grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/crypto/trust_token/{voprf.c → voprf.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020, Google Inc.
+/* Copyright 2020 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -209,8 +209,8 @@ static STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_blind(const VOPRF_METHOD *method,
 
   for (size_t i = 0; i < count; i++) {
     // Insert |pretoken| into |pretokens| early to simplify error-handling.
-    TRUST_TOKEN_PRETOKEN *pretoken =
-        OPENSSL_malloc(sizeof(TRUST_TOKEN_PRETOKEN));
+    TRUST_TOKEN_PRETOKEN *pretoken = reinterpret_cast<TRUST_TOKEN_PRETOKEN *>(
+        OPENSSL_malloc(sizeof(TRUST_TOKEN_PRETOKEN)));
     if (pretoken == NULL ||
         !sk_TRUST_TOKEN_PRETOKEN_push(pretokens, pretoken)) {
       TRUST_TOKEN_PRETOKEN_free(pretoken);
@@ -230,8 +230,7 @@ static STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_blind(const VOPRF_METHOD *method,
 
     // We sample r in Montgomery form to simplify inverting.
     EC_SCALAR r;
-    if (!ec_random_nonzero_scalar(group, &r,
-                                  kDefaultAdditionalData)) {
+    if (!ec_random_nonzero_scalar(group, &r, kDefaultAdditionalData)) {
       goto err;
     }
 
@@ -275,12 +274,9 @@ static int hash_to_scalar_dleq(const VOPRF_METHOD *method, EC_SCALAR *out,
   size_t len;
   if (!CBB_init(&cbb, 0) ||
       !CBB_add_bytes(&cbb, kDLEQLabel, sizeof(kDLEQLabel)) ||
-      !cbb_add_point(&cbb, group, X) ||
-      !cbb_add_point(&cbb, group, T) ||
-      !cbb_add_point(&cbb, group, W) ||
-      !cbb_add_point(&cbb, group, K0) ||
-      !cbb_add_point(&cbb, group, K1) ||
-      !CBB_finish(&cbb, &buf, &len) ||
+      !cbb_add_point(&cbb, group, X) || !cbb_add_point(&cbb, group, T) ||
+      !cbb_add_point(&cbb, group, W) || !cbb_add_point(&cbb, group, K0) ||
+      !cbb_add_point(&cbb, group, K1) || !CBB_finish(&cbb, &buf, &len) ||
       !method->hash_to_scalar(group, out, buf, len)) {
     goto err;
   }
@@ -335,8 +331,7 @@ static int hash_to_scalar_batch(const VOPRF_METHOD *method, EC_SCALAR *out,
   if (!CBB_init(&cbb, 0) ||
       !CBB_add_bytes(&cbb, kDLEQBatchLabel, sizeof(kDLEQBatchLabel)) ||
       !CBB_add_bytes(&cbb, CBB_data(points), CBB_len(points)) ||
-      !CBB_add_u16(&cbb, (uint16_t)index) ||
-      !CBB_finish(&cbb, &buf, &len) ||
+      !CBB_add_u16(&cbb, (uint16_t)index) || !CBB_finish(&cbb, &buf, &len) ||
       !method->hash_to_scalar(method->group_func(), out, buf, len)) {
     goto err;
   }
@@ -365,11 +360,11 @@ static int dleq_generate(const VOPRF_METHOD *method, CBB *cbb,
 
   // Setup the DLEQ proof.
   EC_SCALAR r;
-  if (// r <- Zp
+  if (  // r <- Zp
       !ec_random_nonzero_scalar(group, &r, kDefaultAdditionalData) ||
       // k0;k1 = r*(G;T)
       !ec_point_mul_scalar_base(group, &jacobians[idx_k0], &r) ||
-      !ec_point_mul_scalar(group, &jacobians[idx_k1], T, &r))  {
+      !ec_point_mul_scalar(group, &jacobians[idx_k1], T, &r)) {
     return 0;
   }
 
@@ -398,8 +393,7 @@ static int dleq_generate(const VOPRF_METHOD *method, CBB *cbb,
   ec_scalar_add(group, &u, &r, &u);
 
   // Store DLEQ proof in transcript.
-  if (!scalar_to_cbb(cbb, group, &c) ||
-      !scalar_to_cbb(cbb, group, &u)) {
+  if (!scalar_to_cbb(cbb, group, &c) || !scalar_to_cbb(cbb, group, &u)) {
     return 0;
   }
 
@@ -432,8 +426,7 @@ static int dleq_verify(const VOPRF_METHOD *method, CBS *cbs,
 
   // Decode the DLEQ proof.
   EC_SCALAR c, u;
-  if (!scalar_from_cbs(cbs, group, &c) ||
-      !scalar_from_cbs(cbs, group, &u)) {
+  if (!scalar_from_cbs(cbs, group, &c) || !scalar_from_cbs(cbs, group, &u)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
   }
@@ -484,80 +477,83 @@ static int voprf_sign_tt(const VOPRF_METHOD *method,
   }
 
   int ret = 0;
-  EC_JACOBIAN *BTs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_SCALAR *es = OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *es = reinterpret_cast<EC_SCALAR *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR)));
   CBB batch_cbb;
   CBB_zero(&batch_cbb);
-  if (!BTs ||
-      !Zs ||
-      !es ||
-      !CBB_init(&batch_cbb, 0) ||
-      !cbb_add_point(&batch_cbb, group, &key->pubs)) {
-    goto err;
-  }
 
-  for (size_t i = 0; i < num_to_issue; i++) {
-    EC_AFFINE BT_affine, Z_affine;
-    EC_JACOBIAN BT, Z;
-    if (!cbs_get_point(cbs, group, &BT_affine)) {
-      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+  {
+    if (!BTs || !Zs || !es || !CBB_init(&batch_cbb, 0) ||
+        !cbb_add_point(&batch_cbb, group, &key->pubs)) {
       goto err;
     }
-    ec_affine_to_jacobian(group, &BT, &BT_affine);
-    if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
-        !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
-        !cbb_add_point(cbb, group, &Z_affine)) {
-      goto err;
+
+    for (size_t i = 0; i < num_to_issue; i++) {
+      EC_AFFINE BT_affine, Z_affine;
+      EC_JACOBIAN BT, Z;
+      if (!cbs_get_point(cbs, group, &BT_affine)) {
+        OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+        goto err;
+      }
+      ec_affine_to_jacobian(group, &BT, &BT_affine);
+      if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
+          !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
+          !cbb_add_point(cbb, group, &Z_affine)) {
+        goto err;
+      }
+
+      if (!cbb_add_point(&batch_cbb, group, &BT_affine) ||
+          !cbb_add_point(&batch_cbb, group, &Z_affine)) {
+        goto err;
+      }
+      BTs[i] = BT;
+      Zs[i] = Z;
+
+      if (!CBB_flush(cbb)) {
+        goto err;
+      }
     }
 
-    if (!cbb_add_point(&batch_cbb, group, &BT_affine) ||
-        !cbb_add_point(&batch_cbb, group, &Z_affine)) {
-      goto err;
+    // The DLEQ batching construction is described in appendix B of
+    // https://eprint.iacr.org/2020/072/20200324:214215. Note the additional
+    // computations all act on public inputs.
+    for (size_t i = 0; i < num_to_issue; i++) {
+      if (!hash_to_scalar_batch(method, &es[i], &batch_cbb, i)) {
+        goto err;
+      }
     }
-    BTs[i] = BT;
-    Zs[i] = Z;
 
-    if (!CBB_flush(cbb)) {
+    EC_JACOBIAN BT_batch, Z_batch;
+    if (!ec_point_mul_scalar_public_batch(group, &BT_batch,
+                                          /*g_scalar=*/NULL, BTs, es,
+                                          num_to_issue) ||
+        !ec_point_mul_scalar_public_batch(group, &Z_batch,
+                                          /*g_scalar=*/NULL, Zs, es,
+                                          num_to_issue)) {
       goto err;
     }
-  }
 
-  // The DLEQ batching construction is described in appendix B of
-  // https://eprint.iacr.org/2020/072/20200324:214215. Note the additional
-  // computations all act on public inputs.
-  for (size_t i = 0; i < num_to_issue; i++) {
-    if (!hash_to_scalar_batch(method, &es[i], &batch_cbb, i)) {
+    CBB proof;
+    if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
+        !dleq_generate(method, &proof, key, &BT_batch, &Z_batch) ||
+        !CBB_flush(cbb)) {
       goto err;
     }
-  }
-
-  EC_JACOBIAN BT_batch, Z_batch;
-  if (!ec_point_mul_scalar_public_batch(group, &BT_batch,
-                                        /*g_scalar=*/NULL, BTs, es,
-                                        num_to_issue) ||
-      !ec_point_mul_scalar_public_batch(group, &Z_batch,
-                                        /*g_scalar=*/NULL, Zs, es,
-                                        num_to_issue)) {
-    goto err;
-  }
 
-  CBB proof;
-  if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
-      !dleq_generate(method, &proof, key, &BT_batch, &Z_batch) ||
-      !CBB_flush(cbb)) {
-    goto err;
-  }
+    // Skip over any unused requests.
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
+    if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
+      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+      goto err;
+    }
 
-  // Skip over any unused requests.
-  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
-  if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
-    goto err;
+    ret = 1;
   }
 
-  ret = 1;
-
 err:
   OPENSSL_free(BTs);
   OPENSSL_free(Zs);
@@ -578,15 +574,15 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
 
   int ok = 0;
   STACK_OF(TRUST_TOKEN) *ret = sk_TRUST_TOKEN_new_null();
-  EC_JACOBIAN *BTs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_SCALAR *es = OPENSSL_calloc(count, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *es =
+      reinterpret_cast<EC_SCALAR *>(OPENSSL_calloc(count, sizeof(EC_SCALAR)));
   CBB batch_cbb;
   CBB_zero(&batch_cbb);
-  if (ret == NULL ||
-      BTs == NULL ||
-      Zs == NULL ||
-      es == NULL ||
+  if (ret == NULL || BTs == NULL || Zs == NULL || es == NULL ||
       !CBB_init(&batch_cbb, 0) ||
       !cbb_add_point(&batch_cbb, group, &key->pubs)) {
     goto err;
@@ -635,8 +631,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
     TRUST_TOKEN *token =
         TRUST_TOKEN_new(CBB_data(&token_cbb), CBB_len(&token_cbb));
     CBB_cleanup(&token_cbb);
-    if (token == NULL ||
-        !sk_TRUST_TOKEN_push(ret, token)) {
+    if (token == NULL || !sk_TRUST_TOKEN_push(ret, token)) {
       TRUST_TOKEN_free(token);
       goto err;
     }
@@ -681,15 +676,17 @@ err:
 }
 
 static void sha384_update_u16(SHA512_CTX *ctx, uint16_t v) {
-  uint8_t buf[2] = {v >> 8, v & 0xff};
+  uint8_t buf[2] = {static_cast<uint8_t>(v >> 8),
+                    static_cast<uint8_t>(v & 0xff)};
   SHA384_Update(ctx, buf, 2);
 }
 
-static void sha384_update_point_with_length(
-     SHA512_CTX *ctx, const EC_GROUP *group, const EC_AFFINE *point) {
+static void sha384_update_point_with_length(SHA512_CTX *ctx,
+                                            const EC_GROUP *group,
+                                            const EC_AFFINE *point) {
   uint8_t buf[EC_MAX_COMPRESSED];
-  size_t len = ec_point_to_bytes(group, point, POINT_CONVERSION_COMPRESSED,
-                                 buf, sizeof(buf));
+  size_t len = ec_point_to_bytes(group, point, POINT_CONVERSION_COMPRESSED, buf,
+                                 sizeof(buf));
   assert(len > 0);
   sha384_update_u16(ctx, (uint16_t)len);
   SHA384_Update(ctx, buf, len);
@@ -729,11 +726,9 @@ static int compute_composite_element(const VOPRF_METHOD *method,
   if (!CBB_init_fixed(&cbb, transcript, sizeof(transcript)) ||
       !CBB_add_u16(&cbb, SHA384_DIGEST_LENGTH) ||
       !CBB_add_bytes(&cbb, seed, SHA384_DIGEST_LENGTH) ||
-      !CBB_add_u16(&cbb, index) ||
-      !cbb_serialize_point(&cbb, group, C) ||
+      !CBB_add_u16(&cbb, index) || !cbb_serialize_point(&cbb, group, C) ||
       !cbb_serialize_point(&cbb, group, D) ||
-      !CBB_add_bytes(&cbb, kCompositeLabel,
-                     sizeof(kCompositeLabel) - 1) ||
+      !CBB_add_bytes(&cbb, kCompositeLabel, sizeof(kCompositeLabel) - 1) ||
       !CBB_finish(&cbb, NULL, &len) ||
       !method->hash_to_scalar(group, di, transcript, len)) {
     return 0;
@@ -786,8 +781,7 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
   ec_scalar_sub(group, &s, r, &s);
 
   // Store DLEQ proof in transcript.
-  if (!scalar_to_cbb(cbb, group, &c) ||
-      !scalar_to_cbb(cbb, group, &s)) {
+  if (!scalar_to_cbb(cbb, group, &c) || !scalar_to_cbb(cbb, group, &s)) {
     return 0;
   }
 
@@ -795,8 +789,8 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
 }
 
 static int verify_proof(const VOPRF_METHOD *method, CBS *cbs,
-                        const TRUST_TOKEN_CLIENT_KEY *pub,
-                        const EC_JACOBIAN *M, const EC_JACOBIAN *Z) {
+                        const TRUST_TOKEN_CLIENT_KEY *pub, const EC_JACOBIAN *M,
+                        const EC_JACOBIAN *Z) {
   const EC_GROUP *group = method->group_func();
 
   enum {
@@ -809,16 +803,14 @@ static int verify_proof(const VOPRF_METHOD *method, CBS *cbs,
   EC_JACOBIAN jacobians[num_idx];
 
   EC_SCALAR c, s;
-  if (!scalar_from_cbs(cbs, group, &c) ||
-      !scalar_from_cbs(cbs, group, &s)) {
+  if (!scalar_from_cbs(cbs, group, &c) || !scalar_from_cbs(cbs, group, &s)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
   }
 
   EC_JACOBIAN pubs;
   ec_affine_to_jacobian(group, &pubs, &pub->pubs);
-  if (!ec_point_mul_scalar_public(group, &jacobians[idx_t2], &s, &pubs,
-                                  &c) ||
+  if (!ec_point_mul_scalar_public(group, &jacobians[idx_t2], &s, &pubs, &c) ||
       !mul_public_2(group, &jacobians[idx_t3], M, &s, Z, &c)) {
     return 0;
   }
@@ -857,72 +849,78 @@ static int voprf_sign_impl(const VOPRF_METHOD *method,
   }
 
   int ret = 0;
-  EC_JACOBIAN *BTs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_SCALAR *dis = OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR));
-  if (!BTs || !Zs || !dis) {
-    goto err;
-  }
-
-  uint8_t seed[SHA384_DIGEST_LENGTH];
-  if (!compute_composite_seed(method, seed, &key->pubs)) {
-    goto err;
-  }
-
-  // This implements the BlindEvaluateBatch as defined in section 4 of
-  // draft-robert-privacypass-batched-tokens-01, based on the constructions
-  // in draft-irtf-cfrg-voprf-21. To optimize the computation of the proof,
-  // the computation of di is done during the token signing and passed into
-  // the proof generation.
-  for (size_t i = 0; i < num_to_issue; i++) {
-    EC_AFFINE BT_affine, Z_affine;
-    EC_JACOBIAN BT, Z;
-    if (!cbs_get_point(cbs, group, &BT_affine)) {
-      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *dis = reinterpret_cast<EC_SCALAR *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR)));
+
+  {
+    if (!BTs || !Zs || !dis) {
       goto err;
     }
-    ec_affine_to_jacobian(group, &BT, &BT_affine);
-    if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
-        !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
-        !cbb_add_point(cbb, group, &Z_affine)) {
+
+    uint8_t seed[SHA384_DIGEST_LENGTH];
+    if (!compute_composite_seed(method, seed, &key->pubs)) {
       goto err;
     }
-    BTs[i] = BT;
-    Zs[i] = Z;
-    if (!compute_composite_element(method, seed, &dis[i], i, &BT_affine,
-                                   &Z_affine)) {
-      goto err;
+
+    // This implements the BlindEvaluateBatch as defined in section 4 of
+    // draft-robert-privacypass-batched-tokens-01, based on the constructions
+    // in draft-irtf-cfrg-voprf-21. To optimize the computation of the proof,
+    // the computation of di is done during the token signing and passed into
+    // the proof generation.
+    for (size_t i = 0; i < num_to_issue; i++) {
+      EC_AFFINE BT_affine, Z_affine;
+      EC_JACOBIAN BT, Z;
+      if (!cbs_get_point(cbs, group, &BT_affine)) {
+        OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+        goto err;
+      }
+      ec_affine_to_jacobian(group, &BT, &BT_affine);
+      if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
+          !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
+          !cbb_add_point(cbb, group, &Z_affine)) {
+        goto err;
+      }
+      BTs[i] = BT;
+      Zs[i] = Z;
+      if (!compute_composite_element(method, seed, &dis[i], i, &BT_affine,
+                                     &Z_affine)) {
+        goto err;
+      }
+
+      if (!CBB_flush(cbb)) {
+        goto err;
+      }
     }
 
-    if (!CBB_flush(cbb)) {
+    EC_JACOBIAN M, Z;
+    if (!ec_point_mul_scalar_public_batch(group, &M,
+                                          /*g_scalar=*/NULL, BTs, dis,
+                                          num_to_issue) ||
+        !ec_point_mul_scalar(group, &Z, &M, &key->xs)) {
       goto err;
     }
-  }
 
-  EC_JACOBIAN M, Z;
-  if (!ec_point_mul_scalar_public_batch(group, &M,
-                                        /*g_scalar=*/NULL, BTs, dis,
-                                        num_to_issue) ||
-      !ec_point_mul_scalar(group, &Z, &M, &key->xs)) {
-    goto err;
-  }
+    CBB proof;
+    if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
+        !generate_proof(method, &proof, key, proof_scalar, &M, &Z) ||
+        !CBB_flush(cbb)) {
+      goto err;
+    }
 
-  CBB proof;
-  if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
-      !generate_proof(method, &proof, key, proof_scalar, &M, &Z) ||
-      !CBB_flush(cbb)) {
-    goto err;
-  }
+    // Skip over any unused requests.
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
+    if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
+      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+      goto err;
+    }
 
-  // Skip over any unused requests.
-  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
-  if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
-    goto err;
+    ret = 1;
   }
 
-  ret = 1;
-
 err:
   OPENSSL_free(BTs);
   OPENSSL_free(Zs);
@@ -968,9 +966,12 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
 
   int ok = 0;
   STACK_OF(TRUST_TOKEN) *ret = sk_TRUST_TOKEN_new_null();
-  EC_JACOBIAN *BTs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_SCALAR *dis = OPENSSL_calloc(count, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *dis =
+      reinterpret_cast<EC_SCALAR *>(OPENSSL_calloc(count, sizeof(EC_SCALAR)));
   if (ret == NULL || !BTs || !Zs || !dis) {
     goto err;
   }
@@ -1022,8 +1023,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
     TRUST_TOKEN *token =
         TRUST_TOKEN_new(CBB_data(&token_cbb), CBB_len(&token_cbb));
     CBB_cleanup(&token_cbb);
-    if (token == NULL ||
-        !sk_TRUST_TOKEN_push(ret, token)) {
+    if (token == NULL || !sk_TRUST_TOKEN_push(ret, token)) {
       TRUST_TOKEN_free(token);
       goto err;
     }
@@ -1031,18 +1031,15 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
 
   EC_JACOBIAN M, Z;
   if (!ec_point_mul_scalar_public_batch(group, &M,
-                                        /*g_scalar=*/NULL, BTs, dis,
-                                        count) ||
+                                        /*g_scalar=*/NULL, BTs, dis, count) ||
       !ec_point_mul_scalar_public_batch(group, &Z,
-                                        /*g_scalar=*/NULL, Zs, dis,
-                                        count)) {
+                                        /*g_scalar=*/NULL, Zs, dis, count)) {
     goto err;
   }
 
   CBS proof;
   if (!CBS_get_u16_length_prefixed(cbs, &proof) ||
-      !verify_proof(method, &proof, key, &M, &Z) ||
-      CBS_len(&proof) != 0) {
+      !verify_proof(method, &proof, key, &M, &Z) || CBS_len(&proof) != 0) {
     goto err;
   }
 
@@ -1069,8 +1066,7 @@ static int voprf_read(const VOPRF_METHOD *method,
   CBS_init(&cbs, token, token_len);
   EC_AFFINE Ws;
   if (!CBS_get_bytes(&cbs, &salt, TRUST_TOKEN_NONCE_SIZE) ||
-      !cbs_get_point(&cbs, group, &Ws) ||
-      CBS_len(&cbs) != 0) {
+      !cbs_get_point(&cbs, group, &Ws) || CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_INVALID_TOKEN);
     return 0;
   }
@@ -1113,7 +1109,7 @@ static int voprf_exp2_hash_to_group(const EC_GROUP *group, EC_JACOBIAN *out,
 }
 
 static int voprf_exp2_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                             uint8_t *buf, size_t len) {
+                                     uint8_t *buf, size_t len) {
   const uint8_t kHashCLabel[] = "TrustToken VOPRF Experiment V2 HashToScalar";
   return ec_hash_to_scalar_p384_xmd_sha512_draft07(
       group, out, kHashCLabel, sizeof(kHashCLabel), buf, len);
@@ -1189,7 +1185,7 @@ static int voprf_pst1_hash_to_group(const EC_GROUP *group, EC_JACOBIAN *out,
 }
 
 static int voprf_pst1_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                             uint8_t *buf, size_t len) {
+                                     uint8_t *buf, size_t len) {
   const uint8_t kHashCLabel[] = "HashToScalar-OPRFV1-\x01-P384-SHA384";
   return ec_hash_to_scalar_p384_xmd_sha384(group, out, kHashCLabel,
                                            sizeof(kHashCLabel) - 1, buf, len);

data/third_party/boringssl-with-bazel/src/crypto/x509/{a_digest.c → a_digest.cc}

@@ -83,7 +83,7 @@ int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, void *asn,
   int i, ret;
   unsigned char *str = NULL;
 
-  i = ASN1_item_i2d(asn, &str, it);
+  i = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &str, it);
   if (!str) {
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/x509/{a_sign.c → a_sign.cc}

@@ -87,46 +87,49 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
                        void *asn, EVP_MD_CTX *ctx) {
   int ret = 0;
   uint8_t *in = NULL, *out = NULL;
-  if (signature->type != V_ASN1_BIT_STRING) {
-    OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE);
-    goto err;
-  }
 
-  // Write out the requested copies of the AlgorithmIdentifier.
-  if (algor1 && !x509_digest_sign_algorithm(ctx, algor1)) {
-    goto err;
-  }
-  if (algor2 && !x509_digest_sign_algorithm(ctx, algor2)) {
-    goto err;
-  }
+  {
+    if (signature->type != V_ASN1_BIT_STRING) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE);
+      goto err;
+    }
 
-  int in_len = ASN1_item_i2d(asn, &in, it);
-  if (in_len < 0) {
-    goto err;
-  }
+    // Write out the requested copies of the AlgorithmIdentifier.
+    if (algor1 && !x509_digest_sign_algorithm(ctx, algor1)) {
+      goto err;
+    }
+    if (algor2 && !x509_digest_sign_algorithm(ctx, algor2)) {
+      goto err;
+    }
 
-  EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
-  size_t out_len = EVP_PKEY_size(pkey);
-  if (out_len > INT_MAX) {
-    OPENSSL_PUT_ERROR(X509, ERR_R_OVERFLOW);
-    goto err;
-  }
+    int in_len = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &in, it);
+    if (in_len < 0) {
+      goto err;
+    }
 
-  out = OPENSSL_malloc(out_len);
-  if (out == NULL) {
-    goto err;
-  }
+    EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
+    size_t out_len = EVP_PKEY_size(pkey);
+    if (out_len > INT_MAX) {
+      OPENSSL_PUT_ERROR(X509, ERR_R_OVERFLOW);
+      goto err;
+    }
 
-  if (!EVP_DigestSign(ctx, out, &out_len, in, in_len)) {
-    OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
-    goto err;
-  }
+    out = reinterpret_cast<uint8_t *>(OPENSSL_malloc(out_len));
+    if (out == NULL) {
+      goto err;
+    }
 
-  ASN1_STRING_set0(signature, out, (int)out_len);
-  out = NULL;
-  signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
-  signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
-  ret = (int)out_len;
+    if (!EVP_DigestSign(ctx, out, &out_len, in, in_len)) {
+      OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
+      goto err;
+    }
+
+    ASN1_STRING_set0(signature, out, (int)out_len);
+    out = NULL;
+    signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
+    signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+    ret = (int)out_len;
+  }
 
 err:
   EVP_MD_CTX_cleanup(ctx);

data/third_party/boringssl-with-bazel/src/crypto/x509/{a_verify.c → a_verify.cc}

@@ -95,7 +95,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *a,
     goto err;
   }
 
-  inl = ASN1_item_i2d(asn, &buf_in, it);
+  inl = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &buf_in, it);
 
   if (buf_in == NULL) {
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/x509/{algorithm.c → algorithm.cc}

@@ -98,7 +98,7 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
 
   // Default behavior: look up the OID for the algorithm/hash pair and encode
   // that.
-  const EVP_MD *digest = EVP_MD_CTX_md(ctx);
+  const EVP_MD *digest = EVP_MD_CTX_get0_md(ctx);
   if (digest == NULL) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_CONTEXT_NOT_INITIALISED);
     return 0;