grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/ec.cc.inc

@@ -18,12 +18,15 @@
 #include <assert.h>
 #include <string.h>
 
+#include <iterator>
+
 #include <openssl/bn.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
 
 #include "../../internal.h"
+#include "../../mem_internal.h"
 #include "../bn/internal.h"
 #include "../delocate.h"
 #include "internal.h"
@@ -31,6 +34,8 @@
 #include "builtin_curves.h"
 
 
+using namespace bssl;
+
 static void ec_point_free(EC_POINT *point, int free_group);
 
 static void ec_group_init_static_mont(BN_MONT_CTX *mont, size_t num_words,
@@ -59,29 +64,21 @@ static void ec_group_set_a_minus3(EC_GROUP *group) {
 DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p224) {
   out->curve_name = NID_secp224r1;
   out->comment = "NIST P-224";
-  // 1.3.132.0.33
-  static const uint8_t kOIDP224[] = {0x2b, 0x81, 0x04, 0x00, 0x21};
+  static const uint8_t kOIDP224[] = {OBJ_ENC_secp224r1};
+  static_assert(sizeof(kOIDP224) <= sizeof(out->oid));
   OPENSSL_memcpy(out->oid, kOIDP224, sizeof(kOIDP224));
   out->oid_len = sizeof(kOIDP224);
 
-  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP224Field),
-                            kP224Field, kP224FieldRR, kP224FieldN0);
-  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP224Order),
-                            kP224Order, kP224OrderRR, kP224OrderN0);
-
-#if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL)
-  out->meth = EC_GFp_nistp224_method();
-  OPENSSL_memcpy(out->generator.raw.X.words, kP224GX, sizeof(kP224GX));
-  OPENSSL_memcpy(out->generator.raw.Y.words, kP224GY, sizeof(kP224GY));
-  out->generator.raw.Z.words[0] = 1;
-  OPENSSL_memcpy(out->b.words, kP224B, sizeof(kP224B));
-#else
+  ec_group_init_static_mont(&out->field, std::size(kP224Field), kP224Field,
+                            kP224FieldRR, kP224FieldN0);
+  ec_group_init_static_mont(&out->order, std::size(kP224Order), kP224Order,
+                            kP224OrderRR, kP224OrderN0);
+
   out->meth = EC_GFp_mont_method();
   OPENSSL_memcpy(out->generator.raw.X.words, kP224MontGX, sizeof(kP224MontGX));
   OPENSSL_memcpy(out->generator.raw.Y.words, kP224MontGY, sizeof(kP224MontGY));
   OPENSSL_memcpy(out->generator.raw.Z.words, kP224FieldR, sizeof(kP224FieldR));
   OPENSSL_memcpy(out->b.words, kP224MontB, sizeof(kP224MontB));
-#endif
   out->generator.group = out;
 
   ec_group_set_a_minus3(out);
@@ -92,24 +89,17 @@ DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p224) {
 DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p256) {
   out->curve_name = NID_X9_62_prime256v1;
   out->comment = "NIST P-256";
-  // 1.2.840.10045.3.1.7
-  static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce,
-                                     0x3d, 0x03, 0x01, 0x07};
+  static const uint8_t kOIDP256[] = {OBJ_ENC_X9_62_prime256v1};
+  static_assert(sizeof(kOIDP256) <= sizeof(out->oid));
   OPENSSL_memcpy(out->oid, kOIDP256, sizeof(kOIDP256));
   out->oid_len = sizeof(kOIDP256);
 
-  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP256Field),
-                            kP256Field, kP256FieldRR, kP256FieldN0);
-  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP256Order),
-                            kP256Order, kP256OrderRR, kP256OrderN0);
+  ec_group_init_static_mont(&out->field, std::size(kP256Field), kP256Field,
+                            kP256FieldRR, kP256FieldN0);
+  ec_group_init_static_mont(&out->order, std::size(kP256Order), kP256Order,
+                            kP256OrderRR, kP256OrderN0);
 
-#if !defined(OPENSSL_NO_ASM) &&                              \
-    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
-    !defined(OPENSSL_SMALL)
-  out->meth = EC_GFp_nistz256_method();
-#else
   out->meth = EC_GFp_nistp256_method();
-#endif
   out->generator.group = out;
   OPENSSL_memcpy(out->generator.raw.X.words, kP256MontGX, sizeof(kP256MontGX));
   OPENSSL_memcpy(out->generator.raw.Y.words, kP256MontGY, sizeof(kP256MontGY));
@@ -124,15 +114,15 @@ DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p256) {
 DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p384) {
   out->curve_name = NID_secp384r1;
   out->comment = "NIST P-384";
-  // 1.3.132.0.34
-  static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22};
+  static const uint8_t kOIDP384[] = {OBJ_ENC_secp384r1};
+  static_assert(sizeof(kOIDP384) <= sizeof(out->oid));
   OPENSSL_memcpy(out->oid, kOIDP384, sizeof(kOIDP384));
   out->oid_len = sizeof(kOIDP384);
 
-  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP384Field),
-                            kP384Field, kP384FieldRR, kP384FieldN0);
-  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP384Order),
-                            kP384Order, kP384OrderRR, kP384OrderN0);
+  ec_group_init_static_mont(&out->field, std::size(kP384Field), kP384Field,
+                            kP384FieldRR, kP384FieldN0);
+  ec_group_init_static_mont(&out->order, std::size(kP384Order), kP384Order,
+                            kP384OrderRR, kP384OrderN0);
 
   out->meth = EC_GFp_mont_method();
   out->generator.group = out;
@@ -149,15 +139,15 @@ DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p384) {
 DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p521) {
   out->curve_name = NID_secp521r1;
   out->comment = "NIST P-521";
-  // 1.3.132.0.35
-  static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23};
+  static const uint8_t kOIDP521[] = {OBJ_ENC_secp521r1};
+  static_assert(sizeof(kOIDP521) <= sizeof(out->oid));
   OPENSSL_memcpy(out->oid, kOIDP521, sizeof(kOIDP521));
   out->oid_len = sizeof(kOIDP521);
 
-  ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP521Field),
-                            kP521Field, kP521FieldRR, kP521FieldN0);
-  ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP521Order),
-                            kP521Order, kP521OrderRR, kP521OrderN0);
+  ec_group_init_static_mont(&out->field, std::size(kP521Field), kP521Field,
+                            kP521FieldRR, kP521FieldN0);
+  ec_group_init_static_mont(&out->order, std::size(kP521Order), kP521Order,
+                            kP521OrderRR, kP521OrderN0);
 
   out->meth = EC_GFp_mont_method();
   out->generator.group = out;
@@ -178,7 +168,7 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
     return nullptr;
   }
 
-  bssl::UniquePtr<BN_CTX> new_ctx;
+  UniquePtr<BN_CTX> new_ctx;
   if (ctx == nullptr) {
     new_ctx.reset(BN_CTX_new());
     if (new_ctx == nullptr) {
@@ -187,9 +177,9 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
     ctx = new_ctx.get();
   }
 
-  // Historically, |a| and |b| were not required to be fully reduced.
+  // Historically, `a` and `b` were not required to be fully reduced.
   // TODO(davidben): Can this be removed?
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *a_reduced = BN_CTX_get(ctx);
   BIGNUM *b_reduced = BN_CTX_get(ctx);
   if (a_reduced == nullptr || b_reduced == nullptr ||
@@ -198,16 +188,10 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
     return nullptr;
   }
 
-  bssl::UniquePtr<EC_GROUP> ret(
-      reinterpret_cast<EC_GROUP *>(OPENSSL_zalloc(sizeof(EC_GROUP))));
+  UniquePtr<ECCustomGroup> ret(New<ECCustomGroup>(EC_GFp_mont_method()));
   if (ret == nullptr) {
     return nullptr;
   }
-  ret->references = 1;
-  ret->meth = EC_GFp_mont_method();
-  bn_mont_ctx_init(&ret->field);
-  bn_mont_ctx_init(&ret->order);
-  ret->generator.group = ret.get();
   if (!ec_GFp_simple_group_set_curve(ret.get(), p, a_reduced, b_reduced, ctx)) {
     return nullptr;
   }
@@ -219,10 +203,10 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
                            const BIGNUM *order, const BIGNUM *cofactor) {
   if (group->curve_name != NID_undef || group->has_order ||
       generator->group != group) {
-    // |EC_GROUP_set_generator| may only be used with |EC_GROUP|s returned by
-    // |EC_GROUP_new_curve_GFp| and may only used once on each group.
-    // |generator| must have been created from |EC_GROUP_new_curve_GFp|, not a
-    // copy, so that |generator->group->generator| is set correctly.
+    // `EC_GROUP_set_generator` may only be used with `EC_GROUP`s returned by
+    // `EC_GROUP_new_curve_GFp` and may only used once on each group.
+    // `generator` must have been created from `EC_GROUP_new_curve_GFp`, not a
+    // copy, so that `generator->group->generator` is set correctly.
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -241,9 +225,9 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
   // Require that p < 2×order. This simplifies some ECDSA operations.
   //
   // Note any curve which did not satisfy this must have been invalid or use a
-  // tiny prime (less than 17). See the proof in |field_element_to_scalar| in
+  // tiny prime (less than 17). See the proof in `field_element_to_scalar` in
   // the ECDSA implementation.
-  bssl::UniquePtr<BIGNUM> tmp(BN_new());
+  UniquePtr<BIGNUM> tmp(BN_new());
   if (tmp == nullptr || !BN_lshift1(tmp.get(), order)) {
     return 0;
   }
@@ -254,14 +238,14 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 
   EC_AFFINE affine;
   if (!ec_jacobian_to_affine(group, &affine, &generator->raw) ||
-      !BN_MONT_CTX_set(&group->order, order, NULL)) {
+      !BN_MONT_CTX_set(&group->order, order, nullptr)) {
     return 0;
   }
 
   group->field_greater_than_order = BN_cmp(&group->field.N, order) > 0;
   group->generator.raw.X = affine.X;
   group->generator.raw.Y = affine.Y;
-  // |raw.Z| was set to 1 by |EC_GROUP_new_curve_GFp|.
+  // `raw.Z` was set to 1 by `EC_GROUP_new_curve_GFp`.
   group->has_order = 1;
   return 1;
 }
@@ -278,34 +262,45 @@ EC_GROUP *EC_GROUP_new_by_curve_name(int nid) {
       return (EC_GROUP *)EC_group_p521();
     default:
       OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-      return NULL;
+      return nullptr;
   }
 }
 
+ECCustomGroup::ECCustomGroup(const EC_METHOD *m)
+    : ec_group_st({}), RefCounted(CheckSubClass()) {
+  meth = m;
+  bn_mont_ctx_init(&field);
+  bn_mont_ctx_init(&order);
+  generator.group = this;
+}
+
+ECCustomGroup::~ECCustomGroup() {
+  bn_mont_ctx_cleanup(&order);
+  bn_mont_ctx_cleanup(&field);
+}
+
 void EC_GROUP_free(EC_GROUP *group) {
-  if (group == NULL ||
+  if (group == nullptr ||
       // Built-in curves are static.
-      group->curve_name != NID_undef ||
-      !CRYPTO_refcount_dec_and_test_zero(&group->references)) {
+      group->curve_name != NID_undef) {
     return;
   }
-
-  bn_mont_ctx_cleanup(&group->order);
-  bn_mont_ctx_cleanup(&group->field);
-  OPENSSL_free(group);
+  auto *custom = static_cast<ECCustomGroup *>(group);
+  custom->DecRefInternal();
 }
 
 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a) {
-  if (a == NULL ||
+  if (a == nullptr ||
       // Built-in curves are static.
       a->curve_name != NID_undef) {
     return (EC_GROUP *)a;
   }
+  auto *custom = static_cast<const ECCustomGroup *>(a);
 
-  // Groups are logically immutable (but for |EC_GROUP_set_generator| which must
+  // Groups are logically immutable (but for `EC_GROUP_set_generator` which must
   // be called early on), so we simply take a reference.
-  EC_GROUP *group = (EC_GROUP *)a;
-  CRYPTO_refcount_inc(&group->references);
+  ECCustomGroup *group = const_cast<ECCustomGroup *>(custom);
+  group->UpRefInternal();
   return group;
 }
 
@@ -322,8 +317,8 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) {
     return 0;
   }
 
-  // |a| and |b| are both custom curves. We compare the entire curve
-  // structure. If |a| or |b| is incomplete (due to legacy OpenSSL mistakes,
+  // `a` and `b` are both custom curves. We compare the entire curve
+  // structure. If `a` or `b` is incomplete (due to legacy OpenSSL mistakes,
   // custom curve construction is sadly done in two parts) but otherwise not the
   // same object, we consider them always unequal.
   return a->meth != b->meth ||  //
@@ -336,7 +331,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) {
 }
 
 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group) {
-  return group->has_order ? &group->generator : NULL;
+  return group->has_order ? &group->generator : nullptr;
 }
 
 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
@@ -345,7 +340,7 @@ const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
 }
 
 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
-  if (BN_copy(order, EC_GROUP_get0_order(group)) == NULL) {
+  if (BN_copy(order, EC_GROUP_get0_order(group)) == nullptr) {
     return 0;
   }
   return 1;
@@ -357,7 +352,7 @@ int EC_GROUP_order_bits(const EC_GROUP *group) {
 
 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
                           BN_CTX *ctx) {
-  // All |EC_GROUP|s have cofactor 1.
+  // All `EC_GROUP`s have cofactor 1.
   return BN_set_word(cofactor, 1);
 }
 
@@ -383,7 +378,7 @@ const char *EC_curve_nid2nist(int nid) {
     case NID_secp521r1:
       return "P-521";
   }
-  return NULL;
+  return nullptr;
 }
 
 int EC_curve_nist2nid(const char *name) {
@@ -403,14 +398,14 @@ int EC_curve_nist2nid(const char *name) {
 }
 
 EC_POINT *EC_POINT_new(const EC_GROUP *group) {
-  if (group == NULL) {
+  if (group == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return nullptr;
   }
 
-  EC_POINT *ret = reinterpret_cast<EC_POINT *>(OPENSSL_malloc(sizeof *ret));
-  if (ret == NULL) {
-    return NULL;
+  EC_POINT *ret = New<EC_POINT>();
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   ret->group = EC_GROUP_dup(group);
@@ -425,7 +420,7 @@ static void ec_point_free(EC_POINT *point, int free_group) {
   if (free_group) {
     EC_GROUP_free(point->group);
   }
-  OPENSSL_free(point);
+  Delete(point);
 }
 
 void EC_POINT_free(EC_POINT *point) {
@@ -435,7 +430,7 @@ void EC_POINT_free(EC_POINT *point) {
 void EC_POINT_clear_free(EC_POINT *point) { EC_POINT_free(point); }
 
 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) {
-  if (EC_GROUP_cmp(dest->group, src->group, NULL) != 0) {
+  if (EC_GROUP_cmp(dest->group, src->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -447,21 +442,21 @@ int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) {
 }
 
 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group) {
-  if (a == NULL) {
-    return NULL;
+  if (a == nullptr) {
+    return nullptr;
   }
 
   EC_POINT *ret = EC_POINT_new(group);
-  if (ret == NULL || !EC_POINT_copy(ret, a)) {
+  if (ret == nullptr || !EC_POINT_copy(ret, a)) {
     EC_POINT_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   return ret;
 }
 
 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -470,7 +465,7 @@ int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point) {
 }
 
 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -479,7 +474,7 @@ int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) {
 
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -488,33 +483,33 @@ int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
 
 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
                  BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, a->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, b->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, a->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, b->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return -1;
   }
 
-  // Note |EC_POINT_cmp| returns zero for equality and non-zero for inequality.
+  // Note `EC_POINT_cmp` returns zero for equality and non-zero for inequality.
   return ec_GFp_simple_points_equal(group, &a->raw, &b->raw) ? 0 : 1;
 }
 
 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
                                         const EC_POINT *point, BIGNUM *x,
                                         BIGNUM *y, BN_CTX *ctx) {
-  if (group->meth->point_get_affine_coordinates == 0) {
+  if (group->meth->point_get_affine_coordinates == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
   EC_FELEM x_felem, y_felem;
-  if (!group->meth->point_get_affine_coordinates(group, &point->raw,
-                                                 x == NULL ? NULL : &x_felem,
-                                                 y == NULL ? NULL : &y_felem) ||
-      (x != NULL && !ec_felem_to_bignum(group, x, &x_felem)) ||
-      (y != NULL && !ec_felem_to_bignum(group, y, &y_felem))) {
+  if (!group->meth->point_get_affine_coordinates(
+          group, &point->raw, x == nullptr ? nullptr : &x_felem,
+          y == nullptr ? nullptr : &y_felem) ||
+      (x != nullptr && !ec_felem_to_bignum(group, x, &x_felem)) ||
+      (y != nullptr && !ec_felem_to_bignum(group, y, &y_felem))) {
     return 0;
   }
   return 1;
@@ -526,40 +521,36 @@ int EC_POINT_get_affine_coordinates(const EC_GROUP *group,
   return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx);
 }
 
-void ec_affine_to_jacobian(const EC_GROUP *group, EC_JACOBIAN *out,
-                           const EC_AFFINE *p) {
+void bssl::ec_affine_to_jacobian(const EC_GROUP *group, EC_JACOBIAN *out,
+                                 const EC_AFFINE *p) {
   out->X = p->X;
   out->Y = p->Y;
   out->Z = *ec_felem_one(group);
 }
 
-int ec_jacobian_to_affine(const EC_GROUP *group, EC_AFFINE *out,
-                          const EC_JACOBIAN *p) {
+int bssl::ec_jacobian_to_affine(const EC_GROUP *group, EC_AFFINE *out,
+                                const EC_JACOBIAN *p) {
   return group->meth->point_get_affine_coordinates(group, p, &out->X, &out->Y);
 }
 
-int ec_jacobian_to_affine_batch(const EC_GROUP *group, EC_AFFINE *out,
-                                const EC_JACOBIAN *in, size_t num) {
-  if (group->meth->jacobian_to_affine_batch == NULL) {
+int bssl::ec_jacobian_to_affine_batch(const EC_GROUP *group, EC_AFFINE *out,
+                                      const EC_JACOBIAN *in, size_t num) {
+  if (group->meth->jacobian_to_affine_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
   return group->meth->jacobian_to_affine_batch(group, out, in, num);
 }
 
-int ec_point_set_affine_coordinates(const EC_GROUP *group, EC_AFFINE *out,
-                                    const EC_FELEM *x, const EC_FELEM *y) {
-  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
-                          const EC_FELEM *b) = group->meth->felem_mul;
-  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
-      group->meth->felem_sqr;
-
+int bssl::ec_point_set_affine_coordinates(const EC_GROUP *group, EC_AFFINE *out,
+                                          const EC_FELEM *x,
+                                          const EC_FELEM *y) {
   // Check if the point is on the curve.
   EC_FELEM lhs, rhs;
-  felem_sqr(group, &lhs, y);                   // lhs = y^2
-  felem_sqr(group, &rhs, x);                   // rhs = x^2
+  ec_felem_sqr(group, &lhs, y);                // lhs = y^2
+  ec_felem_sqr(group, &rhs, x);                // rhs = x^2
   ec_felem_add(group, &rhs, &rhs, &group->a);  // rhs = x^2 + a
-  felem_mul(group, &rhs, &rhs, x);             // rhs = x^3 + ax
+  ec_felem_mul(group, &rhs, &rhs, x);          // rhs = x^3 + ax
   ec_felem_add(group, &rhs, &rhs, &group->b);  // rhs = x^3 + ax + b
   if (!ec_felem_equal(group, &lhs, &rhs)) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE);
@@ -582,12 +573,12 @@ int ec_point_set_affine_coordinates(const EC_GROUP *group, EC_AFFINE *out,
 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
                                         const BIGNUM *x, const BIGNUM *y,
                                         BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
 
-  if (x == NULL || y == NULL) {
+  if (x == nullptr || y == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -615,9 +606,9 @@ int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
 
 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                  const EC_POINT *b, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, a->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, b->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, a->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, b->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -627,8 +618,8 @@ int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 
 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                  BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, a->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, a->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -638,7 +629,7 @@ int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 
 
 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, a->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, a->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -655,43 +646,41 @@ static int arbitrary_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   ERR_clear_error();
 
   // This is an unusual input, so we do not guarantee constant-time processing.
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  int ok = tmp != NULL && BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
-           ec_bignum_to_scalar(group, out, tmp);
-  BN_CTX_end(ctx);
-  return ok;
+  return tmp != nullptr && BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
+         ec_bignum_to_scalar(group, out, tmp);
 }
 
-int ec_point_mul_no_self_test(const EC_GROUP *group, EC_POINT *r,
-                              const BIGNUM *g_scalar, const EC_POINT *p,
-                              const BIGNUM *p_scalar, BN_CTX *ctx) {
-  // Previously, this function set |r| to the point at infinity if there was
+int bssl::ec_point_mul_no_self_test(const EC_GROUP *group, EC_POINT *r,
+                                    const BIGNUM *g_scalar, const EC_POINT *p,
+                                    const BIGNUM *p_scalar, BN_CTX *ctx) {
+  // Previously, this function set `r` to the point at infinity if there was
   // nothing to multiply. But, nobody should be calling this function with
   // nothing to multiply in the first place.
-  if ((g_scalar == NULL && p_scalar == NULL) ||
-      (p == NULL) != (p_scalar == NULL)) {
+  if ((g_scalar == nullptr && p_scalar == nullptr) ||
+      (p == nullptr) != (p_scalar == nullptr)) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      (p != NULL && EC_GROUP_cmp(group, p->group, NULL) != 0)) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      (p != nullptr && EC_GROUP_cmp(group, p->group, nullptr) != 0)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
 
-  bssl::UniquePtr<BN_CTX> new_ctx;
-  if (ctx == NULL) {
+  UniquePtr<BN_CTX> new_ctx;
+  if (ctx == nullptr) {
     new_ctx.reset(BN_CTX_new());
-    if (new_ctx == NULL) {
+    if (new_ctx == nullptr) {
       return 0;
     }
     ctx = new_ctx.get();
   }
 
-  // If both |g_scalar| and |p_scalar| are non-NULL,
-  // |ec_point_mul_scalar_public| would share the doublings between the two
+  // If both `g_scalar` and `p_scalar` are non-NULL,
+  // `ec_point_mul_scalar_public` would share the doublings between the two
   // products, which would be more efficient. However, we conservatively assume
   // the caller needs a constant-time operation. (ECDSA verification does not
   // use this function.)
@@ -701,7 +690,7 @@ int ec_point_mul_no_self_test(const EC_GROUP *group, EC_POINT *r,
   // which combined the two multiplications did not avoid the doubling case
   // in the incomplete addition formula and were not constant-time.
 
-  if (g_scalar != NULL) {
+  if (g_scalar != nullptr) {
     EC_SCALAR scalar;
     if (!arbitrary_bignum_to_scalar(group, &scalar, g_scalar, ctx) ||
         !ec_point_mul_scalar_base(group, &r->raw, &scalar)) {
@@ -709,14 +698,14 @@ int ec_point_mul_no_self_test(const EC_GROUP *group, EC_POINT *r,
     }
   }
 
-  if (p_scalar != NULL) {
+  if (p_scalar != nullptr) {
     EC_SCALAR scalar;
     EC_JACOBIAN tmp;
     if (!arbitrary_bignum_to_scalar(group, &scalar, p_scalar, ctx) ||
         !ec_point_mul_scalar(group, &tmp, &p->raw, &scalar)) {
       return 0;
     }
-    if (g_scalar == NULL) {
+    if (g_scalar == nullptr) {
       OPENSSL_memcpy(&r->raw, &tmp, sizeof(EC_JACOBIAN));
     } else {
       group->meth->add(group, &r->raw, &r->raw, &tmp);
@@ -733,15 +722,16 @@ int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
   return ec_point_mul_no_self_test(group, r, g_scalar, p, p_scalar, ctx);
 }
 
-int ec_point_mul_scalar_public(const EC_GROUP *group, EC_JACOBIAN *r,
-                               const EC_SCALAR *g_scalar, const EC_JACOBIAN *p,
-                               const EC_SCALAR *p_scalar) {
-  if (g_scalar == NULL || p_scalar == NULL || p == NULL) {
+int bssl::ec_point_mul_scalar_public(const EC_GROUP *group, EC_JACOBIAN *r,
+                                     const EC_SCALAR *g_scalar,
+                                     const EC_JACOBIAN *p,
+                                     const EC_SCALAR *p_scalar) {
+  if (g_scalar == nullptr || p_scalar == nullptr || p == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  if (group->meth->mul_public == NULL) {
+  if (group->meth->mul_public == nullptr) {
     return group->meth->mul_public_batch(group, r, g_scalar, p, p_scalar, 1);
   }
 
@@ -749,11 +739,10 @@ int ec_point_mul_scalar_public(const EC_GROUP *group, EC_JACOBIAN *r,
   return 1;
 }
 
-int ec_point_mul_scalar_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
-                                     const EC_SCALAR *g_scalar,
-                                     const EC_JACOBIAN *points,
-                                     const EC_SCALAR *scalars, size_t num) {
-  if (group->meth->mul_public_batch == NULL) {
+int bssl::ec_point_mul_scalar_public_batch(
+    const EC_GROUP *group, EC_JACOBIAN *r, const EC_SCALAR *g_scalar,
+    const EC_JACOBIAN *points, const EC_SCALAR *scalars, size_t num) {
+  if (group->meth->mul_public_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -762,9 +751,9 @@ int ec_point_mul_scalar_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
                                        num);
 }
 
-int ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
-                        const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
-  if (p == NULL || scalar == NULL) {
+int bssl::ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
+                              const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
+  if (p == nullptr || scalar == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -773,7 +762,7 @@ int ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
 
   // Check the result is on the curve to defend against fault attacks or bugs.
   // This has negligible cost compared to the multiplication.
-  if (!ec_GFp_simple_is_on_curve(group, r)) {
+  if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) {
     OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
     return 0;
   }
@@ -781,9 +770,9 @@ int ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
   return 1;
 }
 
-int ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
-                             const EC_SCALAR *scalar) {
-  if (scalar == NULL) {
+int bssl::ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
+                                   const EC_SCALAR *scalar) {
+  if (scalar == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -802,11 +791,11 @@ int ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
   return 1;
 }
 
-int ec_point_mul_scalar_batch(const EC_GROUP *group, EC_JACOBIAN *r,
-                              const EC_JACOBIAN *p0, const EC_SCALAR *scalar0,
-                              const EC_JACOBIAN *p1, const EC_SCALAR *scalar1,
-                              const EC_JACOBIAN *p2, const EC_SCALAR *scalar2) {
-  if (group->meth->mul_batch == NULL) {
+int bssl::ec_point_mul_scalar_batch(
+    const EC_GROUP *group, EC_JACOBIAN *r, const EC_JACOBIAN *p0,
+    const EC_SCALAR *scalar0, const EC_JACOBIAN *p1, const EC_SCALAR *scalar1,
+    const EC_JACOBIAN *p2, const EC_SCALAR *scalar2) {
+  if (group->meth->mul_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -823,9 +812,9 @@ int ec_point_mul_scalar_batch(const EC_GROUP *group, EC_JACOBIAN *r,
   return 1;
 }
 
-int ec_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
-                    const EC_JACOBIAN *p) {
-  if (group->meth->init_precomp == NULL) {
+int bssl::ec_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
+                          const EC_JACOBIAN *p) {
+  if (group->meth->init_precomp == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -833,12 +822,11 @@ int ec_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
   return group->meth->init_precomp(group, out, p);
 }
 
-int ec_point_mul_scalar_precomp(const EC_GROUP *group, EC_JACOBIAN *r,
-                                const EC_PRECOMP *p0, const EC_SCALAR *scalar0,
-                                const EC_PRECOMP *p1, const EC_SCALAR *scalar1,
-                                const EC_PRECOMP *p2,
-                                const EC_SCALAR *scalar2) {
-  if (group->meth->mul_precomp == NULL) {
+int bssl::ec_point_mul_scalar_precomp(
+    const EC_GROUP *group, EC_JACOBIAN *r, const EC_PRECOMP *p0,
+    const EC_SCALAR *scalar0, const EC_PRECOMP *p1, const EC_SCALAR *scalar1,
+    const EC_PRECOMP *p2, const EC_SCALAR *scalar2) {
+  if (group->meth->mul_precomp == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -855,35 +843,38 @@ int ec_point_mul_scalar_precomp(const EC_GROUP *group, EC_JACOBIAN *r,
   return 1;
 }
 
-void ec_point_select(const EC_GROUP *group, EC_JACOBIAN *out, BN_ULONG mask,
-                     const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
+void bssl::ec_point_select(const EC_GROUP *group, EC_JACOBIAN *out,
+                           BN_ULONG mask, const EC_JACOBIAN *a,
+                           const EC_JACOBIAN *b) {
   ec_felem_select(group, &out->X, mask, &a->X, &b->X);
   ec_felem_select(group, &out->Y, mask, &a->Y, &b->Y);
   ec_felem_select(group, &out->Z, mask, &a->Z, &b->Z);
 }
 
-void ec_affine_select(const EC_GROUP *group, EC_AFFINE *out, BN_ULONG mask,
-                      const EC_AFFINE *a, const EC_AFFINE *b) {
+void bssl::ec_affine_select(const EC_GROUP *group, EC_AFFINE *out,
+                            BN_ULONG mask, const EC_AFFINE *a,
+                            const EC_AFFINE *b) {
   ec_felem_select(group, &out->X, mask, &a->X, &b->X);
   ec_felem_select(group, &out->Y, mask, &a->Y, &b->Y);
 }
 
-void ec_precomp_select(const EC_GROUP *group, EC_PRECOMP *out, BN_ULONG mask,
-                       const EC_PRECOMP *a, const EC_PRECOMP *b) {
+void bssl::ec_precomp_select(const EC_GROUP *group, EC_PRECOMP *out,
+                             BN_ULONG mask, const EC_PRECOMP *a,
+                             const EC_PRECOMP *b) {
   static_assert(sizeof(out->comb) == sizeof(*out),
                 "out->comb does not span the entire structure");
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(out->comb); i++) {
+  for (size_t i = 0; i < std::size(out->comb); i++) {
     ec_affine_select(group, &out->comb[i], mask, &a->comb[i], &b->comb[i]);
   }
 }
 
-int ec_cmp_x_coordinate(const EC_GROUP *group, const EC_JACOBIAN *p,
-                        const EC_SCALAR *r) {
+int bssl::ec_cmp_x_coordinate(const EC_GROUP *group, const EC_JACOBIAN *p,
+                              const EC_SCALAR *r) {
   return group->meth->cmp_x_coordinate(group, p, r);
 }
 
-int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                                  const EC_JACOBIAN *p) {
+int bssl::ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
+                                        const EC_JACOBIAN *p) {
   uint8_t bytes[EC_MAX_BYTES];
   size_t len;
   if (!ec_get_x_coordinate_as_bytes(group, bytes, &len, sizeof(bytes), p)) {
@@ -894,7 +885,7 @@ int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
   // order. These may not have the same size. However, we must have p < 2×order,
   // assuming p is not tiny (p >= 17).
   //
-  // Thus |bytes| will fit in |order.width + 1| words, and we can reduce by
+  // Thus `bytes` will fit in `order.width + 1` words, and we can reduce by
   // performing at most one subtraction.
   //
   // Proof: We only work with prime order curves, so the number of points on
@@ -908,7 +899,7 @@ int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
   //                     p  < 2×order
   //
   // Additionally, one can manually check this property for built-in curves. It
-  // is enforced for legacy custom curves in |EC_GROUP_set_generator|.
+  // is enforced for legacy custom curves in `EC_GROUP_set_generator`.
   const BIGNUM *order = EC_GROUP_get0_order(group);
   BN_ULONG words[EC_MAX_WORDS + 1] = {0};
   bn_big_endian_to_words(words, order->width + 1, bytes, len);
@@ -917,9 +908,9 @@ int ec_get_x_coordinate_as_scalar(const EC_GROUP *group, EC_SCALAR *out,
   return 1;
 }
 
-int ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
-                                 size_t *out_len, size_t max_out,
-                                 const EC_JACOBIAN *p) {
+int bssl::ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
+                                       size_t *out_len, size_t max_out,
+                                       const EC_JACOBIAN *p) {
   size_t len = BN_num_bytes(&group->field.N);
   assert(len <= EC_MAX_BYTES);
   if (max_out < len) {
@@ -928,7 +919,7 @@ int ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
   }
 
   EC_FELEM x;
-  if (!group->meth->point_get_affine_coordinates(group, p, &x, NULL)) {
+  if (!group->meth->point_get_affine_coordinates(group, p, &x, nullptr)) {
     return 0;
   }
 
@@ -937,7 +928,7 @@ int ec_get_x_coordinate_as_bytes(const EC_GROUP *group, uint8_t *out,
   return 1;
 }
 
-void ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) {
+void bssl::ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) {
   if (group->has_order) {
     ec_GFp_simple_point_copy(out, &group->generator.raw);
   } else {
@@ -956,7 +947,7 @@ int EC_GROUP_get_asn1_flag(const EC_GROUP *group) {
 
 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group) {
   // This function exists purely to give callers a way to call
-  // |EC_METHOD_get_field_type|. cryptography.io crashes if |EC_GROUP_method_of|
+  // `EC_METHOD_get_field_type`. cryptography.io crashes if `EC_GROUP_method_of`
   // returns NULL, so return some other garbage pointer.
   return (const EC_METHOD *)0x12340000;
 }