grpc 1.37.1 → 1.38.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/gcm.c

@@ -73,7 +73,7 @@ static const size_t kSizeTWithoutLower4Bits = (size_t) -16;
 
 #if defined(GHASH_ASM_X86_64) || defined(GHASH_ASM_X86)
 static inline void gcm_reduce_1bit(u128 *V) {
-  if (sizeof(size_t) == 8) {
+  if (sizeof(crypto_word_t) == 8) {
     uint64_t T = UINT64_C(0xe100000000000000) & (0 - (V->hi & 1));
     V->hi = (V->lo << 63) | (V->hi >> 1);
     V->lo = (V->lo >> 1) ^ T;
@@ -377,9 +377,10 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
       (*block)(ctx->Yi.c, ctx->EKi.c, key);
       ++ctr;
       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);
-      for (size_t i = 0; i < 16; i += sizeof(size_t)) {
-        store_word_le(out + i,
-                      load_word_le(in + i) ^ ctx->EKi.t[i / sizeof(size_t)]);
+      for (size_t i = 0; i < 16; i += sizeof(crypto_word_t)) {
+        CRYPTO_store_word_le(out + i,
+                             CRYPTO_load_word_le(in + i) ^
+                                 ctx->EKi.t[i / sizeof(crypto_word_t)]);
       }
       out += 16;
       in += 16;
@@ -394,9 +395,10 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
       (*block)(ctx->Yi.c, ctx->EKi.c, key);
       ++ctr;
       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);
-      for (size_t i = 0; i < 16; i += sizeof(size_t)) {
-        store_word_le(out + i,
-                      load_word_le(in + i) ^ ctx->EKi.t[i / sizeof(size_t)]);
+      for (size_t i = 0; i < 16; i += sizeof(crypto_word_t)) {
+        CRYPTO_store_word_le(out + i,
+                             CRYPTO_load_word_le(in + i) ^
+                                 ctx->EKi.t[i / sizeof(crypto_word_t)]);
       }
       out += 16;
       in += 16;
@@ -468,9 +470,10 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
       (*block)(ctx->Yi.c, ctx->EKi.c, key);
       ++ctr;
       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);
-      for (size_t i = 0; i < 16; i += sizeof(size_t)) {
-        store_word_le(out + i,
-                      load_word_le(in + i) ^ ctx->EKi.t[i / sizeof(size_t)]);
+      for (size_t i = 0; i < 16; i += sizeof(crypto_word_t)) {
+        CRYPTO_store_word_le(out + i,
+                             CRYPTO_load_word_le(in + i) ^
+                                 ctx->EKi.t[i / sizeof(crypto_word_t)]);
       }
       out += 16;
       in += 16;
@@ -485,9 +488,10 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
       (*block)(ctx->Yi.c, ctx->EKi.c, key);
       ++ctr;
       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);
-      for (size_t i = 0; i < 16; i += sizeof(size_t)) {
-        store_word_le(out + i,
-                      load_word_le(in + i) ^ ctx->EKi.t[i / sizeof(size_t)]);
+      for (size_t i = 0; i < 16; i += sizeof(crypto_word_t)) {
+        CRYPTO_store_word_le(out + i,
+                             CRYPTO_load_word_le(in + i) ^
+                                 ctx->EKi.t[i / sizeof(crypto_word_t)]);
       }
       out += 16;
       in += 16;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/internal.h

@@ -64,27 +64,6 @@ extern "C" {
 #endif
 
 
-static inline uint32_t GETU32(const void *in) {
-  uint32_t v;
-  OPENSSL_memcpy(&v, in, sizeof(v));
-  return CRYPTO_bswap4(v);
-}
-
-static inline void PUTU32(void *out, uint32_t v) {
-  v = CRYPTO_bswap4(v);
-  OPENSSL_memcpy(out, &v, sizeof(v));
-}
-
-static inline size_t load_word_le(const void *in) {
-  size_t v;
-  OPENSSL_memcpy(&v, in, sizeof(v));
-  return v;
-}
-
-static inline void store_word_le(void *out, size_t v) {
-  OPENSSL_memcpy(out, &v, sizeof(v));
-}
-
 // block128_f is the type of an AES block cipher implementation.
 //
 // Unlike upstream OpenSSL, it and the other functions in this file hard-code
@@ -171,7 +150,7 @@ typedef struct {
     uint64_t u[2];
     uint32_t d[4];
     uint8_t c[16];
-    size_t t[16 / sizeof(size_t)];
+    crypto_word_t t[16 / sizeof(crypto_word_t)];
   } Yi, EKi, EK0, len, Xi;
 
   // Note that the order of |Xi| and |gcm_key| is fixed by the MOVBE-based,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/ofb.c

@@ -60,7 +60,8 @@ OPENSSL_STATIC_ASSERT(16 % sizeof(size_t) == 0,
 void CRYPTO_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                            const AES_KEY *key, uint8_t ivec[16], unsigned *num,
                            block128_f block) {
-  assert(in && out && key && ivec && num);
+  assert(key != NULL && ivec != NULL && num != NULL);
+  assert(len == 0 || (in != NULL && out != NULL));
 
   unsigned n = *num;
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/urandom.c

@@ -62,6 +62,15 @@
 #include <sys/random.h>
 #endif
 
+#if defined(OPENSSL_FREEBSD)
+#define URANDOM_BLOCKS_FOR_ENTROPY
+#if __FreeBSD__ >= 12
+// getrandom is supported in FreeBSD 12 and up.
+#define FREEBSD_GETRANDOM
+#include <sys/random.h>
+#endif
+#endif
+
 #include <openssl/thread.h>
 #include <openssl/mem.h>
 
@@ -176,6 +185,11 @@ static void init_once(void) {
   }
 #endif
 
+#if defined(FREEBSD_GETRANDOM)
+  *urandom_fd_bss_get() = kHaveGetrandom;
+  return;
+#endif
+
   // Android FIPS builds must support getrandom.
 #if defined(BORINGSSL_FIPS) && defined(OPENSSL_ANDROID)
   perror("getrandom not found");
@@ -256,11 +270,11 @@ static void wait_for_entropy(void) {
     return;
   }
 
-#if defined(BORINGSSL_FIPS)
-  // In FIPS mode we ensure that the kernel has sufficient entropy before
-  // continuing. This is automatically handled by getrandom, which requires
-  // that the entropy pool has been initialised, but for urandom we have to
-  // poll.
+#if defined(BORINGSSL_FIPS) && !defined(URANDOM_BLOCKS_FOR_ENTROPY)
+  // In FIPS mode on platforms where urandom doesn't block at startup, we ensure
+  // that the kernel has sufficient entropy before continuing. This is
+  // automatically handled by getrandom, which requires that the entropy pool
+  // has been initialised, but for urandom we have to poll.
   for (;;) {
     int entropy_bits;
     if (ioctl(fd, RNDGETENTCNT, &entropy_bits)) {
@@ -277,7 +291,7 @@ static void wait_for_entropy(void) {
 
     usleep(250000);
   }
-#endif  // BORINGSSL_FIPS
+#endif  // BORINGSSL_FIPS && !URANDOM_BLOCKS_FOR_ENTROPY
 }
 
 // fill_with_entropy writes |len| bytes of entropy into |out|. It returns one
@@ -291,11 +305,14 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
     return 1;
   }
 
-#if defined(USE_NR_getrandom)
+#if defined(USE_NR_getrandom) || defined(FREEBSD_GETRANDOM)
   int getrandom_flags = 0;
   if (!block) {
     getrandom_flags |= GRND_NONBLOCK;
   }
+#endif
+
+#if defined (USE_NR_getrandom)
   if (seed) {
     getrandom_flags |= *extra_getrandom_flags_for_seed_bss_get();
   }
@@ -315,6 +332,8 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
     if (*urandom_fd_bss_get() == kHaveGetrandom) {
 #if defined(USE_NR_getrandom)
       r = boringssl_getrandom(out, len, getrandom_flags);
+#elif defined(FREEBSD_GETRANDOM)
+      r = getrandom(out, len, getrandom_flags);
 #elif defined(OPENSSL_MACOS)
       if (__builtin_available(macos 10.12, *)) {
         // |getentropy| can only request 256 bytes at a time.

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/self_check/fips.c

@@ -0,0 +1,79 @@
+/* Copyright (c) 2017, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/crypto.h>
+
+#include "../../internal.h"
+#include "../delocate.h"
+
+
+int FIPS_mode(void) {
+#if defined(BORINGSSL_FIPS) && !defined(OPENSSL_ASAN)
+  return 1;
+#else
+  return 0;
+#endif
+}
+
+int FIPS_mode_set(int on) { return on == FIPS_mode(); }
+
+#if defined(BORINGSSL_FIPS_COUNTERS)
+
+size_t FIPS_read_counter(enum fips_counter_t counter) {
+  if (counter < 0 || counter > fips_counter_max) {
+    abort();
+  }
+
+  const size_t *array =
+      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS);
+  if (!array) {
+    return 0;
+  }
+
+  return array[counter];
+}
+
+void boringssl_fips_inc_counter(enum fips_counter_t counter) {
+  if (counter < 0 || counter > fips_counter_max) {
+    abort();
+  }
+
+  size_t *array =
+      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS);
+  if (!array) {
+    const size_t num_bytes = sizeof(size_t) * (fips_counter_max + 1);
+    array = OPENSSL_malloc(num_bytes);
+    if (!array) {
+      return;
+    }
+
+    OPENSSL_memset(array, 0, num_bytes);
+    if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS, array,
+                                 OPENSSL_free)) {
+      // |OPENSSL_free| has already been called by |CRYPTO_set_thread_local|.
+      return;
+    }
+  }
+
+  array[counter]++;
+}
+
+#else
+
+size_t FIPS_read_counter(enum fips_counter_t counter) { return 0; }
+
+// boringssl_fips_inc_counter is a no-op, inline function in internal.h in this
+// case. That should let the compiler optimise away the callsites.
+
+#endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/self_check/self_check.c

@@ -32,13 +32,20 @@
 
 #include "../../internal.h"
 #include "../ec/internal.h"
+#include "../ecdsa/internal.h"
 #include "../rand/internal.h"
 #include "../tls/internal.h"
 
 
 // MSVC wants to put a NUL byte at the end of non-char arrays and so cannot
-// compile this.
-#if !defined(_MSC_VER)
+// compile the real logic.
+#if defined(_MSC_VER)
+
+int BORINGSSL_self_test(void) {
+  return 0;
+}
+
+#else
 
 #if defined(BORINGSSL_FIPS) && defined(OPENSSL_ANDROID)
 // FIPS builds on Android will test for flag files, named after the module hash,
@@ -727,14 +734,12 @@ int boringssl_fips_self_test(
   // ECDSA Sign/Verify KAT
 
   // The 'k' value for ECDSA is fixed to avoid an entropy draw.
-  ec_key->fixed_k = BN_new();
-  if (ec_key->fixed_k == NULL ||
-      !BN_set_word(ec_key->fixed_k, 42)) {
-    fprintf(stderr, "Out of memory\n");
-    goto err;
-  }
+  uint8_t ecdsa_k[32] = {0};
+  ecdsa_k[31] = 42;
 
-  sig = ECDSA_do_sign(kPlaintextSHA256, sizeof(kPlaintextSHA256), ec_key);
+  sig = ecdsa_sign_with_nonce_for_known_answer_test(
+      kPlaintextSHA256, sizeof(kPlaintextSHA256), ec_key, ecdsa_k,
+      sizeof(ecdsa_k));
 
   uint8_t ecdsa_r_bytes[sizeof(kECDSASigR)];
   uint8_t ecdsa_s_bytes[sizeof(kECDSASigS)];

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha1.c

@@ -88,19 +88,18 @@ uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH]) {
 #define HASH_CTX                SHA_CTX
 #define HASH_CBLOCK             64
 #define HASH_DIGEST_LENGTH      20
-#define HASH_MAKE_STRING(c, s) \
-  do {                         \
-    uint32_t ll;               \
-    ll = (c)->h[0];            \
-    HOST_l2c(ll, (s));         \
-    ll = (c)->h[1];            \
-    HOST_l2c(ll, (s));         \
-    ll = (c)->h[2];            \
-    HOST_l2c(ll, (s));         \
-    ll = (c)->h[3];            \
-    HOST_l2c(ll, (s));         \
-    ll = (c)->h[4];            \
-    HOST_l2c(ll, (s));         \
+#define HASH_MAKE_STRING(c, s)           \
+  do {                                   \
+    CRYPTO_store_u32_be((s), (c)->h[0]); \
+    (s) += 4;                            \
+    CRYPTO_store_u32_be((s), (c)->h[1]); \
+    (s) += 4;                            \
+    CRYPTO_store_u32_be((s), (c)->h[2]); \
+    (s) += 4;                            \
+    CRYPTO_store_u32_be((s), (c)->h[3]); \
+    (s) += 4;                            \
+    CRYPTO_store_u32_be((s), (c)->h[4]); \
+    (s) += 4;                            \
   } while (0)
 
 #define HASH_UPDATE SHA1_Update
@@ -193,7 +192,7 @@ static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
 #if !defined(SHA1_ASM)
 static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
                                   size_t num) {
-  register uint32_t A, B, C, D, E, T, l;
+  register uint32_t A, B, C, D, E, T;
   uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
       XX11, XX12, XX13, XX14, XX15;
 
@@ -204,52 +203,52 @@ static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
   E = state[4];
 
   for (;;) {
-    HOST_c2l(data, l);
-    X(0) = l;
-    HOST_c2l(data, l);
-    X(1) = l;
+    X(0) = CRYPTO_load_u32_be(data);
+    data += 4;
+    X(1) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(0, A, B, C, D, E, T, X(0));
-    HOST_c2l(data, l);
-    X(2) = l;
+    X(2) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(1, T, A, B, C, D, E, X(1));
-    HOST_c2l(data, l);
-    X(3) = l;
+    X(3) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(2, E, T, A, B, C, D, X(2));
-    HOST_c2l(data, l);
-    X(4) = l;
+    X(4) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(3, D, E, T, A, B, C, X(3));
-    HOST_c2l(data, l);
-    X(5) = l;
+    X(5) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(4, C, D, E, T, A, B, X(4));
-    HOST_c2l(data, l);
-    X(6) = l;
+    X(6) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(5, B, C, D, E, T, A, X(5));
-    HOST_c2l(data, l);
-    X(7) = l;
+    X(7) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(6, A, B, C, D, E, T, X(6));
-    HOST_c2l(data, l);
-    X(8) = l;
+    X(8) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(7, T, A, B, C, D, E, X(7));
-    HOST_c2l(data, l);
-    X(9) = l;
+    X(9) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(8, E, T, A, B, C, D, X(8));
-    HOST_c2l(data, l);
-    X(10) = l;
+    X(10) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(9, D, E, T, A, B, C, X(9));
-    HOST_c2l(data, l);
-    X(11) = l;
+    X(11) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(10, C, D, E, T, A, B, X(10));
-    HOST_c2l(data, l);
-    X(12) = l;
+    X(12) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(11, B, C, D, E, T, A, X(11));
-    HOST_c2l(data, l);
-    X(13) = l;
+    X(13) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(12, A, B, C, D, E, T, X(12));
-    HOST_c2l(data, l);
-    X(14) = l;
+    X(14) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(13, T, A, B, C, D, E, X(13));
-    HOST_c2l(data, l);
-    X(15) = l;
+    X(15) = CRYPTO_load_u32_be(data);
+    data += 4;
     BODY_00_15(14, E, T, A, B, C, D, X(14));
     BODY_00_15(15, D, E, T, A, B, C, X(15));
 
@@ -367,5 +366,3 @@ static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
 #undef BODY_40_59
 #undef BODY_60_79
 #undef X
-#undef HOST_c2l
-#undef HOST_l2c

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha256.c

@@ -139,19 +139,18 @@ int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *ctx) {
 // hash 'final' function can fail. This should never happen.
 #define HASH_MAKE_STRING(c, s)                              \
   do {                                                      \
-    uint32_t ll;                                            \
     unsigned int nn;                                        \
     switch ((c)->md_len) {                                  \
       case SHA224_DIGEST_LENGTH:                            \
         for (nn = 0; nn < SHA224_DIGEST_LENGTH / 4; nn++) { \
-          ll = (c)->h[nn];                                  \
-          HOST_l2c(ll, (s));                                \
+          CRYPTO_store_u32_be((s), (c)->h[nn]);             \
+          (s) += 4;                                         \
         }                                                   \
         break;                                              \
       case SHA256_DIGEST_LENGTH:                            \
         for (nn = 0; nn < SHA256_DIGEST_LENGTH / 4; nn++) { \
-          ll = (c)->h[nn];                                  \
-          HOST_l2c(ll, (s));                                \
+          CRYPTO_store_u32_be((s), (c)->h[nn]);             \
+          (s) += 4;                                         \
         }                                                   \
         break;                                              \
       default:                                              \
@@ -159,8 +158,8 @@ int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *ctx) {
           return 0;                                         \
         }                                                   \
         for (nn = 0; nn < (c)->md_len / 4; nn++) {          \
-          ll = (c)->h[nn];                                  \
-          HOST_l2c(ll, (s));                                \
+          CRYPTO_store_u32_be((s), (c)->h[nn]);             \
+          (s) += 4;                                         \
         }                                                   \
         break;                                              \
     }                                                       \
@@ -241,55 +240,53 @@ static void sha256_block_data_order(uint32_t *state, const uint8_t *data,
     g = state[6];
     h = state[7];
 
-    uint32_t l;
-
-    HOST_c2l(data, l);
-    T1 = X[0] = l;
+    T1 = X[0] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(0, a, b, c, d, e, f, g, h);
-    HOST_c2l(data, l);
-    T1 = X[1] = l;
+    T1 = X[1] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(1, h, a, b, c, d, e, f, g);
-    HOST_c2l(data, l);
-    T1 = X[2] = l;
+    T1 = X[2] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(2, g, h, a, b, c, d, e, f);
-    HOST_c2l(data, l);
-    T1 = X[3] = l;
+    T1 = X[3] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(3, f, g, h, a, b, c, d, e);
-    HOST_c2l(data, l);
-    T1 = X[4] = l;
+    T1 = X[4] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(4, e, f, g, h, a, b, c, d);
-    HOST_c2l(data, l);
-    T1 = X[5] = l;
+    T1 = X[5] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(5, d, e, f, g, h, a, b, c);
-    HOST_c2l(data, l);
-    T1 = X[6] = l;
+    T1 = X[6] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(6, c, d, e, f, g, h, a, b);
-    HOST_c2l(data, l);
-    T1 = X[7] = l;
+    T1 = X[7] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(7, b, c, d, e, f, g, h, a);
-    HOST_c2l(data, l);
-    T1 = X[8] = l;
+    T1 = X[8] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(8, a, b, c, d, e, f, g, h);
-    HOST_c2l(data, l);
-    T1 = X[9] = l;
+    T1 = X[9] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(9, h, a, b, c, d, e, f, g);
-    HOST_c2l(data, l);
-    T1 = X[10] = l;
+    T1 = X[10] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(10, g, h, a, b, c, d, e, f);
-    HOST_c2l(data, l);
-    T1 = X[11] = l;
+    T1 = X[11] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(11, f, g, h, a, b, c, d, e);
-    HOST_c2l(data, l);
-    T1 = X[12] = l;
+    T1 = X[12] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(12, e, f, g, h, a, b, c, d);
-    HOST_c2l(data, l);
-    T1 = X[13] = l;
+    T1 = X[13] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(13, d, e, f, g, h, a, b, c);
-    HOST_c2l(data, l);
-    T1 = X[14] = l;
+    T1 = X[14] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(14, c, d, e, f, g, h, a, b);
-    HOST_c2l(data, l);
-    T1 = X[15] = l;
+    T1 = X[15] = CRYPTO_load_u32_be(data);
+    data += 4;
     ROUND_00_15(15, b, c, d, e, f, g, h, a);
 
     for (i = 16; i < 64; i += 8) {
@@ -339,5 +336,3 @@ void SHA256_TransformBlocks(uint32_t state[8], const uint8_t *data,
 #undef Maj
 #undef ROUND_00_15
 #undef ROUND_16_63
-#undef HOST_c2l
-#undef HOST_l2c