grpc 1.80.0 → 1.81.0

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/prime.cc.inc

@@ -290,7 +290,9 @@ void *BN_GENCB_get_arg(const BN_GENCB *callback) { return callback->arg; }
 int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
                          const BIGNUM *rem, BN_GENCB *cb) {
   BIGNUM *t;
+  int found = 0;
   int i, j, c1 = 0;
+  BN_CTX *ctx;
   int checks = BN_prime_checks_for_size(bits);
 
   if (bits < 2) {
@@ -303,43 +305,43 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
     return 0;
   }
 
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
-    return 0;
+  ctx = BN_CTX_new();
+  if (ctx == NULL) {
+    goto err;
   }
-  bssl::BN_CTXScope scope(ctx.get());
-  t = BN_CTX_get(ctx.get());
+  BN_CTX_start(ctx);
+  t = BN_CTX_get(ctx);
   if (!t) {
-    return 0;
+    goto err;
   }
 
 loop:
   // make a random number and set the top and bottom bits
   if (add == NULL) {
     if (!probable_prime(ret, bits)) {
-      return 0;
+      goto err;
     }
   } else {
     if (safe) {
-      if (!probable_prime_dh_safe(ret, bits, add, rem, ctx.get())) {
-        return 0;
+      if (!probable_prime_dh_safe(ret, bits, add, rem, ctx)) {
+        goto err;
       }
     } else {
-      if (!probable_prime_dh(ret, bits, add, rem, ctx.get())) {
-        return 0;
+      if (!probable_prime_dh(ret, bits, add, rem, ctx)) {
+        goto err;
       }
     }
   }
 
   if (!BN_GENCB_call(cb, BN_GENCB_GENERATED, c1++)) {
     // aborted
-    return 0;
+    goto err;
   }
 
   if (!safe) {
-    i = BN_is_prime_fasttest_ex(ret, checks, ctx.get(), 0, cb);
+    i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb);
     if (i == -1) {
-      return 0;
+      goto err;
     } else if (i == 0) {
       goto loop;
     }
@@ -347,7 +349,7 @@ loop:
     // for "safe prime" generation, check that (p-1)/2 is prime. Since a prime
     // is odd, We just need to divide by 2
     if (!BN_rshift1(t, ret)) {
-      return 0;
+      goto err;
     }
 
     // Interleave |ret| and |t|'s primality tests to avoid paying the full
@@ -356,29 +358,37 @@ loop:
     // TODO(davidben): This doesn't quite work because an iteration count of 1
     // still runs the blinding mechanism.
     for (i = 0; i < checks; i++) {
-      j = BN_is_prime_fasttest_ex(ret, 1, ctx.get(), 0, NULL);
+      j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, NULL);
       if (j == -1) {
-        return 0;
+        goto err;
       } else if (j == 0) {
         goto loop;
       }
 
-      j = BN_is_prime_fasttest_ex(t, 1, ctx.get(), 0, NULL);
+      j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, NULL);
       if (j == -1) {
-        return 0;
+        goto err;
       } else if (j == 0) {
         goto loop;
       }
 
       if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i)) {
-        return 0;
+        goto err;
       }
       // We have a safe prime test pass
     }
   }
 
   // we have a prime :-)
-  return 1;
+  found = 1;
+
+err:
+  if (ctx != NULL) {
+    BN_CTX_end(ctx);
+    BN_CTX_free(ctx);
+  }
+
+  return found;
 }
 
 static int bn_trial_division(uint16_t *out, const BIGNUM *bn) {
@@ -443,7 +453,8 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
                               int *out_is_possibly_prime, const BIGNUM *b,
                               const BN_MONT_CTX *mont, BN_CTX *ctx) {
   // This function corresponds to steps 4.3 through 4.5 of FIPS 186-4, C.3.1.
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
+  BN_CTX_start(ctx);
 
   // Step 4.3. We use Montgomery-encoding for better performance and to avoid
   // timing leaks.
@@ -453,7 +464,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
   if (z == NULL ||
       !BN_mod_exp_mont_consttime(z, b, miller_rabin->m, w, ctx, mont) ||
       !BN_to_montgomery(z, z, mont, ctx)) {
-    return 0;
+    goto err;
   }
 
   // is_possibly_prime is all ones if we have determined |b| is not a composite
@@ -482,7 +493,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
 
     // Step 4.5.1.
     if (!BN_mod_mul_montgomery(z, z, z, mont, ctx)) {
-      return 0;
+      goto err;
     }
 
     // Step 4.5.2. If z = w-1 and the loop is not done, this is not a composite
@@ -502,7 +513,11 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
   }
 
   *out_is_possibly_prime = constant_time_declassify_w(is_possibly_prime) & 1;
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
@@ -583,25 +598,26 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
     checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
-  bssl::UniquePtr<BN_CTX> new_ctx;
-  if (ctx == nullptr) {
-    new_ctx.reset(BN_CTX_new());
-    if (new_ctx == nullptr) {
+  BN_CTX *new_ctx = NULL;
+  if (ctx == NULL) {
+    new_ctx = BN_CTX_new();
+    if (new_ctx == NULL) {
       return 0;
     }
-    ctx = new_ctx.get();
+    ctx = new_ctx;
   }
 
   // See C.3.1 from FIPS 186-4.
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
+  BN_CTX_start(ctx);
   BIGNUM *b = BN_CTX_get(ctx);
-  bssl::UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_consttime(w, ctx));
+  BN_MONT_CTX *mont = BN_MONT_CTX_new_consttime(w, ctx);
   BN_MILLER_RABIN miller_rabin;
   crypto_word_t uniform_iterations = 0;
-  if (b == nullptr || mont == nullptr ||
+  if (b == NULL || mont == NULL ||
       // Steps 1-3.
-      !bn_miller_rabin_init(&miller_rabin, mont.get(), ctx)) {
-    return 0;
+      !bn_miller_rabin_init(&miller_rabin, mont, ctx)) {
+    goto err;
   }
 
   // The following loop performs in inner iteration of the Miller-Rabin
@@ -641,32 +657,39 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
     // Step 4.1-4.2
     int is_uniform;
     if (!bn_rand_secret_range(b, &is_uniform, 2, miller_rabin.w1)) {
-      return 0;
+      goto err;
     }
     uniform_iterations += is_uniform;
 
     // Steps 4.3-4.5
     int is_possibly_prime = 0;
-    if (!bn_miller_rabin_iteration(&miller_rabin, &is_possibly_prime, b,
-                                   mont.get(), ctx)) {
-      return 0;
+    if (!bn_miller_rabin_iteration(&miller_rabin, &is_possibly_prime, b, mont,
+                                   ctx)) {
+      goto err;
     }
 
     if (!is_possibly_prime) {
       // Step 4.6. We did not see z = w-1 before z = 1, so w must be composite.
       *out_is_probably_prime = 0;
-      return 1;
+      ret = 1;
+      goto err;
     }
 
     // Step 4.7
     if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i - 1)) {
-      return 0;
+      goto err;
     }
   }
 
   declassify_assert(uniform_iterations >= (crypto_word_t)checks);
   *out_is_probably_prime = 1;
-  return 1;
+  ret = 1;
+
+err:
+  BN_MONT_CTX_free(mont);
+  BN_CTX_end(ctx);
+  BN_CTX_free(new_ctx);
+  return ret;
 }
 
 int BN_is_prime_ex(const BIGNUM *candidate, int checks, BN_CTX *ctx,
@@ -697,36 +720,41 @@ int BN_enhanced_miller_rabin_primality_test(
     checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
+  BN_MONT_CTX *mont = NULL;
+
+  BN_CTX_start(ctx);
+
   BIGNUM *w1 = BN_CTX_get(ctx);
-  if (w1 == nullptr || !BN_copy(w1, w) || !BN_sub_word(w1, 1)) {
-    return 0;
+  BIGNUM *b, *g, *z, *x, *x1, *m;
+  int a;
+  if (w1 == NULL || !BN_copy(w1, w) || !BN_sub_word(w1, 1)) {
+    goto err;
   }
 
   // Write w1 as m*2^a (Steps 1 and 2).
-  int a = 0;
+  a = 0;
   while (!BN_is_bit_set(w1, a)) {
     a++;
   }
-  BIGNUM *m = BN_CTX_get(ctx);
-  if (m == nullptr || !BN_rshift(m, w1, a)) {
-    return 0;
+  m = BN_CTX_get(ctx);
+  if (m == NULL || !BN_rshift(m, w1, a)) {
+    goto err;
   }
 
-  BIGNUM *b = BN_CTX_get(ctx);
-  BIGNUM *g = BN_CTX_get(ctx);
-  BIGNUM *z = BN_CTX_get(ctx);
-  BIGNUM *x = BN_CTX_get(ctx);
-  BIGNUM *x1 = BN_CTX_get(ctx);
-  if (b == nullptr || g == nullptr || z == nullptr || x == nullptr ||
-      x1 == nullptr) {
-    return 0;
+  b = BN_CTX_get(ctx);
+  g = BN_CTX_get(ctx);
+  z = BN_CTX_get(ctx);
+  x = BN_CTX_get(ctx);
+  x1 = BN_CTX_get(ctx);
+  if (b == NULL || g == NULL || z == NULL || x == NULL || x1 == NULL) {
+    goto err;
   }
 
   // Montgomery setup for computations mod w
-  bssl::UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_for_modulus(w, ctx));
-  if (mont == nullptr) {
-    return 0;
+  mont = BN_MONT_CTX_new_for_modulus(w, ctx);
+  if (mont == NULL) {
+    goto err;
   }
 
   // The following loop performs in inner iteration of the Enhanced Miller-Rabin
@@ -734,21 +762,22 @@ int BN_enhanced_miller_rabin_primality_test(
   for (int i = 1; i <= checks; i++) {
     // Step 4.1-4.2
     if (!BN_rand_range_ex(b, 2, w1)) {
-      return 0;
+      goto err;
     }
 
     // Step 4.3-4.4
     if (!BN_gcd(g, b, w, ctx)) {
-      return 0;
+      goto err;
     }
     if (BN_cmp_word(g, 1) > 0) {
       *out_result = bn_composite;
-      return 1;
+      ret = 1;
+      goto err;
     }
 
     // Step 4.5
-    if (!BN_mod_exp_mont(z, b, m, w, ctx, mont.get())) {
-      return 0;
+    if (!BN_mod_exp_mont(z, b, m, w, ctx, mont)) {
+      goto err;
     }
 
     // Step 4.6
@@ -759,7 +788,7 @@ int BN_enhanced_miller_rabin_primality_test(
     // Step 4.7
     for (int j = 1; j < a; j++) {
       if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
-        return 0;
+        goto err;
       }
       if (BN_cmp(z, w1) == 0) {
         goto loop;
@@ -771,18 +800,18 @@ int BN_enhanced_miller_rabin_primality_test(
 
     // Step 4.8-4.9
     if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
-      return 0;
+      goto err;
     }
 
     // Step 4.10-4.11
     if (!BN_is_one(z) && !BN_copy(x, z)) {
-      return 0;
+      goto err;
     }
 
   composite:
     // Step 4.12-4.14
     if (!BN_copy(x1, x) || !BN_sub_word(x1, 1) || !BN_gcd(g, x1, w, ctx)) {
-      return 0;
+      goto err;
     }
     if (BN_cmp_word(g, 1) > 0) {
       *out_result = bn_composite;
@@ -790,17 +819,24 @@ int BN_enhanced_miller_rabin_primality_test(
       *out_result = bn_non_prime_power_composite;
     }
 
-    return 1;
+    ret = 1;
+    goto err;
 
   loop:
     // Step 4.15
     if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i - 1)) {
-      return 0;
+      goto err;
     }
   }
 
   *out_result = bn_probably_prime;
-  return 1;
+  ret = 1;
+
+err:
+  BN_MONT_CTX_free(mont);
+  BN_CTX_end(ctx);
+
+  return ret;
 }
 
 static int probable_prime(BIGNUM *rnd, int bits) {
@@ -814,99 +850,111 @@ static int probable_prime(BIGNUM *rnd, int bits) {
 
 static int probable_prime_dh(BIGNUM *rnd, int bits, const BIGNUM *add,
                              const BIGNUM *rem, BN_CTX *ctx) {
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
   BIGNUM *t1;
-  if ((t1 = BN_CTX_get(ctx)) == nullptr) {
-    return 0;
+
+  BN_CTX_start(ctx);
+  size_t num_primes;
+  if ((t1 = BN_CTX_get(ctx)) == NULL) {
+    goto err;
   }
 
   if (!BN_rand(rnd, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
-    return 0;
+    goto err;
   }
 
   // we need ((rnd-rem) % add) == 0
+
   if (!BN_mod(t1, rnd, add, ctx)) {
-    return 0;
+    goto err;
   }
   if (!BN_sub(rnd, rnd, t1)) {
-    return 0;
+    goto err;
   }
-  if (rem == nullptr) {
+  if (rem == NULL) {
     if (!BN_add_word(rnd, 1)) {
-      return 0;
+      goto err;
     }
   } else {
     if (!BN_add(rnd, rnd, rem)) {
-      return 0;
+      goto err;
     }
   }
   // we now have a random number 'rand' to test.
 
-  size_t num_primes = num_trial_division_primes(rnd);
+  num_primes = num_trial_division_primes(rnd);
 loop:
   for (size_t i = 1; i < num_primes; i++) {
     // check that rnd is a prime
     if (bn_mod_u16_consttime(rnd, kPrimes[i]) <= 1) {
       if (!BN_add(rnd, rnd, add)) {
-        return 0;
+        goto err;
       }
       goto loop;
     }
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 static int probable_prime_dh_safe(BIGNUM *p, int bits, const BIGNUM *padd,
                                   const BIGNUM *rem, BN_CTX *ctx) {
+  int ret = 0;
+  BIGNUM *t1, *qadd, *q;
+
   bits--;
-  bssl::BN_CTXScope scope(ctx);
-  BIGNUM *t1 = BN_CTX_get(ctx);
-  BIGNUM *q = BN_CTX_get(ctx);
-  BIGNUM *qadd = BN_CTX_get(ctx);
+  BN_CTX_start(ctx);
+  t1 = BN_CTX_get(ctx);
+  q = BN_CTX_get(ctx);
+  qadd = BN_CTX_get(ctx);
+  size_t num_primes;
   if (qadd == NULL) {
-    return 0;
+    goto err;
   }
 
   if (!BN_rshift1(qadd, padd)) {
-    return 0;
+    goto err;
   }
 
   if (!BN_rand(q, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
-    return 0;
+    goto err;
   }
 
   // we need ((rnd-rem) % add) == 0
   if (!BN_mod(t1, q, qadd, ctx)) {
-    return 0;
+    goto err;
   }
 
   if (!BN_sub(q, q, t1)) {
-    return 0;
+    goto err;
   }
 
   if (rem == NULL) {
     if (!BN_add_word(q, 1)) {
-      return 0;
+      goto err;
     }
   } else {
     if (!BN_rshift1(t1, rem)) {
-      return 0;
+      goto err;
     }
     if (!BN_add(q, q, t1)) {
-      return 0;
+      goto err;
     }
   }
 
   // we now have a random number 'rand' to test.
   if (!BN_lshift1(p, q)) {
-    return 0;
+    goto err;
   }
   if (!BN_add_word(p, 1)) {
-    return 0;
+    goto err;
   }
 
-  size_t num_primes = num_trial_division_primes(p);
+  num_primes = num_trial_division_primes(p);
 loop:
   for (size_t i = 1; i < num_primes; i++) {
     // check that p and q are prime
@@ -915,14 +963,18 @@ loop:
     if (bn_mod_u16_consttime(p, kPrimes[i]) == 0 ||
         bn_mod_u16_consttime(q, kPrimes[i]) == 0) {
       if (!BN_add(p, p, padd)) {
-        return 0;
+        goto err;
       }
       if (!BN_add(q, q, qadd)) {
-        return 0;
+        goto err;
       }
       goto loop;
     }
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/shift.cc.inc

@@ -129,11 +129,12 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) {
 
 int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
                            BN_CTX *ctx) {
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
+  BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned max_bits;
   if (tmp == NULL || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
-    return 0;
+    goto err;
   }
 
   // Shift conditionally by powers of two.
@@ -146,7 +147,11 @@ int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
                     r->d /* ignore shift */, r->width);
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) {

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/sqrt.cc.inc

@@ -63,7 +63,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
     return ret;
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTX_start(ctx);
   A = BN_CTX_get(ctx);
   b = BN_CTX_get(ctx);
   q = BN_CTX_get(ctx);
@@ -378,5 +378,82 @@ end:
     }
     ret = NULL;
   }
+  BN_CTX_end(ctx);
   return ret;
 }
+
+int BN_sqrt(BIGNUM *out_sqrt, const BIGNUM *in, BN_CTX *ctx) {
+  BIGNUM *estimate, *tmp, *delta, *last_delta, *tmp2;
+  int ok = 0, last_delta_valid = 0;
+
+  if (in->neg) {
+    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
+    return 0;
+  }
+  if (BN_is_zero(in)) {
+    BN_zero(out_sqrt);
+    return 1;
+  }
+
+  BN_CTX_start(ctx);
+  if (out_sqrt == in) {
+    estimate = BN_CTX_get(ctx);
+  } else {
+    estimate = out_sqrt;
+  }
+  tmp = BN_CTX_get(ctx);
+  last_delta = BN_CTX_get(ctx);
+  delta = BN_CTX_get(ctx);
+  if (estimate == NULL || tmp == NULL || last_delta == NULL || delta == NULL) {
+    goto err;
+  }
+
+  // We estimate that the square root of an n-bit number is 2^{n/2}.
+  if (!BN_lshift(estimate, BN_value_one(), BN_num_bits(in)/2)) {
+    goto err;
+  }
+
+  // This is Newton's method for finding a root of the equation |estimate|^2 -
+  // |in| = 0.
+  for (;;) {
+    // |estimate| = 1/2 * (|estimate| + |in|/|estimate|)
+    if (!BN_div(tmp, NULL, in, estimate, ctx) ||
+        !BN_add(tmp, tmp, estimate) ||
+        !BN_rshift1(estimate, tmp) ||
+        // |tmp| = |estimate|^2
+        !BN_sqr(tmp, estimate, ctx) ||
+        // |delta| = |in| - |tmp|
+        !BN_sub(delta, in, tmp)) {
+      OPENSSL_PUT_ERROR(BN, ERR_R_BN_LIB);
+      goto err;
+    }
+
+    delta->neg = 0;
+    // The difference between |in| and |estimate| squared is required to always
+    // decrease. This ensures that the loop always terminates, but I don't have
+    // a proof that it always finds the square root for a given square.
+    if (last_delta_valid && BN_cmp(delta, last_delta) >= 0) {
+      break;
+    }
+
+    last_delta_valid = 1;
+
+    tmp2 = last_delta;
+    last_delta = delta;
+    delta = tmp2;
+  }
+
+  if (BN_cmp(tmp, in) != 0) {
+    OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
+    goto err;
+  }
+
+  ok = 1;
+
+err:
+  if (ok && out_sqrt == in && !BN_copy(out_sqrt, estimate)) {
+    ok = 0;
+  }
+  BN_CTX_end(ctx);
+  return ok;
+}