grpc 1.53.1 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256.c

@@ -22,7 +22,6 @@
 #include <openssl/ec.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/type_check.h>
 
 #include <assert.h>
 #include <string.h>
@@ -31,8 +30,6 @@
 #include "../delocate.h"
 #include "./internal.h"
 
-
-// MSVC does not implement uint128_t, and crashes with intrinsics
 #if defined(BORINGSSL_HAS_UINT128)
 #define BORINGSSL_NISTP256_64BIT 1
 #include "../../../third_party/fiat/p256_64.h"
@@ -79,17 +76,22 @@ static void fiat_p256_cmovznz(fiat_p256_limb_t out[FIAT_P256_NLIMBS],
   fiat_p256_selectznz(out, !!t, z, nz);
 }
 
+static void fiat_p256_from_words(fiat_p256_felem out,
+                                 const BN_ULONG in[32 / sizeof(BN_ULONG)]) {
+  // Typically, |BN_ULONG| and |fiat_p256_limb_t| will be the same type, but on
+  // 64-bit platforms without |uint128_t|, they are different. However, on
+  // little-endian systems, |uint64_t[4]| and |uint32_t[8]| have the same
+  // layout.
+  OPENSSL_memcpy(out, in, 32);
+}
+
 static void fiat_p256_from_generic(fiat_p256_felem out, const EC_FELEM *in) {
-  fiat_p256_from_bytes(out, in->bytes);
+  fiat_p256_from_words(out, in->words);
 }
 
 static void fiat_p256_to_generic(EC_FELEM *out, const fiat_p256_felem in) {
-  // This works because 256 is a multiple of 64, so there are no excess bytes to
-  // zero when rounding up to |BN_ULONG|s.
-  OPENSSL_STATIC_ASSERT(
-      256 / 8 == sizeof(BN_ULONG) * ((256 + BN_BITS2 - 1) / BN_BITS2),
-      "fiat_p256_to_bytes leaves bytes uninitialized");
-  fiat_p256_to_bytes(out->bytes, in);
+  // See |fiat_p256_from_words|.
+  OPENSSL_memcpy(out->words, in, 32);
 }
 
 // fiat_p256_inv_square calculates |out| = |in|^{-2}
@@ -392,12 +394,18 @@ static void fiat_p256_select_point(const fiat_p256_limb_t idx, size_t size,
   }
 }
 
-// fiat_p256_get_bit returns the |i|th bit in |in|
-static crypto_word_t fiat_p256_get_bit(const uint8_t *in, int i) {
+// fiat_p256_get_bit returns the |i|th bit in |in|.
+static crypto_word_t fiat_p256_get_bit(const EC_SCALAR *in, int i) {
   if (i < 0 || i >= 256) {
     return 0;
   }
-  return (in[i >> 3] >> (i & 7)) & 1;
+#if defined(OPENSSL_64_BIT)
+  static_assert(sizeof(BN_ULONG) == 8, "BN_ULONG was not 64-bit");
+  return (in->words[i >> 6] >> (i & 63)) & 1;
+#else
+  static_assert(sizeof(BN_ULONG) == 4, "BN_ULONG was not 32-bit");
+  return (in->words[i >> 5] >> (i & 31)) & 1;
+#endif
 }
 
 // OPENSSL EC_METHOD FUNCTIONS
@@ -498,12 +506,12 @@ static void ec_GFp_nistp256_point_mul(const EC_GROUP *group, EC_RAW_POINT *r,
 
     // do other additions every 5 doublings
     if (i % 5 == 0) {
-      crypto_word_t bits = fiat_p256_get_bit(scalar->bytes, i + 4) << 5;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 3) << 4;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 2) << 3;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 1) << 2;
-      bits |= fiat_p256_get_bit(scalar->bytes, i) << 1;
-      bits |= fiat_p256_get_bit(scalar->bytes, i - 1);
+      crypto_word_t bits = fiat_p256_get_bit(scalar, i + 4) << 5;
+      bits |= fiat_p256_get_bit(scalar, i + 3) << 4;
+      bits |= fiat_p256_get_bit(scalar, i + 2) << 3;
+      bits |= fiat_p256_get_bit(scalar, i + 1) << 2;
+      bits |= fiat_p256_get_bit(scalar, i) << 1;
+      bits |= fiat_p256_get_bit(scalar, i - 1);
       crypto_word_t sign, digit;
       ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);
 
@@ -543,10 +551,10 @@ static void ec_GFp_nistp256_point_mul_base(const EC_GROUP *group,
     }
 
     // First, look 32 bits upwards.
-    crypto_word_t bits = fiat_p256_get_bit(scalar->bytes, i + 224) << 3;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 160) << 2;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 96) << 1;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 32);
+    crypto_word_t bits = fiat_p256_get_bit(scalar, i + 224) << 3;
+    bits |= fiat_p256_get_bit(scalar, i + 160) << 2;
+    bits |= fiat_p256_get_bit(scalar, i + 96) << 1;
+    bits |= fiat_p256_get_bit(scalar, i + 32);
     // Select the point to add, in constant time.
     fiat_p256_select_point_affine((fiat_p256_limb_t)bits, 15,
                                   fiat_p256_g_pre_comp[1], tmp);
@@ -562,10 +570,10 @@ static void ec_GFp_nistp256_point_mul_base(const EC_GROUP *group,
     }
 
     // Second, look at the current position.
-    bits = fiat_p256_get_bit(scalar->bytes, i + 192) << 3;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 128) << 2;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 64) << 1;
-    bits |= fiat_p256_get_bit(scalar->bytes, i);
+    bits = fiat_p256_get_bit(scalar, i + 192) << 3;
+    bits |= fiat_p256_get_bit(scalar, i + 128) << 2;
+    bits |= fiat_p256_get_bit(scalar, i + 64) << 1;
+    bits |= fiat_p256_get_bit(scalar, i);
     // Select the point to add, in constant time.
     fiat_p256_select_point_affine((fiat_p256_limb_t)bits, 15,
                                   fiat_p256_g_pre_comp[0], tmp);
@@ -615,10 +623,10 @@ static void ec_GFp_nistp256_point_mul_public(const EC_GROUP *group,
     // constant-time lookup.
     if (i <= 31) {
       // First, look 32 bits upwards.
-      crypto_word_t bits = fiat_p256_get_bit(g_scalar->bytes, i + 224) << 3;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 160) << 2;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 96) << 1;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 32);
+      crypto_word_t bits = fiat_p256_get_bit(g_scalar, i + 224) << 3;
+      bits |= fiat_p256_get_bit(g_scalar, i + 160) << 2;
+      bits |= fiat_p256_get_bit(g_scalar, i + 96) << 1;
+      bits |= fiat_p256_get_bit(g_scalar, i + 32);
       if (bits != 0) {
         size_t index = (size_t)(bits - 1);
         fiat_p256_point_add(ret[0], ret[1], ret[2], ret[0], ret[1], ret[2],
@@ -629,10 +637,10 @@ static void ec_GFp_nistp256_point_mul_public(const EC_GROUP *group,
       }
 
       // Second, look at the current position.
-      bits = fiat_p256_get_bit(g_scalar->bytes, i + 192) << 3;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 128) << 2;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 64) << 1;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i);
+      bits = fiat_p256_get_bit(g_scalar, i + 192) << 3;
+      bits |= fiat_p256_get_bit(g_scalar, i + 128) << 2;
+      bits |= fiat_p256_get_bit(g_scalar, i + 64) << 1;
+      bits |= fiat_p256_get_bit(g_scalar, i);
       if (bits != 0) {
         size_t index = (size_t)(bits - 1);
         fiat_p256_point_add(ret[0], ret[1], ret[2], ret[0], ret[1], ret[2],
@@ -685,7 +693,7 @@ static int ec_GFp_nistp256_cmp_x_coordinate(const EC_GROUP *group,
   fiat_p256_mul(Z2_mont, Z2_mont, Z2_mont);
 
   fiat_p256_felem r_Z2;
-  fiat_p256_from_bytes(r_Z2, r->bytes);  // r < order < p, so this is valid.
+  fiat_p256_from_words(r_Z2, r->words);  // r < order < p, so this is valid.
   fiat_p256_mul(r_Z2, r_Z2, Z2_mont);
 
   fiat_p256_felem X;
@@ -731,6 +739,10 @@ DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistp256_method) {
   out->felem_sqr = ec_GFp_mont_felem_sqr;
   out->felem_to_bytes = ec_GFp_mont_felem_to_bytes;
   out->felem_from_bytes = ec_GFp_mont_felem_from_bytes;
+  out->felem_reduce = ec_GFp_mont_felem_reduce;
+  // TODO(davidben): This should use the specialized field arithmetic
+  // implementation, rather than the generic one.
+  out->felem_exp = ec_GFp_mont_felem_exp;
   out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery;
   out->scalar_to_montgomery_inv_vartime =
       ec_simple_scalar_to_montgomery_inv_vartime;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/scalar.c

@@ -54,9 +54,7 @@ int ec_random_nonzero_scalar(const EC_GROUP *group, EC_SCALAR *out,
 void ec_scalar_to_bytes(const EC_GROUP *group, uint8_t *out, size_t *out_len,
                         const EC_SCALAR *in) {
   size_t len = BN_num_bytes(&group->order);
-  for (size_t i = 0; i < len; i++) {
-    out[len - i - 1] = in->bytes[i];
-  }
+  bn_words_to_big_endian(out, len, in->words, group->order.width);
   *out_len = len;
 }
 
@@ -67,11 +65,7 @@ int ec_scalar_from_bytes(const EC_GROUP *group, EC_SCALAR *out,
     return 0;
   }
 
-  OPENSSL_memset(out, 0, sizeof(EC_SCALAR));
-
-  for (size_t i = 0; i < len; i++) {
-    out->bytes[i] = in[len - i - 1];
-  }
+  bn_big_endian_to_words(out->words, group->order.width, in, len);
 
   if (!bn_less_than_words(out->words, group->order.d, group->order.width)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR);

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/simple.c

@@ -330,9 +330,7 @@ int ec_GFp_simple_cmp_x_coordinate(const EC_GROUP *group, const EC_RAW_POINT *p,
 void ec_GFp_simple_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
                                   size_t *out_len, const EC_FELEM *in) {
   size_t len = BN_num_bytes(&group->field);
-  for (size_t i = 0; i < len; i++) {
-    out[i] = in->bytes[len - 1 - i];
-  }
+  bn_words_to_big_endian(out, len, in->words, group->field.width);
   *out_len = len;
 }
 
@@ -343,10 +341,7 @@ int ec_GFp_simple_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out,
     return 0;
   }
 
-  OPENSSL_memset(out, 0, sizeof(EC_FELEM));
-  for (size_t i = 0; i < len; i++) {
-    out->bytes[i] = in[len - 1 - i];
-  }
+  bn_big_endian_to_words(out->words, group->field.width, in, len);
 
   if (!bn_less_than_words(out->words, group->field.d, group->field.width)) {
     OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/simple_mul.c

@@ -202,9 +202,8 @@ int ec_GFp_mont_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
 
   // Store the comb in affine coordinates to shrink the table. (This reduces
   // cache pressure and makes the constant-time selects faster.)
-  OPENSSL_STATIC_ASSERT(
-      OPENSSL_ARRAY_SIZE(comb) == OPENSSL_ARRAY_SIZE(out->comb),
-      "comb sizes did not match");
+  static_assert(OPENSSL_ARRAY_SIZE(comb) == OPENSSL_ARRAY_SIZE(out->comb),
+                "comb sizes did not match");
   return ec_jacobian_to_affine_batch(group, out->comb, comb,
                                      OPENSSL_ARRAY_SIZE(comb));
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/wnaf.c

@@ -205,7 +205,6 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_RAW_POINT *r,
     wNAF_alloc = OPENSSL_malloc(num * sizeof(wNAF_alloc[0]));
     precomp_alloc = OPENSSL_malloc(num * sizeof(precomp_alloc[0]));
     if (wNAF_alloc == NULL || precomp_alloc == NULL) {
-      OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE);
       goto err;
     }
     wNAF = wNAF_alloc;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdh/ecdh.c

@@ -74,11 +74,15 @@
 #include <openssl/mem.h>
 #include <openssl/sha.h>
 
+#include "../../internal.h"
 #include "../ec/internal.h"
+#include "../service_indicator/internal.h"
 
 
 int ECDH_compute_key_fips(uint8_t *out, size_t out_len, const EC_POINT *pub_key,
                           const EC_KEY *priv_key) {
+  boringssl_ensure_ecc_self_test();
+
   if (priv_key->priv_key == NULL) {
     OPENSSL_PUT_ERROR(ECDH, ECDH_R_NO_PRIVATE_VALUE);
     return 0;
@@ -100,6 +104,7 @@ int ECDH_compute_key_fips(uint8_t *out, size_t out_len, const EC_POINT *pub_key,
     return 0;
   }
 
+  FIPS_service_indicator_lock_state();
   switch (out_len) {
     case SHA224_DIGEST_LENGTH:
       SHA224(buf, buflen, out);
@@ -115,8 +120,11 @@ int ECDH_compute_key_fips(uint8_t *out, size_t out_len, const EC_POINT *pub_key,
       break;
     default:
       OPENSSL_PUT_ERROR(ECDH, ECDH_R_UNKNOWN_DIGEST_LENGTH);
+      FIPS_service_indicator_unlock_state();
       return 0;
   }
+  FIPS_service_indicator_unlock_state();
 
+  ECDH_verify_service_indicator(priv_key);
   return 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/ecdsa.c

@@ -59,11 +59,11 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/sha.h>
-#include <openssl/type_check.h>
 
 #include "../../internal.h"
 #include "../bn/internal.h"
 #include "../ec/internal.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 
@@ -78,10 +78,7 @@ static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   if (digest_len > num_bytes) {
     digest_len = num_bytes;
   }
-  OPENSSL_memset(out, 0, sizeof(EC_SCALAR));
-  for (size_t i = 0; i < digest_len; i++) {
-    out->bytes[i] = digest[digest_len - 1 - i];
-  }
+  bn_big_endian_to_words(out->words, order->width, digest, digest_len);
 
   // If it is still too long, truncate remaining bits with a shift.
   if (8 * digest_len > num_bits) {
@@ -151,8 +148,8 @@ int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
   return 1;
 }
 
-int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
-                    const ECDSA_SIG *sig, const EC_KEY *eckey) {
+int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
+                                 const ECDSA_SIG *sig, const EC_KEY *eckey) {
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   const EC_POINT *pub_key = EC_KEY_get0_public_key(eckey);
   if (group == NULL || pub_key == NULL || sig == NULL) {
@@ -198,6 +195,13 @@ int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
   return 1;
 }
 
+int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
+                    const ECDSA_SIG *sig, const EC_KEY *eckey) {
+  boringssl_ensure_ecc_self_test();
+
+  return ecdsa_do_verify_no_self_test(digest, digest_len, sig, eckey);
+}
+
 static ECDSA_SIG *ecdsa_sign_impl(const EC_GROUP *group, int *out_retry,
                                   const EC_SCALAR *priv_key, const EC_SCALAR *k,
                                   const uint8_t *digest, size_t digest_len) {
@@ -292,12 +296,16 @@ ECDSA_SIG *ecdsa_sign_with_nonce_for_known_answer_test(const uint8_t *digest,
 ECDSA_SIG *ECDSA_sign_with_nonce_and_leak_private_key_for_testing(
     const uint8_t *digest, size_t digest_len, const EC_KEY *eckey,
     const uint8_t *nonce, size_t nonce_len) {
+  boringssl_ensure_ecc_self_test();
+
   return ecdsa_sign_with_nonce_for_known_answer_test(digest, digest_len, eckey,
                                                      nonce, nonce_len);
 }
 
 ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
                          const EC_KEY *eckey) {
+  boringssl_ensure_ecc_self_test();
+
   if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED);
     return NULL;
@@ -313,8 +321,11 @@ ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
 
   // Pass a SHA512 hash of the private key and digest as additional data
   // into the RBG. This is a hardening measure against entropy failure.
-  OPENSSL_STATIC_ASSERT(SHA512_DIGEST_LENGTH >= 32,
-                        "additional_data is too large for SHA-512");
+  static_assert(SHA512_DIGEST_LENGTH >= 32,
+                "additional_data is too large for SHA-512");
+
+  FIPS_service_indicator_lock_state();
+
   SHA512_CTX sha;
   uint8_t additional_data[SHA512_DIGEST_LENGTH];
   SHA512_Init(&sha);
@@ -322,17 +333,34 @@ ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
   SHA512_Update(&sha, digest, digest_len);
   SHA512_Final(additional_data, &sha);
 
+  // Cap iterations so callers who supply invalid values as custom groups do not
+  // infinite loop. This does not impact valid parameters (e.g. those covered by
+  // FIPS) because the probability of requiring even one retry is negligible,
+  // let alone 32.
+  static const int kMaxIterations = 32;
+  ECDSA_SIG *ret = NULL;
+  int iters = 0;
   for (;;) {
     EC_SCALAR k;
     if (!ec_random_nonzero_scalar(group, &k, additional_data)) {
-      return NULL;
+      ret = NULL;
+      goto out;
     }
 
     int retry;
-    ECDSA_SIG *sig =
-        ecdsa_sign_impl(group, &retry, priv_key, &k, digest, digest_len);
-    if (sig != NULL || !retry) {
-      return sig;
+    ret = ecdsa_sign_impl(group, &retry, priv_key, &k, digest, digest_len);
+    if (ret != NULL || !retry) {
+      goto out;
+    }
+
+    iters++;
+    if (iters > kMaxIterations) {
+      OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_TOO_MANY_ITERATIONS);
+      goto out;
     }
   }
+
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/internal.h

@@ -31,6 +31,12 @@ ECDSA_SIG *ecdsa_sign_with_nonce_for_known_answer_test(const uint8_t *digest,
                                                        const uint8_t *nonce,
                                                        size_t nonce_len);
 
+// ecdsa_do_verify_no_self_test does the same as |ECDSA_do_verify|, but doesn't
+// try to run the self-test first. This is for use in the self tests themselves,
+// to prevent an infinite loop.
+int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
+                                 const ECDSA_SIG *sig, const EC_KEY *eckey);
+
 
 #if defined(__cplusplus)
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/hmac/hmac.c

@@ -63,6 +63,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 uint8_t *HMAC(const EVP_MD *evp_md, const void *key, size_t key_len,
@@ -70,13 +71,22 @@ uint8_t *HMAC(const EVP_MD *evp_md, const void *key, size_t key_len,
               unsigned int *out_len) {
   HMAC_CTX ctx;
   HMAC_CTX_init(&ctx);
-  if (!HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) ||
-      !HMAC_Update(&ctx, data, data_len) ||
-      !HMAC_Final(&ctx, out, out_len)) {
-    out = NULL;
-  }
+
+  // The underlying hash functions should not set the FIPS service indicator
+  // until all operations have completed.
+  FIPS_service_indicator_lock_state();
+  const int ok = HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) &&
+                 HMAC_Update(&ctx, data, data_len) &&
+                 HMAC_Final(&ctx, out, out_len);
+  FIPS_service_indicator_unlock_state();
 
   HMAC_CTX_cleanup(&ctx);
+
+  if (!ok) {
+    return NULL;
+  }
+
+  HMAC_verify_service_indicator(evp_md);
   return out;
 }
 
@@ -102,6 +112,13 @@ void HMAC_CTX_cleanup(HMAC_CTX *ctx) {
   OPENSSL_cleanse(ctx, sizeof(HMAC_CTX));
 }
 
+void HMAC_CTX_cleanse(HMAC_CTX *ctx) {
+  EVP_MD_CTX_cleanse(&ctx->i_ctx);
+  EVP_MD_CTX_cleanse(&ctx->o_ctx);
+  EVP_MD_CTX_cleanse(&ctx->md_ctx);
+  OPENSSL_cleanse(ctx, sizeof(HMAC_CTX));
+}
+
 void HMAC_CTX_free(HMAC_CTX *ctx) {
   if (ctx == NULL) {
     return;
@@ -113,6 +130,9 @@ void HMAC_CTX_free(HMAC_CTX *ctx) {
 
 int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, size_t key_len,
                  const EVP_MD *md, ENGINE *impl) {
+  int ret = 0;
+  FIPS_service_indicator_lock_state();
+
   if (md == NULL) {
     md = ctx->md;
   }
@@ -131,12 +151,13 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, size_t key_len,
 
     size_t block_size = EVP_MD_block_size(md);
     assert(block_size <= sizeof(key_block));
+    assert(EVP_MD_size(md) <= block_size);
     if (block_size < key_len) {
       // Long keys are hashed.
       if (!EVP_DigestInit_ex(&ctx->md_ctx, md, impl) ||
           !EVP_DigestUpdate(&ctx->md_ctx, key, key_len) ||
           !EVP_DigestFinal_ex(&ctx->md_ctx, key_block, &key_block_len)) {
-        return 0;
+        goto out;
       }
     } else {
       assert(key_len <= sizeof(key_block));
@@ -144,34 +165,32 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, size_t key_len,
       key_block_len = (unsigned)key_len;
     }
     // Keys are then padded with zeros.
-    if (key_block_len != EVP_MAX_MD_BLOCK_SIZE) {
-      OPENSSL_memset(&key_block[key_block_len], 0, sizeof(key_block) - key_block_len);
-    }
+    OPENSSL_memset(key_block + key_block_len, 0, block_size - key_block_len);
 
-    for (size_t i = 0; i < EVP_MAX_MD_BLOCK_SIZE; i++) {
+    for (size_t i = 0; i < block_size; i++) {
       pad[i] = 0x36 ^ key_block[i];
     }
     if (!EVP_DigestInit_ex(&ctx->i_ctx, md, impl) ||
-        !EVP_DigestUpdate(&ctx->i_ctx, pad, EVP_MD_block_size(md))) {
-      return 0;
+        !EVP_DigestUpdate(&ctx->i_ctx, pad, block_size)) {
+      goto out;
     }
 
-    for (size_t i = 0; i < EVP_MAX_MD_BLOCK_SIZE; i++) {
+    for (size_t i = 0; i < block_size; i++) {
       pad[i] = 0x5c ^ key_block[i];
     }
     if (!EVP_DigestInit_ex(&ctx->o_ctx, md, impl) ||
-        !EVP_DigestUpdate(&ctx->o_ctx, pad, EVP_MD_block_size(md))) {
-      return 0;
+        !EVP_DigestUpdate(&ctx->o_ctx, pad, block_size)) {
+      goto out;
     }
 
     ctx->md = md;
   }
 
-  if (!EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->i_ctx)) {
-    return 0;
-  }
+  ret = EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->i_ctx);
 
-  return 1;
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }
 
 int HMAC_Update(HMAC_CTX *ctx, const uint8_t *data, size_t data_len) {
@@ -179,9 +198,11 @@ int HMAC_Update(HMAC_CTX *ctx, const uint8_t *data, size_t data_len) {
 }
 
 int HMAC_Final(HMAC_CTX *ctx, uint8_t *out, unsigned int *out_len) {
+  int ret = 0;
   unsigned int i;
   uint8_t buf[EVP_MAX_MD_SIZE];
 
+  FIPS_service_indicator_lock_state();
   // TODO(davidben): The only thing that can officially fail here is
   // |EVP_MD_CTX_copy_ex|, but even that should be impossible in this case.
   if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i) ||
@@ -189,16 +210,23 @@ int HMAC_Final(HMAC_CTX *ctx, uint8_t *out, unsigned int *out_len) {
       !EVP_DigestUpdate(&ctx->md_ctx, buf, i) ||
       !EVP_DigestFinal_ex(&ctx->md_ctx, out, out_len)) {
     *out_len = 0;
-    return 0;
+    goto out;
   }
 
-  return 1;
-}
+  ret = 1;
 
-size_t HMAC_size(const HMAC_CTX *ctx) {
-  return EVP_MD_size(ctx->md);
+ out:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    HMAC_verify_service_indicator(ctx->md);
+  }
+  return ret;
 }
 
+size_t HMAC_size(const HMAC_CTX *ctx) { return EVP_MD_size(ctx->md); }
+
+const EVP_MD *HMAC_CTX_get_md(const HMAC_CTX *ctx) { return ctx->md; }
+
 int HMAC_CTX_copy_ex(HMAC_CTX *dest, const HMAC_CTX *src) {
   if (!EVP_MD_CTX_copy_ex(&dest->i_ctx, &src->i_ctx) ||
       !EVP_MD_CTX_copy_ex(&dest->o_ctx, &src->o_ctx) ||

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/cbc.c

@@ -49,8 +49,6 @@
 #include <assert.h>
 #include <string.h>
 
-#include <openssl/type_check.h>
-
 #include "internal.h"
 #include "../../internal.h"
 
@@ -116,16 +114,12 @@ void CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
   assert(inptr >= outptr || inptr + len <= outptr);
 
   size_t n;
-  union {
-    crypto_word_t t[16 / sizeof(crypto_word_t)];
-    uint8_t c[16];
-  } tmp;
-
+  alignas(16) uint8_t tmp[16];
   if ((inptr >= 32 && outptr <= inptr - 32) || inptr < outptr) {
     // If |out| is at least two blocks behind |in| or completely disjoint, there
     // is no need to decrypt to a temporary block.
-    OPENSSL_STATIC_ASSERT(16 % sizeof(crypto_word_t) == 0,
-                          "block cannot be evenly divided into words");
+    static_assert(16 % sizeof(crypto_word_t) == 0,
+                  "block cannot be evenly divided into words");
     const uint8_t *iv = ivec;
     while (len >= 16) {
       (*block)(in, out, key);
@@ -140,14 +134,14 @@ void CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
     }
     OPENSSL_memcpy(ivec, iv, 16);
   } else {
-    OPENSSL_STATIC_ASSERT(16 % sizeof(crypto_word_t) == 0,
-                          "block cannot be evenly divided into words");
+    static_assert(16 % sizeof(crypto_word_t) == 0,
+                  "block cannot be evenly divided into words");
 
     while (len >= 16) {
-      (*block)(in, tmp.c, key);
+      (*block)(in, tmp, key);
       for (n = 0; n < 16; n += sizeof(crypto_word_t)) {
         crypto_word_t c = CRYPTO_load_word_le(in + n);
-        CRYPTO_store_word_le(out + n, tmp.t[n / sizeof(crypto_word_t)] ^
+        CRYPTO_store_word_le(out + n, CRYPTO_load_word_le(tmp + n) ^
                                           CRYPTO_load_word_le(ivec + n));
         CRYPTO_store_word_le(ivec + n, c);
       }
@@ -159,10 +153,10 @@ void CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
 
   while (len) {
     uint8_t c;
-    (*block)(in, tmp.c, key);
+    (*block)(in, tmp, key);
     for (n = 0; n < 16 && n < len; ++n) {
       c = in[n];
-      out[n] = tmp.c[n] ^ ivec[n];
+      out[n] = tmp[n] ^ ivec[n];
       ivec[n] = c;
     }
     if (len <= 16) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/cfb.c

@@ -46,16 +46,13 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  * ==================================================================== */
 
-#include <openssl/type_check.h>
-
 #include <assert.h>
 #include <string.h>
 
 #include "internal.h"
 
 
-OPENSSL_STATIC_ASSERT(16 % sizeof(size_t) == 0,
-                      "block cannot be divided into size_t");
+static_assert(16 % sizeof(size_t) == 0, "block cannot be divided into size_t");
 
 void CRYPTO_cfb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                            const AES_KEY *key, uint8_t ivec[16], unsigned *num,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/ctr.c

@@ -46,8 +46,6 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  * ==================================================================== */
 
-#include <openssl/type_check.h>
-
 #include <assert.h>
 #include <string.h>
 
@@ -70,8 +68,8 @@ static void ctr128_inc(uint8_t *counter) {
   } while (n);
 }
 
-OPENSSL_STATIC_ASSERT(16 % sizeof(crypto_word_t) == 0,
-                      "block cannot be divided into crypto_word_t");
+static_assert(16 % sizeof(crypto_word_t) == 0,
+              "block cannot be divided into crypto_word_t");
 
 // The input encrypted as though 128bit counter mode is being used.  The extra
 // state information to record how much of the 128bit block we have used is