grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/evp/evp_kem.cc

@@ -0,0 +1,82 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/evp.h>
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <openssl/err.h>
+
+#include "../internal.h"
+#include "internal.h"
+
+using namespace bssl;
+
+// Checks whether KEM function invocation is valid.
+// `ciphertext_len` may be nullptr if it is not required to match.
+// `secret_len` must always match.
+static bool check_kem_invocation(const EVP_KEM *kem,
+                                 const size_t *ciphertext_len,
+                                 size_t secret_len,
+                                 const bssl::EvpPkey *pkey_impl) {
+  if (pkey_impl == nullptr || pkey_impl->pkey == nullptr ||
+      pkey_impl->ameth == nullptr) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
+    return false;
+  }
+  if (kem->pkey_id != EVP_PKEY_id(pkey_impl)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    return false;
+  }
+  if (ciphertext_len && *ciphertext_len != kem->ciphertext_len) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_CIPHERTEXT_LENGTH);
+    return false;
+  }
+  if (secret_len != kem->secret_len) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_SECRET_LENGTH);
+    return false;
+  }
+  return true;
+}
+
+size_t EVP_KEM_ciphertext_len(const EVP_KEM *kem) {
+  return kem->ciphertext_len;
+}
+
+size_t EVP_KEM_secret_len(const EVP_KEM *kem) {
+  return kem->secret_len;
+}
+
+int EVP_KEM_encap(const EVP_KEM *kem, uint8_t *out_ciphertext,
+                  size_t ciphertext_len, uint8_t *out_secret, size_t secret_len,
+                  const EVP_PKEY *peer_key) {
+  auto *pkey_impl = FromOpaque(peer_key);
+  if (!check_kem_invocation(kem, &ciphertext_len, secret_len, pkey_impl)) {
+    return 0;
+  }
+  return kem->encap(out_ciphertext, ciphertext_len, out_secret, secret_len,
+                    pkey_impl);
+}
+
+int EVP_KEM_decap(const EVP_KEM *kem, uint8_t *out_secret, size_t secret_len,
+                  const uint8_t *ciphertext, size_t ciphertext_len,
+                  const EVP_PKEY *key) {
+  auto *pkey_impl = FromOpaque(key);
+  if (!check_kem_invocation(kem, nullptr, secret_len, pkey_impl)) {
+    return 0;
+  }
+  return kem->decap(out_secret, secret_len, ciphertext, ciphertext_len,
+                    pkey_impl);
+}

data/third_party/boringssl-with-bazel/crypto/evp/internal.h

@@ -15,93 +15,145 @@
 #ifndef OPENSSL_HEADER_CRYPTO_EVP_INTERNAL_H
 #define OPENSSL_HEADER_CRYPTO_EVP_INTERNAL_H
 
-#include <openssl/base.h>
+#include <openssl/evp.h>
 
-#include <openssl/rsa.h>
+#include <array>
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
+#include <openssl/span.h>
 
+#include "../internal.h"
+#include "../mem_internal.h"
 
-typedef struct evp_pkey_asn1_method_st EVP_PKEY_ASN1_METHOD;
-typedef struct evp_pkey_method_st EVP_PKEY_METHOD;
 
-struct evp_pkey_asn1_method_st {
-  int pkey_id;
-  uint8_t oid[9];
-  uint8_t oid_len;
+DECLARE_OPAQUE_STRUCT(evp_pkey_st, EvpPkey)
+DECLARE_OPAQUE_STRUCT(evp_pkey_ctx_st, EvpPkeyCtx)
 
-  const EVP_PKEY_METHOD *pkey_method;
+BSSL_NAMESPACE_BEGIN
 
-  // pub_decode decodes |params| and |key| as a SubjectPublicKeyInfo
-  // and writes the result into |out|. It returns one on success and zero on
-  // error. |params| is the AlgorithmIdentifier after the OBJECT IDENTIFIER
-  // type field, and |key| is the contents of the subjectPublicKey with the
-  // leading padding byte checked and removed. Although X.509 uses BIT STRINGs
-  // to represent SubjectPublicKeyInfo, every key type defined encodes the key
-  // as a byte string with the same conversion to BIT STRING.
-  int (*pub_decode)(EVP_PKEY *out, CBS *params, CBS *key);
+typedef struct evp_pkey_asn1_method_st EVP_PKEY_ASN1_METHOD;
+typedef struct evp_pkey_ctx_method_st EVP_PKEY_CTX_METHOD;
+
+BSSL_NAMESPACE_END
 
-  // pub_encode encodes |key| as a SubjectPublicKeyInfo and appends the result
-  // to |out|. It returns one on success and zero on error.
-  int (*pub_encode)(CBB *out, const EVP_PKEY *key);
+struct evp_pkey_alg_st {
+  // method and pkey_method implement operations for this `EVP_PKEY_ALG`.
+  const bssl::EVP_PKEY_ASN1_METHOD *method;
+  const bssl::EVP_PKEY_CTX_METHOD *pkey_method;
+};
 
-  int (*pub_cmp)(const EVP_PKEY *a, const EVP_PKEY *b);
+BSSL_NAMESPACE_BEGIN
 
-  // priv_decode decodes |params| and |key| as a PrivateKeyInfo and writes the
-  // result into |out|. It returns one on success and zero on error. |params| is
-  // the AlgorithmIdentifier after the OBJECT IDENTIFIER type field, and |key|
-  // is the contents of the OCTET STRING privateKey field.
-  int (*priv_decode)(EVP_PKEY *out, CBS *params, CBS *key);
+enum evp_decode_result_t {
+  evp_decode_error = 0,
+  evp_decode_ok = 1,
+  evp_decode_unsupported = 2,
+};
 
-  // priv_encode encodes |key| as a PrivateKeyInfo and appends the result to
-  // |out|. It returns one on success and zero on error.
-  int (*priv_encode)(CBB *out, const EVP_PKEY *key);
+struct evp_pkey_asn1_method_st {
+  // pkey_id contains one of the `EVP_PKEY_*` values and corresponds to the OID
+  // in the key type's AlgorithmIdentifier.
+  int pkey_id;
+  uint8_t oid[9];
+  uint8_t oid_len;
 
-  int (*set_priv_raw)(EVP_PKEY *pkey, const uint8_t *in, size_t len);
-  int (*set_pub_raw)(EVP_PKEY *pkey, const uint8_t *in, size_t len);
-  int (*get_priv_raw)(const EVP_PKEY *pkey, uint8_t *out, size_t *out_len);
-  int (*get_pub_raw)(const EVP_PKEY *pkey, uint8_t *out, size_t *out_len);
+  const EVP_PKEY_CTX_METHOD *pkey_method;
+
+  // pub_decode decodes `params` and `key` as a SubjectPublicKeyInfo
+  // and writes the result into `out`. It returns `evp_decode_ok` on success,
+  // and `evp_decode_error` on error, and `evp_decode_unsupported` if the input
+  // was not supported by this `EVP_PKEY_ALG`. In case of
+  // `evp_decode_unsupported`, it does not add an error to the error queue. May
+  // modify `params` and `key`. Callers must make a copy if calling in a loop.
+  //
+  // `params` is the AlgorithmIdentifier after the OBJECT IDENTIFIER type field,
+  // and `key` is the contents of the subjectPublicKey with the leading padding
+  // byte checked and removed. Although X.509 uses BIT STRINGs to represent
+  // SubjectPublicKeyInfo, every key type defined encodes the key as a byte
+  // string with the same conversion to BIT STRING.
+  evp_decode_result_t (*pub_decode)(const EVP_PKEY_ALG *alg, EvpPkey *out,
+                                    CBS *params, CBS *key);
+
+  // pub_encode encodes `key` as a SubjectPublicKeyInfo and appends the result
+  // to `out`. It returns one on success and zero on error.
+  int (*pub_encode)(CBB *out, const EvpPkey *key);
+
+  bool (*pub_equal)(const EvpPkey *a, const EvpPkey *b);
+
+  // pub_present returns true iff the `pk` has a public key. (If so, validity
+  // is not guaranteed and should be checked separately.)
+  bool (*pub_present)(const EvpPkey *pk);
+
+  // pub_copy sets the key data of `out` to a newly allocated key data structure
+  // which contains a copy of only the public key of `pk`, freeing any key
+  // previously in `out`. Returns true on success or false on failure.
+  bool (*pub_copy)(EvpPkey *out, const EvpPkey *pk);
+
+  // priv_decode decodes `params` and `key` as a PrivateKeyInfo and writes the
+  // result into `out`.  It returns `evp_decode_ok` on success, and
+  // `evp_decode_error` on error, and `evp_decode_unsupported` if the key type
+  // was not supported by this `EVP_PKEY_ALG`. In case of
+  // `evp_decode_unsupported`, it does not add an error to the error queue. May
+  // modify `params` and `key`. Callers must make a copy if calling in a loop.
+  //
+  // `params` is the AlgorithmIdentifier after the OBJECT IDENTIFIER type field,
+  // and `key` is the contents of the OCTET STRING privateKey field.
+  evp_decode_result_t (*priv_decode)(const EVP_PKEY_ALG *alg, EvpPkey *out,
+                                     CBS *params, CBS *key);
+
+  // priv_encode encodes `key` as a PrivateKeyInfo and appends the result to
+  // `out`. It returns one on success and zero on error.
+  int (*priv_encode)(CBB *out, const EvpPkey *key);
+
+  // priv_present returns true iff the `pk` has a private key. (If so, validity
+  // is not guaranteed and should be checked separately.)
+  bool (*priv_present)(const EvpPkey *pk);
+
+  int (*set_priv_raw)(EvpPkey *pkey, const uint8_t *in, size_t len);
+  int (*set_priv_seed)(EvpPkey *pkey, const uint8_t *in, size_t len);
+  int (*set_pub_raw)(EvpPkey *pkey, const uint8_t *in, size_t len);
+  int (*get_priv_raw)(const EvpPkey *pkey, uint8_t *out, size_t *out_len);
+  int (*get_priv_seed)(const EvpPkey *pkey, uint8_t *out, size_t *out_len);
+  int (*get_pub_raw)(const EvpPkey *pkey, uint8_t *out, size_t *out_len);
 
   // TODO(davidben): Can these be merged with the functions above? OpenSSL does
-  // not implement |EVP_PKEY_get_raw_public_key|, etc., for |EVP_PKEY_EC|, but
+  // not implement `EVP_PKEY_get_raw_public_key`, etc., for `EVP_PKEY_EC`, but
   // the distinction seems unimportant. OpenSSL 3.0 has since renamed
-  // |EVP_PKEY_get1_tls_encodedpoint| to |EVP_PKEY_get1_encoded_public_key|, and
+  // `EVP_PKEY_get1_tls_encodedpoint` to `EVP_PKEY_get1_encoded_public_key`, and
   // what is the difference between "raw" and an "encoded" public key.
   //
   // One nuisance is the notion of "raw" is slightly ambiguous for EC keys. Is
   // it a DER ECPrivateKey or just the scalar?
-  int (*set1_tls_encodedpoint)(EVP_PKEY *pkey, const uint8_t *in, size_t len);
-  size_t (*get1_tls_encodedpoint)(const EVP_PKEY *pkey, uint8_t **out_ptr);
+  int (*set1_tls_encodedpoint)(EvpPkey *pkey, const uint8_t *in, size_t len);
+  size_t (*get1_tls_encodedpoint)(const EvpPkey *pkey, uint8_t **out_ptr);
 
-  // pkey_opaque returns 1 if the |pk| is opaque. Opaque keys are backed by
+  // pkey_opaque returns 1 if the `pk` is opaque. Opaque keys are backed by
   // custom implementations which do not expose key material and parameters.
-  int (*pkey_opaque)(const EVP_PKEY *pk);
+  int (*pkey_opaque)(const EvpPkey *pk);
 
-  int (*pkey_size)(const EVP_PKEY *pk);
-  int (*pkey_bits)(const EVP_PKEY *pk);
+  int (*pkey_size)(const EvpPkey *pk);
+  int (*pkey_bits)(const EvpPkey *pk);
 
-  int (*param_missing)(const EVP_PKEY *pk);
-  int (*param_copy)(EVP_PKEY *to, const EVP_PKEY *from);
-  int (*param_cmp)(const EVP_PKEY *a, const EVP_PKEY *b);
+  int (*param_missing)(const EvpPkey *pk);
+  int (*param_copy)(EvpPkey *to, const EvpPkey *from);
+  bool (*param_equal)(const EvpPkey *a, const EvpPkey *b);
 
-  void (*pkey_free)(EVP_PKEY *pkey);
+  void (*pkey_free)(EvpPkey *pkey);
 } /* EVP_PKEY_ASN1_METHOD */;
 
-struct evp_pkey_st {
-  CRYPTO_refcount_t references;
+class EvpPkey : public evp_pkey_st, public RefCounted<EvpPkey> {
+ public:
+  EvpPkey();
 
-  // type contains one of the EVP_PKEY_* values or NID_undef and determines
-  // the type of |pkey|.
-  int type;
+  // pkey contains a pointer to a structure dependent on `ameth`.
+  void *pkey = nullptr;
 
-  // pkey contains a pointer to a structure dependent on |type|.
-  void *pkey;
+  // ameth contains a pointer to a method table that determines the key type, or
+  // nullptr if the key is empty.
+  const bssl::EVP_PKEY_ASN1_METHOD *ameth = nullptr;
 
-  // ameth contains a pointer to a method table that contains many ASN.1
-  // methods for the key type.
-  const EVP_PKEY_ASN1_METHOD *ameth;
+ private:
+  ~EvpPkey();
+  friend RefCounted;
 } /* EVP_PKEY */;
 
 #define EVP_PKEY_OP_UNDEFINED 0
@@ -113,23 +165,22 @@ struct evp_pkey_st {
 #define EVP_PKEY_OP_DECRYPT (1 << 7)
 #define EVP_PKEY_OP_DERIVE (1 << 8)
 #define EVP_PKEY_OP_PARAMGEN (1 << 9)
+#define EVP_PKEY_OP_ENCAPSULATE (1 << 10)
+#define EVP_PKEY_OP_DECAPSULATE (1 << 11)
 
 #define EVP_PKEY_OP_TYPE_SIG \
   (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY | EVP_PKEY_OP_VERIFYRECOVER)
 
 #define EVP_PKEY_OP_TYPE_CRYPT (EVP_PKEY_OP_ENCRYPT | EVP_PKEY_OP_DECRYPT)
 
-#define EVP_PKEY_OP_TYPE_NOGEN \
-  (EVP_PKEY_OP_SIG | EVP_PKEY_OP_CRYPT | EVP_PKEY_OP_DERIVE)
-
 #define EVP_PKEY_OP_TYPE_GEN (EVP_PKEY_OP_KEYGEN | EVP_PKEY_OP_PARAMGEN)
 
-// EVP_PKEY_CTX_ctrl performs |cmd| on |ctx|. The |keytype| and |optype|
+// EVP_PKEY_CTX_ctrl performs `cmd` on `ctx`. The `keytype` and `optype`
 // arguments can be -1 to specify that any type and operation are acceptable,
-// otherwise |keytype| must match the type of |ctx| and the bits of |optype|
-// must intersect the operation flags set on |ctx|.
+// otherwise `keytype` must match the type of `ctx` and the bits of `optype`
+// must intersect the operation flags set on `ctx`.
 //
-// The |p1| and |p2| arguments depend on the value of |cmd|.
+// The `p1` and `p2` arguments depend on the value of `cmd`.
 //
 // It returns one on success and zero on error.
 OPENSSL_EXPORT int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
@@ -138,14 +189,14 @@ OPENSSL_EXPORT int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
 #define EVP_PKEY_CTRL_MD 1
 #define EVP_PKEY_CTRL_GET_MD 2
 
-// EVP_PKEY_CTRL_PEER_KEY is called with different values of |p1|:
-//   0: Is called from |EVP_PKEY_derive_set_peer| and |p2| contains a peer key.
+// EVP_PKEY_CTRL_PEER_KEY is called with different values of `p1`:
+//   0: Is called from `EVP_PKEY_derive_set_peer` and `p2` contains a peer key.
 //      If the return value is <= 0, the key is rejected.
-//   1: Is called at the end of |EVP_PKEY_derive_set_peer| and |p2| contains a
+//   1: Is called at the end of `EVP_PKEY_derive_set_peer` and `p2` contains a
 //      peer key. If the return value is <= 0, the key is rejected.
-//   2: Is called with |p2| == NULL to test whether the peer's key was used.
+//   2: Is called with `p2` == NULL to test whether the peer's key was used.
 //      (EC)DH always return one in this case.
-//   3: Is called with |p2| == NULL to set whether the peer's key was used.
+//   3: Is called with `p2` == NULL to set whether the peer's key was used.
 //      (EC)DH always return one in this case. This was only used for GOST.
 #define EVP_PKEY_CTRL_PEER_KEY 3
 
@@ -165,104 +216,208 @@ OPENSSL_EXPORT int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
 #define EVP_PKEY_CTRL_GET_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 10)
 #define EVP_PKEY_CTRL_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 11)
 #define EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 12)
-#define EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID (EVP_PKEY_ALG_CTRL + 13)
+#define EVP_PKEY_CTRL_EC_PARAMGEN_GROUP (EVP_PKEY_ALG_CTRL + 13)
 #define EVP_PKEY_CTRL_HKDF_MODE (EVP_PKEY_ALG_CTRL + 14)
 #define EVP_PKEY_CTRL_HKDF_MD (EVP_PKEY_ALG_CTRL + 15)
 #define EVP_PKEY_CTRL_HKDF_KEY (EVP_PKEY_ALG_CTRL + 16)
 #define EVP_PKEY_CTRL_HKDF_SALT (EVP_PKEY_ALG_CTRL + 17)
 #define EVP_PKEY_CTRL_HKDF_INFO (EVP_PKEY_ALG_CTRL + 18)
 #define EVP_PKEY_CTRL_DH_PAD (EVP_PKEY_ALG_CTRL + 19)
+#define EVP_PKEY_CTRL_SIGNATURE_CONTEXT_STRING (EVP_PKEY_ALG_CTRL + 20)
+
+class EvpPkeyCtx : public evp_pkey_ctx_st {
+ public:
+  static constexpr bool kAllowUniquePtr = true;
+
+  // Use an optional virtual destructor. This class does not (yet) have a need
+  // for a vtable, but we intend to write code with vtables in the future.
+  // Virtual destructors add a reference to symbols in the C++ runtime, so trial
+  // the dependency here. This is, temporarily, gated on a build define. If this
+  // breaks your build, build with `BORINGSSL_TEMPORARY_NO_CXX_RUNTIME` and then
+  // contact the BoringSSL team, so we can help fix your build.
+  //
+  // TODO(crbug.com/486922845): Remove the `BORINGSSL_TEMPORARY_NO_CXX_RUNTIME`
+  // case.
+#if defined(BORINGSSL_TEMPORARY_NO_CXX_RUNTIME)
+  ~EvpPkeyCtx();
+#else
+  virtual ~EvpPkeyCtx();
+#endif
 
-struct evp_pkey_ctx_st {
   // Method associated with this operation
-  const EVP_PKEY_METHOD *pmeth;
-  // Engine that implements this method or NULL if builtin
-  ENGINE *engine;
-  // Key: may be NULL
-  EVP_PKEY *pkey;
-  // Peer key for key agreement, may be NULL
-  EVP_PKEY *peerkey;
-  // operation contains one of the |EVP_PKEY_OP_*| values.
-  int operation;
-  // Algorithm specific data
-  void *data;
-} /* EVP_PKEY_CTX */;
-
-struct evp_pkey_method_st {
+  const bssl::EVP_PKEY_CTX_METHOD *pmeth = nullptr;
+  // Key: may be nullptr
+  bssl::UniquePtr<EvpPkey> pkey;
+  // Peer key for key agreement, may be nullptr
+  bssl::UniquePtr<EvpPkey> peerkey;
+  // operation contains one of the `EVP_PKEY_OP_*` values.
+  int operation = EVP_PKEY_OP_UNDEFINED;
+  // Algorithm specific data.
+  // TODO(crbug.com/487376811): Since a `EVP_PKEY_CTX` never has its type change
+  // after creation, this should instead be a base class, with the
+  // algorithm-specific data on the subclass, coming from the same allocation.
+  void *data = nullptr;
+};
+
+struct evp_pkey_ctx_method_st {
   int pkey_id;
 
-  int (*init)(EVP_PKEY_CTX *ctx);
-  int (*copy)(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src);
-  void (*cleanup)(EVP_PKEY_CTX *ctx);
+  // `alg` may be nullptr. If non-null, `ctx` will have a key set.
+  int (*init)(EvpPkeyCtx *ctx, const EVP_PKEY_ALG *alg);
+  int (*copy)(EvpPkeyCtx *dst, EvpPkeyCtx *src);
+  void (*cleanup)(EvpPkeyCtx *ctx);
 
-  int (*keygen)(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey);
+  int (*keygen)(EvpPkeyCtx *ctx, EvpPkey *pkey);
 
-  int (*sign)(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
-              const uint8_t *tbs, size_t tbslen);
+  int (*sign)(EvpPkeyCtx *ctx, uint8_t *sig, size_t *siglen, const uint8_t *tbs,
+              size_t tbslen);
 
-  int (*sign_message)(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
+  int (*sign_message)(EvpPkeyCtx *ctx, uint8_t *sig, size_t *siglen,
                       const uint8_t *tbs, size_t tbslen);
 
-  int (*verify)(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t siglen,
+  int (*verify)(EvpPkeyCtx *ctx, const uint8_t *sig, size_t siglen,
                 const uint8_t *tbs, size_t tbslen);
 
-  int (*verify_message)(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t siglen,
+  int (*verify_message)(EvpPkeyCtx *ctx, const uint8_t *sig, size_t siglen,
                         const uint8_t *tbs, size_t tbslen);
 
-  int (*verify_recover)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len,
+  int (*verify_recover)(EvpPkeyCtx *ctx, uint8_t *out, size_t *out_len,
                         const uint8_t *sig, size_t sig_len);
 
-  int (*encrypt)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *outlen,
+  int (*encrypt)(EvpPkeyCtx *ctx, uint8_t *out, size_t *outlen,
                  const uint8_t *in, size_t inlen);
 
-  int (*decrypt)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *outlen,
+  int (*decrypt)(EvpPkeyCtx *ctx, uint8_t *out, size_t *outlen,
                  const uint8_t *in, size_t inlen);
 
-  int (*derive)(EVP_PKEY_CTX *ctx, uint8_t *key, size_t *keylen);
+  int (*derive)(EvpPkeyCtx *ctx, uint8_t *key, size_t *keylen);
 
-  int (*paramgen)(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey);
+  int (*paramgen)(EvpPkeyCtx *ctx, EvpPkey *pkey);
 
-  int (*ctrl)(EVP_PKEY_CTX *ctx, int type, int p1, void *p2);
-} /* EVP_PKEY_METHOD */;
+  int (*encap)(EvpPkeyCtx *ctx, uint8_t *out_ciphertext,
+               size_t *out_ciphertext_len, uint8_t *out_secret,
+               size_t *out_secret_len);
 
-typedef struct {
-  // key is the concatenation of the private seed and public key. It is stored
-  // as a single 64-bit array to allow passing to |ED25519_sign|. If
-  // |has_private| is false, the first 32 bytes are uninitialized and the public
-  // key is in the last 32 bytes.
-  uint8_t key[64];
-  char has_private;
-} ED25519_KEY;
+  int (*decap)(EvpPkeyCtx *ctx, uint8_t *out_secret, size_t *out_secret_len,
+               const uint8_t *ciphertext, size_t ciphertext_len);
 
-#define ED25519_PUBLIC_KEY_OFFSET 32
+  int (*ctrl)(EvpPkeyCtx *ctx, int type, int p1, void *p2);
+} /* EVP_PKEY_CTX_METHOD */;
 
-typedef struct {
-  uint8_t pub[32];
-  uint8_t priv[32];
-  char has_private;
-} X25519_KEY;
-
-extern const EVP_PKEY_ASN1_METHOD dsa_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD ec_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD rsa_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD x25519_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD dh_asn1_meth;
-
-extern const EVP_PKEY_METHOD rsa_pkey_meth;
-extern const EVP_PKEY_METHOD ec_pkey_meth;
-extern const EVP_PKEY_METHOD ed25519_pkey_meth;
-extern const EVP_PKEY_METHOD x25519_pkey_meth;
-extern const EVP_PKEY_METHOD hkdf_pkey_meth;
-extern const EVP_PKEY_METHOD dh_pkey_meth;
-
-// evp_pkey_set_method behaves like |EVP_PKEY_set_type|, but takes a pointer to
-// a method table. This avoids depending on every |EVP_PKEY_ASN1_METHOD|.
-void evp_pkey_set_method(EVP_PKEY *pkey, const EVP_PKEY_ASN1_METHOD *method);
+BSSL_NAMESPACE_END
 
+// TODO(chlily): Make compatible with `EVP_HPKE_KEM`.
+struct evp_kem_st {
+  // Identifies the type of EVP_PKEYs compatible with this KEM.
+  int pkey_id;
 
-#if defined(__cplusplus)
-}  // extern C
-#endif
+  // Constant lengths of ciphertexts and secrets produced/consumed by this KEM.
+  size_t ciphertext_len;
+  size_t secret_len;
+
+  int (*encap)(uint8_t *out_ciphertext, size_t ciphertext_len,
+               uint8_t *out_secret, size_t secret_len,
+               const EVP_PKEY *peer_key);
+  int (*decap)(uint8_t *out_secret, size_t secret_len,
+               const uint8_t *ciphertext, size_t ciphertext_len,
+               const EVP_PKEY *key);
+} /* EVP_KEM */;
+
+BSSL_NAMESPACE_BEGIN
+
+// KemAdapter is templated on an instance of EVP_KEM, and generates static
+// methods matching the behavior and function signatures for `encap` and `decap`
+// in EVP_PKEY_CTX_METHOD.
+template <const evp_kem_st &KEM>
+struct KemAdapter {
+  KemAdapter() = delete;
+
+  static int EncapMethod(EvpPkeyCtx *ctx, uint8_t *out_ciphertext,
+                         size_t *out_ciphertext_len, uint8_t *out_secret,
+                         size_t *out_secret_len) {
+    if (out_ciphertext == nullptr) {
+      if (out_ciphertext_len != nullptr) {
+        *out_ciphertext_len = KEM.ciphertext_len;
+      }
+      if (out_secret_len != nullptr) {
+        *out_secret_len = KEM.secret_len;
+      }
+      return 1;
+    }
+    if (*out_ciphertext_len < KEM.ciphertext_len ||
+        *out_secret_len < KEM.secret_len) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+      return 0;
+    }
+    if (KEM.encap(out_ciphertext, KEM.ciphertext_len, out_secret,
+                  KEM.secret_len, ctx->pkey.get())) {
+      *out_ciphertext_len = KEM.ciphertext_len;
+      *out_secret_len = KEM.secret_len;
+      return 1;
+    }
+    return 0;
+  }
+
+  static int DecapMethod(EvpPkeyCtx *ctx, uint8_t *out_secret,
+                         size_t *out_secret_len, const uint8_t *ciphertext,
+                         size_t ciphertext_len) {
+    if (out_secret == nullptr) {
+      *out_secret_len = KEM.secret_len;
+      return 1;
+    }
+    if (*out_secret_len < KEM.secret_len) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+      return 0;
+    }
+    if (KEM.decap(out_secret, KEM.secret_len, ciphertext, ciphertext_len,
+                  ctx->pkey.get())) {
+      *out_secret_len = KEM.secret_len;
+      return 1;
+    }
+    return 0;
+  }
+};
+
+// evp_pkey_ec_no_curve returns an internal curveless EC `EVP_PKEY_ALG`. This
+// cannot be used to parse anything and is only useful for key generation.
+const EVP_PKEY_ALG *evp_pkey_ec_no_curve();
+
+// evp_pkey_hkdf returns an internal `EVP_PKEY_ALG` used to implement
+// `EVP_PKEY_HKDF`. It has no associated key type.
+const EVP_PKEY_ALG *evp_pkey_hkdf();
+
+// evp_pkey_ctx_new_alg behaves like `EVP_PKEY_CTX_new_id` but takes an
+// `EVP_PKEY_ALG`.
+UniquePtr<EvpPkeyCtx> evp_pkey_ctx_new_alg(const EVP_PKEY_ALG *alg);
+
+// evp_pkey_set0 sets `pkey`'s method to `method` and data to `pkey_data`,
+// freeing any key that may previously have been configured. This function takes
+// ownership of `pkey_data`, which must be of the type expected by `method`.
+void evp_pkey_set0(EvpPkey *pkey, const EVP_PKEY_ASN1_METHOD *method,
+                   void *pkey_data);
+
+inline auto GetDefaultEVPAlgorithms() {
+  // A set of algorithms to use by default in `EVP_parse_public_key` and
+  // `EVP_parse_private_key`.
+  return std::array{
+      EVP_pkey_ec_p224(),
+      EVP_pkey_ec_p256(),
+      EVP_pkey_ec_p384(),
+      EVP_pkey_ec_p521(),
+      EVP_pkey_ed25519(),
+      EVP_pkey_rsa(),
+      EVP_pkey_x25519(),
+      EVP_pkey_ml_dsa_44(),
+      EVP_pkey_ml_dsa_65(),
+      EVP_pkey_ml_dsa_87(),
+      EVP_pkey_ml_kem_768(),
+      EVP_pkey_ml_kem_1024(),
+      // TODO(crbug.com/438761503): Remove DSA from this set, after callers that
+      // need DSA pass in `EVP_pkey_dsa` explicitly.
+      EVP_pkey_dsa(),
+  };
+}
+
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_EVP_INTERNAL_H