grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/{sha512.c.inc → sha512.cc.inc}

@@ -1,66 +1,23 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
-
-#include <openssl/sha.h>
+// Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <string.h>
 
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../service_indicator/internal.h"
 #include "internal.h"
 
@@ -71,9 +28,9 @@
 // this writing, so there is no need for a common collector/padding
 // implementation yet.
 
-static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha);
+static void sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha);
 
-int SHA384_Init(SHA512_CTX *sha) {
+bcm_infallible BCM_sha384_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0xcbbb9d5dc1059ed8);
   sha->h[1] = UINT64_C(0x629a292a367cd507);
   sha->h[2] = UINT64_C(0x9159015a3070dd17);
@@ -86,12 +43,12 @@ int SHA384_Init(SHA512_CTX *sha) {
   sha->Nl = 0;
   sha->Nh = 0;
   sha->num = 0;
-  sha->md_len = SHA384_DIGEST_LENGTH;
-  return 1;
+  sha->md_len = BCM_SHA384_DIGEST_LENGTH;
+  return bcm_infallible::approved;
 }
 
 
-int SHA512_Init(SHA512_CTX *sha) {
+bcm_infallible BCM_sha512_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0x6a09e667f3bcc908);
   sha->h[1] = UINT64_C(0xbb67ae8584caa73b);
   sha->h[2] = UINT64_C(0x3c6ef372fe94f82b);
@@ -104,11 +61,11 @@ int SHA512_Init(SHA512_CTX *sha) {
   sha->Nl = 0;
   sha->Nh = 0;
   sha->num = 0;
-  sha->md_len = SHA512_DIGEST_LENGTH;
-  return 1;
+  sha->md_len = BCM_SHA512_DIGEST_LENGTH;
+  return bcm_infallible::approved;
 }
 
-int SHA512_256_Init(SHA512_CTX *sha) {
+bcm_infallible BCM_sha512_256_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0x22312194fc2bf72c);
   sha->h[1] = UINT64_C(0x9f555fa3c84c64c2);
   sha->h[2] = UINT64_C(0x2393b86b6f53b151);
@@ -121,38 +78,8 @@ int SHA512_256_Init(SHA512_CTX *sha) {
   sha->Nl = 0;
   sha->Nh = 0;
   sha->num = 0;
-  sha->md_len = SHA512_256_DIGEST_LENGTH;
-  return 1;
-}
-
-uint8_t *SHA384(const uint8_t *data, size_t len,
-                uint8_t out[SHA384_DIGEST_LENGTH]) {
-  SHA512_CTX ctx;
-  SHA384_Init(&ctx);
-  SHA384_Update(&ctx, data, len);
-  SHA384_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
-}
-
-uint8_t *SHA512(const uint8_t *data, size_t len,
-                uint8_t out[SHA512_DIGEST_LENGTH]) {
-  SHA512_CTX ctx;
-  SHA512_Init(&ctx);
-  SHA512_Update(&ctx, data, len);
-  SHA512_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
-}
-
-uint8_t *SHA512_256(const uint8_t *data, size_t len,
-                    uint8_t out[SHA512_256_DIGEST_LENGTH]) {
-  SHA512_CTX ctx;
-  SHA512_256_Init(&ctx);
-  SHA512_256_Update(&ctx, data, len);
-  SHA512_256_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
+  sha->md_len = BCM_SHA512_256_DIGEST_LENGTH;
+  return bcm_infallible::approved;
 }
 
 #if !defined(SHA512_ASM)
@@ -161,39 +88,48 @@ static void sha512_block_data_order(uint64_t state[8], const uint8_t *in,
 #endif
 
 
-int SHA384_Final(uint8_t out[SHA384_DIGEST_LENGTH], SHA512_CTX *sha) {
-  // This function must be paired with |SHA384_Init|, which sets |sha->md_len|
-  // to |SHA384_DIGEST_LENGTH|.
-  assert(sha->md_len == SHA384_DIGEST_LENGTH);
-  return sha512_final_impl(out, SHA384_DIGEST_LENGTH, sha);
+bcm_infallible BCM_sha384_final(uint8_t out[BCM_SHA384_DIGEST_LENGTH],
+                                SHA512_CTX *sha) {
+  // This function must be paired with |BCM_sha384_init|, which sets
+  // |sha->md_len| to |BCM_SHA384_DIGEST_LENGTH|.
+  assert(sha->md_len == BCM_SHA384_DIGEST_LENGTH);
+  sha512_final_impl(out, BCM_SHA384_DIGEST_LENGTH, sha);
+  return bcm_infallible::approved;
 }
 
-int SHA384_Update(SHA512_CTX *sha, const void *data, size_t len) {
-  return SHA512_Update(sha, data, len);
+bcm_infallible BCM_sha384_update(SHA512_CTX *sha, const void *data,
+                                 size_t len) {
+  return BCM_sha512_update(sha, data, len);
 }
 
-int SHA512_256_Update(SHA512_CTX *sha, const void *data, size_t len) {
-  return SHA512_Update(sha, data, len);
+bcm_infallible BCM_sha512_256_update(SHA512_CTX *sha, const void *data,
+                                     size_t len) {
+  return BCM_sha512_update(sha, data, len);
 }
 
-int SHA512_256_Final(uint8_t out[SHA512_256_DIGEST_LENGTH], SHA512_CTX *sha) {
-  // This function must be paired with |SHA512_256_Init|, which sets
-  // |sha->md_len| to |SHA512_256_DIGEST_LENGTH|.
-  assert(sha->md_len == SHA512_256_DIGEST_LENGTH);
-  return sha512_final_impl(out, SHA512_256_DIGEST_LENGTH, sha);
+bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
+                                    SHA512_CTX *sha) {
+  // This function must be paired with |BCM_sha512_256_init|, which sets
+  // |sha->md_len| to |BCM_SHA512_256_DIGEST_LENGTH|.
+  assert(sha->md_len == BCM_SHA512_256_DIGEST_LENGTH);
+  sha512_final_impl(out, BCM_SHA512_256_DIGEST_LENGTH, sha);
+  return bcm_infallible::approved;
 }
 
-void SHA512_Transform(SHA512_CTX *c, const uint8_t block[SHA512_CBLOCK]) {
+bcm_infallible BCM_sha512_transform(SHA512_CTX *c,
+                                    const uint8_t block[SHA512_CBLOCK]) {
   sha512_block_data_order(c->h, block, 1);
+  return bcm_infallible::approved;
 }
 
-int SHA512_Update(SHA512_CTX *c, const void *in_data, size_t len) {
+bcm_infallible BCM_sha512_update(SHA512_CTX *c, const void *in_data,
+                                 size_t len) {
   uint64_t l;
   uint8_t *p = c->p;
-  const uint8_t *data = in_data;
+  const uint8_t *data = reinterpret_cast<const uint8_t *>(in_data);
 
   if (len == 0) {
-    return 1;
+    return bcm_infallible::approved;
   }
 
   l = (c->Nl + (((uint64_t)len) << 3)) & UINT64_C(0xffffffffffffffff);
@@ -211,7 +147,7 @@ int SHA512_Update(SHA512_CTX *c, const void *in_data, size_t len) {
     if (len < n) {
       OPENSSL_memcpy(p + c->num, data, len);
       c->num += (unsigned int)len;
-      return 1;
+      return bcm_infallible::approved;
     } else {
       OPENSSL_memcpy(p + c->num, data, n), c->num = 0;
       len -= n;
@@ -232,19 +168,21 @@ int SHA512_Update(SHA512_CTX *c, const void *in_data, size_t len) {
     c->num = (int)len;
   }
 
-  return 1;
+  return bcm_infallible::approved;
 }
 
-int SHA512_Final(uint8_t out[SHA512_DIGEST_LENGTH], SHA512_CTX *sha) {
-  // Ideally we would assert |sha->md_len| is |SHA512_DIGEST_LENGTH| to match
-  // the size hint, but calling code often pairs |SHA384_Init| with
-  // |SHA512_Final| and expects |sha->md_len| to carry the size over.
+bcm_infallible BCM_sha512_final(uint8_t out[BCM_SHA512_DIGEST_LENGTH],
+                                SHA512_CTX *sha) {
+  // Ideally we would assert |sha->md_len| is |BCM_SHA512_DIGEST_LENGTH| to
+  // match the size hint, but calling code often pairs |BCM_sha384_init| with
+  // |BCM_sha512_final| and expects |sha->md_len| to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
-  return sha512_final_impl(out, sha->md_len, sha);
+  sha512_final_impl(out, sha->md_len, sha);
+  return bcm_infallible::approved;
 }
 
-static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
+static void sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
   uint8_t *p = sha->p;
   size_t n = sha->num;
 
@@ -262,12 +200,6 @@ static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
 
   sha512_block_data_order(sha->h, p, 1);
 
-  if (out == NULL) {
-    // TODO(davidben): This NULL check is absent in other low-level hash 'final'
-    // functions and is one of the few places one can fail.
-    return 0;
-  }
-
   assert(md_len % 8 == 0);
   const size_t out_words = md_len / 8;
   for (size_t i = 0; i < out_words; i++) {
@@ -276,7 +208,6 @@ static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
   }
 
   FIPS_service_indicator_update_state();
-  return 1;
 }
 
 #if !defined(SHA512_ASM)
@@ -423,7 +354,6 @@ static void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *in,
   int i;
 
   while (num--) {
-
     a = state[0];
     b = state[1];
     c = state[2];

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/address.h

@@ -0,0 +1,119 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_ADDRESS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_ADDRESS_H
+
+#include <openssl/mem.h>
+
+#include "../../internal.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Offsets of various fields in the address structure for SLH-DSA-SHA2-128s.
+
+// The byte used to specify the Merkle tree layer.
+#define SLHDSA_SHA2_128S_OFFSET_LAYER 0
+
+// The start of the 8 byte field used to specify the tree.
+#define SLHDSA_SHA2_128S_OFFSET_TREE 1
+
+// The byte used to specify the hash type (reason).
+#define SLHDSA_SHA2_128S_OFFSET_TYPE 9
+
+// The high byte used to specify the key pair (which one-time signature).
+#define SLHDSA_SHA2_128S_OFFSET_KP_ADDR2 12
+
+// The low byte used to specific the key pair.
+#define SLHDSA_SHA2_128S_OFFSET_KP_ADDR1 13
+
+// The byte used to specify the chain address (which Winternitz chain).
+#define SLHDSA_SHA2_128S_OFFSET_CHAIN_ADDR 17
+
+// The byte used to specify the hash address (where in the Winternitz chain).
+#define SLHDSA_SHA2_128S_OFFSET_HASH_ADDR 21
+
+// The byte used to specify the height of this node in the FORS or Merkle tree.
+#define SLHDSA_SHA2_128S_OFFSET_TREE_HGT 17
+
+// The start of the 4 byte field used to specify the node in the FORS or Merkle
+// tree.
+#define SLHDSA_SHA2_128S_OFFSET_TREE_INDEX 18
+
+
+inline void slhdsa_set_chain_addr(uint8_t addr[32], uint32_t chain) {
+  addr[SLHDSA_SHA2_128S_OFFSET_CHAIN_ADDR] = (uint8_t)chain;
+}
+
+inline void slhdsa_set_hash_addr(uint8_t addr[32], uint32_t hash) {
+  addr[SLHDSA_SHA2_128S_OFFSET_HASH_ADDR] = (uint8_t)hash;
+}
+
+inline void slhdsa_set_keypair_addr(uint8_t addr[32], uint32_t keypair) {
+  addr[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2] = (uint8_t)(keypair >> 8);
+  addr[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1] = (uint8_t)keypair;
+}
+
+inline void slhdsa_copy_keypair_addr(uint8_t out[32], const uint8_t in[32]) {
+  OPENSSL_memcpy(out, in, SLHDSA_SHA2_128S_OFFSET_TREE + 8);
+  out[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2] = in[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2];
+  out[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1] = in[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1];
+}
+
+inline void slhdsa_set_layer_addr(uint8_t addr[32], uint32_t layer) {
+  addr[SLHDSA_SHA2_128S_OFFSET_LAYER] = (uint8_t)layer;
+}
+
+inline void slhdsa_set_tree_addr(uint8_t addr[32], uint64_t tree) {
+  CRYPTO_store_u64_be(&addr[SLHDSA_SHA2_128S_OFFSET_TREE], tree);
+}
+
+#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTS 0
+#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTSPK 1
+#define SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE 2
+#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE 3
+#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSPK 4
+#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTSPRF 5
+#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSPRF 6
+
+inline void slhdsa_set_type(uint8_t addr[32], uint32_t type) {
+  // FIPS 205 relies on this setting parts of the address to 0, so we do it
+  // here to avoid confusion.
+  //
+  // The behavior here is only correct for the SHA-2 instantiations.
+  OPENSSL_memset(addr + 10, 0, 12);
+  addr[SLHDSA_SHA2_128S_OFFSET_TYPE] = (uint8_t)type;
+}
+
+inline void slhdsa_set_tree_height(uint8_t addr[32], uint32_t tree_height) {
+  addr[SLHDSA_SHA2_128S_OFFSET_TREE_HGT] = (uint8_t)tree_height;
+}
+
+inline void slhdsa_set_tree_index(uint8_t addr[32], uint32_t tree_index) {
+  CRYPTO_store_u32_be(&addr[SLHDSA_SHA2_128S_OFFSET_TREE_INDEX], tree_index);
+}
+
+inline uint32_t slhdsa_get_tree_index(uint8_t addr[32]) {
+  return CRYPTO_load_u32_be(addr + SLHDSA_SHA2_128S_OFFSET_TREE_INDEX);
+}
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_ADDRESS_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/fors.cc.inc

@@ -0,0 +1,169 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include "../../internal.h"
+#include "./address.h"
+#include "./fors.h"
+#include "./params.h"
+#include "./thash.h"
+
+// Compute the base 2^12 representation of `message` (algorithm 4, page 16).
+static void fors_base_b(
+    uint16_t indices[SLHDSA_SHA2_128S_FORS_TREES],
+    const uint8_t message[SLHDSA_SHA2_128S_FORS_MSG_BYTES]) {
+  static_assert(SLHDSA_SHA2_128S_FORS_HEIGHT == 12, "");
+  static_assert((SLHDSA_SHA2_128S_FORS_TREES & 1) == 0, "");
+
+  const uint8_t *msg = message;
+  for (size_t i = 0; i < SLHDSA_SHA2_128S_FORS_TREES; i += 2) {
+    uint32_t val = ((uint32_t)msg[0] << 16) | ((uint32_t)msg[1] << 8) | msg[2];
+    indices[i] = (val >> 12) & 0xFFF;
+    indices[i + 1] = val & 0xFFF;
+    msg += 3;
+  }
+}
+
+// Implements Algorithm 14: fors_skGen function (page 29)
+void slhdsa_fors_sk_gen(uint8_t fors_sk[BCM_SLHDSA_SHA2_128S_N], uint32_t idx,
+                        const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                        const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                        uint8_t addr[32]) {
+  uint8_t sk_addr[32];
+  OPENSSL_memcpy(sk_addr, addr, sizeof(sk_addr));
+
+  slhdsa_set_type(sk_addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSPRF);
+  slhdsa_copy_keypair_addr(sk_addr, addr);
+  slhdsa_set_tree_index(sk_addr, idx);
+  slhdsa_thash_prf(fors_sk, pk_seed, sk_seed, sk_addr);
+}
+
+// Implements Algorithm 15: fors_node function (page 30)
+void slhdsa_fors_treehash(uint8_t root_node[BCM_SLHDSA_SHA2_128S_N],
+                          const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                          uint32_t i /*target node index*/,
+                          uint32_t z /*target node height*/,
+                          const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                          uint8_t addr[32]) {
+  BSSL_CHECK(z <= SLHDSA_SHA2_128S_FORS_HEIGHT);
+  BSSL_CHECK(i < (uint32_t)(SLHDSA_SHA2_128S_FORS_TREES *
+                            (1 << (SLHDSA_SHA2_128S_FORS_HEIGHT - z))));
+
+  if (z == 0) {
+    uint8_t sk[BCM_SLHDSA_SHA2_128S_N];
+    slhdsa_set_tree_height(addr, 0);
+    slhdsa_set_tree_index(addr, i);
+    slhdsa_fors_sk_gen(sk, i, sk_seed, pk_seed, addr);
+    slhdsa_thash_f(root_node, sk, pk_seed, addr);
+  } else {
+    // Stores left node and right node.
+    uint8_t nodes[2 * BCM_SLHDSA_SHA2_128S_N];
+    slhdsa_fors_treehash(nodes, sk_seed, 2 * i, z - 1, pk_seed, addr);
+    slhdsa_fors_treehash(nodes + BCM_SLHDSA_SHA2_128S_N, sk_seed, 2 * i + 1, z - 1,
+                         pk_seed, addr);
+    slhdsa_set_tree_height(addr, z);
+    slhdsa_set_tree_index(addr, i);
+    slhdsa_thash_h(root_node, nodes, pk_seed, addr);
+  }
+}
+
+// Implements Algorithm 16: fors_sign function (page 31)
+void slhdsa_fors_sign(uint8_t fors_sig[SLHDSA_SHA2_128S_FORS_BYTES],
+                      const uint8_t message[SLHDSA_SHA2_128S_FORS_MSG_BYTES],
+                      const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      uint8_t addr[32]) {
+  uint16_t indices[SLHDSA_SHA2_128S_FORS_TREES];
+
+  // Derive FORS indices compatible with the NIST changes.
+  fors_base_b(indices, message);
+
+  for (size_t i = 0; i < SLHDSA_SHA2_128S_FORS_TREES; ++i) {
+    slhdsa_set_tree_height(addr, 0);
+    // Write the FORS secret key element to the correct position.
+    slhdsa_fors_sk_gen(
+        fors_sig + i * BCM_SLHDSA_SHA2_128S_N * (SLHDSA_SHA2_128S_FORS_HEIGHT + 1),
+        i * (1 << SLHDSA_SHA2_128S_FORS_HEIGHT) + indices[i], sk_seed, pk_seed,
+        addr);
+    for (size_t j = 0; j < SLHDSA_SHA2_128S_FORS_HEIGHT; ++j) {
+      size_t s = (indices[i] / (1 << j)) ^ 1;
+      // Write the FORS auth path element to the correct position.
+      slhdsa_fors_treehash(
+          fors_sig + BCM_SLHDSA_SHA2_128S_N *
+                         (i * (SLHDSA_SHA2_128S_FORS_HEIGHT + 1) + j + 1),
+          sk_seed, i * (1ULL << (SLHDSA_SHA2_128S_FORS_HEIGHT - j)) + s, j,
+          pk_seed, addr);
+    }
+  }
+}
+
+// Implements Algorithm 17: fors_pkFromSig function (page 32)
+void slhdsa_fors_pk_from_sig(
+    uint8_t fors_pk[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t fors_sig[SLHDSA_SHA2_128S_FORS_BYTES],
+    const uint8_t message[SLHDSA_SHA2_128S_FORS_MSG_BYTES],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]) {
+  uint16_t indices[SLHDSA_SHA2_128S_FORS_TREES];
+  uint8_t tmp[2 * BCM_SLHDSA_SHA2_128S_N];
+  uint8_t roots[SLHDSA_SHA2_128S_FORS_TREES * BCM_SLHDSA_SHA2_128S_N];
+
+  // Derive FORS indices compatible with the NIST changes.
+  fors_base_b(indices, message);
+
+  for (size_t i = 0; i < SLHDSA_SHA2_128S_FORS_TREES; ++i) {
+    // Pointer to current sk and authentication path
+    const uint8_t *sk =
+        fors_sig + i * BCM_SLHDSA_SHA2_128S_N * (SLHDSA_SHA2_128S_FORS_HEIGHT + 1);
+    const uint8_t *auth =
+        fors_sig + i * BCM_SLHDSA_SHA2_128S_N * (SLHDSA_SHA2_128S_FORS_HEIGHT + 1) +
+        BCM_SLHDSA_SHA2_128S_N;
+    uint8_t nodes[2 * BCM_SLHDSA_SHA2_128S_N];
+
+    slhdsa_set_tree_height(addr, 0);
+    slhdsa_set_tree_index(
+        addr, (i * (1 << SLHDSA_SHA2_128S_FORS_HEIGHT)) + indices[i]);
+
+    slhdsa_thash_f(nodes, sk, pk_seed, addr);
+
+    for (size_t j = 0; j < SLHDSA_SHA2_128S_FORS_HEIGHT; ++j) {
+      slhdsa_set_tree_height(addr, j + 1);
+
+      // Even node
+      if (((indices[i] / (1 << j)) % 2) == 0) {
+        slhdsa_set_tree_index(addr, slhdsa_get_tree_index(addr) / 2);
+        OPENSSL_memcpy(tmp, nodes, BCM_SLHDSA_SHA2_128S_N);
+        OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, auth + j * BCM_SLHDSA_SHA2_128S_N,
+                       BCM_SLHDSA_SHA2_128S_N);
+        slhdsa_thash_h(nodes + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
+      } else {
+        slhdsa_set_tree_index(addr, (slhdsa_get_tree_index(addr) - 1) / 2);
+        OPENSSL_memcpy(tmp, auth + j * BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N);
+        OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, nodes, BCM_SLHDSA_SHA2_128S_N);
+        slhdsa_thash_h(nodes + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
+      }
+      OPENSSL_memcpy(nodes, nodes + BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N);
+    }
+    OPENSSL_memcpy(roots + i * BCM_SLHDSA_SHA2_128S_N, nodes, BCM_SLHDSA_SHA2_128S_N);
+  }
+
+  uint8_t forspk_addr[32];
+  OPENSSL_memcpy(forspk_addr, addr, sizeof(forspk_addr));
+  slhdsa_set_type(forspk_addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSPK);
+  slhdsa_copy_keypair_addr(forspk_addr, addr);
+  slhdsa_thash_tk(fors_pk, roots, pk_seed, forspk_addr);
+}

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/fors.h

@@ -0,0 +1,58 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H
+
+#include "./params.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Implements Algorithm 14: fors_skGen function (page 29)
+void slhdsa_fors_sk_gen(uint8_t fors_sk[BCM_SLHDSA_SHA2_128S_N], uint32_t idx,
+                        const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                        const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                        uint8_t addr[32]);
+
+// Implements Algorithm 15: fors_node function (page 30)
+void slhdsa_fors_treehash(uint8_t root_node[BCM_SLHDSA_SHA2_128S_N],
+                          const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                          uint32_t i /*target node index*/,
+                          uint32_t z /*target node height*/,
+                          const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                          uint8_t addr[32]);
+
+// Implements Algorithm 16: fors_sign function (page 31)
+void slhdsa_fors_sign(uint8_t fors_sig[SLHDSA_SHA2_128S_FORS_BYTES],
+                      const uint8_t message[SLHDSA_SHA2_128S_FORS_MSG_BYTES],
+                      const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      uint8_t addr[32]);
+
+// Implements Algorithm 17: fors_pkFromSig function (page 32)
+void slhdsa_fors_pk_from_sig(
+    uint8_t fors_pk[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t fors_sig[SLHDSA_SHA2_128S_FORS_BYTES],
+    const uint8_t message[SLHDSA_SHA2_128S_FORS_MSG_BYTES],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H