grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/{padding.c.inc → padding.cc.inc}

@@ -1,57 +1,16 @@
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2005.
- */
-/* ====================================================================
- * Copyright (c) 2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com). */
+// Copyright 2005-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/rsa.h>
 
@@ -63,12 +22,11 @@
 #include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/sha.h>
 
-#include "internal.h"
-#include "../service_indicator/internal.h"
-#include "../bcm_interface.h"
 #include "../../internal.h"
+#include "../bcm_interface.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 int RSA_padding_add_PKCS1_type_1(uint8_t *to, size_t to_len,
@@ -216,8 +174,11 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
 
   int ret = 0;
   uint8_t *DB = NULL;
+  const uint8_t *H;
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
+  unsigned MSBits;
+  size_t emLen, maskedDBLen, salt_start;
   FIPS_service_indicator_lock_state();
 
   // Negative sLen has special meanings:
@@ -234,8 +195,8 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     goto err;
   }
 
-  unsigned MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
-  size_t emLen = RSA_size(rsa);
+  MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
+  emLen = RSA_size(rsa);
   if (EM[0] & (0xFF << MSBits)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_FIRST_OCTET_INVALID);
     goto err;
@@ -245,8 +206,7 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     emLen--;
   }
   // |sLen| may be -2 for the non-standard salt length recovery mode.
-  if (emLen < hLen + 2 ||
-      (sLen >= 0 && emLen < hLen + (size_t)sLen + 2)) {
+  if (emLen < hLen + 2 || (sLen >= 0 && emLen < hLen + (size_t)sLen + 2)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE);
     goto err;
   }
@@ -254,9 +214,9 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     OPENSSL_PUT_ERROR(RSA, RSA_R_LAST_OCTET_INVALID);
     goto err;
   }
-  size_t maskedDBLen = emLen - hLen - 1;
-  const uint8_t *H = EM + maskedDBLen;
-  DB = OPENSSL_malloc(maskedDBLen);
+  maskedDBLen = emLen - hLen - 1;
+  H = EM + maskedDBLen;
+  DB = reinterpret_cast<uint8_t *>(OPENSSL_malloc(maskedDBLen));
   if (!DB) {
     goto err;
   }
@@ -272,7 +232,6 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
   // This step differs slightly from EMSA-PSS-VERIFY (RFC 8017) step 10 because
   // it accepts a non-standard salt recovery flow. DB should be some number of
   // zeros, a one, then the salt.
-  size_t salt_start;
   for (salt_start = 0; DB[salt_start] == 0 && salt_start < maskedDBLen - 1;
        salt_start++) {
     ;
@@ -313,7 +272,7 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
                                    const unsigned char *mHash,
                                    const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                                    int sLenRequested) {
-  int ret = 0;
+  int ret = 0, digest_ok;
   size_t maskedDBLen, MSBits, emLen;
   size_t hLen;
   unsigned char *H, *salt = NULL, *p;
@@ -365,7 +324,7 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
   }
 
   if (sLen > 0) {
-    salt = OPENSSL_malloc(sLen);
+    salt = reinterpret_cast<uint8_t *>(OPENSSL_malloc(sLen));
     if (!salt) {
       goto err;
     }
@@ -376,11 +335,11 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
 
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
-  int digest_ok = EVP_DigestInit_ex(&ctx, Hash, NULL) &&
-                  EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) &&
-                  EVP_DigestUpdate(&ctx, mHash, hLen) &&
-                  EVP_DigestUpdate(&ctx, salt, sLen) &&
-                  EVP_DigestFinal_ex(&ctx, H, NULL);
+  digest_ok = EVP_DigestInit_ex(&ctx, Hash, NULL) &&
+              EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) &&
+              EVP_DigestUpdate(&ctx, mHash, hLen) &&
+              EVP_DigestUpdate(&ctx, salt, sLen) &&
+              EVP_DigestFinal_ex(&ctx, H, NULL);
   EVP_MD_CTX_cleanup(&ctx);
   if (!digest_ok) {
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/{rsa.c.inc → rsa.cc.inc}

@@ -1,58 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/rsa.h>
 
@@ -68,12 +26,12 @@
 #include <openssl/md5.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
-#include <openssl/sha.h>
 #include <openssl/thread.h>
 
+#include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../bn/internal.h"
 #include "../delocate.h"
-#include "../../internal.h"
 #include "internal.h"
 
 
@@ -206,7 +164,7 @@ RSA *RSA_new_private_key_large_e(const BIGNUM *n, const BIGNUM *e,
 RSA *RSA_new(void) { return RSA_new_method(NULL); }
 
 RSA *RSA_new_method(const ENGINE *engine) {
-  RSA *rsa = OPENSSL_zalloc(sizeof(RSA));
+  RSA *rsa = reinterpret_cast<RSA *>(OPENSSL_zalloc(sizeof(RSA)));
   if (rsa == NULL) {
     return NULL;
   }
@@ -216,7 +174,7 @@ RSA *RSA_new_method(const ENGINE *engine) {
   }
 
   if (rsa->meth == NULL) {
-    rsa->meth = (RSA_METHOD *) RSA_default_method();
+    rsa->meth = (RSA_METHOD *)RSA_default_method();
   }
   METHOD_ref(rsa->meth);
 
@@ -238,8 +196,7 @@ RSA *RSA_new_method(const ENGINE *engine) {
 
 RSA *RSA_new_method_no_e(const ENGINE *engine, const BIGNUM *n) {
   RSA *rsa = RSA_new_method(engine);
-  if (rsa == NULL ||
-      !bn_dup_into(&rsa->n, n)) {
+  if (rsa == NULL || !bn_dup_into(&rsa->n, n)) {
     RSA_free(rsa);
     return NULL;
   }
@@ -342,8 +299,7 @@ void RSA_get0_crt_params(const RSA *rsa, const BIGNUM **out_dmp1,
 }
 
 int RSA_set0_key(RSA *rsa, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
-  if ((rsa->n == NULL && n == NULL) ||
-      (rsa->e == NULL && e == NULL)) {
+  if ((rsa->n == NULL && n == NULL) || (rsa->e == NULL && e == NULL)) {
     return 0;
   }
 
@@ -365,8 +321,7 @@ int RSA_set0_key(RSA *rsa, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
 }
 
 int RSA_set0_factors(RSA *rsa, BIGNUM *p, BIGNUM *q) {
-  if ((rsa->p == NULL && p == NULL) ||
-      (rsa->q == NULL && q == NULL)) {
+  if ((rsa->p == NULL && p == NULL) || (rsa->q == NULL && q == NULL)) {
     return 0;
   }
 
@@ -424,14 +379,7 @@ int RSA_sign_raw(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
                                    padding);
 }
 
-unsigned RSA_size(const RSA *rsa) {
-  size_t ret = rsa->meth->size ? rsa->meth->size(rsa) : rsa_default_size(rsa);
-  // RSA modulus sizes are bounded by |BIGNUM|, which must fit in |unsigned|.
-  //
-  // TODO(https://crbug.com/boringssl/516): Should we make this return |size_t|?
-  assert(ret < UINT_MAX);
-  return (unsigned)ret;
-}
+unsigned RSA_size(const RSA *rsa) { return BN_num_bytes(rsa->n); }
 
 int RSA_is_opaque(const RSA *rsa) {
   return rsa->meth && (rsa->meth->flags & RSA_FLAG_OPAQUE);
@@ -440,7 +388,7 @@ int RSA_is_opaque(const RSA *rsa) {
 int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
                          CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
   return CRYPTO_get_ex_new_index_ex(g_rsa_ex_data_class_bss_get(), argl, argp,
-                                 free_func);
+                                    free_func);
 }
 
 int RSA_set_ex_data(RSA *rsa, int idx, void *arg) {
@@ -472,49 +420,52 @@ struct pkcs1_sig_prefix {
 // different hash functions.
 static const struct pkcs1_sig_prefix kPKCS1SigPrefixes[] = {
     {
-     NID_md5,
-     MD5_DIGEST_LENGTH,
-     18,
-     {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
-      0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
+        NID_md5,
+        MD5_DIGEST_LENGTH,
+        18,
+        {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+         0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
     },
     {
-     NID_sha1,
-     SHA_DIGEST_LENGTH,
-     15,
-     {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
-      0x00, 0x04, 0x14},
+        NID_sha1,
+        BCM_SHA_DIGEST_LENGTH,
+        15,
+        {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05,
+         0x00, 0x04, 0x14},
     },
     {
-     NID_sha224,
-     SHA224_DIGEST_LENGTH,
-     19,
-     {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
-      0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1c},
+        NID_sha224,
+        BCM_SHA224_DIGEST_LENGTH,
+        19,
+        {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+         0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1c},
     },
     {
-     NID_sha256,
-     SHA256_DIGEST_LENGTH,
-     19,
-     {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
-      0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20},
+        NID_sha256,
+        BCM_SHA256_DIGEST_LENGTH,
+        19,
+        {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+         0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20},
     },
     {
-     NID_sha384,
-     SHA384_DIGEST_LENGTH,
-     19,
-     {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
-      0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30},
+        NID_sha384,
+        BCM_SHA384_DIGEST_LENGTH,
+        19,
+        {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+         0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30},
     },
     {
-     NID_sha512,
-     SHA512_DIGEST_LENGTH,
-     19,
-     {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
-      0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40},
+        NID_sha512,
+        BCM_SHA512_DIGEST_LENGTH,
+        19,
+        {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+         0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40},
     },
     {
-     NID_undef, 0, 0, {0},
+        NID_undef,
+        0,
+        0,
+        {0},
     },
 };
 
@@ -540,7 +491,6 @@ static int rsa_check_digest_size(int hash_nid, size_t digest_len) {
 
   OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_ALGORITHM_TYPE);
   return 0;
-
 }
 
 int RSA_add_pkcs1_prefix(uint8_t **out_msg, size_t *out_msg_len,
@@ -567,7 +517,7 @@ int RSA_add_pkcs1_prefix(uint8_t **out_msg, size_t *out_msg_len,
 
     // The length should already have been checked.
     assert(digest_len == sig_prefix->hash_len);
-    const uint8_t* prefix = sig_prefix->bytes;
+    const uint8_t *prefix = sig_prefix->bytes;
     size_t prefix_len = sig_prefix->len;
     size_t signed_msg_len = prefix_len + digest_len;
     if (signed_msg_len < prefix_len) {
@@ -575,7 +525,8 @@ int RSA_add_pkcs1_prefix(uint8_t **out_msg, size_t *out_msg_len,
       return 0;
     }
 
-    uint8_t *signed_msg = OPENSSL_malloc(signed_msg_len);
+    uint8_t *signed_msg =
+        reinterpret_cast<uint8_t *>(OPENSSL_malloc(signed_msg_len));
     if (!signed_msg) {
       return 0;
     }
@@ -654,7 +605,7 @@ int RSA_sign_pss_mgf1(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
   }
 
   size_t padded_len = RSA_size(rsa);
-  uint8_t *padded = OPENSSL_malloc(padded_len);
+  uint8_t *padded = reinterpret_cast<uint8_t *>(OPENSSL_malloc(padded_len));
   if (padded == NULL) {
     return 0;
   }
@@ -687,7 +638,7 @@ int rsa_verify_no_self_test(int hash_nid, const uint8_t *digest,
     return 0;
   }
 
-  buf = OPENSSL_malloc(rsa_size);
+  buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
   if (!buf) {
     return 0;
   }
@@ -733,7 +684,7 @@ int RSA_verify_pss_mgf1(RSA *rsa, const uint8_t *digest, size_t digest_len,
   }
 
   size_t em_len = RSA_size(rsa);
-  uint8_t *em = OPENSSL_malloc(em_len);
+  uint8_t *em = reinterpret_cast<uint8_t *>(OPENSSL_malloc(em_len));
   if (em == NULL) {
     return 0;
   }
@@ -769,8 +720,7 @@ static int check_mod_inverse(int *out_ok, const BIGNUM *a, const BIGNUM *ainv,
   // were checked by the caller.
   BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  int ret = tmp != NULL &&
-            bn_mul_consttime(tmp, a, ainv, ctx) &&
+  int ret = tmp != NULL && bn_mul_consttime(tmp, a, ainv, ctx) &&
             bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx);
   if (ret) {
     *out_ok = constant_time_declassify_int(BN_is_one(tmp));
@@ -786,11 +736,6 @@ int RSA_check_key(const RSA *key) {
   // https://crbug.com/boringssl/316. As a result, we inconsistently check RSA
   // invariants. We should fix this and integrate that logic.
 
-  if (RSA_is_opaque(key)) {
-    // Opaque keys can't be checked.
-    return 1;
-  }
-
   if (!rsa_check_public_key(key)) {
     return 0;
   }
@@ -820,7 +765,8 @@ int RSA_check_key(const RSA *key) {
   }
 
   BIGNUM tmp, de, pm1, qm1, dmp1, dmq1;
-  int ok = 0;
+  int ok = 0, has_crt_values;
+  unsigned pm1_bits, qm1_bits;
   BN_init(&tmp);
   BN_init(&de);
   BN_init(&pm1);
@@ -857,8 +803,8 @@ int RSA_check_key(const RSA *key) {
     OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
     goto out;
   }
-  const unsigned pm1_bits = BN_num_bits(&pm1);
-  const unsigned qm1_bits = BN_num_bits(&qm1);
+  pm1_bits = BN_num_bits(&pm1);
+  qm1_bits = BN_num_bits(&qm1);
   if (!bn_mul_consttime(&de, key->d, key->e, ctx) ||
       !bn_div_consttime(NULL, &tmp, &de, &pm1, pm1_bits, ctx) ||
       !bn_div_consttime(NULL, &de, &de, &qm1, qm1_bits, ctx)) {
@@ -872,7 +818,7 @@ int RSA_check_key(const RSA *key) {
     goto out;
   }
 
-  int has_crt_values = key->dmp1 != NULL;
+  has_crt_values = key->dmp1 != NULL;
   if (has_crt_values != (key->dmq1 != NULL) ||
       has_crt_values != (key->iqmp != NULL)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_INCONSISTENT_SET_OF_CRT_VALUES);
@@ -913,20 +859,26 @@ out:
 
 
 // This is the product of the 132 smallest odd primes, from 3 to 751.
-static const BN_ULONG kSmallFactorsLimbs[] = {
-    TOBN(0xc4309333, 0x3ef4e3e1), TOBN(0x71161eb6, 0xcd2d655f),
-    TOBN(0x95e2238c, 0x0bf94862), TOBN(0x3eb233d3, 0x24f7912b),
-    TOBN(0x6b55514b, 0xbf26c483), TOBN(0x0a84d817, 0x5a144871),
-    TOBN(0x77d12fee, 0x9b82210a), TOBN(0xdb5b93c2, 0x97f050b3),
-    TOBN(0x4acad6b9, 0x4d6c026b), TOBN(0xeb7751f3, 0x54aec893),
-    TOBN(0xdba53368, 0x36bc85c4), TOBN(0xd85a1b28, 0x7f5ec78e),
-    TOBN(0x2eb072d8, 0x6b322244), TOBN(0xbba51112, 0x5e2b3aea),
-    TOBN(0x36ed1a6c, 0x0e2486bf), TOBN(0x5f270460, 0xec0c5727),
-    0x000017b1
-};
+static const BN_ULONG kSmallFactorsLimbs[] = {TOBN(0xc4309333, 0x3ef4e3e1),
+                                              TOBN(0x71161eb6, 0xcd2d655f),
+                                              TOBN(0x95e2238c, 0x0bf94862),
+                                              TOBN(0x3eb233d3, 0x24f7912b),
+                                              TOBN(0x6b55514b, 0xbf26c483),
+                                              TOBN(0x0a84d817, 0x5a144871),
+                                              TOBN(0x77d12fee, 0x9b82210a),
+                                              TOBN(0xdb5b93c2, 0x97f050b3),
+                                              TOBN(0x4acad6b9, 0x4d6c026b),
+                                              TOBN(0xeb7751f3, 0x54aec893),
+                                              TOBN(0xdba53368, 0x36bc85c4),
+                                              TOBN(0xd85a1b28, 0x7f5ec78e),
+                                              TOBN(0x2eb072d8, 0x6b322244),
+                                              TOBN(0xbba51112, 0x5e2b3aea),
+                                              TOBN(0x36ed1a6c, 0x0e2486bf),
+                                              TOBN(0x5f270460, 0xec0c5727),
+                                              0x000017b1};
 
 DEFINE_LOCAL_DATA(BIGNUM, g_small_factors) {
-  out->d = (BN_ULONG *) kSmallFactorsLimbs;
+  out->d = (BN_ULONG *)kSmallFactorsLimbs;
   out->width = OPENSSL_ARRAY_SIZE(kSmallFactorsLimbs);
   out->dmax = out->width;
   out->neg = 0;
@@ -934,12 +886,6 @@ DEFINE_LOCAL_DATA(BIGNUM, g_small_factors) {
 }
 
 int RSA_check_fips(RSA *key) {
-  if (RSA_is_opaque(key)) {
-    // Opaque keys can't be checked.
-    OPENSSL_PUT_ERROR(RSA, RSA_R_PUBLIC_KEY_VALIDATION_FAILED);
-    return 0;
-  }
-
   if (!RSA_check_key(key)) {
     return 0;
   }
@@ -960,10 +906,13 @@ int RSA_check_fips(RSA *key) {
   // match. This is only a plausibility test and we expect the value to be
   // composite, so too few iterations will cause us to reject the key, not use
   // an implausible one.
+  //
+  // |key->e| may be nullptr if created with |RSA_new_private_key_no_e|.
   enum bn_primality_result_t primality_result;
-  if (BN_num_bits(key->e) <= 16 ||
-      BN_num_bits(key->e) > 256 ||
-      !BN_is_odd(key->n) ||
+  if (key->e == nullptr ||          //
+      BN_num_bits(key->e) <= 16 ||  //
+      BN_num_bits(key->e) > 256 ||  //
+      !BN_is_odd(key->n) ||         //
       !BN_is_odd(key->e) ||
       !BN_gcd(&small_gcd, key->n, g_small_factors(), ctx) ||
       !BN_is_one(&small_gcd) ||
@@ -990,7 +939,7 @@ int RSA_check_fips(RSA *key) {
   // perform a signing test.
   uint8_t data[32] = {0};
   unsigned sig_len = RSA_size(key);
-  uint8_t *sig = OPENSSL_malloc(sig_len);
+  uint8_t *sig = reinterpret_cast<uint8_t *>(OPENSSL_malloc(sig_len));
   if (sig == NULL) {
     return 0;
   }
@@ -1032,7 +981,3 @@ int rsa_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
 int RSA_flags(const RSA *rsa) { return rsa->flags; }
 
 int RSA_test_flags(const RSA *rsa, int flags) { return rsa->flags & flags; }
-
-int RSA_blinding_on(RSA *rsa, BN_CTX *ctx) {
-  return 1;
-}