grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/slhdsa/slhdsa.cc.inc

@@ -29,6 +29,16 @@
 #include "thash.h"
 
 
+using namespace bssl;
+
+#if defined(BORINGSSL_FIPS)
+
+DEFINE_STATIC_ONCE(g_slhdsa_keygen_self_test_once)
+DEFINE_STATIC_ONCE(g_slhdsa_sign_self_test_once)
+DEFINE_STATIC_ONCE(g_slhdsa_verify_self_test_once)
+
+#endif
+
 namespace {
 
 namespace fips {
@@ -45,26 +55,24 @@ const uint8_t kSHA384OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
 #define MAX_OID_LENGTH 11
 #define MAX_CONTEXT_LENGTH 255
 
-bcm_infallible generate_key_from_seed_no_self_test(
-    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
-    uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
-    const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
+bcm_infallible generate_key_from_seed_no_self_test(const slh_dsa_config *config,
+                                                   uint8_t *out_public_key,
+                                                   uint8_t *out_secret_key,
+                                                   const uint8_t *seed) {
   // Initialize SK.seed || SK.prf || PK.seed from seed.
-  OPENSSL_memcpy(out_secret_key, seed, 3 * BCM_SLHDSA_SHA2_128S_N);
+  OPENSSL_memcpy(out_secret_key, seed, 3 * config->n);
 
   // Initialize PK.seed from seed.
-  OPENSSL_memcpy(out_public_key, seed + 2 * BCM_SLHDSA_SHA2_128S_N,
-                 BCM_SLHDSA_SHA2_128S_N);
+  OPENSSL_memcpy(out_public_key, seed + 2 * config->n, config->n);
 
   uint8_t addr[32] = {0};
-  slhdsa_set_layer_addr(addr, SLHDSA_SHA2_128S_D - 1);
+  slhdsa_set_layer_addr(config, addr, config->d - 1);
 
   // Set PK.root
-  slhdsa_treehash(out_public_key + BCM_SLHDSA_SHA2_128S_N, out_secret_key, 0,
-                  SLHDSA_SHA2_128S_TREE_HEIGHT, out_public_key, addr);
-  OPENSSL_memcpy(out_secret_key + 3 * BCM_SLHDSA_SHA2_128S_N,
-                 out_public_key + BCM_SLHDSA_SHA2_128S_N,
-                 BCM_SLHDSA_SHA2_128S_N);
+  slhdsa_treehash(config, out_public_key + config->n, out_secret_key, 0,
+                  config->tree_height, out_public_key, addr);
+  OPENSSL_memcpy(out_secret_key + 3 * config->n, out_public_key + config->n,
+                 config->n);
 
   // FIPS 140-3 IG 10.3.A comment 1 says of the pair-wise consistency test for
   // SLH-DSA:
@@ -80,113 +88,135 @@ bcm_infallible generate_key_from_seed_no_self_test(
   if (boringssl_fips_break_test("SLHDSA_PWCT")) {
     out_public_key[0] ^= 1;
   }
-  if (OPENSSL_memcmp(out_public_key,
-                     out_secret_key + 2 * BCM_SLHDSA_SHA2_128S_N,
-                     BCM_SLHDSA_SHA2_128S_N) != 0) {
+  if (OPENSSL_memcmp(out_public_key, out_secret_key + 2 * config->n,
+                     config->n) != 0) {
     abort();
   }
 
   return bcm_infallible::not_approved;
 }
 
-// Note that this overreads by a byte. This is fine in the context that it's
-// used.
-uint64_t load_tree_index(const uint8_t in[8]) {
-  static_assert(SLHDSA_SHA2_128S_TREE_BYTES == 7,
-                "This code needs to be updated");
-  uint64_t index = CRYPTO_load_u64_be(in);
-  index >>= 8;
-  index &= (~(uint64_t)0) >> (64 - SLHDSA_SHA2_128S_TREE_BITS);
+uint64_t load_tree_index(const slh_dsa_config *config, const uint8_t *in) {
+  const size_t tree_bits = slhdsa_tree_bits(config);
+  const size_t tree_bytes = slhdsa_tree_bytes(config);
+  BSSL_CHECK(tree_bits <= 64);
+  BSSL_CHECK(tree_bytes <= 8);
+
+  uint8_t buf[8] = {0};
+  OPENSSL_memcpy(buf + (sizeof(buf) - tree_bytes), in, tree_bytes);
+  uint64_t index = CRYPTO_load_u64_be(buf);
+  if (tree_bits < 64) {
+    index &= (~(uint64_t)0) >> (64 - tree_bits);
+  }
   return index;
 }
 
 // Implements Algorithm 22: slh_sign function (Section 10.2.1, page 39)
 bcm_infallible sign_internal_no_self_test(
-    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
-    const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const slh_dsa_config *config, uint8_t *out_signature,
+    const uint8_t *secret_key,
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
     size_t context_len, const uint8_t *msg, size_t msg_len,
-    const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]) {
+    const uint8_t *entropy) {
+  const size_t n = config->n;
   const uint8_t *sk_seed = secret_key;
-  const uint8_t *sk_prf = secret_key + BCM_SLHDSA_SHA2_128S_N;
-  const uint8_t *pk_seed = secret_key + 2 * BCM_SLHDSA_SHA2_128S_N;
-  const uint8_t *pk_root = secret_key + 3 * BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *sk_prf = secret_key + n;
+  const uint8_t *pk_seed = secret_key + 2 * n;
+  const uint8_t *pk_root = secret_key + 3 * n;
 
   // Derive randomizer R and copy it to signature
-  uint8_t R[BCM_SLHDSA_SHA2_128S_N];
-  slhdsa_thash_prfmsg(R, sk_prf, entropy, header, context, context_len, msg,
-                      msg_len);
-  OPENSSL_memcpy(out_signature, R, BCM_SLHDSA_SHA2_128S_N);
+  uint8_t R[SLHDSA_MAX_N];
+  slhdsa_thash_prfmsg(config, R, sk_prf, entropy, header, context, context_len,
+                      msg, msg_len);
+  OPENSSL_memcpy(out_signature, R, n);
 
   // Compute message digest
-  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
-  slhdsa_thash_hmsg(digest, R, pk_seed, pk_root, header, context, context_len,
-                    msg, msg_len);
-
-  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
-  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-
-  const uint64_t idx_tree =
-      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-  uint32_t idx_leaf = CRYPTO_load_u16_be(
-      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
-  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+  uint8_t digest[SLHDSA_MAX_DIGEST_SIZE];
+  slhdsa_thash_hmsg(config, digest, R, pk_seed, pk_root, header, context,
+                    context_len, msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_MAX_FORS_MSG_BYTES];
+  const size_t fors_msg_bytes = slhdsa_fors_msg_bytes(config);
+  OPENSSL_memcpy(fors_digest, digest, fors_msg_bytes);
+
+  size_t digest_offset = fors_msg_bytes;
+  const uint64_t idx_tree = load_tree_index(config, digest + digest_offset);
+  digest_offset += slhdsa_tree_bytes(config);
+  uint32_t idx_leaf = 0;
+  const size_t leaf_bytes = slhdsa_leaf_bytes(config);
+  for (size_t i = 0; i < leaf_bytes; ++i) {
+    idx_leaf = (idx_leaf << 8) | digest[digest_offset + i];
+  }
+  const size_t leaf_bits = slhdsa_leaf_bits(config);
+  if (leaf_bits < 32) {
+    idx_leaf &= (~(uint32_t)0) >> (32 - leaf_bits);
+  }
 
   uint8_t addr[32] = {0};
-  slhdsa_set_tree_addr(addr, idx_tree);
-  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
-  slhdsa_set_keypair_addr(addr, idx_leaf);
+  slhdsa_set_tree_addr(config, addr, idx_tree);
+  slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(config, addr, idx_leaf);
 
-  slhdsa_fors_sign(out_signature + BCM_SLHDSA_SHA2_128S_N, fors_digest, sk_seed,
-                   pk_seed, addr);
+  slhdsa_fors_sign(config, out_signature + n, fors_digest, sk_seed, pk_seed,
+                   addr);
 
-  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
-  slhdsa_fors_pk_from_sig(pk_fors, out_signature + BCM_SLHDSA_SHA2_128S_N,
-                          fors_digest, pk_seed, addr);
+  uint8_t pk_fors[SLHDSA_MAX_N];
+  slhdsa_fors_pk_from_sig(config, pk_fors, out_signature + n, fors_digest,
+                          pk_seed, addr);
 
-  slhdsa_ht_sign(
-      out_signature + BCM_SLHDSA_SHA2_128S_N + SLHDSA_SHA2_128S_FORS_BYTES,
-      pk_fors, idx_tree, idx_leaf, sk_seed, pk_seed);
+  slhdsa_ht_sign(config, out_signature + n + slhdsa_fors_bytes(config), pk_fors,
+                 idx_tree, idx_leaf, sk_seed, pk_seed);
   return bcm_infallible::approved;
 }
 
-bcm_status verify_internal(
-    const uint8_t *signature, size_t signature_len,
-    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
-    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
-    size_t context_len, const uint8_t *msg, size_t msg_len) {
-  if (signature_len != BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES) {
+bcm_status verify_internal(const slh_dsa_config *config,
+                           const uint8_t *signature, size_t signature_len,
+                           const uint8_t *public_key,
+                           const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN],
+                           const uint8_t *context, size_t context_len,
+                           const uint8_t *msg, size_t msg_len) {
+  const size_t n = config->n;
+  if (signature_len != config->signature_bytes) {
     return bcm_status::failure;
   }
   const uint8_t *pk_seed = public_key;
-  const uint8_t *pk_root = public_key + BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *pk_root = public_key + n;
 
   const uint8_t *r = signature;
-  const uint8_t *sig_fors = signature + BCM_SLHDSA_SHA2_128S_N;
-  const uint8_t *sig_ht = sig_fors + SLHDSA_SHA2_128S_FORS_BYTES;
-
-  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
-  slhdsa_thash_hmsg(digest, r, pk_seed, pk_root, header, context, context_len,
-                    msg, msg_len);
-
-  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
-  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-
-  const uint64_t idx_tree =
-      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-  uint32_t idx_leaf = CRYPTO_load_u16_be(
-      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
-  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+  const uint8_t *sig_fors = signature + n;
+  const uint8_t *sig_ht = sig_fors + slhdsa_fors_bytes(config);
+
+  uint8_t digest[SLHDSA_MAX_DIGEST_SIZE];
+  slhdsa_thash_hmsg(config, digest, r, pk_seed, pk_root, header, context,
+                    context_len, msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_MAX_FORS_MSG_BYTES];
+  const size_t fors_msg_bytes = slhdsa_fors_msg_bytes(config);
+  OPENSSL_memcpy(fors_digest, digest, fors_msg_bytes);
+
+  size_t digest_offset = fors_msg_bytes;
+  const uint64_t idx_tree = load_tree_index(config, digest + digest_offset);
+  digest_offset += slhdsa_tree_bytes(config);
+  uint32_t idx_leaf = 0;
+  const size_t leaf_bytes = slhdsa_leaf_bytes(config);
+  for (size_t i = 0; i < leaf_bytes; ++i) {
+    idx_leaf = (idx_leaf << 8) | digest[digest_offset + i];
+  }
+  const size_t leaf_bits = slhdsa_leaf_bits(config);
+  if (leaf_bits < 32) {
+    idx_leaf &= (~(uint32_t)0) >> (32 - leaf_bits);
+  }
 
   uint8_t addr[32] = {0};
-  slhdsa_set_tree_addr(addr, idx_tree);
-  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
-  slhdsa_set_keypair_addr(addr, idx_leaf);
+  slhdsa_set_tree_addr(config, addr, idx_tree);
+  slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(config, addr, idx_leaf);
 
-  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
-  slhdsa_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
+  uint8_t pk_fors[SLHDSA_MAX_N];
+  slhdsa_fors_pk_from_sig(config, pk_fors, sig_fors, fors_digest, pk_seed,
+                          addr);
 
-  if (!slhdsa_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
+  if (!slhdsa_ht_verify(config, sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
                         pk_seed)) {
     return bcm_status::failure;
   }
@@ -202,14 +232,10 @@ static int keygen_self_test() {
   uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N] = {0};
   uint8_t pub[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES];
   uint8_t priv[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES];
-  generate_key_from_seed_no_self_test(pub, priv, seed);
-
-  static_assert(sizeof(kExpectedPublicKey) == sizeof(pub));
-  static_assert(sizeof(kExpectedPrivateKey) == sizeof(priv));
-  if (!BORINGSSL_check_test(kExpectedPublicKey, pub, sizeof(pub),
-                            "SLH-DSA public key") ||
-      !BORINGSSL_check_test(kExpectedPrivateKey, priv, sizeof(priv),
-                            "SLH-DSA private key")) {
+  generate_key_from_seed_no_self_test(&kSLHDSAConfigSHA2_128s, pub, priv, seed);
+
+  if (!BORINGSSL_check_test(kExpectedPublicKey, pub, "SLH-DSA public key") ||
+      !BORINGSSL_check_test(kExpectedPrivateKey, priv, "SLH-DSA private key")) {
     return 0;
   }
 
@@ -220,13 +246,12 @@ static int sign_self_test() {
   uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN] = {0};
   uint8_t entropy[BCM_SLHDSA_SHA2_128S_N] = {0};
   uint8_t sig[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES];
-  sign_internal_no_self_test(sig, kExpectedPrivateKey, header, nullptr, 0,
-                             nullptr, 0, entropy);
+  sign_internal_no_self_test(&kSLHDSAConfigSHA2_128s, sig, kExpectedPrivateKey,
+                             header, nullptr, 0, nullptr, 0, entropy);
   uint8_t digest[32];
   SHA256(sig, sizeof(sig), digest);
 
-  static_assert(sizeof(kExpectedSignatureSHA256) == sizeof(digest));
-  if (!BORINGSSL_check_test(kExpectedSignatureSHA256, digest, sizeof(digest),
+  if (!BORINGSSL_check_test(kExpectedSignatureSHA256, digest,
                             "SLH-DSA signature")) {
     return 0;
   }
@@ -236,16 +261,14 @@ static int sign_self_test() {
 
 static int verify_self_test() {
   uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN] = {0};
-  return verify_internal(kExpectedSignature, sizeof(kExpectedSignature),
-                         kExpectedPublicKey, header, nullptr, 0, nullptr,
-                         0) == bcm_status::approved;
+  return verify_internal(&kSLHDSAConfigSHA2_128s, kExpectedSignature,
+                         sizeof(kExpectedSignature), kExpectedPublicKey, header,
+                         nullptr, 0, nullptr, 0) == bcm_status::approved;
 }
 
 #if defined(BORINGSSL_FIPS)
 
-DEFINE_STATIC_ONCE(g_slhdsa_keygen_self_test_once)
-
-void ensure_keygen_self_test(void) {
+void ensure_keygen_self_test() {
   CRYPTO_once(g_slhdsa_keygen_self_test_once_bss_get(), []() {
     if (!keygen_self_test()) {
       BORINGSSL_FIPS_abort();
@@ -253,9 +276,7 @@ void ensure_keygen_self_test(void) {
   });
 }
 
-DEFINE_STATIC_ONCE(g_slhdsa_sign_self_test_once)
-
-void ensure_sign_self_test(void) {
+void ensure_sign_self_test() {
   CRYPTO_once(g_slhdsa_sign_self_test_once_bss_get(), []() {
     if (!sign_self_test()) {
       BORINGSSL_FIPS_abort();
@@ -263,9 +284,7 @@ void ensure_sign_self_test(void) {
   });
 }
 
-DEFINE_STATIC_ONCE(g_slhdsa_verify_self_test_once)
-
-void ensure_verify_self_test(void) {
+void ensure_verify_self_test() {
   CRYPTO_once(g_slhdsa_verify_self_test_once_bss_get(), []() {
     if (!verify_self_test()) {
       BORINGSSL_FIPS_abort();
@@ -275,9 +294,9 @@ void ensure_verify_self_test(void) {
 
 #else
 
-void ensure_keygen_self_test(void) {}
-void ensure_sign_self_test(void) {}
-void ensure_verify_self_test(void) {}
+void ensure_keygen_self_test() {}
+void ensure_sign_self_test() {}
+void ensure_verify_self_test() {}
 
 #endif
 
@@ -285,16 +304,25 @@ void ensure_verify_self_test(void) {}
 
 }  // namespace
 
-bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
+bcm_infallible bssl::BCM_slhdsa_sha2_128s_generate_key_from_seed(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
   fips::ensure_keygen_self_test();
-  return generate_key_from_seed_no_self_test(out_public_key, out_secret_key,
-                                             seed);
+  return generate_key_from_seed_no_self_test(
+      &kSLHDSAConfigSHA2_128s, out_public_key, out_secret_key, seed);
 }
 
-bcm_status BCM_slhdsa_sha2_128s_generate_key_from_seed_fips(
+bcm_infallible bssl::BCM_slhdsa_shake_256f_generate_key_from_seed(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHAKE_256F_N]) {
+  fips::ensure_keygen_self_test();
+  return generate_key_from_seed_no_self_test(
+      &kSLHDSAConfigSHAKE_256f, out_public_key, out_secret_key, seed);
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_generate_key_from_seed_fips(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
@@ -306,7 +334,19 @@ bcm_status BCM_slhdsa_sha2_128s_generate_key_from_seed_fips(
   return bcm_status::approved;
 }
 
-bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
+bcm_status bssl::BCM_slhdsa_shake_256f_generate_key_from_seed_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHAKE_256F_N]) {
+  if (out_public_key == nullptr || out_secret_key == nullptr) {
+    return bcm_status::failure;
+  }
+  BCM_slhdsa_shake_256f_generate_key_from_seed(out_public_key, out_secret_key,
+                                               seed);
+  return bcm_status::approved;
+}
+
+bcm_infallible bssl::BCM_slhdsa_sha2_128s_generate_key(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
   uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N];
@@ -315,7 +355,16 @@ bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
                                                      out_private_key, seed);
 }
 
-bcm_status BCM_slhdsa_sha2_128s_generate_key_fips(
+bcm_infallible bssl::BCM_slhdsa_shake_256f_generate_key(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]) {
+  uint8_t seed[3 * BCM_SLHDSA_SHAKE_256F_N];
+  RAND_bytes(seed, 3 * BCM_SLHDSA_SHAKE_256F_N);
+  return BCM_slhdsa_shake_256f_generate_key_from_seed(out_public_key,
+                                                      out_private_key, seed);
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_generate_key_fips(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
   if (out_public_key == nullptr || out_private_key == nullptr) {
@@ -325,7 +374,17 @@ bcm_status BCM_slhdsa_sha2_128s_generate_key_fips(
   return bcm_status::approved;
 }
 
-bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
+bcm_status bssl::BCM_slhdsa_shake_256f_generate_key_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]) {
+  if (out_public_key == nullptr || out_private_key == nullptr) {
+    return bcm_status::failure;
+  }
+  BCM_slhdsa_shake_256f_generate_key(out_public_key, out_private_key);
+  return bcm_status::approved;
+}
+
+bcm_infallible bssl::BCM_slhdsa_sha2_128s_public_from_private(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
   OPENSSL_memcpy(out_public_key, private_key + 2 * BCM_SLHDSA_SHA2_128S_N,
@@ -333,7 +392,15 @@ bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
   return bcm_infallible::approved;
 }
 
-bcm_status BCM_slhdsa_sha2_128s_sign(
+bcm_infallible bssl::BCM_slhdsa_shake_256f_public_from_private(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]) {
+  OPENSSL_memcpy(out_public_key, private_key + 2 * BCM_SLHDSA_SHAKE_256F_N,
+                 BCM_SLHDSA_SHAKE_256F_N * 2);
+  return bcm_infallible::approved;
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
@@ -355,6 +422,27 @@ bcm_status BCM_slhdsa_sha2_128s_sign(
   return bcm_status::approved;
 }
 
+bcm_status bssl::BCM_slhdsa_shake_256f_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t entropy[BCM_SLHDSA_SHAKE_256F_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  BCM_slhdsa_shake_256f_sign_internal(out_signature, private_key,
+                                      M_prime_header, context, context_len, msg,
+                                      msg_len, entropy);
+  return bcm_status::approved;
+}
+
 static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
                                       size_t *out_context_and_oid_len,
                                       size_t max_out_context_and_oid,
@@ -368,7 +456,7 @@ static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
     case NID_sha256:
       oid = kSHA256OID;
       oid_len = sizeof(kSHA256OID);
-      static_assert(sizeof(kSHA256OID) <= MAX_OID_LENGTH, "");
+      static_assert(sizeof(kSHA256OID) <= MAX_OID_LENGTH);
       expected_hash_len = 32;
       break;
 
@@ -377,7 +465,7 @@ static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
     case NID_sha384:
       oid = kSHA384OID;
       oid_len = sizeof(kSHA384OID);
-      static_assert(sizeof(kSHA384OID) <= MAX_OID_LENGTH, "");
+      static_assert(sizeof(kSHA384OID) <= MAX_OID_LENGTH);
       expected_hash_len = 48;
       break;
 
@@ -402,18 +490,31 @@ static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
   return 1;
 }
 
-bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
+bcm_infallible bssl::BCM_slhdsa_sha2_128s_sign_internal(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
     size_t context_len, const uint8_t *msg, size_t msg_len,
     const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]) {
   fips::ensure_sign_self_test();
-  return sign_internal_no_self_test(out_signature, secret_key, header, context,
-                                    context_len, msg, msg_len, entropy);
+  return sign_internal_no_self_test(&kSLHDSAConfigSHA2_128s, out_signature,
+                                    secret_key, header, context, context_len,
+                                    msg, msg_len, entropy);
 }
 
-bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
+bcm_infallible bssl::BCM_slhdsa_shake_256f_sign_internal(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[BCM_SLHDSA_SHAKE_256F_N]) {
+  fips::ensure_sign_self_test();
+  return sign_internal_no_self_test(&kSLHDSAConfigSHAKE_256f, out_signature,
+                                    secret_key, header, context, context_len,
+                                    msg, msg_len, entropy);
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_prehash_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
@@ -442,8 +543,37 @@ bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
   return bcm_status::approved;
 }
 
+bcm_status bssl::BCM_slhdsa_shake_256f_prehash_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_context_and_oid(context_and_oid, &context_and_oid_len,
+                                  sizeof(context_and_oid), context, context_len,
+                                  hash_nid, hashed_msg_len)) {
+    return bcm_status::failure;
+  }
+
+  uint8_t entropy[BCM_SLHDSA_SHAKE_256F_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  BCM_slhdsa_shake_256f_sign_internal(
+      out_signature, private_key, M_prime_header, context_and_oid,
+      context_and_oid_len, hashed_msg, hashed_msg_len, entropy);
+  return bcm_status::approved;
+}
+
 // Implements Algorithm 24: slh_verify function (Section 10.3, page 41)
-bcm_status BCM_slhdsa_sha2_128s_verify(
+bcm_status bssl::BCM_slhdsa_sha2_128s_verify(
     const uint8_t *signature, size_t signature_len,
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
@@ -462,7 +592,25 @@ bcm_status BCM_slhdsa_sha2_128s_verify(
       context_len, msg, msg_len);
 }
 
-bcm_status BCM_slhdsa_sha2_128s_prehash_verify(
+bcm_status bssl::BCM_slhdsa_shake_256f_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;
+  M_prime_header[1] = (uint8_t)context_len;
+
+  return BCM_slhdsa_shake_256f_verify_internal(
+      signature, signature_len, public_key, M_prime_header, context,
+      context_len, msg, msg_len);
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_prehash_verify(
     const uint8_t *signature, size_t signature_len,
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
@@ -488,17 +636,55 @@ bcm_status BCM_slhdsa_sha2_128s_prehash_verify(
       context_and_oid_len, hashed_msg, hashed_msg_len);
 }
 
-bcm_status BCM_slhdsa_sha2_128s_verify_internal(
+bcm_status bssl::BCM_slhdsa_shake_256f_prehash_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return bcm_status::failure;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_context_and_oid(context_and_oid, &context_and_oid_len,
+                                  sizeof(context_and_oid), context, context_len,
+                                  hash_nid, hashed_msg_len)) {
+    return bcm_status::failure;
+  }
+
+  return BCM_slhdsa_shake_256f_verify_internal(
+      signature, signature_len, public_key, M_prime_header, context_and_oid,
+      context_and_oid_len, hashed_msg, hashed_msg_len);
+}
+
+bcm_status bssl::BCM_slhdsa_sha2_128s_verify_internal(
     const uint8_t *signature, size_t signature_len,
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
     size_t context_len, const uint8_t *msg, size_t msg_len) {
   fips::ensure_verify_self_test();
-  return verify_internal(signature, signature_len, public_key, header, context,
-                         context_len, msg, msg_len);
+  return verify_internal(&kSLHDSAConfigSHA2_128s, signature, signature_len,
+                         public_key, header, context, context_len, msg,
+                         msg_len);
+}
+
+bcm_status bssl::BCM_slhdsa_shake_256f_verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len) {
+  fips::ensure_verify_self_test();
+  return verify_internal(&kSLHDSAConfigSHAKE_256f, signature, signature_len,
+                         public_key, header, context, context_len, msg,
+                         msg_len);
 }
 
-int boringssl_self_test_slhdsa() {
+int bssl::boringssl_self_test_slhdsa() {
   return fips::keygen_self_test() && fips::sign_self_test() &&
          fips::verify_self_test();
 }