grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/ssl/ssl_key_share.cc

@@ -17,6 +17,7 @@
 #include <assert.h>
 #include <string.h>
 
+#include <iterator>
 #include <utility>
 
 #include <openssl/bn.h>
@@ -24,8 +25,6 @@
 #include <openssl/curve25519.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
-#define OPENSSL_UNSTABLE_EXPERIMENTAL_KYBER
-#include <openssl/experimental/kyber.h>
 #include <openssl/hrss.h>
 #include <openssl/mem.h>
 #include <openssl/mlkem.h>
@@ -34,6 +33,7 @@
 #include <openssl/span.h>
 
 #include "../crypto/internal.h"
+#include "../crypto/kyber/internal.h"
 #include "internal.h"
 
 BSSL_NAMESPACE_BEGIN
@@ -98,7 +98,7 @@ class ECKeyShare : public SSLKeyShare {
       return false;
     }
 
-    // Compute the x-coordinate of |peer_key| * |private_key_|.
+    // Compute the x-coordinate of `peer_key` * `private_key_`.
     if (!EC_POINT_mul(group_, result.get(), nullptr, peer_point.get(),
                       private_key_.get(), /*ctx=*/nullptr) ||
         !EC_POINT_get_affine_coordinates_GFp(group_, result.get(), x.get(),
@@ -375,8 +375,67 @@ class X25519MLKEM768KeyShare : public SSLKeyShare {
   MLKEM768_private_key mlkem_private_key_;
 };
 
+// draft-ietf-tls-mlkem-04
+class MLKEM1024KeyShare : public SSLKeyShare {
+ public:
+  MLKEM1024KeyShare() = default;
+
+  uint16_t GroupID() const override { return SSL_GROUP_MLKEM1024; }
+
+  bool Generate(CBB *out_public_key) override {
+    uint8_t public_key[MLKEM1024_PUBLIC_KEY_BYTES];
+    MLKEM1024_generate_key(public_key, /*optional_out_seed=*/nullptr,
+                           &private_key_);
+    return CBB_add_bytes(out_public_key, public_key, sizeof(public_key));
+  }
+
+  bool Encap(CBB *out_ciphertext, Array<uint8_t> *out_secret,
+             uint8_t *out_alert, Span<const uint8_t> peer_key) override {
+    MLKEM1024_public_key peer_pub;
+    CBS peer_pub_cbs;
+    CBS_init(&peer_pub_cbs, peer_key.data(), peer_key.size());
+    if (!MLKEM1024_parse_public_key(&peer_pub, &peer_pub_cbs)) {
+      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
+      return false;
+    }
+
+    Array<uint8_t> secret;
+    if (!secret.InitForOverwrite(MLKEM_SHARED_SECRET_BYTES)) {
+      return false;
+    }
+    uint8_t ciphertext[MLKEM1024_CIPHERTEXT_BYTES];
+    MLKEM1024_encap(ciphertext, secret.data(), &peer_pub);
+    if (!CBB_add_bytes(out_ciphertext, ciphertext, sizeof(ciphertext))) {
+      return false;
+    }
+    *out_secret = std::move(secret);
+    return true;
+  }
+
+  bool Decap(Array<uint8_t> *out_secret, uint8_t *out_alert,
+             Span<const uint8_t> ciphertext) override {
+    Array<uint8_t> secret;
+    if (!secret.InitForOverwrite(MLKEM_SHARED_SECRET_BYTES)) {
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+      return false;
+    }
+
+    if (!MLKEM1024_decap(secret.data(), ciphertext.data(), ciphertext.size(),
+                         &private_key_)) {
+      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
+      return false;
+    }
+    *out_secret = std::move(secret);
+    return true;
+  }
+
+ private:
+  MLKEM1024_private_key private_key_;
+};
+
 constexpr NamedGroup kNamedGroups[] = {
-    {NID_secp224r1, SSL_GROUP_SECP224R1, "P-224", "secp224r1"},
     {NID_X9_62_prime256v1, SSL_GROUP_SECP256R1, "P-256", "prime256v1"},
     {NID_secp384r1, SSL_GROUP_SECP384R1, "P-384", "secp384r1"},
     {NID_secp521r1, SSL_GROUP_SECP521R1, "P-521", "secp521r1"},
@@ -384,16 +443,27 @@ constexpr NamedGroup kNamedGroups[] = {
     {NID_X25519Kyber768Draft00, SSL_GROUP_X25519_KYBER768_DRAFT00,
      "X25519Kyber768Draft00", ""},
     {NID_X25519MLKEM768, SSL_GROUP_X25519_MLKEM768, "X25519MLKEM768", ""},
+    {NID_ML_KEM_1024, SSL_GROUP_MLKEM1024, "MLKEM1024", ""},
 };
 
+static_assert(std::size(kNamedGroups) == kNumNamedGroups,
+              "kNamedGroups size mismatch");
+
 }  // namespace
 
 Span<const NamedGroup> NamedGroups() { return kNamedGroups; }
 
+Span<const uint16_t> DefaultSupportedGroupIds() {
+  static const uint16_t kDefaultSupportedGroupIds[] = {
+      SSL_GROUP_X25519,
+      SSL_GROUP_SECP256R1,
+      SSL_GROUP_SECP384R1,
+  };
+  return Span(kDefaultSupportedGroupIds);
+}
+
 UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
   switch (group_id) {
-    case SSL_GROUP_SECP224R1:
-      return MakeUnique<ECKeyShare>(EC_group_p224(), SSL_GROUP_SECP224R1);
     case SSL_GROUP_SECP256R1:
       return MakeUnique<ECKeyShare>(EC_group_p256(), SSL_GROUP_SECP256R1);
     case SSL_GROUP_SECP384R1:
@@ -406,6 +476,8 @@ UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
       return MakeUnique<X25519Kyber768KeyShare>();
     case SSL_GROUP_X25519_MLKEM768:
       return MakeUnique<X25519MLKEM768KeyShare>();
+    case SSL_GROUP_MLKEM1024:
+      return MakeUnique<MLKEM1024KeyShare>();
     default:
       return nullptr;
   }
@@ -461,6 +533,6 @@ const char *SSL_get_group_name(uint16_t group_id) {
 }
 
 size_t SSL_get_all_group_names(const char **out, size_t max_out) {
-  return GetAllNames(out, max_out, Span<const char *>(), &NamedGroup::name,
+  return GetAllNames(out, max_out, Span<const char *const>(), &NamedGroup::name,
                      Span(kNamedGroups));
 }