grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/pkcs7/pkcs7_x509.cc

@@ -17,9 +17,12 @@
 #include <assert.h>
 #include <limits.h>
 
+#include <openssl/asn1.h>
 #include <openssl/bytestring.h>
 #include <openssl/cms.h>
+#include <openssl/digest.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
 #include <openssl/pem.h>
@@ -28,23 +31,26 @@
 #include <openssl/x509.h>
 
 #include "../asn1/internal.h"
-#include "../x509/internal.h"
 #include "../internal.h"
+#include "../mem_internal.h"
+#include "../x509/internal.h"
 #include "internal.h"
 
 
+using namespace bssl;
+
 int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) {
   int ret = 0;
   const size_t initial_certs_len = sk_X509_num(out_certs);
   STACK_OF(CRYPTO_BUFFER) *raw = sk_CRYPTO_BUFFER_new_null();
-  if (raw == NULL || !PKCS7_get_raw_certificates(raw, cbs, NULL)) {
+  if (raw == nullptr || !PKCS7_get_raw_certificates(raw, cbs, nullptr)) {
     goto err;
   }
 
   for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(raw); i++) {
     CRYPTO_BUFFER *buf = sk_CRYPTO_BUFFER_value(raw, i);
     X509 *x509 = X509_parse_from_buffer(buf);
-    if (x509 == NULL || !sk_X509_push(out_certs, x509)) {
+    if (x509 == nullptr || !sk_X509_push(out_certs, x509)) {
       X509_free(x509);
       goto err;
     }
@@ -66,7 +72,7 @@ err:
 
 int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs) {
   CBS signed_data, crls;
-  uint8_t *der_bytes = NULL;
+  uint8_t *der_bytes = nullptr;
   int ret = 0, has_crls;
   const size_t initial_crls_len = sk_X509_CRL_num(out_crls);
 
@@ -75,7 +81,7 @@ int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs) {
       // Even if only CRLs are included, there may be an empty certificates
       // block. OpenSSL does this, for example.
       !CBS_get_optional_asn1(
-          &signed_data, NULL, NULL,
+          &signed_data, nullptr, nullptr,
           CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0) ||
       !CBS_get_optional_asn1(
           &signed_data, &crls, &has_crls,
@@ -84,7 +90,7 @@ int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs) {
   }
 
   if (!has_crls) {
-    CBS_init(&crls, NULL, 0);
+    CBS_init(&crls, nullptr, 0);
   }
 
   while (CBS_len(&crls) > 0) {
@@ -100,7 +106,7 @@ int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs) {
       goto err;
     }
     inp = CBS_data(&crl_data);
-    crl = d2i_X509_CRL(NULL, &inp, (long)CBS_len(&crl_data));
+    crl = d2i_X509_CRL(nullptr, &inp, (long)CBS_len(&crl_data));
     if (!crl) {
       goto err;
     }
@@ -135,10 +141,10 @@ int PKCS7_get_PEM_certificates(STACK_OF(X509) *out_certs, BIO *pem_bio) {
   // Even though we pass PEM_STRING_PKCS7 as the expected PEM type here, PEM
   // internally will actually allow several other values too, including
   // "CERTIFICATE".
-  if (!PEM_bytes_read_bio(&data, &len, NULL /* PEM type output */,
+  if (!PEM_bytes_read_bio(&data, &len, nullptr /* PEM type output */,
                           PEM_STRING_PKCS7, pem_bio,
-                          NULL /* password callback */,
-                          NULL /* password callback argument */)) {
+                          nullptr /* password callback */,
+                          nullptr /* password callback argument */)) {
     return 0;
   }
 
@@ -157,10 +163,10 @@ int PKCS7_get_PEM_CRLs(STACK_OF(X509_CRL) *out_crls, BIO *pem_bio) {
   // Even though we pass PEM_STRING_PKCS7 as the expected PEM type here, PEM
   // internally will actually allow several other values too, including
   // "CERTIFICATE".
-  if (!PEM_bytes_read_bio(&data, &len, NULL /* PEM type output */,
+  if (!PEM_bytes_read_bio(&data, &len, nullptr /* PEM type output */,
                           PEM_STRING_PKCS7, pem_bio,
-                          NULL /* password callback */,
-                          NULL /* password callback argument */)) {
+                          nullptr /* password callback */,
+                          nullptr /* password callback argument */)) {
     return 0;
   }
 
@@ -185,7 +191,7 @@ static int pkcs7_bundle_certificates_cb(CBB *out, void *arg) {
   for (i = 0; i < sk_X509_num(certs); i++) {
     X509 *x509 = sk_X509_value(certs, i);
     uint8_t *buf;
-    int len = i2d_X509(x509, NULL);
+    int len = i2d_X509(x509, nullptr);
 
     if (len < 0 || !CBB_add_space(&certificates, &buf, len) ||
         i2d_X509(x509, &buf) < 0) {
@@ -193,7 +199,7 @@ static int pkcs7_bundle_certificates_cb(CBB *out, void *arg) {
     }
   }
 
-  // |certificates| is a implicitly-tagged SET OF.
+  // `certificates` is a implicitly-tagged SET OF.
   return CBB_flush_asn1_set_of(&certificates) && CBB_flush(out);
 }
 
@@ -218,7 +224,7 @@ static int pkcs7_bundle_crls_cb(CBB *out, void *arg) {
   for (i = 0; i < sk_X509_CRL_num(crls); i++) {
     X509_CRL *crl = sk_X509_CRL_value(crls, i);
     uint8_t *buf;
-    int len = i2d_X509_CRL(crl, NULL);
+    int len = i2d_X509_CRL(crl, nullptr);
 
     if (len < 0 || !CBB_add_space(&crl_data, &buf, len) ||
         i2d_X509_CRL(crl, &buf) < 0) {
@@ -226,7 +232,7 @@ static int pkcs7_bundle_crls_cb(CBB *out, void *arg) {
     }
   }
 
-  // |crl_data| is a implicitly-tagged SET OF.
+  // `crl_data` is a implicitly-tagged SET OF.
   return CBB_flush_asn1_set_of(&crl_data) && CBB_flush(out);
 }
 
@@ -239,19 +245,18 @@ int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls) {
 
 static PKCS7 *pkcs7_new(CBS *cbs) {
   CBS copy = *cbs, copy2 = *cbs;
-  PKCS7 *ret = reinterpret_cast<PKCS7 *>(OPENSSL_zalloc(sizeof(PKCS7)));
-  if (ret == NULL) {
-    return NULL;
+  PKCS7 *ret = New<PKCS7>();
+  if (ret == nullptr) {
+    return nullptr;
   }
   ret->type = OBJ_nid2obj(NID_pkcs7_signed);
-  ret->d.sign =
-      reinterpret_cast<PKCS7_SIGNED *>(OPENSSL_malloc(sizeof(PKCS7_SIGNED)));
-  if (ret->d.sign == NULL) {
+  ret->d.sign = New<PKCS7_SIGNED>();
+  if (ret->d.sign == nullptr) {
     goto err;
   }
   ret->d.sign->cert = sk_X509_new_null();
   ret->d.sign->crl = sk_X509_CRL_new_null();
-  if (ret->d.sign->cert == NULL || ret->d.sign->crl == NULL ||
+  if (ret->d.sign->cert == nullptr || ret->d.sign->crl == nullptr ||
       !PKCS7_get_certificates(ret->d.sign->cert, &copy) ||
       !PKCS7_get_CRLs(ret->d.sign->crl, cbs)) {
     goto err;
@@ -259,18 +264,18 @@ static PKCS7 *pkcs7_new(CBS *cbs) {
 
   if (sk_X509_num(ret->d.sign->cert) == 0) {
     sk_X509_free(ret->d.sign->cert);
-    ret->d.sign->cert = NULL;
+    ret->d.sign->cert = nullptr;
   }
 
   if (sk_X509_CRL_num(ret->d.sign->crl) == 0) {
     sk_X509_CRL_free(ret->d.sign->crl);
-    ret->d.sign->crl = NULL;
+    ret->d.sign->crl = nullptr;
   }
 
   ret->ber_len = CBS_len(&copy2) - CBS_len(cbs);
   ret->ber_bytes = reinterpret_cast<uint8_t *>(
       OPENSSL_memdup(CBS_data(&copy2), ret->ber_len));
-  if (ret->ber_bytes == NULL) {
+  if (ret->ber_bytes == nullptr) {
     goto err;
   }
 
@@ -278,18 +283,18 @@ static PKCS7 *pkcs7_new(CBS *cbs) {
 
 err:
   PKCS7_free(ret);
-  return NULL;
+  return nullptr;
 }
 
 PKCS7 *d2i_PKCS7(PKCS7 **out, const uint8_t **inp, size_t len) {
   CBS cbs;
   CBS_init(&cbs, *inp, len);
   PKCS7 *ret = pkcs7_new(&cbs);
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
   *inp = CBS_data(&cbs);
-  if (out != NULL) {
+  if (out != nullptr) {
     PKCS7_free(*out);
     *out = ret;
   }
@@ -302,14 +307,14 @@ PKCS7 *d2i_PKCS7_bio(BIO *bio, PKCS7 **out) {
   uint8_t *data;
   size_t len;
   if (!BIO_read_asn1(bio, &data, &len, kMaxSize)) {
-    return NULL;
+    return nullptr;
   }
 
   CBS cbs;
   CBS_init(&cbs, data, len);
   PKCS7 *ret = pkcs7_new(&cbs);
   OPENSSL_free(data);
-  if (out != NULL && ret != NULL) {
+  if (out != nullptr && ret != nullptr) {
     PKCS7_free(*out);
     *out = ret;
   }
@@ -322,14 +327,14 @@ int i2d_PKCS7(const PKCS7 *p7, uint8_t **out) {
     return -1;
   }
 
-  if (out == NULL) {
+  if (out == nullptr) {
     return (int)p7->ber_len;
   }
 
-  if (*out == NULL) {
+  if (*out == nullptr) {
     *out =
         reinterpret_cast<uint8_t *>(OPENSSL_memdup(p7->ber_bytes, p7->ber_len));
-    if (*out == NULL) {
+    if (*out == nullptr) {
       return -1;
     }
   } else {
@@ -344,19 +349,19 @@ int i2d_PKCS7_bio(BIO *bio, const PKCS7 *p7) {
 }
 
 void PKCS7_free(PKCS7 *p7) {
-  if (p7 == NULL) {
+  if (p7 == nullptr) {
     return;
   }
 
   OPENSSL_free(p7->ber_bytes);
   ASN1_OBJECT_free(p7->type);
   // We only supported signed data.
-  if (p7->d.sign != NULL) {
+  if (p7->d.sign != nullptr) {
     sk_X509_pop_free(p7->d.sign->cert, X509_free);
     sk_X509_CRL_pop_free(p7->d.sign->crl, X509_CRL_free);
-    OPENSSL_free(p7->d.sign);
+    Delete(p7->d.sign);
   }
-  OPENSSL_free(p7);
+  Delete(p7);
 }
 
 // We only support signed data, so these getters are no-ops.
@@ -382,7 +387,7 @@ static bool digest_sign_update(EVP_MD_CTX *ctx, BIO *data) {
 namespace {
 struct signer_info_data {
   X509 *sign_cert = nullptr;
-  bssl::ScopedEVP_MD_CTX sign_ctx;
+  ScopedEVP_MD_CTX sign_ctx;
   bool use_key_id = false;
 };
 }  // namespace
@@ -398,7 +403,7 @@ static int write_signer_digest_algos(CBB *digest_algos_set, void *arg) {
 
 // write_signer_info writes the SignerInfo structure from
 // https://www.rfc-editor.org/rfc/rfc2315.html#section-9.2 and
-// https://www.rfc-editor.org/rfc/rfc5652.html#section-5.3 to |out|. It returns
+// https://www.rfc-editor.org/rfc/rfc5652.html#section-5.3 to `out`. It returns
 // one on success or zero on error.
 static int write_signer_info(CBB *out, void *arg) {
   auto *si_data = static_cast<struct signer_info_data *>(arg);
@@ -419,14 +424,14 @@ static int write_signer_info(CBB *out, void *arg) {
       return 0;
     }
     // subjectKeyIdentifier is implicitly-tagged.
-    if (!CBB_add_asn1(&seq, &child, CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
-        !CBB_add_bytes(&child, ASN1_STRING_get0_data(skid),
-                       ASN1_STRING_length(skid))) {
+    if (!CBB_add_asn1_element(&seq, CBS_ASN1_CONTEXT_SPECIFIC | 0,
+                              ASN1_STRING_get0_data(skid),
+                              ASN1_STRING_length(skid))) {
       return 0;
     }
   } else {
     if (!CBB_add_asn1(&seq, &child, CBS_ASN1_SEQUENCE) ||
-        !x509_marshal_name(&child, X509_get_subject_name(si_data->sign_cert)) ||
+        !x509_marshal_name(&child, X509_get_issuer_name(si_data->sign_cert)) ||
         !asn1_marshal_integer(&child,
                               X509_get0_serialNumber(si_data->sign_cert),
                               /*tag=*/0)) {
@@ -467,8 +472,9 @@ static int write_signer_info(CBB *out, void *arg) {
   return 1;
 }
 
-int pkcs7_add_external_signature(CBB *out, X509 *sign_cert, EVP_PKEY *key,
-                                 const EVP_MD *md, BIO *data, bool use_key_id) {
+int bssl::pkcs7_add_external_signature(CBB *out, X509 *sign_cert, EVP_PKEY *key,
+                                       const EVP_MD *md, BIO *data,
+                                       bool use_key_id) {
   signer_info_data si_data;
   si_data.use_key_id = use_key_id;
   si_data.sign_cert = sign_cert;
@@ -490,7 +496,7 @@ int pkcs7_add_external_signature(CBB *out, X509 *sign_cert, EVP_PKEY *key,
 
 PKCS7 *PKCS7_sign(X509 *sign_cert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                   BIO *data, int flags) {
-  bssl::ScopedCBB cbb;
+  ScopedCBB cbb;
   if (!CBB_init(cbb.get(), 2048)) {
     return nullptr;
   }

data/third_party/boringssl-with-bazel/crypto/pkcs8/internal.h

@@ -18,10 +18,6 @@
 #include <openssl/base.h>
 #include <openssl/stack.h>
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
-
 
 struct pkcs8_priv_key_info_st {
   ASN1_INTEGER *version;
@@ -30,9 +26,11 @@ struct pkcs8_priv_key_info_st {
   STACK_OF(X509_ATTRIBUTE) *attributes;
 };
 
-// pkcs8_pbe_decrypt decrypts |in| using the PBE scheme described by
-// |algorithm|, which should be a serialized AlgorithmIdentifier structure. On
-// success, it sets |*out| to a newly-allocated buffer containing the decrypted
+BSSL_NAMESPACE_BEGIN
+
+// pkcs8_pbe_decrypt decrypts `in` using the PBE scheme described by
+// `algorithm`, which should be a serialized AlgorithmIdentifier structure. On
+// success, it sets `*out` to a newly-allocated buffer containing the decrypted
 // result and returns one. Otherwise, it returns zero.
 int pkcs8_pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
                       const char *pass, size_t pass_len, const uint8_t *in,
@@ -43,17 +41,17 @@ int pkcs8_pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
 #define PKCS12_MAC_ID 3
 
 // pkcs12_key_gen runs the PKCS#12 key derivation function as specified in
-// RFC 7292, appendix B. On success, it writes the resulting |out_len| bytes of
-// key material to |out| and returns one. Otherwise, it returns zero. |id|
-// should be one of the |PKCS12_*_ID| values.
+// RFC 7292, appendix B. On success, it writes the resulting `out_len` bytes of
+// key material to `out` and returns one. Otherwise, it returns zero. `id`
+// should be one of the `PKCS12_*_ID` values.
 int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
                    size_t salt_len, uint8_t id, uint32_t iterations,
                    size_t out_len, uint8_t *out, const EVP_MD *md);
 
-// pkcs12_pbe_encrypt_init configures |ctx| for encrypting with a PBES1 scheme
+// pkcs12_pbe_encrypt_init configures `ctx` for encrypting with a PBES1 scheme
 // defined in PKCS#12, or a PBES2 scheme defined in PKCS#5. The algorithm is
-// determined as in |PKCS8_encrypt|. It writes the corresponding
-// AlgorithmIdentifier to |out|.
+// determined as in `PKCS8_encrypt`. It writes the corresponding
+// AlgorithmIdentifier to `out`.
 int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg_nid,
                             const EVP_CIPHER *alg_cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
@@ -63,10 +61,10 @@ struct pbe_suite {
   int pbe_nid;
   uint8_t oid[10];
   uint8_t oid_len;
-  const EVP_CIPHER *(*cipher_func)(void);
-  const EVP_MD *(*md_func)(void);
-  // decrypt_init initialize |ctx| for decrypting. The password is specified by
-  // |pass| and |pass_len|. |param| contains the serialized parameters field of
+  const EVP_CIPHER *(*cipher_func)();
+  const EVP_MD *(*md_func)();
+  // decrypt_init initialize `ctx` for decrypting. The password is specified by
+  // `pass` and `pass_len`. `param` contains the serialized parameters field of
   // the AlgorithmIdentifier.
   //
   // It returns one on success and zero on error.
@@ -74,30 +72,27 @@ struct pbe_suite {
                       const char *pass, size_t pass_len, CBS *param);
 };
 
-#define PKCS5_SALT_LEN 8
+#define PKCS5_SALT_LEN 16
 
-// pkcs5_pbe2_nid_to_cipher returns the |EVP_CIPHER| for |nid| if |nid| is
+// pkcs5_pbe2_nid_to_cipher returns the `EVP_CIPHER` for `nid` if `nid` is
 // supported with PKCS#5 PBES2, and nullptr otherwise.
 const EVP_CIPHER *pkcs5_pbe2_nid_to_cipher(int nid);
 
 int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
                             const char *pass, size_t pass_len, CBS *param);
 
-// PKCS5_pbe2_encrypt_init configures |ctx| for encrypting with PKCS #5 PBES2,
+// PKCS5_pbe2_encrypt_init configures `ctx` for encrypting with PKCS #5 PBES2,
 // as defined in RFC 2998, with the specified parameters. It writes the
-// corresponding AlgorithmIdentifier to |out|.
+// corresponding AlgorithmIdentifier to `out`.
 int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
                             const EVP_CIPHER *cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
                             const uint8_t *salt, size_t salt_len);
 
-// pkcs12_iterations_acceptable returns one if |iterations| is a reasonable
+// pkcs12_iterations_acceptable returns one if `iterations` is a reasonable
 // number of PBKDF2 iterations and zero otherwise.
 int pkcs12_iterations_acceptable(uint64_t iterations);
 
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_PKCS8_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/pkcs8/p5_pbev2.cc

@@ -19,15 +19,18 @@
 
 #include <openssl/bytestring.h>
 #include <openssl/cipher.h>
+#include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
 #include <openssl/rand.h>
 
-#include "internal.h"
 #include "../internal.h"
+#include "internal.h"
 
 
+using namespace bssl;
+
 // 1.2.840.113549.1.5.12
 static const uint8_t kPBKDF2[] = {0x2a, 0x86, 0x48, 0x86, 0xf7,
                                   0x0d, 0x01, 0x05, 0x0c};
@@ -48,7 +51,7 @@ static const struct {
   uint8_t oid[9];
   uint8_t oid_len;
   int nid;
-  const EVP_CIPHER *(*cipher_func)(void);
+  const EVP_CIPHER *(*cipher_func)();
 } kCipherOIDs[] = {
     // 1.2.840.113549.3.2
     {{0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x03, 0x02},
@@ -90,10 +93,8 @@ static const EVP_CIPHER *cbs_to_cipher(const CBS *cbs) {
 static int add_cipher_oid(CBB *out, int nid) {
   for (const auto &cipher : kCipherOIDs) {
     if (cipher.nid == nid) {
-      CBB child;
-      return CBB_add_asn1(out, &child, CBS_ASN1_OBJECT) &&
-             CBB_add_bytes(&child, cipher.oid, cipher.oid_len) &&
-             CBB_flush(out);
+      return CBB_add_asn1_element(out, CBS_ASN1_OBJECT, cipher.oid,
+                                  cipher.oid_len);
     }
   }
 
@@ -101,7 +102,7 @@ static int add_cipher_oid(CBB *out, int nid) {
   return 0;
 }
 
-const EVP_CIPHER *pkcs5_pbe2_nid_to_cipher(int nid) {
+const EVP_CIPHER *bssl::pkcs5_pbe2_nid_to_cipher(int nid) {
   for (const auto &cipher : kCipherOIDs) {
     if (cipher.nid == nid) {
       return cipher.cipher_func();
@@ -123,15 +124,15 @@ static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
   uint8_t key[EVP_MAX_KEY_LENGTH];
   int ret = PKCS5_PBKDF2_HMAC(pass, pass_len, salt, salt_len, iterations,
                               pbkdf2_md, EVP_CIPHER_key_length(cipher), key) &&
-            EVP_CipherInit_ex(ctx, cipher, NULL /* engine */, key, iv, enc);
+            EVP_CipherInit_ex(ctx, cipher, nullptr /* engine */, key, iv, enc);
   OPENSSL_cleanse(key, EVP_MAX_KEY_LENGTH);
   return ret;
 }
 
-int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
-                            const EVP_CIPHER *cipher, uint32_t iterations,
-                            const char *pass, size_t pass_len,
-                            const uint8_t *salt, size_t salt_len) {
+int bssl::PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
+                                  const EVP_CIPHER *cipher, uint32_t iterations,
+                                  const char *pass, size_t pass_len,
+                                  const uint8_t *salt, size_t salt_len) {
   int cipher_nid = EVP_CIPHER_nid(cipher);
   if (cipher_nid == NID_undef) {
     OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
@@ -144,42 +145,43 @@ int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
     return 0;
   }
 
-  // See RFC 2898, appendix A.
-  CBB algorithm, oid, param, kdf, kdf_oid, kdf_param, salt_cbb, cipher_cbb,
-      iv_cbb;
+  // See RFC 8018, appendix A.
+  CBB algorithm, param, kdf, kdf_param, prf, cipher_cbb;
   if (!CBB_add_asn1(out, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, kPBES2, sizeof(kPBES2)) ||
+      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, kPBES2,
+                            sizeof(kPBES2)) ||
       !CBB_add_asn1(&algorithm, &param, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&param, &kdf, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&kdf, &kdf_oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&kdf_oid, kPBKDF2, sizeof(kPBKDF2)) ||
+      !CBB_add_asn1_element(&kdf, CBS_ASN1_OBJECT, kPBKDF2, sizeof(kPBKDF2)) ||
       !CBB_add_asn1(&kdf, &kdf_param, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&kdf_param, &salt_cbb, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&salt_cbb, salt, salt_len) ||
+      !CBB_add_asn1_octet_string(&kdf_param, salt, salt_len) ||
       !CBB_add_asn1_uint64(&kdf_param, iterations) ||
       // Specify a key length for RC2.
       (cipher_nid == NID_rc2_cbc &&
        !CBB_add_asn1_uint64(&kdf_param, EVP_CIPHER_key_length(cipher))) ||
-      // Omit the PRF. We use the default hmacWithSHA1.
-      // TODO(crbug.com/396434682): Improve this defaults.
+      // Use hmacWithSHA256 for the PRF.
+      !CBB_add_asn1(&kdf_param, &prf, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1_element(&prf, CBS_ASN1_OBJECT, kHMACWithSHA256,
+                            sizeof(kHMACWithSHA256)) ||
+      !CBB_add_asn1_element(&prf, CBS_ASN1_NULL, nullptr, 0) ||
       !CBB_add_asn1(&param, &cipher_cbb, CBS_ASN1_SEQUENCE) ||
       !add_cipher_oid(&cipher_cbb, cipher_nid) ||
-      // RFC 2898 says RC2-CBC and RC5-CBC-Pad use a SEQUENCE with version and
+      // RFC 8018 says RC2-CBC and RC5-CBC-Pad use a SEQUENCE with version and
       // IV, but OpenSSL always uses an OCTET STRING IV, so we do the same.
-      !CBB_add_asn1(&cipher_cbb, &iv_cbb, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&iv_cbb, iv, EVP_CIPHER_iv_length(cipher)) ||
+      !CBB_add_asn1_octet_string(&cipher_cbb, iv,
+                                 EVP_CIPHER_iv_length(cipher)) ||
       !CBB_flush(out)) {
     return 0;
   }
 
-  return pkcs5_pbe2_cipher_init(ctx, cipher, EVP_sha1(), iterations, pass,
+  return pkcs5_pbe2_cipher_init(ctx, cipher, EVP_sha256(), iterations, pass,
                                 pass_len, salt, salt_len, iv,
                                 EVP_CIPHER_iv_length(cipher), 1 /* encrypt */);
 }
 
-int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
-                            const char *pass, size_t pass_len, CBS *param) {
+int bssl::PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite,
+                                  EVP_CIPHER_CTX *ctx, const char *pass,
+                                  size_t pass_len, CBS *param) {
   CBS pbe_param, kdf, kdf_obj, enc_scheme, enc_obj;
   if (!CBS_get_asn1(param, &pbe_param, CBS_ASN1_SEQUENCE) ||
       CBS_len(param) != 0 ||
@@ -200,7 +202,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
 
   // See if we recognise the encryption algorithm.
   const EVP_CIPHER *cipher = cbs_to_cipher(&enc_obj);
-  if (cipher == NULL) {
+  if (cipher == nullptr) {
     OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_UNSUPPORTED_CIPHER);
     return 0;
   }
@@ -268,7 +270,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
   }
 
   // Parse the encryption scheme parameters. Note OpenSSL does not match the
-  // specification. Per RFC 2898, this should depend on the encryption scheme.
+  // specification. Per RFC 8018, this should depend on the encryption scheme.
   // In particular, RC2-CBC uses a SEQUENCE with version and IV. We align with
   // OpenSSL.
   CBS iv;