grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/trust_token/{voprf.c → voprf.cc}

@@ -1,16 +1,16 @@
-/* Copyright (c) 2020, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2020 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/trust_token.h>
 
@@ -23,7 +23,7 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-#include "../ec_extra/internal.h"
+#include "../ec/internal.h"
 #include "../fipsmodule/ec/internal.h"
 
 #include "internal.h"
@@ -209,8 +209,8 @@ static STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_blind(const VOPRF_METHOD *method,
 
   for (size_t i = 0; i < count; i++) {
     // Insert |pretoken| into |pretokens| early to simplify error-handling.
-    TRUST_TOKEN_PRETOKEN *pretoken =
-        OPENSSL_malloc(sizeof(TRUST_TOKEN_PRETOKEN));
+    TRUST_TOKEN_PRETOKEN *pretoken = reinterpret_cast<TRUST_TOKEN_PRETOKEN *>(
+        OPENSSL_malloc(sizeof(TRUST_TOKEN_PRETOKEN)));
     if (pretoken == NULL ||
         !sk_TRUST_TOKEN_PRETOKEN_push(pretokens, pretoken)) {
       TRUST_TOKEN_PRETOKEN_free(pretoken);
@@ -230,8 +230,7 @@ static STACK_OF(TRUST_TOKEN_PRETOKEN) *voprf_blind(const VOPRF_METHOD *method,
 
     // We sample r in Montgomery form to simplify inverting.
     EC_SCALAR r;
-    if (!ec_random_nonzero_scalar(group, &r,
-                                  kDefaultAdditionalData)) {
+    if (!ec_random_nonzero_scalar(group, &r, kDefaultAdditionalData)) {
       goto err;
     }
 
@@ -275,12 +274,9 @@ static int hash_to_scalar_dleq(const VOPRF_METHOD *method, EC_SCALAR *out,
   size_t len;
   if (!CBB_init(&cbb, 0) ||
       !CBB_add_bytes(&cbb, kDLEQLabel, sizeof(kDLEQLabel)) ||
-      !cbb_add_point(&cbb, group, X) ||
-      !cbb_add_point(&cbb, group, T) ||
-      !cbb_add_point(&cbb, group, W) ||
-      !cbb_add_point(&cbb, group, K0) ||
-      !cbb_add_point(&cbb, group, K1) ||
-      !CBB_finish(&cbb, &buf, &len) ||
+      !cbb_add_point(&cbb, group, X) || !cbb_add_point(&cbb, group, T) ||
+      !cbb_add_point(&cbb, group, W) || !cbb_add_point(&cbb, group, K0) ||
+      !cbb_add_point(&cbb, group, K1) || !CBB_finish(&cbb, &buf, &len) ||
       !method->hash_to_scalar(group, out, buf, len)) {
     goto err;
   }
@@ -335,8 +331,7 @@ static int hash_to_scalar_batch(const VOPRF_METHOD *method, EC_SCALAR *out,
   if (!CBB_init(&cbb, 0) ||
       !CBB_add_bytes(&cbb, kDLEQBatchLabel, sizeof(kDLEQBatchLabel)) ||
       !CBB_add_bytes(&cbb, CBB_data(points), CBB_len(points)) ||
-      !CBB_add_u16(&cbb, (uint16_t)index) ||
-      !CBB_finish(&cbb, &buf, &len) ||
+      !CBB_add_u16(&cbb, (uint16_t)index) || !CBB_finish(&cbb, &buf, &len) ||
       !method->hash_to_scalar(method->group_func(), out, buf, len)) {
     goto err;
   }
@@ -365,11 +360,11 @@ static int dleq_generate(const VOPRF_METHOD *method, CBB *cbb,
 
   // Setup the DLEQ proof.
   EC_SCALAR r;
-  if (// r <- Zp
+  if (  // r <- Zp
       !ec_random_nonzero_scalar(group, &r, kDefaultAdditionalData) ||
       // k0;k1 = r*(G;T)
       !ec_point_mul_scalar_base(group, &jacobians[idx_k0], &r) ||
-      !ec_point_mul_scalar(group, &jacobians[idx_k1], T, &r))  {
+      !ec_point_mul_scalar(group, &jacobians[idx_k1], T, &r)) {
     return 0;
   }
 
@@ -398,8 +393,7 @@ static int dleq_generate(const VOPRF_METHOD *method, CBB *cbb,
   ec_scalar_add(group, &u, &r, &u);
 
   // Store DLEQ proof in transcript.
-  if (!scalar_to_cbb(cbb, group, &c) ||
-      !scalar_to_cbb(cbb, group, &u)) {
+  if (!scalar_to_cbb(cbb, group, &c) || !scalar_to_cbb(cbb, group, &u)) {
     return 0;
   }
 
@@ -432,8 +426,7 @@ static int dleq_verify(const VOPRF_METHOD *method, CBS *cbs,
 
   // Decode the DLEQ proof.
   EC_SCALAR c, u;
-  if (!scalar_from_cbs(cbs, group, &c) ||
-      !scalar_from_cbs(cbs, group, &u)) {
+  if (!scalar_from_cbs(cbs, group, &c) || !scalar_from_cbs(cbs, group, &u)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
   }
@@ -484,80 +477,83 @@ static int voprf_sign_tt(const VOPRF_METHOD *method,
   }
 
   int ret = 0;
-  EC_JACOBIAN *BTs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_SCALAR *es = OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *es = reinterpret_cast<EC_SCALAR *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR)));
   CBB batch_cbb;
   CBB_zero(&batch_cbb);
-  if (!BTs ||
-      !Zs ||
-      !es ||
-      !CBB_init(&batch_cbb, 0) ||
-      !cbb_add_point(&batch_cbb, group, &key->pubs)) {
-    goto err;
-  }
 
-  for (size_t i = 0; i < num_to_issue; i++) {
-    EC_AFFINE BT_affine, Z_affine;
-    EC_JACOBIAN BT, Z;
-    if (!cbs_get_point(cbs, group, &BT_affine)) {
-      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+  {
+    if (!BTs || !Zs || !es || !CBB_init(&batch_cbb, 0) ||
+        !cbb_add_point(&batch_cbb, group, &key->pubs)) {
       goto err;
     }
-    ec_affine_to_jacobian(group, &BT, &BT_affine);
-    if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
-        !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
-        !cbb_add_point(cbb, group, &Z_affine)) {
-      goto err;
+
+    for (size_t i = 0; i < num_to_issue; i++) {
+      EC_AFFINE BT_affine, Z_affine;
+      EC_JACOBIAN BT, Z;
+      if (!cbs_get_point(cbs, group, &BT_affine)) {
+        OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+        goto err;
+      }
+      ec_affine_to_jacobian(group, &BT, &BT_affine);
+      if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
+          !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
+          !cbb_add_point(cbb, group, &Z_affine)) {
+        goto err;
+      }
+
+      if (!cbb_add_point(&batch_cbb, group, &BT_affine) ||
+          !cbb_add_point(&batch_cbb, group, &Z_affine)) {
+        goto err;
+      }
+      BTs[i] = BT;
+      Zs[i] = Z;
+
+      if (!CBB_flush(cbb)) {
+        goto err;
+      }
     }
 
-    if (!cbb_add_point(&batch_cbb, group, &BT_affine) ||
-        !cbb_add_point(&batch_cbb, group, &Z_affine)) {
-      goto err;
+    // The DLEQ batching construction is described in appendix B of
+    // https://eprint.iacr.org/2020/072/20200324:214215. Note the additional
+    // computations all act on public inputs.
+    for (size_t i = 0; i < num_to_issue; i++) {
+      if (!hash_to_scalar_batch(method, &es[i], &batch_cbb, i)) {
+        goto err;
+      }
     }
-    BTs[i] = BT;
-    Zs[i] = Z;
 
-    if (!CBB_flush(cbb)) {
+    EC_JACOBIAN BT_batch, Z_batch;
+    if (!ec_point_mul_scalar_public_batch(group, &BT_batch,
+                                          /*g_scalar=*/NULL, BTs, es,
+                                          num_to_issue) ||
+        !ec_point_mul_scalar_public_batch(group, &Z_batch,
+                                          /*g_scalar=*/NULL, Zs, es,
+                                          num_to_issue)) {
       goto err;
     }
-  }
 
-  // The DLEQ batching construction is described in appendix B of
-  // https://eprint.iacr.org/2020/072/20200324:214215. Note the additional
-  // computations all act on public inputs.
-  for (size_t i = 0; i < num_to_issue; i++) {
-    if (!hash_to_scalar_batch(method, &es[i], &batch_cbb, i)) {
+    CBB proof;
+    if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
+        !dleq_generate(method, &proof, key, &BT_batch, &Z_batch) ||
+        !CBB_flush(cbb)) {
       goto err;
     }
-  }
-
-  EC_JACOBIAN BT_batch, Z_batch;
-  if (!ec_point_mul_scalar_public_batch(group, &BT_batch,
-                                        /*g_scalar=*/NULL, BTs, es,
-                                        num_to_issue) ||
-      !ec_point_mul_scalar_public_batch(group, &Z_batch,
-                                        /*g_scalar=*/NULL, Zs, es,
-                                        num_to_issue)) {
-    goto err;
-  }
 
-  CBB proof;
-  if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
-      !dleq_generate(method, &proof, key, &BT_batch, &Z_batch) ||
-      !CBB_flush(cbb)) {
-    goto err;
-  }
+    // Skip over any unused requests.
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
+    if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
+      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+      goto err;
+    }
 
-  // Skip over any unused requests.
-  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
-  if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
-    goto err;
+    ret = 1;
   }
 
-  ret = 1;
-
 err:
   OPENSSL_free(BTs);
   OPENSSL_free(Zs);
@@ -578,15 +574,15 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
 
   int ok = 0;
   STACK_OF(TRUST_TOKEN) *ret = sk_TRUST_TOKEN_new_null();
-  EC_JACOBIAN *BTs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_SCALAR *es = OPENSSL_calloc(count, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *es =
+      reinterpret_cast<EC_SCALAR *>(OPENSSL_calloc(count, sizeof(EC_SCALAR)));
   CBB batch_cbb;
   CBB_zero(&batch_cbb);
-  if (ret == NULL ||
-      BTs == NULL ||
-      Zs == NULL ||
-      es == NULL ||
+  if (ret == NULL || BTs == NULL || Zs == NULL || es == NULL ||
       !CBB_init(&batch_cbb, 0) ||
       !cbb_add_point(&batch_cbb, group, &key->pubs)) {
     goto err;
@@ -635,8 +631,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind_tt(
     TRUST_TOKEN *token =
         TRUST_TOKEN_new(CBB_data(&token_cbb), CBB_len(&token_cbb));
     CBB_cleanup(&token_cbb);
-    if (token == NULL ||
-        !sk_TRUST_TOKEN_push(ret, token)) {
+    if (token == NULL || !sk_TRUST_TOKEN_push(ret, token)) {
       TRUST_TOKEN_free(token);
       goto err;
     }
@@ -681,15 +676,17 @@ err:
 }
 
 static void sha384_update_u16(SHA512_CTX *ctx, uint16_t v) {
-  uint8_t buf[2] = {v >> 8, v & 0xff};
+  uint8_t buf[2] = {static_cast<uint8_t>(v >> 8),
+                    static_cast<uint8_t>(v & 0xff)};
   SHA384_Update(ctx, buf, 2);
 }
 
-static void sha384_update_point_with_length(
-     SHA512_CTX *ctx, const EC_GROUP *group, const EC_AFFINE *point) {
+static void sha384_update_point_with_length(SHA512_CTX *ctx,
+                                            const EC_GROUP *group,
+                                            const EC_AFFINE *point) {
   uint8_t buf[EC_MAX_COMPRESSED];
-  size_t len = ec_point_to_bytes(group, point, POINT_CONVERSION_COMPRESSED,
-                                 buf, sizeof(buf));
+  size_t len = ec_point_to_bytes(group, point, POINT_CONVERSION_COMPRESSED, buf,
+                                 sizeof(buf));
   assert(len > 0);
   sha384_update_u16(ctx, (uint16_t)len);
   SHA384_Update(ctx, buf, len);
@@ -729,11 +726,9 @@ static int compute_composite_element(const VOPRF_METHOD *method,
   if (!CBB_init_fixed(&cbb, transcript, sizeof(transcript)) ||
       !CBB_add_u16(&cbb, SHA384_DIGEST_LENGTH) ||
       !CBB_add_bytes(&cbb, seed, SHA384_DIGEST_LENGTH) ||
-      !CBB_add_u16(&cbb, index) ||
-      !cbb_serialize_point(&cbb, group, C) ||
+      !CBB_add_u16(&cbb, index) || !cbb_serialize_point(&cbb, group, C) ||
       !cbb_serialize_point(&cbb, group, D) ||
-      !CBB_add_bytes(&cbb, kCompositeLabel,
-                     sizeof(kCompositeLabel) - 1) ||
+      !CBB_add_bytes(&cbb, kCompositeLabel, sizeof(kCompositeLabel) - 1) ||
       !CBB_finish(&cbb, NULL, &len) ||
       !method->hash_to_scalar(group, di, transcript, len)) {
     return 0;
@@ -786,8 +781,7 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
   ec_scalar_sub(group, &s, r, &s);
 
   // Store DLEQ proof in transcript.
-  if (!scalar_to_cbb(cbb, group, &c) ||
-      !scalar_to_cbb(cbb, group, &s)) {
+  if (!scalar_to_cbb(cbb, group, &c) || !scalar_to_cbb(cbb, group, &s)) {
     return 0;
   }
 
@@ -795,8 +789,8 @@ static int generate_proof(const VOPRF_METHOD *method, CBB *cbb,
 }
 
 static int verify_proof(const VOPRF_METHOD *method, CBS *cbs,
-                        const TRUST_TOKEN_CLIENT_KEY *pub,
-                        const EC_JACOBIAN *M, const EC_JACOBIAN *Z) {
+                        const TRUST_TOKEN_CLIENT_KEY *pub, const EC_JACOBIAN *M,
+                        const EC_JACOBIAN *Z) {
   const EC_GROUP *group = method->group_func();
 
   enum {
@@ -809,16 +803,14 @@ static int verify_proof(const VOPRF_METHOD *method, CBS *cbs,
   EC_JACOBIAN jacobians[num_idx];
 
   EC_SCALAR c, s;
-  if (!scalar_from_cbs(cbs, group, &c) ||
-      !scalar_from_cbs(cbs, group, &s)) {
+  if (!scalar_from_cbs(cbs, group, &c) || !scalar_from_cbs(cbs, group, &s)) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
     return 0;
   }
 
   EC_JACOBIAN pubs;
   ec_affine_to_jacobian(group, &pubs, &pub->pubs);
-  if (!ec_point_mul_scalar_public(group, &jacobians[idx_t2], &s, &pubs,
-                                  &c) ||
+  if (!ec_point_mul_scalar_public(group, &jacobians[idx_t2], &s, &pubs, &c) ||
       !mul_public_2(group, &jacobians[idx_t3], M, &s, Z, &c)) {
     return 0;
   }
@@ -857,72 +849,78 @@ static int voprf_sign_impl(const VOPRF_METHOD *method,
   }
 
   int ret = 0;
-  EC_JACOBIAN *BTs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN));
-  EC_SCALAR *dis = OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR));
-  if (!BTs || !Zs || !dis) {
-    goto err;
-  }
-
-  uint8_t seed[SHA384_DIGEST_LENGTH];
-  if (!compute_composite_seed(method, seed, &key->pubs)) {
-    goto err;
-  }
-
-  // This implements the BlindEvaluateBatch as defined in section 4 of
-  // draft-robert-privacypass-batched-tokens-01, based on the constructions
-  // in draft-irtf-cfrg-voprf-21. To optimize the computation of the proof,
-  // the computation of di is done during the token signing and passed into
-  // the proof generation.
-  for (size_t i = 0; i < num_to_issue; i++) {
-    EC_AFFINE BT_affine, Z_affine;
-    EC_JACOBIAN BT, Z;
-    if (!cbs_get_point(cbs, group, &BT_affine)) {
-      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *dis = reinterpret_cast<EC_SCALAR *>(
+      OPENSSL_calloc(num_to_issue, sizeof(EC_SCALAR)));
+
+  {
+    if (!BTs || !Zs || !dis) {
       goto err;
     }
-    ec_affine_to_jacobian(group, &BT, &BT_affine);
-    if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
-        !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
-        !cbb_add_point(cbb, group, &Z_affine)) {
+
+    uint8_t seed[SHA384_DIGEST_LENGTH];
+    if (!compute_composite_seed(method, seed, &key->pubs)) {
       goto err;
     }
-    BTs[i] = BT;
-    Zs[i] = Z;
-    if (!compute_composite_element(method, seed, &dis[i], i, &BT_affine,
-                                   &Z_affine)) {
-      goto err;
+
+    // This implements the BlindEvaluateBatch as defined in section 4 of
+    // draft-robert-privacypass-batched-tokens-01, based on the constructions
+    // in draft-irtf-cfrg-voprf-21. To optimize the computation of the proof,
+    // the computation of di is done during the token signing and passed into
+    // the proof generation.
+    for (size_t i = 0; i < num_to_issue; i++) {
+      EC_AFFINE BT_affine, Z_affine;
+      EC_JACOBIAN BT, Z;
+      if (!cbs_get_point(cbs, group, &BT_affine)) {
+        OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+        goto err;
+      }
+      ec_affine_to_jacobian(group, &BT, &BT_affine);
+      if (!ec_point_mul_scalar(group, &Z, &BT, &key->xs) ||
+          !ec_jacobian_to_affine(group, &Z_affine, &Z) ||
+          !cbb_add_point(cbb, group, &Z_affine)) {
+        goto err;
+      }
+      BTs[i] = BT;
+      Zs[i] = Z;
+      if (!compute_composite_element(method, seed, &dis[i], i, &BT_affine,
+                                     &Z_affine)) {
+        goto err;
+      }
+
+      if (!CBB_flush(cbb)) {
+        goto err;
+      }
     }
 
-    if (!CBB_flush(cbb)) {
+    EC_JACOBIAN M, Z;
+    if (!ec_point_mul_scalar_public_batch(group, &M,
+                                          /*g_scalar=*/NULL, BTs, dis,
+                                          num_to_issue) ||
+        !ec_point_mul_scalar(group, &Z, &M, &key->xs)) {
       goto err;
     }
-  }
 
-  EC_JACOBIAN M, Z;
-  if (!ec_point_mul_scalar_public_batch(group, &M,
-                                        /*g_scalar=*/NULL, BTs, dis,
-                                        num_to_issue) ||
-      !ec_point_mul_scalar(group, &Z, &M, &key->xs)) {
-    goto err;
-  }
+    CBB proof;
+    if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
+        !generate_proof(method, &proof, key, proof_scalar, &M, &Z) ||
+        !CBB_flush(cbb)) {
+      goto err;
+    }
 
-  CBB proof;
-  if (!CBB_add_u16_length_prefixed(cbb, &proof) ||
-      !generate_proof(method, &proof, key, proof_scalar, &M, &Z) ||
-      !CBB_flush(cbb)) {
-    goto err;
-  }
+    // Skip over any unused requests.
+    size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
+    if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
+      OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
+      goto err;
+    }
 
-  // Skip over any unused requests.
-  size_t point_len = ec_point_byte_len(group, POINT_CONVERSION_UNCOMPRESSED);
-  if (!CBS_skip(cbs, point_len * (num_requested - num_to_issue))) {
-    OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_DECODE_FAILURE);
-    goto err;
+    ret = 1;
   }
 
-  ret = 1;
-
 err:
   OPENSSL_free(BTs);
   OPENSSL_free(Zs);
@@ -968,9 +966,12 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
 
   int ok = 0;
   STACK_OF(TRUST_TOKEN) *ret = sk_TRUST_TOKEN_new_null();
-  EC_JACOBIAN *BTs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_JACOBIAN *Zs = OPENSSL_calloc(count, sizeof(EC_JACOBIAN));
-  EC_SCALAR *dis = OPENSSL_calloc(count, sizeof(EC_SCALAR));
+  EC_JACOBIAN *BTs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_JACOBIAN *Zs = reinterpret_cast<EC_JACOBIAN *>(
+      OPENSSL_calloc(count, sizeof(EC_JACOBIAN)));
+  EC_SCALAR *dis =
+      reinterpret_cast<EC_SCALAR *>(OPENSSL_calloc(count, sizeof(EC_SCALAR)));
   if (ret == NULL || !BTs || !Zs || !dis) {
     goto err;
   }
@@ -1022,8 +1023,7 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
     TRUST_TOKEN *token =
         TRUST_TOKEN_new(CBB_data(&token_cbb), CBB_len(&token_cbb));
     CBB_cleanup(&token_cbb);
-    if (token == NULL ||
-        !sk_TRUST_TOKEN_push(ret, token)) {
+    if (token == NULL || !sk_TRUST_TOKEN_push(ret, token)) {
       TRUST_TOKEN_free(token);
       goto err;
     }
@@ -1031,18 +1031,15 @@ static STACK_OF(TRUST_TOKEN) *voprf_unblind(
 
   EC_JACOBIAN M, Z;
   if (!ec_point_mul_scalar_public_batch(group, &M,
-                                        /*g_scalar=*/NULL, BTs, dis,
-                                        count) ||
+                                        /*g_scalar=*/NULL, BTs, dis, count) ||
       !ec_point_mul_scalar_public_batch(group, &Z,
-                                        /*g_scalar=*/NULL, Zs, dis,
-                                        count)) {
+                                        /*g_scalar=*/NULL, Zs, dis, count)) {
     goto err;
   }
 
   CBS proof;
   if (!CBS_get_u16_length_prefixed(cbs, &proof) ||
-      !verify_proof(method, &proof, key, &M, &Z) ||
-      CBS_len(&proof) != 0) {
+      !verify_proof(method, &proof, key, &M, &Z) || CBS_len(&proof) != 0) {
     goto err;
   }
 
@@ -1069,8 +1066,7 @@ static int voprf_read(const VOPRF_METHOD *method,
   CBS_init(&cbs, token, token_len);
   EC_AFFINE Ws;
   if (!CBS_get_bytes(&cbs, &salt, TRUST_TOKEN_NONCE_SIZE) ||
-      !cbs_get_point(&cbs, group, &Ws) ||
-      CBS_len(&cbs) != 0) {
+      !cbs_get_point(&cbs, group, &Ws) || CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(TRUST_TOKEN, TRUST_TOKEN_R_INVALID_TOKEN);
     return 0;
   }
@@ -1113,7 +1109,7 @@ static int voprf_exp2_hash_to_group(const EC_GROUP *group, EC_JACOBIAN *out,
 }
 
 static int voprf_exp2_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                             uint8_t *buf, size_t len) {
+                                     uint8_t *buf, size_t len) {
   const uint8_t kHashCLabel[] = "TrustToken VOPRF Experiment V2 HashToScalar";
   return ec_hash_to_scalar_p384_xmd_sha512_draft07(
       group, out, kHashCLabel, sizeof(kHashCLabel), buf, len);
@@ -1189,7 +1185,7 @@ static int voprf_pst1_hash_to_group(const EC_GROUP *group, EC_JACOBIAN *out,
 }
 
 static int voprf_pst1_hash_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                             uint8_t *buf, size_t len) {
+                                     uint8_t *buf, size_t len) {
   const uint8_t kHashCLabel[] = "HashToScalar-OPRFV1-\x01-P384-SHA384";
   return ec_hash_to_scalar_p384_xmd_sha384(group, out, kHashCLabel,
                                            sizeof(kHashCLabel) - 1, buf, len);

data/third_party/boringssl-with-bazel/src/crypto/x509/a_digest.cc

@@ -0,0 +1,52 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/x509.h>
+
+#include <openssl/asn1.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
+                unsigned char *md, unsigned int *len) {
+  int i, ret;
+  unsigned char *str, *p;
+
+  i = i2d(data, NULL);
+  if ((str = (unsigned char *)OPENSSL_malloc(i)) == NULL) {
+    return 0;
+  }
+  p = str;
+  i2d(data, &p);
+
+  ret = EVP_Digest(str, i, md, len, type, NULL);
+  OPENSSL_free(str);
+  return ret;
+}
+
+int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, void *asn,
+                     unsigned char *md, unsigned int *len) {
+  int i, ret;
+  unsigned char *str = NULL;
+
+  i = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &str, it);
+  if (!str) {
+    return 0;
+  }
+
+  ret = EVP_Digest(str, i, md, len, type, NULL);
+  OPENSSL_free(str);
+  return ret;
+}