grpc 1.27.0 → 1.30.2

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/derive_key.c

@@ -86,7 +86,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
   EVP_MD_CTX_init(&c);
   for (;;) {
     if (!EVP_DigestInit_ex(&c, md, NULL)) {
-      return 0;
+      goto err;
     }
     if (addmd++) {
       if (!EVP_DigestUpdate(&c, md_buf, mds)) {

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_aesgcmsiv.c

@@ -723,6 +723,14 @@ static void gcm_siv_keys(
   }
 
   OPENSSL_memcpy(out_keys->auth_key, key_material, 16);
+  // Note the |ctr128_f| function uses a big-endian couner, while AES-GCM-SIV
+  // uses a little-endian counter. We ignore the return value and only use
+  // |block128_f|. This has a significant performance cost for the fallback
+  // bitsliced AES implementations (bsaes and aes_nohw).
+  //
+  // We currently do not consider AES-GCM-SIV to be performance-sensitive on
+  // client hardware. If this changes, we can write little-endian |ctr128_f|
+  // functions.
   aes_ctr_set_key(&out_keys->enc_key.ks, NULL, &out_keys->enc_block,
                   key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
 }

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-arm-linux.c

@@ -21,7 +21,6 @@
 #include <unistd.h>
 
 #include <openssl/arm_arch.h>
-#include <openssl/buf.h>
 #include <openssl/mem.h>
 
 #include "cpu-arm-linux.h"
@@ -147,11 +146,13 @@ extern uint32_t OPENSSL_armcap_P;
 static int g_has_broken_neon, g_needs_hwcap2_workaround;
 
 void OPENSSL_cpuid_setup(void) {
-  char *cpuinfo_data;
-  size_t cpuinfo_len;
-  if (!read_file(&cpuinfo_data, &cpuinfo_len, "/proc/cpuinfo")) {
-    return;
-  }
+  // We ignore the return value of |read_file| and proceed with an empty
+  // /proc/cpuinfo on error. If |getauxval| works, we will still detect
+  // capabilities. There may be a false positive due to
+  // |crypto_cpuinfo_has_broken_neon|, but this is now rare.
+  char *cpuinfo_data = NULL;
+  size_t cpuinfo_len = 0;
+  read_file(&cpuinfo_data, &cpuinfo_len, "/proc/cpuinfo");
   STRING_PIECE cpuinfo;
   cpuinfo.data = cpuinfo_data;
   cpuinfo.len = cpuinfo_len;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-intel.c

@@ -123,7 +123,9 @@ static uint64_t OPENSSL_xgetbv(uint32_t xcr) {
 // and |out[1]|. See the comment in |OPENSSL_cpuid_setup| about this.
 static void handle_cpu_env(uint32_t *out, const char *in) {
   const int invert = in[0] == '~';
-  const int hex = in[invert] == '0' && in[invert+1] == 'x';
+  const int or = in[0] == '|';
+  const int skip_first_byte = invert || or;
+  const int hex = in[skip_first_byte] == '0' && in[skip_first_byte+1] == 'x';
 
   int sscanf_result;
   uint64_t v;
@@ -140,6 +142,9 @@ static void handle_cpu_env(uint32_t *out, const char *in) {
   if (invert) {
     out[0] &= ~v;
     out[1] &= ~(v >> 32);
+  } else if (or) {
+    out[0] |= v;
+    out[1] |= (v >> 32);
   } else {
     out[0] = v;
     out[1] = v >> 32;
@@ -264,10 +269,14 @@ void OPENSSL_cpuid_setup(void) {
 
   // OPENSSL_ia32cap can contain zero, one or two values, separated with a ':'.
   // Each value is a 64-bit, unsigned value which may start with "0x" to
-  // indicate a hex value. Prior to the 64-bit value, a '~' may be given.
+  // indicate a hex value. Prior to the 64-bit value, a '~' or '|' may be given.
   //
-  // If '~' isn't present, then the value is taken as the result of the CPUID.
-  // Otherwise the value is inverted and ANDed with the probed CPUID result.
+  // If the '~' prefix is present:
+  //   the value is inverted and ANDed with the probed CPUID result
+  // If the '|' prefix is present:
+  //   the value is ORed with the probed CPUID result
+  // Otherwise:
+  //   the value is taken as the result of the CPUID
   //
   // The first value determines OPENSSL_ia32cap_P[0] and [1]. The second [2]
   // and [3].

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/crypto.c

@@ -16,6 +16,8 @@
 
 #include <openssl/cpu.h>
 
+#include "fipsmodule/rand/fork_detect.h"
+#include "fipsmodule/rand/internal.h"
 #include "internal.h"
 
 
@@ -174,6 +176,15 @@ int CRYPTO_has_asm(void) {
 #endif
 }
 
+void CRYPTO_pre_sandbox_init(void) {
+  // Read from /proc/cpuinfo if needed.
+  CRYPTO_library_init();
+  // Open /dev/urandom if needed.
+  CRYPTO_init_sysrand();
+  // Set up MADV_WIPEONFORK state if needed.
+  CRYPTO_get_fork_generation();
+}
+
 const char *SSLeay_version(int which) { return OpenSSL_version(which); }
 
 const char *OpenSSL_version(int which) {

data/third_party/{boringssl/third_party/fiat → boringssl-with-bazel/src/crypto/curve25519}/curve25519.c

@@ -1,29 +1,21 @@
-// The MIT License (MIT)
-//
-// Copyright (c) 2015-2016 the fiat-crypto authors (see the AUTHORS file).
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
+/* Copyright (c) 2020, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
 // Some of this code is taken from the ref10 version of Ed25519 in SUPERCOP
 // 20141124 (http://bench.cr.yp.to/supercop.html). That code is released as
-// public domain but parts have been replaced with code generated by Fiat
-// (https://github.com/mit-plv/fiat-crypto), which is MIT licensed.
+// public domain. Other parts have been replaced to call into code generated by
+// Fiat (https://github.com/mit-plv/fiat-crypto) in //third_party/fiat.
 //
 // The field functions are shared by Ed25519 and X25519 where possible.
 
@@ -39,16 +31,16 @@
 #include <openssl/type_check.h>
 
 #include "internal.h"
-#include "../../crypto/internal.h"
+#include "../internal.h"
 
 
 // Various pre-computed constants.
 #include "./curve25519_tables.h"
 
 #if defined(BORINGSSL_CURVE25519_64BIT)
-#include "./curve25519_64.h"
+#include "../../third_party/fiat/curve25519_64.h"
 #else
-#include "./curve25519_32.h"
+#include "../../third_party/fiat/curve25519_32.h"
 #endif  // BORINGSSL_CURVE25519_64BIT
 
 

data/third_party/{boringssl/third_party/fiat → boringssl-with-bazel/src/crypto/curve25519}/curve25519_tables.h

@@ -1,24 +1,16 @@
-// The MIT License (MIT)
-//
-// Copyright (c) 2015-2016 the fiat-crypto authors (see the AUTHORS file).
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in
-// all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
+/* Copyright (c) 2020, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
 // This file is generated from
 //    ./make_curve25519_tables.py > curve25519_tables.h

data/third_party/{boringssl/third_party/fiat → boringssl-with-bazel/src/crypto/curve25519}/internal.h

@@ -1,24 +1,16 @@
-// The MIT License (MIT)
-//
-// Copyright (c) 2015-2016 the fiat-crypto authors (see the AUTHORS file).
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all
-// copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
+/* Copyright (c) 2020, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
 #ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H
 #define OPENSSL_HEADER_CURVE25519_INTERNAL_H
@@ -29,7 +21,7 @@ extern "C" {
 
 #include <openssl/base.h>
 
-#include "../../crypto/internal.h"
+#include "../internal.h"
 
 
 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE)

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/curve25519/spake25519.c

@@ -23,7 +23,7 @@
 #include <openssl/sha.h>
 
 #include "../internal.h"
-#include "../../third_party/fiat/internal.h"
+#include "./internal.h"
 
 
 // The following precomputation tables are for the following

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dh/check.c

@@ -151,7 +151,7 @@ int DH_check(const DH *dh, int *out_flags) {
         *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
       }
     }
-    r = BN_is_prime_ex(dh->q, BN_prime_checks, ctx, NULL);
+    r = BN_is_prime_ex(dh->q, BN_prime_checks_for_validation, ctx, NULL);
     if (r < 0) {
       goto err;
     }
@@ -188,7 +188,7 @@ int DH_check(const DH *dh, int *out_flags) {
     *out_flags |= DH_CHECK_UNABLE_TO_CHECK_GENERATOR;
   }
 
-  r = BN_is_prime_ex(dh->p, BN_prime_checks, ctx, NULL);
+  r = BN_is_prime_ex(dh->p, BN_prime_checks_for_validation, ctx, NULL);
   if (r < 0) {
     goto err;
   }
@@ -198,7 +198,7 @@ int DH_check(const DH *dh, int *out_flags) {
     if (!BN_rshift1(t1, dh->p)) {
       goto err;
     }
-    r = BN_is_prime_ex(t1, BN_prime_checks, ctx, NULL);
+    r = BN_is_prime_ex(t1, BN_prime_checks_for_validation, ctx, NULL);
     if (r < 0) {
       goto err;
     }

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dh/dh.c

@@ -59,7 +59,6 @@
 #include <string.h>
 
 #include <openssl/bn.h>
-#include <openssl/buf.h>
 #include <openssl/err.h>
 #include <openssl/ex_data.h>
 #include <openssl/mem.h>
@@ -114,6 +113,16 @@ void DH_free(DH *dh) {
   OPENSSL_free(dh);
 }
 
+const BIGNUM *DH_get0_pub_key(const DH *dh) { return dh->pub_key; }
+
+const BIGNUM *DH_get0_priv_key(const DH *dh) { return dh->priv_key; }
+
+const BIGNUM *DH_get0_p(const DH *dh) { return dh->p; }
+
+const BIGNUM *DH_get0_q(const DH *dh) { return dh->q; }
+
+const BIGNUM *DH_get0_g(const DH *dh) { return dh->g; }
+
 void DH_get0_key(const DH *dh, const BIGNUM **out_pub_key,
                  const BIGNUM **out_priv_key) {
   if (out_pub_key != NULL) {
@@ -175,6 +184,11 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
   return 1;
 }
 
+int DH_set_length(DH *dh, unsigned priv_length) {
+  dh->priv_length = priv_length;
+  return 1;
+}
+
 int DH_generate_parameters_ex(DH *dh, int prime_bits, int generator, BN_GENCB *cb) {
   // We generate DH parameters as follows
   // find a prime q which is prime_bits/2 bits long.
@@ -476,7 +490,7 @@ static int int_dh_param_copy(DH *to, const DH *from, int is_x942) {
   to->seedlen = 0;
 
   if (from->seed) {
-    to->seed = BUF_memdup(from->seed, from->seedlen);
+    to->seed = OPENSSL_memdup(from->seed, from->seedlen);
     if (!to->seed) {
       return 0;
     }

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dsa/dsa.c

@@ -131,6 +131,16 @@ int DSA_up_ref(DSA *dsa) {
   return 1;
 }
 
+const BIGNUM *DSA_get0_pub_key(const DSA *dsa) { return dsa->pub_key; }
+
+const BIGNUM *DSA_get0_priv_key(const DSA *dsa) { return dsa->priv_key; }
+
+const BIGNUM *DSA_get0_p(const DSA *dsa) { return dsa->p; }
+
+const BIGNUM *DSA_get0_q(const DSA *dsa) { return dsa->q; }
+
+const BIGNUM *DSA_get0_g(const DSA *dsa) { return dsa->g; }
+
 void DSA_get0_key(const DSA *dsa, const BIGNUM **out_pub_key,
                   const BIGNUM **out_priv_key) {
   if (out_pub_key != NULL) {

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/ec_extra/ec_derive.c

@@ -16,7 +16,6 @@
 
 #include <string.h>
 
-#include <openssl/buf.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
 #include <openssl/digest.h>
@@ -40,8 +39,8 @@ EC_KEY *EC_KEY_derive_from_secret(const EC_GROUP *group, const uint8_t *secret,
   // separated.
   static const char kLabel[] = "derive EC key ";
   char info[sizeof(kLabel) + EC_KEY_DERIVE_MAX_NAME_LEN];
-  BUF_strlcpy(info, kLabel, sizeof(info));
-  BUF_strlcat(info, name, sizeof(info));
+  OPENSSL_strlcpy(info, kLabel, sizeof(info));
+  OPENSSL_strlcat(info, name, sizeof(info));
 
   // Generate 128 bits beyond the group order so the bias is at most 2^-128.
 #define EC_KEY_DERIVE_EXTRA_BITS 128

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/hash_to_curve.c

@@ -0,0 +1,425 @@
+/* Copyright (c) 2020, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/ec.h>
+
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/nid.h>
+#include <openssl/type_check.h>
+
+#include <assert.h>
+
+#include "internal.h"
+#include "../fipsmodule/bn/internal.h"
+#include "../fipsmodule/ec/internal.h"
+#include "../internal.h"
+
+
+// This file implements hash-to-curve, as described in
+// draft-irtf-cfrg-hash-to-curve-07.
+//
+// This hash-to-curve implementation is written generically with the
+// expectation that we will eventually wish to support other curves. If it
+// becomes a performance bottleneck, some possible optimizations by
+// specializing it to the curve:
+//
+// - Rather than using a generic |felem_exp|, specialize the exponentation to
+//   c2 with a faster addition chain.
+//
+// - |felem_mul| and |felem_sqr| are indirect calls to generic Montgomery
+//   code. Given the few curves, we could specialize
+//   |map_to_curve_simple_swu|. But doing this reasonably without duplicating
+//   code in C is difficult. (C++ templates would be useful here.)
+//
+// - P-521's Z and c2 have small power-of-two absolute values. We could save
+//   two multiplications in SSWU. (Other curves have reasonable values of Z
+//   and inconvenient c2.) This is unlikely to be worthwhile without C++
+//   templates to make specializing more convenient.
+
+// expand_message_xmd implements the operation described in section 5.3.1 of
+// draft-irtf-cfrg-hash-to-curve-07. It returns one on success and zero on
+// allocation failure or if |out_len| was too large. If |is_draft06| is one, it
+// implements the operation from draft-irtf-cfrg-hash-to-curve-06 instead.
+static int expand_message_xmd(const EVP_MD *md, uint8_t *out, size_t out_len,
+                              const uint8_t *msg, size_t msg_len,
+                              const uint8_t *dst, size_t dst_len,
+                              int is_draft06) {
+  int ret = 0;
+  const size_t block_size = EVP_MD_block_size(md);
+  const size_t md_size = EVP_MD_size(md);
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
+
+  // Long DSTs are hashed down to size. See section 5.3.3.
+  OPENSSL_STATIC_ASSERT(EVP_MAX_MD_SIZE < 256, "hashed DST still too large");
+  uint8_t dst_buf[EVP_MAX_MD_SIZE];
+  if (dst_len >= 256) {
+    static const char kPrefix[] = "H2C-OVERSIZE-DST-";
+    if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+        !EVP_DigestUpdate(&ctx, kPrefix, sizeof(kPrefix) - 1) ||
+        !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+        !EVP_DigestFinal_ex(&ctx, dst_buf, NULL)) {
+      goto err;
+    }
+    dst = dst_buf;
+    dst_len = md_size;
+  }
+  uint8_t dst_len_u8 = (uint8_t)dst_len;
+
+  // Compute b_0.
+  static const uint8_t kZeros[EVP_MAX_MD_BLOCK_SIZE] = {0};
+  // If |out_len| exceeds 16 bits then |i| will wrap below causing an error to
+  // be returned. This depends on the static assert above.
+  uint8_t l_i_b_str_zero[3] = {out_len >> 8, out_len, 0};
+  uint8_t b_0[EVP_MAX_MD_SIZE];
+  if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+      !EVP_DigestUpdate(&ctx, kZeros, block_size) ||
+      !EVP_DigestUpdate(&ctx, msg, msg_len) ||
+      !EVP_DigestUpdate(&ctx, l_i_b_str_zero, sizeof(l_i_b_str_zero)) ||
+      (is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
+      !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+      (!is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
+      !EVP_DigestFinal_ex(&ctx, b_0, NULL)) {
+    goto err;
+  }
+
+  uint8_t b_i[EVP_MAX_MD_SIZE];
+  uint8_t i = 1;
+  while (out_len > 0) {
+    if (i == 0) {
+      // Input was too large.
+      OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+      goto err;
+    }
+    if (i > 1) {
+      for (size_t j = 0; j < md_size; j++) {
+        b_i[j] ^= b_0[j];
+      }
+    } else {
+      OPENSSL_memcpy(b_i, b_0, md_size);
+    }
+
+    if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+        !EVP_DigestUpdate(&ctx, b_i, md_size) ||
+        !EVP_DigestUpdate(&ctx, &i, 1) ||
+        (is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
+        !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+        (!is_draft06 && !EVP_DigestUpdate(&ctx, &dst_len_u8, 1)) ||
+        !EVP_DigestFinal_ex(&ctx, b_i, NULL)) {
+      goto err;
+    }
+
+    size_t todo = out_len >= md_size ? md_size : out_len;
+    OPENSSL_memcpy(out, b_i, todo);
+    out += todo;
+    out_len -= todo;
+    i++;
+  }
+
+  ret = 1;
+
+err:
+  EVP_MD_CTX_cleanup(&ctx);
+  return ret;
+}
+
+// num_bytes_to_derive determines the number of bytes to derive when hashing to
+// a number modulo |modulus|. See the hash_to_field operation defined in
+// section 5.2 of draft-irtf-cfrg-hash-to-curve-07.
+static int num_bytes_to_derive(size_t *out, const BIGNUM *modulus, unsigned k) {
+  size_t bits = BN_num_bits(modulus);
+  size_t L = (bits + k + 7) / 8;
+  // We require 2^(8*L) < 2^(2*bits - 2) <= n^2 so to fit in bounds for
+  // |felem_reduce| and |ec_scalar_reduce|. All defined hash-to-curve suites
+  // define |k| to be well under this bound. (|k| is usually around half of
+  // |p_bits|.)
+  if (L * 8 >= 2 * bits - 2 ||
+      L > 2 * EC_MAX_BYTES) {
+    assert(0);
+    OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  *out = L;
+  return 1;
+}
+
+// big_endian_to_words decodes |in| as a big-endian integer and writes the
+// result to |out|. |num_words| must be large enough to contain the output.
+static void big_endian_to_words(BN_ULONG *out, size_t num_words,
+                                const uint8_t *in, size_t len) {
+  assert(len <= num_words * sizeof(BN_ULONG));
+  // Ensure any excess bytes are zeroed.
+  OPENSSL_memset(out, 0, num_words * sizeof(BN_ULONG));
+  uint8_t *out_u8 = (uint8_t *)out;
+  for (size_t i = 0; i < len; i++) {
+    out_u8[len - 1 - i] = in[i];
+  }
+}
+
+// hash_to_field implements the operation described in section 5.2
+// of draft-irtf-cfrg-hash-to-curve-07, with count = 2. |k| is the security
+// factor.
+static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
+                          EC_FELEM *out1, EC_FELEM *out2, const uint8_t *dst,
+                          size_t dst_len, unsigned k, const uint8_t *msg,
+                          size_t msg_len, int is_draft06) {
+  size_t L;
+  uint8_t buf[4 * EC_MAX_BYTES];
+  if (!num_bytes_to_derive(&L, &group->field, k) ||
+      !expand_message_xmd(md, buf, 2 * L, msg, msg_len, dst, dst_len,
+                          is_draft06)) {
+    return 0;
+  }
+  BN_ULONG words[2 * EC_MAX_WORDS];
+  size_t num_words = 2 * group->field.width;
+  big_endian_to_words(words, num_words, buf, L);
+  group->meth->felem_reduce(group, out1, words, num_words);
+  big_endian_to_words(words, num_words, buf + L, L);
+  group->meth->felem_reduce(group, out2, words, num_words);
+  return 1;
+}
+
+// hash_to_scalar behaves like |hash_to_field2| but returns a value modulo the
+// group order rather than a field element. |k| is the security factor.
+static int hash_to_scalar(const EC_GROUP *group, const EVP_MD *md,
+                          EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+                          unsigned k, const uint8_t *msg, size_t msg_len,
+                          int is_draft06) {
+  size_t L;
+  uint8_t buf[EC_MAX_BYTES * 2];
+  if (!num_bytes_to_derive(&L, &group->order, k) ||
+      !expand_message_xmd(md, buf, L, msg, msg_len, dst, dst_len, is_draft06)) {
+    return 0;
+  }
+
+  BN_ULONG words[2 * EC_MAX_WORDS];
+  size_t num_words = 2 * group->order.width;
+  big_endian_to_words(words, num_words, buf, L);
+  ec_scalar_reduce(group, out, words, num_words);
+  return 1;
+}
+
+static inline void mul_A(const EC_GROUP *group, EC_FELEM *out,
+                         const EC_FELEM *in) {
+  assert(group->a_is_minus3);
+  EC_FELEM tmp;
+  ec_felem_add(group, &tmp, in, in);      // tmp = 2*in
+  ec_felem_add(group, &tmp, &tmp, &tmp);  // tmp = 4*in
+  ec_felem_sub(group, out, in, &tmp);     // out = -3*in
+}
+
+static inline void mul_minus_A(const EC_GROUP *group, EC_FELEM *out,
+                               const EC_FELEM *in) {
+  assert(group->a_is_minus3);
+  EC_FELEM tmp;
+  ec_felem_add(group, &tmp, in, in);   // tmp = 2*in
+  ec_felem_add(group, out, &tmp, in);  // out = 3*in
+}
+
+// sgn0_le implements the operation described in section 4.1.2 of
+// draft-irtf-cfrg-hash-to-curve-07.
+static BN_ULONG sgn0_le(const EC_GROUP *group, const EC_FELEM *a) {
+  uint8_t buf[EC_MAX_BYTES];
+  size_t len;
+  ec_felem_to_bytes(group, buf, &len, a);
+  return buf[len - 1] & 1;
+}
+
+// map_to_curve_simple_swu implements the operation described in section 6.6.2
+// of draft-irtf-cfrg-hash-to-curve-07, using the optimization in appendix
+// D.2.1. It returns one on success and zero on error.
+static int map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
+                                   const BN_ULONG *c1, size_t num_c1,
+                                   const EC_FELEM *c2, EC_RAW_POINT *out,
+                                   const EC_FELEM *u) {
+  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
+                          const EC_FELEM *b) = group->meth->felem_mul;
+  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
+      group->meth->felem_sqr;
+
+  // This function requires the prime be 3 mod 4, and that A = -3.
+  if (group->field.width == 0 || (group->field.d[0] & 3) != 3 ||
+      !group->a_is_minus3) {
+    OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  EC_FELEM tv1, tv2, tv3, tv4, xd, x1n, x2n, tmp, gxd, gx1, y1, y2;
+  felem_sqr(group, &tv1, u);                         // tv1 = u^2
+  felem_mul(group, &tv3, Z, &tv1);                   // tv3 = Z * tv1
+  felem_sqr(group, &tv2, &tv3);                      // tv2 = tv3^2
+  ec_felem_add(group, &xd, &tv2, &tv3);              // xd = tv2 + tv3
+  ec_felem_add(group, &x1n, &xd, &group->one);       // x1n = xd + 1
+  felem_mul(group, &x1n, &x1n, &group->b);           // x1n = x1n * B
+  mul_minus_A(group, &xd, &xd);                      // xd = -A * xd
+  BN_ULONG e1 = ec_felem_non_zero_mask(group, &xd);  // e1 = xd == 0 [flipped]
+  mul_A(group, &tmp, Z);
+  ec_felem_select(group, &xd, e1, &xd, &tmp);  // xd = CMOV(xd, Z * A, e1)
+  felem_sqr(group, &tv2, &xd);                 // tv2 = xd^2
+  felem_mul(group, &gxd, &tv2, &xd);           // gxd = tv2 * xd = xd^3
+  mul_A(group, &tv2, &tv2);                    // tv2 = A * tv2
+  felem_sqr(group, &gx1, &x1n);                // gx1 = x1n^2
+  ec_felem_add(group, &gx1, &gx1, &tv2);       // gx1 = gx1 + tv2
+  felem_mul(group, &gx1, &gx1, &x1n);          // gx1 = gx1 * x1n
+  felem_mul(group, &tv2, &group->b, &gxd);     // tv2 = B * gxd
+  ec_felem_add(group, &gx1, &gx1, &tv2);       // gx1 = gx1 + tv2
+  felem_sqr(group, &tv4, &gxd);                // tv4 = gxd^2
+  felem_mul(group, &tv2, &gx1, &gxd);          // tv2 = gx1 * gxd
+  felem_mul(group, &tv4, &tv4, &tv2);          // tv4 = tv4 * tv2
+  group->meth->felem_exp(group, &y1, &tv4, c1, num_c1);  // y1 = tv4^c1
+  felem_mul(group, &y1, &y1, &tv2);                      // y1 = y1 * tv2
+  felem_mul(group, &x2n, &tv3, &x1n);                    // x2n = tv3 * x1n
+  felem_mul(group, &y2, &y1, c2);                        // y2 = y1 * c2
+  felem_mul(group, &y2, &y2, &tv1);                      // y2 = y2 * tv1
+  felem_mul(group, &y2, &y2, u);                         // y2 = y2 * u
+  felem_sqr(group, &tv2, &y1);                           // tv2 = y1^2
+  felem_mul(group, &tv2, &tv2, &gxd);                    // tv2 = tv2 * gxd
+  ec_felem_sub(group, &tv3, &tv2, &gx1);
+  BN_ULONG e2 =
+      ec_felem_non_zero_mask(group, &tv3);       // e2 = tv2 == gx1 [flipped]
+  ec_felem_select(group, &x1n, e2, &x2n, &x1n);  // xn = CMOV(x2n, x1n, e2)
+  ec_felem_select(group, &y1, e2, &y2, &y1);     // y = CMOV(y2, y1, e2)
+  BN_ULONG sgn0_u = sgn0_le(group, u);
+  BN_ULONG sgn0_y = sgn0_le(group, &y1);
+  BN_ULONG e3 = sgn0_u ^ sgn0_y;
+  e3 = ((BN_ULONG)0) - e3;  // e3 = sgn0(u) == sgn0(y) [flipped]
+  ec_felem_neg(group, &y2, &y1);
+  ec_felem_select(group, &y1, e3, &y2, &y1);  // y = CMOV(-y, y, e3)
+
+  // Appendix D.1 describes how to convert (x1n, xd, y1, 1) to Jacobian
+  // coordinates. Note yd = 1. Also note that gxd computed above is xd^3.
+  felem_mul(group, &out->X, &x1n, &xd);     // X = xn * xd
+  felem_mul(group, &out->Y, &y1, &gxd);     // Y = yn * gxd = yn * xd^3
+  out->Z = xd;                              // Z = xd
+  return 1;
+}
+
+static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
+                         const EC_FELEM *Z, const EC_FELEM *c2, unsigned k,
+                         EC_RAW_POINT *out, const uint8_t *dst, size_t dst_len,
+                         const uint8_t *msg, size_t msg_len, int is_draft06) {
+  EC_FELEM u0, u1;
+  if (!hash_to_field2(group, md, &u0, &u1, dst, dst_len, k, msg, msg_len,
+                      is_draft06)) {
+    return 0;
+  }
+
+  // Compute |c1| = (p - 3) / 4.
+  BN_ULONG c1[EC_MAX_WORDS];
+  size_t num_c1 = group->field.width;
+  if (!bn_copy_words(c1, num_c1, &group->field)) {
+    return 0;
+  }
+  bn_rshift_words(c1, c1, /*shift=*/2, /*num=*/num_c1);
+
+  EC_RAW_POINT Q0, Q1;
+  if (!map_to_curve_simple_swu(group, Z, c1, num_c1, c2, &Q0, &u0) ||
+      !map_to_curve_simple_swu(group, Z, c1, num_c1, c2, &Q1, &u1)) {
+    return 0;
+  }
+
+  group->meth->add(group, out, &Q0, &Q1);  // R = Q0 + Q1
+  // All our curves have cofactor one, so |clear_cofactor| is a no-op.
+  return 1;
+}
+
+static int felem_from_u8(const EC_GROUP *group, EC_FELEM *out, uint8_t a) {
+  uint8_t bytes[EC_MAX_BYTES] = {0};
+  size_t len = BN_num_bytes(&group->field);
+  bytes[len - 1] = a;
+  return ec_felem_from_bytes(group, out, bytes, len);
+}
+
+int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
+    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
+    size_t dst_len, const uint8_t *msg, size_t msg_len) {
+  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-07.
+  if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
+    OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
+    return 0;
+  }
+
+  // kSqrt1728 was computed as follows in python3:
+  //
+  // p = 2**384 - 2**128 - 2**96 + 2**32 - 1
+  // z3 = 12**3
+  // c2 = pow(z3, (p+1)//4, p)
+  // assert z3 == pow(c2, 2, p)
+  // ", ".join("0x%02x" % b for b in c2.to_bytes(384//8, 'big')
+
+  static const uint8_t kSqrt1728[] = {
+      0x01, 0x98, 0x77, 0xcc, 0x10, 0x41, 0xb7, 0x55, 0x57, 0x43, 0xc0, 0xae,
+      0x2e, 0x3a, 0x3e, 0x61, 0xfb, 0x2a, 0xaa, 0x2e, 0x0e, 0x87, 0xea, 0x55,
+      0x7a, 0x56, 0x3d, 0x8b, 0x59, 0x8a, 0x09, 0x40, 0xd0, 0xa6, 0x97, 0xa9,
+      0xe0, 0xb9, 0xe9, 0x2c, 0xfa, 0xa3, 0x14, 0xf5, 0x83, 0xc9, 0xd0, 0x66
+  };
+
+  // Z = -12, c2 = sqrt(1728)
+  EC_FELEM Z, c2;
+  if (!felem_from_u8(group, &Z, 12) ||
+      !ec_felem_from_bytes(group, &c2, kSqrt1728, sizeof(kSqrt1728))) {
+    return 0;
+  }
+  ec_felem_neg(group, &Z, &Z);
+
+  return hash_to_curve(group, EVP_sha512(), &Z, &c2, /*k=*/192, out, dst,
+                       dst_len, msg, msg_len, /*is_draft06=*/0);
+}
+
+int ec_hash_to_scalar_p384_xmd_sha512_draft07(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
+  if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
+    OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
+    return 0;
+  }
+
+  return hash_to_scalar(group, EVP_sha512(), out, dst, dst_len, /*k=*/192, msg,
+                        msg_len, /*is_draft06=*/0);
+}
+
+int ec_hash_to_curve_p521_xmd_sha512_sswu_draft06(
+    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
+    size_t dst_len, const uint8_t *msg, size_t msg_len) {
+  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-06.
+  if (EC_GROUP_get_curve_name(group) != NID_secp521r1) {
+    OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
+    return 0;
+  }
+
+  // Z = -4, c2 = 8.
+  EC_FELEM Z, c2;
+  if (!felem_from_u8(group, &Z, 4) ||
+      !felem_from_u8(group, &c2, 8)) {
+    return 0;
+  }
+  ec_felem_neg(group, &Z, &Z);
+
+  return hash_to_curve(group, EVP_sha512(), &Z, &c2, /*k=*/256, out, dst,
+                       dst_len, msg, msg_len, /*is_draft06=*/1);
+}
+
+int ec_hash_to_scalar_p521_xmd_sha512_draft06(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
+  if (EC_GROUP_get_curve_name(group) != NID_secp521r1) {
+    OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
+    return 0;
+  }
+
+  return hash_to_scalar(group, EVP_sha512(), out, dst, dst_len, /*k=*/256, msg,
+                        msg_len, /*is_draft06=*/1);
+}