grpc 1.72.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/cipher/e_aesgcmsiv.cc

@@ -28,6 +28,7 @@
 #define EVP_AEAD_AES_GCM_SIV_NONCE_LEN 12
 #define EVP_AEAD_AES_GCM_SIV_TAG_LEN 16
 
+namespace {
 // TODO(davidben): AES-GCM-SIV assembly is not correct for Windows. It must save
 // and restore xmm6 through xmm15.
 #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \
@@ -36,12 +37,10 @@
 
 // Optimised AES-GCM-SIV
 
-namespace {
 struct aead_aes_gcm_siv_asm_ctx {
   alignas(16) uint8_t key[16 * 15];
   int is_128_bit;
 };
-}  // namespace
 
 // The assembly code assumes 8-byte alignment of the EVP_AEAD_CTX's state, and
 // aligns to 16 bytes itself.
@@ -51,15 +50,6 @@ static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) + 8 >=
 static_assert(alignof(union evp_aead_ctx_st_state) >= 8,
               "AEAD state has insufficient alignment");
 
-// asm_ctx_from_ctx returns a 16-byte aligned context pointer from |ctx|.
-static struct aead_aes_gcm_siv_asm_ctx *asm_ctx_from_ctx(
-    const EVP_AEAD_CTX *ctx) {
-  // ctx->state must already be 8-byte aligned. Thus, at most, we may need to
-  // add eight to align it to 16 bytes.
-  const uintptr_t offset = ((uintptr_t)&ctx->state) & 8;
-  return (struct aead_aes_gcm_siv_asm_ctx *)(&ctx->state.opaque[offset]);
-}
-
 extern "C" {
 // aes128gcmsiv_aes_ks writes an AES-128 key schedule for |key| to
 // |out_expanded_key|.
@@ -70,45 +60,7 @@ extern void aes128gcmsiv_aes_ks(const uint8_t key[16],
 // |out_expanded_key|.
 extern void aes256gcmsiv_aes_ks(const uint8_t key[32],
                                 uint8_t out_expanded_key[16 * 15]);
-}
-
-static int aead_aes_gcm_siv_asm_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
-                                     size_t key_len, size_t tag_len) {
-  const size_t key_bits = key_len * 8;
-
-  if (key_bits != 128 && key_bits != 256) {
-    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
-    return 0;  // EVP_AEAD_CTX_init should catch this.
-  }
-
-  if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
-    tag_len = EVP_AEAD_AES_GCM_SIV_TAG_LEN;
-  }
-
-  if (tag_len != EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
-    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
-    return 0;
-  }
-
-  struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = asm_ctx_from_ctx(ctx);
-  assert((((uintptr_t)gcm_siv_ctx) & 15) == 0);
 
-  if (key_bits == 128) {
-    aes128gcmsiv_aes_ks(key, &gcm_siv_ctx->key[0]);
-    gcm_siv_ctx->is_128_bit = 1;
-  } else {
-    aes256gcmsiv_aes_ks(key, &gcm_siv_ctx->key[0]);
-    gcm_siv_ctx->is_128_bit = 0;
-  }
-
-  ctx->tag_len = tag_len;
-
-  return 1;
-}
-
-static void aead_aes_gcm_siv_asm_cleanup(EVP_AEAD_CTX *ctx) {}
-
-extern "C" {
 // aesgcmsiv_polyval_horner updates the POLYVAL value in |in_out_poly| to
 // include a number (|in_blocks|) of 16-byte blocks of data from |in|, given
 // the POLYVAL key in |key|.
@@ -225,12 +177,55 @@ extern void aes256gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out,
                                     size_t in_len);
 }
 
+// asm_ctx_from_ctx returns a 16-byte aligned context pointer from |ctx|.
+struct aead_aes_gcm_siv_asm_ctx *asm_ctx_from_ctx(const EVP_AEAD_CTX *ctx) {
+  // ctx->state must already be 8-byte aligned. Thus, at most, we may need to
+  // add eight to align it to 16 bytes.
+  const uintptr_t offset = ((uintptr_t)&ctx->state) & 8;
+  return (struct aead_aes_gcm_siv_asm_ctx *)(&ctx->state.opaque[offset]);
+}
+
+int aead_aes_gcm_siv_asm_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
+                              size_t key_len, size_t tag_len) {
+  const size_t key_bits = key_len * 8;
+
+  if (key_bits != 128 && key_bits != 256) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
+    return 0;  // EVP_AEAD_CTX_init should catch this.
+  }
+
+  if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
+    tag_len = EVP_AEAD_AES_GCM_SIV_TAG_LEN;
+  }
+
+  if (tag_len != EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
+    return 0;
+  }
+
+  struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = asm_ctx_from_ctx(ctx);
+  assert((((uintptr_t)gcm_siv_ctx) & 15) == 0);
+
+  if (key_bits == 128) {
+    aes128gcmsiv_aes_ks(key, &gcm_siv_ctx->key[0]);
+    gcm_siv_ctx->is_128_bit = 1;
+  } else {
+    aes256gcmsiv_aes_ks(key, &gcm_siv_ctx->key[0]);
+    gcm_siv_ctx->is_128_bit = 0;
+  }
+
+  ctx->tag_len = tag_len;
+
+  return 1;
+}
+
+void aead_aes_gcm_siv_asm_cleanup(EVP_AEAD_CTX *ctx) {}
+
 // gcm_siv_asm_polyval evaluates POLYVAL at |auth_key| on the given plaintext
 // and AD. The result is written to |out_tag|.
-static void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in,
-                                size_t in_len, const uint8_t *ad, size_t ad_len,
-                                const uint8_t auth_key[16],
-                                const uint8_t nonce[12]) {
+void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
+                         const uint8_t *ad, size_t ad_len,
+                         const uint8_t auth_key[16], const uint8_t nonce[12]) {
   OPENSSL_memset(out_tag, 0, 16);
   const size_t ad_blocks = ad_len / 16;
   const size_t in_blocks = in_len / 16;
@@ -283,7 +278,7 @@ static void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in,
 // (same thing in CTR mode) of the final block of a plaintext/ciphertext. It
 // writes |in_len| & 15 bytes to |out| + |in_len|, based on an initial counter
 // derived from |tag|.
-static void aead_aes_gcm_siv_asm_crypt_last_block(
+void aead_aes_gcm_siv_asm_crypt_last_block(
     int is_128_bit, uint8_t *out, const uint8_t *in, size_t in_len,
     const uint8_t tag[16],
     const struct aead_aes_gcm_siv_asm_ctx *enc_key_expanded) {
@@ -309,10 +304,11 @@ static void aead_aes_gcm_siv_asm_crypt_last_block(
 
 // aead_aes_gcm_siv_kdf calculates the record encryption and authentication
 // keys given the |nonce|.
-static void aead_aes_gcm_siv_kdf(
-    int is_128_bit, const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx,
-    uint64_t out_record_auth_key[2], uint64_t out_record_enc_key[4],
-    const uint8_t nonce[12]) {
+void aead_aes_gcm_siv_kdf(int is_128_bit,
+                          const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx,
+                          uint64_t out_record_auth_key[2],
+                          uint64_t out_record_enc_key[4],
+                          const uint8_t nonce[12]) {
   alignas(16) uint8_t padded_nonce[16];
   OPENSSL_memcpy(padded_nonce, nonce, 12);
 
@@ -333,7 +329,7 @@ static void aead_aes_gcm_siv_kdf(
   out_record_auth_key[1] = key_material[2];
 }
 
-static int aead_aes_gcm_siv_asm_seal_scatter(
+int aead_aes_gcm_siv_asm_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
     size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
@@ -399,10 +395,11 @@ static int aead_aes_gcm_siv_asm_seal_scatter(
   return 1;
 }
 
-static int aead_aes_gcm_siv_asm_open_gather(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
-    size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
+int aead_aes_gcm_siv_asm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
+                                     const uint8_t *nonce, size_t nonce_len,
+                                     const uint8_t *in, size_t in_len,
+                                     const uint8_t *in_tag, size_t in_tag_len,
+                                     const uint8_t *ad, size_t ad_len) {
   const uint64_t ad_len_64 = ad_len;
   if (ad_len_64 >= (UINT64_C(1) << 61)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
@@ -499,7 +496,7 @@ static int aead_aes_gcm_siv_asm_open_gather(
   return 1;
 }
 
-static const EVP_AEAD aead_aes_128_gcm_siv_asm = {
+const EVP_AEAD aead_aes_128_gcm_siv_asm = {
     16,                              // key length
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
@@ -516,7 +513,7 @@ static const EVP_AEAD aead_aes_128_gcm_siv_asm = {
     NULL /* tag_len */,
 };
 
-static const EVP_AEAD aead_aes_256_gcm_siv_asm = {
+const EVP_AEAD aead_aes_256_gcm_siv_asm = {
     32,                              // key length
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
@@ -535,7 +532,7 @@ static const EVP_AEAD aead_aes_256_gcm_siv_asm = {
 
 #endif  // X86_64 && !NO_ASM && !WINDOWS
 
-namespace {
+
 struct aead_aes_gcm_siv_ctx {
   union {
     double align;
@@ -544,7 +541,6 @@ struct aead_aes_gcm_siv_ctx {
   block128_f kgk_block;
   unsigned is_256 : 1;
 };
-}  // namespace
 
 static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
                   sizeof(struct aead_aes_gcm_siv_ctx),
@@ -553,8 +549,8 @@ static_assert(alignof(union evp_aead_ctx_st_state) >=
                   alignof(struct aead_aes_gcm_siv_ctx),
               "AEAD state has insufficient alignment");
 
-static int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
-                                 size_t key_len, size_t tag_len) {
+int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len,
+                          size_t tag_len) {
   const size_t key_bits = key_len * 8;
 
   if (key_bits != 128 && key_bits != 256) {
@@ -582,7 +578,7 @@ static int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
   return 1;
 }
 
-static void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {}
+void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {}
 
 // gcm_siv_crypt encrypts (or decrypts—it's the same thing) |in_len| bytes from
 // |in| to |out|, using the block function |enc_block| with |key| in counter
@@ -591,9 +587,9 @@ static void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {}
 // first four bytes are used and the GCM-SIV tweak to the final byte is
 // applied. The |in| and |out| pointers may be equal but otherwise must not
 // alias.
-static void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
-                          const uint8_t initial_counter[AES_BLOCK_SIZE],
-                          block128_f enc_block, const AES_KEY *key) {
+void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
+                   const uint8_t initial_counter[AES_BLOCK_SIZE],
+                   block128_f enc_block, const AES_KEY *key) {
   uint8_t counter[16];
 
   OPENSSL_memcpy(counter, initial_counter, AES_BLOCK_SIZE);
@@ -617,45 +613,125 @@ static void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
   }
 }
 
+
+// POLYVAL.
+//
+// POLYVAL is a polynomial authenticator that operates over a field very
+// similar to the one that GHASH uses. See
+// https://www.rfc-editor.org/rfc/rfc8452.html#section-3.
+
+// POLYVAL(H, X_1, ..., X_n) =
+// ByteReverse(GHASH(mulX_GHASH(ByteReverse(H)), ByteReverse(X_1), ...,
+// ByteReverse(X_n))).
+//
+// See https://www.rfc-editor.org/rfc/rfc8452.html#appendix-A.
+
+struct polyval_ctx {
+  uint8_t S[16];
+  u128 Htable[16];
+  gmult_func gmult;
+  ghash_func ghash;
+};
+
+// byte_reverse reverses the order of the bytes in |b->c|.
+void byte_reverse(uint8_t b[16]) {
+  uint64_t hi = CRYPTO_load_u64_le(b);
+  uint64_t lo = CRYPTO_load_u64_le(b + 8);
+  CRYPTO_store_u64_le(b, CRYPTO_bswap8(lo));
+  CRYPTO_store_u64_le(b + 8, CRYPTO_bswap8(hi));
+}
+
+// reverse_and_mulX_ghash interprets |b| as a reversed element of the GHASH
+// field, multiplies that by 'x' and serialises the result back into |b|, but
+// with GHASH's backwards bit ordering.
+void reverse_and_mulX_ghash(uint8_t b[16]) {
+  uint64_t hi = CRYPTO_load_u64_le(b);
+  uint64_t lo = CRYPTO_load_u64_le(b + 8);
+  const crypto_word_t carry = constant_time_eq_w(hi & 1, 1);
+  hi >>= 1;
+  hi |= lo << 63;
+  lo >>= 1;
+  lo ^= ((uint64_t)constant_time_select_w(carry, 0xe1, 0)) << 56;
+
+  CRYPTO_store_u64_le(b, CRYPTO_bswap8(lo));
+  CRYPTO_store_u64_le(b + 8, CRYPTO_bswap8(hi));
+}
+
+void crypto_polyval_init(struct polyval_ctx *ctx, const uint8_t key[16]) {
+  alignas(8) uint8_t H[16];
+  OPENSSL_memcpy(H, key, 16);
+  reverse_and_mulX_ghash(H);
+
+  CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, ctx->Htable, H);
+  OPENSSL_memset(&ctx->S, 0, sizeof(ctx->S));
+}
+
+void crypto_polyval_update_blocks(struct polyval_ctx *ctx, const uint8_t *in,
+                                  size_t in_len) {
+  assert((in_len & 15) == 0);
+  alignas(8) uint8_t buf[32 * 16];
+
+  while (in_len > 0) {
+    size_t todo = in_len;
+    if (todo > sizeof(buf)) {
+      todo = sizeof(buf);
+    }
+    OPENSSL_memcpy(buf, in, todo);
+    in += todo;
+    in_len -= todo;
+
+    size_t blocks = todo / 16;
+    for (size_t i = 0; i < blocks; i++) {
+      byte_reverse(buf + 16 * i);
+    }
+
+    ctx->ghash(ctx->S, ctx->Htable, buf, todo);
+  }
+}
+
+void crypto_polyval_finish(const struct polyval_ctx *ctx, uint8_t out[16]) {
+  OPENSSL_memcpy(out, &ctx->S, 16);
+  byte_reverse(out);
+}
+
 // gcm_siv_polyval evaluates POLYVAL at |auth_key| on the given plaintext and
 // AD. The result is written to |out_tag|.
-static void gcm_siv_polyval(
-    uint8_t out_tag[16], const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len, const uint8_t auth_key[16],
-    const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
+void gcm_siv_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
+                     const uint8_t *ad, size_t ad_len,
+                     const uint8_t auth_key[16],
+                     const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
   struct polyval_ctx polyval_ctx;
-  CRYPTO_POLYVAL_init(&polyval_ctx, auth_key);
+  crypto_polyval_init(&polyval_ctx, auth_key);
 
-  CRYPTO_POLYVAL_update_blocks(&polyval_ctx, ad, ad_len & ~15);
+  crypto_polyval_update_blocks(&polyval_ctx, ad, ad_len & ~15);
 
   uint8_t scratch[16];
   if (ad_len & 15) {
     OPENSSL_memset(scratch, 0, sizeof(scratch));
     OPENSSL_memcpy(scratch, &ad[ad_len & ~15], ad_len & 15);
-    CRYPTO_POLYVAL_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
+    crypto_polyval_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
   }
 
-  CRYPTO_POLYVAL_update_blocks(&polyval_ctx, in, in_len & ~15);
+  crypto_polyval_update_blocks(&polyval_ctx, in, in_len & ~15);
   if (in_len & 15) {
     OPENSSL_memset(scratch, 0, sizeof(scratch));
     OPENSSL_memcpy(scratch, &in[in_len & ~15], in_len & 15);
-    CRYPTO_POLYVAL_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
+    crypto_polyval_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
   }
 
   uint8_t length_block[16];
   CRYPTO_store_u64_le(length_block, ((uint64_t)ad_len) * 8);
   CRYPTO_store_u64_le(length_block + 8, ((uint64_t)in_len) * 8);
-  CRYPTO_POLYVAL_update_blocks(&polyval_ctx, length_block,
+  crypto_polyval_update_blocks(&polyval_ctx, length_block,
                                sizeof(length_block));
 
-  CRYPTO_POLYVAL_finish(&polyval_ctx, out_tag);
+  crypto_polyval_finish(&polyval_ctx, out_tag);
   for (size_t i = 0; i < EVP_AEAD_AES_GCM_SIV_NONCE_LEN; i++) {
     out_tag[i] ^= nonce[i];
   }
   out_tag[15] &= 0x7f;
 }
 
-namespace {
 // gcm_siv_record_keys contains the keys used for a specific GCM-SIV record.
 struct gcm_siv_record_keys {
   uint8_t auth_key[16];
@@ -665,13 +741,12 @@ struct gcm_siv_record_keys {
   } enc_key;
   block128_f enc_block;
 };
-}  // namespace
 
 // gcm_siv_keys calculates the keys for a specific GCM-SIV record with the
 // given nonce and writes them to |*out_keys|.
-static void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
-                         struct gcm_siv_record_keys *out_keys,
-                         const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
+void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
+                  struct gcm_siv_record_keys *out_keys,
+                  const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
   const AES_KEY *const key = &gcm_siv_ctx->ks.ks;
   uint8_t key_material[(128 /* POLYVAL key */ + 256 /* max AES key */) / 8];
   const size_t blocks_needed = gcm_siv_ctx->is_256 ? 6 : 4;
@@ -701,11 +776,13 @@ static void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
                   key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
 }
 
-static int aead_aes_gcm_siv_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
-    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
+int aead_aes_gcm_siv_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
+                                  uint8_t *out_tag, size_t *out_tag_len,
+                                  size_t max_out_tag_len, const uint8_t *nonce,
+                                  size_t nonce_len, const uint8_t *in,
+                                  size_t in_len, const uint8_t *extra_in,
+                                  size_t extra_in_len, const uint8_t *ad,
+                                  size_t ad_len) {
   const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx =
       (struct aead_aes_gcm_siv_ctx *)&ctx->state;
   const uint64_t in_len_64 = in_len;
@@ -742,12 +819,11 @@ static int aead_aes_gcm_siv_seal_scatter(
   return 1;
 }
 
-static int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                        const uint8_t *nonce, size_t nonce_len,
-                                        const uint8_t *in, size_t in_len,
-                                        const uint8_t *in_tag,
-                                        size_t in_tag_len, const uint8_t *ad,
-                                        size_t ad_len) {
+int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
+                                 const uint8_t *nonce, size_t nonce_len,
+                                 const uint8_t *in, size_t in_len,
+                                 const uint8_t *in_tag, size_t in_tag_len,
+                                 const uint8_t *ad, size_t ad_len) {
   const uint64_t ad_len_64 = ad_len;
   if (ad_len_64 >= (UINT64_C(1) << 61)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
@@ -786,7 +862,7 @@ static int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
   return 1;
 }
 
-static const EVP_AEAD aead_aes_128_gcm_siv = {
+const EVP_AEAD aead_aes_128_gcm_siv = {
     16,                              // key length
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
@@ -803,7 +879,7 @@ static const EVP_AEAD aead_aes_128_gcm_siv = {
     NULL /* tag_len */,
 };
 
-static const EVP_AEAD aead_aes_256_gcm_siv = {
+const EVP_AEAD aead_aes_256_gcm_siv = {
     32,                              // key length
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
@@ -819,6 +895,7 @@ static const EVP_AEAD aead_aes_256_gcm_siv = {
     NULL /* get_iv */,
     NULL /* tag_len */,
 };
+}  // namespace
 
 #if defined(AES_GCM_SIV_ASM)
 

data/third_party/boringssl-with-bazel/src/crypto/cipher/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_CIPHER_EXTRA_INTERNAL_H
-#define OPENSSL_HEADER_CIPHER_EXTRA_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_CIPHER_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_CIPHER_INTERNAL_H
 
 #include <assert.h>
 #include <stdlib.h>
@@ -237,4 +237,4 @@ inline void chacha20_poly1305_seal(uint8_t *out_ciphertext,
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_CIPHER_EXTRA_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_CIPHER_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/cms/cms.cc

@@ -0,0 +1,172 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/cms.h>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/mem.h>
+#include <openssl/x509.h>
+
+#include "../pkcs7/internal.h"
+
+
+// TODO(davidben): Should we move the core PKCS#7 / CMS implementation into
+// crypto/cms instead of crypto/pkcs7? CMS is getting new features while PKCS#7
+// is not.
+OPENSSL_DECLARE_ERROR_REASON(CMS, CERTIFICATE_HAS_NO_KEYID)
+
+struct CMS_SignerInfo_st {
+  X509 *signcert = nullptr;
+  EVP_PKEY *pkey = nullptr;
+  const EVP_MD *md = nullptr;
+  bool use_key_id = false;
+};
+
+struct CMS_ContentInfo_st {
+  bool has_signer_info = false;
+  CMS_SignerInfo signer_info;
+  uint8_t *der = nullptr;
+  size_t der_len = 0;
+};
+
+CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                          BIO *data, uint32_t flags) {
+  // We only support external signatures and do not support embedding
+  // certificates in SignedData.
+  if ((flags & CMS_DETACHED) == 0 || sk_X509_num(certs) != 0) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return nullptr;
+  }
+
+  bssl::UniquePtr<CMS_ContentInfo> cms(
+      static_cast<CMS_ContentInfo *>(OPENSSL_zalloc(sizeof(CMS_ContentInfo))));
+  if (cms == nullptr) {
+    return nullptr;
+  }
+
+  if (pkey != nullptr &&
+      !CMS_add1_signer(cms.get(), signcert, pkey, /*md=*/nullptr, flags)) {
+    return nullptr;
+  }
+
+  // We don't actually use streaming mode, but Linux passes |CMS_STREAM| to
+  // |CMS_sign| and OpenSSL interprets it as an alias for |CMS_PARTIAL| in this
+  // context.
+  if ((flags & (CMS_PARTIAL | CMS_STREAM)) == 0 &&
+      !CMS_final(cms.get(), data, NULL, flags)) {
+    return nullptr;
+  }
+
+  return cms.release();
+}
+
+void CMS_ContentInfo_free(CMS_ContentInfo *cms) {
+  if (cms == nullptr) {
+    return;
+  }
+  X509_free(cms->signer_info.signcert);
+  EVP_PKEY_free(cms->signer_info.pkey);
+  OPENSSL_free(cms->der);
+  OPENSSL_free(cms);
+}
+
+CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert,
+                                EVP_PKEY *pkey, const EVP_MD *md,
+                                uint32_t flags) {
+  if (  // Already finalized.
+      cms->der_len != 0 ||
+      // We only support one signer.
+      cms->has_signer_info ||
+      // We do not support configuring a signer in multiple steps. (In OpenSSL,
+      // this is used to configure attributes.
+      (flags & CMS_PARTIAL) != 0 ||
+      // We do not support embedding certificates in SignedData.
+      (flags & CMS_NOCERTS) == 0 ||
+      // We do not support attributes in SignedData.
+      (flags & CMS_NOATTR) == 0) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return nullptr;
+  }
+
+  if (signcert == nullptr || pkey == nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_PASSED_NULL_PARAMETER);
+    return nullptr;
+  }
+
+  if (!X509_check_private_key(signcert, pkey)) {
+    OPENSSL_PUT_ERROR(CMS, CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+    return nullptr;
+  }
+
+  // Default to SHA-256.
+  if (md == nullptr) {
+    md = EVP_sha256();
+  }
+
+  // Save information for later.
+  cms->has_signer_info = true;
+  cms->signer_info.signcert = bssl::UpRef(signcert).release();
+  cms->signer_info.pkey = bssl::UpRef(pkey).release();
+  cms->signer_info.md = md;
+  cms->signer_info.use_key_id = (flags & CMS_USE_KEYID) != 0;
+  return &cms->signer_info;
+}
+
+int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, uint32_t flags) {
+  if (  // Already finalized.
+      cms->der_len != 0 ||
+      // Require a SignerInfo. We do not support signature-less SignedDatas.
+      !cms->has_signer_info ||
+      // We only support the straightforward passthrough mode, without S/MIME
+      // translations.
+      (flags & CMS_BINARY) == 0 ||
+      // We do not support |dcont|. It is unclear what it does.
+      dcont != nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  bssl::ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 2048) ||
+      !pkcs7_add_external_signature(cbb.get(), cms->signer_info.signcert,
+                                    cms->signer_info.pkey, cms->signer_info.md,
+                                    data, cms->signer_info.use_key_id) ||
+      !CBB_finish(cbb.get(), &cms->der, &cms->der_len)) {
+    return 0;
+  }
+
+  return 1;
+}
+
+int i2d_CMS_bio(BIO *out, CMS_ContentInfo *cms) {
+  if (cms->der_len == 0) {
+    // Not yet finalized.
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  return BIO_write_all(out, cms->der, cms->der_len);
+}
+
+int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags) {
+  // We do not support streaming mode.
+  if ((flags & CMS_STREAM) != 0 || in != nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  return i2d_CMS_bio(out, cms);
+}