grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/include/openssl/hpke.h

@@ -16,7 +16,7 @@
 #define OPENSSL_HEADER_HPKE_H
 
 #include <openssl/aead.h>
-#include <openssl/base.h>   // IWYU pragma: export
+#include <openssl/base.h>  // IWYU pragma: export
 #include <openssl/curve25519.h>
 #include <openssl/digest.h>
 
@@ -36,58 +36,67 @@ extern "C" {
 // Parameters.
 //
 // An HPKE context is parameterized by KEM, KDF, and AEAD algorithms,
-// represented by |EVP_HPKE_KEM|, |EVP_HPKE_KDF|, and |EVP_HPKE_AEAD| types,
+// represented by `EVP_HPKE_KEM`, `EVP_HPKE_KDF`, and `EVP_HPKE_AEAD` types,
 // respectively.
 
 // The following constants are KEM identifiers.
 #define EVP_HPKE_DHKEM_P256_HKDF_SHA256 0x0010
 #define EVP_HPKE_DHKEM_X25519_HKDF_SHA256 0x0020
+#define EVP_HPKE_XWING 0x647a
+#define EVP_HPKE_MLKEM768 0x0041
+#define EVP_HPKE_MLKEM1024 0x0042
 
 // The following functions are KEM algorithms which may be used with HPKE. Note
 // that, while some HPKE KEMs use KDFs internally, this is separate from the
-// |EVP_HPKE_KDF| selection.
+// `EVP_HPKE_KDF` selection.
 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_x25519_hkdf_sha256(void);
 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_p256_hkdf_sha256(void);
+OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_xwing(void);
+OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_mlkem768(void);
+OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_mlkem1024(void);
 
-// EVP_HPKE_KEM_id returns the HPKE KEM identifier for |kem|, which
-// will be one of the |EVP_HPKE_KEM_*| constants.
+// EVP_HPKE_KEM_id returns the HPKE KEM identifier for `kem`, which
+// will be one of the `EVP_HPKE_KEM_*` constants.
 OPENSSL_EXPORT uint16_t EVP_HPKE_KEM_id(const EVP_HPKE_KEM *kem);
 
 // EVP_HPKE_MAX_PUBLIC_KEY_LENGTH is the maximum length of an encoded public key
 // for all KEMs currently supported by this library.
-#define EVP_HPKE_MAX_PUBLIC_KEY_LENGTH 65
+#define EVP_HPKE_MAX_PUBLIC_KEY_LENGTH 1568
 
-// EVP_HPKE_KEM_public_key_len returns the length of a public key for |kem|.
-// This value will be at most |EVP_HPKE_MAX_PUBLIC_KEY_LENGTH|.
+// EVP_HPKE_KEM_public_key_len returns the length of a public key for `kem`.
+// This value will be at most `EVP_HPKE_MAX_PUBLIC_KEY_LENGTH`.
 OPENSSL_EXPORT size_t EVP_HPKE_KEM_public_key_len(const EVP_HPKE_KEM *kem);
 
 // EVP_HPKE_MAX_PRIVATE_KEY_LENGTH is the maximum length of an encoded private
 // key for all KEMs currently supported by this library.
-#define EVP_HPKE_MAX_PRIVATE_KEY_LENGTH 32
+#define EVP_HPKE_MAX_PRIVATE_KEY_LENGTH 64
 
-// EVP_HPKE_KEM_private_key_len returns the length of a private key for |kem|.
-// This value will be at most |EVP_HPKE_MAX_PRIVATE_KEY_LENGTH|.
+// EVP_HPKE_KEM_private_key_len returns the length of a private key for `kem`.
+// This value will be at most `EVP_HPKE_MAX_PRIVATE_KEY_LENGTH`.
 OPENSSL_EXPORT size_t EVP_HPKE_KEM_private_key_len(const EVP_HPKE_KEM *kem);
 
 // EVP_HPKE_MAX_ENC_LENGTH is the maximum length of "enc", the encapsulated
 // shared secret, for all KEMs currently supported by this library.
-#define EVP_HPKE_MAX_ENC_LENGTH 65
+#define EVP_HPKE_MAX_ENC_LENGTH 1568
 
 // EVP_HPKE_KEM_enc_len returns the length of the "enc", the encapsulated shared
-// secret, for |kem|. This value will be at most |EVP_HPKE_MAX_ENC_LENGTH|.
+// secret, for `kem`. This value will be at most `EVP_HPKE_MAX_ENC_LENGTH`.
 OPENSSL_EXPORT size_t EVP_HPKE_KEM_enc_len(const EVP_HPKE_KEM *kem);
 
 // The following constants are KDF identifiers.
 #define EVP_HPKE_HKDF_SHA256 0x0001
+#define EVP_HPKE_HKDF_SHA384 0x0002
 
-// The following functions are KDF algorithms which may be used with HPKE.
+// The following functions are KDF algorithms which may be used with HPKE. If
+// unsure, use `EVP_hpke_hkdf_sha256`.
 OPENSSL_EXPORT const EVP_HPKE_KDF *EVP_hpke_hkdf_sha256(void);
+OPENSSL_EXPORT const EVP_HPKE_KDF *EVP_hpke_hkdf_sha384(void);
 
-// EVP_HPKE_KDF_id returns the HPKE KDF identifier for |kdf|.
+// EVP_HPKE_KDF_id returns the HPKE KDF identifier for `kdf`.
 OPENSSL_EXPORT uint16_t EVP_HPKE_KDF_id(const EVP_HPKE_KDF *kdf);
 
-// EVP_HPKE_KDF_hkdf_md returns the HKDF hash function corresponding to |kdf|,
-// or NULL if |kdf| is not an HKDF-based KDF. All currently supported KDFs are
+// EVP_HPKE_KDF_hkdf_md returns the HKDF hash function corresponding to `kdf`,
+// or NULL if `kdf` is not an HKDF-based KDF. All currently supported KDFs are
 // HKDF-based.
 OPENSSL_EXPORT const EVP_MD *EVP_HPKE_KDF_hkdf_md(const EVP_HPKE_KDF *kdf);
 
@@ -101,83 +110,90 @@ OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_aes_128_gcm(void);
 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_aes_256_gcm(void);
 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_chacha20_poly1305(void);
 
-// EVP_HPKE_AEAD_id returns the HPKE AEAD identifier for |aead|.
+// EVP_HPKE_AEAD_id returns the HPKE AEAD identifier for `aead`.
 OPENSSL_EXPORT uint16_t EVP_HPKE_AEAD_id(const EVP_HPKE_AEAD *aead);
 
-// EVP_HPKE_AEAD_aead returns the |EVP_AEAD| corresponding to |aead|.
+// EVP_HPKE_AEAD_aead returns the `EVP_AEAD` corresponding to `aead`.
 OPENSSL_EXPORT const EVP_AEAD *EVP_HPKE_AEAD_aead(const EVP_HPKE_AEAD *aead);
 
 
 // Recipient keys.
 //
 // An HPKE recipient maintains a long-term KEM key. This library represents keys
-// with the |EVP_HPKE_KEY| type.
+// with the `EVP_HPKE_KEY` type.
 
-// EVP_HPKE_KEY_zero sets an uninitialized |EVP_HPKE_KEY| to the zero state. The
-// caller should then use |EVP_HPKE_KEY_init|, |EVP_HPKE_KEY_copy|, or
-// |EVP_HPKE_KEY_generate| to finish initializing |key|.
+// EVP_HPKE_KEY_zero sets an uninitialized `EVP_HPKE_KEY` to the zero state. The
+// caller should then use `EVP_HPKE_KEY_init`, `EVP_HPKE_KEY_copy`, or
+// `EVP_HPKE_KEY_generate` to finish initializing `key`.
 //
-// It is safe, but not necessary to call |EVP_HPKE_KEY_cleanup| in this state.
-// This may be used for more uniform cleanup of |EVP_HPKE_KEY|.
+// It is safe, but not necessary to call `EVP_HPKE_KEY_cleanup` in this state.
+// This may be used for more uniform cleanup of `EVP_HPKE_KEY`.
 OPENSSL_EXPORT void EVP_HPKE_KEY_zero(EVP_HPKE_KEY *key);
 
-// EVP_HPKE_KEY_cleanup releases memory referenced by |key|.
+// EVP_HPKE_KEY_cleanup releases memory referenced by `key`.
 OPENSSL_EXPORT void EVP_HPKE_KEY_cleanup(EVP_HPKE_KEY *key);
 
-// EVP_HPKE_KEY_new returns a newly-allocated |EVP_HPKE_KEY|, or NULL on error.
-// The caller must call |EVP_HPKE_KEY_free| on the result to release it.
+// EVP_HPKE_KEY_new returns a newly-allocated `EVP_HPKE_KEY`, or NULL on error.
+// The caller must call `EVP_HPKE_KEY_free` on the result to release it.
 //
 // This is a convenience function for callers that need a heap-allocated
-// |EVP_HPKE_KEY|.
+// `EVP_HPKE_KEY`.
 OPENSSL_EXPORT EVP_HPKE_KEY *EVP_HPKE_KEY_new(void);
 
-// EVP_HPKE_KEY_free releases memory associated with |key|, which must have been
-// created with |EVP_HPKE_KEY_new|.
+// EVP_HPKE_KEY_free releases memory associated with `key`, which must have been
+// created with `EVP_HPKE_KEY_new`.
 OPENSSL_EXPORT void EVP_HPKE_KEY_free(EVP_HPKE_KEY *key);
 
-// EVP_HPKE_KEY_copy sets |dst| to a copy of |src|. It returns one on success
-// and zero on error. On success, the caller must call |EVP_HPKE_KEY_cleanup| to
-// release |dst|. On failure, calling |EVP_HPKE_KEY_cleanup| is safe, but not
+// EVP_HPKE_KEY_copy sets `dst` to a copy of `src`. It returns one on success
+// and zero on error. On success, the caller must call `EVP_HPKE_KEY_cleanup` to
+// release `dst`. On failure, calling `EVP_HPKE_KEY_cleanup` is safe, but not
 // necessary.
 OPENSSL_EXPORT int EVP_HPKE_KEY_copy(EVP_HPKE_KEY *dst,
                                      const EVP_HPKE_KEY *src);
 
-// EVP_HPKE_KEY_move sets |out|, which must be initialized or in the zero state,
-// to the key in |in|. |in| is mutated and left in the zero state.
+// EVP_HPKE_KEY_move sets `out`, which must be initialized or in the zero state,
+// to the key in `in`. `in` is mutated and left in the zero state.
 OPENSSL_EXPORT void EVP_HPKE_KEY_move(EVP_HPKE_KEY *out, EVP_HPKE_KEY *in);
 
-// EVP_HPKE_KEY_init decodes |priv_key| as a private key for |kem| and
-// initializes |key| with the result. It returns one on success and zero if
-// |priv_key| was invalid. On success, the caller must call
-// |EVP_HPKE_KEY_cleanup| to release the key. On failure, calling
-// |EVP_HPKE_KEY_cleanup| is safe, but not necessary.
+// EVP_HPKE_KEY_init decodes `priv_key` as a private key for `kem` and
+// initializes `key` with the result. It returns one on success and zero if
+// `priv_key` was invalid. On success, the caller must call
+// `EVP_HPKE_KEY_cleanup` to release the key. On failure, calling
+// `EVP_HPKE_KEY_cleanup` is safe, but not necessary.
 OPENSSL_EXPORT int EVP_HPKE_KEY_init(EVP_HPKE_KEY *key, const EVP_HPKE_KEM *kem,
                                      const uint8_t *priv_key,
                                      size_t priv_key_len);
 
-// EVP_HPKE_KEY_generate sets |key| to a newly-generated key using |kem|.
+// EVP_HPKE_KEY_generate sets `key` to a newly-generated key using `kem`.
 OPENSSL_EXPORT int EVP_HPKE_KEY_generate(EVP_HPKE_KEY *key,
                                          const EVP_HPKE_KEM *kem);
 
-// EVP_HPKE_KEY_kem returns the HPKE KEM used by |key|.
+// EVP_HPKE_KEY_derive deterministically derives a key from `ikm` for use with
+// `kem` and initializes `key` with the result. It returns one on success and
+// zero on error. This corresponds to the DeriveKeyPair operation in RFC 9180.
+OPENSSL_EXPORT int EVP_HPKE_KEY_derive(EVP_HPKE_KEY *key,
+                                       const EVP_HPKE_KEM *kem,
+                                       const uint8_t *ikm, size_t ikm_len);
+
+// EVP_HPKE_KEY_kem returns the HPKE KEM used by `key`.
 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_HPKE_KEY_kem(const EVP_HPKE_KEY *key);
 
-// EVP_HPKE_KEY_public_key writes |key|'s public key to |out| and sets
-// |*out_len| to the number of bytes written. On success, it returns one and
-// writes at most |max_out| bytes. If |max_out| is too small, it returns zero.
-// Setting |max_out| to |EVP_HPKE_MAX_PUBLIC_KEY_LENGTH| will ensure the public
+// EVP_HPKE_KEY_public_key writes `key`'s public key to `out` and sets
+// `*out_len` to the number of bytes written. On success, it returns one and
+// writes at most `max_out` bytes. If `max_out` is too small, it returns zero.
+// Setting `max_out` to `EVP_HPKE_MAX_PUBLIC_KEY_LENGTH` will ensure the public
 // key fits. An exact size can also be determined by
-// |EVP_HPKE_KEM_public_key_len|.
+// `EVP_HPKE_KEM_public_key_len`.
 OPENSSL_EXPORT int EVP_HPKE_KEY_public_key(const EVP_HPKE_KEY *key,
                                            uint8_t *out, size_t *out_len,
                                            size_t max_out);
 
-// EVP_HPKE_KEY_private_key writes |key|'s private key to |out| and sets
-// |*out_len| to the number of bytes written. On success, it returns one and
-// writes at most |max_out| bytes. If |max_out| is too small, it returns zero.
-// Setting |max_out| to |EVP_HPKE_MAX_PRIVATE_KEY_LENGTH| will ensure the
+// EVP_HPKE_KEY_private_key writes `key`'s private key to `out` and sets
+// `*out_len` to the number of bytes written. On success, it returns one and
+// writes at most `max_out` bytes. If `max_out` is too small, it returns zero.
+// Setting `max_out` to `EVP_HPKE_MAX_PRIVATE_KEY_LENGTH` will ensure the
 // private key fits. An exact size can also be determined by
-// |EVP_HPKE_KEM_private_key_len|.
+// `EVP_HPKE_KEM_private_key_len`.
 OPENSSL_EXPORT int EVP_HPKE_KEY_private_key(const EVP_HPKE_KEY *key,
                                             uint8_t *out, size_t *out_len,
                                             size_t max_out);
@@ -185,47 +201,47 @@ OPENSSL_EXPORT int EVP_HPKE_KEY_private_key(const EVP_HPKE_KEY *key,
 
 // Encryption contexts.
 //
-// An HPKE encryption context is represented by the |EVP_HPKE_CTX| type.
+// An HPKE encryption context is represented by the `EVP_HPKE_CTX` type.
 
-// EVP_HPKE_CTX_zero sets an uninitialized |EVP_HPKE_CTX| to the zero state. The
-// caller should then use one of the |EVP_HPKE_CTX_setup_*| functions to finish
-// setting up |ctx|.
+// EVP_HPKE_CTX_zero sets an uninitialized `EVP_HPKE_CTX` to the zero state. The
+// caller should then use one of the `EVP_HPKE_CTX_setup_*` functions to finish
+// setting up `ctx`.
 //
-// It is safe, but not necessary to call |EVP_HPKE_CTX_cleanup| in this state.
-// This may be used for more uniform cleanup of |EVP_HPKE_CTX|.
+// It is safe, but not necessary to call `EVP_HPKE_CTX_cleanup` in this state.
+// This may be used for more uniform cleanup of `EVP_HPKE_CTX`.
 OPENSSL_EXPORT void EVP_HPKE_CTX_zero(EVP_HPKE_CTX *ctx);
 
-// EVP_HPKE_CTX_cleanup releases memory referenced by |ctx|. |ctx| must have
-// been initialized with |EVP_HPKE_CTX_zero| or one of the
-// |EVP_HPKE_CTX_setup_*| functions.
+// EVP_HPKE_CTX_cleanup releases memory referenced by `ctx`. `ctx` must have
+// been initialized with `EVP_HPKE_CTX_zero` or one of the
+// `EVP_HPKE_CTX_setup_*` functions.
 OPENSSL_EXPORT void EVP_HPKE_CTX_cleanup(EVP_HPKE_CTX *ctx);
 
-// EVP_HPKE_CTX_new returns a newly-allocated |EVP_HPKE_CTX|, or NULL on error.
-// The caller must call |EVP_HPKE_CTX_free| on the result to release it.
+// EVP_HPKE_CTX_new returns a newly-allocated `EVP_HPKE_CTX`, or NULL on error.
+// The caller must call `EVP_HPKE_CTX_free` on the result to release it.
 //
 // This is a convenience function for callers that need a heap-allocated
-// |EVP_HPKE_CTX|.
+// `EVP_HPKE_CTX`.
 OPENSSL_EXPORT EVP_HPKE_CTX *EVP_HPKE_CTX_new(void);
 
-// EVP_HPKE_CTX_free releases memory associated with |ctx|, which must have been
-// created with |EVP_HPKE_CTX_new|.
+// EVP_HPKE_CTX_free releases memory associated with `ctx`, which must have been
+// created with `EVP_HPKE_CTX_new`.
 OPENSSL_EXPORT void EVP_HPKE_CTX_free(EVP_HPKE_CTX *ctx);
 
 // EVP_HPKE_CTX_setup_sender implements the SetupBaseS HPKE operation. It
-// encapsulates a shared secret for |peer_public_key| and sets up |ctx| as a
-// sender context. It writes the encapsulated shared secret to |out_enc| and
-// sets |*out_enc_len| to the number of bytes written. It writes at most
-// |max_enc| bytes and fails if the buffer is too small. Setting |max_enc| to at
-// least |EVP_HPKE_MAX_ENC_LENGTH| will ensure the buffer is large enough. An
-// exact size may also be determined by |EVP_PKEY_KEM_enc_len|.
+// encapsulates a shared secret for `peer_public_key` and sets up `ctx` as a
+// sender context. It writes the encapsulated shared secret to `out_enc` and
+// sets `*out_enc_len` to the number of bytes written. It writes at most
+// `max_enc` bytes and fails if the buffer is too small. Setting `max_enc` to at
+// least `EVP_HPKE_MAX_ENC_LENGTH` will ensure the buffer is large enough. An
+// exact size may also be determined by `EVP_PKEY_KEM_enc_len`.
 //
 // This function returns one on success and zero on error. Note that
-// |peer_public_key| may be invalid, in which case this function will return an
+// `peer_public_key` may be invalid, in which case this function will return an
 // error.
 //
-// On success, callers may call |EVP_HPKE_CTX_seal| to encrypt messages for the
-// recipient. Callers must then call |EVP_HPKE_CTX_cleanup| when done. On
-// failure, calling |EVP_HPKE_CTX_cleanup| is safe, but not required.
+// On success, callers may call `EVP_HPKE_CTX_seal` to encrypt messages for the
+// recipient. Callers must then call `EVP_HPKE_CTX_cleanup` when done. On
+// failure, calling `EVP_HPKE_CTX_cleanup` is safe, but not required.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender(
     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
     const EVP_HPKE_KEM *kem, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
@@ -233,8 +249,8 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender(
     const uint8_t *info, size_t info_len);
 
 // EVP_HPKE_CTX_setup_sender_with_seed_for_testing behaves like
-// |EVP_HPKE_CTX_setup_sender|, but takes a seed to behave deterministically.
-// The seed's format depends on |kem|. For X25519, it is the sender's
+// `EVP_HPKE_CTX_setup_sender`, but takes a seed to behave deterministically.
+// The seed's format depends on `kem`. For X25519, it is the sender's
 // ephemeral private key. For P256, it's an HKDF input.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender_with_seed_for_testing(
     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
@@ -243,21 +259,21 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender_with_seed_for_testing(
     const uint8_t *info, size_t info_len, const uint8_t *seed, size_t seed_len);
 
 // EVP_HPKE_CTX_setup_recipient implements the SetupBaseR HPKE operation. It
-// decapsulates the shared secret in |enc| with |key| and sets up |ctx| as a
+// decapsulates the shared secret in `enc` with `key` and sets up `ctx` as a
 // recipient context. It returns one on success and zero on failure. Note that
-// |enc| may be invalid, in which case this function will return an error.
+// `enc` may be invalid, in which case this function will return an error.
 //
-// On success, callers may call |EVP_HPKE_CTX_open| to decrypt messages from the
-// sender. Callers must then call |EVP_HPKE_CTX_cleanup| when done. On failure,
-// calling |EVP_HPKE_CTX_cleanup| is safe, but not required.
+// On success, callers may call `EVP_HPKE_CTX_open` to decrypt messages from the
+// sender. Callers must then call `EVP_HPKE_CTX_cleanup` when done. On failure,
+// calling `EVP_HPKE_CTX_cleanup` is safe, but not required.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_recipient(
     EVP_HPKE_CTX *ctx, const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf,
     const EVP_HPKE_AEAD *aead, const uint8_t *enc, size_t enc_len,
     const uint8_t *info, size_t info_len);
 
 // EVP_HPKE_CTX_setup_auth_sender implements the SetupAuthS HPKE operation. It
-// behaves like |EVP_HPKE_CTX_setup_sender| but authenticates the resulting
-// context with |key|.
+// behaves like `EVP_HPKE_CTX_setup_sender` but authenticates the resulting
+// context with `key`.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender(
     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
     const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
@@ -265,8 +281,8 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender(
     const uint8_t *info, size_t info_len);
 
 // EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing behaves like
-// |EVP_HPKE_CTX_setup_auth_sender|, but takes a seed to behave
-// deterministically. The seed's format depends on |kem|. For X25519, it is the
+// `EVP_HPKE_CTX_setup_auth_sender`, but takes a seed to behave
+// deterministically. The seed's format depends on `kem`. For X25519, it is the
 // sender's ephemeral private key. For P256, it's an HKDF input.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing(
     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
@@ -275,8 +291,8 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing(
     const uint8_t *info, size_t info_len, const uint8_t *seed, size_t seed_len);
 
 // EVP_HPKE_CTX_setup_auth_recipient implements the SetupAuthR HPKE operation.
-// It behaves like |EVP_HPKE_CTX_setup_recipient| but checks the resulting
-// context was authenticated with |peer_public_key|.
+// It behaves like `EVP_HPKE_CTX_setup_recipient` but checks the resulting
+// context was authenticated with `peer_public_key`.
 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_recipient(
     EVP_HPKE_CTX *ctx, const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf,
     const EVP_HPKE_AEAD *aead, const uint8_t *enc, size_t enc_len,
@@ -286,50 +302,50 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_recipient(
 
 // Using an HPKE context.
 //
-// Once set up, callers may encrypt or decrypt with an |EVP_HPKE_CTX| using the
+// Once set up, callers may encrypt or decrypt with an `EVP_HPKE_CTX` using the
 // following functions.
 
-// EVP_HPKE_CTX_open uses the HPKE context |ctx| to authenticate |in_len| bytes
-// from |in| and |ad_len| bytes from |ad| and to decrypt at most |in_len| bytes
-// into |out|. It returns one on success, and zero otherwise.
+// EVP_HPKE_CTX_open uses the HPKE context `ctx` to authenticate `in_len` bytes
+// from `in` and `ad_len` bytes from `ad` and to decrypt at most `in_len` bytes
+// into `out`. It returns one on success, and zero otherwise.
 //
-// This operation will fail if the |ctx| context is not set up as a receiver.
+// This operation will fail if the `ctx` context is not set up as a receiver.
 //
 // Note that HPKE encryption is stateful and ordered. The sender's first call to
-// |EVP_HPKE_CTX_seal| must correspond to the recipient's first call to
-// |EVP_HPKE_CTX_open|, etc.
+// `EVP_HPKE_CTX_seal` must correspond to the recipient's first call to
+// `EVP_HPKE_CTX_open`, etc.
 //
-// At most |in_len| bytes are written to |out|. In order to ensure success,
-// |max_out_len| should be at least |in_len|. On successful return, |*out_len|
+// At most `in_len` bytes are written to `out`. In order to ensure success,
+// `max_out_len` should be at least `in_len`. On successful return, `*out_len`
 // is set to the actual number of bytes written.
 OPENSSL_EXPORT int EVP_HPKE_CTX_open(EVP_HPKE_CTX *ctx, uint8_t *out,
                                      size_t *out_len, size_t max_out_len,
                                      const uint8_t *in, size_t in_len,
                                      const uint8_t *ad, size_t ad_len);
 
-// EVP_HPKE_CTX_seal uses the HPKE context |ctx| to encrypt and authenticate
-// |in_len| bytes of ciphertext |in| and authenticate |ad_len| bytes from |ad|,
-// writing the result to |out|. It returns one on success and zero otherwise.
+// EVP_HPKE_CTX_seal uses the HPKE context `ctx` to encrypt and authenticate
+// `in_len` bytes of ciphertext `in` and authenticate `ad_len` bytes from `ad`,
+// writing the result to `out`. It returns one on success and zero otherwise.
 //
-// This operation will fail if the |ctx| context is not set up as a sender.
+// This operation will fail if the `ctx` context is not set up as a sender.
 //
 // Note that HPKE encryption is stateful and ordered. The sender's first call to
-// |EVP_HPKE_CTX_seal| must correspond to the recipient's first call to
-// |EVP_HPKE_CTX_open|, etc.
+// `EVP_HPKE_CTX_seal` must correspond to the recipient's first call to
+// `EVP_HPKE_CTX_open`, etc.
 //
-// At most, |max_out_len| encrypted bytes are written to |out|. On successful
-// return, |*out_len| is set to the actual number of bytes written.
+// At most, `max_out_len` encrypted bytes are written to `out`. On successful
+// return, `*out_len` is set to the actual number of bytes written.
 //
-// To ensure success, |max_out_len| should be |in_len| plus the result of
-// |EVP_HPKE_CTX_max_overhead| or |EVP_HPKE_MAX_OVERHEAD|.
+// To ensure success, `max_out_len` should be `in_len` plus the result of
+// `EVP_HPKE_CTX_max_overhead` or `EVP_HPKE_MAX_OVERHEAD`.
 OPENSSL_EXPORT int EVP_HPKE_CTX_seal(EVP_HPKE_CTX *ctx, uint8_t *out,
                                      size_t *out_len, size_t max_out_len,
                                      const uint8_t *in, size_t in_len,
                                      const uint8_t *ad, size_t ad_len);
 
-// EVP_HPKE_CTX_export uses the HPKE context |ctx| to export a secret of
-// |secret_len| bytes into |out|. This function uses |context_len| bytes from
-// |context| as a context string for the secret. This is necessary to separate
+// EVP_HPKE_CTX_export uses the HPKE context `ctx` to export a secret of
+// `secret_len` bytes into `out`. This function uses `context_len` bytes from
+// `context` as a context string for the secret. This is necessary to separate
 // different uses of exported secrets and bind relevant caller-specific context
 // into the output. It returns one on success and zero otherwise.
 OPENSSL_EXPORT int EVP_HPKE_CTX_export(const EVP_HPKE_CTX *ctx, uint8_t *out,
@@ -338,23 +354,23 @@ OPENSSL_EXPORT int EVP_HPKE_CTX_export(const EVP_HPKE_CTX *ctx, uint8_t *out,
                                        size_t context_len);
 
 // EVP_HPKE_MAX_OVERHEAD contains the largest value that
-// |EVP_HPKE_CTX_max_overhead| would ever return for any context.
+// `EVP_HPKE_CTX_max_overhead` would ever return for any context.
 #define EVP_HPKE_MAX_OVERHEAD EVP_AEAD_MAX_OVERHEAD
 
 // EVP_HPKE_CTX_max_overhead returns the maximum number of additional bytes
-// added by sealing data with |EVP_HPKE_CTX_seal|. The |ctx| context must be set
+// added by sealing data with `EVP_HPKE_CTX_seal`. The `ctx` context must be set
 // up as a sender.
 OPENSSL_EXPORT size_t EVP_HPKE_CTX_max_overhead(const EVP_HPKE_CTX *ctx);
 
-// EVP_HPKE_CTX_kem returns |ctx|'s configured KEM, or NULL if the context has
+// EVP_HPKE_CTX_kem returns `ctx`'s configured KEM, or NULL if the context has
 // not been set up.
 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_HPKE_CTX_kem(const EVP_HPKE_CTX *ctx);
 
-// EVP_HPKE_CTX_aead returns |ctx|'s configured AEAD, or NULL if the context has
+// EVP_HPKE_CTX_aead returns `ctx`'s configured AEAD, or NULL if the context has
 // not been set up.
 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_HPKE_CTX_aead(const EVP_HPKE_CTX *ctx);
 
-// EVP_HPKE_CTX_kdf returns |ctx|'s configured KDF, or NULL if the context has
+// EVP_HPKE_CTX_kdf returns `ctx`'s configured KDF, or NULL if the context has
 // not been set up.
 OPENSSL_EXPORT const EVP_HPKE_KDF *EVP_HPKE_CTX_kdf(const EVP_HPKE_CTX *ctx);
 

data/third_party/boringssl-with-bazel/include/openssl/hrss.h

@@ -27,6 +27,12 @@ extern "C" {
 // The best exposition is https://eprint.iacr.org/2017/667.pdf although this
 // implementation uses a different KEM construction based on
 // https://eprint.iacr.org/2017/1005.pdf.
+//
+// This module is a remnant of early post-quantum KEM deployments. It should not
+// be used in any new applications. Use ML-KEM instead.
+//
+// TODO(crbug.com/503068543): Remove this.
+
 
 struct HRSS_private_key {
   uint8_t opaque[1808];
@@ -66,18 +72,18 @@ OPENSSL_EXPORT int HRSS_generate_key(
     const uint8_t input[HRSS_GENERATE_KEY_BYTES]);
 
 // HRSS_encap is a deterministic function the generates and encrypts a random
-// session key from the given entropy, writing those values to |out_shared_key|
-// and |out_ciphertext|, respectively. It returns one on success or zero on
+// session key from the given entropy, writing those values to `out_shared_key`
+// and `out_ciphertext`, respectively. It returns one on success or zero on
 // malloc failure.
 OPENSSL_EXPORT int HRSS_encap(uint8_t out_ciphertext[HRSS_CIPHERTEXT_BYTES],
                               uint8_t out_shared_key[HRSS_KEY_BYTES],
                               const struct HRSS_public_key *in_pub,
                               const uint8_t in[HRSS_ENCAP_BYTES]);
 
-// HRSS_decap decrypts a session key from |ciphertext_len| bytes of
-// |ciphertext|. If the ciphertext is valid, the decrypted key is written to
-// |out_shared_key|. Otherwise the HMAC of |ciphertext| under a secret key (kept
-// in |in_priv|) is written. If the ciphertext is the wrong length then it will
+// HRSS_decap decrypts a session key from `ciphertext_len` bytes of
+// `ciphertext`. If the ciphertext is valid, the decrypted key is written to
+// `out_shared_key`. Otherwise the HMAC of `ciphertext` under a secret key (kept
+// in `in_priv`) is written. If the ciphertext is the wrong length then it will
 // leak which was done via side-channels. Otherwise it should perform either
 // action in constant-time. It returns one on success (whether the ciphertext
 // was valid or not) and zero on malloc failure.
@@ -85,11 +91,11 @@ OPENSSL_EXPORT int HRSS_decap(uint8_t out_shared_key[HRSS_KEY_BYTES],
                               const struct HRSS_private_key *in_priv,
                               const uint8_t *ciphertext, size_t ciphertext_len);
 
-// HRSS_marshal_public_key serialises |in_pub| to |out|.
+// HRSS_marshal_public_key serialises `in_pub` to `out`.
 OPENSSL_EXPORT void HRSS_marshal_public_key(
     uint8_t out[HRSS_PUBLIC_KEY_BYTES], const struct HRSS_public_key *in_pub);
 
-// HRSS_parse_public_key sets |*out| to the public-key encoded in |in|. It
+// HRSS_parse_public_key sets `*out` to the public-key encoded in `in`. It
 // returns true on success and zero on error.
 OPENSSL_EXPORT int HRSS_parse_public_key(
     struct HRSS_public_key *out, const uint8_t in[HRSS_PUBLIC_KEY_BYTES]);

data/third_party/boringssl-with-bazel/include/openssl/kdf.h

@@ -28,23 +28,24 @@ extern "C" {
 // HKDF-specific functions.
 //
 // The following functions are provided for OpenSSL compatibility. Prefer the
-// HKDF functions in <openssl/hkdf.h>. In each, |ctx| must be created with
-// |EVP_PKEY_CTX_new_id| with |EVP_PKEY_HKDF| and then initialized with
-// |EVP_PKEY_derive_init|.
+// HKDF functions in <openssl/hkdf.h>. In each, `ctx` must be created with
+// `EVP_PKEY_CTX_new_id` with `EVP_PKEY_HKDF` and then initialized with
+// `EVP_PKEY_derive_init`.
 
-// EVP_PKEY_HKDEF_MODE_* define "modes" for use with |EVP_PKEY_CTX_hkdf_mode|.
-// The mispelling of "HKDF" as "HKDEF" is intentional for OpenSSL compatibility.
+// EVP_PKEY_HKDEF_MODE_* define "modes" for use with `EVP_PKEY_CTX_hkdf_mode`.
+// The misspelling of "HKDF" as "HKDEF" is intentional for OpenSSL
+// compatibility.
 #define EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND 0
 #define EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY 1
 #define EVP_PKEY_HKDEF_MODE_EXPAND_ONLY 2
 
 // EVP_PKEY_CTX_hkdf_mode configures which HKDF operation to run. It returns one
-// on success and zero on error. |mode| must be one of |EVP_PKEY_HKDEF_MODE_*|.
-// By default, the mode is |EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND|.
+// on success and zero on error. `mode` must be one of `EVP_PKEY_HKDEF_MODE_*`.
+// By default, the mode is `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND`.
 //
-// If |mode| is |EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND| or
-// |EVP_PKEY_HKDEF_MODE_EXPAND_ONLY|, the output is variable-length.
-// |EVP_PKEY_derive| uses the size of the output buffer as the output length for
+// If `mode` is `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND` or
+// `EVP_PKEY_HKDEF_MODE_EXPAND_ONLY`, the output is variable-length.
+// `EVP_PKEY_derive` uses the size of the output buffer as the output length for
 // HKDF-Expand.
 //
 // WARNING: Although this API calls it a "mode", HKDF-Extract and HKDF-Expand
@@ -52,31 +53,31 @@ extern "C" {
 // Callers should not pass input secrets for one operation into the other.
 OPENSSL_EXPORT int EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX *ctx, int mode);
 
-// EVP_PKEY_CTX_set_hkdf_md sets |md| as the digest to use with HKDF. It returns
+// EVP_PKEY_CTX_set_hkdf_md sets `md` as the digest to use with HKDF. It returns
 // one on success and zero on error.
 OPENSSL_EXPORT int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx,
                                             const EVP_MD *md);
 
-// EVP_PKEY_CTX_set1_hkdf_key configures HKDF to use |key_len| bytes from |key|
+// EVP_PKEY_CTX_set1_hkdf_key configures HKDF to use `key_len` bytes from `key`
 // as the "key", described below. It returns one on success and zero on error.
 //
-// Which input is the key depends on the "mode" (see |EVP_PKEY_CTX_hkdf_mode|).
-// If |EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND| or
-// |EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY|, this function specifies the input keying
-// material (IKM) for HKDF-Extract. If |EVP_PKEY_HKDEF_MODE_EXPAND_ONLY|, it
+// Which input is the key depends on the "mode" (see `EVP_PKEY_CTX_hkdf_mode`).
+// If `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND` or
+// `EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY`, this function specifies the input keying
+// material (IKM) for HKDF-Extract. If `EVP_PKEY_HKDEF_MODE_EXPAND_ONLY`, it
 // instead specifies the pseudorandom key (PRK) for HKDF-Expand.
 OPENSSL_EXPORT int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx,
                                               const uint8_t *key,
                                               size_t key_len);
 
-// EVP_PKEY_CTX_set1_hkdf_salt configures HKDF to use |salt_len| bytes from
-// |salt| as the salt parameter to HKDF-Extract. It returns one on success and
+// EVP_PKEY_CTX_set1_hkdf_salt configures HKDF to use `salt_len` bytes from
+// `salt` as the salt parameter to HKDF-Extract. It returns one on success and
 // zero on error. If performing HKDF-Expand only, this parameter is ignored.
 OPENSSL_EXPORT int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx,
                                                const uint8_t *salt,
                                                size_t salt_len);
 
-// EVP_PKEY_CTX_add1_hkdf_info appends |info_len| bytes from |info| to the info
+// EVP_PKEY_CTX_add1_hkdf_info appends `info_len` bytes from `info` to the info
 // parameter used with HKDF-Expand. It returns one on success and zero on error.
 // If performing HKDF-Extract only, this parameter is ignored.
 OPENSSL_EXPORT int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx,

data/third_party/boringssl-with-bazel/include/openssl/lhash.h

@@ -1,4 +1,4 @@
-// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright 2025 The BoringSSL Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,28 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_LHASH_H
-#define OPENSSL_HEADER_LHASH_H
+// This header is provided in order to make compiling against code that expects
+// OpenSSL easier.
 
-#include <openssl/base.h>   // IWYU pragma: export
-
-#if defined(__cplusplus)
-extern "C" {
-#endif
-
-
-// lhash is an internal library and not exported for use outside BoringSSL. This
-// header is provided for compatibility with code that expects OpenSSL.
-
-
-// These two macros are exported for compatibility with existing callers of
-// |X509V3_EXT_conf_nid|. Do not use these symbols outside BoringSSL.
-#define LHASH_OF(type) struct lhash_st_##type
-#define DECLARE_LHASH_OF(type) LHASH_OF(type);
-
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
-
-#endif  // OPENSSL_HEADER_LHASH_H
+#include "base.h"