grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/include/openssl/slhdsa.h

@@ -22,6 +22,9 @@ extern "C" {
 #endif
 
 
+// SLH-DSA.
+
+
 // SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES is the number of bytes in an
 // SLH-DSA-SHA2-128s public key.
 #define SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES 32
@@ -34,35 +37,73 @@ extern "C" {
 // SLH-DSA-SHA2-128s signature.
 #define SLHDSA_SHA2_128S_SIGNATURE_BYTES 7856
 
+// SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES is the number of bytes in an
+// SLH-DSA-SHAKE-256f public key.
+#define SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES 64
+
+// SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES is the number of bytes in an
+// SLH-DSA-SHAKE-256f private key.
+#define SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES 128
+
+// SLHDSA_SHAKE_256F_SIGNATURE_BYTES is the number of bytes in an
+// SLH-DSA-SHAKE-256f signature.
+#define SLHDSA_SHAKE_256F_SIGNATURE_BYTES 49856
+
 // SLHDSA_SHA2_128S_generate_key generates a SLH-DSA-SHA2-128s key pair and
-// writes the result to |out_public_key| and |out_private_key|.
+// writes the result to `out_public_key` and `out_private_key`.
 OPENSSL_EXPORT void SLHDSA_SHA2_128S_generate_key(
     uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
 
+// SLHDSA_SHAKE_256F_generate_key generates a SLH-DSA-SHAKE-256f key pair and
+// writes the result to `out_public_key` and `out_private_key`.
+OPENSSL_EXPORT void SLHDSA_SHAKE_256F_generate_key(
+    uint8_t out_public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]);
+
 // SLHDSA_SHA2_128S_public_from_private writes the public key corresponding to
-// |private_key| to |out_public_key|.
+// `private_key` to `out_public_key`.
 OPENSSL_EXPORT void SLHDSA_SHA2_128S_public_from_private(
     uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
 
-// SLHDSA_SHA2_128S_sign slowly generates a SLH-DSA-SHA2-128s signature of |msg|
-// using |private_key| and writes it to |out_signature|. The |context| argument
+// SLHDSA_SHAKE_256F_public_from_private writes the public key corresponding to
+// `private_key` to `out_public_key`.
+OPENSSL_EXPORT void SLHDSA_SHAKE_256F_public_from_private(
+    uint8_t out_public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]);
+
+// SLHDSA_SHA2_128S_sign slowly generates a SLH-DSA-SHA2-128s signature of `msg`
+// using `private_key` and writes it to `out_signature`. The `context` argument
 // is also signed over and can be used to include implicit contextual
-// information that isn't included in |msg|. The same value of |context| must be
-// presented to |SLHDSA_SHA2_128S_verify| in order for the generated signature
-// to be considered valid. |context| and |context_len| may be |NULL| and 0 to
+// information that isn't included in `msg`. The same value of `context` must be
+// presented to `SLHDSA_SHA2_128S_verify` in order for the generated signature
+// to be considered valid. `context` and `context_len` may be `NULL` and 0 to
 // use an empty context (this is common). It returns 1 on success and 0 if
-// |context_len| is larger than 255.
+// `context_len` is larger than 255.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_sign(
     uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len);
 
-// SLHDSA_SHA2_128S_verify verifies that |signature| is a valid
-// SLH-DSA-SHA2-128s signature of |msg| by |public_key|. The value of |context|
-// must equal the value that was passed to |SLHDSA_SHA2_128S_sign| when the
+// SLHDSA_SHAKE_256F_sign slowly generates a SLH-DSA-SHAKE-256f signature of
+// `msg` using `private_key` and writes it to `out_signature`. The `context`
+// argument is also signed over and can be used to include implicit contextual
+// information that isn't included in `msg`. The same value of `context` must be
+// presented to `SLHDSA_SHAKE_256F_verify` in order for the generated signature
+// to be considered valid. `context` and `context_len` may be `NULL` and 0 to
+// use an empty context (this is common). It returns 1 on success and 0 if
+// `context_len` is larger than 255.
+OPENSSL_EXPORT int SLHDSA_SHAKE_256F_sign(
+    uint8_t out_signature[SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
+// SLHDSA_SHA2_128S_verify verifies that `signature` is a valid
+// SLH-DSA-SHA2-128s signature of `msg` by `public_key`. The value of `context`
+// must equal the value that was passed to `SLHDSA_SHA2_128S_sign` when the
 // signature was generated. It returns 1 if the signature is valid and 0
 // otherwise.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_verify(
@@ -71,6 +112,17 @@ OPENSSL_EXPORT int SLHDSA_SHA2_128S_verify(
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len);
 
+// SLHDSA_SHAKE_256F_verify verifies that `signature` is a valid
+// SLH-DSA-SHAKE-256f signature of `msg` by `public_key`. The value of `context`
+// must equal the value that was passed to `SLHDSA_SHAKE_256F_sign` when the
+// signature was generated. It returns 1 if the signature is valid and 0
+// otherwise.
+OPENSSL_EXPORT int SLHDSA_SHAKE_256F_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
 
 // Prehashed SLH-DSA-SHA2-128s.
 //
@@ -79,26 +131,26 @@ OPENSSL_EXPORT int SLHDSA_SHA2_128S_verify(
 // wish. These functions should only be used when:
 //
 //   a) Compatibility with an external system that uses prehashed messages is
-//   required. (The general signature of a hash is not compatible with a
-//   "prehash" signature of the same hash.)
+//      required. (The general signature of a hash is not compatible with a
+//      "prehash" signature of the same hash.)
 //   b) A single private key is used to sign both prehashed and raw messages,
-//   and there's no other way to prevent ambiguity.
+//      and there's no other way to prevent ambiguity.
 
 // SLHDSA_SHA2_128S_prehash_sign slowly generates a SLH-DSA-SHA2-128s signature
-// of the prehashed |hashed_msg| using |private_key| and writes it to
-// |out_signature|. The |context| argument is also signed over and can be used
+// of the prehashed `hashed_msg` using `private_key` and writes it to
+// `out_signature`. The `context` argument is also signed over and can be used
 // to include implicit contextual information that isn't included in
-// |hashed_msg|. The same value of |context| must be presented to
-// |SLHDSA_SHA2_128S_prehash_verify| in order for the generated signature to be
-// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
+// `hashed_msg`. The same value of `context` must be presented to
+// `SLHDSA_SHA2_128S_prehash_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
 // empty context (this is common).
 //
-// The |hash_nid| argument must specify the hash function that was used to
-// generate |hashed_msg|. This function only accepts hash functions listed in
+// The `hash_nid` argument must specify the hash function that was used to
+// generate `hashed_msg`. This function only accepts hash functions listed in
 // FIPS 205.
 //
-// This function returns 1 on success and 0 if |context_len| is larger than 255,
-// if the hash function is not supported, or if |hashed_msg| is the wrong
+// This function returns 1 on success and 0 if `context_len` is larger than 255,
+// if the hash function is not supported, or if `hashed_msg` is the wrong
 // length.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_sign(
     uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
@@ -106,18 +158,18 @@ OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_sign(
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
     const uint8_t *context, size_t context_len);
 
-// SLHDSA_SHA2_128S_prehash_verify verifies that |signature| is a valid
-// SLH-DSA-SHA2-128s signature of the prehashed |hashed_msg| by |public_key|,
-// using the hash algorithm identified by |hash_nid|. The value of |context|
-// must equal the value that was passed to |SLHDSA_SHA2_128S_prehash_sign| when
+// SLHDSA_SHA2_128S_prehash_verify verifies that `signature` is a valid
+// SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` by `public_key`,
+// using the hash algorithm identified by `hash_nid`. The value of `context`
+// must equal the value that was passed to `SLHDSA_SHA2_128S_prehash_sign` when
 // the signature was generated.
 //
-// The |hash_nid| argument must specify the hash function that was used to
-// generate |hashed_msg|. This function only accepts hash functions that are
+// The `hash_nid` argument must specify the hash function that was used to
+// generate `hashed_msg`. This function only accepts hash functions that are
 // listed in FIPS 205.
 //
 // This function returns 1 if the signature is valid and 0 if the signature is
-// invalid, the hash function is not supported, or if |hashed_msg| is the wrong
+// invalid, the hash function is not supported, or if `hashed_msg` is the wrong
 // length.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_verify(
     const uint8_t *signature, size_t signature_len,
@@ -126,20 +178,20 @@ OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_verify(
     const uint8_t *context, size_t context_len);
 
 // SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign slowly generates a
-// SLH-DSA-SHA2-128s signature of the prehashed |hashed_msg| using |private_key|
-// and writes it to |out_signature|. The |context| argument is also signed over
+// SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` using `private_key`
+// and writes it to `out_signature`. The `context` argument is also signed over
 // and can be used to include implicit contextual information that isn't
-// included in |hashed_msg|. The same value of |context| must be presented to
-// |SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify| in order for the
-// generated signature to be considered valid. |context| and |context_len| may
-// be |NULL| and 0 to use an empty context (this is common).
+// included in `hashed_msg`. The same value of `context` must be presented to
+// `SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify` in order for the
+// generated signature to be considered valid. `context` and `context_len` may
+// be `NULL` and 0 to use an empty context (this is common).
 //
-// The |hash_nid| argument must specify the hash function that was used to
-// generate |hashed_msg|. This function only accepts non-standard hash functions
+// The `hash_nid` argument must specify the hash function that was used to
+// generate `hashed_msg`. This function only accepts non-standard hash functions
 // that are not compliant with FIPS 205.
 //
-// This function returns 1 on success and 0 if |context_len| is larger than 255,
-// if the hash function is not supported, or if |hashed_msg| is the wrong
+// This function returns 1 on success and 0 if `context_len` is larger than 255,
+// if the hash function is not supported, or if `hashed_msg` is the wrong
 // length.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign(
     uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
@@ -147,18 +199,18 @@ OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign(
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
     const uint8_t *context, size_t context_len);
 
-// SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify verifies that |signature|
-// is a valid SLH-DSA-SHA2-128s signature of the prehashed |hashed_msg| by
-// |public_key|, using the hash algorithm identified by |hash_nid|. The value of
-// |context| must equal the value that was passed to
-// |SLHDSA_SHA2_128S_prehash_sign| when the signature was generated.
+// SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify verifies that `signature`
+// is a valid SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` by
+// `public_key`, using the hash algorithm identified by `hash_nid`. The value of
+// `context` must equal the value that was passed to
+// `SLHDSA_SHA2_128S_prehash_sign` when the signature was generated.
 //
-// The |hash_nid| argument must specify the hash function that was used to
-// generate |hashed_msg|. This function only accepts non-standard hash functions
+// The `hash_nid` argument must specify the hash function that was used to
+// generate `hashed_msg`. This function only accepts non-standard hash functions
 // that are not compliant with FIPS 205.
 //
 // This function returns 1 if the signature is valid and 0 if the signature is
-// invalid, the hash function is not supported, or if |hashed_msg| is the wrong
+// invalid, the hash function is not supported, or if `hashed_msg` is the wrong
 // length.
 OPENSSL_EXPORT int SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify(
     const uint8_t *signature, size_t signature_len,

data/third_party/boringssl-with-bazel/include/openssl/span.h

@@ -19,11 +19,14 @@
 
 #if !defined(BORINGSSL_NO_CXX)
 
+// Work around consumers including our headers under extern "C".
 extern "C++" {
 
 #include <stdlib.h>
 
 #include <algorithm>
+#include <array>
+#include <limits>
 #include <string_view>
 #include <type_traits>
 
@@ -33,31 +36,34 @@ extern "C++" {
 
 #if defined(__cpp_lib_ranges) && __cpp_lib_ranges >= 201911L
 #include <ranges>
+#endif
+
 BSSL_NAMESPACE_BEGIN
-template <typename T>
+inline constexpr size_t dynamic_extent = std::numeric_limits<size_t>::max();
+
+template <typename T, size_t N = dynamic_extent>
 class Span;
 BSSL_NAMESPACE_END
 
+#if defined(__cpp_lib_ranges) && __cpp_lib_ranges >= 201911L
 // Mark `Span` as satisfying the `view` and `borrowed_range` concepts. This
 // should be done before the definition of `Span`, so that any inlined calls to
 // range functionality use the correct specializations.
-template <typename T>
-inline constexpr bool std::ranges::enable_view<bssl::Span<T>> = true;
-template <typename T>
-inline constexpr bool std::ranges::enable_borrowed_range<bssl::Span<T>> = true;
+template <typename T, size_t N>
+inline constexpr bool std::ranges::enable_view<bssl::Span<T, N>> = true;
+template <typename T, size_t N>
+inline constexpr bool std::ranges::enable_borrowed_range<bssl::Span<T, N>> =
+    true;
 #endif
 
 BSSL_NAMESPACE_BEGIN
 
-template <typename T>
-class Span;
-
 namespace internal {
 template <typename T>
 class SpanBase {
   // Put comparison operator implementations into a base class with const T, so
   // they can be used with any type that implicitly converts into a Span.
-  static_assert(std::is_const<T>::value,
+  static_assert(std::is_const_v<T>,
                 "Span<T> must be derived from SpanBase<const T>");
 
   friend bool operator==(Span<T> lhs, Span<T> rhs) {
@@ -67,6 +73,32 @@ class SpanBase {
   friend bool operator!=(Span<T> lhs, Span<T> rhs) { return !(lhs == rhs); }
 };
 
+// Container class to store the size of a span at runtime or compile time.
+template <typename T, size_t N>
+class SpanStorage : private SpanBase<const T> {
+ public:
+  constexpr SpanStorage(T *data, size_t size) : data_(data) {
+    BSSL_CHECK(size == N);
+  }
+  constexpr T *data() const { return data_; }
+  constexpr size_t size() const { return N; }
+
+ private:
+  T *data_;
+};
+
+template <typename T>
+class SpanStorage<T, dynamic_extent> : private SpanBase<const T> {
+ public:
+  constexpr SpanStorage(T *data, size_t size) : data_(data), size_(size) {}
+  constexpr T *data() const { return data_; }
+  constexpr size_t size() const { return size_; }
+
+ private:
+  T *data_;
+  size_t size_;
+};
+
 // Heuristically test whether C is a container type that can be converted into
 // a Span<T> by checking for data() and size() member functions.
 template <typename C, typename T>
@@ -74,15 +106,19 @@ using EnableIfContainer = std::enable_if_t<
     std::is_convertible_v<decltype(std::declval<C>().data()), T *> &&
     std::is_integral_v<decltype(std::declval<C>().size())>>;
 
+// A fake type used to be able to SFINAE between two different container
+// constructors - by giving one this as a second default argument, and one not.
+struct AllowRedeclaringConstructor {};
+
 }  // namespace internal
 
 // A Span<T> is a non-owning reference to a contiguous array of objects of type
-// |T|. Conceptually, a Span is a simple a pointer to |T| and a count of
+// `T`. Conceptually, a Span is a simple a pointer to `T` and a count of
 // elements accessible via that pointer. The elements referenced by the Span can
-// be mutated if |T| is mutable.
+// be mutated if `T` is mutable.
 //
-// A Span can be constructed from container types implementing |data()| and
-// |size()| methods. If |T| is constant, construction from a container type is
+// A Span can be constructed from container types implementing `data()` and
+// `size()` methods. If `T` is constant, construction from a container type is
 // implicit. This allows writing methods that accept data from some unspecified
 // container type:
 //
@@ -104,14 +140,12 @@ using EnableIfContainer = std::enable_if_t<
 //
 // FooMutate(bssl::Span(vec));
 //
-// Note that Spans have value type sematics. They are cheap to construct and
+// Note that Spans have value type semantics. They are cheap to construct and
 // copy, and should be passed by value whenever a method would otherwise accept
 // a reference or pointer to a container or array.
-template <typename T>
-class Span : private internal::SpanBase<const T> {
+template <typename T, size_t N>
+class Span : public internal::SpanStorage<T, N> {
  public:
-  static const size_t npos = static_cast<size_t>(-1);
-
   using element_type = T;
   using value_type = std::remove_cv_t<T>;
   using size_type = size_t;
@@ -123,90 +157,171 @@ class Span : private internal::SpanBase<const T> {
   using iterator = T *;
   using const_iterator = const T *;
 
-  constexpr Span() : Span(nullptr, 0) {}
-  constexpr Span(T *ptr, size_t len) : data_(ptr), size_(len) {}
-
-  template <size_t N>
-  constexpr Span(T (&array)[N]) : Span(array, N) {}
+  template <typename U = T,
+            typename = std::enable_if_t<N == 0 || N == dynamic_extent, U>>
+  constexpr Span() : internal::SpanStorage<T, N>(nullptr, 0) {}
+
+  // NOTE: This constructor may abort() at runtime if len differs from the
+  // compile-time size, if any.
+  constexpr Span(T *ptr, size_t len) : internal::SpanStorage<T, N>(ptr, len) {}
+
+  template <size_t NA,
+            typename = std::enable_if_t<N == NA || N == dynamic_extent>>
+  // NOLINTNEXTLINE(google-explicit-constructor): same as std::span.
+  constexpr Span(T (&array)[NA]) : internal::SpanStorage<T, N>(array, NA) {}
+
+  // TODO(crbug.com/457351017): Add tests for these c'tors.
+  template <size_t NA, typename U,
+            typename = internal::EnableIfContainer<std::array<U, NA>, T>,
+            typename = std::enable_if_t<N == NA || N == dynamic_extent>>
+  // NOLINTNEXTLINE(google-explicit-constructor): same as std::span.
+  constexpr Span(std::array<U, NA> &array)
+      : internal::SpanStorage<T, N>(array.data(), NA) {}
+
+  template <size_t NA, typename U,
+            typename = internal::EnableIfContainer<const std::array<U, NA>, T>,
+            typename = std::enable_if_t<N == NA || N == dynamic_extent>>
+  // NOLINTNEXTLINE(google-explicit-constructor): same as std::span.
+  constexpr Span(const std::array<U, NA> &array)
+      : internal::SpanStorage<T, N>(array.data(), NA) {}
+
+  template <
+      size_t NA, typename U,
+      typename = std::enable_if_t<std::is_convertible_v<U (*)[], T (*)[]>>,
+      typename = std::enable_if_t<N == dynamic_extent || N == NA>>
+  // NOLINTNEXTLINE(google-explicit-constructor): same as std::span.
+  constexpr Span(Span<U, NA> other)
+      : internal::SpanStorage<T, N>(other.data(), other.size()) {}
 
   template <typename C, typename = internal::EnableIfContainer<C, T>,
-            typename = std::enable_if_t<std::is_const<T>::value, C>>
+            typename = std::enable_if_t<std::is_const_v<T>, C>,
+            typename = std::enable_if_t<N == dynamic_extent, C>>
+  // NOLINTNEXTLINE(google-explicit-constructor): same as std::span.
   constexpr Span(const C &container)
-      : data_(container.data()), size_(container.size()) {}
+      : internal::SpanStorage<T, N>(container.data(), container.size()) {}
 
+  // NOTE: This constructor may abort() at runtime if the container's length
+  // differs from the compile-time size, if any.
   template <typename C, typename = internal::EnableIfContainer<C, T>,
-            typename = std::enable_if_t<!std::is_const<T>::value, C>>
+            typename = std::enable_if_t<std::is_const_v<T>, C>,
+            typename = std::enable_if_t<N != dynamic_extent, C>>
+  constexpr explicit Span(const C &container,
+                          internal::AllowRedeclaringConstructor = {})
+      : internal::SpanStorage<T, N>(container.data(), container.size()) {}
+
+  // NOTE: This constructor may abort() at runtime if the container's length
+  // differs from the compile-time size, if any.
+  template <typename C, typename = internal::EnableIfContainer<C, T>,
+            typename = std::enable_if_t<!std::is_const_v<T>, C>>
   constexpr explicit Span(C &container)
-      : data_(container.data()), size_(container.size()) {}
+      : internal::SpanStorage<T, N>(container.data(), container.size()) {}
 
-  constexpr T *data() const { return data_; }
-  constexpr size_t size() const { return size_; }
-  constexpr bool empty() const { return size_ == 0; }
+  using internal::SpanStorage<T, N>::data;
+  using internal::SpanStorage<T, N>::size;
+  constexpr bool empty() const { return size() == 0; }
 
-  constexpr iterator begin() const { return data_; }
-  constexpr const_iterator cbegin() const { return data_; }
-  constexpr iterator end() const { return data_ + size_; }
+  constexpr iterator begin() const { return data(); }
+  constexpr const_iterator cbegin() const { return data(); }
+  constexpr iterator end() const { return data() + size(); }
   constexpr const_iterator cend() const { return end(); }
 
   constexpr T &front() const {
-    if (size_ == 0) {
-      abort();
-    }
-    return data_[0];
+    BSSL_CHECK(size() != 0);
+    return data()[0];
   }
   constexpr T &back() const {
-    if (size_ == 0) {
-      abort();
-    }
-    return data_[size_ - 1];
+    BSSL_CHECK(size() != 0);
+    return data()[size() - 1];
   }
 
   constexpr T &operator[](size_t i) const {
-    if (i >= size_) {
-      abort();
-    }
-    return data_[i];
+    BSSL_CHECK(i < size());
+    return data()[i];
   }
   T &at(size_t i) const { return (*this)[i]; }
 
-  constexpr Span subspan(size_t pos = 0, size_t len = npos) const {
-    if (pos > size_) {
-      // absl::Span throws an exception here. Note std::span and Chromium
-      // base::span additionally forbid pos + len being out of range, with a
-      // special case at npos/dynamic_extent, while absl::Span::subspan clips
-      // the span. For now, we align with absl::Span in case we switch to it in
-      // the future.
-      abort();
-    }
-    return Span(data_ + pos, std::min(size_ - pos, len));
+ private:
+  static constexpr size_t SubspanOutLen(size_t size, size_t pos, size_t len) {
+    return len != dynamic_extent ? len : size - pos;
+  }
+  static constexpr size_t SubspanTypeOutLen(size_t size, size_t pos,
+                                            size_t len) {
+    // This differs from SubspanOutLen in that if both size and len are
+    // dynamic_extent, dynamic_extent will be returned.
+    return len != dynamic_extent
+               ? len
+               : (size != dynamic_extent ? size - pos : dynamic_extent);
   }
 
-  constexpr Span first(size_t len) const {
-    if (len > size_) {
-      abort();
-    }
-    return Span(data_, len);
+ public:
+  // NOTE: This method may abort() at runtime if pos or len are out of range.
+  // NOTE: As opposed to std::span, the `dynamic_extent` value of `len` is not
+  // magical here. This gets rid of a lot of runtime checks.
+  constexpr Span<T> subspan(size_t pos, size_t len) const {
+    // absl::Span throws an exception here. Note std::span and Chromium
+    // base::span forbid pos + len being out of range, with a special case at
+    // npos/dynamic_extent, whereas absl::Span::subspan clips the span. This
+    // implements the std::span behavior which is more strict.
+    BSSL_CHECK(pos <= size());
+    BSSL_CHECK(len <= size() - pos);
+    return Span<T>(data() + pos, len);
   }
 
-  constexpr Span last(size_t len) const {
-    if (len > size_) {
-      abort();
-    }
-    return Span(data_ + size_ - len, len);
+  // NOTE: This method may abort() at runtime if pos is out of range.
+  constexpr Span<T> subspan(size_t pos) const {
+    // absl::Span throws an exception here.
+    BSSL_CHECK(pos <= size());
+    return Span<T>(data() + pos, size() - pos);
   }
 
- private:
-  T *data_;
-  size_t size_;
-};
+  // NOTE: This method may abort() at runtime if len is out of range.
+  template <size_t pos, size_t len = dynamic_extent>
+  constexpr Span<T, SubspanTypeOutLen(N, pos, len)> subspan() const {
+    // absl::Span throws an exception here. Note std::span and Chromium
+    // base::span forbid pos + len being out of range, with a special case at
+    // npos/dynamic_extent, whereas absl::Span::subspan clips the span. This
+    // implements the std::span behavior which is more strict.
+    BSSL_CHECK(pos <= size());
+    BSSL_CHECK(len == dynamic_extent || len <= size() - pos);
+    return Span<T, SubspanTypeOutLen(N, pos, len)>(
+        data() + pos, SubspanOutLen(size(), pos, len));
+  }
 
-template <typename T>
-const size_t Span<T>::npos;
+  // NOTE: This method may abort() at runtime if len is out of range.
+  constexpr Span<T> first(size_t len) const {
+    BSSL_CHECK(len <= size());
+    return Span<T>(data(), len);
+  }
+
+  // NOTE: This method may abort() at runtime if len is out of range.
+  template <size_t len>
+  constexpr Span<T, len> first() const {
+    BSSL_CHECK(len <= size());
+    return Span<T, len>(data(), len);
+  }
+
+  // NOTE: This method may abort() at runtime if len is out of range.
+  constexpr Span<T> last(size_t len) const {
+    BSSL_CHECK(len <= size());
+    return Span<T>(data() + size() - len, len);
+  }
+
+  // NOTE: This method may abort() at runtime if len is out of range.
+  template <size_t len>
+  constexpr Span<T, len> last() const {
+    BSSL_CHECK(len <= size());
+    return Span<T, len>(data() + size() - len, len);
+  }
+};
 
 template <typename T>
 Span(T *, size_t) -> Span<T>;
 template <typename T, size_t size>
-Span(T (&array)[size]) -> Span<T>;
+Span(T (&array)[size]) -> Span<T, size>;
+template <typename T, size_t size>
+Span(std::array<T, size> &array) -> Span<T, size>;
+template <typename T, size_t size>
+Span(const std::array<T, size> &array) -> Span<const T, size>;
 template <
     typename C,
     typename T = std::remove_pointer_t<decltype(std::declval<C>().data())>,
@@ -224,8 +339,8 @@ constexpr auto MakeSpan(C &c) -> decltype(MakeSpan(c.data(), c.size())) {
 }
 
 template <typename T, size_t N>
-constexpr Span<T> MakeSpan(T (&array)[N]) {
-  return Span<T>(array, N);
+constexpr Span<T, N> MakeSpan(T (&array)[N]) {
+  return array;
 }
 
 template <typename T>
@@ -240,7 +355,7 @@ constexpr auto MakeConstSpan(const C &c)
 }
 
 template <typename T, size_t size>
-constexpr Span<const T> MakeConstSpan(T (&array)[size]) {
+constexpr Span<const T, size> MakeConstSpan(T (&array)[size]) {
   return array;
 }