grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/hrss/{hrss.c → hrss.cc}

@@ -1,22 +1,23 @@
-/* Copyright (c) 2018, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/hrss.h>
 
 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <type_traits>
 
 #include <openssl/bn.h>
 #include <openssl/hmac.h>
@@ -24,12 +25,6 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-#if defined(_MSC_VER)
-#define RESTRICT
-#else
-#define RESTRICT restrict
-#endif
-
 #include "../internal.h"
 #include "internal.h"
 
@@ -226,9 +221,7 @@ static inline vec_t vec_merge_3_5(vec_t left, vec_t right) {
   return vextq_u16(left, right, 5);
 }
 
-static inline uint16_t vec_get_word(vec_t v, unsigned i) {
-  return v[i];
-}
+static inline uint16_t vec_get_word(vec_t v, unsigned i) { return v[i]; }
 
 #if !defined(OPENSSL_AARCH64)
 
@@ -298,14 +291,6 @@ static inline void poly3_vec_rshift1(vec_t a_s[6], vec_t a_a[6]) {
 //  crypto_word_t v[WORDS_PER_POLY];
 // };
 
-OPENSSL_UNUSED static void hexdump(const void *void_in, size_t len) {
-  const uint8_t *in = (const uint8_t *)void_in;
-  for (size_t i = 0; i < len; i++) {
-    printf("%02x", in[i]);
-  }
-  printf("\n");
-}
-
 static void poly2_zero(struct poly2 *p) {
   OPENSSL_memset(&p->v[0], 0, sizeof(crypto_word_t) * WORDS_PER_POLY);
 }
@@ -314,20 +299,13 @@ static void poly2_zero(struct poly2 *p) {
 static crypto_word_t word_reverse(crypto_word_t in) {
 #if defined(OPENSSL_64_BIT)
   static const crypto_word_t kMasks[6] = {
-    UINT64_C(0x5555555555555555),
-    UINT64_C(0x3333333333333333),
-    UINT64_C(0x0f0f0f0f0f0f0f0f),
-    UINT64_C(0x00ff00ff00ff00ff),
-    UINT64_C(0x0000ffff0000ffff),
-    UINT64_C(0x00000000ffffffff),
+      UINT64_C(0x5555555555555555), UINT64_C(0x3333333333333333),
+      UINT64_C(0x0f0f0f0f0f0f0f0f), UINT64_C(0x00ff00ff00ff00ff),
+      UINT64_C(0x0000ffff0000ffff), UINT64_C(0x00000000ffffffff),
   };
 #else
   static const crypto_word_t kMasks[5] = {
-    0x55555555,
-    0x33333333,
-    0x0f0f0f0f,
-    0x00ff00ff,
-    0x0000ffff,
+      0x55555555, 0x33333333, 0x0f0f0f0f, 0x00ff00ff, 0x0000ffff,
   };
 #endif
 
@@ -362,12 +340,12 @@ static void poly2_reverse_700(struct poly2 *out, const struct poly2 *in) {
     t.v[i] = word_reverse(in->v[i]);
   }
 
-  static const size_t shift = BITS_PER_WORD - ((N-1) % BITS_PER_WORD);
-  for (size_t i = 0; i < WORDS_PER_POLY-1; i++) {
-    out->v[i] = t.v[WORDS_PER_POLY-1-i] >> shift;
-    out->v[i] |= t.v[WORDS_PER_POLY-2-i] << (BITS_PER_WORD - shift);
+  static const size_t shift = BITS_PER_WORD - ((N - 1) % BITS_PER_WORD);
+  for (size_t i = 0; i < WORDS_PER_POLY - 1; i++) {
+    out->v[i] = t.v[WORDS_PER_POLY - 1 - i] >> shift;
+    out->v[i] |= t.v[WORDS_PER_POLY - 2 - i] << (BITS_PER_WORD - shift);
   }
-  out->v[WORDS_PER_POLY-1] = t.v[0] >> shift;
+  out->v[WORDS_PER_POLY - 1] = t.v[0] >> shift;
 }
 
 // poly2_cswap exchanges the values of |a| and |b| if |swap| is all ones.
@@ -416,13 +394,6 @@ static void poly2_clear_top_bits(struct poly2 *p) {
   p->v[WORDS_PER_POLY - 1] &= (UINT64_C(1) << BITS_IN_LAST_WORD) - 1;
 }
 
-// poly2_top_bits_are_clear returns one iff the extra bits in the final words of
-// |p| are zero.
-static int poly2_top_bits_are_clear(const struct poly2 *p) {
-  return (p->v[WORDS_PER_POLY - 1] &
-          ~((UINT64_C(1) << BITS_IN_LAST_WORD) - 1)) == 0;
-}
-
 // Ternary polynomials.
 
 // poly3 represents a degree-N polynomial over GF(3). Each coefficient is
@@ -460,29 +431,6 @@ static int poly2_top_bits_are_clear(const struct poly2 *p) {
 //   struct poly2 s, a;
 // };
 
-OPENSSL_UNUSED static void poly3_print(const struct poly3 *in) {
-  struct poly3 p;
-  OPENSSL_memcpy(&p, in, sizeof(p));
-  p.s.v[WORDS_PER_POLY - 1] &= ((crypto_word_t)1 << BITS_IN_LAST_WORD) - 1;
-  p.a.v[WORDS_PER_POLY - 1] &= ((crypto_word_t)1 << BITS_IN_LAST_WORD) - 1;
-
-  printf("{[");
-  for (unsigned i = 0; i < WORDS_PER_POLY; i++) {
-    if (i) {
-      printf(" ");
-    }
-    printf(BN_HEX_FMT2, p.s.v[i]);
-  }
-  printf("] [");
-  for (unsigned i = 0; i < WORDS_PER_POLY; i++) {
-    if (i) {
-      printf(" ");
-    }
-    printf(BN_HEX_FMT2, p.a.v[i]);
-  }
-  printf("]}\n");
-}
-
 static void poly3_zero(struct poly3 *p) {
   poly2_zero(&p->s);
   poly2_zero(&p->a);
@@ -533,9 +481,8 @@ static void poly3_mul_const(struct poly3 *p, crypto_word_t ms,
 }
 
 // poly3_fmadd sets |out| to |out| - |in|×m, where m is (ms, ma).
-static void poly3_fmsub(struct poly3 *RESTRICT out,
-                        const struct poly3 *RESTRICT in, crypto_word_t ms,
-                        crypto_word_t ma) {
+static void poly3_fmsub(struct poly3 *out, const struct poly3 *in,
+                        crypto_word_t ms, crypto_word_t ma) {
   crypto_word_t product_s, product_a;
   for (size_t i = 0; i < WORDS_PER_POLY; i++) {
     poly3_word_mul(&product_s, &product_a, in->s.v[i], in->a.v[i], ms, ma);
@@ -550,12 +497,6 @@ static crypto_word_t final_bit_to_all(crypto_word_t v) {
   return lsb_to_all(v >> (BITS_IN_LAST_WORD - 1));
 }
 
-// poly3_top_bits_are_clear returns one iff the extra bits in the final words of
-// |p| are zero.
-OPENSSL_UNUSED static int poly3_top_bits_are_clear(const struct poly3 *p) {
-  return poly2_top_bits_are_clear(&p->s) && poly2_top_bits_are_clear(&p->a);
-}
-
 // poly3_mod_phiN reduces |p| by Φ(N).
 static void poly3_mod_phiN(struct poly3 *p) {
   // In order to reduce by Φ(N) we subtract by the value of the greatest
@@ -802,15 +743,16 @@ static void poly3_invert_vec(struct poly3 *out, const struct poly3 *in) {
 
   int delta = 1;
 
-  for (size_t i = 0; i < (2*(N-1)) - 1; i++) {
+  for (size_t i = 0; i < (2 * (N - 1)) - 1; i++) {
     poly3_vec_lshift1(v_s, v_a);
 
     const crypto_word_t delta_sign_bit = (delta >> (sizeof(delta) * 8 - 1)) & 1;
     const crypto_word_t delta_is_non_negative = delta_sign_bit - 1;
     const crypto_word_t delta_is_non_zero = ~constant_time_is_zero_w(delta);
     const vec_t g_has_constant_term = vec_broadcast_bit(g_a[0]);
-    const vec_t mask_w =
-        {delta_is_non_negative & delta_is_non_zero};
+    const vec_t mask_w = {
+        static_cast<std::remove_reference<decltype(mask_w[0])>::type>(
+            delta_is_non_negative & delta_is_non_zero)};
     const vec_t mask = vec_broadcast_bit(mask_w) & g_has_constant_term;
 
     const vec_t c_a = vec_broadcast_bit(f_a[0] & g_a[0]);
@@ -863,7 +805,7 @@ void HRSS_poly3_invert(struct poly3 *out, const struct poly3 *in) {
   poly3_reverse_700(&g, in);
   int delta = 1;
 
-  for (size_t i = 0; i < (2*(N-1)) - 1; i++) {
+  for (size_t i = 0; i < (2 * (N - 1)) - 1; i++) {
     poly3_lshift1(&v);
 
     const crypto_word_t delta_sign_bit = (delta >> (sizeof(delta) * 8 - 1)) & 1;
@@ -905,6 +847,7 @@ void HRSS_poly3_invert(struct poly3 *out, const struct poly3 *in) {
 #define COEFFICIENTS_PER_VEC (sizeof(vec_t) / sizeof(uint16_t))
 #define VECS_PER_POLY ((N + COEFFICIENTS_PER_VEC - 1) / COEFFICIENTS_PER_VEC)
 
+namespace {
 // poly represents a polynomial with coefficients mod Q. Note that, while Q is a
 // power of two, this does not operate in GF(Q). That would be a binary field
 // but this is simply mod Q. Thus the coefficients are not a field.
@@ -925,6 +868,7 @@ struct poly {
   alignas(16) uint16_t v[N + 3];
 #endif
 };
+}  // namespace
 
 // poly_normalize zeros out the excess elements of |x| which are included only
 // for alignment.
@@ -940,17 +884,7 @@ static void poly_assert_normalized(const struct poly *x) {
   assert(x->v[N + 2] == 0);
 }
 
-OPENSSL_UNUSED static void poly_print(const struct poly *p) {
-  printf("[");
-  for (unsigned i = 0; i < N; i++) {
-    if (i) {
-      printf(" ");
-    }
-    printf("%d", p->v[i]);
-  }
-  printf("]\n");
-}
-
+namespace {
 // POLY_MUL_SCRATCH contains space for the working variables needed by
 // |poly_mul|. The contents afterwards may be discarded, but the object may also
 // be reused with future |poly_mul| calls to save heap allocations.
@@ -978,6 +912,7 @@ struct POLY_MUL_SCRATCH {
 #endif
   } u;
 };
+}  // namespace
 
 #if defined(HRSS_HAVE_VECTOR_UNIT)
 
@@ -986,9 +921,8 @@ struct POLY_MUL_SCRATCH {
 // of |scratch| and the function recurses, except if |n| < 3, when |scratch|
 // isn't used and the recursion stops. If |n| == |VECS_PER_POLY| then |scratch|
 // needs 172 elements.
-static void poly_mul_vec_aux(vec_t *restrict out, vec_t *restrict scratch,
-                             const vec_t *restrict a, const vec_t *restrict b,
-                             const size_t n) {
+static void poly_mul_vec_aux(vec_t *out, vec_t *scratch, const vec_t *a,
+                             const vec_t *b, const size_t n) {
   // In [HRSS], the technique they used for polynomial multiplication is
   // described: they start with Toom-4 at the top level and then two layers of
   // Karatsuba. Karatsuba is a specific instance of the general Toom–Cook
@@ -1245,8 +1179,8 @@ static void poly_mul_vec(struct POLY_MUL_SCRATCH *scratch, struct poly *out,
 
   for (size_t i = 0; i < VECS_PER_POLY; i++) {
     const vec_t prev = prod[VECS_PER_POLY - 1 + i];
-    const vec_t this = prod[VECS_PER_POLY + i];
-    out_vecs[i] = vec_add(prod[i], vec_merge_3_5(prev, this));
+    const vec_t this_vec = prod[VECS_PER_POLY + i];
+    out_vecs[i] = vec_add(prod[i], vec_merge_3_5(prev, this_vec));
   }
 
   OPENSSL_memset(&out->v[N], 0, 3 * sizeof(uint16_t));
@@ -1266,7 +1200,7 @@ static void poly_mul_novec_aux(uint16_t *out, uint16_t *scratch,
     OPENSSL_memset(out, 0, sizeof(uint16_t) * n * 2);
     for (size_t i = 0; i < n; i++) {
       for (size_t j = 0; j < n; j++) {
-        out[i + j] += (unsigned) a[i] * b[j];
+        out[i + j] += (unsigned)a[i] * b[j];
       }
     }
 
@@ -1334,7 +1268,7 @@ static void poly_mul(struct POLY_MUL_SCRATCH *scratch, struct poly *r,
 #endif
 
 #if defined(HRSS_HAVE_VECTOR_UNIT)
-  if (vec_capable()) {
+      if (vec_capable()) {
     poly_mul_vec(scratch, r, a, b);
   } else
 #endif
@@ -1563,7 +1497,7 @@ static void poly_invert_mod2(struct poly *out, const struct poly *in) {
   poly2_reverse_700(&g, &g);
   int delta = 1;
 
-  for (size_t i = 0; i < (2*(N-1)) - 1; i++) {
+  for (size_t i = 0; i < (2 * (N - 1)) - 1; i++) {
     poly2_lshift1(&v);
 
     const crypto_word_t delta_sign_bit = (delta >> (sizeof(delta) * 8 - 1)) & 1;
@@ -1728,7 +1662,7 @@ static void poly_marshal_mod3(uint8_t out[HRSS_POLY3_BYTES],
   const uint16_t *coeffs = in->v;
 
   // Only 700 coefficients are marshaled because in[700] must be zero.
-  assert(coeffs[N-1] == 0);
+  assert(coeffs[N - 1] == 0);
 
   for (size_t i = 0; i < HRSS_POLY3_BYTES; i++) {
     const uint16_t coeffs0 = mod3_from_modQ(coeffs[0]);
@@ -1772,15 +1706,15 @@ static void poly_short_sample_plus(struct poly *out,
   // because |sum| is bound by +/- (N-2), and N < 2^15 so it works out.
   uint16_t sum = 0;
   for (unsigned i = 0; i < N - 2; i++) {
-    sum += (unsigned) out->v[i] * out->v[i + 1];
+    sum += (unsigned)out->v[i] * out->v[i + 1];
   }
 
   // If the sum is negative, flip the sign of even-positioned coefficients. (See
   // page 8 of [HRSS].)
-  sum = ((int16_t) sum) >> 15;
+  sum = ((int16_t)sum) >> 15;
   const uint16_t scale = sum | (~sum & 1);
   for (unsigned i = 0; i < N; i += 2) {
-    out->v[i] = (unsigned) out->v[i] * scale;
+    out->v[i] = (unsigned)out->v[i] * scale;
   }
   poly_assert_normalized(out);
 }
@@ -1877,7 +1811,7 @@ static void poly_lift(struct poly *out, const struct poly *a) {
 
   // Note that s0 + s1 + s2 = 0.
   out->v[0] += s0;
-  out->v[1] -= (s0 + s2); // = s1
+  out->v[1] -= (s0 + s2);  // = s1
   out->v[2] += s2;
 
   // Calculate the remaining inner products by taking advantage of the
@@ -1901,6 +1835,8 @@ static void poly_lift(struct poly *out, const struct poly *a) {
   poly_normalize(out);
 }
 
+namespace {
+
 struct public_key {
   struct poly ph;
 };
@@ -1911,6 +1847,8 @@ struct private_key {
   uint8_t hmac_key[32];
 };
 
+}  // namespace
+
 // public_key_from_external converts an external public key pointer into an
 // internal one. Externally the alignment is only specified to be eight bytes
 // but we need 16-byte alignment. We could annotate the external struct with
@@ -1924,7 +1862,7 @@ static struct public_key *public_key_from_external(
       sizeof(struct HRSS_public_key) >= sizeof(struct public_key) + 15,
       "HRSS public key too small");
 
-  return align_pointer(ext->opaque, 16);
+  return reinterpret_cast<public_key *>(align_pointer(ext->opaque, 16));
 }
 
 // private_key_from_external does the same thing as |public_key_from_external|,
@@ -1936,7 +1874,7 @@ static struct private_key *private_key_from_external(
       sizeof(struct HRSS_private_key) >= sizeof(struct private_key) + 15,
       "HRSS private key too small");
 
-  return align_pointer(ext->opaque, 16);
+  return reinterpret_cast<private_key *>(align_pointer(ext->opaque, 16));
 }
 
 // malloc_align32 returns a pointer to |size| bytes of 32-byte-aligned heap and
@@ -1968,13 +1906,14 @@ int HRSS_generate_key(
   };
 
   void *malloc_ptr;
-  struct vars *const vars = malloc_align32(&malloc_ptr, sizeof(struct vars));
+  struct vars *const vars = reinterpret_cast<struct vars *>(
+      malloc_align32(&malloc_ptr, sizeof(struct vars)));
   if (!vars) {
     // If the caller ignores the return value the output will still be safe.
     // The private key output is randomised in case it's later passed to
     // |HRSS_encap|.
     memset(out_pub, 0, sizeof(struct HRSS_public_key));
-    RAND_bytes((uint8_t*) out_priv, sizeof(struct HRSS_private_key));
+    RAND_bytes((uint8_t *)out_priv, sizeof(struct HRSS_private_key));
     return 0;
   }
 
@@ -2031,7 +1970,8 @@ int HRSS_encap(uint8_t out_ciphertext[POLY_BYTES], uint8_t out_shared_key[32],
   };
 
   void *malloc_ptr;
-  struct vars *const vars = malloc_align32(&malloc_ptr, sizeof(struct vars));
+  struct vars *const vars = reinterpret_cast<struct vars *>(
+      malloc_align32(&malloc_ptr, sizeof(struct vars)));
   if (!vars) {
     // If the caller ignores the return value the output will still be safe.
     // The private key output is randomised in case it's used to encrypt and
@@ -2071,11 +2011,17 @@ int HRSS_encap(uint8_t out_ciphertext[POLY_BYTES], uint8_t out_shared_key[32],
 }
 
 int HRSS_decap(uint8_t out_shared_key[HRSS_KEY_BYTES],
-                const struct HRSS_private_key *in_priv,
-                const uint8_t *ciphertext, size_t ciphertext_len) {
+               const struct HRSS_private_key *in_priv,
+               const uint8_t *ciphertext, size_t ciphertext_len) {
   const struct private_key *priv =
       private_key_from_external((struct HRSS_private_key *)in_priv);
 
+#if defined(_MSC_VER)
+  // MSVC will produce this useless warning:
+  // warning C4324: structure was padded due to alignment specifier
+#pragma warning(push)
+#pragma warning(disable : 4324)
+#endif
   struct vars {
     struct POLY_MUL_SCRATCH scratch;
     uint8_t masked_key[SHA256_CBLOCK];
@@ -2091,9 +2037,13 @@ int HRSS_decap(uint8_t out_shared_key[HRSS_KEY_BYTES],
     uint8_t r_bytes[HRSS_POLY3_BYTES];
     uint8_t shared_key[32];
   };
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
 
   void *malloc_ptr;
-  struct vars *const vars = malloc_align32(&malloc_ptr, sizeof(struct vars));
+  struct vars *const vars = reinterpret_cast<struct vars *>(
+      malloc_align32(&malloc_ptr, sizeof(struct vars)));
   if (!vars) {
     // If the caller ignores the return value the output will still be safe.
     // The private key output is randomised in case it's used to encrypt and
@@ -2139,6 +2089,7 @@ int HRSS_decap(uint8_t out_shared_key[HRSS_KEY_BYTES],
   // If the ciphertext is publicly invalid then a random shared key is still
   // returned to simply the logic of the caller, but this path is not constant
   // time.
+  crypto_word_t ok = 0;
   if (ciphertext_len != HRSS_CIPHERTEXT_BYTES ||
       !poly_unmarshal(&vars->c, ciphertext)) {
     goto out;
@@ -2161,7 +2112,7 @@ int HRSS_decap(uint8_t out_shared_key[HRSS_KEY_BYTES],
   poly_mod_phiN(&vars->r);
   poly_clamp(&vars->r);
 
-  crypto_word_t ok = poly3_from_poly_checked(&vars->r3, &vars->r);
+  ok = poly3_from_poly_checked(&vars->r3, &vars->r);
 
   // [NTRUCOMP] section 5.1 includes ReEnc2 and a proof that it's valid. Rather
   // than do an expensive |poly_mul|, it rebuilds |c'| from |c - lift(m)|

data/third_party/boringssl-with-bazel/src/crypto/hrss/internal.h

@@ -1,16 +1,16 @@
-/* Copyright (c) 2018, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #ifndef OPENSSL_HEADER_HRSS_INTERNAL_H
 #define OPENSSL_HEADER_HRSS_INTERNAL_H