grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/evp/p_ed25519.cc

@@ -14,35 +14,282 @@
 
 #include <openssl/evp.h>
 
+#include <openssl/bytestring.h>
 #include <openssl/curve25519.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
+#include "../internal.h"
+#include "../mem_internal.h"
 #include "internal.h"
 
+using namespace bssl;
 
-// Ed25519 has no parameters to copy.
-static int pkey_ed25519_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) { return 1; }
+namespace {
+
+struct ED25519_KEY {
+  // key is the concatenation of the private seed and public key. It is stored
+  // as a single 64-bit array to allow passing to `ED25519_sign`. If
+  // `has_private` is false, the first 32 bytes are uninitialized and the public
+  // key is in the last 32 bytes.
+  uint8_t key[64];
+  bool has_private;
+};
+
+extern const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth;
+extern const EVP_PKEY_CTX_METHOD ed25519_pkey_meth;
+
+#define ED25519_PUBLIC_KEY_OFFSET 32
+
+static void ed25519_free(EvpPkey *pkey) {
+  ED25519_KEY *key = reinterpret_cast<ED25519_KEY *>(pkey->pkey);
+  Delete(key);
+  pkey->pkey = nullptr;
+}
 
-static int pkey_ed25519_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
-  ED25519_KEY *key =
-      reinterpret_cast<ED25519_KEY *>(OPENSSL_malloc(sizeof(ED25519_KEY)));
-  if (key == NULL) {
+static int ed25519_set_priv_raw(EvpPkey *pkey, const uint8_t *in, size_t len) {
+  if (len != 32) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     return 0;
   }
 
-  evp_pkey_set_method(pkey, &ed25519_asn1_meth);
+  ED25519_KEY *key = New<ED25519_KEY>();
+  if (key == nullptr) {
+    return 0;
+  }
+
+  // The RFC 8032 encoding stores only the 32-byte seed, so we must recover the
+  // full representation which we use from it.
+  uint8_t pubkey_unused[32];
+  ED25519_keypair_from_seed(pubkey_unused, key->key, in);
+  key->has_private = true;
+  evp_pkey_set0(pkey, &ed25519_asn1_meth, key);
+  return 1;
+}
+
+static int ed25519_set_pub_raw(EvpPkey *pkey, const uint8_t *in, size_t len) {
+  if (len != 32) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+
+  ED25519_KEY *key = New<ED25519_KEY>();
+  if (key == nullptr) {
+    return 0;
+  }
+
+  OPENSSL_memcpy(key->key + ED25519_PUBLIC_KEY_OFFSET, in, 32);
+  key->has_private = false;
+  evp_pkey_set0(pkey, &ed25519_asn1_meth, key);
+  return 1;
+}
+
+static int ed25519_get_priv_raw(const EvpPkey *pkey, uint8_t *out,
+                                size_t *out_len) {
+  const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+  if (!key->has_private) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NOT_A_PRIVATE_KEY);
+    return 0;
+  }
+
+  if (out == nullptr) {
+    *out_len = 32;
+    return 1;
+  }
+
+  if (*out_len < 32) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+
+  // The raw private key format is the first 32 bytes of the private key.
+  OPENSSL_memcpy(out, key->key, 32);
+  *out_len = 32;
+  return 1;
+}
+
+static int ed25519_get_pub_raw(const EvpPkey *pkey, uint8_t *out,
+                               size_t *out_len) {
+  const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+  if (out == nullptr) {
+    *out_len = 32;
+    return 1;
+  }
+
+  if (*out_len < 32) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+
+  OPENSSL_memcpy(out, key->key + ED25519_PUBLIC_KEY_OFFSET, 32);
+  *out_len = 32;
+  return 1;
+}
+
+static bssl::evp_decode_result_t ed25519_pub_decode(const EVP_PKEY_ALG *alg,
+                                                    EvpPkey *out, CBS *params,
+                                                    CBS *key) {
+  // See RFC 8410, section 4.
+
+  // The parameters must be omitted. Public keys have length 32.
+  if (CBS_len(params) != 0) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return evp_decode_error;
+  }
+
+  return ed25519_set_pub_raw(out, CBS_data(key), CBS_len(key))
+             ? evp_decode_ok
+             : evp_decode_error;
+}
+
+static int ed25519_pub_encode(CBB *out, const EvpPkey *pkey) {
+  const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+
+  // See RFC 8410, section 4.
+  CBB spki, algorithm, key_bitstring;
+  if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ed25519_asn1_meth.oid,
+                            ed25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
+      !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
+      !CBB_add_bytes(&key_bitstring, key->key + ED25519_PUBLIC_KEY_OFFSET,
+                     32) ||
+      !CBB_flush(out)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
+    return 0;
+  }
+
+  return 1;
+}
+
+static bool ed25519_pub_equal(const EvpPkey *a, const EvpPkey *b) {
+  const ED25519_KEY *a_key = reinterpret_cast<const ED25519_KEY *>(a->pkey);
+  const ED25519_KEY *b_key = reinterpret_cast<const ED25519_KEY *>(b->pkey);
+  return OPENSSL_memcmp(a_key->key + ED25519_PUBLIC_KEY_OFFSET,
+                        b_key->key + ED25519_PUBLIC_KEY_OFFSET, 32) == 0;
+}
+
+static bssl::evp_decode_result_t ed25519_priv_decode(const EVP_PKEY_ALG *alg,
+                                                     EvpPkey *out, CBS *params,
+                                                     CBS *key) {
+  // See RFC 8410, section 7.
+
+  // Parameters must be empty. The key is a 32-byte value wrapped in an extra
+  // OCTET STRING layer.
+  CBS inner;
+  if (CBS_len(params) != 0 ||
+      !CBS_get_asn1(key, &inner, CBS_ASN1_OCTETSTRING) || CBS_len(key) != 0) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return evp_decode_error;
+  }
+
+  return ed25519_set_priv_raw(out, CBS_data(&inner), CBS_len(&inner))
+             ? evp_decode_ok
+             : evp_decode_error;
+}
+
+static int ed25519_priv_encode(CBB *out, const EvpPkey *pkey) {
+  const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+  if (!key->has_private) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NOT_A_PRIVATE_KEY);
+    return 0;
+  }
+
+  // See RFC 8410, section 7.
+  CBB pkcs8, algorithm, private_key, inner;
+  if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
+      !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ed25519_asn1_meth.oid,
+                            ed25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
+      !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
+      // The PKCS#8 encoding stores only the 32-byte seed which is the first 32
+      // bytes of the private key.
+      !CBB_add_bytes(&inner, key->key, 32) ||  //
+      !CBB_flush(out)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
+    return 0;
+  }
+
+  return 1;
+}
+
+static bool ed25519_pub_present(const EvpPkey *) { return true; }
+
+static bool ed25519_pub_copy(EvpPkey *out, const EvpPkey *pkey) {
+  const ED25519_KEY *pkey_ed25519 =
+      reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+  ED25519_KEY *public_copy = New<ED25519_KEY>();
+  if (public_copy == nullptr) {
+    return false;
+  }
+  OPENSSL_memcpy(public_copy->key + ED25519_PUBLIC_KEY_OFFSET,
+                 pkey_ed25519->key + ED25519_PUBLIC_KEY_OFFSET,
+                 ED25519_PUBLIC_KEY_LEN);
+  public_copy->has_private = false;
+  evp_pkey_set0(out, pkey->ameth, public_copy);
+  return true;
+}
+
+static bool ed25519_priv_present(const EvpPkey *pkey) {
+  const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
+  return key->has_private;
+}
+
+static int ed25519_size(const EvpPkey *pkey) { return 64; }
+
+static int ed25519_bits(const EvpPkey *pkey) { return 253; }
+
+const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = {
+    EVP_PKEY_ED25519,
+    {0x2b, 0x65, 0x70},
+    3,
+    &ed25519_pkey_meth,
+    ed25519_pub_decode,
+    ed25519_pub_encode,
+    ed25519_pub_equal,
+    ed25519_pub_present,
+    ed25519_pub_copy,
+    ed25519_priv_decode,
+    ed25519_priv_encode,
+    ed25519_priv_present,
+    ed25519_set_priv_raw,
+    /*set_priv_seed=*/nullptr,
+    ed25519_set_pub_raw,
+    ed25519_get_priv_raw,
+    /*get_priv_seed=*/nullptr,
+    ed25519_get_pub_raw,
+    /*set1_tls_encodedpoint=*/nullptr,
+    /*get1_tls_encodedpoint=*/nullptr,
+    /*pkey_opaque=*/nullptr,
+    ed25519_size,
+    ed25519_bits,
+    /*param_missing=*/nullptr,
+    /*param_copy=*/nullptr,
+    /*param_equal=*/nullptr,
+    ed25519_free,
+};
+
+// Ed25519 has no parameters to copy.
+static int pkey_ed25519_copy(EvpPkeyCtx *dst, EvpPkeyCtx *src) { return 1; }
+
+static int pkey_ed25519_keygen(EvpPkeyCtx *ctx, EvpPkey *pkey) {
+  ED25519_KEY *key = New<ED25519_KEY>();
+  if (key == nullptr) {
+    return 0;
+  }
 
   uint8_t pubkey_unused[32];
   ED25519_keypair(pubkey_unused, key->key);
-  key->has_private = 1;
+  key->has_private = true;
 
-  OPENSSL_free(pkey->pkey);
-  pkey->pkey = key;
+  evp_pkey_set0(pkey, &ed25519_asn1_meth, key);
   return 1;
 }
 
-static int pkey_ed25519_sign_message(EVP_PKEY_CTX *ctx, uint8_t *sig,
+static int pkey_ed25519_sign_message(EvpPkeyCtx *ctx, uint8_t *sig,
                                      size_t *siglen, const uint8_t *tbs,
                                      size_t tbslen) {
   const ED25519_KEY *key =
@@ -52,7 +299,7 @@ static int pkey_ed25519_sign_message(EVP_PKEY_CTX *ctx, uint8_t *sig,
     return 0;
   }
 
-  if (sig == NULL) {
+  if (sig == nullptr) {
     *siglen = 64;
     return 1;
   }
@@ -70,7 +317,7 @@ static int pkey_ed25519_sign_message(EVP_PKEY_CTX *ctx, uint8_t *sig,
   return 1;
 }
 
-static int pkey_ed25519_verify_message(EVP_PKEY_CTX *ctx, const uint8_t *sig,
+static int pkey_ed25519_verify_message(EvpPkeyCtx *ctx, const uint8_t *sig,
                                        size_t siglen, const uint8_t *tbs,
                                        size_t tbslen) {
   const ED25519_KEY *key =
@@ -84,7 +331,7 @@ static int pkey_ed25519_verify_message(EVP_PKEY_CTX *ctx, const uint8_t *sig,
   return 1;
 }
 
-const EVP_PKEY_METHOD ed25519_pkey_meth = {
+const EVP_PKEY_CTX_METHOD ed25519_pkey_meth = {
     /*pkey_id=*/EVP_PKEY_ED25519,
     /*init=*/nullptr,
     /*copy=*/pkey_ed25519_copy,
@@ -99,5 +346,14 @@ const EVP_PKEY_METHOD ed25519_pkey_meth = {
     /*decrypt=*/nullptr,
     /*derive=*/nullptr,
     /*paramgen=*/nullptr,
+    /*encap=*/nullptr,
+    /*decap=*/nullptr,
     /*ctrl=*/nullptr,
 };
+
+}  // namespace
+
+const EVP_PKEY_ALG *EVP_pkey_ed25519() {
+  static const EVP_PKEY_ALG kAlg = {&ed25519_asn1_meth, &ed25519_pkey_meth};
+  return &kAlg;
+}

data/third_party/boringssl-with-bazel/crypto/evp/p_hkdf.cc

@@ -14,44 +14,36 @@
 
 #include <openssl/evp.h>
 
-#include <openssl/bytestring.h>
 #include <openssl/err.h>
 #include <openssl/hkdf.h>
 #include <openssl/kdf.h>
 #include <openssl/mem.h>
+#include <openssl/span.h>
 
 #include "../internal.h"
+#include "../mem_internal.h"
 #include "internal.h"
 
 
-typedef struct {
-  int mode;
-  const EVP_MD *md;
-  uint8_t *key;
-  size_t key_len;
-  uint8_t *salt;
-  size_t salt_len;
-  CBB info;
-} HKDF_PKEY_CTX;
-
-static int pkey_hkdf_init(EVP_PKEY_CTX *ctx) {
-  HKDF_PKEY_CTX *hctx =
-      reinterpret_cast<HKDF_PKEY_CTX *>(OPENSSL_zalloc(sizeof(HKDF_PKEY_CTX)));
-  if (hctx == NULL) {
-    return 0;
-  }
+using namespace bssl;
 
-  if (!CBB_init(&hctx->info, 0)) {
-    OPENSSL_free(hctx);
-    return 0;
-  }
+namespace {
 
-  ctx->data = hctx;
+struct HKDF_PKEY_CTX {
+  int mode = 0;
+  const EVP_MD *md = nullptr;
+  Array<uint8_t> key;
+  Array<uint8_t> salt;
+  Vector<uint8_t> info;
+};
+
+static int pkey_hkdf_init(EvpPkeyCtx *ctx, const EVP_PKEY_ALG *) {
+  ctx->data = New<HKDF_PKEY_CTX>();
   return 1;
 }
 
-static int pkey_hkdf_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
-  if (!pkey_hkdf_init(dst)) {
+static int pkey_hkdf_copy(EvpPkeyCtx *dst, EvpPkeyCtx *src) {
+  if (!pkey_hkdf_init(dst, nullptr)) {
     return 0;
   }
 
@@ -61,85 +53,64 @@ static int pkey_hkdf_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
   hctx_dst->mode = hctx_src->mode;
   hctx_dst->md = hctx_src->md;
 
-  if (hctx_src->key_len != 0) {
-    hctx_dst->key = reinterpret_cast<uint8_t *>(
-        OPENSSL_memdup(hctx_src->key, hctx_src->key_len));
-    if (hctx_dst->key == NULL) {
-      return 0;
-    }
-    hctx_dst->key_len = hctx_src->key_len;
-  }
-
-  if (hctx_src->salt_len != 0) {
-    hctx_dst->salt = reinterpret_cast<uint8_t *>(
-        OPENSSL_memdup(hctx_src->salt, hctx_src->salt_len));
-    if (hctx_dst->salt == NULL) {
-      return 0;
-    }
-    hctx_dst->salt_len = hctx_src->salt_len;
-  }
-
-  if (!CBB_add_bytes(&hctx_dst->info, CBB_data(&hctx_src->info),
-                     CBB_len(&hctx_src->info))) {
+  if (!hctx_dst->key.CopyFrom(hctx_src->key) ||
+      !hctx_dst->salt.CopyFrom(hctx_src->salt) ||
+      !hctx_dst->info.CopyFrom(hctx_src->info)) {
     return 0;
   }
 
   return 1;
 }
 
-static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx) {
-  HKDF_PKEY_CTX *hctx = reinterpret_cast<HKDF_PKEY_CTX *>(ctx->data);
-  if (hctx != NULL) {
-    OPENSSL_free(hctx->key);
-    OPENSSL_free(hctx->salt);
-    CBB_cleanup(&hctx->info);
-    OPENSSL_free(hctx);
-    ctx->data = NULL;
-  }
+static void pkey_hkdf_cleanup(EvpPkeyCtx *ctx) {
+  Delete(reinterpret_cast<HKDF_PKEY_CTX *>(ctx->data));
 }
 
-static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len) {
+static int pkey_hkdf_derive(EvpPkeyCtx *ctx, uint8_t *out, size_t *out_len) {
   HKDF_PKEY_CTX *hctx = reinterpret_cast<HKDF_PKEY_CTX *>(ctx->data);
-  if (hctx->md == NULL) {
+  if (hctx->md == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
     return 0;
   }
-  if (hctx->key_len == 0) {
+  if (hctx->key.empty()) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
     return 0;
   }
 
-  if (out == NULL) {
+  if (out == nullptr) {
     if (hctx->mode == EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) {
       *out_len = EVP_MD_size(hctx->md);
     }
-    // HKDF-Expand is variable-length and returns |*out_len| bytes. "Output" the
+    // HKDF-Expand is variable-length and returns `*out_len` bytes. "Output" the
     // input length by leaving it alone.
     return 1;
   }
 
   switch (hctx->mode) {
     case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:
-      return HKDF(out, *out_len, hctx->md, hctx->key, hctx->key_len, hctx->salt,
-                  hctx->salt_len, CBB_data(&hctx->info), CBB_len(&hctx->info));
+      return HKDF(out, *out_len, hctx->md, hctx->key.data(), hctx->key.size(),
+                  hctx->salt.data(), hctx->salt.size(), hctx->info.data(),
+                  hctx->info.size());
 
     case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:
       if (*out_len < EVP_MD_size(hctx->md)) {
         OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
         return 0;
       }
-      return HKDF_extract(out, out_len, hctx->md, hctx->key, hctx->key_len,
-                          hctx->salt, hctx->salt_len);
+      return HKDF_extract(out, out_len, hctx->md, hctx->key.data(),
+                          hctx->key.size(), hctx->salt.data(),
+                          hctx->salt.size());
 
     case EVP_PKEY_HKDEF_MODE_EXPAND_ONLY:
-      return HKDF_expand(out, *out_len, hctx->md, hctx->key, hctx->key_len,
-                         CBB_data(&hctx->info), CBB_len(&hctx->info));
+      return HKDF_expand(out, *out_len, hctx->md, hctx->key.data(),
+                         hctx->key.size(), hctx->info.data(),
+                         hctx->info.size());
   }
   OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
   return 0;
 }
 
-static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
+static int pkey_hkdf_ctrl(EvpPkeyCtx *ctx, int type, int p1, void *p2) {
   HKDF_PKEY_CTX *hctx = reinterpret_cast<HKDF_PKEY_CTX *>(ctx->data);
   switch (type) {
     case EVP_PKEY_CTRL_HKDF_MODE:
@@ -155,27 +126,18 @@ static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
       hctx->md = reinterpret_cast<const EVP_MD *>(p2);
       return 1;
     case EVP_PKEY_CTRL_HKDF_KEY: {
-      const CBS *key = reinterpret_cast<const CBS *>(p2);
-      if (!CBS_stow(key, &hctx->key, &hctx->key_len)) {
-        return 0;
-      }
-      return 1;
+      const auto *key = reinterpret_cast<const Span<const uint8_t> *>(p2);
+      return hctx->key.CopyFrom(*key);
     }
     case EVP_PKEY_CTRL_HKDF_SALT: {
-      const CBS *salt = reinterpret_cast<const CBS *>(p2);
-      if (!CBS_stow(salt, &hctx->salt, &hctx->salt_len)) {
-        return 0;
-      }
-      return 1;
+      const auto *salt = reinterpret_cast<const Span<const uint8_t> *>(p2);
+      return hctx->salt.CopyFrom(*salt);
     }
     case EVP_PKEY_CTRL_HKDF_INFO: {
-      const CBS *info = reinterpret_cast<const CBS *>(p2);
-      // |EVP_PKEY_CTX_add1_hkdf_info| appends to the info string, rather than
+      const auto *info = reinterpret_cast<const Span<const uint8_t> *>(p2);
+      // `EVP_PKEY_CTX_add1_hkdf_info` appends to the info string, rather than
       // replacing it.
-      if (!CBB_add_bytes(&hctx->info, CBS_data(info), CBS_len(info))) {
-        return 0;
-      }
-      return 1;
+      return hctx->info.Append(*info);
     }
     default:
       OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
@@ -183,27 +145,36 @@ static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
   }
 }
 
-const EVP_PKEY_METHOD hkdf_pkey_meth = {
-    /*pkey_id=*/EVP_PKEY_HKDF,
+const EVP_PKEY_CTX_METHOD hkdf_pkey_meth = {
+    EVP_PKEY_HKDF,
     pkey_hkdf_init,
     pkey_hkdf_copy,
     pkey_hkdf_cleanup,
-    /*keygen=*/NULL,
-    /*sign=*/NULL,
-    /*sign_message=*/NULL,
-    /*verify=*/NULL,
-    /*verify_message=*/NULL,
-    /*verify_recover=*/NULL,
-    /*encrypt=*/NULL,
-    /*decrypt=*/NULL,
+    /*keygen=*/nullptr,
+    /*sign=*/nullptr,
+    /*sign_message=*/nullptr,
+    /*verify=*/nullptr,
+    /*verify_message=*/nullptr,
+    /*verify_recover=*/nullptr,
+    /*encrypt=*/nullptr,
+    /*decrypt=*/nullptr,
     pkey_hkdf_derive,
-    /*paramgen=*/NULL,
+    /*paramgen=*/nullptr,
+    /*encap=*/nullptr,
+    /*decap=*/nullptr,
     pkey_hkdf_ctrl,
 };
 
+}  // namespace
+
+const EVP_PKEY_ALG *bssl::evp_pkey_hkdf() {
+  static const EVP_PKEY_ALG kAlg = {nullptr, &hkdf_pkey_meth};
+  return &kAlg;
+}
+
 int EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX *ctx, int mode) {
   return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
-                           EVP_PKEY_CTRL_HKDF_MODE, mode, NULL);
+                           EVP_PKEY_CTRL_HKDF_MODE, mode, nullptr);
 }
 
 int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
@@ -213,24 +184,21 @@ int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
 
 int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx, const uint8_t *key,
                                size_t key_len) {
-  CBS cbs;
-  CBS_init(&cbs, key, key_len);
+  Span<const uint8_t> span(key, key_len);
   return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
-                           EVP_PKEY_CTRL_HKDF_KEY, 0, &cbs);
+                           EVP_PKEY_CTRL_HKDF_KEY, 0, &span);
 }
 
 int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx, const uint8_t *salt,
                                 size_t salt_len) {
-  CBS cbs;
-  CBS_init(&cbs, salt, salt_len);
+  Span<const uint8_t> span(salt, salt_len);
   return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
-                           EVP_PKEY_CTRL_HKDF_SALT, 0, &cbs);
+                           EVP_PKEY_CTRL_HKDF_SALT, 0, &span);
 }
 
 int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx, const uint8_t *info,
                                 size_t info_len) {
-  CBS cbs;
-  CBS_init(&cbs, info, info_len);
+  Span<const uint8_t> span(info, info_len);
   return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
-                           EVP_PKEY_CTRL_HKDF_INFO, 0, &cbs);
+                           EVP_PKEY_CTRL_HKDF_INFO, 0, &span);
 }