grpc 1.56.0 → 1.61.0

data/third_party/boringssl-with-bazel/src/crypto/trust_token/pmbtoken.c

@@ -62,17 +62,13 @@ typedef struct {
 
 static const uint8_t kDefaultAdditionalData[32] = {0};
 
-static int pmbtoken_init_method(PMBTOKEN_METHOD *method, int curve_nid,
+static int pmbtoken_init_method(PMBTOKEN_METHOD *method, const EC_GROUP *group,
                                 const uint8_t *h_bytes, size_t h_len,
                                 hash_t_func_t hash_t, hash_s_func_t hash_s,
                                 hash_c_func_t hash_c,
                                 hash_to_scalar_func_t hash_to_scalar,
                                 int prefix_point) {
-  method->group = EC_GROUP_new_by_curve_name(curve_nid);
-  if (method->group == NULL) {
-    return 0;
-  }
-
+  method->group = group;
   method->hash_t = hash_t;
   method->hash_s = hash_s;
   method->hash_c = hash_c;
@@ -86,7 +82,7 @@ static int pmbtoken_init_method(PMBTOKEN_METHOD *method, int curve_nid,
   ec_affine_to_jacobian(method->group, &method->h, &h);
 
   if (!ec_init_precomp(method->group, &method->g_precomp,
-                       &method->group->generator->raw) ||
+                       &method->group->generator.raw) ||
       !ec_init_precomp(method->group, &method->h_precomp, &method->h)) {
     return 0;
   }
@@ -160,7 +156,7 @@ static int cbs_get_prefixed_point(CBS *cbs, const EC_GROUP *group,
       return 0;
     }
   } else {
-    size_t plen = 1 + 2 * BN_num_bytes(&group->field);
+    size_t plen = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
     if (!CBS_get_bytes(cbs, &child, plen)) {
       return 0;
     }
@@ -201,7 +197,7 @@ static int pmbtoken_compute_keys(const PMBTOKEN_METHOD *method,
   }
 
   const EC_SCALAR *scalars[] = {x0, y0, x1, y1, xs, ys};
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(scalars); i++) {
     uint8_t *buf;
     if (!CBB_add_space(out_private, &buf, scalar_len)) {
@@ -290,7 +286,7 @@ static int pmbtoken_issuer_key_from_bytes(const PMBTOKEN_METHOD *method,
   const EC_GROUP *group = method->group;
   CBS cbs, tmp;
   CBS_init(&cbs, in, len);
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   EC_SCALAR *scalars[] = {&key->x0, &key->y0, &key->x1,
                           &key->y1, &key->xs, &key->ys};
   for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(scalars); i++) {
@@ -390,7 +386,7 @@ err:
 static int scalar_to_cbb(CBB *out, const EC_GROUP *group,
                          const EC_SCALAR *scalar) {
   uint8_t *buf;
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   if (!CBB_add_space(out, &buf, scalar_len)) {
     return 0;
   }
@@ -399,7 +395,7 @@ static int scalar_to_cbb(CBB *out, const EC_GROUP *group,
 }
 
 static int scalar_from_cbs(CBS *cbs, const EC_GROUP *group, EC_SCALAR *out) {
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   CBS tmp;
   if (!CBS_get_bytes(cbs, &tmp, scalar_len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
@@ -679,7 +675,7 @@ static int dleq_verify(const PMBTOKEN_METHOD *method, CBS *cbs,
                        const EC_JACOBIAN *S, const EC_JACOBIAN *W,
                        const EC_JACOBIAN *Ws) {
   const EC_GROUP *group = method->group;
-  const EC_JACOBIAN *g = &group->generator->raw;
+  const EC_JACOBIAN *g = &group->generator.raw;
 
   // We verify a DLEQ proof for the validity token and a DLEQOR2 proof for the
   // private metadata token. To allow amortizing Jacobian-to-affine conversions,
@@ -912,7 +908,7 @@ static int pmbtoken_sign(const PMBTOKEN_METHOD *method,
   }
 
   // Skip over any unused requests.
-  size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
   size_t token_len = point_len;
   if (method->prefix_point) {
     token_len += 2;
@@ -1015,7 +1011,7 @@ static STACK_OF(TRUST_TOKEN) *pmbtoken_unblind(
     // Serialize the token. Include |key_id| to avoid an extra copy in the layer
     // above.
     CBB token_cbb;
-    size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
     if (!CBB_init(&token_cbb,
                   4 + TRUST_TOKEN_NONCE_SIZE + 3 * (2 + point_len)) ||
         !CBB_add_u32(&token_cbb, key_id) ||
@@ -1230,7 +1226,7 @@ static void pmbtoken_exp1_init_method_impl(void) {
   };
 
   pmbtoken_exp1_ok = pmbtoken_init_method(
-      &pmbtoken_exp1_method, NID_secp384r1, kH, sizeof(kH),
+      &pmbtoken_exp1_method, EC_group_p384(), kH, sizeof(kH),
       pmbtoken_exp1_hash_t, pmbtoken_exp1_hash_s, pmbtoken_exp1_hash_c,
       pmbtoken_exp1_hash_to_scalar, 1);
 }
@@ -1403,7 +1399,7 @@ static void pmbtoken_exp2_init_method_impl(void) {
   };
 
   pmbtoken_exp2_ok = pmbtoken_init_method(
-      &pmbtoken_exp2_method, NID_secp384r1, kH, sizeof(kH),
+      &pmbtoken_exp2_method, EC_group_p384(), kH, sizeof(kH),
       pmbtoken_exp2_hash_t, pmbtoken_exp2_hash_s, pmbtoken_exp2_hash_c,
       pmbtoken_exp2_hash_to_scalar, 0);
 }
@@ -1577,7 +1573,7 @@ static void pmbtoken_pst1_init_method_impl(void) {
   };
 
   pmbtoken_pst1_ok = pmbtoken_init_method(
-      &pmbtoken_pst1_method, NID_secp384r1, kH, sizeof(kH),
+      &pmbtoken_pst1_method, EC_group_p384(), kH, sizeof(kH),
       pmbtoken_pst1_hash_t, pmbtoken_pst1_hash_s, pmbtoken_pst1_hash_c,
       pmbtoken_pst1_hash_to_scalar, 0);
 }

data/third_party/boringssl-with-bazel/src/crypto/trust_token/voprf.c

@@ -35,7 +35,7 @@ typedef int (*hash_to_scalar_func_t)(const EC_GROUP *group, EC_SCALAR *out,
                                      uint8_t *buf, size_t len);
 
 typedef struct {
-  const EC_GROUP *group;
+  const EC_GROUP *(*group_func)(void);
 
   // hash_to_group implements the HashToGroup operation for VOPRFs. It returns
   // one on success and zero on error.
@@ -47,20 +47,6 @@ typedef struct {
 
 static const uint8_t kDefaultAdditionalData[32] = {0};
 
-static int voprf_init_method(VOPRF_METHOD *method, int curve_nid,
-                             hash_to_group_func_t hash_to_group,
-                             hash_to_scalar_func_t hash_to_scalar) {
-  method->group = EC_GROUP_new_by_curve_name(curve_nid);
-  if (method->group == NULL) {
-    return 0;
-  }
-
-  method->hash_to_group = hash_to_group;
-  method->hash_to_scalar = hash_to_scalar;
-
-  return 1;
-}
-
 static int cbb_add_point(CBB *out, const EC_GROUP *group,
                          const EC_AFFINE *point) {
   uint8_t *p;
@@ -83,7 +69,7 @@ static int cbb_serialize_point(CBB *out, const EC_GROUP *group,
 
 static int cbs_get_point(CBS *cbs, const EC_GROUP *group, EC_AFFINE *out) {
   CBS child;
-  size_t plen = 1 + 2 * BN_num_bytes(&group->field);
+  size_t plen = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
   if (!CBS_get_bytes(cbs, &child, plen) ||
       !ec_point_from_uncompressed(group, out, CBS_data(&child),
                                   CBS_len(&child))) {
@@ -95,7 +81,7 @@ static int cbs_get_point(CBS *cbs, const EC_GROUP *group, EC_AFFINE *out) {
 static int scalar_to_cbb(CBB *out, const EC_GROUP *group,
                          const EC_SCALAR *scalar) {
   uint8_t *buf;
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   if (!CBB_add_space(out, &buf, scalar_len)) {
     return 0;
   }
@@ -104,7 +90,7 @@ static int scalar_to_cbb(CBB *out, const EC_GROUP *group,
 }
 
 static int scalar_from_cbs(CBS *cbs, const EC_GROUP *group, EC_SCALAR *out) {
-  size_t scalar_len = BN_num_bytes(&group->order);
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   CBS tmp;
   if (!CBS_get_bytes(cbs, &tmp, scalar_len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
@@ -117,7 +103,7 @@ static int scalar_from_cbs(CBS *cbs, const EC_GROUP *group, EC_SCALAR *out) {
 
 static int voprf_calculate_key(const VOPRF_METHOD *method, CBB *out_private,
                                CBB *out_public, const EC_SCALAR *priv) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   EC_JACOBIAN pub;
   EC_AFFINE pub_affine;
   if (!ec_point_mul_scalar_base(group, &pub, priv) ||
@@ -139,7 +125,8 @@ static int voprf_calculate_key(const VOPRF_METHOD *method, CBB *out_private,
 static int voprf_generate_key(const VOPRF_METHOD *method, CBB *out_private,
                               CBB *out_public) {
   EC_SCALAR priv;
-  if (!ec_random_nonzero_scalar(method->group, &priv, kDefaultAdditionalData)) {
+  if (!ec_random_nonzero_scalar(method->group_func(), &priv,
+                                kDefaultAdditionalData)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_KEYGEN_FAILURE);
     return 0;
   }
@@ -162,7 +149,7 @@ static int voprf_derive_key_from_secret(const VOPRF_METHOD *method,
       !CBB_add_bytes(&cbb, kKeygenLabel, sizeof(kKeygenLabel)) ||
       !CBB_add_bytes(&cbb, secret, secret_len) ||
       !CBB_finish(&cbb, &buf, &len) ||
-      !method->hash_to_scalar(method->group, &priv, buf, len)) {
+      !method->hash_to_scalar(method->group_func(), &priv, buf, len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_KEYGEN_FAILURE);
     goto err;
   }
@@ -178,7 +165,7 @@ err:
 static int voprf_client_key_from_bytes(const VOPRF_METHOD *method,
                                        TRUST_TOKEN_CLIENT_KEY *key,
                                        const uint8_t *in, size_t len) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (!ec_point_from_uncompressed(group, &key->pubs, in, len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
@@ -190,7 +177,7 @@ static int voprf_client_key_from_bytes(const VOPRF_METHOD *method,
 static int voprf_issuer_key_from_bytes(const VOPRF_METHOD *method,
                                        TRUST_TOKEN_ISSUER_KEY *key,
                                        const uint8_t *in, size_t len) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (!ec_scalar_from_bytes(group, &key->xs, in, len)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
@@ -213,7 +200,7 @@ static STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_blind(const VOPRF_METHOD *method,
                                                    size_t msg_len) {
   SHA512_CTX hash_ctx;
 
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   STACK_OF(TRUST_TOKEN_PRETOKEN) *pretokens =
       sk_TRUST_TOKEN_PRETOKEN_new_null();
   if (pretokens == NULL) {
@@ -280,6 +267,7 @@ static int hash_to_scalar_dleq(const VOPRF_METHOD *method, EC_SCALAR *out,
                                const EC_AFFINE *K1) {
   static const uint8_t kDLEQLabel[] = "DLEQ";
 
+  const EC_GROUP *group = method->group_func();
   int ok = 0;
   CBB cbb;
   CBB_zero(&cbb);
@@ -287,13 +275,13 @@ static int hash_to_scalar_dleq(const VOPRF_METHOD *method, EC_SCALAR *out,
   size_t len;
   if (!CBB_init(&cbb, 0) ||
       !CBB_add_bytes(&cbb, kDLEQLabel, sizeof(kDLEQLabel)) ||
-      !cbb_add_point(&cbb, method->group, X) ||
-      !cbb_add_point(&cbb, method->group, T) ||
-      !cbb_add_point(&cbb, method->group, W) ||
-      !cbb_add_point(&cbb, method->group, K0) ||
-      !cbb_add_point(&cbb, method->group, K1) ||
+      !cbb_add_point(&cbb, group, X) ||
+      !cbb_add_point(&cbb, group, T) ||
+      !cbb_add_point(&cbb, group, W) ||
+      !cbb_add_point(&cbb, group, K0) ||
+      !cbb_add_point(&cbb, group, K1) ||
       !CBB_finish(&cbb, &buf, &len) ||
-      !method->hash_to_scalar(method->group, out, buf, len)) {
+      !method->hash_to_scalar(group, out, buf, len)) {
     goto err;
   }
 
@@ -311,18 +299,19 @@ static int hash_to_scalar_challenge(const VOPRF_METHOD *method, EC_SCALAR *out,
                                     const EC_AFFINE *a3) {
   static const uint8_t kChallengeLabel[] = "Challenge";
 
+  const EC_GROUP *group = method->group_func();
   CBB cbb;
   uint8_t transcript[5 * EC_MAX_COMPRESSED + 2 + sizeof(kChallengeLabel) - 1];
   size_t len;
   if (!CBB_init_fixed(&cbb, transcript, sizeof(transcript)) ||
-      !cbb_serialize_point(&cbb, method->group, Bm) ||
-      !cbb_serialize_point(&cbb, method->group, a0) ||
-      !cbb_serialize_point(&cbb, method->group, a1) ||
-      !cbb_serialize_point(&cbb, method->group, a2) ||
-      !cbb_serialize_point(&cbb, method->group, a3) ||
+      !cbb_serialize_point(&cbb, group, Bm) ||
+      !cbb_serialize_point(&cbb, group, a0) ||
+      !cbb_serialize_point(&cbb, group, a1) ||
+      !cbb_serialize_point(&cbb, group, a2) ||
+      !cbb_serialize_point(&cbb, group, a3) ||
       !CBB_add_bytes(&cbb, kChallengeLabel, sizeof(kChallengeLabel) - 1) ||
       !CBB_finish(&cbb, NULL, &len) ||
-      !method->hash_to_scalar(method->group, out, transcript, len)) {
+      !method->hash_to_scalar(group, out, transcript, len)) {
     return 0;
   }
 
@@ -348,7 +337,7 @@ static int hash_to_scalar_batch(const VOPRF_METHOD *method, EC_SCALAR *out,
       !CBB_add_bytes(&cbb, CBB_data(points), CBB_len(points)) ||
       !CBB_add_u16(&cbb, (uint16_t)index) ||
       !CBB_finish(&cbb, &buf, &len) ||
-      !method->hash_to_scalar(method->group, out, buf, len)) {
+      !method->hash_to_scalar(method->group_func(), out, buf, len)) {
     goto err;
   }
 
@@ -363,7 +352,7 @@ err:
 static int dleq_generate(const VOPRF_METHOD *method, CBB *cbb,
                          const TRUST_TOKEN_ISSUER_KEY *priv,
                          const EC_JACOBIAN *T, const EC_JACOBIAN *W) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
 
   enum {
     idx_T,
@@ -429,7 +418,7 @@ static int mul_public_2(const EC_GROUP *group, EC_JACOBIAN *out,
 static int dleq_verify(const VOPRF_METHOD *method, CBS *cbs,
                        const TRUST_TOKEN_CLIENT_KEY *pub, const EC_JACOBIAN *T,
                        const EC_JACOBIAN *W) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
 
 
   enum {
@@ -488,7 +477,7 @@ static int dleq_verify(const VOPRF_METHOD *method, CBS *cbs,
 static int voprf_sign_tt(const VOPRF_METHOD *method,
                          const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
                          size_t num_requested, size_t num_to_issue) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (num_requested < num_to_issue) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, ERR_R_INTERNAL_ERROR);
     return 0;
@@ -510,7 +499,7 @@ static int voprf_sign_tt(const VOPRF_METHOD *method,
       !Zs ||
       !es ||
       !CBB_init(&batch_cbb, 0) ||
-      !cbb_add_point(&batch_cbb, method->group, &key->pubs)) {
+      !cbb_add_point(&batch_cbb, group, &key->pubs)) {
     goto err;
   }
 
@@ -567,7 +556,7 @@ static int voprf_sign_tt(const VOPRF_METHOD *method,
   }
 
   // Skip over any unused requests.
-  size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
   if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     goto err;
@@ -587,7 +576,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
     const VOPRF_METHOD *method, const TRUST_TOKEN_CLIENT_KEY *key,
     const STACK_OF(TRUST_TOKEN_PRETOKEN) *pretokens, CBS *cbs, size_t count,
     uint32_t key_id) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (count > sk_TRUST_TOKEN_PRETOKEN_num(pretokens)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return NULL;
@@ -611,7 +600,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
       Zs == NULL ||
       es == NULL ||
       !CBB_init(&batch_cbb, 0) ||
-      !cbb_add_point(&batch_cbb, method->group, &key->pubs)) {
+      !cbb_add_point(&batch_cbb, group, &key->pubs)) {
     goto err;
   }
 
@@ -645,7 +634,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
     // Serialize the token. Include |key_id| to avoid an extra copy in the layer
     // above.
     CBB token_cbb;
-    size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
     if (!CBB_init(&token_cbb, 4 + TRUST_TOKEN_NONCE_SIZE + (2 + point_len)) ||
         !CBB_add_u32(&token_cbb, key_id) ||
         !CBB_add_bytes(&token_cbb, pretoken->salt, TRUST_TOKEN_NONCE_SIZE) ||
@@ -721,7 +710,7 @@ static void sha384_update_point_with_length(
 static int compute_composite_seed(const VOPRF_METHOD *method,
                                   uint8_t out[SHA384_DIGEST_LENGTH],
                                   const EC_AFFINE *pub) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   static const uint8_t kSeedDST[] = "Seed-OPRFV1-\x01-P384-SHA384";
 
   SHA512_CTX hash_ctx;
@@ -739,7 +728,7 @@ static int compute_composite_element(const VOPRF_METHOD *method,
                                      EC_SCALAR *di, size_t index,
                                      const EC_AFFINE *C, const EC_AFFINE *D) {
   static const uint8_t kCompositeLabel[] = "Composite";
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
 
   if (index > UINT16_MAX) {
     return 0;
@@ -758,7 +747,7 @@ static int compute_composite_element(const VOPRF_METHOD *method,
       !CBB_add_bytes(&cbb, kCompositeLabel,
                      sizeof(kCompositeLabel) - 1) ||
       !CBB_finish(&cbb, NULL, &len) ||
-      !method->hash_to_scalar(method->group, di, transcript, len)) {
+      !method->hash_to_scalar(group, di, transcript, len)) {
     return 0;
   }
 
@@ -769,7 +758,7 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
                           const TRUST_TOKEN_ISSUER_KEY *priv,
                           const EC_SCALAR *r, const EC_JACOBIAN *M,
                           const EC_JACOBIAN *Z) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
 
   enum {
     idx_M,
@@ -820,7 +809,7 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
 static int verify_proof(const VOPRF_METHOD *method, CBS *cbs,
                         const TRUST_TOKEN_CLIENT_KEY *pub,
                         const EC_JACOBIAN *M, const EC_JACOBIAN *Z) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
 
   enum {
     idx_M,
@@ -873,7 +862,7 @@ static int voprf_sign_impl(const VOPRF_METHOD *method,
                            const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb,
                            CBS *cbs, size_t num_requested, size_t num_to_issue,
                            const EC_SCALAR *proof_scalar) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (num_requested < num_to_issue) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, ERR_R_INTERNAL_ERROR);
     return 0;
@@ -944,7 +933,7 @@ static int voprf_sign_impl(const VOPRF_METHOD *method,
   }
 
   // Skip over any unused requests.
-  size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
   if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     goto err;
@@ -963,7 +952,7 @@ static int voprf_sign(const VOPRF_METHOD *method,
                       const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
                       size_t num_requested, size_t num_to_issue) {
   EC_SCALAR proof_scalar;
-  if (!ec_random_nonzero_scalar(method->group, &proof_scalar,
+  if (!ec_random_nonzero_scalar(method->group_func(), &proof_scalar,
                                 kDefaultAdditionalData)) {
     return 0;
   }
@@ -977,8 +966,8 @@ static int voprf_sign_with_proof_scalar_for_testing(
     CBS *cbs, size_t num_requested, size_t num_to_issue,
     const uint8_t *proof_scalar_buf, size_t proof_scalar_len) {
   EC_SCALAR proof_scalar;
-  if (!ec_scalar_from_bytes(method->group, &proof_scalar, proof_scalar_buf,
-                            proof_scalar_len)) {
+  if (!ec_scalar_from_bytes(method->group_func(), &proof_scalar,
+                            proof_scalar_buf, proof_scalar_len)) {
     return 0;
   }
   return voprf_sign_impl(method, key, cbb, cbs, num_requested, num_to_issue,
@@ -989,7 +978,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
     const VOPRF_METHOD *method, const TRUST_TOKEN_CLIENT_KEY *key,
     const STACK_OF(TRUST_TOKEN_PRETOKEN) *pretokens, CBS *cbs, size_t count,
     uint32_t key_id) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   if (count > sk_TRUST_TOKEN_PRETOKEN_num(pretokens)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return NULL;
@@ -1044,7 +1033,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
     // Serialize the token. Include |key_id| to avoid an extra copy in the layer
     // above.
     CBB token_cbb;
-    size_t point_len = 1 + 2 * BN_num_bytes(&group->field);
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
     if (!CBB_init(&token_cbb, 4 + TRUST_TOKEN_NONCE_SIZE + (2 + point_len)) ||
         !CBB_add_u32(&token_cbb, key_id) ||
         !CBB_add_bytes(&token_cbb, pretoken->salt, TRUST_TOKEN_NONCE_SIZE) ||
@@ -1099,7 +1088,7 @@ static int voprf_read(const VOPRF_METHOD *method,
                       uint8_t out_nonce[TRUST_TOKEN_NONCE_SIZE],
                       const uint8_t *token, size_t token_len,
                       int include_message, const uint8_t *msg, size_t msg_len) {
-  const EC_GROUP *group = method->group;
+  const EC_GROUP *group = method->group_func();
   CBS cbs, salt;
   CBS_init(&cbs, token, token_len);
   EC_AFFINE Ws;
@@ -1154,57 +1143,27 @@ static int voprf_exp2_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
       group, out, kHashCLabel, sizeof(kHashCLabel), buf, len);
 }
 
-static int voprf_exp2_ok = 0;
-static VOPRF_METHOD voprf_exp2_method;
-static CRYPTO_once_t voprf_exp2_method_once = CRYPTO_ONCE_INIT;
-
-static void voprf_exp2_init_method_impl(void) {
-  voprf_exp2_ok =
-      voprf_init_method(&voprf_exp2_method, NID_secp384r1,
-                        voprf_exp2_hash_to_group, voprf_exp2_hash_to_scalar);
-}
-
-static int voprf_exp2_init_method(void) {
-  CRYPTO_once(&voprf_exp2_method_once, voprf_exp2_init_method_impl);
-  if (!voprf_exp2_ok) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, ERR_R_INTERNAL_ERROR);
-    return 0;
-  }
-  return 1;
-}
+static VOPRF_METHOD voprf_exp2_method = {
+    EC_group_p384, voprf_exp2_hash_to_group, voprf_exp2_hash_to_scalar};
 
 int voprf_exp2_generate_key(CBB *out_private, CBB *out_public) {
-  if (!voprf_exp2_init_method()) {
-    return 0;
-  }
-
   return voprf_generate_key(&voprf_exp2_method, out_private, out_public);
 }
 
 int voprf_exp2_derive_key_from_secret(CBB *out_private, CBB *out_public,
                                       const uint8_t *secret,
                                       size_t secret_len) {
-  if (!voprf_exp2_init_method()) {
-    return 0;
-  }
-
   return voprf_derive_key_from_secret(&voprf_exp2_method, out_private,
                                       out_public, secret, secret_len);
 }
 
 int voprf_exp2_client_key_from_bytes(TRUST_TOKEN_CLIENT_KEY *key,
                                      const uint8_t *in, size_t len) {
-  if (!voprf_exp2_init_method()) {
-    return 0;
-  }
   return voprf_client_key_from_bytes(&voprf_exp2_method, key, in, len);
 }
 
 int voprf_exp2_issuer_key_from_bytes(TRUST_TOKEN_ISSUER_KEY *key,
                                      const uint8_t *in, size_t len) {
-  if (!voprf_exp2_init_method()) {
-    return 0;
-  }
   return voprf_issuer_key_from_bytes(&voprf_exp2_method, key, in, len);
 }
 
@@ -1212,9 +1171,6 @@ STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_exp2_blind(CBB *cbb, size_t count,
                                                  int include_message,
                                                  const uint8_t *msg,
                                                  size_t msg_len) {
-  if (!voprf_exp2_init_method()) {
-    return NULL;
-  }
   return voprf_blind(&voprf_exp2_method, cbb, count, include_message, msg,
                      msg_len);
 }
@@ -1222,7 +1178,7 @@ STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_exp2_blind(CBB *cbb, size_t count,
 int voprf_exp2_sign(const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
                     size_t num_requested, size_t num_to_issue,
                     uint8_t private_metadata) {
-  if (!voprf_exp2_init_method() || private_metadata != 0) {
+  if (private_metadata != 0) {
     return 0;
   }
   return voprf_sign_tt(&voprf_exp2_method, key, cbb, cbs, num_requested,
@@ -1233,9 +1189,6 @@ STACK_OF(TRUST_TOKEN) *voprf_exp2_unblind(
     const TRUST_TOKEN_CLIENT_KEY *key,
     const STACK_OF(TRUST_TOKEN_PRETOKEN) *pretokens, CBS *cbs, size_t count,
     uint32_t key_id) {
-  if (!voprf_exp2_init_method()) {
-    return NULL;
-  }
   return voprf_unblind_tt(&voprf_exp2_method, key, pretokens, cbs, count,
                           key_id);
 }
@@ -1245,9 +1198,6 @@ int voprf_exp2_read(const TRUST_TOKEN_ISSUER_KEY *key,
                     uint8_t *out_private_metadata, const uint8_t *token,
                     size_t token_len, int include_message, const uint8_t *msg,
                     size_t msg_len) {
-  if (!voprf_exp2_init_method()) {
-    return 0;
-  }
   return voprf_read(&voprf_exp2_method, key, out_nonce, token, token_len,
                     include_message, msg, msg_len);
 }
@@ -1269,57 +1219,27 @@ static int voprf_pst1_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                                            sizeof(kHashCLabel) - 1, buf, len);
 }
 
-static int voprf_pst1_ok = 0;
-static VOPRF_METHOD voprf_pst1_method;
-static CRYPTO_once_t voprf_pst1_method_once = CRYPTO_ONCE_INIT;
-
-static void voprf_pst1_init_method_impl(void) {
-  voprf_pst1_ok =
-      voprf_init_method(&voprf_pst1_method, NID_secp384r1,
-                        voprf_pst1_hash_to_group, voprf_pst1_hash_to_scalar);
-}
-
-static int voprf_pst1_init_method(void) {
-  CRYPTO_once(&voprf_pst1_method_once, voprf_pst1_init_method_impl);
-  if (!voprf_pst1_ok) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, ERR_R_INTERNAL_ERROR);
-    return 0;
-  }
-  return 1;
-}
+static VOPRF_METHOD voprf_pst1_method = {
+    EC_group_p384, voprf_pst1_hash_to_group, voprf_pst1_hash_to_scalar};
 
 int voprf_pst1_generate_key(CBB *out_private, CBB *out_public) {
-  if (!voprf_pst1_init_method()) {
-    return 0;
-  }
-
   return voprf_generate_key(&voprf_pst1_method, out_private, out_public);
 }
 
 int voprf_pst1_derive_key_from_secret(CBB *out_private, CBB *out_public,
                                       const uint8_t *secret,
                                       size_t secret_len) {
-  if (!voprf_pst1_init_method()) {
-    return 0;
-  }
-
   return voprf_derive_key_from_secret(&voprf_pst1_method, out_private,
                                       out_public, secret, secret_len);
 }
 
 int voprf_pst1_client_key_from_bytes(TRUST_TOKEN_CLIENT_KEY *key,
                                      const uint8_t *in, size_t len) {
-  if (!voprf_pst1_init_method()) {
-    return 0;
-  }
   return voprf_client_key_from_bytes(&voprf_pst1_method, key, in, len);
 }
 
 int voprf_pst1_issuer_key_from_bytes(TRUST_TOKEN_ISSUER_KEY *key,
                                      const uint8_t *in, size_t len) {
-  if (!voprf_pst1_init_method()) {
-    return 0;
-  }
   return voprf_issuer_key_from_bytes(&voprf_pst1_method, key, in, len);
 }
 
@@ -1327,9 +1247,6 @@ STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_pst1_blind(CBB *cbb, size_t count,
                                                  int include_message,
                                                  const uint8_t *msg,
                                                  size_t msg_len) {
-  if (!voprf_pst1_init_method()) {
-    return NULL;
-  }
   return voprf_blind(&voprf_pst1_method, cbb, count, include_message, msg,
                      msg_len);
 }
@@ -1337,7 +1254,7 @@ STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_pst1_blind(CBB *cbb, size_t count,
 int voprf_pst1_sign(const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs,
                     size_t num_requested, size_t num_to_issue,
                     uint8_t private_metadata) {
-  if (!voprf_pst1_init_method() || private_metadata != 0) {
+  if (private_metadata != 0) {
     return 0;
   }
   return voprf_sign(&voprf_pst1_method, key, cbb, cbs, num_requested,
@@ -1349,7 +1266,7 @@ int voprf_pst1_sign_with_proof_scalar_for_testing(
     const TRUST_TOKEN_ISSUER_KEY *key, CBB *cbb, CBS *cbs, size_t num_requested,
     size_t num_to_issue, uint8_t private_metadata,
     const uint8_t *proof_scalar_buf, size_t proof_scalar_len) {
-  if (!voprf_pst1_init_method() || private_metadata != 0) {
+  if (private_metadata != 0) {
     return 0;
   }
   return voprf_sign_with_proof_scalar_for_testing(
@@ -1361,9 +1278,6 @@ STACK_OF(TRUST_TOKEN) *voprf_pst1_unblind(
     const TRUST_TOKEN_CLIENT_KEY *key,
     const STACK_OF(TRUST_TOKEN_PRETOKEN) *pretokens, CBS *cbs, size_t count,
     uint32_t key_id) {
-  if (!voprf_pst1_init_method()) {
-    return NULL;
-  }
   return voprf_unblind(&voprf_pst1_method, key, pretokens, cbs, count, key_id);
 }
 
@@ -1372,9 +1286,6 @@ int voprf_pst1_read(const TRUST_TOKEN_ISSUER_KEY *key,
                     uint8_t *out_private_metadata, const uint8_t *token,
                     size_t token_len, int include_message, const uint8_t *msg,
                     size_t msg_len) {
-  if (!voprf_pst1_init_method()) {
-    return 0;
-  }
   return voprf_read(&voprf_pst1_method, key, out_nonce, token, token_len,
                     include_message, msg, msg_len);
 }