grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/crypto.cc

@@ -22,6 +22,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 static_assert(sizeof(ossl_ssize_t) == sizeof(size_t),
               "ossl_ssize_t should be the same size as size_t");
 
@@ -54,75 +56,42 @@ static_assert(sizeof(ossl_ssize_t) == sizeof(size_t),
 // archive, linking on OS X will fail to resolve common symbols. By
 // initialising it to zero, it becomes a "data symbol", which isn't so
 // affected.
-HIDDEN uint8_t BORINGSSL_function_hit[8] = {0};
+HIDDEN uint8_t bssl::BORINGSSL_function_hit[8] = {0};
 #endif
 
 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
 
 // This value must be explicitly initialized to zero. See similar comment above.
-HIDDEN uint32_t OPENSSL_ia32cap_P[4] = {0};
+HIDDEN uint32_t bssl::OPENSSL_ia32cap_P[4] = {0};
 
-uint32_t OPENSSL_get_ia32cap(int idx) {
+uint32_t bssl::OPENSSL_get_ia32cap(int idx) {
   OPENSSL_init_cpuid();
   return OPENSSL_ia32cap_P[idx];
 }
 
-#elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
-
-#if defined(OPENSSL_STATIC_ARMCAP)
+#elif (defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)) && \
+    !defined(OPENSSL_STATIC_ARMCAP)
+HIDDEN uint32_t bssl::OPENSSL_armcap_P = 0;
 
-// See ARM ACLE for the definitions of these macros. Note |__ARM_FEATURE_AES|
-// covers both AES and PMULL and |__ARM_FEATURE_SHA2| covers SHA-1 and SHA-256.
-// https://developer.arm.com/architectures/system-architectures/software-standards/acle
-// https://github.com/ARM-software/acle/issues/152
-//
-// TODO(davidben): Do we still need |OPENSSL_STATIC_ARMCAP_*| or are the
-// standard flags and -march sufficient?
-HIDDEN uint32_t OPENSSL_armcap_P =
-#if defined(OPENSSL_STATIC_ARMCAP_NEON) || defined(__ARM_NEON)
-    ARMV7_NEON |
-#endif
-#if defined(OPENSSL_STATIC_ARMCAP_AES) || defined(__ARM_FEATURE_AES)
-    ARMV8_AES |
-#endif
-#if defined(OPENSSL_STATIC_ARMCAP_PMULL) || defined(__ARM_FEATURE_AES)
-    ARMV8_PMULL |
-#endif
-#if defined(OPENSSL_STATIC_ARMCAP_SHA1) || defined(__ARM_FEATURE_SHA2)
-    ARMV8_SHA1 |
-#endif
-#if defined(OPENSSL_STATIC_ARMCAP_SHA256) || defined(__ARM_FEATURE_SHA2)
-    ARMV8_SHA256 |
-#endif
-#if defined(__ARM_FEATURE_SHA512)
-    ARMV8_SHA512 |
-#endif
-    0;
-
-#else
-HIDDEN uint32_t OPENSSL_armcap_P = 0;
-
-uint32_t *OPENSSL_get_armcap_pointer_for_test(void) {
+uint32_t *bssl::OPENSSL_get_armcap_pointer_for_test() {
   OPENSSL_init_cpuid();
   return &OPENSSL_armcap_P;
 }
-#endif
 
-uint32_t OPENSSL_get_armcap(void) {
+uint32_t bssl::OPENSSL_get_armcap() {
   OPENSSL_init_cpuid();
   return OPENSSL_armcap_P;
 }
-
 #endif
 
 #if defined(NEED_CPUID)
-static CRYPTO_once_t once = CRYPTO_ONCE_INIT;
-void OPENSSL_init_cpuid(void) { CRYPTO_once(&once, OPENSSL_cpuid_setup); }
+static bssl::CRYPTO_once_t once = CRYPTO_ONCE_INIT;
+void bssl::OPENSSL_init_cpuid() { CRYPTO_once(&once, OPENSSL_cpuid_setup); }
 #endif
 
-void CRYPTO_library_init(void) {}
+void CRYPTO_library_init() {}
 
-int CRYPTO_is_confidential_build(void) {
+int CRYPTO_is_confidential_build() {
 #if defined(BORINGSSL_CONFIDENTIAL)
   return 1;
 #else
@@ -130,7 +99,7 @@ int CRYPTO_is_confidential_build(void) {
 #endif
 }
 
-void CRYPTO_pre_sandbox_init(void) {
+void CRYPTO_pre_sandbox_init() {
   // Read from /proc/cpuinfo if needed.
   OPENSSL_init_cpuid();
   // Open /dev/urandom if needed.
@@ -158,24 +127,26 @@ const char *OpenSSL_version(int which) {
   }
 }
 
-unsigned long SSLeay(void) { return OPENSSL_VERSION_NUMBER; }
+unsigned long SSLeay() { return OPENSSL_VERSION_NUMBER; }
+
+unsigned long OpenSSL_version_num() { return OPENSSL_VERSION_NUMBER; }
 
-unsigned long OpenSSL_version_num(void) { return OPENSSL_VERSION_NUMBER; }
+int CRYPTO_malloc_init() { return 1; }
 
-int CRYPTO_malloc_init(void) { return 1; }
+int OPENSSL_malloc_init() { return 1; }
 
-int OPENSSL_malloc_init(void) { return 1; }
+void ENGINE_load_builtin_engines() {}
 
-void ENGINE_load_builtin_engines(void) {}
+int ENGINE_register_all_complete() { return 1; }
 
-int ENGINE_register_all_complete(void) { return 1; }
+void ENGINE_cleanup() {}
 
-void OPENSSL_load_builtin_modules(void) {}
+void OPENSSL_load_builtin_modules() {}
 
 int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
   return 1;
 }
 
-void OPENSSL_cleanup(void) {}
+void OPENSSL_cleanup() {}
 
-FILE *CRYPTO_get_stderr(void) { return stderr; }
+FILE *bssl::CRYPTO_get_stderr() { return stderr; }

data/third_party/boringssl-with-bazel/crypto/curve25519/curve25519.cc

@@ -24,7 +24,7 @@
 
 #include <openssl/mem.h>
 #include <openssl/rand.h>
-#include <openssl/sha.h>
+#include <openssl/sha2.h>
 
 #include "../internal.h"
 #include "internal.h"
@@ -41,6 +41,8 @@
 #endif
 
 
+using namespace bssl;
+
 // Low-level intrinsic operations
 
 static uint64_t load_3(const uint8_t *in) {
@@ -68,7 +70,7 @@ static uint64_t load_4(const uint8_t *in) {
 typedef uint64_t fe_limb_t;
 #define FE_NUM_LIMBS 5
 
-// assert_fe asserts that |f| satisfies bounds:
+// assert_fe asserts that `f` satisfies bounds:
 //
 //  [[0x0 ~> 0x8cccccccccccc],
 //   [0x0 ~> 0x8cccccccccccc],
@@ -85,7 +87,7 @@ typedef uint64_t fe_limb_t;
     }                                                                   \
   } while (0)
 
-// assert_fe_loose asserts that |f| satisfies bounds:
+// assert_fe_loose asserts that `f` satisfies bounds:
 //
 //  [[0x0 ~> 0x1a666666666664],
 //   [0x0 ~> 0x1a666666666664],
@@ -107,7 +109,7 @@ typedef uint64_t fe_limb_t;
 typedef uint32_t fe_limb_t;
 #define FE_NUM_LIMBS 10
 
-// assert_fe asserts that |f| satisfies bounds:
+// assert_fe asserts that `f` satisfies bounds:
 //
 //  [[0x0 ~> 0x4666666], [0x0 ~> 0x2333333],
 //   [0x0 ~> 0x4666666], [0x0 ~> 0x2333333],
@@ -125,7 +127,7 @@ typedef uint32_t fe_limb_t;
     }                                                                    \
   } while (0)
 
-// assert_fe_loose asserts that |f| satisfies bounds:
+// assert_fe_loose asserts that `f` satisfies bounds:
 //
 //  [[0x0 ~> 0xd333332], [0x0 ~> 0x6999999],
 //   [0x0 ~> 0xd333332], [0x0 ~> 0x6999999],
@@ -149,7 +151,7 @@ static_assert(sizeof(fe) == sizeof(fe_limb_t) * FE_NUM_LIMBS,
               "fe_limb_t[FE_NUM_LIMBS] is inconsistent with fe");
 
 static void fe_frombytes_strict(fe *h, const uint8_t s[32]) {
-  // |fiat_25519_from_bytes| requires the top-most bit be clear.
+  // `fiat_25519_from_bytes` requires the top-most bit be clear.
   declassify_assert((s[31] & 0x80) == 0);
   fiat_25519_from_bytes(h->v, s);
   assert_fe(h->v);
@@ -284,7 +286,7 @@ static void fe_neg(fe_loose *h, const fe *f) {
 //
 // Preconditions: b in {0,1}.
 static void fe_cmov(fe_loose *f, const fe_loose *g, fe_limb_t b) {
-  // Silence an unused function warning. |fiat_25519_selectznz| isn't quite the
+  // Silence an unused function warning. `fiat_25519_selectznz` isn't quite the
   // calling convention the rest of this code wants, so implement it by hand.
   //
   // TODO(davidben): Switch to fiat's calling convention, or ask fiat to emit a
@@ -460,7 +462,7 @@ static void fe_pow22523(fe *out, const fe *z) {
 
 // Group operations.
 
-void x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h) {
+void bssl::x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h) {
   fe recip;
   fe x;
   fe y;
@@ -484,7 +486,7 @@ static void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
   s[31] ^= fe_isnegative(&x) << 7;
 }
 
-int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
+int bssl::x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
   fe u;
   fe_loose v;
   fe w;
@@ -558,7 +560,7 @@ static void ge_p3_to_p2(ge_p2 *r, const ge_p3 *p) {
 }
 
 // r = p
-void x25519_ge_p3_to_cached(ge_cached *r, const ge_p3 *p) {
+void bssl::x25519_ge_p3_to_cached(ge_cached *r, const ge_p3 *p) {
   fe_add(&r->YplusX, &p->Y, &p->X);
   fe_sub(&r->YminusX, &p->Y, &p->X);
   fe_copy_lt(&r->Z, &p->Z);
@@ -566,14 +568,14 @@ void x25519_ge_p3_to_cached(ge_cached *r, const ge_p3 *p) {
 }
 
 // r = p
-void x25519_ge_p1p1_to_p2(ge_p2 *r, const ge_p1p1 *p) {
+void bssl::x25519_ge_p1p1_to_p2(ge_p2 *r, const ge_p1p1 *p) {
   fe_mul_tll(&r->X, &p->X, &p->T);
   fe_mul_tll(&r->Y, &p->Y, &p->Z);
   fe_mul_tll(&r->Z, &p->Z, &p->T);
 }
 
 // r = p
-void x25519_ge_p1p1_to_p3(ge_p3 *r, const ge_p1p1 *p) {
+void bssl::x25519_ge_p1p1_to_p3(ge_p3 *r, const ge_p1p1 *p) {
   fe_mul_tll(&r->X, &p->X, &p->T);
   fe_mul_tll(&r->Y, &p->Y, &p->Z);
   fe_mul_tll(&r->Z, &p->Z, &p->T);
@@ -648,7 +650,7 @@ static void ge_msub(ge_p1p1 *r, const ge_p3 *p, const ge_precomp *q) {
 }
 
 // r = p + q
-void x25519_ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q) {
+void bssl::x25519_ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q) {
   fe trX, trY, trZ, trT;
 
   fe_add(&r->X, &p->Y, &p->X);
@@ -666,7 +668,7 @@ void x25519_ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q) {
 }
 
 // r = p - q
-void x25519_ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q) {
+void bssl::x25519_ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q) {
   fe trX, trY, trZ, trT;
 
   fe_add(&r->X, &p->Y, &p->X);
@@ -689,16 +691,16 @@ static void cmov(ge_precomp *t, const ge_precomp *u, uint8_t b) {
   fe_cmov(&t->xy2d, &u->xy2d, b);
 }
 
-void x25519_ge_scalarmult_small_precomp(
+void bssl::x25519_ge_scalarmult_small_precomp(
     ge_p3 *h, const uint8_t a[32], const uint8_t precomp_table[15 * 2 * 32]) {
-  // precomp_table is first expanded into matching |ge_precomp|
+  // precomp_table is first expanded into matching `ge_precomp`
   // elements.
   ge_precomp multiples[15];
 
   unsigned i;
   for (i = 0; i < 15; i++) {
     // The precomputed table is assumed to already clear the top bit, so
-    // |fe_frombytes_strict| may be used directly.
+    // `fe_frombytes_strict` may be used directly.
     const uint8_t *bytes = &precomp_table[i * (2 * 32)];
     fe x, y;
     fe_frombytes_strict(&x, bytes);
@@ -711,7 +713,7 @@ void x25519_ge_scalarmult_small_precomp(
     fe_mul_llt(&out->xy2d, &out->xy2d, &d2);
   }
 
-  // See the comment above |k25519SmallPrecomp| about the structure of the
+  // See the comment above `k25519SmallPrecomp` about the structure of the
   // precomputed elements. This loop does 64 additions and 64 doublings to
   // calculate the result.
   ge_p3_0(h);
@@ -745,7 +747,7 @@ void x25519_ge_scalarmult_small_precomp(
 
 #if defined(OPENSSL_SMALL)
 
-void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) {
+void bssl::x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) {
   x25519_ge_scalarmult_small_precomp(h, a, k25519SmallPrecomp);
 }
 
@@ -762,7 +764,7 @@ static void table_select(ge_precomp *t, const int pos, const signed char b) {
 #if defined(__clang__)  // materialize for vectorization, 6% speedup
   __asm__("" : "+m"(t_bytes) : /*no inputs*/);
 #endif
-  static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]), "");
+  static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]));
   for (int i = 0; i < 8; i++) {
     constant_time_conditional_memxor(t_bytes, k25519Precomp[pos][i],
                                      sizeof(t_bytes),
@@ -791,7 +793,7 @@ static void table_select(ge_precomp *t, const int pos, const signed char b) {
 //
 // Preconditions:
 //   a[31] <= 127
-void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) {
+void bssl::x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) {
 #if defined(BORINGSSL_FE25519_ADX)
   if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
       CRYPTO_is_ADX_capable()) {
@@ -862,7 +864,8 @@ static void cmov_cached(ge_cached *t, ge_cached *u, uint8_t b) {
 
 // r = scalar * A.
 // where a = a[0]+256*a[1]+...+256^31 a[31].
-void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A) {
+void bssl::x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar,
+                                const ge_p3 *A) {
   ge_p2 Ai_p2[8];
   ge_cached Ai[16];
   ge_p1p1 t;
@@ -1021,9 +1024,9 @@ static void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
   }
 }
 
-// int64_lshift21 returns |a << 21| but is defined when shifting bits into the
+// int64_lshift21 returns `a << 21` but is defined when shifting bits into the
 // sign bit. This works around a language flaw in C.
-static inline int64_t int64_lshift21(int64_t a) {
+static int64_t int64_lshift21(int64_t a) {
   return (int64_t)((uint64_t)a << 21);
 }
 
@@ -1037,7 +1040,7 @@ static inline int64_t int64_lshift21(int64_t a) {
 //   s[0]+256*s[1]+...+256^31*s[31] = s mod l
 //   where l = 2^252 + 27742317777372353535851937790883648493.
 //   Overwrites s in place.
-void x25519_sc_reduce(uint8_t s[64]) {
+void bssl::x25519_sc_reduce(uint8_t s[64]) {
   int64_t s0 = 2097151 & load_3(s);
   int64_t s1 = 2097151 & (load_4(s + 2) >> 5);
   int64_t s2 = 2097151 & (load_3(s + 5) >> 2);

data/third_party/boringssl-with-bazel/crypto/curve25519/curve25519_tables.h

@@ -16,7 +16,7 @@
 //    ./make_curve25519_tables.py > curve25519_tables.h
 
 
-static const fe d = {{
+static const bssl::fe d = {{
 #if defined(OPENSSL_64_BIT)
     929955233495203, 466365720129213, 1662059464998953, 2033849074728123,
     1442794654840575
@@ -26,7 +26,7 @@ static const fe d = {{
 #endif
 }};
 
-static const fe sqrtm1 = {{
+static const bssl::fe sqrtm1 = {{
 #if defined(OPENSSL_64_BIT)
     1718705420411056, 234908883556509, 2233514472574048, 2117202627021982,
     765476049583133
@@ -36,7 +36,7 @@ static const fe sqrtm1 = {{
 #endif
 }};
 
-static const fe d2 = {{
+static const bssl::fe d2 = {{
 #if defined(OPENSSL_64_BIT)
     1859910466990425, 932731440258426, 1072319116312658, 1815898335770999,
     633789495995903
@@ -52,7 +52,7 @@ static const fe d2 = {{
 // one. The standard table is 30,720 bytes while this one is just 960.
 //
 // This table contains 15 pairs of group elements, (x, y), where each field
-// element is serialised with |fe_tobytes|. If |i| is the index of the group
+// element is serialised with `fe_tobytes`. If `i` is the index of the group
 // element then consider i+1 as a four-bit number: (i₀, i₁, i₂, i₃) (where i₀
 // is the most significant bit). The value of the group element is then:
 // (i₀×2^192 + i₁×2^128 + i₂×2^64 + i₃)G, where G is the generator.
@@ -142,7 +142,7 @@ static const uint8_t k25519SmallPrecomp[15 * 2 * 32] = {
 #else
 
 // k25519Precomp[i][j] = (j+1)*256^i*B
-const uint8_t k25519Precomp[32][8][3][32] = {
+const uint8_t bssl::k25519Precomp[32][8][3][32] = {
     {
         {
             {0x85, 0x3b, 0x8c, 0xf5, 0xc6, 0x93, 0xbc, 0x2f, 0x19, 0xe,  0x8c,
@@ -3028,7 +3028,7 @@ const uint8_t k25519Precomp[32][8][3][32] = {
 #endif  // OPENSSL_SMALL
 
 // Bi[i] = (2*i+1)*B
-static const ge_precomp Bi[8] = {
+static const bssl::ge_precomp Bi[8] = {
     {
         {{
 #if defined(OPENSSL_64_BIT)

data/third_party/boringssl-with-bazel/crypto/curve25519/internal.h

@@ -19,37 +19,35 @@
 
 #include "../internal.h"
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
+BSSL_NAMESPACE_BEGIN
 
 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE)
 #define BORINGSSL_X25519_NEON
 
 // x25519_NEON is defined in asm/x25519-arm.S.
-void x25519_NEON(uint8_t out[32], const uint8_t scalar[32],
-                 const uint8_t point[32]);
+extern "C" void x25519_NEON(uint8_t out[32], const uint8_t scalar[32],
+                            const uint8_t point[32]);
 #endif
 
 #if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \
-    defined(__GNUC__) && defined(__x86_64__) && !defined(OPENSSL_WINDOWS)
+    (defined(__APPLE__) || defined(__ELF__)) && defined(OPENSSL_X86_64)
 #define BORINGSSL_FE25519_ADX
 
 // fiat_curve25519_adx_mul is defined in
 // third_party/fiat/asm/fiat_curve25519_adx_mul.S
-void __attribute__((sysv_abi))
-fiat_curve25519_adx_mul(uint64_t out[4], const uint64_t in1[4],
-                        const uint64_t in2[4]);
+extern "C" void __attribute__((sysv_abi)) fiat_curve25519_adx_mul(
+    uint64_t out[4], const uint64_t in1[4], const uint64_t in2[4]);
 
 // fiat_curve25519_adx_square is defined in
 // third_party/fiat/asm/fiat_curve25519_adx_square.S
-void __attribute__((sysv_abi))
-fiat_curve25519_adx_square(uint64_t out[4], const uint64_t in[4]);
+extern "C" void __attribute__((sysv_abi)) fiat_curve25519_adx_square(
+    uint64_t out[4], const uint64_t in[4]);
 
 // x25519_scalar_mult_adx is defined in third_party/fiat/curve25519_64_adx.h
 void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
                             const uint8_t point[32]);
 void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]);
+
 #endif
 
 #if defined(OPENSSL_64_BIT)
@@ -140,6 +138,8 @@ enum spake2_state_t {
   spake2_state_key_generated,
 };
 
+BSSL_NAMESPACE_END
+
 struct spake2_ctx_st {
   uint8_t private_key[32];
   uint8_t my_msg[32];
@@ -150,15 +150,14 @@ struct spake2_ctx_st {
   uint8_t *their_name;
   size_t their_name_len;
   enum spake2_role_t my_role;
-  enum spake2_state_t state;
+  enum bssl::spake2_state_t state;
   char disable_password_scalar_hack;
 };
 
+BSSL_NAMESPACE_BEGIN
 
 extern const uint8_t k25519Precomp[32][8][3][32];
 
-#if defined(__cplusplus)
-}  // extern C
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_CURVE25519_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/curve25519/spake25519.cc

@@ -17,16 +17,21 @@
 #include <assert.h>
 #include <string.h>
 
+#include <iterator>
+
 #include <openssl/bytestring.h>
 #include <openssl/mem.h>
 #include <openssl/rand.h>
-#include <openssl/sha.h>
+#include <openssl/sha2.h>
 
 #include "../fipsmodule/bn/internal.h"
 #include "../internal.h"
+#include "../mem_internal.h"
 #include "./internal.h"
 
 
+using namespace bssl;
+
 // The following precomputation tables are for the following
 // points used in the SPAKE2 protocol.
 //
@@ -276,10 +281,9 @@ static const uint8_t kSpakeMSmallPrecomp[15 * 2 * 32] = {
 SPAKE2_CTX *SPAKE2_CTX_new(enum spake2_role_t my_role, const uint8_t *my_name,
                            size_t my_name_len, const uint8_t *their_name,
                            size_t their_name_len) {
-  SPAKE2_CTX *ctx =
-      reinterpret_cast<SPAKE2_CTX *>(OPENSSL_zalloc(sizeof(SPAKE2_CTX)));
-  if (ctx == NULL) {
-    return NULL;
+  SPAKE2_CTX *ctx = New<SPAKE2_CTX>();
+  if (ctx == nullptr) {
+    return nullptr;
   }
 
   ctx->my_role = my_role;
@@ -290,23 +294,23 @@ SPAKE2_CTX *SPAKE2_CTX_new(enum spake2_role_t my_role, const uint8_t *my_name,
   if (!CBS_stow(&my_name_cbs, &ctx->my_name, &ctx->my_name_len) ||
       !CBS_stow(&their_name_cbs, &ctx->their_name, &ctx->their_name_len)) {
     SPAKE2_CTX_free(ctx);
-    return NULL;
+    return nullptr;
   }
 
   return ctx;
 }
 
 void SPAKE2_CTX_free(SPAKE2_CTX *ctx) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return;
   }
 
   OPENSSL_free(ctx->my_name);
   OPENSSL_free(ctx->their_name);
-  OPENSSL_free(ctx);
+  Delete(ctx);
 }
 
-// left_shift_3 sets |n| to |n|*8, where |n| is represented in little-endian
+// left_shift_3 sets `n` to `n`*8, where `n` is represented in little-endian
 // order.
 static void left_shift_3(uint8_t n[32]) {
   uint8_t carry = 0;
@@ -330,21 +334,20 @@ static const scalar kOrder = {
     {TOBN(0x5812631a, 0x5cf5d3ed), TOBN(0x14def9de, 0xa2f79cd6),
      TOBN(0x00000000, 0x00000000), TOBN(0x10000000, 0x00000000)}};
 
-// scalar_cmov copies |src| to |dest| if |mask| is all ones.
+// scalar_cmov copies `src` to `dest` if `mask` is all ones.
 static void scalar_cmov(scalar *dest, const scalar *src, crypto_word_t mask) {
   bn_select_words(dest->words, mask, src->words, dest->words,
-                  OPENSSL_ARRAY_SIZE(dest->words));
+                  std::size(dest->words));
 }
 
-// scalar_double sets |s| to |2×s|.
+// scalar_double sets `s` to `2×s`.
 static void scalar_double(scalar *s) {
-  bn_add_words(s->words, s->words, s->words, OPENSSL_ARRAY_SIZE(s->words));
+  bn_add_words(s->words, s->words, s->words, std::size(s->words));
 }
 
-// scalar_add sets |dest| to |dest| plus |src|.
+// scalar_add sets `dest` to `dest` plus `src`.
 static void scalar_add(scalar *dest, const scalar *src) {
-  bn_add_words(dest->words, dest->words, src->words,
-               OPENSSL_ARRAY_SIZE(dest->words));
+  bn_add_words(dest->words, dest->words, src->words, std::size(dest->words));
 }
 
 int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
@@ -375,8 +378,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
   OPENSSL_memcpy(ctx->password_hash, password_tmp, sizeof(ctx->password_hash));
   x25519_sc_reduce(password_tmp);
 
-  // Due to a copy-paste error, the call to |left_shift_3| was omitted after
-  // the |x25519_sc_reduce|, just above. This meant that |ctx->password_scalar|
+  // Due to a copy-paste error, the call to `left_shift_3` was omitted after
+  // the `x25519_sc_reduce`, just above. This meant that `ctx->password_scalar`
   // was not a multiple of eight to clear the cofactor and thus three bits of
   // the password hash would leak. In order to fix this in a unilateral way,
   // points of small order are added to the mask point such that it is in the
@@ -392,8 +395,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
   scalar password_scalar;
   OPENSSL_memcpy(&password_scalar, password_tmp, sizeof(password_scalar));
 
-  // |password_scalar| is the result of |x25519_sc_reduce| and thus is, at
-  // most, $l-1$ (where $l$ is |kOrder|, the order of the prime-order subgroup
+  // `password_scalar` is the result of `x25519_sc_reduce` and thus is, at
+  // most, $l-1$ (where $l$ is `kOrder`, the order of the prime-order subgroup
   // of Ed25519). In the following, we may add $l + 2×l + 4×l$ for a max value
   // of $8×l-1$. That is < 2**256, as required.