grpc 1.66.0 → 1.67.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/{p256-nistz.c → p256-nistz.c.inc}

@@ -39,7 +39,7 @@
 typedef P256_POINT_AFFINE PRECOMP256_ROW[64];
 
 // One converted into the Montgomery domain
-static const BN_ULONG ONE[P256_LIMBS] = {
+static const BN_ULONG ONE_MONT[P256_LIMBS] = {
     TOBN(0x00000000, 0x00000001), TOBN(0xffffffff, 0x00000000),
     TOBN(0xffffffff, 0xffffffff), TOBN(0x00000000, 0xfffffffe),
 };
@@ -116,6 +116,103 @@ static BN_ULONG is_not_zero(BN_ULONG in) {
   return in;
 }
 
+#if defined(OPENSSL_X86_64)
+// Dispatch between CPU variations. The "_adx" suffixed functions use MULX in
+// addition to ADCX/ADOX. MULX is part of BMI2, not ADX, so we must check both
+// capabilities.
+static void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
+                                  const BN_ULONG a[P256_LIMBS],
+                                  const BN_ULONG b[P256_LIMBS]) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_mul_mont_adx(res, a, b);
+  } else {
+    ecp_nistz256_mul_mont_nohw(res, a, b);
+  }
+}
+
+static void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS],
+                                  const BN_ULONG a[P256_LIMBS]) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_sqr_mont_adx(res, a);
+  } else {
+    ecp_nistz256_sqr_mont_nohw(res, a);
+  }
+}
+
+static void ecp_nistz256_ord_mul_mont(BN_ULONG res[P256_LIMBS],
+                                      const BN_ULONG a[P256_LIMBS],
+                                      const BN_ULONG b[P256_LIMBS]) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_ord_mul_mont_adx(res, a, b);
+  } else {
+    ecp_nistz256_ord_mul_mont_nohw(res, a, b);
+  }
+}
+
+static void ecp_nistz256_ord_sqr_mont(BN_ULONG res[P256_LIMBS],
+                                      const BN_ULONG a[P256_LIMBS],
+                                      BN_ULONG rep) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_ord_sqr_mont_adx(res, a, rep);
+  } else {
+    ecp_nistz256_ord_sqr_mont_nohw(res, a, rep);
+  }
+}
+
+static void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16],
+                                   int index) {
+  if (CRYPTO_is_AVX2_capable()) {
+    ecp_nistz256_select_w5_avx2(val, in_t, index);
+  } else {
+    ecp_nistz256_select_w5_nohw(val, in_t, index);
+  }
+}
+
+static void ecp_nistz256_select_w7(P256_POINT_AFFINE *val,
+                                   const P256_POINT_AFFINE in_t[64],
+                                   int index) {
+  if (CRYPTO_is_AVX2_capable()) {
+    ecp_nistz256_select_w7_avx2(val, in_t, index);
+  } else {
+    ecp_nistz256_select_w7_nohw(val, in_t, index);
+  }
+}
+
+static void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_point_double_adx(r, a);
+  } else {
+    ecp_nistz256_point_double_nohw(r, a);
+  }
+}
+
+static void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a,
+                                   const P256_POINT *b) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_point_add_adx(r, a, b);
+  } else {
+    ecp_nistz256_point_add_nohw(r, a, b);
+  }
+}
+
+static void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
+                                          const P256_POINT_AFFINE *b) {
+  if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
+    ecp_nistz256_point_add_affine_adx(r, a, b);
+  } else {
+    ecp_nistz256_point_add_affine_nohw(r, a, b);
+  }
+}
+#endif  // OPENSSL_X86_64
+
+// ecp_nistz256_from_mont sets |res| to |in|, converted from Montgomery domain
+// by multiplying with 1.
+static void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS],
+                                   const BN_ULONG in[P256_LIMBS]) {
+  static const BN_ULONG ONE[P256_LIMBS] = {1};
+  ecp_nistz256_mul_mont(res, in, ONE);
+}
+
 // ecp_nistz256_mod_inverse_sqr_mont sets |r| to (|in| * 2^-256)^-2 * 2^256 mod
 // p. That is, |r| is the modular inverse square of |in| for input and output in
 // the Montgomery domain.
@@ -328,12 +425,12 @@ static void ecp_nistz256_point_mul_base(const EC_GROUP *group, EC_JACOBIAN *r,
   copy_conditional(t.Y, p.Z, wvalue & 1);
 
   // Convert |t| from affine to Jacobian coordinates. We set Z to zero if |t|
-  // is infinity and |ONE| otherwise. |t| was computed from the table, so it
-  // is infinity iff |wvalue >> 1| is zero.
+  // is infinity and |ONE_MONT| otherwise. |t| was computed from the table, so
+  // it is infinity iff |wvalue >> 1| is zero.
   OPENSSL_memcpy(p.X, t.X, sizeof(p.X));
   OPENSSL_memcpy(p.Y, t.Y, sizeof(p.Y));
   OPENSSL_memset(p.Z, 0, sizeof(p.Z));
-  copy_conditional(p.Z, ONE, is_not_zero(wvalue >> 1));
+  copy_conditional(p.Z, ONE_MONT, is_not_zero(wvalue >> 1));
 
   for (int i = 1; i < 37; i++) {
     wvalue = calc_wvalue(&index, p_str);
@@ -372,14 +469,14 @@ static void ecp_nistz256_points_mul_public(const EC_GROUP *group,
   size_t wvalue = calc_first_wvalue(&index, p_str);
 
   // Convert |p| from affine to Jacobian coordinates. We set Z to zero if |p|
-  // is infinity and |ONE| otherwise. |p| was computed from the table, so it
-  // is infinity iff |wvalue >> 1| is zero.
+  // is infinity and |ONE_MONT| otherwise. |p| was computed from the table, so
+  // it is infinity iff |wvalue >> 1| is zero.
   if ((wvalue >> 1) != 0) {
     OPENSSL_memcpy(p.X, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].X,
                    sizeof(p.X));
     OPENSSL_memcpy(p.Y, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].Y,
                    sizeof(p.Y));
-    OPENSSL_memcpy(p.Z, ONE, sizeof(p.Z));
+    OPENSSL_memcpy(p.Z, ONE_MONT, sizeof(p.Z));
   } else {
     OPENSSL_memset(p.X, 0, sizeof(p.X));
     OPENSSL_memset(p.Y, 0, sizeof(p.Y));
@@ -612,11 +709,6 @@ static int ecp_nistz256_cmp_x_coordinate(const EC_GROUP *group,
 }
 
 DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistz256_method) {
-  // TODO(crbug.com/42290548): The x86_64 assembly depends on initializing
-  // |OPENSSL_ia32cap_P|. Move the dispatch to C. For now, explicitly initialize
-  // things.
-  OPENSSL_init_cpuid();
-
   out->point_get_affine_coordinates = ecp_nistz256_get_affine;
   out->add = ecp_nistz256_add;
   out->dbl = ecp_nistz256_dbl;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256-nistz.h

@@ -48,21 +48,29 @@ extern "C" {
 void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
 
 // ecp_nistz256_mul_mont sets |res| to |a| * |b| * 2^-256 mod P.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_mul_mont_nohw(BN_ULONG res[P256_LIMBS],
+                                const BN_ULONG a[P256_LIMBS],
+                                const BN_ULONG b[P256_LIMBS]);
+void ecp_nistz256_mul_mont_adx(BN_ULONG res[P256_LIMBS],
+                               const BN_ULONG a[P256_LIMBS],
+                               const BN_ULONG b[P256_LIMBS]);
+#else
 void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
                            const BN_ULONG a[P256_LIMBS],
                            const BN_ULONG b[P256_LIMBS]);
+#endif
 
 // ecp_nistz256_sqr_mont sets |res| to |a| * |a| * 2^-256 mod P.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_sqr_mont_nohw(BN_ULONG res[P256_LIMBS],
+                                const BN_ULONG a[P256_LIMBS]);
+void ecp_nistz256_sqr_mont_adx(BN_ULONG res[P256_LIMBS],
+                               const BN_ULONG a[P256_LIMBS]);
+#else
 void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS],
                            const BN_ULONG a[P256_LIMBS]);
-
-// ecp_nistz256_from_mont sets |res| to |in|, converted from Montgomery domain
-// by multiplying with 1.
-static inline void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS],
-                                          const BN_ULONG in[P256_LIMBS]) {
-  static const BN_ULONG ONE[P256_LIMBS] = { 1 };
-  ecp_nistz256_mul_mont(res, in, ONE);
-}
+#endif
 
 
 // P-256 scalar operations.
@@ -72,15 +80,31 @@ static inline void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS],
 
 // ecp_nistz256_ord_mul_mont sets |res| to |a| * |b| where inputs and outputs
 // are in Montgomery form. That is, |res| is |a| * |b| * 2^-256 mod N.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_ord_mul_mont_nohw(BN_ULONG res[P256_LIMBS],
+                                    const BN_ULONG a[P256_LIMBS],
+                                    const BN_ULONG b[P256_LIMBS]);
+void ecp_nistz256_ord_mul_mont_adx(BN_ULONG res[P256_LIMBS],
+                                   const BN_ULONG a[P256_LIMBS],
+                                   const BN_ULONG b[P256_LIMBS]);
+#else
 void ecp_nistz256_ord_mul_mont(BN_ULONG res[P256_LIMBS],
                                const BN_ULONG a[P256_LIMBS],
                                const BN_ULONG b[P256_LIMBS]);
+#endif
 
 // ecp_nistz256_ord_sqr_mont sets |res| to |a|^(2*|rep|) where inputs and
 // outputs are in Montgomery form. That is, |res| is
 // (|a| * 2^-256)^(2*|rep|) * 2^256 mod N.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_ord_sqr_mont_nohw(BN_ULONG res[P256_LIMBS],
+                                    const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
+void ecp_nistz256_ord_sqr_mont_adx(BN_ULONG res[P256_LIMBS],
+                                   const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
+#else
 void ecp_nistz256_ord_sqr_mont(BN_ULONG res[P256_LIMBS],
                                const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
+#endif
 
 // beeu_mod_inverse_vartime sets out = a^-1 mod p using a Euclidean algorithm.
 // Assumption: 0 < a < p < 2^(256) and p is odd.
@@ -111,27 +135,60 @@ typedef struct {
 // ecp_nistz256_select_w5 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 16
 // and all zeros (the point at infinity) if |index| is 0. This is done in
 // constant time.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_select_w5_nohw(P256_POINT *val, const P256_POINT in_t[16],
+                                 int index);
+void ecp_nistz256_select_w5_avx2(P256_POINT *val, const P256_POINT in_t[16],
+                                 int index);
+#else
 void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16],
                             int index);
+#endif
 
 // ecp_nistz256_select_w7 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 64
 // and all zeros (the point at infinity) if |index| is 0. This is done in
 // constant time.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_select_w7_nohw(P256_POINT_AFFINE *val,
+                                 const P256_POINT_AFFINE in_t[64], int index);
+void ecp_nistz256_select_w7_avx2(P256_POINT_AFFINE *val,
+                                 const P256_POINT_AFFINE in_t[64], int index);
+#else
 void ecp_nistz256_select_w7(P256_POINT_AFFINE *val,
                             const P256_POINT_AFFINE in_t[64], int index);
+#endif
 
 // ecp_nistz256_point_double sets |r| to |a| doubled.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_point_double_nohw(P256_POINT *r, const P256_POINT *a);
+void ecp_nistz256_point_double_adx(P256_POINT *r, const P256_POINT *a);
+#else
 void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a);
+#endif
 
 // ecp_nistz256_point_add adds |a| to |b| and places the result in |r|.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_point_add_nohw(P256_POINT *r, const P256_POINT *a,
+                                 const P256_POINT *b);
+void ecp_nistz256_point_add_adx(P256_POINT *r, const P256_POINT *a,
+                                const P256_POINT *b);
+#else
 void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a,
                             const P256_POINT *b);
+#endif
 
 // ecp_nistz256_point_add_affine adds |a| to |b| and places the result in
 // |r|. |a| and |b| must not represent the same point unless they are both
 // infinity.
+#if defined(OPENSSL_X86_64)
+void ecp_nistz256_point_add_affine_adx(P256_POINT *r, const P256_POINT *a,
+                                       const P256_POINT_AFFINE *b);
+void ecp_nistz256_point_add_affine_nohw(P256_POINT *r, const P256_POINT *a,
+                                        const P256_POINT_AFFINE *b);
+#else
 void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
                                    const P256_POINT_AFFINE *b);
+#endif
 
 #endif /* !defined(OPENSSL_NO_ASM) && \
           (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/{ecdsa.c → ecdsa.c.inc}

@@ -95,61 +95,9 @@ static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                           order->width);
 }
 
-ECDSA_SIG *ECDSA_SIG_new(void) {
-  ECDSA_SIG *sig = OPENSSL_malloc(sizeof(ECDSA_SIG));
-  if (sig == NULL) {
-    return NULL;
-  }
-  sig->r = BN_new();
-  sig->s = BN_new();
-  if (sig->r == NULL || sig->s == NULL) {
-    ECDSA_SIG_free(sig);
-    return NULL;
-  }
-  return sig;
-}
-
-void ECDSA_SIG_free(ECDSA_SIG *sig) {
-  if (sig == NULL) {
-    return;
-  }
-
-  BN_free(sig->r);
-  BN_free(sig->s);
-  OPENSSL_free(sig);
-}
-
-const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig) {
-  return sig->r;
-}
-
-const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig) {
-  return sig->s;
-}
-
-void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **out_r,
-                    const BIGNUM **out_s) {
-  if (out_r != NULL) {
-    *out_r = sig->r;
-  }
-  if (out_s != NULL) {
-    *out_s = sig->s;
-  }
-}
-
-int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
-  if (r == NULL || s == NULL) {
-    return 0;
-  }
-  BN_free(sig->r);
-  BN_free(sig->s);
-  sig->r = r;
-  sig->s = s;
-  return 1;
-}
-
-int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
-                                 const ECDSA_SIG *sig, const EC_KEY *eckey) {
+int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
+                                    const uint8_t *sig, size_t sig_len,
+                                    const EC_KEY *eckey) {
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   const EC_POINT *pub_key = EC_KEY_get0_public_key(eckey);
   if (group == NULL || pub_key == NULL || sig == NULL) {
@@ -157,11 +105,13 @@ int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
     return 0;
   }
 
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
   EC_SCALAR r, s, u1, u2, s_inv_mont, m;
-  if (BN_is_zero(sig->r) ||
-      !ec_bignum_to_scalar(group, &r, sig->r) ||
-      BN_is_zero(sig->s) ||
-      !ec_bignum_to_scalar(group, &s, sig->s)) {
+  if (sig_len != 2 * scalar_len ||
+      !ec_scalar_from_bytes(group, &r, sig, scalar_len) ||
+      ec_scalar_is_zero(group, &r) ||
+      !ec_scalar_from_bytes(group, &s, sig + scalar_len, scalar_len) ||
+      ec_scalar_is_zero(group, &s)) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
     return 0;
   }
@@ -195,24 +145,31 @@ int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
   return 1;
 }
 
-int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
-                    const ECDSA_SIG *sig, const EC_KEY *eckey) {
+int ecdsa_verify_fixed(const uint8_t *digest, size_t digest_len,
+                       const uint8_t *sig, size_t sig_len, const EC_KEY *key) {
   boringssl_ensure_ecc_self_test();
 
-  return ecdsa_do_verify_no_self_test(digest, digest_len, sig, eckey);
+  return ecdsa_verify_fixed_no_self_test(digest, digest_len, sig, sig_len, key);
 }
 
-static ECDSA_SIG *ecdsa_sign_impl(const EC_GROUP *group, int *out_retry,
-                                  const EC_SCALAR *priv_key, const EC_SCALAR *k,
-                                  const uint8_t *digest, size_t digest_len) {
+static int ecdsa_sign_impl(const EC_GROUP *group, int *out_retry, uint8_t *sig,
+                           size_t *out_sig_len, size_t max_sig_len,
+                           const EC_SCALAR *priv_key, const EC_SCALAR *k,
+                           const uint8_t *digest, size_t digest_len) {
   *out_retry = 0;
 
   // Check that the size of the group order is FIPS compliant (FIPS 186-4
   // B.5.2).
   const BIGNUM *order = EC_GROUP_get0_order(group);
   if (BN_num_bits(order) < 160) {
-    OPENSSL_PUT_ERROR(ECDSA, EC_R_INVALID_GROUP_ORDER);
-    return NULL;
+    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
+    return 0;
+  }
+
+  size_t sig_len = 2 * BN_num_bytes(order);
+  if (sig_len > max_sig_len) {
+    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
+    return 0;
   }
 
   // Compute r, the x-coordinate of k * generator.
@@ -220,12 +177,12 @@ static ECDSA_SIG *ecdsa_sign_impl(const EC_GROUP *group, int *out_retry,
   EC_SCALAR r;
   if (!ec_point_mul_scalar_base(group, &tmp_point, k) ||
       !ec_get_x_coordinate_as_scalar(group, &r, &tmp_point)) {
-    return NULL;
+    return 0;
   }
 
   if (constant_time_declassify_int(ec_scalar_is_zero(group, &r))) {
     *out_retry = 1;
-    return NULL;
+    return 0;
   }
 
   // s = priv_key * r. Note if only one parameter is in the Montgomery domain,
@@ -252,71 +209,59 @@ static ECDSA_SIG *ecdsa_sign_impl(const EC_GROUP *group, int *out_retry,
   ec_scalar_mul_montgomery(group, &s, &s, &tmp);
   if (constant_time_declassify_int(ec_scalar_is_zero(group, &s))) {
     *out_retry = 1;
-    return NULL;
+    return 0;
   }
 
   CONSTTIME_DECLASSIFY(r.words, sizeof(r.words));
   CONSTTIME_DECLASSIFY(s.words, sizeof(r.words));
-  ECDSA_SIG *ret = ECDSA_SIG_new();
-  if (ret == NULL ||  //
-      !bn_set_words(ret->r, r.words, order->width) ||
-      !bn_set_words(ret->s, s.words, order->width)) {
-    ECDSA_SIG_free(ret);
-    return NULL;
-  }
-  return ret;
+  size_t len;
+  ec_scalar_to_bytes(group, sig, &len, &r);
+  assert(len == sig_len / 2);
+  ec_scalar_to_bytes(group, sig + len, &len, &s);
+  assert(len == sig_len / 2);
+  *out_sig_len = sig_len;
+  return 1;
 }
 
-ECDSA_SIG *ecdsa_sign_with_nonce_for_known_answer_test(const uint8_t *digest,
-                                                       size_t digest_len,
-                                                       const EC_KEY *eckey,
-                                                       const uint8_t *nonce,
-                                                       size_t nonce_len) {
+int ecdsa_sign_fixed_with_nonce_for_known_answer_test(
+    const uint8_t *digest, size_t digest_len, uint8_t *sig, size_t *out_sig_len,
+    size_t max_sig_len, const EC_KEY *eckey, const uint8_t *nonce,
+    size_t nonce_len) {
   if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED);
-    return NULL;
+    return 0;
   }
 
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   if (group == NULL || eckey->priv_key == NULL) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return 0;
   }
   const EC_SCALAR *priv_key = &eckey->priv_key->scalar;
 
   EC_SCALAR k;
   if (!ec_scalar_from_bytes(group, &k, nonce, nonce_len)) {
-    return NULL;
+    return 0;
   }
   int retry_ignored;
-  return ecdsa_sign_impl(group, &retry_ignored, priv_key, &k, digest,
-                         digest_len);
-}
-
-// This function is only exported for testing and is not called in production
-// code.
-ECDSA_SIG *ECDSA_sign_with_nonce_and_leak_private_key_for_testing(
-    const uint8_t *digest, size_t digest_len, const EC_KEY *eckey,
-    const uint8_t *nonce, size_t nonce_len) {
-  boringssl_ensure_ecc_self_test();
-
-  return ecdsa_sign_with_nonce_for_known_answer_test(digest, digest_len, eckey,
-                                                     nonce, nonce_len);
+  return ecdsa_sign_impl(group, &retry_ignored, sig, out_sig_len, max_sig_len,
+                         priv_key, &k, digest, digest_len);
 }
 
-ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
-                         const EC_KEY *eckey) {
+int ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len, uint8_t *sig,
+                     size_t *out_sig_len, size_t max_sig_len,
+                     const EC_KEY *eckey) {
   boringssl_ensure_ecc_self_test();
 
   if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED);
-    return NULL;
+    return 0;
   }
 
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   if (group == NULL || eckey->priv_key == NULL) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return 0;
   }
   const BIGNUM *order = EC_GROUP_get0_order(group);
   const EC_SCALAR *priv_key = &eckey->priv_key->scalar;
@@ -340,12 +285,11 @@ ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
   // FIPS) because the probability of requiring even one retry is negligible,
   // let alone 32.
   static const int kMaxIterations = 32;
-  ECDSA_SIG *ret = NULL;
+  int ret = 0;
   int iters = 0;
   for (;;) {
     EC_SCALAR k;
     if (!ec_random_nonzero_scalar(group, &k, additional_data)) {
-      ret = NULL;
       goto out;
     }
 
@@ -354,8 +298,9 @@ ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
     CONSTTIME_SECRET(k.words, sizeof(k.words));
 
     int retry;
-    ret = ecdsa_sign_impl(group, &retry, priv_key, &k, digest, digest_len);
-    if (ret != NULL || !retry) {
+    ret = ecdsa_sign_impl(group, &retry, sig, out_sig_len, max_sig_len,
+                          priv_key, &k, digest, digest_len);
+    if (ret || !retry) {
       goto out;
     }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/internal.h

@@ -17,25 +17,42 @@
 
 #include <openssl/base.h>
 
+#include "../ec/internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
-// ecdsa_sign_with_nonce_for_known_answer_test behaves like |ECDSA_do_sign| but
-// takes a fixed nonce. This function is used as part of known-answer tests in
-// the FIPS module.
-ECDSA_SIG *ecdsa_sign_with_nonce_for_known_answer_test(const uint8_t *digest,
-                                                       size_t digest_len,
-                                                       const EC_KEY *eckey,
-                                                       const uint8_t *nonce,
-                                                       size_t nonce_len);
+// ECDSA_MAX_FIXED_LEN is the maximum length of an ECDSA signature in the
+// fixed-width, big-endian format from IEEE P1363.
+#define ECDSA_MAX_FIXED_LEN (2 * EC_MAX_BYTES)
+
+// ecdsa_sign_fixed behaves like |ECDSA_sign| but uses the fixed-width,
+// big-endian format from IEEE P1363.
+int ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len, uint8_t *sig,
+                     size_t *out_sig_len, size_t max_sig_len,
+                     const EC_KEY *key);
+
+// ecdsa_sign_fixed_with_nonce_for_known_answer_test behaves like
+// |ecdsa_sign_fixed| but takes a caller-supplied nonce. This function is used
+// as part of known-answer tests in the FIPS module.
+int ecdsa_sign_fixed_with_nonce_for_known_answer_test(
+    const uint8_t *digest, size_t digest_len, uint8_t *sig, size_t *out_sig_len,
+    size_t max_sig_len, const EC_KEY *key, const uint8_t *nonce,
+    size_t nonce_len);
+
+// ecdsa_verify_fixed behaves like |ECDSA_verify| but uses the fixed-width,
+// big-endian format from IEEE P1363.
+int ecdsa_verify_fixed(const uint8_t *digest, size_t digest_len,
+                       const uint8_t *sig, size_t sig_len, const EC_KEY *key);
 
-// ecdsa_do_verify_no_self_test does the same as |ECDSA_do_verify|, but doesn't
+// ecdsa_verify_fixed_no_self_test behaves like ecdsa_verify_fixed, but doesn't
 // try to run the self-test first. This is for use in the self tests themselves,
 // to prevent an infinite loop.
-int ecdsa_do_verify_no_self_test(const uint8_t *digest, size_t digest_len,
-                                 const ECDSA_SIG *sig, const EC_KEY *eckey);
+int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
+                                    const uint8_t *sig, size_t sig_len,
+                                    const EC_KEY *key);
 
 
 #if defined(__cplusplus)