grpc 1.55.0 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h

@@ -15,14 +15,13 @@
 #ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H
 #define OPENSSL_HEADER_CURVE25519_INTERNAL_H
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
-
-#include <openssl/base.h>
+#include <openssl/curve25519.h>
 
 #include "../internal.h"
 
+#if defined(__cplusplus)
+extern "C" {
+#endif
 
 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE)
 #define BORINGSSL_X25519_NEON
@@ -32,11 +31,28 @@ void x25519_NEON(uint8_t out[32], const uint8_t scalar[32],
                  const uint8_t point[32]);
 #endif
 
-#if defined(BORINGSSL_HAS_UINT128)
-#define BORINGSSL_CURVE25519_64BIT
+#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \
+    defined(__GNUC__) && defined(__x86_64__)
+#define BORINGSSL_FE25519_ADX
+
+// fiat_curve25519_adx_mul is defined in
+// third_party/fiat/asm/fiat_curve25519_adx_mul.S
+void __attribute__((sysv_abi))
+fiat_curve25519_adx_mul(uint64_t out[4], const uint64_t in1[4],
+                        const uint64_t in2[4]);
+
+// fiat_curve25519_adx_square is defined in
+// third_party/fiat/asm/fiat_curve25519_adx_square.S
+void __attribute__((sysv_abi))
+fiat_curve25519_adx_square(uint64_t out[4], const uint64_t in[4]);
+
+// x25519_scalar_mult_adx is defined in third_party/fiat/curve25519_64_adx.h
+void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
+                            const uint8_t point[32]);
+void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]);
 #endif
 
-#if defined(BORINGSSL_CURVE25519_64BIT)
+#if defined(OPENSSL_64_BIT)
 // fe means field element. Here the field is \Z/(2^255-19). An element t,
 // entries t[0]...t[4], represents the integer t[0]+2^51 t[1]+2^102 t[2]+2^153
 // t[3]+2^204 t[4].
@@ -139,6 +155,8 @@ struct spake2_ctx_st {
 };
 
 
+extern const uint8_t k25519Precomp[32][8][3][32];
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/dh_extra/dh_asn1.c

@@ -110,6 +110,10 @@ DH *DH_parse_parameters(CBS *cbs) {
     goto err;
   }
 
+  if (!dh_check_params_fast(ret)) {
+    goto err;
+  }
+
   return ret;
 
 err:

data/third_party/boringssl-with-bazel/src/crypto/dh_extra/params.c

@@ -337,6 +337,11 @@ int DH_generate_parameters_ex(DH *dh, int prime_bits, int generator,
   // It's just as OK (and in some sense better) to use a generator of the
   // order-q subgroup.
 
+  if (prime_bits <= 0 || prime_bits > OPENSSL_DH_MAX_MODULUS_BITS) {
+    OPENSSL_PUT_ERROR(DH, DH_R_MODULUS_TOO_LARGE);
+    return 0;
+  }
+
   BIGNUM *t1, *t2;
   int g, ok = 0;
   BN_CTX *ctx = NULL;

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c

@@ -202,6 +202,10 @@ int DSA_set0_pqg(DSA *dsa, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
     dsa->g = g;
   }
 
+  BN_MONT_CTX_free(dsa->method_mont_p);
+  dsa->method_mont_p = NULL;
+  BN_MONT_CTX_free(dsa->method_mont_q);
+  dsa->method_mont_q = NULL;
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/dsa/internal.h

@@ -17,11 +17,31 @@
 
 #include <openssl/dsa.h>
 
+#include <openssl/thread.h>
+
+#include "../internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
+struct dsa_st {
+  BIGNUM *p;
+  BIGNUM *q;
+  BIGNUM *g;
+
+  BIGNUM *pub_key;
+  BIGNUM *priv_key;
+
+  // Normally used to cache montgomery values
+  CRYPTO_MUTEX method_mont_lock;
+  BN_MONT_CTX *method_mont_p;
+  BN_MONT_CTX *method_mont_q;
+  CRYPTO_refcount_t references;
+  CRYPTO_EX_DATA ex_data;
+};
+
 // dsa_check_key performs cheap self-checks on |dsa|, and ensures it is within
 // DoS bounds. It returns one on success and zero on error.
 int dsa_check_key(const DSA *dsa);

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/ec_asn1.c

@@ -72,6 +72,16 @@ static const CBS_ASN1_TAG kParametersTag =
 static const CBS_ASN1_TAG kPublicKeyTag =
     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1;
 
+// TODO(https://crbug.com/boringssl/497): Allow parsers to specify a list of
+// acceptable groups, so parsers don't have to pull in all four.
+typedef const EC_GROUP *(*ec_group_func)(void);
+static const ec_group_func kAllGroups[] = {
+    &EC_group_p224,
+    &EC_group_p256,
+    &EC_group_p384,
+    &EC_group_p521,
+};
+
 EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   CBS ec_private_key, private_key;
   uint64_t version;
@@ -84,7 +94,6 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   }
 
   // Parse the optional parameters field.
-  EC_GROUP *inner_group = NULL;
   EC_KEY *ret = NULL;
   BIGNUM *priv_key = NULL;
   if (CBS_peek_asn1_tag(&ec_private_key, kParametersTag)) {
@@ -97,7 +106,7 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
       OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
       goto err;
     }
-    inner_group = EC_KEY_parse_parameters(&child);
+    const EC_GROUP *inner_group = EC_KEY_parse_parameters(&child);
     if (inner_group == NULL) {
       goto err;
     }
@@ -179,13 +188,11 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   }
 
   BN_free(priv_key);
-  EC_GROUP_free(inner_group);
   return ret;
 
 err:
   EC_KEY_free(ret);
   BN_free(priv_key);
-  EC_GROUP_free(inner_group);
   return NULL;
 }
 
@@ -244,9 +251,12 @@ int EC_KEY_marshal_private_key(CBB *cbb, const EC_KEY *key,
 // kPrimeFieldOID is the encoding of 1.2.840.10045.1.1.
 static const uint8_t kPrimeField[] = {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01, 0x01};
 
-static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
-                                      CBS *out_b, CBS *out_base_x,
-                                      CBS *out_base_y, CBS *out_order) {
+struct explicit_prime_curve {
+  CBS prime, a, b, base_x, base_y, order;
+};
+
+static int parse_explicit_prime_curve(CBS *in,
+                                      struct explicit_prime_curve *out) {
   // See RFC 3279, section 2.3.5. Note that RFC 3279 calls this structure an
   // ECParameters while RFC 5480 calls it a SpecifiedECDomain.
   CBS params, field_id, field_type, curve, base, cofactor;
@@ -260,18 +270,18 @@ static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
       CBS_len(&field_type) != sizeof(kPrimeField) ||
       OPENSSL_memcmp(CBS_data(&field_type), kPrimeField, sizeof(kPrimeField)) !=
           0 ||
-      !CBS_get_asn1(&field_id, out_prime, CBS_ASN1_INTEGER) ||
-      !CBS_is_unsigned_asn1_integer(out_prime) ||
+      !CBS_get_asn1(&field_id, &out->prime, CBS_ASN1_INTEGER) ||
+      !CBS_is_unsigned_asn1_integer(&out->prime) ||
       CBS_len(&field_id) != 0 ||
       !CBS_get_asn1(&params, &curve, CBS_ASN1_SEQUENCE) ||
-      !CBS_get_asn1(&curve, out_a, CBS_ASN1_OCTETSTRING) ||
-      !CBS_get_asn1(&curve, out_b, CBS_ASN1_OCTETSTRING) ||
+      !CBS_get_asn1(&curve, &out->a, CBS_ASN1_OCTETSTRING) ||
+      !CBS_get_asn1(&curve, &out->b, CBS_ASN1_OCTETSTRING) ||
       // |curve| has an optional BIT STRING seed which we ignore.
       !CBS_get_optional_asn1(&curve, NULL, NULL, CBS_ASN1_BITSTRING) ||
       CBS_len(&curve) != 0 ||
       !CBS_get_asn1(&params, &base, CBS_ASN1_OCTETSTRING) ||
-      !CBS_get_asn1(&params, out_order, CBS_ASN1_INTEGER) ||
-      !CBS_is_unsigned_asn1_integer(out_order) ||
+      !CBS_get_asn1(&params, &out->order, CBS_ASN1_INTEGER) ||
+      !CBS_is_unsigned_asn1_integer(&out->order) ||
       !CBS_get_optional_asn1(&params, &cofactor, &has_cofactor,
                              CBS_ASN1_INTEGER) ||
       CBS_len(&params) != 0) {
@@ -300,25 +310,33 @@ static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
     return 0;
   }
   size_t field_len = CBS_len(&base) / 2;
-  CBS_init(out_base_x, CBS_data(&base), field_len);
-  CBS_init(out_base_y, CBS_data(&base) + field_len, field_len);
+  CBS_init(&out->base_x, CBS_data(&base), field_len);
+  CBS_init(&out->base_y, CBS_data(&base) + field_len, field_len);
 
   return 1;
 }
 
-// integers_equal returns one if |a| and |b| are equal, up to leading zeros, and
+// integers_equal returns one if |bytes| is a big-endian encoding of |bn|, and
 // zero otherwise.
-static int integers_equal(const CBS *a, const uint8_t *b, size_t b_len) {
-  // Remove leading zeros from |a| and |b|.
-  CBS a_copy = *a;
-  while (CBS_len(&a_copy) > 0 && CBS_data(&a_copy)[0] == 0) {
-    CBS_skip(&a_copy, 1);
+static int integers_equal(const CBS *bytes, const BIGNUM *bn) {
+  // Although, in SEC 1, Field-Element-to-Octet-String has a fixed width,
+  // OpenSSL mis-encodes the |a| and |b|, so we tolerate any number of leading
+  // zeros. (This matters for P-521 whose |b| has a leading 0.)
+  CBS copy = *bytes;
+  while (CBS_len(&copy) > 0 && CBS_data(&copy)[0] == 0) {
+    CBS_skip(&copy, 1);
   }
-  while (b_len > 0 && b[0] == 0) {
-    b++;
-    b_len--;
+
+  if (CBS_len(&copy) > EC_MAX_BYTES) {
+    return 0;
   }
-  return CBS_mem_equal(&a_copy, b, b_len);
+  uint8_t buf[EC_MAX_BYTES];
+  if (!BN_bn2bin_padded(buf, CBS_len(&copy), bn)) {
+    ERR_clear_error();
+    return 0;
+  }
+
+  return CBS_mem_equal(&copy, buf, CBS_len(&copy));
 }
 
 EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
@@ -329,13 +347,10 @@ EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
   }
 
   // Look for a matching curve.
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    if (CBS_len(&named_curve) == curve->oid_len &&
-        OPENSSL_memcmp(CBS_data(&named_curve), curve->oid, curve->oid_len) ==
-            0) {
-      return EC_GROUP_new_by_curve_name(curve->nid);
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    if (CBS_mem_equal(&named_curve, group->oid, group->oid_len)) {
+      return (EC_GROUP *)group;
     }
   }
 
@@ -344,25 +359,15 @@ EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
 }
 
 int EC_KEY_marshal_curve_name(CBB *cbb, const EC_GROUP *group) {
-  int nid = EC_GROUP_get_curve_name(group);
-  if (nid == NID_undef) {
+  if (group->oid_len == 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
     return 0;
   }
 
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    if (curve->nid == nid) {
-      CBB child;
-      return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) &&
-             CBB_add_bytes(&child, curve->oid, curve->oid_len) &&
-             CBB_flush(cbb);
-    }
-  }
-
-  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-  return 0;
+  CBB child;
+  return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) &&
+         CBB_add_bytes(&child, group->oid, group->oid_len) &&  //
+         CBB_flush(cbb);
 }
 
 EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) {
@@ -374,34 +379,56 @@ EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) {
   // of named curves.
   //
   // TODO(davidben): Remove support for this.
-  CBS prime, a, b, base_x, base_y, order;
-  if (!parse_explicit_prime_curve(cbs, &prime, &a, &b, &base_x, &base_y,
-                                  &order)) {
+  struct explicit_prime_curve curve;
+  if (!parse_explicit_prime_curve(cbs, &curve)) {
     return NULL;
   }
 
-  // Look for a matching prime curve.
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    const unsigned param_len = curve->param_len;
-    // |curve->params| is ordered p, a, b, x, y, order, each component
-    // zero-padded up to the field length. Although SEC 1 states that the
-    // Field-Element-to-Octet-String conversion also pads, OpenSSL mis-encodes
-    // |a| and |b|, so this comparison must allow omitting leading zeros. (This
-    // is relevant for P-521 whose |b| has a leading 0.)
-    if (integers_equal(&prime, curve->params, param_len) &&
-        integers_equal(&a, curve->params + param_len, param_len) &&
-        integers_equal(&b, curve->params + param_len * 2, param_len) &&
-        integers_equal(&base_x, curve->params + param_len * 3, param_len) &&
-        integers_equal(&base_y, curve->params + param_len * 4, param_len) &&
-        integers_equal(&order, curve->params + param_len * 5, param_len)) {
-      return EC_GROUP_new_by_curve_name(curve->nid);
+  const EC_GROUP *ret = NULL;
+  BIGNUM *p = BN_new(), *a = BN_new(), *b = BN_new(), *x = BN_new(),
+         *y = BN_new();
+  if (p == NULL || a == NULL || b == NULL || x == NULL || y == NULL) {
+    goto err;
+  }
+
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    if (!integers_equal(&curve.order, EC_GROUP_get0_order(group))) {
+      continue;
+    }
+
+    // The order alone uniquely identifies the group, but we check the other
+    // parameters to avoid misinterpreting the group.
+    if (!EC_GROUP_get_curve_GFp(group, p, a, b, NULL)) {
+      goto err;
+    }
+    if (!integers_equal(&curve.prime, p) || !integers_equal(&curve.a, a) ||
+        !integers_equal(&curve.b, b)) {
+      break;
+    }
+    if (!EC_POINT_get_affine_coordinates_GFp(
+            group, EC_GROUP_get0_generator(group), x, y, NULL)) {
+      goto err;
     }
+    if (!integers_equal(&curve.base_x, x) ||
+        !integers_equal(&curve.base_y, y)) {
+      break;
+    }
+    ret = group;
+    break;
   }
 
-  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-  return NULL;
+  if (ret == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
+  }
+
+err:
+  BN_free(p);
+  BN_free(a);
+  BN_free(b);
+  BN_free(x);
+  BN_free(y);
+  return (EC_GROUP *)ret;
 }
 
 int EC_POINT_point2cbb(CBB *out, const EC_GROUP *group, const EC_POINT *point,
@@ -458,18 +485,16 @@ EC_KEY *d2i_ECParameters(EC_KEY **out_key, const uint8_t **inp, long len) {
 
   CBS cbs;
   CBS_init(&cbs, *inp, (size_t)len);
-  EC_GROUP *group = EC_KEY_parse_parameters(&cbs);
+  const EC_GROUP *group = EC_KEY_parse_parameters(&cbs);
   if (group == NULL) {
     return NULL;
   }
 
   EC_KEY *ret = EC_KEY_new();
   if (ret == NULL || !EC_KEY_set_group(ret, group)) {
-    EC_GROUP_free(group);
     EC_KEY_free(ret);
     return NULL;
   }
-  EC_GROUP_free(group);
 
   if (out_key != NULL) {
     EC_KEY_free(*out_key);
@@ -532,3 +557,16 @@ int i2o_ECPublicKey(const EC_KEY *key, uint8_t **outp) {
   // Historically, this function used the wrong return value on error.
   return ret > 0 ? ret : 0;
 }
+
+size_t EC_get_builtin_curves(EC_builtin_curve *out_curves,
+                             size_t max_num_curves) {
+  if (max_num_curves > OPENSSL_ARRAY_SIZE(kAllGroups)) {
+    max_num_curves = OPENSSL_ARRAY_SIZE(kAllGroups);
+  }
+  for (size_t i = 0; i < max_num_curves; i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    out_curves[i].nid = group->curve_name;
+    out_curves[i].comment = group->comment;
+  }
+  return OPENSSL_ARRAY_SIZE(kAllGroups);
+}

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/ec_derive.c

@@ -55,7 +55,8 @@ EC_KEY *EC_KEY_derive_from_secret(const EC_GROUP *group, const uint8_t *secret,
   }
 
   uint8_t derived[EC_KEY_DERIVE_EXTRA_BYTES + EC_MAX_BYTES];
-  size_t derived_len = BN_num_bytes(&group->order) + EC_KEY_DERIVE_EXTRA_BYTES;
+  size_t derived_len =
+      BN_num_bytes(EC_GROUP_get0_order(group)) + EC_KEY_DERIVE_EXTRA_BYTES;
   assert(derived_len <= sizeof(derived));
   if (!HKDF(derived, derived_len, EVP_sha256(), secret, secret_len,
             /*salt=*/NULL, /*salt_len=*/0, (const uint8_t *)info,
@@ -74,10 +75,10 @@ EC_KEY *EC_KEY_derive_from_secret(const EC_GROUP *group, const uint8_t *secret,
       // enough. 2^(num_bytes(order)) < 2^8 * order, so:
       //
       //    priv < 2^8 * order * 2^128 < order * order < order * R
-      !BN_from_montgomery(priv, priv, group->order_mont, ctx) ||
+      !BN_from_montgomery(priv, priv, &group->order, ctx) ||
       // Multiply by R^2 and do another Montgomery reduction to compute
       // priv * R^-1 * R^2 * R^-1 = priv mod order.
-      !BN_to_montgomery(priv, priv, group->order_mont, ctx) ||
+      !BN_to_montgomery(priv, priv, &group->order, ctx) ||
       !EC_POINT_mul(group, pub, priv, NULL, NULL, ctx) ||
       !EC_KEY_set_group(key, group) || !EC_KEY_set_public_key(key, pub) ||
       !EC_KEY_set_private_key(key, priv)) {

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/hash_to_curve.c

@@ -26,8 +26,7 @@
 #include "../internal.h"
 
 
-// This file implements hash-to-curve, as described in
-// draft-irtf-cfrg-hash-to-curve-16.
+// This file implements hash-to-curve, as described in RFC 9380.
 //
 // This hash-to-curve implementation is written generically with the
 // expectation that we will eventually wish to support other curves. If it
@@ -48,8 +47,7 @@
 //   templates to make specializing more convenient.
 
 // expand_message_xmd implements the operation described in section 5.3.1 of
-// draft-irtf-cfrg-hash-to-curve-16. It returns one on success and zero on
-// error.
+// RFC 9380. It returns one on success and zero on error.
 static int expand_message_xmd(const EVP_MD *md, uint8_t *out, size_t out_len,
                               const uint8_t *msg, size_t msg_len,
                               const uint8_t *dst, size_t dst_len) {
@@ -138,7 +136,7 @@ err:
 
 // num_bytes_to_derive determines the number of bytes to derive when hashing to
 // a number modulo |modulus|. See the hash_to_field operation defined in
-// section 5.2 of draft-irtf-cfrg-hash-to-curve-16.
+// section 5.2 of RFC 9380.
 static int num_bytes_to_derive(size_t *out, const BIGNUM *modulus, unsigned k) {
   size_t bits = BN_num_bits(modulus);
   size_t L = (bits + k + 7) / 8;
@@ -171,20 +169,19 @@ static void big_endian_to_words(BN_ULONG *out, size_t num_words,
 }
 
 // hash_to_field implements the operation described in section 5.2
-// of draft-irtf-cfrg-hash-to-curve-16, with count = 2. |k| is the security
-// factor.
+// of RFC 9380, with count = 2. |k| is the security factor.
 static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
                           EC_FELEM *out1, EC_FELEM *out2, const uint8_t *dst,
                           size_t dst_len, unsigned k, const uint8_t *msg,
                           size_t msg_len) {
   size_t L;
   uint8_t buf[4 * EC_MAX_BYTES];
-  if (!num_bytes_to_derive(&L, &group->field, k) ||
+  if (!num_bytes_to_derive(&L, &group->field.N, k) ||
       !expand_message_xmd(md, buf, 2 * L, msg, msg_len, dst, dst_len)) {
     return 0;
   }
   BN_ULONG words[2 * EC_MAX_WORDS];
-  size_t num_words = 2 * group->field.width;
+  size_t num_words = 2 * group->field.N.width;
   big_endian_to_words(words, num_words, buf, L);
   group->meth->felem_reduce(group, out1, words, num_words);
   big_endian_to_words(words, num_words, buf + L, L);
@@ -197,15 +194,16 @@ static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
 static int hash_to_scalar(const EC_GROUP *group, const EVP_MD *md,
                           EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
                           unsigned k, const uint8_t *msg, size_t msg_len) {
+  const BIGNUM *order = EC_GROUP_get0_order(group);
   size_t L;
   uint8_t buf[EC_MAX_BYTES * 2];
-  if (!num_bytes_to_derive(&L, &group->order, k) ||
+  if (!num_bytes_to_derive(&L, order, k) ||
       !expand_message_xmd(md, buf, L, msg, msg_len, dst, dst_len)) {
     return 0;
   }
 
   BN_ULONG words[2 * EC_MAX_WORDS];
-  size_t num_words = 2 * group->order.width;
+  size_t num_words = 2 * order->width;
   big_endian_to_words(words, num_words, buf, L);
   ec_scalar_reduce(group, out, words, num_words);
   return 1;
@@ -220,8 +218,7 @@ static inline void mul_A(const EC_GROUP *group, EC_FELEM *out,
   ec_felem_sub(group, out, in, &tmp);     // out = -3*in
 }
 
-// sgn0 implements the operation described in section 4.1.2 of
-// draft-irtf-cfrg-hash-to-curve-16.
+// sgn0 implements the operation described in section 4.1.2 of RFC 9380.
 static BN_ULONG sgn0(const EC_GROUP *group, const EC_FELEM *a) {
   uint8_t buf[EC_MAX_BYTES];
   size_t len;
@@ -230,11 +227,11 @@ static BN_ULONG sgn0(const EC_GROUP *group, const EC_FELEM *a) {
 }
 
 OPENSSL_UNUSED static int is_3mod4(const EC_GROUP *group) {
-  return group->field.width > 0 && (group->field.d[0] & 3) == 3;
+  return group->field.N.width > 0 && (group->field.N.d[0] & 3) == 3;
 }
 
 // sqrt_ratio_3mod4 implements the operation described in appendix F.2.1.2
-// of draft-irtf-cfrg-hash-to-curve-16.
+// of RFC 9380.
 static BN_ULONG sqrt_ratio_3mod4(const EC_GROUP *group, const EC_FELEM *Z,
                                  const BN_ULONG *c1, size_t num_c1,
                                  const EC_FELEM *c2, EC_FELEM *out_y,
@@ -269,11 +266,10 @@ static BN_ULONG sqrt_ratio_3mod4(const EC_GROUP *group, const EC_FELEM *Z,
 }
 
 // map_to_curve_simple_swu implements the operation described in section 6.6.2
-// of draft-irtf-cfrg-hash-to-curve-16, using the straight-line implementation
-// in appendix F.2.
+// of RFC 9380, using the straight-line implementation in appendix F.2.
 static void map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
                                     const BN_ULONG *c1, size_t num_c1,
-                                    const EC_FELEM *c2, EC_RAW_POINT *out,
+                                    const EC_FELEM *c2, EC_JACOBIAN *out,
                                     const EC_FELEM *u) {
   // This function requires the prime be 3 mod 4, and that A = -3.
   assert(is_3mod4(group));
@@ -285,12 +281,12 @@ static void map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
       group->meth->felem_sqr;
 
   EC_FELEM tv1, tv2, tv3, tv4, tv5, tv6, x, y, y1;
-  felem_sqr(group, &tv1, u);                     // 1. tv1 = u^2
-  felem_mul(group, &tv1, Z, &tv1);               // 2. tv1 = Z * tv1
-  felem_sqr(group, &tv2, &tv1);                  // 3. tv2 = tv1^2
-  ec_felem_add(group, &tv2, &tv2, &tv1);         // 4. tv2 = tv2 + tv1
-  ec_felem_add(group, &tv3, &tv2, &group->one);  // 5. tv3 = tv2 + 1
-  felem_mul(group, &tv3, &group->b, &tv3);       // 6. tv3 = B * tv3
+  felem_sqr(group, &tv1, u);                             // 1. tv1 = u^2
+  felem_mul(group, &tv1, Z, &tv1);                       // 2. tv1 = Z * tv1
+  felem_sqr(group, &tv2, &tv1);                          // 3. tv2 = tv1^2
+  ec_felem_add(group, &tv2, &tv2, &tv1);                 // 4. tv2 = tv2 + tv1
+  ec_felem_add(group, &tv3, &tv2, ec_felem_one(group));  // 5. tv3 = tv2 + 1
+  felem_mul(group, &tv3, &group->b, &tv3);               // 6. tv3 = B * tv3
 
   // 7. tv4 = CMOV(Z, -tv2, tv2 != 0)
   const BN_ULONG tv2_non_zero = ec_felem_non_zero_mask(group, &tv2);
@@ -344,7 +340,7 @@ static void map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
 
 static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
                          const EC_FELEM *Z, const EC_FELEM *c2, unsigned k,
-                         EC_RAW_POINT *out, const uint8_t *dst, size_t dst_len,
+                         EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
                          const uint8_t *msg, size_t msg_len) {
   EC_FELEM u0, u1;
   if (!hash_to_field2(group, md, &u0, &u1, dst, dst_len, k, msg, msg_len)) {
@@ -353,13 +349,13 @@ static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
 
   // Compute |c1| = (p - 3) / 4.
   BN_ULONG c1[EC_MAX_WORDS];
-  size_t num_c1 = group->field.width;
-  if (!bn_copy_words(c1, num_c1, &group->field)) {
+  size_t num_c1 = group->field.N.width;
+  if (!bn_copy_words(c1, num_c1, &group->field.N)) {
     return 0;
   }
   bn_rshift_words(c1, c1, /*shift=*/2, /*num=*/num_c1);
 
-  EC_RAW_POINT Q0, Q1;
+  EC_JACOBIAN Q0, Q1;
   map_to_curve_simple_swu(group, Z, c1, num_c1, c2, &Q0, &u0);
   map_to_curve_simple_swu(group, Z, c1, num_c1, c2, &Q1, &u1);
 
@@ -370,7 +366,7 @@ static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
 
 static int felem_from_u8(const EC_GROUP *group, EC_FELEM *out, uint8_t a) {
   uint8_t bytes[EC_MAX_BYTES] = {0};
-  size_t len = BN_num_bytes(&group->field);
+  size_t len = BN_num_bytes(&group->field.N);
   bytes[len - 1] = a;
   return ec_felem_from_bytes(group, out, bytes, len);
 }
@@ -401,10 +397,10 @@ static const uint8_t kP384Sqrt12[] = {
     0xa8, 0x0f, 0x7e, 0x19, 0x14, 0xe2, 0xec, 0x69, 0xf5, 0xa6, 0x26, 0xb3};
 
 int ec_hash_to_curve_p256_xmd_sha256_sswu(const EC_GROUP *group,
-                                          EC_RAW_POINT *out, const uint8_t *dst,
+                                          EC_JACOBIAN *out, const uint8_t *dst,
                                           size_t dst_len, const uint8_t *msg,
                                           size_t msg_len) {
-  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-16.
+  // See section 8.3 of RFC 9380.
   if (EC_GROUP_get_curve_name(group) != NID_X9_62_prime256v1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
@@ -434,10 +430,10 @@ int EC_hash_to_curve_p256_xmd_sha256_sswu(const EC_GROUP *group, EC_POINT *out,
 }
 
 int ec_hash_to_curve_p384_xmd_sha384_sswu(const EC_GROUP *group,
-                                          EC_RAW_POINT *out, const uint8_t *dst,
+                                          EC_JACOBIAN *out, const uint8_t *dst,
                                           size_t dst_len, const uint8_t *msg,
                                           size_t msg_len) {
-  // See section 8.3 of draft-irtf-cfrg-hash-to-curve-16.
+  // See section 8.3 of RFC 9380.
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
@@ -466,8 +462,20 @@ int EC_hash_to_curve_p384_xmd_sha384_sswu(const EC_GROUP *group, EC_POINT *out,
                                                msg, msg_len);
 }
 
+int ec_hash_to_scalar_p384_xmd_sha384(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
+  if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
+    OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
+    return 0;
+  }
+
+  return hash_to_scalar(group, EVP_sha384(), out, dst, dst_len, /*k=*/192, msg,
+                        msg_len);
+}
+
 int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst,
     size_t dst_len, const uint8_t *msg, size_t msg_len) {
   // See section 8.3 of draft-irtf-cfrg-hash-to-curve-07.
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {