grpc 1.70.1 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm_interface.h

@@ -1,16 +1,16 @@
-/* Copyright 2024 The BoringSSL Authors
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #ifndef OPENSSL_HEADER_CRYPTO_BCM_INTERFACE_H
 #define OPENSSL_HEADER_CRYPTO_BCM_INTERFACE_H
@@ -47,10 +47,14 @@ enum class bcm_status_t {
 typedef enum bcm_status_t bcm_status;
 typedef enum bcm_infallible_t bcm_infallible;
 
-OPENSSL_INLINE int bcm_success(bcm_status status) {
+inline int bcm_success(bcm_status status) {
   return status == bcm_status::approved || status == bcm_status::not_approved;
 }
 
+inline bcm_status_t bcm_as_approved_status(int result) {
+  return result ? bcm_status::approved : bcm_status::failure;
+}
+
 
 // Random number generator.
 
@@ -235,6 +239,489 @@ bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
                                     SHA512_CTX *sha);
 
 
+// ML-DSA
+//
+// Where not commented, these functions have the same signature as the
+// corresponding public function.
+
+// BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES is the number of bytes of uniformly
+// random entropy necessary to generate a signature in randomized mode.
+#define BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES 32
+
+// BCM_MLDSA_SEED_BYTES is the number of bytes in an ML-DSA seed value.
+#define BCM_MLDSA_SEED_BYTES 32
+
+// BCM_MLDSA65_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
+// private key.
+#define BCM_MLDSA65_PRIVATE_KEY_BYTES 4032
+
+// BCM_MLDSA65_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
+// public key.
+#define BCM_MLDSA65_PUBLIC_KEY_BYTES 1952
+
+// BCM_MLDSA65_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-65
+// signature.
+#define BCM_MLDSA65_SIGNATURE_BYTES 3309
+
+struct BCM_mldsa65_private_key {
+  union {
+    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (5 + 6 + 6)];
+    uint32_t alignment;
+  } opaque;
+};
+
+struct BCM_mldsa65_public_key {
+  union {
+    uint8_t bytes[32 + 64 + 256 * 4 * 6];
+    uint32_t alignment;
+  } opaque;
+};
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key(
+    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
+    struct BCM_mldsa65_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_private_key_from_seed(
+    struct BCM_mldsa65_private_key *out_private_key,
+    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_public_from_private(
+    struct BCM_mldsa65_public_key *out_public_key,
+    const struct BCM_mldsa65_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_sign(
+    uint8_t out_encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
+    const struct BCM_mldsa65_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_verify(
+    const struct BCM_mldsa65_public_key *public_key,
+    const uint8_t signature[BCM_MLDSA65_SIGNATURE_BYTES], const uint8_t *msg,
+    size_t msg_len, const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_marshal_public_key(
+    CBB *out, const struct BCM_mldsa65_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_parse_public_key(
+    struct BCM_mldsa65_public_key *public_key, CBS *in);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_parse_private_key(
+    struct BCM_mldsa65_private_key *private_key, CBS *in);
+
+// BCM_mldsa65_generate_key_external_entropy generates a public/private key pair
+// using the given seed, writes the encoded public key to
+// |out_encoded_public_key| and sets |out_private_key| to the private key.
+OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key_external_entropy(
+    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
+    struct BCM_mldsa65_private_key *out_private_key,
+    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+
+// BCM_mldsa5_sign_internal signs |msg| using |private_key| and writes the
+// signature to |out_encoded_signature|. The |context_prefix| and |context| are
+// prefixed to the message, in that order, before signing. The |randomizer|
+// value can be set to zero bytes in order to make a deterministic signature, or
+// else filled with entropy for the usual |MLDSA_sign| behavior.
+OPENSSL_EXPORT bcm_status BCM_mldsa65_sign_internal(
+    uint8_t out_encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
+    const struct BCM_mldsa65_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context_prefix, size_t context_prefix_len,
+    const uint8_t *context, size_t context_len,
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+// BCM_mldsa5_verify_internal verifies that |encoded_signature| is a valid
+// signature of |msg| by |public_key|. The |context_prefix| and |context| are
+// prefixed to the message before verification, in that order.
+OPENSSL_EXPORT bcm_status BCM_mldsa65_verify_internal(
+    const struct BCM_mldsa65_public_key *public_key,
+    const uint8_t encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context_prefix,
+    size_t context_prefix_len, const uint8_t *context, size_t context_len);
+
+// BCM_mldsa65_marshal_private_key serializes |private_key| to |out| in the
+// NIST format for ML-DSA-65 private keys.
+OPENSSL_EXPORT bcm_status BCM_mldsa65_marshal_private_key(
+    CBB *out, const struct BCM_mldsa65_private_key *private_key);
+
+
+// BCM_MLDSA87_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
+// private key.
+#define BCM_MLDSA87_PRIVATE_KEY_BYTES 4896
+
+// BCM_MLDSA87_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
+// public key.
+#define BCM_MLDSA87_PUBLIC_KEY_BYTES 2592
+
+// BCM_MLDSA87_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-87
+// signature.
+#define BCM_MLDSA87_SIGNATURE_BYTES 4627
+
+struct BCM_mldsa87_private_key {
+  union {
+    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (7 + 8 + 8)];
+    uint32_t alignment;
+  } opaque;
+};
+
+struct BCM_mldsa87_public_key {
+  union {
+    uint8_t bytes[32 + 64 + 256 * 4 * 8];
+    uint32_t alignment;
+  } opaque;
+};
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key(
+    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
+    struct BCM_mldsa87_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_private_key_from_seed(
+    struct BCM_mldsa87_private_key *out_private_key,
+    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_public_from_private(
+    struct BCM_mldsa87_public_key *out_public_key,
+    const struct BCM_mldsa87_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_sign(
+    uint8_t out_encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
+    const struct BCM_mldsa87_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa87_verify(const struct BCM_mldsa87_public_key *public_key,
+                   const uint8_t *signature, const uint8_t *msg, size_t msg_len,
+                   const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_marshal_public_key(
+    CBB *out, const struct BCM_mldsa87_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_parse_public_key(
+    struct BCM_mldsa87_public_key *public_key, CBS *in);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_parse_private_key(
+    struct BCM_mldsa87_private_key *private_key, CBS *in);
+
+// BCM_mldsa87_generate_key_external_entropy generates a public/private key pair
+// using the given seed, writes the encoded public key to
+// |out_encoded_public_key| and sets |out_private_key| to the private key.
+OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key_external_entropy(
+    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
+    struct BCM_mldsa87_private_key *out_private_key,
+    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+
+// BCM_mldsa87_sign_internal signs |msg| using |private_key| and writes the
+// signature to |out_encoded_signature|. The |context_prefix| and |context| are
+// prefixed to the message, in that order, before signing. The |randomizer|
+// value can be set to zero bytes in order to make a deterministic signature, or
+// else filled with entropy for the usual |MLDSA_sign| behavior.
+OPENSSL_EXPORT bcm_status BCM_mldsa87_sign_internal(
+    uint8_t out_encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
+    const struct BCM_mldsa87_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context_prefix, size_t context_prefix_len,
+    const uint8_t *context, size_t context_len,
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+// BCM_mldsa87_verify_internal verifies that |encoded_signature| is a valid
+// signature of |msg| by |public_key|. The |context_prefix| and |context| are
+// prefixed to the message before verification, in that order.
+OPENSSL_EXPORT bcm_status BCM_mldsa87_verify_internal(
+    const struct BCM_mldsa87_public_key *public_key,
+    const uint8_t encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context_prefix,
+    size_t context_prefix_len, const uint8_t *context, size_t context_len);
+
+// BCM_mldsa87_marshal_private_key serializes |private_key| to |out| in the
+// NIST format for ML-DSA-87 private keys.
+OPENSSL_EXPORT bcm_status BCM_mldsa87_marshal_private_key(
+    CBB *out, const struct BCM_mldsa87_private_key *private_key);
+
+
+// ML-KEM
+//
+// Where not commented, these functions have the same signature as the
+// corresponding public function.
+
+// BCM_MLKEM_ENCAP_ENTROPY is the number of bytes of uniformly random entropy
+// necessary to encapsulate a secret. The entropy will be leaked to the
+// decapsulating party.
+#define BCM_MLKEM_ENCAP_ENTROPY 32
+
+// BCM_MLKEM768_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-KEM-768
+// public key.
+#define BCM_MLKEM768_PUBLIC_KEY_BYTES 1184
+
+// BCM_MLKEM1024_PUBLIC_KEY_BYTES is the number of bytes in an encoded
+// ML-KEM-1024 public key.
+#define BCM_MLKEM1024_PUBLIC_KEY_BYTES 1568
+
+// BCM_MLKEM768_CIPHERTEXT_BYTES is number of bytes in the ML-KEM-768
+// ciphertext.
+#define BCM_MLKEM768_CIPHERTEXT_BYTES 1088
+
+// BCM_MLKEM1024_CIPHERTEXT_BYTES is number of bytes in the ML-KEM-1024
+// ciphertext.
+#define BCM_MLKEM1024_CIPHERTEXT_BYTES 1568
+
+// BCM_MLKEM768_PRIVATE_KEY_BYTES is the length of the data produced by
+// |BCM_mlkem768_marshal_private_key|.
+#define BCM_MLKEM768_PRIVATE_KEY_BYTES 2400
+
+// BCM_MLKEM1024_PRIVATE_KEY_BYTES is the length of the data produced by
+// |BCM_mlkem1024_marshal_private_key|.
+#define BCM_MLKEM1024_PRIVATE_KEY_BYTES 3168
+
+// BCM_MLKEM_SEED_BYTES is the number of bytes in an ML-KEM seed.
+#define BCM_MLKEM_SEED_BYTES 64
+
+// BCM_mlkem_SHARED_SECRET_BYTES is the number of bytes in an ML-KEM shared
+// secret.
+#define BCM_MLKEM_SHARED_SECRET_BYTES 32
+
+struct BCM_mlkem768_public_key {
+  union {
+    uint8_t bytes[512 * (3 + 9) + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+struct BCM_mlkem768_private_key {
+  union {
+    uint8_t bytes[512 * (3 + 3 + 9) + 32 + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+OPENSSL_EXPORT bcm_infallible BCM_mlkem768_generate_key(
+    uint8_t out_encoded_public_key[BCM_MLKEM768_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
+    struct BCM_mlkem768_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem768_private_key_from_seed(
+    struct BCM_mlkem768_private_key *out_private_key, const uint8_t *seed,
+    size_t seed_len);
+
+OPENSSL_EXPORT bcm_infallible BCM_mlkem768_public_from_private(
+    struct BCM_mlkem768_public_key *out_public_key,
+    const struct BCM_mlkem768_private_key *private_key);
+
+OPENSSL_EXPORT bcm_infallible
+BCM_mlkem768_encap(uint8_t out_ciphertext[BCM_MLKEM768_CIPHERTEXT_BYTES],
+                   uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+                   const struct BCM_mlkem768_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status
+BCM_mlkem768_decap(uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+                   const uint8_t *ciphertext, size_t ciphertext_len,
+                   const struct BCM_mlkem768_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem768_marshal_public_key(
+    CBB *out, const struct BCM_mlkem768_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem768_parse_public_key(
+    struct BCM_mlkem768_public_key *out_public_key, CBS *in);
+
+// BCM_mlkem768_parse_private_key parses a private key, in NIST's format for
+// private keys, from |in| and writes the result to |out_private_key|. It
+// returns one on success or zero on parse error or if there are trailing bytes
+// in |in|. This format is verbose and should be avoided. Private keys should be
+// stored as seeds and parsed using |BCM_mlkem768_private_key_from_seed|.
+OPENSSL_EXPORT bcm_status BCM_mlkem768_parse_private_key(
+    struct BCM_mlkem768_private_key *out_private_key, CBS *in);
+
+// BCM_mlkem768_generate_key_external_seed is a deterministic function to create
+// a pair of ML-KEM-768 keys, using the supplied seed. The seed needs to be
+// uniformly random. This function should only be used for tests; regular
+// callers should use the non-deterministic |BCM_mlkem768_generate_key|
+// directly.
+OPENSSL_EXPORT bcm_infallible BCM_mlkem768_generate_key_external_seed(
+    uint8_t out_encoded_public_key[BCM_MLKEM768_PUBLIC_KEY_BYTES],
+    struct BCM_mlkem768_private_key *out_private_key,
+    const uint8_t seed[BCM_MLKEM_SEED_BYTES]);
+
+// BCM_mlkem768_encap_external_entropy behaves like |MLKEM768_encap|, but uses
+// |MLKEM_ENCAP_ENTROPY| bytes of |entropy| for randomization. The decapsulating
+// side will be able to recover |entropy| in full. This function should only be
+// used for tests, regular callers should use the non-deterministic
+// |BCM_mlkem768_encap| directly.
+OPENSSL_EXPORT bcm_infallible BCM_mlkem768_encap_external_entropy(
+    uint8_t out_ciphertext[BCM_MLKEM768_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+    const struct BCM_mlkem768_public_key *public_key,
+    const uint8_t entropy[BCM_MLKEM_ENCAP_ENTROPY]);
+
+// BCM_mlkem768_marshal_private_key serializes |private_key| to |out| in the
+// NIST format for ML-KEM-768 private keys. (Note that one can also save just
+// the seed value produced by |BCM_mlkem768_generate_key|, which is
+// significantly smaller.)
+OPENSSL_EXPORT bcm_status BCM_mlkem768_marshal_private_key(
+    CBB *out, const struct BCM_mlkem768_private_key *private_key);
+
+struct BCM_mlkem1024_public_key {
+  union {
+    uint8_t bytes[512 * (4 + 16) + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+struct BCM_mlkem1024_private_key {
+  union {
+    uint8_t bytes[512 * (4 + 4 + 16) + 32 + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_generate_key(
+    uint8_t out_encoded_public_key[BCM_MLKEM1024_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
+    struct BCM_mlkem1024_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem1024_private_key_from_seed(
+    struct BCM_mlkem1024_private_key *out_private_key, const uint8_t *seed,
+    size_t seed_len);
+
+OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_public_from_private(
+    struct BCM_mlkem1024_public_key *out_public_key,
+    const struct BCM_mlkem1024_private_key *private_key);
+
+OPENSSL_EXPORT bcm_infallible
+BCM_mlkem1024_encap(uint8_t out_ciphertext[BCM_MLKEM1024_CIPHERTEXT_BYTES],
+                    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+                    const struct BCM_mlkem1024_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status
+BCM_mlkem1024_decap(uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+                    const uint8_t *ciphertext, size_t ciphertext_len,
+                    const struct BCM_mlkem1024_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem1024_marshal_public_key(
+    CBB *out, const struct BCM_mlkem1024_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status BCM_mlkem1024_parse_public_key(
+    struct BCM_mlkem1024_public_key *out_public_key, CBS *in);
+
+// BCM_mlkem1024_parse_private_key parses a private key, in NIST's format for
+// private keys, from |in| and writes the result to |out_private_key|. It
+// returns one on success or zero on parse error or if there are trailing bytes
+// in |in|. This format is verbose and should be avoided. Private keys should be
+// stored as seeds and parsed using |BCM_mlkem1024_private_key_from_seed|.
+OPENSSL_EXPORT bcm_status BCM_mlkem1024_parse_private_key(
+    struct BCM_mlkem1024_private_key *out_private_key, CBS *in);
+
+// BCM_mlkem1024_generate_key_external_seed is a deterministic function to
+// create a pair of ML-KEM-1024 keys, using the supplied seed. The seed needs to
+// be uniformly random. This function should only be used for tests, regular
+// callers should use the non-deterministic |BCM_mlkem1024_generate_key|
+// directly.
+OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_generate_key_external_seed(
+    uint8_t out_encoded_public_key[BCM_MLKEM1024_PUBLIC_KEY_BYTES],
+    struct BCM_mlkem1024_private_key *out_private_key,
+    const uint8_t seed[BCM_MLKEM_SEED_BYTES]);
+
+// BCM_mlkem1024_encap_external_entropy behaves like |MLKEM1024_encap|, but uses
+// |MLKEM_ENCAP_ENTROPY| bytes of |entropy| for randomization. The
+// decapsulating side will be able to recover |entropy| in full. This function
+// should only be used for tests, regular callers should use the
+// non-deterministic |BCM_mlkem1024_encap| directly.
+OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_encap_external_entropy(
+    uint8_t out_ciphertext[BCM_MLKEM1024_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+    const struct BCM_mlkem1024_public_key *public_key,
+    const uint8_t entropy[BCM_MLKEM_ENCAP_ENTROPY]);
+
+// BCM_mlkem1024_marshal_private_key serializes |private_key| to |out| in the
+// NIST format for ML-KEM-1024 private keys. (Note that one can also save just
+// the seed value produced by |BCM_mlkem1024_generate_key|, which is
+// significantly smaller.)
+OPENSSL_EXPORT bcm_status BCM_mlkem1024_marshal_private_key(
+    CBB *out, const struct BCM_mlkem1024_private_key *private_key);
+
+
+// SLH-DSA
+
+// Output length of the hash function.
+#define BCM_SLHDSA_SHA2_128S_N 16
+
+// The number of bytes at the beginning of M', the augmented message, before the
+// context.
+#define BCM_SLHDSA_M_PRIME_HEADER_LEN 2
+
+// SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES is the number of bytes in an
+// SLH-DSA-SHA2-128s public key.
+#define BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES 32
+
+// BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES is the number of bytes in an
+// SLH-DSA-SHA2-128s private key.
+#define BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES 64
+
+// BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES is the number of bytes in an
+// SLH-DSA-SHA2-128s signature.
+#define BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES 7856
+
+// SLHDSA_SHA2_128S_generate_key_from_seed generates an SLH-DSA-SHA2-128s key
+// pair from a 48-byte seed and writes the result to |out_public_key| and
+// |out_secret_key|.
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]);
+
+// BCM_slhdsa_sha2_128s_sign_internal acts like |SLHDSA_SHA2_128S_sign| but
+// accepts an explicit entropy input, which can be PK.seed (bytes 32..48 of
+// the private key) to generate deterministic signatures. It also takes the
+// input message in three parts so that the "internal" version of the signing
+// function, from section 9.2, can be implemented. The |header| argument may be
+// NULL to omit it.
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]);
+
+// BCM_slhdsa_sha2_128s_verify_internal acts like |SLHDSA_SHA2_128S_verify| but
+// takes the input message in three parts so that the "internal" version of the
+// verification function, from section 9.3, can be implemented. The |header|
+// argument may be NULL to omit it.
+OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len);
+
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
+
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_prehash_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len);
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/add.cc.inc

@@ -1,58 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/bn.h>
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/asm/x86_64-gcc.cc.inc

@@ -1,11 +1,24 @@
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 /* x86_64 BIGNUM accelerator version 0.1, December 2002.
  *
  * Implemented by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
  * project.
  *
  * Rights for redistribution and usage in source and binary forms are
- * granted according to the OpenSSL license. Warranty of any kind is
- * disclaimed.
+ * granted according to the License. Warranty of any kind is disclaimed.
  *
  * Q. Version 0.1? It doesn't sound like Andy, he used to assign real
  *    versions, like 1.0...