grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/{ec_extra/ec_asn1.c → ec/ec_asn1.cc}

@@ -1,69 +1,30 @@
-/* Written by Nils Larsch for the OpenSSL project. */
-/* ====================================================================
- * Copyright (c) 2000-2003 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com). */
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ec.h>
 
 #include <limits.h>
 #include <string.h>
 
-#include <openssl/bytestring.h>
 #include <openssl/bn.h>
+#include <openssl/bytestring.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
 
-#include "../fipsmodule/ec/internal.h"
 #include "../bytestring/internal.h"
+#include "../fipsmodule/ec/internal.h"
 #include "../internal.h"
 
 
@@ -86,7 +47,7 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   CBS ec_private_key, private_key;
   uint64_t version;
   if (!CBS_get_asn1(cbs, &ec_private_key, CBS_ASN1_SEQUENCE) ||
-      !CBS_get_asn1_uint64(&ec_private_key, &version) ||
+      !CBS_get_asn1_uint64(&ec_private_key, &version) ||  //
       version != 1 ||
       !CBS_get_asn1(&ec_private_key, &private_key, CBS_ASN1_OCTETSTRING)) {
     OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
@@ -150,7 +111,7 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
         !CBS_get_asn1(&child, &public_key, CBS_ASN1_BITSTRING) ||
         // As in a SubjectPublicKeyInfo, the byte-encoded public key is then
         // encoded as a BIT STRING with bits ordered as in the DER encoding.
-        !CBS_get_u8(&public_key, &padding) ||
+        !CBS_get_u8(&public_key, &padding) ||  //
         padding != 0 ||
         // Explicitly check |public_key| is non-empty to save the conversion
         // form later.
@@ -251,9 +212,11 @@ int EC_KEY_marshal_private_key(CBB *cbb, const EC_KEY *key,
 // kPrimeFieldOID is the encoding of 1.2.840.10045.1.1.
 static const uint8_t kPrimeField[] = {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01, 0x01};
 
+namespace {
 struct explicit_prime_curve {
   CBS prime, a, b, base_x, base_y, order;
 };
+}  // namespace
 
 static int parse_explicit_prime_curve(CBS *in,
                                       struct explicit_prime_curve *out) {
@@ -263,15 +226,15 @@ static int parse_explicit_prime_curve(CBS *in,
   int has_cofactor;
   uint64_t version;
   if (!CBS_get_asn1(in, &params, CBS_ASN1_SEQUENCE) ||
-      !CBS_get_asn1_uint64(&params, &version) ||
-      version != 1 ||
+      !CBS_get_asn1_uint64(&params, &version) ||  //
+      version != 1 ||                             //
       !CBS_get_asn1(&params, &field_id, CBS_ASN1_SEQUENCE) ||
       !CBS_get_asn1(&field_id, &field_type, CBS_ASN1_OBJECT) ||
       CBS_len(&field_type) != sizeof(kPrimeField) ||
       OPENSSL_memcmp(CBS_data(&field_type), kPrimeField, sizeof(kPrimeField)) !=
           0 ||
       !CBS_get_asn1(&field_id, &out->prime, CBS_ASN1_INTEGER) ||
-      !CBS_is_unsigned_asn1_integer(&out->prime) ||
+      !CBS_is_unsigned_asn1_integer(&out->prime) ||  //
       CBS_len(&field_id) != 0 ||
       !CBS_get_asn1(&params, &curve, CBS_ASN1_SEQUENCE) ||
       !CBS_get_asn1(&curve, &out->a, CBS_ASN1_OCTETSTRING) ||
@@ -291,7 +254,7 @@ static int parse_explicit_prime_curve(CBS *in,
 
   if (has_cofactor) {
     // We only support prime-order curves so the cofactor must be one.
-    if (CBS_len(&cofactor) != 1 ||
+    if (CBS_len(&cofactor) != 1 ||  //
         CBS_data(&cofactor)[0] != 1) {
       OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
       return 0;
@@ -478,6 +441,41 @@ int i2d_ECPrivateKey(const EC_KEY *key, uint8_t **outp) {
   return CBB_finish_i2d(&cbb, outp);
 }
 
+EC_GROUP *d2i_ECPKParameters(EC_GROUP **out, const uint8_t **inp, long len) {
+  if (len < 0) {
+    return NULL;
+  }
+
+  CBS cbs;
+  CBS_init(&cbs, *inp, (size_t)len);
+  EC_GROUP *ret = EC_KEY_parse_parameters(&cbs);
+  if (ret == NULL) {
+    return NULL;
+  }
+
+  if (out != NULL) {
+    EC_GROUP_free(*out);
+    *out = ret;
+  }
+  *inp = CBS_data(&cbs);
+  return ret;
+}
+
+int i2d_ECPKParameters(const EC_GROUP *group, uint8_t **outp) {
+  if (group == NULL) {
+    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
+    return -1;
+  }
+
+  CBB cbb;
+  if (!CBB_init(&cbb, 0) ||  //
+      !EC_KEY_marshal_curve_name(&cbb, group)) {
+    CBB_cleanup(&cbb);
+    return -1;
+  }
+  return CBB_finish_i2d(&cbb, outp);
+}
+
 EC_KEY *d2i_ECParameters(EC_KEY **out_key, const uint8_t **inp, long len) {
   if (len < 0) {
     return NULL;
@@ -511,7 +509,7 @@ int i2d_ECParameters(const EC_KEY *key, uint8_t **outp) {
   }
 
   CBB cbb;
-  if (!CBB_init(&cbb, 0) ||
+  if (!CBB_init(&cbb, 0) ||  //
       !EC_KEY_marshal_curve_name(&cbb, key->group)) {
     CBB_cleanup(&cbb);
     return -1;

data/third_party/boringssl-with-bazel/src/crypto/{ec_extra/ec_derive.c → ec/ec_derive.cc}

@@ -1,16 +1,16 @@
-/* Copyright (c) 2019, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2019 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ec_key.h>
 

data/third_party/boringssl-with-bazel/src/crypto/{ec_extra/hash_to_curve.c → ec/hash_to_curve.cc}

@@ -1,16 +1,16 @@
-/* Copyright (c) 2020, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2020 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ec.h>
 
@@ -20,10 +20,10 @@
 
 #include <assert.h>
 
-#include "internal.h"
 #include "../fipsmodule/bn/internal.h"
 #include "../fipsmodule/ec/internal.h"
 #include "../internal.h"
+#include "internal.h"
 
 
 // This file implements hash-to-curve, as described in RFC 9380.
@@ -63,72 +63,75 @@ static int expand_message_xmd(const EVP_MD *md, uint8_t *out, size_t out_len,
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
 
-  // Long DSTs are hashed down to size. See section 5.3.3.
-  static_assert(EVP_MAX_MD_SIZE < 256, "hashed DST still too large");
-  uint8_t dst_buf[EVP_MAX_MD_SIZE];
-  if (dst_len >= 256) {
-    static const char kPrefix[] = "H2C-OVERSIZE-DST-";
+  {
+    // Long DSTs are hashed down to size. See section 5.3.3.
+    static_assert(EVP_MAX_MD_SIZE < 256, "hashed DST still too large");
+    uint8_t dst_buf[EVP_MAX_MD_SIZE];
+    if (dst_len >= 256) {
+      static const char kPrefix[] = "H2C-OVERSIZE-DST-";
+      if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+          !EVP_DigestUpdate(&ctx, kPrefix, sizeof(kPrefix) - 1) ||
+          !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+          !EVP_DigestFinal_ex(&ctx, dst_buf, NULL)) {
+        goto err;
+      }
+      dst = dst_buf;
+      dst_len = md_size;
+    }
+    uint8_t dst_len_u8 = (uint8_t)dst_len;
+
+    // Compute b_0.
+    static const uint8_t kZeros[EVP_MAX_MD_BLOCK_SIZE] = {0};
+    // If |out_len| exceeds 16 bits then |i| will wrap below causing an error to
+    // be returned. This depends on the static assert above.
+    uint8_t l_i_b_str_zero[3] = {static_cast<uint8_t>(out_len >> 8),
+                                 static_cast<uint8_t>(out_len), 0};
+    uint8_t b_0[EVP_MAX_MD_SIZE];
     if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
-        !EVP_DigestUpdate(&ctx, kPrefix, sizeof(kPrefix) - 1) ||
+        !EVP_DigestUpdate(&ctx, kZeros, block_size) ||
+        !EVP_DigestUpdate(&ctx, msg, msg_len) ||
+        !EVP_DigestUpdate(&ctx, l_i_b_str_zero, sizeof(l_i_b_str_zero)) ||
         !EVP_DigestUpdate(&ctx, dst, dst_len) ||
-        !EVP_DigestFinal_ex(&ctx, dst_buf, NULL)) {
+        !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
+        !EVP_DigestFinal_ex(&ctx, b_0, NULL)) {
       goto err;
     }
-    dst = dst_buf;
-    dst_len = md_size;
-  }
-  uint8_t dst_len_u8 = (uint8_t)dst_len;
-
-  // Compute b_0.
-  static const uint8_t kZeros[EVP_MAX_MD_BLOCK_SIZE] = {0};
-  // If |out_len| exceeds 16 bits then |i| will wrap below causing an error to
-  // be returned. This depends on the static assert above.
-  uint8_t l_i_b_str_zero[3] = {out_len >> 8, out_len, 0};
-  uint8_t b_0[EVP_MAX_MD_SIZE];
-  if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
-      !EVP_DigestUpdate(&ctx, kZeros, block_size) ||
-      !EVP_DigestUpdate(&ctx, msg, msg_len) ||
-      !EVP_DigestUpdate(&ctx, l_i_b_str_zero, sizeof(l_i_b_str_zero)) ||
-      !EVP_DigestUpdate(&ctx, dst, dst_len) ||
-      !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
-      !EVP_DigestFinal_ex(&ctx, b_0, NULL)) {
-    goto err;
-  }
 
-  uint8_t b_i[EVP_MAX_MD_SIZE];
-  uint8_t i = 1;
-  while (out_len > 0) {
-    if (i == 0) {
-      // Input was too large.
-      OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
-      goto err;
-    }
-    if (i > 1) {
-      for (size_t j = 0; j < md_size; j++) {
-        b_i[j] ^= b_0[j];
+    uint8_t b_i[EVP_MAX_MD_SIZE];
+    uint8_t i = 1;
+    while (out_len > 0) {
+      if (i == 0) {
+        // Input was too large.
+        OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
+        goto err;
+      }
+      if (i > 1) {
+        for (size_t j = 0; j < md_size; j++) {
+          b_i[j] ^= b_0[j];
+        }
+      } else {
+        OPENSSL_memcpy(b_i, b_0, md_size);
       }
-    } else {
-      OPENSSL_memcpy(b_i, b_0, md_size);
-    }
 
-    if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
-        !EVP_DigestUpdate(&ctx, b_i, md_size) ||
-        !EVP_DigestUpdate(&ctx, &i, 1) ||
-        !EVP_DigestUpdate(&ctx, dst, dst_len) ||
-        !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
-        !EVP_DigestFinal_ex(&ctx, b_i, NULL)) {
-      goto err;
+      if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+          !EVP_DigestUpdate(&ctx, b_i, md_size) ||
+          !EVP_DigestUpdate(&ctx, &i, 1) ||
+          !EVP_DigestUpdate(&ctx, dst, dst_len) ||
+          !EVP_DigestUpdate(&ctx, &dst_len_u8, 1) ||
+          !EVP_DigestFinal_ex(&ctx, b_i, NULL)) {
+        goto err;
+      }
+
+      size_t todo = out_len >= md_size ? md_size : out_len;
+      OPENSSL_memcpy(out, b_i, todo);
+      out += todo;
+      out_len -= todo;
+      i++;
     }
 
-    size_t todo = out_len >= md_size ? md_size : out_len;
-    OPENSSL_memcpy(out, b_i, todo);
-    out += todo;
-    out_len -= todo;
-    i++;
+    ret = 1;
   }
 
-  ret = 1;
-
 err:
   EVP_MD_CTX_cleanup(&ctx);
   return ret;
@@ -144,8 +147,7 @@ static int num_bytes_to_derive(size_t *out, const BIGNUM *modulus, unsigned k) {
   // |felem_reduce| and |ec_scalar_reduce|. All defined hash-to-curve suites
   // define |k| to be well under this bound. (|k| is usually around half of
   // |p_bits|.)
-  if (L * 8 >= 2 * bits - 2 ||
-      L > 2 * EC_MAX_BYTES) {
+  if (L * 8 >= 2 * bits - 2 || L > 2 * EC_MAX_BYTES) {
     assert(0);
     OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
     return 0;
@@ -226,7 +228,7 @@ static BN_ULONG sgn0(const EC_GROUP *group, const EC_FELEM *a) {
   return buf[len - 1] & 1;
 }
 
-OPENSSL_UNUSED static int is_3mod4(const EC_GROUP *group) {
+[[maybe_unused]] static int is_3mod4(const EC_GROUP *group) {
   return group->field.N.width > 0 && (group->field.N.d[0] & 3) == 3;
 }
 
@@ -462,9 +464,9 @@ int EC_hash_to_curve_p384_xmd_sha384_sswu(const EC_GROUP *group, EC_POINT *out,
                                                msg, msg_len);
 }
 
-int ec_hash_to_scalar_p384_xmd_sha384(
-    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
-    const uint8_t *msg, size_t msg_len) {
+int ec_hash_to_scalar_p384_xmd_sha384(const EC_GROUP *group, EC_SCALAR *out,
+                                      const uint8_t *dst, size_t dst_len,
+                                      const uint8_t *msg, size_t msg_len) {
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
@@ -475,8 +477,8 @@ int ec_hash_to_scalar_p384_xmd_sha384(
 }
 
 int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
-    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len) {
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len) {
   // See section 8.3 of draft-irtf-cfrg-hash-to-curve-07.
   if (EC_GROUP_get_curve_name(group) != NID_secp384r1) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);

data/third_party/boringssl-with-bazel/src/crypto/{ec_extra → ec}/internal.h

@@ -1,16 +1,16 @@
-/* Copyright (c) 2020, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2020 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #ifndef OPENSSL_HEADER_EC_EXTRA_INTERNAL_H
 #define OPENSSL_HEADER_EC_EXTRA_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/ecdh/ecdh.cc

@@ -0,0 +1,73 @@
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ecdh.h>
+
+#include <limits.h>
+#include <string.h>
+
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+#include "../fipsmodule/ec/internal.h"
+#include "../internal.h"
+
+
+int ECDH_compute_key(void *out, size_t out_len, const EC_POINT *pub_key,
+                     const EC_KEY *priv_key,
+                     void *(*kdf)(const void *in, size_t inlen, void *out,
+                                  size_t *out_len)) {
+  if (priv_key->priv_key == NULL) {
+    OPENSSL_PUT_ERROR(ECDH, ECDH_R_NO_PRIVATE_VALUE);
+    return -1;
+  }
+  const EC_SCALAR *const priv = &priv_key->priv_key->scalar;
+  const EC_GROUP *const group = EC_KEY_get0_group(priv_key);
+  if (EC_GROUP_cmp(group, pub_key->group, NULL) != 0) {
+    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
+    return -1;
+  }
+
+  EC_JACOBIAN shared_point;
+  uint8_t buf[EC_MAX_BYTES];
+  size_t buf_len;
+  if (!ec_point_mul_scalar(group, &shared_point, &pub_key->raw, priv) ||
+      !ec_get_x_coordinate_as_bytes(group, buf, &buf_len, sizeof(buf),
+                                    &shared_point)) {
+    OPENSSL_PUT_ERROR(ECDH, ECDH_R_POINT_ARITHMETIC_FAILURE);
+    return -1;
+  }
+
+  if (kdf != NULL) {
+    if (kdf(buf, buf_len, out, &out_len) == NULL) {
+      OPENSSL_PUT_ERROR(ECDH, ECDH_R_KDF_FAILED);
+      return -1;
+    }
+  } else {
+    // no KDF, just copy as much as we can
+    if (buf_len < out_len) {
+      out_len = buf_len;
+    }
+    OPENSSL_memcpy(out, buf, out_len);
+  }
+
+  if (out_len > INT_MAX) {
+    OPENSSL_PUT_ERROR(ECDH, ERR_R_OVERFLOW);
+    return -1;
+  }
+
+  return (int)out_len;
+}