grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/sha/sha1.cc.inc

@@ -15,6 +15,7 @@
 #include <string.h>
 
 #include <openssl/mem.h>
+#include <openssl/span.h>
 
 #include "../../internal.h"
 #include "../bcm_interface.h"
@@ -23,7 +24,9 @@
 #include "internal.h"
 
 
-bcm_infallible BCM_sha1_init(SHA_CTX *sha) {
+using namespace bssl;
+
+bcm_infallible bssl::BCM_sha1_init(SHA_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA_CTX));
   sha->h[0] = 0x67452301UL;
   sha->h[1] = 0xefcdab89UL;
@@ -38,15 +41,27 @@ static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num);
 #endif
 
-bcm_infallible BCM_sha1_transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK]) {
+bcm_infallible bssl::BCM_sha1_transform(SHA_CTX *c,
+                                        const uint8_t data[SHA_CBLOCK]) {
   sha1_block_data_order(c->h, data, 1);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha1_update(SHA_CTX *c, const void *data, size_t len) {
-  crypto_md32_update(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
-                     &c->Nh, &c->Nl, reinterpret_cast<const uint8_t *>(data),
-                     len);
+namespace {
+struct SHA1Traits {
+  using HashContext = SHA_CTX;
+  static constexpr size_t kBlockSize = SHA_CBLOCK;
+  static constexpr bool kLengthIsBigEndian = true;
+  static void HashBlocks(uint32_t *state, const uint8_t *data,
+                         size_t num_blocks) {
+    sha1_block_data_order(state, data, num_blocks);
+  }
+};
+}  // namespace
+
+bcm_infallible bssl::BCM_sha1_update(SHA_CTX *c, const void *data, size_t len) {
+  crypto_md32_update<SHA1Traits>(c,
+                                 Span(static_cast<const uint8_t *>(data), len));
   return bcm_infallible::approved;
 }
 
@@ -59,17 +74,16 @@ static void sha1_output_state(uint8_t out[SHA_DIGEST_LENGTH],
   CRYPTO_store_u32_be(out + 16, ctx->h[4]);
 }
 
-bcm_infallible BCM_sha1_final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) {
-  crypto_md32_final(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
-                    c->Nh, c->Nl, /*is_big_endian=*/1);
-
+bcm_infallible bssl::BCM_sha1_final(uint8_t out[SHA_DIGEST_LENGTH],
+                                    SHA_CTX *c) {
+  crypto_md32_final<SHA1Traits>(c);
   sha1_output_state(out, c);
   FIPS_service_indicator_update_state();
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
-                                  const uint8_t xkey[SHA_DIGEST_LENGTH]) {
+bcm_infallible bssl::BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
+                                        const uint8_t xkey[SHA_DIGEST_LENGTH]) {
   // XKEY and XVAL are 160-bit values, but are internally right-padded up to
   // block size. See FIPS 186-2, Appendix 3.3. This buffer maintains both the
   // current value of XKEY and the padding.
@@ -174,7 +188,7 @@ bcm_infallible BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
 #endif
 
 /* Originally X was an array. As it's automatic it's natural
- * to expect RISC compiler to accomodate at least part of it in
+ * to expect RISC compiler to accommodate at least part of it in
  * the register bank, isn't it? Unfortunately not all compilers
  * "find" this expectation reasonable:-( On order to make such
  * compilers generate better code I replace X[] with a bunch of

data/third_party/boringssl-with-bazel/crypto/fipsmodule/sha/sha256.cc.inc

@@ -15,6 +15,7 @@
 #include <string.h>
 
 #include <openssl/mem.h>
+#include <openssl/span.h>
 
 #include "../../internal.h"
 #include "../bcm_interface.h"
@@ -23,7 +24,9 @@
 #include "internal.h"
 
 
-bcm_infallible BCM_sha224_init(SHA256_CTX *sha) {
+using namespace bssl;
+
+bcm_infallible bssl::BCM_sha224_init(SHA256_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA256_CTX));
   sha->h[0] = 0xc1059ed8UL;
   sha->h[1] = 0x367cd507UL;
@@ -33,11 +36,11 @@ bcm_infallible BCM_sha224_init(SHA256_CTX *sha) {
   sha->h[5] = 0x68581511UL;
   sha->h[6] = 0x64f98fa7UL;
   sha->h[7] = 0xbefa4fa4UL;
-  sha->md_len = BCM_SHA224_DIGEST_LENGTH;
+  sha->md_len = SHA224_DIGEST_LENGTH;
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha256_init(SHA256_CTX *sha) {
+bcm_infallible bssl::BCM_sha256_init(SHA256_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA256_CTX));
   sha->h[0] = 0x6a09e667UL;
   sha->h[1] = 0xbb67ae85UL;
@@ -47,7 +50,7 @@ bcm_infallible BCM_sha256_init(SHA256_CTX *sha) {
   sha->h[5] = 0x9b05688cUL;
   sha->h[6] = 0x1f83d9abUL;
   sha->h[7] = 0x5be0cd19UL;
-  sha->md_len = BCM_SHA256_DIGEST_LENGTH;
+  sha->md_len = SHA256_DIGEST_LENGTH;
   return bcm_infallible::approved;
 }
 
@@ -56,29 +59,40 @@ static void sha256_block_data_order(uint32_t state[8], const uint8_t *in,
                                     size_t num);
 #endif
 
-bcm_infallible BCM_sha256_transform(SHA256_CTX *c,
-                                    const uint8_t data[BCM_SHA256_CBLOCK]) {
+bcm_infallible bssl::BCM_sha256_transform(SHA256_CTX *c,
+                                          const uint8_t data[SHA256_CBLOCK]) {
   sha256_block_data_order(c->h, data, 1);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha256_update(SHA256_CTX *c, const void *data, size_t len) {
-  crypto_md32_update(&sha256_block_data_order, c->h, c->data, BCM_SHA256_CBLOCK,
-                     &c->num, &c->Nh, &c->Nl,
-                     reinterpret_cast<const uint8_t *>(data), len);
+namespace {
+struct SHA256Traits {
+  using HashContext = SHA256_CTX;
+  static constexpr size_t kBlockSize = SHA256_CBLOCK;
+  static constexpr bool kLengthIsBigEndian = true;
+  static void HashBlocks(uint32_t *state, const uint8_t *data,
+                         size_t num_blocks) {
+    sha256_block_data_order(state, data, num_blocks);
+  }
+};
+}  // namespace
+
+bcm_infallible bssl::BCM_sha256_update(SHA256_CTX *c, const void *data,
+                                       size_t len) {
+  crypto_md32_update<SHA256Traits>(
+      c, Span(static_cast<const uint8_t *>(data), len));
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha224_update(SHA256_CTX *ctx, const void *data,
-                                 size_t len) {
+bcm_infallible bssl::BCM_sha224_update(SHA256_CTX *ctx, const void *data,
+                                       size_t len) {
   return BCM_sha256_update(ctx, data, len);
 }
 
 static void sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
-  crypto_md32_final(&sha256_block_data_order, c->h, c->data, BCM_SHA256_CBLOCK,
-                    &c->num, c->Nh, c->Nl, /*is_big_endian=*/1);
+  crypto_md32_final<SHA256Traits>(c);
 
-  BSSL_CHECK(md_len <= BCM_SHA256_DIGEST_LENGTH);
+  BSSL_CHECK(md_len <= SHA256_DIGEST_LENGTH);
 
   assert(md_len % 4 == 0);
   const size_t out_words = md_len / 4;
@@ -90,23 +104,23 @@ static void sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
   FIPS_service_indicator_update_state();
 }
 
-bcm_infallible BCM_sha256_final(uint8_t out[BCM_SHA256_DIGEST_LENGTH],
-                                SHA256_CTX *c) {
-  // Ideally we would assert |sha->md_len| is |BCM_SHA256_DIGEST_LENGTH| to
-  // match the size hint, but calling code often pairs |SHA224_Init| with
-  // |SHA256_Final| and expects |sha->md_len| to carry the size over.
+bcm_infallible bssl::BCM_sha256_final(uint8_t out[SHA256_DIGEST_LENGTH],
+                                      SHA256_CTX *c) {
+  // Ideally we would assert `sha->md_len` is `SHA256_DIGEST_LENGTH` tomatch the
+  // size hint, but calling code often pairs `SHA224_Init` with `SHA256_Final`
+  // and expects `sha->md_len` to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
   sha256_final_impl(out, c->md_len, c);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha224_final(uint8_t out[BCM_SHA224_DIGEST_LENGTH],
-                                SHA256_CTX *ctx) {
-  // This function must be paired with |SHA224_Init|, which sets |ctx->md_len|
-  // to |BCM_SHA224_DIGEST_LENGTH|.
-  assert(ctx->md_len == BCM_SHA224_DIGEST_LENGTH);
-  sha256_final_impl(out, BCM_SHA224_DIGEST_LENGTH, ctx);
+bcm_infallible bssl::BCM_sha224_final(uint8_t out[SHA224_DIGEST_LENGTH],
+                                      SHA256_CTX *ctx) {
+  // This function must be paired with `SHA224_Init`, which sets `ctx->md_len`
+  // to `SHA224_DIGEST_LENGTH`.
+  assert(ctx->md_len == SHA224_DIGEST_LENGTH);
+  sha256_final_impl(out, SHA224_DIGEST_LENGTH, ctx);
   return bcm_infallible::approved;
 }
 
@@ -282,10 +296,12 @@ static void sha256_block_data_order(uint32_t state[8], const uint8_t *data,
 #endif  // !defined(SHA256_ASM)
 
 
-bcm_infallible BCM_sha256_transform_blocks(uint32_t state[8],
-                                           const uint8_t *data,
-                                           size_t num_blocks) {
-  sha256_block_data_order(state, data, num_blocks);
+bcm_infallible bssl::BCM_sha256_transform_blocks(uint32_t state[8],
+                                                 const uint8_t *data,
+                                                 size_t num_blocks) {
+  if (num_blocks > 0) {
+    sha256_block_data_order(state, data, num_blocks);
+  }
   return bcm_infallible::approved;
 }
 

data/third_party/boringssl-with-bazel/crypto/fipsmodule/sha/sha512.cc.inc

@@ -22,6 +22,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 // The 32-bit hash algorithms share a common byte-order neutral collector and
 // padding function implementations that operate on unaligned data,
 // ../digest/md32_common.h. SHA-512 is the only 64-bit hash algorithm, as of
@@ -30,7 +32,7 @@
 
 static void sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha);
 
-bcm_infallible BCM_sha384_init(SHA512_CTX *sha) {
+bcm_infallible bssl::BCM_sha384_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0xcbbb9d5dc1059ed8);
   sha->h[1] = UINT64_C(0x629a292a367cd507);
   sha->h[2] = UINT64_C(0x9159015a3070dd17);
@@ -40,15 +42,15 @@ bcm_infallible BCM_sha384_init(SHA512_CTX *sha) {
   sha->h[6] = UINT64_C(0xdb0c2e0d64f98fa7);
   sha->h[7] = UINT64_C(0x47b5481dbefa4fa4);
 
-  sha->Nl = 0;
-  sha->Nh = 0;
+  sha->bytes_so_far_low = 0;
+  sha->bytes_so_far_high = 0;
   sha->num = 0;
-  sha->md_len = BCM_SHA384_DIGEST_LENGTH;
+  sha->md_len = SHA384_DIGEST_LENGTH;
   return bcm_infallible::approved;
 }
 
 
-bcm_infallible BCM_sha512_init(SHA512_CTX *sha) {
+bcm_infallible bssl::BCM_sha512_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0x6a09e667f3bcc908);
   sha->h[1] = UINT64_C(0xbb67ae8584caa73b);
   sha->h[2] = UINT64_C(0x3c6ef372fe94f82b);
@@ -58,14 +60,14 @@ bcm_infallible BCM_sha512_init(SHA512_CTX *sha) {
   sha->h[6] = UINT64_C(0x1f83d9abfb41bd6b);
   sha->h[7] = UINT64_C(0x5be0cd19137e2179);
 
-  sha->Nl = 0;
-  sha->Nh = 0;
+  sha->bytes_so_far_low = 0;
+  sha->bytes_so_far_high = 0;
   sha->num = 0;
-  sha->md_len = BCM_SHA512_DIGEST_LENGTH;
+  sha->md_len = SHA512_DIGEST_LENGTH;
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha512_256_init(SHA512_CTX *sha) {
+bcm_infallible bssl::BCM_sha512_256_init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0x22312194fc2bf72c);
   sha->h[1] = UINT64_C(0x9f555fa3c84c64c2);
   sha->h[2] = UINT64_C(0x2393b86b6f53b151);
@@ -75,10 +77,10 @@ bcm_infallible BCM_sha512_256_init(SHA512_CTX *sha) {
   sha->h[6] = UINT64_C(0x2b0199fc2c85b8aa);
   sha->h[7] = UINT64_C(0x0eb72ddc81c52ca2);
 
-  sha->Nl = 0;
-  sha->Nh = 0;
+  sha->bytes_so_far_low = 0;
+  sha->bytes_so_far_high = 0;
   sha->num = 0;
-  sha->md_len = BCM_SHA512_256_DIGEST_LENGTH;
+  sha->md_len = SHA512_256_DIGEST_LENGTH;
   return bcm_infallible::approved;
 }
 
@@ -88,43 +90,42 @@ static void sha512_block_data_order(uint64_t state[8], const uint8_t *in,
 #endif
 
 
-bcm_infallible BCM_sha384_final(uint8_t out[BCM_SHA384_DIGEST_LENGTH],
-                                SHA512_CTX *sha) {
-  // This function must be paired with |BCM_sha384_init|, which sets
-  // |sha->md_len| to |BCM_SHA384_DIGEST_LENGTH|.
-  assert(sha->md_len == BCM_SHA384_DIGEST_LENGTH);
-  sha512_final_impl(out, BCM_SHA384_DIGEST_LENGTH, sha);
+bcm_infallible bssl::BCM_sha384_final(uint8_t out[SHA384_DIGEST_LENGTH],
+                                      SHA512_CTX *sha) {
+  // This function must be paired with `BCM_sha384_init`, which sets
+  // `sha->md_len` to `SHA384_DIGEST_LENGTH`.
+  assert(sha->md_len == SHA384_DIGEST_LENGTH);
+  sha512_final_impl(out, SHA384_DIGEST_LENGTH, sha);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha384_update(SHA512_CTX *sha, const void *data,
-                                 size_t len) {
+bcm_infallible bssl::BCM_sha384_update(SHA512_CTX *sha, const void *data,
+                                       size_t len) {
   return BCM_sha512_update(sha, data, len);
 }
 
-bcm_infallible BCM_sha512_256_update(SHA512_CTX *sha, const void *data,
-                                     size_t len) {
+bcm_infallible bssl::BCM_sha512_256_update(SHA512_CTX *sha, const void *data,
+                                           size_t len) {
   return BCM_sha512_update(sha, data, len);
 }
 
-bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
-                                    SHA512_CTX *sha) {
-  // This function must be paired with |BCM_sha512_256_init|, which sets
-  // |sha->md_len| to |BCM_SHA512_256_DIGEST_LENGTH|.
-  assert(sha->md_len == BCM_SHA512_256_DIGEST_LENGTH);
-  sha512_final_impl(out, BCM_SHA512_256_DIGEST_LENGTH, sha);
+bcm_infallible bssl::BCM_sha512_256_final(uint8_t out[SHA512_256_DIGEST_LENGTH],
+                                          SHA512_CTX *sha) {
+  // This function must be paired with `BCM_sha512_256_init`, which sets
+  // `sha->md_len` to `SHA512_256_DIGEST_LENGTH`.
+  assert(sha->md_len == SHA512_256_DIGEST_LENGTH);
+  sha512_final_impl(out, SHA512_256_DIGEST_LENGTH, sha);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha512_transform(SHA512_CTX *c,
-                                    const uint8_t block[SHA512_CBLOCK]) {
+bcm_infallible bssl::BCM_sha512_transform(SHA512_CTX *c,
+                                          const uint8_t block[SHA512_CBLOCK]) {
   sha512_block_data_order(c->h, block, 1);
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha512_update(SHA512_CTX *c, const void *in_data,
-                                 size_t len) {
-  uint64_t l;
+bcm_infallible bssl::BCM_sha512_update(SHA512_CTX *c, const void *in_data,
+                                       size_t len) {
   uint8_t *p = c->p;
   const uint8_t *data = reinterpret_cast<const uint8_t *>(in_data);
 
@@ -132,14 +133,10 @@ bcm_infallible BCM_sha512_update(SHA512_CTX *c, const void *in_data,
     return bcm_infallible::approved;
   }
 
-  l = (c->Nl + (((uint64_t)len) << 3)) & UINT64_C(0xffffffffffffffff);
-  if (l < c->Nl) {
-    c->Nh++;
-  }
-  if (sizeof(len) >= 8) {
-    c->Nh += (((uint64_t)len) >> 61);
+  c->bytes_so_far_low += len;
+  if (c->bytes_so_far_low < len) {
+    c->bytes_so_far_high++;
   }
-  c->Nl = l;
 
   if (c->num != 0) {
     size_t n = sizeof(c->p) - c->num;
@@ -171,11 +168,11 @@ bcm_infallible BCM_sha512_update(SHA512_CTX *c, const void *in_data,
   return bcm_infallible::approved;
 }
 
-bcm_infallible BCM_sha512_final(uint8_t out[BCM_SHA512_DIGEST_LENGTH],
-                                SHA512_CTX *sha) {
-  // Ideally we would assert |sha->md_len| is |BCM_SHA512_DIGEST_LENGTH| to
-  // match the size hint, but calling code often pairs |BCM_sha384_init| with
-  // |BCM_sha512_final| and expects |sha->md_len| to carry the size over.
+bcm_infallible bssl::BCM_sha512_final(uint8_t out[SHA512_DIGEST_LENGTH],
+                                      SHA512_CTX *sha) {
+  // Ideally we would assert `sha->md_len` is `SHA512_DIGEST_LENGTH` to match
+  // the size hint, but calling code often pairs `BCM_sha384_init` with
+  // `BCM_sha512_final` and expects `sha->md_len` to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
   sha512_final_impl(out, sha->md_len, sha);
@@ -195,8 +192,11 @@ static void sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
   }
 
   OPENSSL_memset(p + n, 0, sizeof(sha->p) - 16 - n);
-  CRYPTO_store_u64_be(p + sizeof(sha->p) - 16, sha->Nh);
-  CRYPTO_store_u64_be(p + sizeof(sha->p) - 8, sha->Nl);
+  const uint64_t Nh = (uint64_t{sha->bytes_so_far_high} << 3) |
+                      (sha->bytes_so_far_low >> (64 - 3));
+  const uint64_t Nl = sha->bytes_so_far_low << 3;
+  CRYPTO_store_u64_be(p + sizeof(sha->p) - 16, Nh);
+  CRYPTO_store_u64_be(p + sizeof(sha->p) - 8, Nl);
 
   sha512_block_data_order(sha->h, p, 1);
 

data/third_party/boringssl-with-bazel/crypto/fipsmodule/slhdsa/address.h

@@ -18,102 +18,127 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
-
-#if defined(__cplusplus)
-extern "C" {
-#endif
-
-
-// Offsets of various fields in the address structure for SLH-DSA-SHA2-128s.
-
-// The byte used to specify the Merkle tree layer.
-#define SLHDSA_SHA2_128S_OFFSET_LAYER 0
-
-// The start of the 8 byte field used to specify the tree.
-#define SLHDSA_SHA2_128S_OFFSET_TREE 1
-
-// The byte used to specify the hash type (reason).
-#define SLHDSA_SHA2_128S_OFFSET_TYPE 9
-
-// The high byte used to specify the key pair (which one-time signature).
-#define SLHDSA_SHA2_128S_OFFSET_KP_ADDR2 12
-
-// The low byte used to specific the key pair.
-#define SLHDSA_SHA2_128S_OFFSET_KP_ADDR1 13
-
-// The byte used to specify the chain address (which Winternitz chain).
-#define SLHDSA_SHA2_128S_OFFSET_CHAIN_ADDR 17
-
-// The byte used to specify the hash address (where in the Winternitz chain).
-#define SLHDSA_SHA2_128S_OFFSET_HASH_ADDR 21
-
-// The byte used to specify the height of this node in the FORS or Merkle tree.
-#define SLHDSA_SHA2_128S_OFFSET_TREE_HGT 17
-
-// The start of the 4 byte field used to specify the node in the FORS or Merkle
-// tree.
-#define SLHDSA_SHA2_128S_OFFSET_TREE_INDEX 18
-
-
-inline void slhdsa_set_chain_addr(uint8_t addr[32], uint32_t chain) {
-  addr[SLHDSA_SHA2_128S_OFFSET_CHAIN_ADDR] = (uint8_t)chain;
+#include "./params.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+#define SLHDSA_ADDR_TYPE_WOTS 0
+#define SLHDSA_ADDR_TYPE_WOTSPK 1
+#define SLHDSA_ADDR_TYPE_HASHTREE 2
+#define SLHDSA_ADDR_TYPE_FORSTREE 3
+#define SLHDSA_ADDR_TYPE_FORSPK 4
+#define SLHDSA_ADDR_TYPE_WOTSPRF 5
+#define SLHDSA_ADDR_TYPE_FORSPRF 6
+
+inline void slhdsa_set_chain_addr(const slh_dsa_config *config,
+                                  uint8_t addr[32], uint32_t chain) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_CHAIN, chain);
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_CHAIN, chain);
+  }
 }
 
-inline void slhdsa_set_hash_addr(uint8_t addr[32], uint32_t hash) {
-  addr[SLHDSA_SHA2_128S_OFFSET_HASH_ADDR] = (uint8_t)hash;
+inline void slhdsa_set_hash_addr(const slh_dsa_config *config, uint8_t addr[32],
+                                 uint32_t hash) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_HASH, hash);
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_HASH, hash);
+  }
 }
 
-inline void slhdsa_set_keypair_addr(uint8_t addr[32], uint32_t keypair) {
-  addr[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2] = (uint8_t)(keypair >> 8);
-  addr[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1] = (uint8_t)keypair;
+inline void slhdsa_set_keypair_addr(const slh_dsa_config *config,
+                                    uint8_t addr[32], uint32_t keypair) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_KEYPAIR, keypair);
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_KEYPAIR, keypair);
+  }
 }
 
-inline void slhdsa_copy_keypair_addr(uint8_t out[32], const uint8_t in[32]) {
-  OPENSSL_memcpy(out, in, SLHDSA_SHA2_128S_OFFSET_TREE + 8);
-  out[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2] = in[SLHDSA_SHA2_128S_OFFSET_KP_ADDR2];
-  out[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1] = in[SLHDSA_SHA2_128S_OFFSET_KP_ADDR1];
+inline void slhdsa_copy_keypair_addr(const slh_dsa_config *config,
+                                     uint8_t out[32], const uint8_t in[32]) {
+  if (config->compressed_addresses) {
+    bssl::OPENSSL_memcpy(out, in, SLHDSA_ADDR_COMP_OFFSET_TYPE);
+    bssl::OPENSSL_memcpy(out + SLHDSA_ADDR_COMP_OFFSET_KEYPAIR,
+                         in + SLHDSA_ADDR_COMP_OFFSET_KEYPAIR, 4);
+  } else {
+    bssl::OPENSSL_memcpy(out, in, SLHDSA_ADDR_FULL_OFFSET_TYPE);
+    bssl::OPENSSL_memcpy(out + SLHDSA_ADDR_FULL_OFFSET_KEYPAIR,
+                         in + SLHDSA_ADDR_FULL_OFFSET_KEYPAIR, 4);
+  }
 }
 
-inline void slhdsa_set_layer_addr(uint8_t addr[32], uint32_t layer) {
-  addr[SLHDSA_SHA2_128S_OFFSET_LAYER] = (uint8_t)layer;
+inline void slhdsa_set_layer_addr(const slh_dsa_config *config,
+                                  uint8_t addr[32], uint32_t layer) {
+  if (config->compressed_addresses) {
+    addr[SLHDSA_ADDR_COMP_OFFSET_LAYER] = (uint8_t)layer;
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_LAYER, layer);
+  }
 }
 
-inline void slhdsa_set_tree_addr(uint8_t addr[32], uint64_t tree) {
-  CRYPTO_store_u64_be(&addr[SLHDSA_SHA2_128S_OFFSET_TREE], tree);
+inline void slhdsa_set_tree_addr(const slh_dsa_config *config, uint8_t addr[32],
+                                 uint64_t tree) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u64_be(addr + SLHDSA_ADDR_COMP_OFFSET_TREE, tree);
+  } else {
+    // The tree address is 12 bytes in this configuration. Just zero the top
+    // four bytes.
+    bssl::OPENSSL_memset(addr + SLHDSA_ADDR_FULL_OFFSET_TREE, 0, 4);
+    bssl::CRYPTO_store_u64_be(addr + SLHDSA_ADDR_FULL_OFFSET_TREE + 4, tree);
+  }
 }
 
-#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTS 0
-#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTSPK 1
-#define SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE 2
-#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE 3
-#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSPK 4
-#define SLHDSA_SHA2_128S_ADDR_TYPE_WOTSPRF 5
-#define SLHDSA_SHA2_128S_ADDR_TYPE_FORSPRF 6
-
-inline void slhdsa_set_type(uint8_t addr[32], uint32_t type) {
+inline void slhdsa_set_type(const slh_dsa_config *config, uint8_t addr[32],
+                            uint32_t type) {
   // FIPS 205 relies on this setting parts of the address to 0, so we do it
   // here to avoid confusion.
   //
   // The behavior here is only correct for the SHA-2 instantiations.
-  OPENSSL_memset(addr + 10, 0, 12);
-  addr[SLHDSA_SHA2_128S_OFFSET_TYPE] = (uint8_t)type;
+  if (config->compressed_addresses) {
+    bssl::OPENSSL_memset(addr + SLHDSA_ADDR_COMP_ZERO_START, 0,
+                         SLHDSA_ADDR_COMP_ZERO_LEN);
+    addr[SLHDSA_ADDR_COMP_OFFSET_TYPE] = (uint8_t)type;
+  } else {
+    bssl::OPENSSL_memset(addr + SLHDSA_ADDR_FULL_ZERO_START, 0,
+                         SLHDSA_ADDR_FULL_ZERO_LEN);
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_TYPE, type);
+  }
 }
 
-inline void slhdsa_set_tree_height(uint8_t addr[32], uint32_t tree_height) {
-  addr[SLHDSA_SHA2_128S_OFFSET_TREE_HGT] = (uint8_t)tree_height;
+inline void slhdsa_set_tree_height(const slh_dsa_config *config,
+                                   uint8_t addr[32], uint32_t tree_height) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_TREE_HEIGHT,
+                              tree_height);
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_TREE_HEIGHT,
+                              tree_height);
+  }
 }
 
-inline void slhdsa_set_tree_index(uint8_t addr[32], uint32_t tree_index) {
-  CRYPTO_store_u32_be(&addr[SLHDSA_SHA2_128S_OFFSET_TREE_INDEX], tree_index);
+inline void slhdsa_set_tree_index(const slh_dsa_config *config,
+                                  uint8_t addr[32], uint32_t tree_index) {
+  if (config->compressed_addresses) {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_TREE_INDEX,
+                              tree_index);
+  } else {
+    bssl::CRYPTO_store_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_TREE_INDEX,
+                              tree_index);
+  }
 }
 
-inline uint32_t slhdsa_get_tree_index(uint8_t addr[32]) {
-  return CRYPTO_load_u32_be(addr + SLHDSA_SHA2_128S_OFFSET_TREE_INDEX);
+inline uint32_t slhdsa_get_tree_index(const slh_dsa_config *config,
+                                      uint8_t addr[32]) {
+  if (config->compressed_addresses) {
+    return bssl::CRYPTO_load_u32_be(addr + SLHDSA_ADDR_COMP_OFFSET_TREE_INDEX);
+  }
+  return bssl::CRYPTO_load_u32_be(addr + SLHDSA_ADDR_FULL_OFFSET_TREE_INDEX);
 }
 
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_ADDRESS_H