grpc 1.62.0 → 1.64.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c

@@ -274,6 +274,8 @@ int DSA_generate_parameters_ex(DSA *dsa, unsigned bits, const uint8_t *seed_in,
         if (!RAND_bytes(seed, qsize)) {
           goto err;
         }
+        // DSA parameters are public.
+        CONSTTIME_DECLASSIFY(seed, qsize);
       } else {
         // If we come back through, use random seed next time.
         seed_in = NULL;
@@ -513,6 +515,9 @@ int DSA_generate_key(DSA *dsa) {
     goto err;
   }
 
+  // The public key is computed from the private key, but is public.
+  bn_declassify(pub_key);
+
   dsa->priv_key = priv_key;
   dsa->pub_key = pub_key;
   ok = 1;
@@ -649,6 +654,10 @@ redo:
     goto err;
   }
 
+  // The signature is computed from the private key, but is public.
+  bn_declassify(r);
+  bn_declassify(s);
+
   // Redo if r or s is zero as required by FIPS 186-3: this is
   // very unlikely.
   if (BN_is_zero(r) || BN_is_zero(s)) {
@@ -681,7 +690,7 @@ err:
   return ret;
 }
 
-int DSA_do_verify(const uint8_t *digest, size_t digest_len, DSA_SIG *sig,
+int DSA_do_verify(const uint8_t *digest, size_t digest_len, const DSA_SIG *sig,
                   const DSA *dsa) {
   int valid;
   if (!DSA_do_check_signature(&valid, digest, digest_len, sig, dsa)) {
@@ -691,7 +700,8 @@ int DSA_do_verify(const uint8_t *digest, size_t digest_len, DSA_SIG *sig,
 }
 
 int DSA_do_check_signature(int *out_valid, const uint8_t *digest,
-                           size_t digest_len, DSA_SIG *sig, const DSA *dsa) {
+                           size_t digest_len, const DSA_SIG *sig,
+                           const DSA *dsa) {
   *out_valid = 0;
   if (!dsa_check_key(dsa)) {
     return 0;
@@ -899,15 +909,19 @@ static int dsa_sign_setup(const DSA *dsa, BN_CTX *ctx, BIGNUM **out_kinv,
                               ctx) ||
       // Compute r = (g^k mod p) mod q
       !BN_mod_exp_mont_consttime(r, dsa->g, &k, dsa->p, ctx,
-                                 dsa->method_mont_p) ||
-      // Note |BN_mod| below is not constant-time and may leak information about
-      // |r|. |dsa->p| may be significantly larger than |dsa->q|, so this is not
-      // easily performed in constant-time with Montgomery reduction.
-      //
-      // However, |r| at this point is g^k (mod p). It is almost the value of
-      // |r| revealed in the signature anyway (g^k (mod p) (mod q)), going from
-      // it to |k| would require computing a discrete log.
-      !BN_mod(r, r, dsa->q, ctx) ||
+                                 dsa->method_mont_p)) {
+    OPENSSL_PUT_ERROR(DSA, ERR_R_BN_LIB);
+    goto err;
+  }
+  // Note |BN_mod| below is not constant-time and may leak information about
+  // |r|. |dsa->p| may be significantly larger than |dsa->q|, so this is not
+  // easily performed in constant-time with Montgomery reduction.
+  //
+  // However, |r| at this point is g^k (mod p). It is almost the value of |r|
+  // revealed in the signature anyway (g^k (mod p) (mod q)), going from it to
+  // |k| would require computing a discrete log.
+  bn_declassify(r);
+  if (!BN_mod(r, r, dsa->q, ctx) ||
       // Compute part of 's = inv(k) (m + xr) mod q' using Fermat's Little
       // Theorem.
       !bn_mod_inverse_prime(kinv, &k, dsa->q, ctx, dsa->method_mont_q)) {
@@ -934,12 +948,7 @@ err:
 
 int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
                          CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
-  int index;
-  if (!CRYPTO_get_ex_new_index(&g_ex_data_class, &index, argl, argp,
-                               free_func)) {
-    return -1;
-  }
-  return index;
+  return CRYPTO_get_ex_new_index_ex(&g_ex_data_class, argl, argp, free_func);
 }
 
 int DSA_set_ex_data(DSA *dsa, int idx, void *arg) {

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa_asn1.c

@@ -119,8 +119,9 @@ int dsa_check_key(const DSA *dsa) {
   if (dsa->priv_key != NULL) {
     // The private key is a non-zero element of the scalar field, determined by
     // |q|.
-    if (BN_is_negative(dsa->priv_key) || BN_is_zero(dsa->priv_key) ||
-        BN_cmp(dsa->priv_key, dsa->q) >= 0) {
+    if (BN_is_negative(dsa->priv_key) ||
+        constant_time_declassify_int(BN_is_zero(dsa->priv_key)) ||
+        constant_time_declassify_int(BN_cmp(dsa->priv_key, dsa->q) >= 0)) {
       OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS);
       return 0;
     }

data/third_party/boringssl-with-bazel/src/crypto/err/err.c

@@ -164,6 +164,17 @@ extern const uint32_t kOpenSSLReasonValues[];
 extern const size_t kOpenSSLReasonValuesLen;
 extern const char kOpenSSLReasonStringData[];
 
+static char *strdup_libc_malloc(const char *str) {
+  // |strdup| is not in C until C23, so MSVC triggers deprecation warnings, and
+  // glibc and musl gate it on a feature macro. Reimplementing it is easier.
+  size_t len = strlen(str);
+  char *ret = malloc(len + 1);
+  if (ret != NULL) {
+    memcpy(ret, str, len + 1);
+  }
+  return ret;
+}
+
 // err_clear clears the given queued error.
 static void err_clear(struct err_error_st *error) {
   free(error->data);
@@ -174,13 +185,9 @@ static void err_copy(struct err_error_st *dst, const struct err_error_st *src) {
   err_clear(dst);
   dst->file = src->file;
   if (src->data != NULL) {
-    // Disable deprecated functions on msvc so it doesn't complain about strdup.
-    OPENSSL_MSVC_PRAGMA(warning(push))
-    OPENSSL_MSVC_PRAGMA(warning(disable : 4996))
     // We can't use OPENSSL_strdup because we don't want to call OPENSSL_malloc,
     // which can affect the error stack.
-    dst->data = strdup(src->data);
-    OPENSSL_MSVC_PRAGMA(warning(pop))
+    dst->data = strdup_libc_malloc(src->data);
   }
   dst->packed = src->packed;
   dst->line = src->line;
@@ -428,50 +435,52 @@ static const char *err_string_lookup(uint32_t lib, uint32_t key,
   return &string_data[(*result) & 0x7fff];
 }
 
-static const char *const kLibraryNames[ERR_NUM_LIBS] = {
-    "invalid library (0)",
-    "unknown library",              // ERR_LIB_NONE
-    "system library",               // ERR_LIB_SYS
-    "bignum routines",              // ERR_LIB_BN
-    "RSA routines",                 // ERR_LIB_RSA
-    "Diffie-Hellman routines",      // ERR_LIB_DH
-    "public key routines",          // ERR_LIB_EVP
-    "memory buffer routines",       // ERR_LIB_BUF
-    "object identifier routines",   // ERR_LIB_OBJ
-    "PEM routines",                 // ERR_LIB_PEM
-    "DSA routines",                 // ERR_LIB_DSA
-    "X.509 certificate routines",   // ERR_LIB_X509
-    "ASN.1 encoding routines",      // ERR_LIB_ASN1
-    "configuration file routines",  // ERR_LIB_CONF
-    "common libcrypto routines",    // ERR_LIB_CRYPTO
-    "elliptic curve routines",      // ERR_LIB_EC
-    "SSL routines",                 // ERR_LIB_SSL
-    "BIO routines",                 // ERR_LIB_BIO
-    "PKCS7 routines",               // ERR_LIB_PKCS7
-    "PKCS8 routines",               // ERR_LIB_PKCS8
-    "X509 V3 routines",             // ERR_LIB_X509V3
-    "random number generator",      // ERR_LIB_RAND
-    "ENGINE routines",              // ERR_LIB_ENGINE
-    "OCSP routines",                // ERR_LIB_OCSP
-    "UI routines",                  // ERR_LIB_UI
-    "COMP routines",                // ERR_LIB_COMP
-    "ECDSA routines",               // ERR_LIB_ECDSA
-    "ECDH routines",                // ERR_LIB_ECDH
-    "HMAC routines",                // ERR_LIB_HMAC
-    "Digest functions",             // ERR_LIB_DIGEST
-    "Cipher functions",             // ERR_LIB_CIPHER
-    "HKDF functions",               // ERR_LIB_HKDF
-    "Trust Token functions",        // ERR_LIB_TRUST_TOKEN
-    "User defined functions",       // ERR_LIB_USER
+typedef struct library_name_st {
+  const char *str;
+  const char *symbol;
+  const char *reason_symbol;
+} LIBRARY_NAME;
+
+static const LIBRARY_NAME kLibraryNames[ERR_NUM_LIBS] = {
+    {"invalid library (0)", NULL, NULL},
+    {"unknown library", "NONE", "NONE_LIB"},
+    {"system library", "SYS", "SYS_LIB"},
+    {"bignum routines", "BN", "BN_LIB"},
+    {"RSA routines", "RSA", "RSA_LIB"},
+    {"Diffie-Hellman routines", "DH", "DH_LIB"},
+    {"public key routines", "EVP", "EVP_LIB"},
+    {"memory buffer routines", "BUF", "BUF_LIB"},
+    {"object identifier routines", "OBJ", "OBJ_LIB"},
+    {"PEM routines", "PEM", "PEM_LIB"},
+    {"DSA routines", "DSA", "DSA_LIB"},
+    {"X.509 certificate routines", "X509", "X509_LIB"},
+    {"ASN.1 encoding routines", "ASN1", "ASN1_LIB"},
+    {"configuration file routines", "CONF", "CONF_LIB"},
+    {"common libcrypto routines", "CRYPTO", "CRYPTO_LIB"},
+    {"elliptic curve routines", "EC", "EC_LIB"},
+    {"SSL routines", "SSL", "SSL_LIB"},
+    {"BIO routines", "BIO", "BIO_LIB"},
+    {"PKCS7 routines", "PKCS7", "PKCS7_LIB"},
+    {"PKCS8 routines", "PKCS8", "PKCS8_LIB"},
+    {"X509 V3 routines", "X509V3", "X509V3_LIB"},
+    {"random number generator", "RAND", "RAND_LIB"},
+    {"ENGINE routines", "ENGINE", "ENGINE_LIB"},
+    {"OCSP routines", "OCSP", "OCSP_LIB"},
+    {"UI routines", "UI", "UI_LIB"},
+    {"COMP routines", "COMP", "COMP_LIB"},
+    {"ECDSA routines", "ECDSA", "ECDSA_LIB"},
+    {"ECDH routines", "ECDH", "ECDH_LIB"},
+    {"HMAC routines", "HMAC", "HMAC_LIB"},
+    {"Digest functions", "DIGEST", "DIGEST_LIB"},
+    {"Cipher functions", "CIPHER", "CIPHER_LIB"},
+    {"HKDF functions", "HKDF", "HKDF_LIB"},
+    {"Trust Token functions", "TRUST_TOKEN", "TRUST_TOKEN_LIB"},
+    {"User defined functions", "USER", "USER_LIB"},
 };
 
 static const char *err_lib_error_string(uint32_t packed_error) {
   const uint32_t lib = ERR_GET_LIB(packed_error);
-
-  if (lib >= ERR_NUM_LIBS) {
-    return NULL;
-  }
-  return kLibraryNames[lib];
+  return lib >= ERR_NUM_LIBS ? NULL : kLibraryNames[lib].str;
 }
 
 const char *ERR_lib_error_string(uint32_t packed_error) {
@@ -479,51 +488,67 @@ const char *ERR_lib_error_string(uint32_t packed_error) {
   return ret == NULL ? "unknown library" : ret;
 }
 
+const char *ERR_lib_symbol_name(uint32_t packed_error) {
+  const uint32_t lib = ERR_GET_LIB(packed_error);
+  return lib >= ERR_NUM_LIBS ? NULL : kLibraryNames[lib].symbol;
+}
+
 const char *ERR_func_error_string(uint32_t packed_error) {
   return "OPENSSL_internal";
 }
 
-static const char *err_reason_error_string(uint32_t packed_error) {
+static const char *err_reason_error_string(uint32_t packed_error, int symbol) {
   const uint32_t lib = ERR_GET_LIB(packed_error);
   const uint32_t reason = ERR_GET_REASON(packed_error);
 
   if (lib == ERR_LIB_SYS) {
-    if (reason < 127) {
+    if (!symbol && reason < 127) {
       return strerror(reason);
     }
     return NULL;
   }
 
   if (reason < ERR_NUM_LIBS) {
-    return kLibraryNames[reason];
+    return symbol ? kLibraryNames[reason].reason_symbol
+                  : kLibraryNames[reason].str;
   }
 
   if (reason < 100) {
+    // TODO(davidben): All our other reason strings match the symbol name. Only
+    // the common ones differ. Should we just consistently return the symbol
+    // name?
     switch (reason) {
       case ERR_R_MALLOC_FAILURE:
-        return "malloc failure";
+        return symbol ? "MALLOC_FAILURE" : "malloc failure";
       case ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED:
-        return "function should not have been called";
+        return symbol ? "SHOULD_NOT_HAVE_BEEN_CALLED"
+                      : "function should not have been called";
       case ERR_R_PASSED_NULL_PARAMETER:
-        return "passed a null parameter";
+        return symbol ? "PASSED_NULL_PARAMETER" : "passed a null parameter";
       case ERR_R_INTERNAL_ERROR:
-        return "internal error";
+        return symbol ? "INTERNAL_ERROR" : "internal error";
       case ERR_R_OVERFLOW:
-        return "overflow";
+        return symbol ? "OVERFLOW" : "overflow";
       default:
         return NULL;
     }
   }
 
+  // Unlike OpenSSL, BoringSSL's reason strings already match symbol name, so we
+  // do not need to check |symbol|.
   return err_string_lookup(lib, reason, kOpenSSLReasonValues,
                            kOpenSSLReasonValuesLen, kOpenSSLReasonStringData);
 }
 
 const char *ERR_reason_error_string(uint32_t packed_error) {
-  const char *ret = err_reason_error_string(packed_error);
+  const char *ret = err_reason_error_string(packed_error, /*symbol=*/0);
   return ret == NULL ? "unknown error" : ret;
 }
 
+const char *ERR_reason_symbol_name(uint32_t packed_error) {
+  return err_reason_error_string(packed_error, /*symbol=*/1);
+}
+
 char *ERR_error_string(uint32_t packed_error, char *ret) {
   static char buf[ERR_ERROR_STRING_BUF_LEN];
 
@@ -550,7 +575,7 @@ char *ERR_error_string_n(uint32_t packed_error, char *buf, size_t len) {
   unsigned reason = ERR_GET_REASON(packed_error);
 
   const char *lib_str = err_lib_error_string(packed_error);
-  const char *reason_str = err_reason_error_string(packed_error);
+  const char *reason_str = err_reason_error_string(packed_error, /*symbol=*/0);
 
   char lib_buf[32], reason_buf[32];
   if (lib_str == NULL) {
@@ -749,13 +774,9 @@ void ERR_set_error_data(char *data, int flags) {
     assert(0);
     return;
   }
-  // Disable deprecated functions on msvc so it doesn't complain about strdup.
-  OPENSSL_MSVC_PRAGMA(warning(push))
-  OPENSSL_MSVC_PRAGMA(warning(disable : 4996))
   // We can not use OPENSSL_strdup because we don't want to call OPENSSL_malloc,
   // which can affect the error stack.
-  char *copy = strdup(data);
-  OPENSSL_MSVC_PRAGMA(warning(pop))
+  char *copy = strdup_libc_malloc(data);
   if (copy != NULL) {
     err_set_error_data(copy);
   }

data/third_party/boringssl-with-bazel/src/crypto/evp/evp.c

@@ -59,12 +59,9 @@
 #include <assert.h>
 #include <string.h>
 
-#include <openssl/dsa.h>
-#include <openssl/ec.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
-#include <openssl/rsa.h>
 #include <openssl/thread.h>
 
 #include "internal.h"
@@ -149,9 +146,7 @@ int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
 
 int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) {
   if (to->type == EVP_PKEY_NONE) {
-    if (!EVP_PKEY_set_type(to, from->type)) {
-      return 0;
-    }
+    evp_pkey_set_method(to, from->ameth);
   } else if (to->type != from->type) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DIFFERENT_KEY_TYPES);
     return 0;
@@ -225,117 +220,21 @@ static const EVP_PKEY_ASN1_METHOD *evp_pkey_asn1_find(int nid) {
   }
 }
 
-static void evp_pkey_set_method(EVP_PKEY *pkey,
-                                const EVP_PKEY_ASN1_METHOD *method) {
+void evp_pkey_set_method(EVP_PKEY *pkey, const EVP_PKEY_ASN1_METHOD *method) {
   free_it(pkey);
   pkey->ameth = method;
   pkey->type = pkey->ameth->pkey_id;
 }
 
 int EVP_PKEY_type(int nid) {
-  const EVP_PKEY_ASN1_METHOD *meth = evp_pkey_asn1_find(nid);
-  if (meth == NULL) {
-    return NID_undef;
-  }
-  return meth->pkey_id;
-}
-
-int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) {
-  if (EVP_PKEY_assign_RSA(pkey, key)) {
-    RSA_up_ref(key);
-    return 1;
-  }
-  return 0;
-}
-
-int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) {
-  evp_pkey_set_method(pkey, &rsa_asn1_meth);
-  pkey->pkey = key;
-  return key != NULL;
-}
-
-RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey) {
-  if (pkey->type != EVP_PKEY_RSA) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_AN_RSA_KEY);
-    return NULL;
-  }
-  return pkey->pkey;
-}
-
-RSA *EVP_PKEY_get1_RSA(const EVP_PKEY *pkey) {
-  RSA *rsa = EVP_PKEY_get0_RSA(pkey);
-  if (rsa != NULL) {
-    RSA_up_ref(rsa);
-  }
-  return rsa;
+  // In OpenSSL, this was used to map between type aliases. BoringSSL supports
+  // no type aliases, so this function is just the identity.
+  return nid;
 }
 
-int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key) {
-  if (EVP_PKEY_assign_DSA(pkey, key)) {
-    DSA_up_ref(key);
-    return 1;
-  }
-  return 0;
-}
-
-int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) {
-  evp_pkey_set_method(pkey, &dsa_asn1_meth);
-  pkey->pkey = key;
-  return key != NULL;
-}
-
-DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey) {
-  if (pkey->type != EVP_PKEY_DSA) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_A_DSA_KEY);
-    return NULL;
-  }
-  return pkey->pkey;
-}
-
-DSA *EVP_PKEY_get1_DSA(const EVP_PKEY *pkey) {
-  DSA *dsa = EVP_PKEY_get0_DSA(pkey);
-  if (dsa != NULL) {
-    DSA_up_ref(dsa);
-  }
-  return dsa;
-}
-
-int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
-  if (EVP_PKEY_assign_EC_KEY(pkey, key)) {
-    EC_KEY_up_ref(key);
-    return 1;
-  }
-  return 0;
-}
-
-int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
-  evp_pkey_set_method(pkey, &ec_asn1_meth);
-  pkey->pkey = key;
-  return key != NULL;
-}
-
-EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
-  if (pkey->type != EVP_PKEY_EC) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_AN_EC_KEY_KEY);
-    return NULL;
-  }
-  return pkey->pkey;
-}
-
-EC_KEY *EVP_PKEY_get1_EC_KEY(const EVP_PKEY *pkey) {
-  EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
-  if (ec_key != NULL) {
-    EC_KEY_up_ref(ec_key);
-  }
-  return ec_key;
-}
-
-DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey) { return NULL; }
-DH *EVP_PKEY_get1_DH(const EVP_PKEY *pkey) { return NULL; }
-
 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) {
-  // This function can only be used to assign RSA, DSA, and EC keys. Other key
-  // types have internal representations which are not exposed through the
+  // This function can only be used to assign RSA, DSA, EC, and DH keys. Other
+  // key types have internal representations which are not exposed through the
   // public API.
   switch (type) {
     case EVP_PKEY_RSA:
@@ -344,6 +243,8 @@ int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) {
       return EVP_PKEY_assign_DSA(pkey, key);
     case EVP_PKEY_EC:
       return EVP_PKEY_assign_EC_KEY(pkey, key);
+    case EVP_PKEY_DH:
+      return EVP_PKEY_assign_DH(pkey, key);
   }
 
   OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
@@ -375,16 +276,26 @@ int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
 
 EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *unused,
                                        const uint8_t *in, size_t len) {
-  EVP_PKEY *ret = EVP_PKEY_new();
-  if (ret == NULL ||
-      !EVP_PKEY_set_type(ret, type)) {
-    goto err;
+  // To avoid pulling in all key types, look for specifically the key types that
+  // support |set_priv_raw|.
+  const EVP_PKEY_ASN1_METHOD *method;
+  switch (type) {
+    case EVP_PKEY_X25519:
+      method = &x25519_asn1_meth;
+      break;
+    case EVP_PKEY_ED25519:
+      method = &ed25519_asn1_meth;
+      break;
+    default:
+      OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+      return 0;
   }
 
-  if (ret->ameth->set_priv_raw == NULL) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+  EVP_PKEY *ret = EVP_PKEY_new();
+  if (ret == NULL) {
     goto err;
   }
+  evp_pkey_set_method(ret, method);
 
   if (!ret->ameth->set_priv_raw(ret, in, len)) {
     goto err;
@@ -399,16 +310,26 @@ err:
 
 EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *unused,
                                       const uint8_t *in, size_t len) {
-  EVP_PKEY *ret = EVP_PKEY_new();
-  if (ret == NULL ||
-      !EVP_PKEY_set_type(ret, type)) {
-    goto err;
+  // To avoid pulling in all key types, look for specifically the key types that
+  // support |set_pub_raw|.
+  const EVP_PKEY_ASN1_METHOD *method;
+  switch (type) {
+    case EVP_PKEY_X25519:
+      method = &x25519_asn1_meth;
+      break;
+    case EVP_PKEY_ED25519:
+      method = &ed25519_asn1_meth;
+      break;
+    default:
+      OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+      return 0;
   }
 
-  if (ret->ameth->set_pub_raw == NULL) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+  EVP_PKEY *ret = EVP_PKEY_new();
+  if (ret == NULL) {
     goto err;
   }
+  evp_pkey_set_method(ret, method);
 
   if (!ret->ameth->set_pub_raw(ret, in, len)) {
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/evp/evp_asn1.c

@@ -69,6 +69,7 @@
 #include "../internal.h"
 
 
+// We intentionally omit |dh_asn1_meth| from this list. It is not serializable.
 static const EVP_PKEY_ASN1_METHOD *const kASN1Methods[] = {
     &rsa_asn1_meth,
     &ec_asn1_meth,
@@ -77,28 +78,26 @@ static const EVP_PKEY_ASN1_METHOD *const kASN1Methods[] = {
     &x25519_asn1_meth,
 };
 
-static int parse_key_type(CBS *cbs, int *out_type) {
+static const EVP_PKEY_ASN1_METHOD *parse_key_type(CBS *cbs) {
   CBS oid;
   if (!CBS_get_asn1(cbs, &oid, CBS_ASN1_OBJECT)) {
-    return 0;
+    return NULL;
   }
 
   for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kASN1Methods); i++) {
     const EVP_PKEY_ASN1_METHOD *method = kASN1Methods[i];
     if (CBS_len(&oid) == method->oid_len &&
         OPENSSL_memcmp(CBS_data(&oid), method->oid, method->oid_len) == 0) {
-      *out_type = method->pkey_id;
-      return 1;
+      return method;
     }
   }
 
-  return 0;
+  return NULL;
 }
 
 EVP_PKEY *EVP_parse_public_key(CBS *cbs) {
   // Parse the SubjectPublicKeyInfo.
   CBS spki, algorithm, key;
-  int type;
   uint8_t padding;
   if (!CBS_get_asn1(cbs, &spki, CBS_ASN1_SEQUENCE) ||
       !CBS_get_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
@@ -107,7 +106,8 @@ EVP_PKEY *EVP_parse_public_key(CBS *cbs) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     return NULL;
   }
-  if (!parse_key_type(&algorithm, &type)) {
+  const EVP_PKEY_ASN1_METHOD *method = parse_key_type(&algorithm);
+  if (method == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
     return NULL;
   }
@@ -121,10 +121,10 @@ EVP_PKEY *EVP_parse_public_key(CBS *cbs) {
 
   // Set up an |EVP_PKEY| of the appropriate type.
   EVP_PKEY *ret = EVP_PKEY_new();
-  if (ret == NULL ||
-      !EVP_PKEY_set_type(ret, type)) {
+  if (ret == NULL) {
     goto err;
   }
+  evp_pkey_set_method(ret, method);
 
   // Call into the type-specific SPKI decoding function.
   if (ret->ameth->pub_decode == NULL) {
@@ -155,7 +155,6 @@ EVP_PKEY *EVP_parse_private_key(CBS *cbs) {
   // Parse the PrivateKeyInfo.
   CBS pkcs8, algorithm, key;
   uint64_t version;
-  int type;
   if (!CBS_get_asn1(cbs, &pkcs8, CBS_ASN1_SEQUENCE) ||
       !CBS_get_asn1_uint64(&pkcs8, &version) ||
       version != 0 ||
@@ -164,7 +163,8 @@ EVP_PKEY *EVP_parse_private_key(CBS *cbs) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     return NULL;
   }
-  if (!parse_key_type(&algorithm, &type)) {
+  const EVP_PKEY_ASN1_METHOD *method = parse_key_type(&algorithm);
+  if (method == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
     return NULL;
   }
@@ -173,10 +173,10 @@ EVP_PKEY *EVP_parse_private_key(CBS *cbs) {
 
   // Set up an |EVP_PKEY| of the appropriate type.
   EVP_PKEY *ret = EVP_PKEY_new();
-  if (ret == NULL ||
-      !EVP_PKEY_set_type(ret, type)) {
+  if (ret == NULL) {
     goto err;
   }
+  evp_pkey_set_method(ret, method);
 
   // Call into the type-specific PrivateKeyInfo decoding function.
   if (ret->ameth->priv_decode == NULL) {

data/third_party/boringssl-with-bazel/src/crypto/evp/internal.h

@@ -213,6 +213,7 @@ OPENSSL_EXPORT int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
 #define EVP_PKEY_CTRL_HKDF_KEY (EVP_PKEY_ALG_CTRL + 16)
 #define EVP_PKEY_CTRL_HKDF_SALT (EVP_PKEY_ALG_CTRL + 17)
 #define EVP_PKEY_CTRL_HKDF_INFO (EVP_PKEY_ALG_CTRL + 18)
+#define EVP_PKEY_CTRL_DH_PAD (EVP_PKEY_ALG_CTRL + 19)
 
 struct evp_pkey_ctx_st {
   // Method associated with this operation
@@ -288,12 +289,18 @@ extern const EVP_PKEY_ASN1_METHOD ec_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD rsa_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth;
 extern const EVP_PKEY_ASN1_METHOD x25519_asn1_meth;
+extern const EVP_PKEY_ASN1_METHOD dh_asn1_meth;
 
 extern const EVP_PKEY_METHOD rsa_pkey_meth;
 extern const EVP_PKEY_METHOD ec_pkey_meth;
 extern const EVP_PKEY_METHOD ed25519_pkey_meth;
 extern const EVP_PKEY_METHOD x25519_pkey_meth;
 extern const EVP_PKEY_METHOD hkdf_pkey_meth;
+extern const EVP_PKEY_METHOD dh_pkey_meth;
+
+// evp_pkey_set_method behaves like |EVP_PKEY_set_type|, but takes a pointer to
+// a method table. This avoids depending on every |EVP_PKEY_ASN1_METHOD|.
+void evp_pkey_set_method(EVP_PKEY *pkey, const EVP_PKEY_ASN1_METHOD *method);
 
 
 #if defined(__cplusplus)