grpc 1.27.0 → 1.30.2

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_info.c

@@ -62,7 +62,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/buf.h>
 #include <openssl/dsa.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_lib.c

@@ -92,9 +92,9 @@ void PEM_proc_type(char *buf, int type)
     else
         str = "BAD-TYPE";
 
-    BUF_strlcat(buf, "Proc-Type: 4,", PEM_BUFSIZE);
-    BUF_strlcat(buf, str, PEM_BUFSIZE);
-    BUF_strlcat(buf, "\n", PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, "Proc-Type: 4,", PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, str, PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, "\n", PEM_BUFSIZE);
 }
 
 void PEM_dek_info(char *buf, const char *type, int len, char *str)
@@ -103,9 +103,9 @@ void PEM_dek_info(char *buf, const char *type, int len, char *str)
     long i;
     int j;
 
-    BUF_strlcat(buf, "DEK-Info: ", PEM_BUFSIZE);
-    BUF_strlcat(buf, type, PEM_BUFSIZE);
-    BUF_strlcat(buf, ",", PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, "DEK-Info: ", PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, type, PEM_BUFSIZE);
+    OPENSSL_strlcat(buf, ",", PEM_BUFSIZE);
     j = strlen(buf);
     if (j + (len * 2) + 1 > PEM_BUFSIZE)
         return;
@@ -772,6 +772,6 @@ int PEM_def_callback(char *buf, int size, int rwflag, void *userdata)
     if (len >= (size_t)size) {
         return 0;
     }
-    BUF_strlcpy(buf, userdata, (size_t)size);
+    OPENSSL_strlcpy(buf, userdata, (size_t)size);
     return len;
 }

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_oth.c

@@ -59,7 +59,6 @@
 
 #include <stdio.h>
 
-#include <openssl/buf.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/evp.h>

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_pk8.c

@@ -56,7 +56,6 @@
 
 #include <openssl/pem.h>
 
-#include <openssl/buf.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_pkey.c

@@ -59,7 +59,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include <openssl/buf.h>
 #include <openssl/dh.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs7/pkcs7_x509.c

@@ -260,7 +260,7 @@ static PKCS7 *pkcs7_new(CBS *cbs) {
   }
 
   ret->ber_len = CBS_len(&copy2) - CBS_len(cbs);
-  ret->ber_bytes = BUF_memdup(CBS_data(&copy2), ret->ber_len);
+  ret->ber_bytes = OPENSSL_memdup(CBS_data(&copy2), ret->ber_len);
   if (ret->ber_bytes == NULL) {
     goto err;
   }

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/poly1305/poly1305.c

@@ -26,7 +26,7 @@
 #include "../internal.h"
 
 
-#if defined(OPENSSL_WINDOWS) || !defined(OPENSSL_X86_64)
+#if !defined(BORINGSSL_HAS_UINT128) || !defined(OPENSSL_X86_64)
 
 // We can assume little-endian.
 static uint32_t U8TO32_LE(const uint8_t *m) {
@@ -315,4 +315,4 @@ void CRYPTO_poly1305_finish(poly1305_state *statep, uint8_t mac[16]) {
   U32TO8_LE(&mac[12], f3);
 }
 
-#endif  // OPENSSL_WINDOWS || !OPENSSL_X86_64
+#endif  // !BORINGSSL_HAS_UINT128 || !OPENSSL_X86_64

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/poly1305/poly1305_arm.c

@@ -103,7 +103,17 @@ static void freeze(fe1305x2 *r) {
   r->v[8] = y4;
 }
 
-static void fe1305x2_tobytearray(uint8_t *r, fe1305x2 *x) {
+static void store32(uint8_t out[4], uint32_t v) { OPENSSL_memcpy(out, &v, 4); }
+
+// load32 exists to avoid breaking strict aliasing rules in
+// fe1305x2_frombytearray.
+static uint32_t load32(const uint8_t t[4]) {
+  uint32_t tmp;
+  OPENSSL_memcpy(&tmp, t, sizeof(tmp));
+  return tmp;
+}
+
+static void fe1305x2_tobytearray(uint8_t r[16], fe1305x2 *x) {
   uint32_t x0 = x->v[0];
   uint32_t x1 = x->v[2];
   uint32_t x2 = x->v[4];
@@ -119,22 +129,13 @@ static void fe1305x2_tobytearray(uint8_t *r, fe1305x2 *x) {
   x4 += x3 >> 26;
   x3 &= 0x3ffffff;
 
-  *(uint32_t *)r = x0 + (x1 << 26);
-  *(uint32_t *)(r + 4) = (x1 >> 6) + (x2 << 20);
-  *(uint32_t *)(r + 8) = (x2 >> 12) + (x3 << 14);
-  *(uint32_t *)(r + 12) = (x3 >> 18) + (x4 << 8);
-}
-
-// load32 exists to avoid breaking strict aliasing rules in
-// fe1305x2_frombytearray.
-static uint32_t load32(uint8_t *t) {
-  uint32_t tmp;
-  OPENSSL_memcpy(&tmp, t, sizeof(tmp));
-  return tmp;
+  store32(r, x0 + (x1 << 26));
+  store32(r + 4, (x1 >> 6) + (x2 << 20));
+  store32(r + 8, (x2 >> 12) + (x3 << 14));
+  store32(r + 12, (x3 >> 18) + (x4 << 8));
 }
 
-static void fe1305x2_frombytearray(fe1305x2 *r, const uint8_t *x,
-                                   unsigned long long xlen) {
+static void fe1305x2_frombytearray(fe1305x2 *r, const uint8_t *x, size_t xlen) {
   unsigned i;
   uint8_t t[17];
 
@@ -190,11 +191,11 @@ void CRYPTO_poly1305_init_neon(poly1305_state *state, const uint8_t key[32]) {
   fe1305x2 *const precomp = c + 1;
   unsigned int j;
 
-  r->v[1] = r->v[0] = 0x3ffffff & *(uint32_t *)key;
-  r->v[3] = r->v[2] = 0x3ffff03 & ((*(uint32_t *)(key + 3)) >> 2);
-  r->v[5] = r->v[4] = 0x3ffc0ff & ((*(uint32_t *)(key + 6)) >> 4);
-  r->v[7] = r->v[6] = 0x3f03fff & ((*(uint32_t *)(key + 9)) >> 6);
-  r->v[9] = r->v[8] = 0x00fffff & ((*(uint32_t *)(key + 12)) >> 8);
+  r->v[1] = r->v[0] = 0x3ffffff & load32(key);
+  r->v[3] = r->v[2] = 0x3ffff03 & (load32(key + 3) >> 2);
+  r->v[5] = r->v[4] = 0x3ffc0ff & (load32(key + 6) >> 4);
+  r->v[7] = r->v[6] = 0x3f03fff & (load32(key + 9) >> 6);
+  r->v[9] = r->v[8] = 0x00fffff & (load32(key + 12) >> 8);
 
   for (j = 0; j < 10; j++) {
     h->v[j] = 0;  // XXX: should fast-forward a bit

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/poly1305/poly1305_vec.c

@@ -23,13 +23,25 @@
 #include "../internal.h"
 
 
-#if !defined(OPENSSL_WINDOWS) && defined(OPENSSL_X86_64)
+#if defined(BORINGSSL_HAS_UINT128) && defined(OPENSSL_X86_64)
 
 #include <emmintrin.h>
 
-#define U8TO64_LE(m) (*(const uint64_t *)(m))
-#define U8TO32_LE(m) (*(const uint32_t *)(m))
-#define U64TO8_LE(m, v) (*(uint64_t *)(m)) = v
+static uint32_t load_u32_le(const uint8_t in[4]) {
+  uint32_t ret;
+  OPENSSL_memcpy(&ret, in, 4);
+  return ret;
+}
+
+static uint64_t load_u64_le(const uint8_t in[8]) {
+  uint64_t ret;
+  OPENSSL_memcpy(&ret, in, 8);
+  return ret;
+}
+
+static void store_u64_le(uint8_t out[8], uint64_t v) {
+  OPENSSL_memcpy(out, &v, 8);
+}
 
 typedef __m128i xmmi;
 
@@ -96,8 +108,8 @@ void CRYPTO_poly1305_init(poly1305_state *state, const uint8_t key[32]) {
   uint64_t t0, t1;
 
   // clamp key
-  t0 = U8TO64_LE(key + 0);
-  t1 = U8TO64_LE(key + 8);
+  t0 = load_u64_le(key + 0);
+  t1 = load_u64_le(key + 8);
   r0 = t0 & 0xffc0fffffff;
   t0 >>= 44;
   t0 |= t1 << 20;
@@ -115,10 +127,10 @@ void CRYPTO_poly1305_init(poly1305_state *state, const uint8_t key[32]) {
   p->R22.d[3] = (uint32_t)(r2 >> 32);
 
   // store pad
-  p->R23.d[1] = U8TO32_LE(key + 16);
-  p->R23.d[3] = U8TO32_LE(key + 20);
-  p->R24.d[1] = U8TO32_LE(key + 24);
-  p->R24.d[3] = U8TO32_LE(key + 28);
+  p->R23.d[1] = load_u32_le(key + 16);
+  p->R23.d[3] = load_u32_le(key + 20);
+  p->R24.d[1] = load_u32_le(key + 24);
+  p->R24.d[3] = load_u32_le(key + 28);
 
   // H = 0
   st->H[0] = _mm_setzero_si128();
@@ -662,6 +674,11 @@ void CRYPTO_poly1305_update(poly1305_state *state, const uint8_t *m,
   poly1305_state_internal *st = poly1305_aligned_state(state);
   size_t want;
 
+  // Work around a C language bug. See https://crbug.com/1019588.
+  if (bytes == 0) {
+    return;
+  }
+
   // need at least 32 initial bytes to start the accelerated branch
   if (!st->started) {
     if ((st->leftover == 0) && (bytes > 32)) {
@@ -745,8 +762,8 @@ void CRYPTO_poly1305_finish(poly1305_state *state, uint8_t mac[16]) {
   }
 
 poly1305_donna_atleast16bytes:
-  t0 = U8TO64_LE(m + 0);
-  t1 = U8TO64_LE(m + 8);
+  t0 = load_u64_le(m + 0);
+  t1 = load_u64_le(m + 8);
   h0 += t0 & 0xfffffffffff;
   t0 = shr128_pair(t1, t0, 44);
   h1 += t0 & 0xfffffffffff;
@@ -785,8 +802,8 @@ poly1305_donna_atmost15bytes:
   OPENSSL_memset(m + leftover, 0, 16 - leftover);
   leftover = 16;
 
-  t0 = U8TO64_LE(m + 0);
-  t1 = U8TO64_LE(m + 8);
+  t0 = load_u64_le(m + 0);
+  t1 = load_u64_le(m + 8);
   h0 += t0 & 0xfffffffffff;
   t0 = shr128_pair(t1, t0, 44);
   h1 += t0 & 0xfffffffffff;
@@ -832,8 +849,8 @@ poly1305_donna_finish:
   t1 = (t1 >> 24);
   h2 += (t1)+c;
 
-  U64TO8_LE(mac + 0, ((h0) | (h1 << 44)));
-  U64TO8_LE(mac + 8, ((h1 >> 20) | (h2 << 24)));
+  store_u64_le(mac + 0, ((h0) | (h1 << 44)));
+  store_u64_le(mac + 8, ((h1 >> 20) | (h2 << 24)));
 }
 
-#endif  // !OPENSSL_WINDOWS && OPENSSL_X86_64
+#endif  // BORINGSSL_HAS_UINT128 && OPENSSL_X86_64

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pool/pool.c

@@ -17,7 +17,6 @@
 #include <assert.h>
 #include <string.h>
 
-#include <openssl/buf.h>
 #include <openssl/bytestring.h>
 #include <openssl/mem.h>
 #include <openssl/thread.h>
@@ -99,7 +98,7 @@ CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
   }
   OPENSSL_memset(buf, 0, sizeof(CRYPTO_BUFFER));
 
-  buf->data = BUF_memdup(data, len);
+  buf->data = OPENSSL_memdup(data, len);
   if (len != 0 && buf->data == NULL) {
     OPENSSL_free(buf);
     return NULL;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rand_extra/deterministic.c

@@ -30,27 +30,23 @@
 // multi-threaded program, replace this with a thread-local. (A mutex would not
 // be deterministic.)
 static uint64_t g_num_calls = 0;
+static struct CRYPTO_STATIC_MUTEX g_num_calls_lock = CRYPTO_STATIC_MUTEX_INIT;
 
 void RAND_reset_for_fuzzing(void) { g_num_calls = 0; }
 
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   static const uint8_t kZeroKey[32];
 
+  CRYPTO_STATIC_MUTEX_lock_write(&g_num_calls_lock);
+  uint64_t num_calls = g_num_calls++;
+  CRYPTO_STATIC_MUTEX_unlock_write(&g_num_calls_lock);
+
   uint8_t nonce[12];
   OPENSSL_memset(nonce, 0, sizeof(nonce));
-  OPENSSL_memcpy(nonce, &g_num_calls, sizeof(g_num_calls));
+  OPENSSL_memcpy(nonce, &num_calls, sizeof(num_calls));
 
   OPENSSL_memset(out, 0, requested);
   CRYPTO_chacha_20(out, out, requested, kZeroKey, nonce, 0);
-  g_num_calls++;
-}
-
-void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
-  CRYPTO_sysrand(out, requested);
-}
-
-void CRYPTO_sysrand_if_available(uint8_t *out, size_t requested) {
-  CRYPTO_sysrand(out, requested);
 }
 
 #endif  // BORINGSSL_UNSAFE_DETERMINISTIC_MODE

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rand_extra/windows.c

@@ -23,12 +23,18 @@ OPENSSL_MSVC_PRAGMA(warning(push, 3))
 
 #include <windows.h>
 
+#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) && \
+    !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
+#include <bcrypt.h>
+OPENSSL_MSVC_PRAGMA(comment(lib, "bcrypt.lib"))
+#else
 // #define needed to link in RtlGenRandom(), a.k.a. SystemFunction036.  See the
 // "Community Additions" comment on MSDN here:
 // http://msdn.microsoft.com/en-us/library/windows/desktop/aa387694.aspx
 #define SystemFunction036 NTAPI SystemFunction036
 #include <ntsecapi.h>
 #undef SystemFunction036
+#endif  // WINAPI_PARTITION_APP && !WINAPI_PARTITION_DESKTOP
 
 OPENSSL_MSVC_PRAGMA(warning(pop))
 
@@ -41,7 +47,17 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
     if (requested < output_bytes_this_pass) {
       output_bytes_this_pass = (ULONG)requested;
     }
+    // On non-UWP configurations, use RtlGenRandom instead of BCryptGenRandom
+    // to avoid accessing resources that may be unavailable inside the
+    // Chromium sandbox. See https://crbug.com/boringssl/307
+#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) && \
+    !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
+    if (!BCRYPT_SUCCESS(BCryptGenRandom(
+            /*hAlgorithm=*/NULL, out, output_bytes_this_pass,
+            BCRYPT_USE_SYSTEM_PREFERRED_RNG))) {
+#else
     if (RtlGenRandom(out, output_bytes_this_pass) == FALSE) {
+#endif  // WINAPI_PARTITION_APP && !WINAPI_PARTITION_DESKTOP
       abort();
     }
     requested -= output_bytes_this_pass;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/siphash/siphash.c

@@ -17,6 +17,8 @@
 
 #include <openssl/siphash.h>
 
+#include "../internal.h"
+
 
 static void siphash_round(uint64_t v[4]) {
   v[0] += v[1];
@@ -62,7 +64,7 @@ uint64_t SIPHASH_24(const uint64_t key[2], const uint8_t *input,
     uint64_t word;
   } last_block;
   last_block.word = 0;
-  memcpy(last_block.bytes, input, input_len);
+  OPENSSL_memcpy(last_block.bytes, input, input_len);
   last_block.bytes[7] = orig_input_len & 0xff;
 
   v[3] ^= last_block.word;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/thread_pthread.c

@@ -26,6 +26,10 @@
 
 OPENSSL_STATIC_ASSERT(sizeof(CRYPTO_MUTEX) >= sizeof(pthread_rwlock_t),
                       "CRYPTO_MUTEX is too small");
+#if defined(__GNUC__) || defined(__clang__)
+OPENSSL_STATIC_ASSERT(alignof(CRYPTO_MUTEX) >= alignof(pthread_rwlock_t),
+                      "CRYPTO_MUTEX has insufficient alignment");
+#endif
 
 void CRYPTO_MUTEX_init(CRYPTO_MUTEX *lock) {
   if (pthread_rwlock_init((pthread_rwlock_t *) lock, NULL) != 0) {

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/thread_win.c

@@ -29,6 +29,10 @@ OPENSSL_MSVC_PRAGMA(warning(pop))
 
 OPENSSL_STATIC_ASSERT(sizeof(CRYPTO_MUTEX) >= sizeof(SRWLOCK),
                       "CRYPTO_MUTEX is too small");
+#if defined(__GNUC__) || defined(__clang__)
+OPENSSL_STATIC_ASSERT(alignof(CRYPTO_MUTEX) >= alignof(SRWLOCK),
+                      "CRYPTO_MUTEX has insufficient alignment");
+#endif
 
 static BOOL CALLBACK call_once_init(INIT_ONCE *once, void *arg, void **out) {
   void (**init)(void) = (void (**)(void))arg;

data/third_party/boringssl-with-bazel/src/crypto/trust_token/internal.h

@@ -0,0 +1,278 @@
+/* Copyright (c) 2019, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_TRUST_TOKEN_INTERNAL_H
+#define OPENSSL_HEADER_TRUST_TOKEN_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/nid.h>
+
+#include "../fipsmodule/ec/internal.h"
+
+#include <openssl/trust_token.h>
+
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// PMBTokens.
+//
+// PMBTokens is described in https://eprint.iacr.org/2020/072/20200324:214215
+// and provides anonymous tokens with private metadata. We implement the
+// construction with validity verification, described in appendix H,
+// construction 6.
+
+// PMBTOKEN_NONCE_SIZE is the size of nonces used as part of the PMBToken
+// protocol.
+#define PMBTOKEN_NONCE_SIZE 64
+
+typedef struct {
+  // TODO(https://crbug.com/boringssl/334): These should store |EC_PRECOMP| so
+  // that |TRUST_TOKEN_finish_issuance| can use |ec_point_mul_scalar_precomp|.
+  EC_AFFINE pub0;
+  EC_AFFINE pub1;
+  EC_AFFINE pubs;
+} PMBTOKEN_CLIENT_KEY;
+
+typedef struct {
+  EC_SCALAR x0;
+  EC_SCALAR y0;
+  EC_SCALAR x1;
+  EC_SCALAR y1;
+  EC_SCALAR xs;
+  EC_SCALAR ys;
+  EC_AFFINE pub0;
+  EC_PRECOMP pub0_precomp;
+  EC_AFFINE pub1;
+  EC_PRECOMP pub1_precomp;
+  EC_AFFINE pubs;
+  EC_PRECOMP pubs_precomp;
+} PMBTOKEN_ISSUER_KEY;
+
+// PMBTOKEN_PRETOKEN represents the intermediate state a client keeps during a
+// PMBToken issuance operation.
+typedef struct pmb_pretoken_st {
+  uint8_t t[PMBTOKEN_NONCE_SIZE];
+  EC_SCALAR r;
+  EC_AFFINE Tp;
+} PMBTOKEN_PRETOKEN;
+
+// PMBTOKEN_PRETOKEN_free releases the memory associated with |token|.
+OPENSSL_EXPORT void PMBTOKEN_PRETOKEN_free(PMBTOKEN_PRETOKEN *token);
+
+DEFINE_STACK_OF(PMBTOKEN_PRETOKEN)
+
+// The following functions implement the corresponding |TRUST_TOKENS_METHOD|
+// functions for |TRUST_TOKENS_experiment_v0|'s PMBTokens construction which
+// uses P-521.
+int pmbtoken_exp0_generate_key(CBB *out_private, CBB *out_public);
+int pmbtoken_exp0_client_key_from_bytes(PMBTOKEN_CLIENT_KEY *key,
+                                        const uint8_t *in, size_t len);
+int pmbtoken_exp0_issuer_key_from_bytes(PMBTOKEN_ISSUER_KEY *key,
+                                        const uint8_t *in, size_t len);
+STACK_OF(PMBTOKEN_PRETOKEN) * pmbtoken_exp0_blind(CBB *cbb, size_t count);
+int pmbtoken_exp0_sign(const PMBTOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
+                       size_t num_requested, size_t num_to_issue,
+                       uint8_t private_metadata);
+STACK_OF(TRUST_TOKEN) *
+    pmbtoken_exp0_unblind(const PMBTOKEN_CLIENT_KEY *key,
+                          const STACK_OF(PMBTOKEN_PRETOKEN) * pretokens,
+                          CBS *cbs, size_t count, uint32_t key_id);
+int pmbtoken_exp0_read(const PMBTOKEN_ISSUER_KEY *key,
+                       uint8_t out_nonce[PMBTOKEN_NONCE_SIZE],
+                       uint8_t *out_private_metadata, const uint8_t *token,
+                       size_t token_len);
+
+// The following functions implement the corresponding |TRUST_TOKENS_METHOD|
+// functions for |TRUST_TOKENS_experiment_v1|'s PMBTokens construction which
+// uses P-384.
+//
+// We use P-384 instead of our usual choice of P-256. See Appendix I which
+// describes two attacks which may affect smaller curves. In particular, p-1 for
+// P-256 is smooth, giving a low complexity for the p-1 attack. P-384's p-1 has
+// a 281-bit prime factor,
+// 3055465788140352002733946906144561090641249606160407884365391979704929268480326390471.
+// This lower-bounds the p-1 attack at O(2^140). The p+1 attack is lower-bounded
+// by O(p^(1/3)) or O(2^128), so we do not need to check the smoothness of p+1.
+int pmbtoken_exp1_generate_key(CBB *out_private, CBB *out_public);
+int pmbtoken_exp1_client_key_from_bytes(PMBTOKEN_CLIENT_KEY *key,
+                                        const uint8_t *in, size_t len);
+int pmbtoken_exp1_issuer_key_from_bytes(PMBTOKEN_ISSUER_KEY *key,
+                                        const uint8_t *in, size_t len);
+STACK_OF(PMBTOKEN_PRETOKEN) * pmbtoken_exp1_blind(CBB *cbb, size_t count);
+int pmbtoken_exp1_sign(const PMBTOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
+                       size_t num_requested, size_t num_to_issue,
+                       uint8_t private_metadata);
+STACK_OF(TRUST_TOKEN) *
+    pmbtoken_exp1_unblind(const PMBTOKEN_CLIENT_KEY *key,
+                          const STACK_OF(PMBTOKEN_PRETOKEN) * pretokens,
+                          CBS *cbs, size_t count, uint32_t key_id);
+int pmbtoken_exp1_read(const PMBTOKEN_ISSUER_KEY *key,
+                       uint8_t out_nonce[PMBTOKEN_NONCE_SIZE],
+                       uint8_t *out_private_metadata, const uint8_t *token,
+                       size_t token_len);
+
+// pmbtoken_exp1_get_h_for_testing returns H in uncompressed coordinates. This
+// function is used to confirm H was computed as expected.
+OPENSSL_EXPORT int pmbtoken_exp1_get_h_for_testing(uint8_t out[97]);
+
+
+// Trust Tokens internals.
+
+struct trust_token_method_st {
+  // generate_key generates a fresh keypair and writes their serialized
+  // forms into |out_private| and |out_public|. It returns one on success and
+  // zero on failure.
+  int (*generate_key)(CBB *out_private, CBB *out_public);
+
+  // client_key_from_bytes decodes a client key from |in| and sets |key|
+  // to the resulting key. It returns one on success and zero
+  // on failure.
+  int (*client_key_from_bytes)(PMBTOKEN_CLIENT_KEY *key, const uint8_t *in,
+                               size_t len);
+
+  // issuer_key_from_bytes decodes a issuer key from |in| and sets |key|
+  // to the resulting key. It returns one on success and zero
+  // on failure.
+  int (*issuer_key_from_bytes)(PMBTOKEN_ISSUER_KEY *key, const uint8_t *in,
+                               size_t len);
+
+  // blind generates a new issuance request for |count| tokens. On
+  // success, it returns a newly-allocated |STACK_OF(PMBTOKEN_PRETOKEN)| and
+  // writes a request to the issuer to |cbb|. On failure, it returns NULL. The
+  // |STACK_OF(PMBTOKEN_PRETOKEN)|s should be passed to |pmbtoken_unblind| when
+  // the server responds.
+  //
+  // This function implements the AT.Usr0 operation.
+  STACK_OF(PMBTOKEN_PRETOKEN) *(*blind)(CBB *cbb, size_t count);
+
+  // sign parses a request for |num_requested| tokens from |cbs| and
+  // issues |num_to_issue| tokens with |key| and a private metadata value of
+  // |private_metadata|. It then writes the response to |cbb|. It returns one on
+  // success and zero on failure.
+  //
+  // This function implements the AT.Sig operation.
+  int (*sign)(const PMBTOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
+              size_t num_requested, size_t num_to_issue,
+              uint8_t private_metadata);
+
+  // unblind processes an issuance response for |count| tokens from |cbs|
+  // and unblinds the signed tokens. |pretokens| are the pre-tokens returned
+  // from the corresponding |blind| call. On success, the function returns a
+  // newly-allocated |STACK_OF(TRUST_TOKEN)| containing the resulting tokens.
+  // Each token's serialization will have |key_id| prepended. Otherwise, it
+  // returns NULL.
+  //
+  // This function implements the AT.Usr1 operation.
+  STACK_OF(TRUST_TOKEN) *
+      (*unblind)(const PMBTOKEN_CLIENT_KEY *key,
+                 const STACK_OF(PMBTOKEN_PRETOKEN) * pretokens, CBS *cbs,
+                 size_t count, uint32_t key_id);
+
+  // read parses a PMBToken from |token| and verifies it using |key|. On
+  // success, it returns one and stores the nonce and private metadata bit in
+  // |out_nonce| and |*out_private_metadata|. Otherwise, it returns zero. Note
+  // that, unlike the output of |unblind|, |token| does not have a
+  // four-byte key ID prepended.
+  int (*read)(const PMBTOKEN_ISSUER_KEY *key,
+              uint8_t out_nonce[PMBTOKEN_NONCE_SIZE],
+              uint8_t *out_private_metadata, const uint8_t *token,
+              size_t token_len);
+
+  // use_token_hash determines whether to include the token hash in the SRR and
+  // private metadata encryption.
+  int use_token_hash : 1;
+
+  // batched_proof determines whether PMBToken uses a batched DLEQOR proof when
+  // signing tokens.
+  int batched_proof : 1;
+};
+
+// Structure representing a single Trust Token public key with the specified ID.
+struct trust_token_client_key_st {
+  uint32_t id;
+  PMBTOKEN_CLIENT_KEY key;
+};
+
+// Structure representing a single Trust Token private key with the specified
+// ID.
+struct trust_token_issuer_key_st {
+  uint32_t id;
+  PMBTOKEN_ISSUER_KEY key;
+};
+
+struct trust_token_client_st {
+  const TRUST_TOKEN_METHOD *method;
+
+  // max_batchsize is the maximum supported batchsize.
+  uint16_t max_batchsize;
+
+  // keys is the set of public keys that are supported by the client for
+  // issuance/redemptions.
+  struct trust_token_client_key_st keys[3];
+
+  // num_keys is the number of keys currently configured.
+  size_t num_keys;
+
+  // pretokens is the intermediate state during an active issuance.
+  STACK_OF(PMBTOKEN_PRETOKEN)* pretokens;
+
+  // srr_key is the public key used to verify the signature of the SRR.
+  EVP_PKEY *srr_key;
+};
+
+
+struct trust_token_issuer_st {
+  const TRUST_TOKEN_METHOD *method;
+
+  // max_batchsize is the maximum supported batchsize.
+  uint16_t max_batchsize;
+
+  // keys is the set of private keys that are supported by the issuer for
+  // issuance/redemptions. The public metadata is an index into this list of
+  // keys.
+  struct trust_token_issuer_key_st keys[3];
+
+  // num_keys is the number of keys currently configured.
+  size_t num_keys;
+
+  // srr_key is the private key used to sign the SRR.
+  EVP_PKEY *srr_key;
+
+  // metadata_key is the secret material used to encode the private metadata bit
+  // in the SRR.
+  uint8_t *metadata_key;
+  size_t metadata_key_len;
+};
+
+
+#if defined(__cplusplus)
+}  // extern C
+
+extern "C++" {
+
+BSSL_NAMESPACE_BEGIN
+
+BORINGSSL_MAKE_DELETER(PMBTOKEN_PRETOKEN, PMBTOKEN_PRETOKEN_free)
+
+BSSL_NAMESPACE_END
+
+}  // extern C++
+#endif
+
+#endif  // OPENSSL_HEADER_TRUST_TOKEN_INTERNAL_H