grpc 1.72.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/bn/sqrt.cc

@@ -0,0 +1,93 @@
+// Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/bn.h>
+
+#include <openssl/err.h>
+
+
+int BN_sqrt(BIGNUM *out_sqrt, const BIGNUM *in, BN_CTX *ctx) {
+  BIGNUM *estimate, *tmp, *delta, *last_delta, *tmp2;
+  int ok = 0, last_delta_valid = 0;
+
+  if (in->neg) {
+    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
+    return 0;
+  }
+  if (BN_is_zero(in)) {
+    BN_zero(out_sqrt);
+    return 1;
+  }
+
+  bssl::BN_CTXScope scope(ctx);
+  if (out_sqrt == in) {
+    estimate = BN_CTX_get(ctx);
+  } else {
+    estimate = out_sqrt;
+  }
+  tmp = BN_CTX_get(ctx);
+  last_delta = BN_CTX_get(ctx);
+  delta = BN_CTX_get(ctx);
+  if (estimate == NULL || tmp == NULL || last_delta == NULL || delta == NULL) {
+    goto err;
+  }
+
+  // We estimate that the square root of an n-bit number is 2^{n/2}.
+  if (!BN_lshift(estimate, BN_value_one(), BN_num_bits(in)/2)) {
+    goto err;
+  }
+
+  // This is Newton's method for finding a root of the equation |estimate|^2 -
+  // |in| = 0.
+  for (;;) {
+    // |estimate| = 1/2 * (|estimate| + |in|/|estimate|)
+    if (!BN_div(tmp, NULL, in, estimate, ctx) ||
+        !BN_add(tmp, tmp, estimate) ||
+        !BN_rshift1(estimate, tmp) ||
+        // |tmp| = |estimate|^2
+        !BN_sqr(tmp, estimate, ctx) ||
+        // |delta| = |in| - |tmp|
+        !BN_sub(delta, in, tmp)) {
+      OPENSSL_PUT_ERROR(BN, ERR_R_BN_LIB);
+      goto err;
+    }
+
+    delta->neg = 0;
+    // The difference between |in| and |estimate| squared is required to always
+    // decrease. This ensures that the loop always terminates, but I don't have
+    // a proof that it always finds the square root for a given square.
+    if (last_delta_valid && BN_cmp(delta, last_delta) >= 0) {
+      break;
+    }
+
+    last_delta_valid = 1;
+
+    tmp2 = last_delta;
+    last_delta = delta;
+    delta = tmp2;
+  }
+
+  if (BN_cmp(tmp, in) != 0) {
+    OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
+    goto err;
+  }
+
+  ok = 1;
+
+err:
+  if (ok && out_sqrt == in && !BN_copy(out_sqrt, estimate)) {
+    ok = 0;
+  }
+  return ok;
+}

data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbb.cc

@@ -481,6 +481,19 @@ void CBB_discard_child(CBB *cbb) {
   cbb->child = NULL;
 }
 
+int CBB_add_asn1_element(CBB *cbb, CBS_ASN1_TAG tag, const uint8_t *data,
+                         size_t data_len) {
+  CBB child;
+  if (!CBB_add_asn1(cbb, &child, tag) ||
+      !CBB_add_bytes(&child, data, data_len) ||  //
+      !CBB_flush(cbb)) {
+    cbb_on_error(cbb);
+    return 0;
+  }
+
+  return 1;
+}
+
 int CBB_add_asn1_uint64(CBB *cbb, uint64_t value) {
   return CBB_add_asn1_uint64_with_tag(cbb, value, CBS_ASN1_INTEGER);
 }
@@ -557,14 +570,7 @@ err:
 }
 
 int CBB_add_asn1_octet_string(CBB *cbb, const uint8_t *data, size_t data_len) {
-  CBB child;
-  if (!CBB_add_asn1(cbb, &child, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&child, data, data_len) || !CBB_flush(cbb)) {
-    cbb_on_error(cbb);
-    return 0;
-  }
-
-  return 1;
+  return CBB_add_asn1_element(cbb, CBS_ASN1_OCTETSTRING, data, data_len);
 }
 
 int CBB_add_asn1_bool(CBB *cbb, int value) {

data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbs.cc

@@ -410,7 +410,7 @@ int CBS_get_any_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG *out_tag) {
     return 0;
   }
 
-  if (!CBS_skip(out, header_len)) {
+  if (out && !CBS_skip(out, header_len)) {
     assert(0);
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/bytestring/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_BYTESTRING_INTERNAL_H
-#define OPENSSL_HEADER_BYTESTRING_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -71,4 +71,4 @@ int CBB_finish_i2d(CBB *cbb, uint8_t **outp);
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_BYTESTRING_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/chacha/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_CHACHA_INTERNAL
-#define OPENSSL_HEADER_CHACHA_INTERNAL
+#ifndef OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -37,7 +37,7 @@ void CRYPTO_hchacha20(uint8_t out[32], const uint8_t key[32],
 inline int ChaCha20_ctr32_ssse3_capable(size_t len) {
   // Unlike the x86_64 version, the x86 SSSE3 routine runs for all non-zero
   // lengths.
-  return len > 0 && CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+  return len > 0 && CRYPTO_is_SSSE3_capable();
 }
 void ChaCha20_ctr32_ssse3(uint8_t *out, const uint8_t *in, size_t in_len,
                           const uint32_t key[8], const uint32_t counter[4]);
@@ -99,4 +99,4 @@ void ChaCha20_ctr32_nohw(uint8_t *out, const uint8_t *in, size_t in_len,
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_CHACHA_INTERNAL
+#endif  // OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/cipher/derive_key.cc

@@ -25,7 +25,6 @@
 int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
                    const uint8_t *salt, const uint8_t *data, size_t data_len,
                    unsigned count, uint8_t *key, uint8_t *iv) {
-  EVP_MD_CTX c;
   uint8_t md_buf[EVP_MAX_MD_SIZE];
   unsigned addmd = 0;
   unsigned mds = 0, i;
@@ -37,36 +36,36 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
   assert(nkey <= EVP_MAX_KEY_LENGTH);
   assert(niv <= EVP_MAX_IV_LENGTH);
 
-  if (data == NULL) {
+  if (data == nullptr) {
     return nkey;
   }
 
-  EVP_MD_CTX_init(&c);
+  bssl::ScopedEVP_MD_CTX c;
   for (;;) {
-    if (!EVP_DigestInit_ex(&c, md, NULL)) {
+    if (!EVP_DigestInit_ex(c.get(), md, nullptr)) {
       goto err;
     }
     if (addmd++) {
-      if (!EVP_DigestUpdate(&c, md_buf, mds)) {
+      if (!EVP_DigestUpdate(c.get(), md_buf, mds)) {
         goto err;
       }
     }
-    if (!EVP_DigestUpdate(&c, data, data_len)) {
+    if (!EVP_DigestUpdate(c.get(), data, data_len)) {
       goto err;
     }
-    if (salt != NULL) {
-      if (!EVP_DigestUpdate(&c, salt, PKCS5_SALT_LEN)) {
+    if (salt != nullptr) {
+      if (!EVP_DigestUpdate(c.get(), salt, PKCS5_SALT_LEN)) {
         goto err;
       }
     }
-    if (!EVP_DigestFinal_ex(&c, md_buf, &mds)) {
+    if (!EVP_DigestFinal_ex(c.get(), md_buf, &mds)) {
       goto err;
     }
 
     for (i = 1; i < count; i++) {
-      if (!EVP_DigestInit_ex(&c, md, NULL) ||
-          !EVP_DigestUpdate(&c, md_buf, mds) ||
-          !EVP_DigestFinal_ex(&c, md_buf, &mds)) {
+      if (!EVP_DigestInit_ex(c.get(), md, nullptr) ||
+          !EVP_DigestUpdate(c.get(), md_buf, mds) ||
+          !EVP_DigestFinal_ex(c.get(), md_buf, &mds)) {
         goto err;
       }
     }
@@ -77,7 +76,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
         if (nkey == 0 || i == mds) {
           break;
         }
-        if (key != NULL) {
+        if (key != nullptr) {
           *(key++) = md_buf[i];
         }
         nkey--;
@@ -90,7 +89,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
         if (niv == 0 || i == mds) {
           break;
         }
-        if (iv != NULL) {
+        if (iv != nullptr) {
           *(iv++) = md_buf[i];
         }
         niv--;
@@ -104,7 +103,6 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
   rv = EVP_CIPHER_key_length(type);
 
 err:
-  EVP_MD_CTX_cleanup(&c);
   OPENSSL_cleanse(md_buf, EVP_MAX_MD_SIZE);
   return rv;
 }

data/third_party/boringssl-with-bazel/src/crypto/cipher/e_aeseax.cc

@@ -0,0 +1,289 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/aead.h>
+
+#include <assert.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <openssl/aes.h>
+#include <openssl/base.h>
+#include <openssl/cipher.h>
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+#include "../fipsmodule/cipher/internal.h"
+#include "../internal.h"
+
+// Implementation of AES-EAX defined in
+// https://www.iacr.org/archive/fse2004/30170391/30170391.pdf.
+
+#define EVP_AEAD_AES_EAX_TAG_LEN AES_BLOCK_SIZE
+
+struct aead_aes_eax_ctx {
+  union {
+    double align;
+    AES_KEY ks;
+  } ks;
+  uint8_t b[AES_BLOCK_SIZE];
+  uint8_t p[AES_BLOCK_SIZE];
+};
+
+static void mult_by_X(uint8_t out[AES_BLOCK_SIZE],
+                      const uint8_t in[AES_BLOCK_SIZE]) {
+  const crypto_word_t in_hi = CRYPTO_load_word_be(in);
+  for (size_t i = 0; i < AES_BLOCK_SIZE - 1; ++i) {
+    out[i] = (in[i] << 1) | (in[i + 1] >> 7);
+  }
+  // Carry over 0x87 if msb is 1, 0x00 if msb is 0.
+  out[AES_BLOCK_SIZE - 1] = in[AES_BLOCK_SIZE - 1] << 1;
+  const uint8_t p = 0x87;
+  constant_time_conditional_memxor(out + AES_BLOCK_SIZE - 1, &p, /*n=*/1,
+                                   constant_time_msb_w(in_hi));
+}
+
+static int aead_aes_eax_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
+                             size_t key_len, size_t tag_len) {
+  struct aead_aes_eax_ctx *aes_ctx = (struct aead_aes_eax_ctx *)&ctx->state;
+
+  if (key_len != 16 && key_len != 32) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
+    return 0;
+  }
+
+  if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
+    tag_len = EVP_AEAD_AES_EAX_TAG_LEN;
+  }
+
+  if (tag_len != EVP_AEAD_AES_EAX_TAG_LEN) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_TAG_SIZE);
+    return 0;
+  }
+
+  if (AES_set_encrypt_key(key, /*bits=*/key_len * 8, &aes_ctx->ks.ks) != 0) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_AES_KEY_SETUP_FAILED);
+    return 0;
+  }
+  ctx->tag_len = tag_len;
+
+  // L <- Ek(0^n).
+  OPENSSL_memset(aes_ctx->b, 0, sizeof(aes_ctx->b));
+  AES_encrypt(aes_ctx->b, aes_ctx->b, &aes_ctx->ks.ks);
+  // B <- 2L.
+  mult_by_X(aes_ctx->b, aes_ctx->b);
+  // P <- 4L = 2B.
+  mult_by_X(aes_ctx->p, aes_ctx->b);
+  return 1;
+}
+
+static void aead_aes_eax_cleanup(EVP_AEAD_CTX *ctx) {}
+
+// Implements the CBK function in the paper.
+static void cbk_block(const struct aead_aes_eax_ctx *aes_ctx,
+                      const uint8_t in[AES_BLOCK_SIZE],
+                      uint8_t out[AES_BLOCK_SIZE]) {
+  CRYPTO_xor16(out, in, out);
+  AES_encrypt(out, out, &aes_ctx->ks.ks);
+}
+
+// Precondition: in_len <= AES_BLOCK_SIZE.
+static void pad(const struct aead_aes_eax_ctx *aes_ctx,
+                uint8_t out[AES_BLOCK_SIZE], const uint8_t *in, size_t in_len) {
+  assert(in_len <= AES_BLOCK_SIZE);
+  if (in_len == AES_BLOCK_SIZE) {
+    CRYPTO_xor16(out, aes_ctx->b, in);
+    return;
+  }
+  OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
+  OPENSSL_memcpy(out, in, in_len);
+  out[in_len] = 0x80;
+  CRYPTO_xor16(out, aes_ctx->p, out);
+}
+
+static void omac(const struct aead_aes_eax_ctx *aes_ctx,
+                 uint8_t out[AES_BLOCK_SIZE], const uint8_t *in,
+                 size_t in_len) {
+  if (in_len == 0) {
+    // CBK(pad(M;B,P)) = CBK(B). Avoiding padding to skip a copy.
+    cbk_block(aes_ctx, aes_ctx->b, out);
+    return;
+  }
+  // CBK(M1) = Ek(M1 ^ 0^n)
+  AES_encrypt(out, out, &aes_ctx->ks.ks);
+  while (in_len > AES_BLOCK_SIZE) {
+    // Full blocks, no padding needed.
+    cbk_block(aes_ctx, in, out);
+    in += AES_BLOCK_SIZE;
+    in_len -= AES_BLOCK_SIZE;
+  }
+  // Last block to be padded.
+  uint8_t padded_block[AES_BLOCK_SIZE];
+  pad(aes_ctx, padded_block, in, in_len);
+  cbk_block(aes_ctx, padded_block, out);
+}
+
+static void omac_with_tag(const struct aead_aes_eax_ctx *aes_ctx,
+                          uint8_t out[AES_BLOCK_SIZE], const uint8_t *in,
+                          size_t in_len, int tag) {
+  OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
+  out[AES_BLOCK_SIZE - 1] = tag;
+  omac(aes_ctx, out, in, in_len);
+}
+
+// Encrypts/decrypts |in_len| bytes from |in| to |out| using AES-CTR with |n| as
+// the IV.
+static void aes_ctr(const struct aead_aes_eax_ctx *aes_ctx, uint8_t *out,
+                    const uint8_t n[AES_BLOCK_SIZE], const uint8_t *in,
+                    size_t in_len) {
+  uint8_t ivec[AES_BLOCK_SIZE];
+  OPENSSL_memcpy(ivec, n, AES_BLOCK_SIZE);
+
+  uint8_t unused_ecount_buf[AES_BLOCK_SIZE];
+  unsigned int unused_num = 0;
+  AES_ctr128_encrypt(in, out, in_len, &aes_ctx->ks.ks, ivec, unused_ecount_buf,
+                     &unused_num);
+}
+
+static int aead_aes_eax_seal_scatter(
+    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
+    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
+  assert(extra_in_len == 0);
+  // We use the full 128 bits of the nonce as counter, so no need to check the
+  // plaintext size.
+
+  if (max_out_tag_len < ctx->tag_len) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+
+  if (nonce_len != 12 && nonce_len != 16) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
+    return 0;
+  }
+
+  const struct aead_aes_eax_ctx *aes_ctx =
+      (struct aead_aes_eax_ctx *)&ctx->state;
+
+  // N <- OMAC(0 || nonce)
+  uint8_t n[AES_BLOCK_SIZE];
+  omac_with_tag(aes_ctx, n, nonce, nonce_len, /*tag=*/0);
+  // H <- OMAC(1 || ad)
+  uint8_t h[AES_BLOCK_SIZE];
+  omac_with_tag(aes_ctx, h, ad, ad_len, /*tag=*/1);
+
+  // C <- CTR^{N}_{K}(M)
+  aes_ctr(aes_ctx, out, n, in, in_len);
+
+  // MAC <- OMAC(2 || C)
+  omac_with_tag(aes_ctx, out_tag, out, in_len, /*tag=*/2);
+  // MAC <- N ^ C ^ H
+  CRYPTO_xor16(out_tag, n, out_tag);
+  CRYPTO_xor16(out_tag, h, out_tag);
+
+  *out_tag_len = ctx->tag_len;
+  return 1;
+}
+
+static int aead_aes_eax_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
+                                    const uint8_t *nonce, size_t nonce_len,
+                                    const uint8_t *in, size_t in_len,
+                                    const uint8_t *in_tag, size_t in_tag_len,
+                                    const uint8_t *ad, size_t ad_len) {
+  const uint64_t ad_len_64 = ad_len;
+  if (ad_len_64 >= (UINT64_C(1) << 61)) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
+    return 0;
+  }
+
+  const uint64_t in_len_64 = in_len;
+  if (in_tag_len != EVP_AEAD_AES_EAX_TAG_LEN ||
+      in_len_64 > (UINT64_C(1) << 36) + AES_BLOCK_SIZE) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
+    return 0;
+  }
+
+  if (nonce_len != 12 && nonce_len != 16) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
+    return 0;
+  }
+
+  const struct aead_aes_eax_ctx *aes_ctx =
+      (struct aead_aes_eax_ctx *)&ctx->state;
+
+  // N <- OMAC(0 || nonce)
+  uint8_t n[AES_BLOCK_SIZE];
+  omac_with_tag(aes_ctx, n, nonce, nonce_len, /*tag=*/0);
+  // H <- OMAC(1 || ad)
+  uint8_t h[AES_BLOCK_SIZE];
+  omac_with_tag(aes_ctx, h, ad, ad_len, /*tag=*/1);
+
+  // MAC <- OMAC(2 || C)
+  uint8_t mac[AES_BLOCK_SIZE];
+  omac_with_tag(aes_ctx, mac, in, in_len, /*tag=*/2);
+  // MAC <- N ^ C ^ H
+  CRYPTO_xor16(mac, n, mac);
+  CRYPTO_xor16(mac, h, mac);
+
+  if (CRYPTO_memcmp(mac, in_tag, in_tag_len) != 0) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
+    return 0;
+  }
+
+  // M <- CTR^{N}_{K}(C)
+  aes_ctr(aes_ctx, out, n, in, in_len);
+  return 1;
+}
+
+static const EVP_AEAD aead_aes_128_eax = {
+    16,                        // AES key size
+    16,                        // nonce length
+    EVP_AEAD_AES_EAX_TAG_LEN,  // overhead
+    EVP_AEAD_AES_EAX_TAG_LEN,  // max tag length
+    0,                         // seal_scatter_supports_extra_in
+
+    aead_aes_eax_init,
+    NULL,  // init_with_direction
+    aead_aes_eax_cleanup,
+    NULL,  // open
+    aead_aes_eax_seal_scatter,
+    aead_aes_eax_open_gather,
+    NULL,  // get_iv
+    NULL,  // tag_len
+};
+
+static const EVP_AEAD aead_aes_256_eax = {
+    32,                        // AES key size
+    16,                        // nonce length
+    EVP_AEAD_AES_EAX_TAG_LEN,  // overhead
+    EVP_AEAD_AES_EAX_TAG_LEN,  // max tag length
+    0,                         // seal_scatter_supports_extra_in
+
+    aead_aes_eax_init,
+    NULL,  // init_with_direction
+    aead_aes_eax_cleanup,
+    NULL,  // open
+    aead_aes_eax_seal_scatter,
+    aead_aes_eax_open_gather,
+    NULL,  // get_iv
+    NULL,  // tag_len
+};
+
+const EVP_AEAD *EVP_aead_aes_128_eax(void) { return &aead_aes_128_eax; }
+
+const EVP_AEAD *EVP_aead_aes_256_eax(void) { return &aead_aes_256_eax; }