // pretty much any Armv8 CPU.
141
+ // For aarch64, |curve25519_s2n_bignum_no_alt_capable| always returns 1. If
142
+ // x25519 s2n-bignum capable, the Armv8 s2n-bignum-alt version should be
143
+ // supported on pretty much any Armv8 CPU.
117
144
  //
118
- // For x86_64, |x25519_s2n_bignum_alt_capable| returns 1 if we detect support
119
- // for bmi+adx instruction sets. Return 0 otherwise.
145
+ // For x86_64, |curve25519_s2n_bignum_alt_capable| returns 1 if we detect
146
+ // support for bmi+adx instruction sets. Return 0 otherwise.
120
147
  //
121
148
  // For all other architectures, return 0.
122
- OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void) {
149
+ OPENSSL_INLINE int curve25519_s2n_bignum_no_alt_capable(void) {
123
150
  #if defined(OPENSSL_X86_64)
124
151
  if (CRYPTO_is_BMI2_capable() == 1 && CRYPTO_is_ADX_capable() == 1) {
125
152
  return 1;
@@ -152,9 +179,9 @@ OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void) {
152
179
  // prefer s2n-bignum-no-alt over s2n-bignum-alt if the former is supported.
153
180
  // For aarch64: if a wide multiplier is supported, we prefer s2n-bignum-alt over
154
181
  // s2n-bignum-no-alt if the former is supported.
155
- // x25519_s2n_bignum_alt_capable() specifically looks to match CPUs that have
156
- // wide multipliers. this ensures that s2n-bignum-alt will only be used on
157
- // such CPUs.
182
+ // |curve25519_s2n_bignum_alt_capable| specifically looks to match CPUs that
183
+ // have wide multipliers. this ensures that s2n-bignum-alt will only be used
184
+ // on such CPUs.
158
185
 
159
186
  static void x25519_s2n_bignum(uint8_t out_shared_key[32],
160
187
  const uint8_t private_key[32], const uint8_t peer_public_value[32]) {
@@ -167,10 +194,10 @@ static void x25519_s2n_bignum(uint8_t out_shared_key[32],
167
194
 
168
195
  #if defined(OPENSSL_X86_64)
169
196
 
170
- if (x25519_s2n_bignum_no_alt_capable() == 1) {
197
+ if (curve25519_s2n_bignum_no_alt_capable() == 1) {
171
198
  curve25519_x25519_byte(out_shared_key, private_key_internal_demask,
172
199
  peer_public_value);
173
- } else if (x25519_s2n_bignum_alt_capable() == 1) {
200
+ } else if (curve25519_s2n_bignum_alt_capable() == 1) {
174
201
  curve25519_x25519_byte_alt(out_shared_key, private_key_internal_demask,
175
202
  peer_public_value);
176
203
  } else {
@@ -179,10 +206,10 @@ static void x25519_s2n_bignum(uint8_t out_shared_key[32],
179
206
 
180
207
  #elif defined(OPENSSL_AARCH64)
181
208
 
182
- if (x25519_s2n_bignum_alt_capable() == 1) {
209
+ if (curve25519_s2n_bignum_alt_capable() == 1) {
183
210
  curve25519_x25519_byte_alt(out_shared_key, private_key_internal_demask,
184
211
  peer_public_value);
185
- } else if (x25519_s2n_bignum_no_alt_capable() == 1) {
212
+ } else if (curve25519_s2n_bignum_no_alt_capable() == 1) {
186
213
  curve25519_x25519_byte(out_shared_key, private_key_internal_demask,
187
214
  peer_public_value);
188
215
  } else {
@@ -208,9 +235,9 @@ static void x25519_s2n_bignum_public_from_private(
208
235
 
209
236
  #if defined(OPENSSL_X86_64)
210
237
 
211
- if (x25519_s2n_bignum_no_alt_capable() == 1) {
238
+ if (curve25519_s2n_bignum_no_alt_capable() == 1) {
212
239
  curve25519_x25519base_byte(out_public_value, private_key_internal_demask);
213
- } else if (x25519_s2n_bignum_alt_capable() == 1) {
240
+ } else if (curve25519_s2n_bignum_alt_capable() == 1) {
214
241
  curve25519_x25519base_byte_alt(out_public_value, private_key_internal_demask);
215
242
  } else {
216
243
  abort();
@@ -218,9 +245,9 @@ static void x25519_s2n_bignum_public_from_private(
218
245
 
219
246
  #elif defined(OPENSSL_AARCH64)
220
247
 
221
- if (x25519_s2n_bignum_alt_capable() == 1) {
248
+ if (curve25519_s2n_bignum_alt_capable() == 1) {
222
249
  curve25519_x25519base_byte_alt(out_public_value, private_key_internal_demask);
223
- } else if (x25519_s2n_bignum_no_alt_capable() == 1) {
250
+ } else if (curve25519_s2n_bignum_no_alt_capable() == 1) {
224
251
  curve25519_x25519base_byte(out_public_value, private_key_internal_demask);
225
252
  } else {
226
253
  abort();
@@ -234,96 +261,152 @@ static void x25519_s2n_bignum_public_from_private(
234
261
  #endif
235
262
  }
236
263
 
264
+ // Stub function until ED25519 lands in s2n-bignum
265
+ static void ed25519_public_key_from_hashed_seed_s2n_bignum(
266
+ uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
267
+ uint8_t az[SHA512_DIGEST_LENGTH]) {
268
+ abort();
269
+ }
270
+
271
+ // Stub function until Ed25519 lands in s2n-bignum
272
+ // |s| is of length |ED25519_PRIVATE_KEY_SEED_LEN|
273
+ // |A| is of length |ED25519_PUBLIC_KEY_LEN|.
274
+ static void ed25519_sign_s2n_bignum(
275
+ uint8_t out_sig[ED25519_SIGNATURE_LEN],
276
+ uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
277
+ const void *message, size_t message_len) {
278
+ abort();
279
+ }
280
+
281
+ static int ed25519_verify_s2n_bignum(uint8_t R_computed_encoded[32],
282
+ const uint8_t public_key[32], uint8_t R_expected[32],
283
+ uint8_t S[32], const uint8_t *message, size_t message_len) {
284
+ abort();
285
+ }
286
+
287
+ void ed25519_sha512(uint8_t out[SHA512_DIGEST_LENGTH],
288
+ const void *input1, size_t len1, const void *input2, size_t len2,
289
+ const void *input3, size_t len3) {
290
+
291
+ SHA512_CTX hash_ctx;
292
+ SHA512_Init(&hash_ctx);
293
+ SHA512_Update(&hash_ctx, input1, len1);
294
+ SHA512_Update(&hash_ctx, input2, len2);
295
+ if (len3 != 0) {
296
+ SHA512_Update(&hash_ctx, input3, len3);
297
+ }
298
+ SHA512_Final(out, &hash_ctx);
299
+ }
300
+
301
+ void ED25519_keypair_from_seed(uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
302
+ uint8_t out_private_key[ED25519_PRIVATE_KEY_LEN],
303
+ const uint8_t seed[ED25519_SEED_LEN]) {
237
304
 
238
- void ED25519_keypair_from_seed(uint8_t out_public_key[32],
239
- uint8_t out_private_key[64],
240
- const uint8_t seed[ED25519_SEED_LEN]) {
305
+ // Step: rfc8032 5.1.5.1
306
+ // Compute SHA512(seed).
241
307
  uint8_t az[SHA512_DIGEST_LENGTH];
242
308
  SHA512(seed, ED25519_SEED_LEN, az);
243
309
 
244
- az[0] &= 248;
245
- az[31] &= 127;
246
- az[31] |= 64;
310
+ // Step: rfc8032 5.1.5.2
311
+ az[0] &= 248; // 11111000_2
312
+ az[31] &= 127; // 01111111_2
313
+ az[31] |= 64; // 01000000_2
247
314
 
248
- ge_p3 A;
249
- x25519_ge_scalarmult_base(&A, az);
250
- ge_p3_tobytes(out_public_key, &A);
315
+ // Step: rfc8032 5.1.5.[3,4]
316
+ // Compute [az]B and encode public key to a 32 byte octet.
317
+ if (ed25519_s2n_bignum_capable() == 1) {
318
+ ed25519_public_key_from_hashed_seed_s2n_bignum(out_public_key, az);
319
+ } else {
320
+ ed25519_public_key_from_hashed_seed_nohw(out_public_key, az);
321
+ }
251
322
 
323
+ // Encoded public key is a suffix in the private key. Avoids having to
324
+ // generate the public key from the private key when signing.
325
+ OPENSSL_STATIC_ASSERT(ED25519_PRIVATE_KEY_LEN == (ED25519_SEED_LEN + ED25519_PUBLIC_KEY_LEN), ed25519_parameter_length_mismatch)
252
326
  OPENSSL_memcpy(out_private_key, seed, ED25519_SEED_LEN);
253
- OPENSSL_memcpy(out_private_key + ED25519_SEED_LEN, out_public_key, 32);
327
+ OPENSSL_memcpy(out_private_key + ED25519_SEED_LEN, out_public_key,
328
+ ED25519_PUBLIC_KEY_LEN);
254
329
  }
255
330
 
256
- void ED25519_keypair(uint8_t out_public_key[32], uint8_t out_private_key[64]) {
331
+ void ED25519_keypair(uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
332
+ uint8_t out_private_key[ED25519_PRIVATE_KEY_LEN]) {
333
+
334
+ // Ed25519 key generation: rfc8032 5.1.5
335
+ // Private key is 32 octets of random data.
257
336
  uint8_t seed[ED25519_SEED_LEN];
258
337
  RAND_bytes(seed, ED25519_SEED_LEN);
338
+
339
+ // Public key generation is handled in a separate function. See function
340
+ // description why this is useful.
259
341
  ED25519_keypair_from_seed(out_public_key, out_private_key, seed);
260
342
  OPENSSL_cleanse(seed, ED25519_SEED_LEN);
261
343
  }
262
344
 
263
- int ED25519_sign(uint8_t out_sig[64], const uint8_t *message,
264
- size_t message_len, const uint8_t private_key[64]) {
345
+ int ED25519_sign(uint8_t out_sig[ED25519_SIGNATURE_LEN],
346
+ const uint8_t *message, size_t message_len,
347
+ const uint8_t private_key[ED25519_PRIVATE_KEY_LEN]) {
265
348
  // NOTE: The documentation on this function says that it returns zero on
266
349
  // allocation failure. While that can't happen with the current
267
350
  // implementation, we want to reserve the ability to allocate in this
268
351
  // implementation in the future.
269
352
 
353
+ // Ed25519 sign: rfc8032 5.1.6
354
+ //
355
+ // Step: rfc8032 5.1.6.1
356
+ // This step is a repeat of rfc8032 5.1.5.[1,2].
357
+ // seed = private_key[0:31]
358
+ // A = private_key[32:61] (per 5.1.5.4)
359
+ // Compute az = SHA512(seed).
270
360
  uint8_t az[SHA512_DIGEST_LENGTH];
271
- SHA512(private_key, 32, az);
272
-
273
- az[0] &= 248;
274
- az[31] &= 63;
275
- az[31] |= 64;
276
-
277
- SHA512_CTX hash_ctx;
278
- SHA512_Init(&hash_ctx);
279
- SHA512_Update(&hash_ctx, az + 32, 32);
280
- SHA512_Update(&hash_ctx, message, message_len);
281
- uint8_t nonce[SHA512_DIGEST_LENGTH];
282
- SHA512_Final(nonce, &hash_ctx);
283
-
284
- x25519_sc_reduce(nonce);
285
- ge_p3 R;
286
- x25519_ge_scalarmult_base(&R, nonce);
287
- ge_p3_tobytes(out_sig, &R);
288
-
289
- SHA512_Init(&hash_ctx);
290
- SHA512_Update(&hash_ctx, out_sig, 32);
291
- SHA512_Update(&hash_ctx, private_key + 32, 32);
292
- SHA512_Update(&hash_ctx, message, message_len);
293
- uint8_t hram[SHA512_DIGEST_LENGTH];
294
- SHA512_Final(hram, &hash_ctx);
295
-
296
- x25519_sc_reduce(hram);
297
- sc_muladd(out_sig + 32, hram, az, nonce);
361
+ SHA512(private_key, ED25519_PRIVATE_KEY_SEED_LEN, az);
362
+ // s = az[0:31]
363
+ // prefix = az[32:61]
364
+ az[0] &= 248; // 11111000_2
365
+ az[31] &= 63; // 00111111_2
366
+ az[31] |= 64; // 01000000_2
367
+
368
+ // Step: rfc8032 5.1.6.2
369
+ // Compute r = SHA512(prefix || message).
370
+ uint8_t r[SHA512_DIGEST_LENGTH];
371
+ ed25519_sha512(r, az + ED25519_PRIVATE_KEY_SEED_LEN,
372
+ ED25519_PRIVATE_KEY_SEED_LEN, message, message_len, NULL, 0);
373
+
374
+ // Step: rfc8032 5.1.6.[3,5,6,7]
375
+ if (ed25519_s2n_bignum_capable() == 1) {
376
+ ed25519_sign_s2n_bignum(out_sig, r, az,
377
+ private_key + ED25519_PRIVATE_KEY_SEED_LEN, message, message_len);
378
+ } else {
379
+ ed25519_sign_nohw(out_sig, r, az,
380
+ private_key + ED25519_PRIVATE_KEY_SEED_LEN, message, message_len);
381
+ }
298
382
 
299
383
  return 1;
300
384
  }
301
385
 
302
386
  int ED25519_verify(const uint8_t *message, size_t message_len,
303
- const uint8_t signature[64], const uint8_t public_key[32]) {
304
- ge_p3 A;
305
- if ((signature[63] & 224) != 0 ||
306
- !x25519_ge_frombytes_vartime(&A, public_key)) {
387
+ const uint8_t signature[ED25519_SIGNATURE_LEN],
388
+ const uint8_t public_key[ED25519_PUBLIC_KEY_LEN]) {
389
+
390
+ // Ed25519 verify: rfc8032 5.1.7
391
+
392
+ // Step: rfc8032 5.1.7.1 (up to decoding the public key)
393
+ // Decode signature as:
394
+ // - signature[0:31]: encoded point R, aliased to R_expected.
395
+ // - signature[32:61]: integer S.
396
+ uint8_t R_expected[32];
397
+ OPENSSL_memcpy(R_expected, signature, 32);
398
+ uint8_t S[32];
399
+ OPENSSL_memcpy(S, signature + 32, 32);
400
+
401
+ // Per rfc8032 5.1.6.6
402
+ // "the three most significant bits of the final octet are always zero"
403
+ // 224 = 11100000_2
404
+ if ((signature[63] & 224) != 0) {
307
405
  return 0;
308
406
  }
309
407
 
310
- fe_loose t;
311
- fe_neg(&t, &A.X);
312
- fe_carry(&A.X, &t);
313
- fe_neg(&t, &A.T);
314
- fe_carry(&A.T, &t);
315
-
316
- uint8_t pkcopy[32];
317
- OPENSSL_memcpy(pkcopy, public_key, 32);
318
- uint8_t rcopy[32];
319
- OPENSSL_memcpy(rcopy, signature, 32);
320
- uint8_t scopy[32];
321
- OPENSSL_memcpy(scopy, signature + 32, 32);
322
-
323
- // https://tools.ietf.org/html/rfc8032#section-5.1.7 requires that s be in
324
- // the range [0, order) in order to prevent signature malleability.
325
-
326
- // kOrder is the order of Curve25519 in little-endian form.
408
+ // S must be in the range [0, order) in order to prevent signature
409
+ // malleability. kOrder is the order of curve25519 in little-endian form.
327
410
  static const uint64_t kOrder[4] = {
328
411
  UINT64_C(0x5812631a5cf5d3ed),
329
412
  UINT64_C(0x14def9dea2f79cd6),
@@ -331,7 +414,7 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
331
414
  UINT64_C(0x1000000000000000),
332
415
  };
333
416
  for (size_t i = 3;; i--) {
334
- uint64_t word = CRYPTO_load_u64_le(scopy + i * 8);
417
+ uint64_t word = CRYPTO_load_u64_le(S + i * 8);
335
418
  if (word > kOrder[i]) {
336
419
  return 0;
337
420
  } else if (word < kOrder[i]) {
@@ -341,30 +424,28 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
341
424
  }
342
425
  }
343
426
 
344
- SHA512_CTX hash_ctx;
345
- SHA512_Init(&hash_ctx);
346
- SHA512_Update(&hash_ctx, signature, 32);
347
- SHA512_Update(&hash_ctx, public_key, 32);
348
- SHA512_Update(&hash_ctx, message, message_len);
349
- uint8_t h[SHA512_DIGEST_LENGTH];
350
- SHA512_Final(h, &hash_ctx);
351
-
352
- x25519_sc_reduce(h);
353
-
354
- ge_p2 R;
355
- ge_double_scalarmult_vartime(&R, h, &A, scopy);
356
-
357
- uint8_t rcheck[32];
358
- x25519_ge_tobytes(rcheck, &R);
427
+ // Step: rfc8032 5.1.7.[1,2,3]
428
+ // Verification works by computing [S]B - [k]A' and comparing against R_expected.
429
+ int res = 0;
430
+ uint8_t R_computed_encoded[32];
431
+ if (ed25519_s2n_bignum_capable() == 1) {
432
+ res = ed25519_verify_s2n_bignum(R_computed_encoded, public_key, R_expected, S,
433
+ message, message_len);
434
+ } else {
435
+ res = ed25519_verify_nohw(R_computed_encoded, public_key, R_expected, S,
436
+ message, message_len);
437
+ }
359
438
 
360
- return CRYPTO_memcmp(rcheck, rcopy, sizeof(rcheck)) == 0;
439
+ // Comparison [S]B - [k]A' =? R_expected. Short-circuits if decoding failed.
440
+ return (res == 1) &&
441
+ CRYPTO_memcmp(R_computed_encoded, R_expected, sizeof(R_computed_encoded)) == 0;
361
442
  }
362
443
 
363
444
 
364
445
  void X25519_public_from_private(uint8_t out_public_value[32],
365
446
  const uint8_t private_key[32]) {
366
447
 
367
- if (x25519_s2n_bignum_capable() == 1) {
448
+ if (curve25519_s2n_bignum_capable() == 1) {
368
449
  x25519_s2n_bignum_public_from_private(out_public_value, private_key);
369
450
  } else {
370
451
  x25519_public_from_private_nohw(out_public_value, private_key);
@@ -399,13 +480,13 @@ int X25519(uint8_t out_shared_key[32], const uint8_t private_key[32],
399
480
 
400
481
  static const uint8_t kZeros[32] = {0};
401
482
 
402
- if (x25519_s2n_bignum_capable() == 1) {
483
+ if (curve25519_s2n_bignum_capable() == 1) {
403
484
  x25519_s2n_bignum(out_shared_key, private_key, peer_public_value);
404
485
  } else {
405
486
  x25519_scalar_mult_generic_nohw(out_shared_key, private_key, peer_public_value);
406
487
  }
407
488
 
408
489
  // The all-zero output results when the input is a point of small order.
409
- // See https://www.rfc-editor.org/rfc/rfc7748#section-6.1.
410
- return CRYPTO_memcmp(kZeros, out_shared_key, 32) != 0;
490
+ return constant_time_declassify_int(
491
+ CRYPTO_memcmp(kZeros, out_shared_key, 32)) != 0;
411
492
  }
@@ -201,7 +201,7 @@ static void fe_sub(fe_loose *h, const fe *f, const fe *g) {
201
201
  assert_fe_loose(h->v);
202
202
  }
203
203
 
204
- void fe_carry(fe *h, const fe_loose* f) {
204
+ static void fe_carry(fe *h, const fe_loose* f) {
205
205
  assert_fe_loose(f->v);
206
206
  fiat_25519_carry(h->v, f->v);
207
207
  assert_fe(h->v);
@@ -273,7 +273,7 @@ static void fe_mul121666(fe *h, const fe_loose *f) {
273
273
  }
274
274
 
275
275
  // h = -f
276
- void fe_neg(fe_loose *h, const fe *f) {
276
+ static void fe_neg(fe_loose *h, const fe *f) {
277
277
  assert_fe(f->v);
278
278
  fiat_25519_opp(h->v, f->v);
279
279
  assert_fe_loose(h->v);
@@ -481,7 +481,7 @@ void x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h) {
481
481
  s[31] ^= fe_isnegative(&x) << 7;
482
482
  }
483
483
 
484
- void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
484
+ static void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
485
485
  fe recip;
486
486
  fe x;
487
487
  fe y;
@@ -956,7 +956,7 @@ static void slide(signed char *r, const uint8_t *a) {
956
956
  // where a = a[0]+256*a[1]+...+256^31 a[31].
957
957
  // and b = b[0]+256*b[1]+...+256^31 b[31].
958
958
  // B is the Ed25519 base point (x,4/5) with x positive.
959
- void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
959
+ static void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
960
960
  const ge_p3 *A, const uint8_t *b) {
961
961
  signed char aslide[256];
962
962
  signed char bslide[256];
@@ -1382,7 +1382,7 @@ void x25519_sc_reduce(uint8_t s[64]) {
1382
1382
  // Output:
1383
1383
  // s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
1384
1384
  // where l = 2^252 + 27742317777372353535851937790883648493.
1385
- void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
1385
+ static void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
1386
1386
  const uint8_t *c) {
1387
1387
  int64_t a0 = 2097151 & load_3(a);
1388
1388
  int64_t a1 = 2097151 & (load_4(a + 2) >> 5);
@@ -1946,7 +1946,7 @@ void x25519_scalar_mult_generic_nohw(uint8_t out[32],
1946
1946
  }
1947
1947
 
1948
1948
  void x25519_public_from_private_nohw(uint8_t out_public_value[32],
1949
- const uint8_t private_key[32]) {
1949
+ const uint8_t private_key[32]) {
1950
1950
 
1951
1951
  uint8_t e[32];
1952
1952
  OPENSSL_memcpy(e, private_key, 32);
@@ -1966,4 +1966,76 @@ void x25519_public_from_private_nohw(uint8_t out_public_value[32],
1966
1966
  fe_loose_invert(&zminusy_inv, &zminusy);
1967
1967
  fe_mul_tlt(&zminusy_inv, &zplusy, &zminusy_inv);
1968
1968
  fe_tobytes(out_public_value, &zminusy_inv);
1969
+ CONSTTIME_DECLASSIFY(out_public_value, 32);
1970
+ }
1971
+
1972
+ void ed25519_public_key_from_hashed_seed_nohw(uint8_t out_public_key[32],
1973
+ uint8_t az[SHA512_DIGEST_LENGTH]) {
1974
+ ge_p3 A;
1975
+ x25519_ge_scalarmult_base(&A, az);
1976
+ ge_p3_tobytes(out_public_key, &A);
1977
+ }
1978
+
1979
+ void ed25519_sign_nohw(
1980
+ uint8_t out_sig[ED25519_SIGNATURE_LEN],
1981
+ uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
1982
+ const void *message, size_t message_len) {
1983
+
1984
+ // Reduce r modulo the order of the base-point B.
1985
+ x25519_sc_reduce(r);
1986
+ ge_p3 R;
1987
+ // Compute [r]B.
1988
+ x25519_ge_scalarmult_base(&R, r);
1989
+ ge_p3_tobytes(out_sig, &R);
1990
+
1991
+ // Compute k = SHA512(R || A || message)
1992
+ // R is of length 32 octets
1993
+ uint8_t k[SHA512_DIGEST_LENGTH];
1994
+ ed25519_sha512(k, out_sig, 32, A, ED25519_PUBLIC_KEY_LEN, message, message_len);
1995
+
1996
+ // Reduce k modulo the order of the base-point B.
1997
+ x25519_sc_reduce(k);
1998
+ // Compute S = r + k * s modulo the order of the base-point B.
1999
+ // out_sig = R || S
2000
+ sc_muladd(out_sig + 32, k, s, r);
2001
+ }
2002
+
2003
+ int ed25519_verify_nohw(uint8_t R_computed_encoded[32],
2004
+ const uint8_t public_key[ED25519_PUBLIC_KEY_LEN], uint8_t R_expected[32],
2005
+ uint8_t S[32], const uint8_t *message, size_t message_len) {
2006
+
2007
+ // Decode public key as A'.
2008
+ ge_p3 A;
2009
+ if (!x25519_ge_frombytes_vartime(&A, public_key)) {
2010
+ return 0;
2011
+ }
2012
+
2013
+ // Step: rfc8032 5.1.7.2
2014
+ // Compute k = SHA512(R_expected || public_key || message).
2015
+ uint8_t k[SHA512_DIGEST_LENGTH];
2016
+ ed25519_sha512(k, R_expected, 32, public_key, ED25519_PUBLIC_KEY_LEN, message,
2017
+ message_len);
2018
+
2019
+ // Reduce k modulo the order of the base-point B. Saves compute in the
2020
+ // subsequent scalar multiplication.
2021
+ x25519_sc_reduce(k);
2022
+
2023
+ // Step: rfc8032 5.1.7.3
2024
+ // Recall, we must compute [S]B - [k]A'.
2025
+ // First negate A'. Point negation for the twisted edwards curve when points
2026
+ // are represented in the extended coordinate system is simply:
2027
+ // -(X,Y,Z,T) = (-X,Y,Z,-T).
2028
+ // See "Twisted Edwards curves revisited" https://ia.cr/2008/522.
2029
+ fe_loose t;
2030
+ fe_neg(&t, &A.X);
2031
+ fe_carry(&A.X, &t);
2032
+ fe_neg(&t, &A.T);
2033
+ fe_carry(&A.T, &t);
2034
+
2035
+ // Compute R_have <- [S]B - [k]A'.
2036
+ ge_p2 R_computed;
2037
+ ge_double_scalarmult_vartime(&R_computed, k, &A, S);
2038
+ x25519_ge_tobytes(R_computed_encoded, &R_computed);
2039
+
2040
+ return 1;
1969
2041
  }
@@ -35,9 +35,15 @@ TEST(Ed25519Test, TestVectors) {
35
35
  ASSERT_TRUE(t->GetBytes(&expected_signature, "SIG"));
36
36
  ASSERT_EQ(64u, expected_signature.size());
37
37
 
38
+ // Signing should not leak the private key or the message.
39
+ CONSTTIME_SECRET(private_key.data(), private_key.size());
40
+ CONSTTIME_SECRET(message.data(), message.size());
38
41
  uint8_t signature[64];
39
42
  ASSERT_TRUE(ED25519_sign(signature, message.data(), message.size(),
40
43
  private_key.data()));
44
+ CONSTTIME_DECLASSIFY(signature, sizeof(signature));
45
+ CONSTTIME_DECLASSIFY(message.data(), message.size());
46
+
41
47
  EXPECT_EQ(Bytes(expected_signature), Bytes(signature));
42
48
  EXPECT_TRUE(ED25519_verify(message.data(), message.size(), signature,
43
49
  public_key.data()));
@@ -114,9 +120,12 @@ TEST(Ed25519Test, KeypairFromSeed) {
114
120
 
115
121
  uint8_t seed[32];
116
122
  OPENSSL_memcpy(seed, private_key1, sizeof(seed));
123
+ CONSTTIME_SECRET(seed, sizeof(seed));
117
124
 
118
125
  uint8_t public_key2[32], private_key2[64];
119
126
  ED25519_keypair_from_seed(public_key2, private_key2, seed);
127
+ CONSTTIME_DECLASSIFY(public_key2, sizeof(public_key2));
128
+ CONSTTIME_DECLASSIFY(private_key2, sizeof(private_key2));
120
129
 
121
130
  EXPECT_EQ(Bytes(public_key1), Bytes(public_key2));
122
131
  EXPECT_EQ(Bytes(private_key1), Bytes(private_key2));
@@ -20,6 +20,7 @@ extern "C" {
20
20
  #endif
21
21
 
22
22
  #include <openssl/base.h>
23
+ #include <openssl/curve25519.h>
23
24
 
24
25
  #include "../internal.h"
25
26
 
@@ -114,16 +115,29 @@ void x25519_scalar_mult_generic_nohw(uint8_t out[32],
114
115
  const uint8_t point[32]);
115
116
  void x25519_public_from_private_nohw(uint8_t out_public_value[32],
116
117
  const uint8_t private_key[32]);
117
-
118
- // Port to internal linkage in curve25519_nohw.c when adding implementation
119
- // from s2n-bignum ed25519
120
- void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h);
121
- void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
122
- const uint8_t *c);
123
- void fe_neg(fe_loose *h, const fe *f);
124
- void fe_carry(fe *h, const fe_loose* f);
125
- void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
126
- const ge_p3 *A, const uint8_t *b);
118
+ void ed25519_public_key_from_hashed_seed_nohw(
119
+ uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
120
+ uint8_t az[SHA512_DIGEST_LENGTH]);
121
+
122
+ // Computes the SHA512 of three input pairs: (|input1|, |len1|),
123
+ // (|input2|, |len2|), (|input3|, |len3|). Specifically, the hash is computed
124
+ // over the concatenation: |input1| || |input2| || |input3|.
125
+ // The final pair might have |len3| == 0, meaning this input will be ignored.
126
+ // The result is written to |out|.
127
+ void ed25519_sha512(uint8_t out[SHA512_DIGEST_LENGTH],
128
+ const void *input1, size_t len1, const void *input2, size_t len2,
129
+ const void *input3, size_t len3);
130
+
131
+ // |s| is of length |ED25519_PRIVATE_KEY_SEED_LEN|
132
+ // |A| is of length |ED25519_PUBLIC_KEY_LEN|.
133
+ void ed25519_sign_nohw(
134
+ uint8_t out_sig[ED25519_SIGNATURE_LEN],
135
+ uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
136
+ const void *message, size_t message_len);
137
+
138
+ int ed25519_verify_nohw(uint8_t R_computed_encoded[32],
139
+ const uint8_t public_key[ED25519_PUBLIC_KEY_LEN], uint8_t R_expected[32],
140
+ uint8_t S[32], const uint8_t *message, size_t message_len);
127
141
 
128
142
  enum spake2_state_t {
129
143
  spake2_state_init = 0,
@@ -384,7 +384,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
384
384
  // bit and so one for all the bottom three bits.
385
385
 
386
386
  scalar password_scalar;
387
- OPENSSL_memcpy(&password_scalar, password_tmp, sizeof(password_scalar));
387
+ bn_little_endian_to_words(password_scalar.words, sizeof(password_scalar) / BN_BYTES,
388
+ password_tmp, sizeof(password_scalar));
388
389
 
389
390
  // |password_scalar| is the result of |x25519_sc_reduce| and thus is, at
390
391
  // most, $l-1$ (where $l$ is |kOrder|, the order of the prime-order subgroup
@@ -414,9 +415,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
414
415
 
415
416
  assert((password_scalar.words[0] & 7) == 0);
416
417
  }
417
-
418
- OPENSSL_memcpy(ctx->password_scalar, password_scalar.words,
419
- sizeof(ctx->password_scalar));
418
+ bn_words_to_little_endian(ctx->password_scalar, sizeof(ctx->password_scalar),
419
+ password_scalar.words, sizeof(password_scalar) / BN_BYTES);
420
420
 
421
421
  ge_p3 mask;
422
422
  x25519_ge_scalarmult_small_precomp(&mask, ctx->password_scalar,