grpc 1.70.1 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/{slhdsa/merkle.cc → fipsmodule/slhdsa/merkle.cc.inc}

@@ -1,22 +1,22 @@
-/* Copyright 2024 The BoringSSL Authors
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/base.h>
 
 #include <string.h>
 
-#include "../internal.h"
+#include "../../internal.h"
 #include "./address.h"
 #include "./merkle.h"
 #include "./params.h"
@@ -25,11 +25,11 @@
 
 
 // Implements Algorithm 9: xmss_node function (page 23)
-void slhdsa_treehash(uint8_t out_pk[SLHDSA_SHA2_128S_N],
-                     const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
+void slhdsa_treehash(uint8_t out_pk[BCM_SLHDSA_SHA2_128S_N],
+                     const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
                      uint32_t i /*target node index*/,
                      uint32_t z /*target node height*/,
-                     const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                     const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
                      uint8_t addr[32]) {
   BSSL_CHECK(z <= SLHDSA_SHA2_128S_TREE_HEIGHT);
   BSSL_CHECK(i < (uint32_t)(1 << (SLHDSA_SHA2_128S_TREE_HEIGHT - z)));
@@ -40,9 +40,9 @@ void slhdsa_treehash(uint8_t out_pk[SLHDSA_SHA2_128S_N],
     slhdsa_wots_pk_gen(out_pk, sk_seed, pk_seed, addr);
   } else {
     // Stores left node and right node.
-    uint8_t nodes[2 * SLHDSA_SHA2_128S_N];
+    uint8_t nodes[2 * BCM_SLHDSA_SHA2_128S_N];
     slhdsa_treehash(nodes, sk_seed, 2 * i, z - 1, pk_seed, addr);
-    slhdsa_treehash(nodes + SLHDSA_SHA2_128S_N, sk_seed, 2 * i + 1, z - 1,
+    slhdsa_treehash(nodes + BCM_SLHDSA_SHA2_128S_N, sk_seed, 2 * i + 1, z - 1,
                     pk_seed, addr);
     slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE);
     slhdsa_set_tree_height(addr, z);
@@ -53,14 +53,14 @@ void slhdsa_treehash(uint8_t out_pk[SLHDSA_SHA2_128S_N],
 
 // Implements Algorithm 10: xmss_sign function (page 24)
 void slhdsa_xmss_sign(uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES],
-                      const uint8_t msg[SLHDSA_SHA2_128S_N], unsigned int idx,
-                      const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
-                      const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                      const uint8_t msg[BCM_SLHDSA_SHA2_128S_N], unsigned int idx,
+                      const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
                       uint8_t addr[32]) {
   // Build authentication path
   for (size_t j = 0; j < SLHDSA_SHA2_128S_TREE_HEIGHT; ++j) {
     unsigned int k = (idx >> j) ^ 1;
-    slhdsa_treehash(sig + SLHDSA_SHA2_128S_WOTS_BYTES + j * SLHDSA_SHA2_128S_N,
+    slhdsa_treehash(sig + SLHDSA_SHA2_128S_WOTS_BYTES + j * BCM_SLHDSA_SHA2_128S_N,
                     sk_seed, k, j, pk_seed, addr);
   }
 
@@ -72,52 +72,52 @@ void slhdsa_xmss_sign(uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES],
 
 // Implements Algorithm 11: xmss_pkFromSig function (page 25)
 void slhdsa_xmss_pk_from_sig(
-    uint8_t root[SLHDSA_SHA2_128S_N],
+    uint8_t root[BCM_SLHDSA_SHA2_128S_N],
     const uint8_t xmss_sig[SLHDSA_SHA2_128S_XMSS_BYTES], unsigned int idx,
-    const uint8_t msg[SLHDSA_SHA2_128S_N],
-    const uint8_t pk_seed[SLHDSA_SHA2_128S_N], uint8_t addr[32]) {
+    const uint8_t msg[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]) {
   // Stores node[0] and node[1] from Algorithm 11
   slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_WOTS);
   slhdsa_set_keypair_addr(addr, idx);
-  uint8_t node[2 * SLHDSA_SHA2_128S_N];
+  uint8_t node[2 * BCM_SLHDSA_SHA2_128S_N];
   slhdsa_wots_pk_from_sig(node, xmss_sig, msg, pk_seed, addr);
 
   slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE);
   slhdsa_set_tree_index(addr, idx);
 
-  uint8_t tmp[2 * SLHDSA_SHA2_128S_N];
+  uint8_t tmp[2 * BCM_SLHDSA_SHA2_128S_N];
   const uint8_t *const auth = xmss_sig + SLHDSA_SHA2_128S_WOTS_BYTES;
   for (size_t k = 0; k < SLHDSA_SHA2_128S_TREE_HEIGHT; ++k) {
     slhdsa_set_tree_height(addr, k + 1);
     if (((idx >> k) & 1) == 0) {
       slhdsa_set_tree_index(addr, slhdsa_get_tree_index(addr) >> 1);
-      OPENSSL_memcpy(tmp, node, SLHDSA_SHA2_128S_N);
-      OPENSSL_memcpy(tmp + SLHDSA_SHA2_128S_N, auth + k * SLHDSA_SHA2_128S_N,
-                     SLHDSA_SHA2_128S_N);
-      slhdsa_thash_h(node + SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
+      OPENSSL_memcpy(tmp, node, BCM_SLHDSA_SHA2_128S_N);
+      OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, auth + k * BCM_SLHDSA_SHA2_128S_N,
+                     BCM_SLHDSA_SHA2_128S_N);
+      slhdsa_thash_h(node + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
     } else {
       slhdsa_set_tree_index(addr, (slhdsa_get_tree_index(addr) - 1) >> 1);
-      OPENSSL_memcpy(tmp, auth + k * SLHDSA_SHA2_128S_N, SLHDSA_SHA2_128S_N);
-      OPENSSL_memcpy(tmp + SLHDSA_SHA2_128S_N, node, SLHDSA_SHA2_128S_N);
-      slhdsa_thash_h(node + SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
+      OPENSSL_memcpy(tmp, auth + k * BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N);
+      OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, node, BCM_SLHDSA_SHA2_128S_N);
+      slhdsa_thash_h(node + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr);
     }
-    OPENSSL_memcpy(node, node + SLHDSA_SHA2_128S_N, SLHDSA_SHA2_128S_N);
+    OPENSSL_memcpy(node, node + BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N);
   }
-  OPENSSL_memcpy(root, node, SLHDSA_SHA2_128S_N);
+  OPENSSL_memcpy(root, node, BCM_SLHDSA_SHA2_128S_N);
 }
 
 // Implements Algorithm 12: ht_sign function (page 27)
 void slhdsa_ht_sign(
     uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES * SLHDSA_SHA2_128S_D],
-    const uint8_t message[SLHDSA_SHA2_128S_N], uint64_t idx_tree,
-    uint32_t idx_leaf, const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
-    const uint8_t pk_seed[SLHDSA_SHA2_128S_N]) {
+    const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]) {
   uint8_t addr[32] = {0};
   slhdsa_set_tree_addr(addr, idx_tree);
 
   // Layer 0
   slhdsa_xmss_sign(sig, message, idx_leaf, sk_seed, pk_seed, addr);
-  uint8_t root[SLHDSA_SHA2_128S_N];
+  uint8_t root[BCM_SLHDSA_SHA2_128S_N];
   slhdsa_xmss_pk_from_sig(root, sig, idx_leaf, message, pk_seed, addr);
   sig += SLHDSA_SHA2_128S_XMSS_BYTES;
 
@@ -139,13 +139,13 @@ void slhdsa_ht_sign(
 // Implements Algorithm 13: ht_verify function (page 28)
 int slhdsa_ht_verify(
     const uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES],
-    const uint8_t message[SLHDSA_SHA2_128S_N], uint64_t idx_tree,
-    uint32_t idx_leaf, const uint8_t pk_root[SLHDSA_SHA2_128S_N],
-    const uint8_t pk_seed[SLHDSA_SHA2_128S_N]) {
+    const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t pk_root[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]) {
   uint8_t addr[32] = {0};
   slhdsa_set_tree_addr(addr, idx_tree);
 
-  uint8_t node[SLHDSA_SHA2_128S_N];
+  uint8_t node[BCM_SLHDSA_SHA2_128S_N];
   slhdsa_xmss_pk_from_sig(node, sig, idx_leaf, message, pk_seed, addr);
 
   for (size_t j = 1; j < SLHDSA_SHA2_128S_D; ++j) {
@@ -157,5 +157,5 @@ int slhdsa_ht_verify(
     slhdsa_xmss_pk_from_sig(node, sig + j * SLHDSA_SHA2_128S_XMSS_BYTES,
                             idx_leaf, node, pk_seed, addr);
   }
-  return memcmp(node, pk_root, SLHDSA_SHA2_128S_N) == 0;
+  return memcmp(node, pk_root, BCM_SLHDSA_SHA2_128S_N) == 0;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/merkle.h

@@ -0,0 +1,70 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H
+
+#include <openssl/base.h>
+
+#include <sys/types.h>
+
+#include "./params.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Implements Algorithm 9: xmss_node function (page 23)
+void slhdsa_treehash(uint8_t out_pk[BCM_SLHDSA_SHA2_128S_N],
+                     const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                     uint32_t i /*target node index*/,
+                     uint32_t z /*target node height*/,
+                     const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                     uint8_t addr[32]);
+
+// Implements Algorithm 10: xmss_sign function (page 24)
+void slhdsa_xmss_sign(uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES],
+                      const uint8_t msg[BCM_SLHDSA_SHA2_128S_N], unsigned int idx,
+                      const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N],
+                      uint8_t addr[32]);
+
+// Implements Algorithm 11: xmss_pkFromSig function (page 25)
+void slhdsa_xmss_pk_from_sig(
+    uint8_t root[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t xmss_sig[SLHDSA_SHA2_128S_XMSS_BYTES], unsigned int idx,
+    const uint8_t msg[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]);
+
+// Implements Algorithm 12: ht_sign function (page 27)
+void slhdsa_ht_sign(
+    uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES],
+    const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]);
+
+// Implements Algorithm 13: ht_verify function (page 28)
+int slhdsa_ht_verify(
+    const uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES],
+    const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t pk_root[BCM_SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H

data/third_party/boringssl-with-bazel/src/crypto/{slhdsa → fipsmodule/slhdsa}/params.h

@@ -1,29 +1,27 @@
-/* Copyright 2024 The BoringSSL Authors
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
-#ifndef OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H
-#define OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
 
 #include <openssl/base.h>
+#include "../bcm_interface.h"
 
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
-
-// Output length of the hash function.
-#define SLHDSA_SHA2_128S_N 16
 // Total height of the tree structure.
 #define SLHDSA_SHA2_128S_FULL_HEIGHT 63
 // Number of subtree layers.
@@ -37,10 +35,7 @@ extern "C" {
 // Size of a FORS signature
 #define SLHDSA_SHA2_128S_FORS_BYTES                                   \
   ((SLHDSA_SHA2_128S_FORS_HEIGHT + 1) * SLHDSA_SHA2_128S_FORS_TREES * \
-   SLHDSA_SHA2_128S_N)
-// The number of bytes at the beginning of M', the augmented message, before the
-// context.
-#define SLHDSA_M_PRIME_HEADER_LEN 2
+   BCM_SLHDSA_SHA2_128S_N)
 
 // Winternitz parameter and derived values
 #define SLHDSA_SHA2_128S_WOTS_W 16
@@ -49,12 +44,12 @@ extern "C" {
 #define SLHDSA_SHA2_128S_WOTS_LEN2 3
 #define SLHDSA_SHA2_128S_WOTS_LEN 35
 #define SLHDSA_SHA2_128S_WOTS_BYTES \
-  (SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_WOTS_LEN)
+  (BCM_SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_WOTS_LEN)
 
 // XMSS sizes
 #define SLHDSA_SHA2_128S_XMSS_BYTES \
   (SLHDSA_SHA2_128S_WOTS_BYTES +    \
-   (SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_TREE_HEIGHT))
+   (BCM_SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_TREE_HEIGHT))
 
 // Size of the message digest (NOTE: This is only correct for the SHA-256 params
 // here)
@@ -80,4 +75,4 @@ extern "C" {
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/slhdsa.cc.inc

@@ -0,0 +1,329 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <string.h>
+
+#include <openssl/bytestring.h>
+#include <openssl/obj.h>
+#include <openssl/rand.h>
+
+#include "../../internal.h"
+#include "../bcm_interface.h"
+#include "address.h"
+#include "fors.h"
+#include "merkle.h"
+#include "params.h"
+#include "thash.h"
+
+
+// The OBJECT IDENTIFIER header is also included in these values, per the spec.
+static const uint8_t kSHA256OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+                                     0x65, 0x03, 0x04, 0x02, 0x01};
+static const uint8_t kSHA384OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+                                     0x65, 0x03, 0x04, 0x02, 0x02};
+#define MAX_OID_LENGTH 11
+#define MAX_CONTEXT_LENGTH 255
+
+bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
+  // Initialize SK.seed || SK.prf || PK.seed from seed.
+  OPENSSL_memcpy(out_secret_key, seed, 3 * BCM_SLHDSA_SHA2_128S_N);
+
+  // Initialize PK.seed from seed.
+  OPENSSL_memcpy(out_public_key, seed + 2 * BCM_SLHDSA_SHA2_128S_N,
+                 BCM_SLHDSA_SHA2_128S_N);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_layer_addr(addr, SLHDSA_SHA2_128S_D - 1);
+
+  // Set PK.root
+  slhdsa_treehash(out_public_key + BCM_SLHDSA_SHA2_128S_N, out_secret_key, 0,
+                  SLHDSA_SHA2_128S_TREE_HEIGHT, out_public_key, addr);
+  OPENSSL_memcpy(out_secret_key + 3 * BCM_SLHDSA_SHA2_128S_N,
+                 out_public_key + BCM_SLHDSA_SHA2_128S_N,
+                 BCM_SLHDSA_SHA2_128S_N);
+  return bcm_infallible::approved;
+}
+
+bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N];
+  RAND_bytes(seed, 3 * BCM_SLHDSA_SHA2_128S_N);
+  BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key, out_private_key,
+                                              seed);
+  return bcm_infallible::approved;
+}
+
+bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  OPENSSL_memcpy(out_public_key, private_key + 2 * BCM_SLHDSA_SHA2_128S_N,
+                 BCM_SLHDSA_SHA2_128S_N * 2);
+  return bcm_infallible::approved;
+}
+
+// Note that this overreads by a byte. This is fine in the context that it's
+// used.
+static uint64_t load_tree_index(const uint8_t in[8]) {
+  static_assert(SLHDSA_SHA2_128S_TREE_BYTES == 7,
+                "This code needs to be updated");
+  uint64_t index = CRYPTO_load_u64_be(in);
+  index >>= 8;
+  index &= (~(uint64_t)0) >> (64 - SLHDSA_SHA2_128S_TREE_BITS);
+  return index;
+}
+
+// Implements Algorithm 22: slh_sign function (Section 10.2.1, page 39)
+bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]) {
+  const uint8_t *sk_seed = secret_key;
+  const uint8_t *sk_prf = secret_key + BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *pk_seed = secret_key + 2 * BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *pk_root = secret_key + 3 * BCM_SLHDSA_SHA2_128S_N;
+
+  // Derive randomizer R and copy it to signature
+  uint8_t R[BCM_SLHDSA_SHA2_128S_N];
+  slhdsa_thash_prfmsg(R, sk_prf, entropy, header, context, context_len, msg,
+                      msg_len);
+  OPENSSL_memcpy(out_signature, R, BCM_SLHDSA_SHA2_128S_N);
+
+  // Compute message digest
+  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
+  slhdsa_thash_hmsg(digest, R, pk_seed, pk_root, header, context, context_len,
+                    msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
+  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+
+  const uint64_t idx_tree =
+      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+  uint32_t idx_leaf = CRYPTO_load_u16_be(
+      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(addr, idx_tree);
+  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(addr, idx_leaf);
+
+  slhdsa_fors_sign(out_signature + BCM_SLHDSA_SHA2_128S_N, fors_digest, sk_seed,
+                   pk_seed, addr);
+
+  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
+  slhdsa_fors_pk_from_sig(pk_fors, out_signature + BCM_SLHDSA_SHA2_128S_N,
+                          fors_digest, pk_seed, addr);
+
+  slhdsa_ht_sign(
+      out_signature + BCM_SLHDSA_SHA2_128S_N + SLHDSA_SHA2_128S_FORS_BYTES,
+      pk_fors, idx_tree, idx_leaf, sk_seed, pk_seed);
+  return bcm_infallible::approved;
+}
+
+bcm_status BCM_slhdsa_sha2_128s_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  // Construct header for M' as specified in Algorithm 22
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;  // domain separator for pure signing
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t entropy[BCM_SLHDSA_SHA2_128S_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  BCM_slhdsa_sha2_128s_sign_internal(out_signature, private_key, M_prime_header,
+                                     context, context_len, msg, msg_len,
+                                     entropy);
+  return bcm_status::approved;
+}
+
+static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
+                                      size_t *out_context_and_oid_len,
+                                      size_t max_out_context_and_oid,
+                                      const uint8_t *context,
+                                      size_t context_len, int hash_nid,
+                                      size_t hashed_msg_len) {
+  const uint8_t *oid;
+  size_t oid_len;
+  size_t expected_hash_len;
+  switch (hash_nid) {
+    case NID_sha256:
+      oid = kSHA256OID;
+      oid_len = sizeof(kSHA256OID);
+      static_assert(sizeof(kSHA256OID) <= MAX_OID_LENGTH, "");
+      expected_hash_len = 32;
+      break;
+
+    // The SLH-DSA spec only lists SHA-256 and SHA-512. This function also
+    // supports SHA-384, which is non-standard.
+    case NID_sha384:
+      oid = kSHA384OID;
+      oid_len = sizeof(kSHA384OID);
+      static_assert(sizeof(kSHA384OID) <= MAX_OID_LENGTH, "");
+      expected_hash_len = 48;
+      break;
+
+    // If adding a hash function with a larger `oid_len`, update the size of
+    // `context_and_oid` in the callers.
+    default:
+      return 0;
+  }
+
+  if (hashed_msg_len != expected_hash_len) {
+    return 0;
+  }
+
+  *out_context_and_oid_len = context_len + oid_len;
+  if (*out_context_and_oid_len > max_out_context_and_oid) {
+    return 0;
+  }
+
+  OPENSSL_memcpy(out_context_and_oid, context, context_len);
+  OPENSSL_memcpy(out_context_and_oid + context_len, oid, oid_len);
+
+  return 1;
+}
+
+
+bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;  // domain separator for prehashed signing
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_context_and_oid(context_and_oid, &context_and_oid_len,
+                                  sizeof(context_and_oid), context, context_len,
+                                  hash_nid, hashed_msg_len)) {
+    return bcm_status::failure;
+  }
+
+  uint8_t entropy[BCM_SLHDSA_SHA2_128S_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  BCM_slhdsa_sha2_128s_sign_internal(out_signature, private_key, M_prime_header,
+                                     context_and_oid, context_and_oid_len,
+                                     hashed_msg, hashed_msg_len, entropy);
+  return bcm_status::approved;
+}
+
+// Implements Algorithm 24: slh_verify function (Section 10.3, page 41)
+bcm_status BCM_slhdsa_sha2_128s_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  // Construct header for M' as specified in Algorithm 24
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;  // domain separator for pure verification
+  M_prime_header[1] = (uint8_t)context_len;
+
+  return BCM_slhdsa_sha2_128s_verify_internal(
+      signature, signature_len, public_key, M_prime_header, context,
+      context_len, msg, msg_len);
+}
+
+bcm_status BCM_slhdsa_sha2_128s_prehash_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;  // domain separator for prehashed verification
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_context_and_oid(context_and_oid, &context_and_oid_len,
+                                  sizeof(context_and_oid), context, context_len,
+                                  hash_nid, hashed_msg_len)) {
+    return bcm_status::failure;
+  }
+
+  return BCM_slhdsa_sha2_128s_verify_internal(
+      signature, signature_len, public_key, M_prime_header, context_and_oid,
+      context_and_oid_len, hashed_msg, hashed_msg_len);
+}
+
+bcm_status BCM_slhdsa_sha2_128s_verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len) {
+  if (signature_len != BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES) {
+    return bcm_status::failure;
+  }
+  const uint8_t *pk_seed = public_key;
+  const uint8_t *pk_root = public_key + BCM_SLHDSA_SHA2_128S_N;
+
+  const uint8_t *r = signature;
+  const uint8_t *sig_fors = signature + BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *sig_ht = sig_fors + SLHDSA_SHA2_128S_FORS_BYTES;
+
+  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
+  slhdsa_thash_hmsg(digest, r, pk_seed, pk_root, header, context, context_len,
+                    msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
+  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+
+  const uint64_t idx_tree =
+      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+  uint32_t idx_leaf = CRYPTO_load_u16_be(
+      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(addr, idx_tree);
+  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(addr, idx_leaf);
+
+  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
+  slhdsa_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
+
+  if (!slhdsa_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
+                        pk_seed)) {
+    return bcm_status::failure;
+  }
+
+  return bcm_status::approved;
+}