grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/cipher/e_aesgcmsiv.cc

@@ -19,16 +19,23 @@
 #include <openssl/cipher.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
+#include <openssl/span.h>
 
 #include "../fipsmodule/aes/internal.h"
 #include "../fipsmodule/cipher/internal.h"
 #include "../internal.h"
 
 
+using namespace bssl;
+
 #define EVP_AEAD_AES_GCM_SIV_NONCE_LEN 12
 #define EVP_AEAD_AES_GCM_SIV_TAG_LEN 16
 
 namespace {
+void inc_counter(uint8_t tag[16], uint32_t by) {
+  CRYPTO_store_u32_le(tag, CRYPTO_load_u32_le(tag) + by);
+}
+
 // TODO(davidben): AES-GCM-SIV assembly is not correct for Windows. It must save
 // and restore xmm6 through xmm15.
 #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \
@@ -44,63 +51,63 @@ struct aead_aes_gcm_siv_asm_ctx {
 
 // The assembly code assumes 8-byte alignment of the EVP_AEAD_CTX's state, and
 // aligns to 16 bytes itself.
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) + 8 >=
-                  sizeof(struct aead_aes_gcm_siv_asm_ctx),
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
+                  sizeof(struct aead_aes_gcm_siv_asm_ctx) + 8,
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >= 8,
               "AEAD state has insufficient alignment");
 
 extern "C" {
-// aes128gcmsiv_aes_ks writes an AES-128 key schedule for |key| to
-// |out_expanded_key|.
+// aes128gcmsiv_aes_ks writes an AES-128 key schedule for `key` to
+// `out_expanded_key`.
 extern void aes128gcmsiv_aes_ks(const uint8_t key[16],
                                 uint8_t out_expanded_key[16 * 15]);
 
-// aes256gcmsiv_aes_ks writes an AES-256 key schedule for |key| to
-// |out_expanded_key|.
+// aes256gcmsiv_aes_ks writes an AES-256 key schedule for `key` to
+// `out_expanded_key`.
 extern void aes256gcmsiv_aes_ks(const uint8_t key[32],
                                 uint8_t out_expanded_key[16 * 15]);
 
-// aesgcmsiv_polyval_horner updates the POLYVAL value in |in_out_poly| to
-// include a number (|in_blocks|) of 16-byte blocks of data from |in|, given
-// the POLYVAL key in |key|.
+// aesgcmsiv_polyval_horner updates the POLYVAL value in `in_out_poly` to
+// include a number (`in_blocks`) of 16-byte blocks of data from `in`, given
+// the POLYVAL key in `key`.
 extern void aesgcmsiv_polyval_horner(const uint8_t in_out_poly[16],
                                      const uint8_t key[16], const uint8_t *in,
                                      size_t in_blocks);
 
-// aesgcmsiv_htable_init writes powers 1..8 of |auth_key| to |out_htable|.
+// aesgcmsiv_htable_init writes powers 1..8 of `auth_key` to `out_htable`.
 extern void aesgcmsiv_htable_init(uint8_t out_htable[16 * 8],
                                   const uint8_t auth_key[16]);
 
-// aesgcmsiv_htable6_init writes powers 1..6 of |auth_key| to |out_htable|.
+// aesgcmsiv_htable6_init writes powers 1..6 of `auth_key` to `out_htable`.
 extern void aesgcmsiv_htable6_init(uint8_t out_htable[16 * 6],
                                    const uint8_t auth_key[16]);
 
-// aesgcmsiv_htable_polyval updates the POLYVAL value in |in_out_poly| to
-// include |in_len| bytes of data from |in|. (Where |in_len| must be a multiple
-// of 16.) It uses the precomputed powers of the key given in |htable|.
+// aesgcmsiv_htable_polyval updates the POLYVAL value in `in_out_poly` to
+// include `in_len` bytes of data from `in`. (Where `in_len` must be a multiple
+// of 16.) It uses the precomputed powers of the key given in `htable`.
 extern void aesgcmsiv_htable_polyval(const uint8_t htable[16 * 8],
                                      const uint8_t *in, size_t in_len,
                                      uint8_t in_out_poly[16]);
 
-// aes128gcmsiv_dec decrypts |in_len| & ~15 bytes from |out| and writes them to
-// |in|. |in| and |out| may be equal, but must not otherwise alias.
+// aes128gcmsiv_dec decrypts `in_len` & ~15 bytes from `out` and writes them to
+// `in`. `in` and `out` may be equal, but must not otherwise alias.
 //
-// |in_out_calculated_tag_and_scratch|, on entry, must contain:
+// `in_out_calculated_tag_and_scratch`, on entry, must contain:
 //    1. The current value of the calculated tag, which will be updated during
 //       decryption and written back to the beginning of this buffer on exit.
 //    2. The claimed tag, which is needed to derive counter values.
 //
-// While decrypting, the whole of |in_out_calculated_tag_and_scratch| may be
+// While decrypting, the whole of `in_out_calculated_tag_and_scratch` may be
 // used for other purposes. In order to decrypt and update the POLYVAL value, it
-// uses the expanded key from |key| and the table of powers in |htable|.
+// uses the expanded key from `key` and the table of powers in `htable`.
 extern void aes128gcmsiv_dec(const uint8_t *in, uint8_t *out,
                              uint8_t in_out_calculated_tag_and_scratch[16 * 8],
                              const uint8_t htable[16 * 6],
                              const struct aead_aes_gcm_siv_asm_ctx *key,
                              size_t in_len);
 
-// aes256gcmsiv_dec acts like |aes128gcmsiv_dec|, but for AES-256.
+// aes256gcmsiv_dec acts like `aes128gcmsiv_dec`, but for AES-256.
 extern void aes256gcmsiv_dec(const uint8_t *in, uint8_t *out,
                              uint8_t in_out_calculated_tag_and_scratch[16 * 8],
                              const uint8_t htable[16 * 6],
@@ -108,68 +115,68 @@ extern void aes256gcmsiv_dec(const uint8_t *in, uint8_t *out,
                              size_t in_len);
 
 // aes128gcmsiv_kdf performs the AES-GCM-SIV KDF given the expanded key from
-// |key_schedule| and the nonce in |nonce|. Note that, while only 12 bytes of
+// `key_schedule` and the nonce in `nonce`. Note that, while only 12 bytes of
 // the nonce are used, 16 bytes are read and so the value must be
 // right-padded.
 extern void aes128gcmsiv_kdf(const uint8_t nonce[16],
                              uint64_t out_key_material[8],
                              const uint8_t *key_schedule);
 
-// aes256gcmsiv_kdf acts like |aes128gcmsiv_kdf|, but for AES-256.
+// aes256gcmsiv_kdf acts like `aes128gcmsiv_kdf`, but for AES-256.
 extern void aes256gcmsiv_kdf(const uint8_t nonce[16],
                              uint64_t out_key_material[12],
                              const uint8_t *key_schedule);
 
 // aes128gcmsiv_aes_ks_enc_x1 performs a key expansion of the AES-128 key in
-// |key|, writes the expanded key to |out_expanded_key| and encrypts a single
-// block from |in| to |out|.
+// `key`, writes the expanded key to `out_expanded_key` and encrypts a single
+// block from `in` to `out`.
 extern void aes128gcmsiv_aes_ks_enc_x1(const uint8_t in[16], uint8_t out[16],
                                        uint8_t out_expanded_key[16 * 15],
                                        const uint64_t key[2]);
 
-// aes256gcmsiv_aes_ks_enc_x1 acts like |aes128gcmsiv_aes_ks_enc_x1|, but for
+// aes256gcmsiv_aes_ks_enc_x1 acts like `aes128gcmsiv_aes_ks_enc_x1`, but for
 // AES-256.
 extern void aes256gcmsiv_aes_ks_enc_x1(const uint8_t in[16], uint8_t out[16],
                                        uint8_t out_expanded_key[16 * 15],
                                        const uint64_t key[4]);
 
-// aes128gcmsiv_ecb_enc_block encrypts a single block from |in| to |out| using
-// the expanded key in |expanded_key|.
+// aes128gcmsiv_ecb_enc_block encrypts a single block from `in` to `out` using
+// the expanded key in `expanded_key`.
 extern void aes128gcmsiv_ecb_enc_block(
     const uint8_t in[16], uint8_t out[16],
     const struct aead_aes_gcm_siv_asm_ctx *expanded_key);
 
-// aes256gcmsiv_ecb_enc_block acts like |aes128gcmsiv_ecb_enc_block|, but for
+// aes256gcmsiv_ecb_enc_block acts like `aes128gcmsiv_ecb_enc_block`, but for
 // AES-256.
 extern void aes256gcmsiv_ecb_enc_block(
     const uint8_t in[16], uint8_t out[16],
     const struct aead_aes_gcm_siv_asm_ctx *expanded_key);
 
-// aes128gcmsiv_enc_msg_x4 encrypts |in_len| bytes from |in| to |out| using the
-// expanded key from |key|. (The value of |in_len| must be a multiple of 16.)
-// The |in| and |out| buffers may be equal but must not otherwise overlap. The
-// initial counter is constructed from the given |tag| as required by
+// aes128gcmsiv_enc_msg_x4 encrypts `in_len` bytes from `in` to `out` using the
+// expanded key from `key`. (The value of `in_len` must be a multiple of 16.)
+// The `in` and `out` buffers may be equal but must not otherwise overlap. The
+// initial counter is constructed from the given `tag` as required by
 // AES-GCM-SIV.
 extern void aes128gcmsiv_enc_msg_x4(const uint8_t *in, uint8_t *out,
                                     const uint8_t *tag,
                                     const struct aead_aes_gcm_siv_asm_ctx *key,
                                     size_t in_len);
 
-// aes256gcmsiv_enc_msg_x4 acts like |aes128gcmsiv_enc_msg_x4|, but for
+// aes256gcmsiv_enc_msg_x4 acts like `aes128gcmsiv_enc_msg_x4`, but for
 // AES-256.
 extern void aes256gcmsiv_enc_msg_x4(const uint8_t *in, uint8_t *out,
                                     const uint8_t *tag,
                                     const struct aead_aes_gcm_siv_asm_ctx *key,
                                     size_t in_len);
 
-// aes128gcmsiv_enc_msg_x8 acts like |aes128gcmsiv_enc_msg_x4|, but is
+// aes128gcmsiv_enc_msg_x8 acts like `aes128gcmsiv_enc_msg_x4`, but is
 // optimised for longer messages.
 extern void aes128gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out,
                                     const uint8_t *tag,
                                     const struct aead_aes_gcm_siv_asm_ctx *key,
                                     size_t in_len);
 
-// aes256gcmsiv_enc_msg_x8 acts like |aes256gcmsiv_enc_msg_x4|, but is
+// aes256gcmsiv_enc_msg_x8 acts like `aes256gcmsiv_enc_msg_x4`, but is
 // optimised for longer messages.
 extern void aes256gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out,
                                     const uint8_t *tag,
@@ -177,7 +184,7 @@ extern void aes256gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out,
                                     size_t in_len);
 }
 
-// asm_ctx_from_ctx returns a 16-byte aligned context pointer from |ctx|.
+// asm_ctx_from_ctx returns a 16-byte aligned context pointer from `ctx`.
 struct aead_aes_gcm_siv_asm_ctx *asm_ctx_from_ctx(const EVP_AEAD_CTX *ctx) {
   // ctx->state must already be 8-byte aligned. Thus, at most, we may need to
   // add eight to align it to 16 bytes.
@@ -221,13 +228,15 @@ int aead_aes_gcm_siv_asm_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
 
 void aead_aes_gcm_siv_asm_cleanup(EVP_AEAD_CTX *ctx) {}
 
-// gcm_siv_asm_polyval evaluates POLYVAL at |auth_key| on the given plaintext
-// and AD. The result is written to |out_tag|.
-void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
-                         const uint8_t *ad, size_t ad_len,
+// gcm_siv_asm_polyval evaluates POLYVAL at `auth_key` on the given plaintext
+// and AD. The result is written to `out_tag`.
+void gcm_siv_asm_polyval(uint8_t out_tag[16], Span<const CRYPTO_IOVEC> iovecs,
+                         Span<const CRYPTO_IVEC> aadvecs,
                          const uint8_t auth_key[16], const uint8_t nonce[12]) {
   OPENSSL_memset(out_tag, 0, 16);
+  const size_t ad_len = bssl::iovec::TotalLength(aadvecs);
   const size_t ad_blocks = ad_len / 16;
+  const size_t in_len = bssl::iovec::TotalLength(iovecs);
   const size_t in_blocks = in_len / 16;
   int htable_init = 0;
   alignas(16) uint8_t htable[16 * 8];
@@ -237,30 +246,36 @@ void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
     aesgcmsiv_htable_init(htable, auth_key);
   }
 
-  if (htable_init) {
-    aesgcmsiv_htable_polyval(htable, ad, ad_len & ~15, out_tag);
-  } else {
-    aesgcmsiv_polyval_horner(out_tag, auth_key, ad, ad_blocks);
-  }
-
-  uint8_t scratch[16];
-  if (ad_len & 15) {
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, &ad[ad_len & ~15], ad_len & 15);
-    aesgcmsiv_polyval_horner(out_tag, auth_key, scratch, 1);
-  }
+  auto f_whole = [&](const uint8_t *in, size_t len) {
+    if (htable_init) {
+      aesgcmsiv_htable_polyval(htable, in, len, out_tag);
+    } else {
+      aesgcmsiv_polyval_horner(out_tag, auth_key, in, len / AES_BLOCK_SIZE);
+    }
+    return true;
+  };
+
+  auto f_final = [&](const uint8_t *in, size_t len) {
+    size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+    if (len_whole != 0) {
+      f_whole(in, len_whole);
+      in += len_whole;
+      len -= len_whole;
+    }
+    if (len != 0) {
+      uint8_t pad_buf[AES_BLOCK_SIZE];
+      OPENSSL_memcpy(pad_buf, in, len);
+      OPENSSL_memset(pad_buf + len, 0, AES_BLOCK_SIZE - len);
+      aesgcmsiv_polyval_horner(out_tag, auth_key, pad_buf, 1);
+    }
+    return true;
+  };
 
-  if (htable_init) {
-    aesgcmsiv_htable_polyval(htable, in, in_len & ~15, out_tag);
-  } else {
-    aesgcmsiv_polyval_horner(out_tag, auth_key, in, in_blocks);
-  }
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(aadvecs, f_whole,
+                                                               f_final);
 
-  if (in_len & 15) {
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, &in[in_len & ~15], in_len & 15);
-    aesgcmsiv_polyval_horner(out_tag, auth_key, scratch, 1);
-  }
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(iovecs, f_whole,
+                                                               f_final);
 
   uint8_t length_block[16];
   CRYPTO_store_u64_le(length_block, ad_len * 8);
@@ -276,16 +291,16 @@ void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
 
 // aead_aes_gcm_siv_asm_crypt_last_block handles the encryption/decryption
 // (same thing in CTR mode) of the final block of a plaintext/ciphertext. It
-// writes |in_len| & 15 bytes to |out| + |in_len|, based on an initial counter
-// derived from |tag|.
+// writes `total_in_len` & 15 bytes to `out_last_block`, based on an initial
+// counter derived from `tag`.
 void aead_aes_gcm_siv_asm_crypt_last_block(
-    int is_128_bit, uint8_t *out, const uint8_t *in, size_t in_len,
-    const uint8_t tag[16],
+    int is_128_bit, uint8_t *out_last_block, const uint8_t *in_last_block,
+    size_t total_in_len, const uint8_t tag[16],
     const struct aead_aes_gcm_siv_asm_ctx *enc_key_expanded) {
   alignas(16) uint8_t counter[16];
   OPENSSL_memcpy(&counter, tag, sizeof(counter));
   counter[15] |= 0x80;
-  CRYPTO_store_u32_le(counter, CRYPTO_load_u32_le(counter) + in_len / 16);
+  inc_counter(counter, static_cast<uint32_t>(total_in_len / 16));
 
   if (is_128_bit) {
     aes128gcmsiv_ecb_enc_block(counter, counter, enc_key_expanded);
@@ -293,23 +308,20 @@ void aead_aes_gcm_siv_asm_crypt_last_block(
     aes256gcmsiv_ecb_enc_block(counter, counter, enc_key_expanded);
   }
 
-  const size_t last_bytes_offset = in_len & ~15;
-  const size_t last_bytes_len = in_len & 15;
-  uint8_t *last_bytes_out = &out[last_bytes_offset];
-  const uint8_t *last_bytes_in = &in[last_bytes_offset];
+  const size_t last_bytes_len = total_in_len & 15;
   for (size_t i = 0; i < last_bytes_len; i++) {
-    last_bytes_out[i] = last_bytes_in[i] ^ counter[i];
+    out_last_block[i] = in_last_block[i] ^ counter[i];
   }
 }
 
 // aead_aes_gcm_siv_kdf calculates the record encryption and authentication
-// keys given the |nonce|.
+// keys given the `nonce`.
 void aead_aes_gcm_siv_kdf(int is_128_bit,
                           const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx,
                           uint64_t out_record_auth_key[2],
                           uint64_t out_record_enc_key[4],
                           const uint8_t nonce[12]) {
-  alignas(16) uint8_t padded_nonce[16];
+  alignas(16) uint8_t padded_nonce[16] = {0};
   OPENSSL_memcpy(padded_nonce, nonce, 12);
 
   alignas(16) uint64_t key_material[12];
@@ -329,13 +341,15 @@ void aead_aes_gcm_siv_kdf(int is_128_bit,
   out_record_auth_key[1] = key_material[2];
 }
 
-int aead_aes_gcm_siv_asm_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
-    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
+int aead_aes_gcm_siv_asm_sealv(const EVP_AEAD_CTX *ctx,
+                               Span<const CRYPTO_IOVEC> iovecs,
+                               Span<uint8_t> out_tag, size_t *out_tag_len,
+                               Span<const uint8_t> nonce,
+                               Span<const CRYPTO_IVEC> aadvecs) {
   const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = asm_ctx_from_ctx(ctx);
+  const size_t in_len = bssl::iovec::TotalLength(iovecs);
   const uint64_t in_len_64 = in_len;
+  const size_t ad_len = bssl::iovec::TotalLength(aadvecs);
   const uint64_t ad_len_64 = ad_len;
 
   if (in_len_64 > (UINT64_C(1) << 36) || ad_len_64 >= (UINT64_C(1) << 61)) {
@@ -343,12 +357,12 @@ int aead_aes_gcm_siv_asm_seal_scatter(
     return 0;
   }
 
-  if (max_out_tag_len < EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
+  if (out_tag.size() < EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
@@ -356,64 +370,121 @@ int aead_aes_gcm_siv_asm_seal_scatter(
   alignas(16) uint64_t record_auth_key[2];
   alignas(16) uint64_t record_enc_key[4];
   aead_aes_gcm_siv_kdf(gcm_siv_ctx->is_128_bit, gcm_siv_ctx, record_auth_key,
-                       record_enc_key, nonce);
+                       record_enc_key, nonce.data());
 
   alignas(16) uint8_t tag[16] = {0};
-  gcm_siv_asm_polyval(tag, in, in_len, ad, ad_len,
-                      (const uint8_t *)record_auth_key, nonce);
+  gcm_siv_asm_polyval(tag, iovecs, aadvecs, (const uint8_t *)record_auth_key,
+                      nonce.data());
 
   struct aead_aes_gcm_siv_asm_ctx enc_key_expanded;
 
   if (gcm_siv_ctx->is_128_bit) {
     aes128gcmsiv_aes_ks_enc_x1(tag, tag, &enc_key_expanded.key[0],
                                record_enc_key);
-
-    if (in_len < 128) {
-      aes128gcmsiv_enc_msg_x4(in, out, tag, &enc_key_expanded, in_len & ~15);
-    } else {
-      aes128gcmsiv_enc_msg_x8(in, out, tag, &enc_key_expanded, in_len & ~15);
-    }
+    // Maintain a counter across calls to assembly. The functions internally set
+    // the MSB of the last byte, so we only need to update the counter.
+    alignas(16) uint8_t counter[16];
+    OPENSSL_memcpy(counter, tag, 16);
+    bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/true>(
+        iovecs,
+        [&](const uint8_t *in, uint8_t *out, size_t len) {
+          if (len >= 128) {
+            aes128gcmsiv_enc_msg_x8(in, out, counter, &enc_key_expanded, len);
+          } else {
+            aes128gcmsiv_enc_msg_x4(in, out, counter, &enc_key_expanded, len);
+          }
+          inc_counter(counter, static_cast<uint32_t>(len / AES_BLOCK_SIZE));
+          return true;
+        },
+        [&](const uint8_t *in, uint8_t *out, size_t len) {
+          size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+          if (len_whole != 0) {
+            if (len_whole >= 128) {
+              aes128gcmsiv_enc_msg_x8(in, out, counter, &enc_key_expanded,
+                                      len_whole);
+            } else {
+              aes128gcmsiv_enc_msg_x4(in, out, counter, &enc_key_expanded,
+                                      len_whole);
+            }
+            in += len_whole;
+            out += len_whole;
+            len -= len_whole;
+          }
+          if (len != 0) {
+            aead_aes_gcm_siv_asm_crypt_last_block(
+                /*is_128_bit=*/true, /*out_last_block=*/out,
+                /*in_last_block=*/in, /*total_in_len=*/in_len, tag,
+                &enc_key_expanded);
+          }
+          return true;
+        });
   } else {
     aes256gcmsiv_aes_ks_enc_x1(tag, tag, &enc_key_expanded.key[0],
                                record_enc_key);
-
-    if (in_len < 128) {
-      aes256gcmsiv_enc_msg_x4(in, out, tag, &enc_key_expanded, in_len & ~15);
-    } else {
-      aes256gcmsiv_enc_msg_x8(in, out, tag, &enc_key_expanded, in_len & ~15);
-    }
+    alignas(16) uint8_t counter[16];
+    OPENSSL_memcpy(counter, tag, 16);
+    bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/true>(
+        iovecs,
+        [&](const uint8_t *in, uint8_t *out, size_t len) {
+          if (len >= 128) {
+            aes256gcmsiv_enc_msg_x8(in, out, counter, &enc_key_expanded, len);
+          } else {
+            aes256gcmsiv_enc_msg_x4(in, out, counter, &enc_key_expanded, len);
+          }
+          inc_counter(counter, static_cast<uint32_t>(len / AES_BLOCK_SIZE));
+          return true;
+        },
+        [&](const uint8_t *in, uint8_t *out, size_t len) {
+          size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+          if (len_whole != 0) {
+            if (len_whole >= 128) {
+              aes256gcmsiv_enc_msg_x8(in, out, counter, &enc_key_expanded,
+                                      len_whole);
+            } else {
+              aes256gcmsiv_enc_msg_x4(in, out, counter, &enc_key_expanded,
+                                      len_whole);
+            }
+            in += len_whole;
+            out += len_whole;
+            len -= len_whole;
+          }
+          if (len != 0) {
+            aead_aes_gcm_siv_asm_crypt_last_block(
+                /*is_128_bit=*/false, /*out_last_block=*/out,
+                /*in_last_block=*/in, /*total_in_len=*/in_len, tag,
+                &enc_key_expanded);
+          }
+          return true;
+        });
   }
 
-  if (in_len & 15) {
-    aead_aes_gcm_siv_asm_crypt_last_block(gcm_siv_ctx->is_128_bit, out, in,
-                                          in_len, tag, &enc_key_expanded);
-  }
-
-  OPENSSL_memcpy(out_tag, tag, sizeof(tag));
+  CopyToPrefix(tag, out_tag);
   *out_tag_len = EVP_AEAD_AES_GCM_SIV_TAG_LEN;
 
   return 1;
 }
 
-int aead_aes_gcm_siv_asm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                     const uint8_t *nonce, size_t nonce_len,
-                                     const uint8_t *in, size_t in_len,
-                                     const uint8_t *in_tag, size_t in_tag_len,
-                                     const uint8_t *ad, size_t ad_len) {
+int aead_aes_gcm_siv_asm_openv_detached(const EVP_AEAD_CTX *ctx,
+                                        Span<const CRYPTO_IOVEC> iovecs,
+                                        Span<const uint8_t> nonce,
+                                        Span<const uint8_t> in_tag,
+                                        Span<const CRYPTO_IVEC> aadvecs) {
+  const size_t ad_len = bssl::iovec::TotalLength(aadvecs);
   const uint64_t ad_len_64 = ad_len;
   if (ad_len_64 >= (UINT64_C(1) << 61)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
     return 0;
   }
 
+  const size_t in_len = bssl::iovec::TotalLength(iovecs);
   const uint64_t in_len_64 = in_len;
   if (in_len_64 > UINT64_C(1) << 36 ||
-      in_tag_len != EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
+      in_tag.size() != EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
@@ -423,7 +494,7 @@ int aead_aes_gcm_siv_asm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
   alignas(16) uint64_t record_auth_key[2];
   alignas(16) uint64_t record_enc_key[4];
   aead_aes_gcm_siv_kdf(gcm_siv_ctx->is_128_bit, gcm_siv_ctx, record_auth_key,
-                       record_enc_key, nonce);
+                       record_enc_key, nonce.data());
 
   struct aead_aes_gcm_siv_asm_ctx expanded_key;
   if (gcm_siv_ctx->is_128_bit) {
@@ -436,38 +507,87 @@ int aead_aes_gcm_siv_asm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
   alignas(16) uint8_t calculated_tag[16 * 8] = {0};
 
   OPENSSL_memset(calculated_tag, 0, EVP_AEAD_AES_GCM_SIV_TAG_LEN);
-  const size_t ad_blocks = ad_len / 16;
-  aesgcmsiv_polyval_horner(calculated_tag, (const uint8_t *)record_auth_key, ad,
-                           ad_blocks);
-
-  uint8_t scratch[16];
-  if (ad_len & 15) {
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, &ad[ad_len & ~15], ad_len & 15);
-    aesgcmsiv_polyval_horner(calculated_tag, (const uint8_t *)record_auth_key,
-                             scratch, 1);
-  }
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
+      aadvecs,
+      [&](const uint8_t *in, size_t len) {
+        aesgcmsiv_polyval_horner(calculated_tag,
+                                 (const uint8_t *)record_auth_key, in,
+                                 len / AES_BLOCK_SIZE);
+        return true;
+      },
+      [&](const uint8_t *in, size_t len) {
+        size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+        if (len_whole != 0) {
+          aesgcmsiv_polyval_horner(calculated_tag,
+                                   (const uint8_t *)record_auth_key, in,
+                                   len_whole / AES_BLOCK_SIZE);
+          in += len_whole;
+          len -= len_whole;
+        }
+        if (len != 0) {
+          uint8_t pad_buf[AES_BLOCK_SIZE];
+          OPENSSL_memcpy(pad_buf, in, len);
+          OPENSSL_memset(pad_buf + len, 0, AES_BLOCK_SIZE - len);
+          aesgcmsiv_polyval_horner(
+              calculated_tag, (const uint8_t *)record_auth_key, pad_buf, 1);
+        }
+        return true;
+      });
 
   alignas(16) uint8_t htable[16 * 6];
   aesgcmsiv_htable6_init(htable, (const uint8_t *)record_auth_key);
 
-  // aes[128|256]gcmsiv_dec needs access to the claimed tag. So it's put into
-  // its scratch space.
-  memcpy(calculated_tag + 16, in_tag, EVP_AEAD_AES_GCM_SIV_TAG_LEN);
-  if (gcm_siv_ctx->is_128_bit) {
-    aes128gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key, in_len);
-  } else {
-    aes256gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key, in_len);
-  }
-
-  if (in_len & 15) {
-    aead_aes_gcm_siv_asm_crypt_last_block(gcm_siv_ctx->is_128_bit, out, in,
-                                          in_len, in_tag, &expanded_key);
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, out + (in_len & ~15), in_len & 15);
-    aesgcmsiv_polyval_horner(calculated_tag, (const uint8_t *)record_auth_key,
-                             scratch, 1);
-  }
+  size_t blocks = 0;
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/true>(
+      iovecs,
+      [&](const uint8_t *in, uint8_t *out, size_t len) {
+        // aes[128|256]gcmsiv_dec needs access to the claimed tag. So it's put
+        // into its scratch space. The function may clobber the claimed tag, so
+        // this is copied before each call.
+        OPENSSL_memcpy(calculated_tag + 16, in_tag.data(),
+                       EVP_AEAD_AES_GCM_SIV_TAG_LEN);
+        inc_counter(calculated_tag + 16, static_cast<uint32_t>(blocks));
+        if (gcm_siv_ctx->is_128_bit) {
+          aes128gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key, len);
+        } else {
+          aes256gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key, len);
+        }
+        blocks += len / AES_BLOCK_SIZE;
+        return true;
+      },
+      [&](const uint8_t *in, uint8_t *out, size_t len) {
+        size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+        if (len_whole != 0) {
+          // aes[128|256]gcmsiv_dec needs access to the claimed tag. So it's put
+          // into its scratch space. The function may clobber the claimed tag,
+          // so this is copied before each call.
+          OPENSSL_memcpy(calculated_tag + 16, in_tag.data(),
+                         EVP_AEAD_AES_GCM_SIV_TAG_LEN);
+          inc_counter(calculated_tag + 16, static_cast<uint32_t>(blocks));
+          if (gcm_siv_ctx->is_128_bit) {
+            aes128gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key,
+                             len_whole);
+          } else {
+            aes256gcmsiv_dec(in, out, calculated_tag, htable, &expanded_key,
+                             len_whole);
+          }
+          in += len_whole;
+          out += len_whole;
+          len -= len_whole;
+        }
+        if (len != 0) {
+          aead_aes_gcm_siv_asm_crypt_last_block(
+              gcm_siv_ctx->is_128_bit, /*out_last_block=*/out,
+              /*in_last_block=*/in, /*total_in_len=*/in_len, in_tag.data(),
+              &expanded_key);
+          uint8_t pad_buf[AES_BLOCK_SIZE];
+          OPENSSL_memcpy(pad_buf, out, len);
+          OPENSSL_memset(pad_buf + len, 0, AES_BLOCK_SIZE - len);
+          aesgcmsiv_polyval_horner(
+              calculated_tag, (const uint8_t *)record_auth_key, pad_buf, 1);
+        }
+        return true;
+      });
 
   uint8_t length_block[16];
   CRYPTO_store_u64_le(length_block, ad_len * 8);
@@ -487,8 +607,8 @@ int aead_aes_gcm_siv_asm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
     aes256gcmsiv_ecb_enc_block(calculated_tag, calculated_tag, &expanded_key);
   }
 
-  if (CRYPTO_memcmp(calculated_tag, in_tag, EVP_AEAD_AES_GCM_SIV_TAG_LEN) !=
-      0) {
+  if (CRYPTO_memcmp(calculated_tag, in_tag.data(),
+                    EVP_AEAD_AES_GCM_SIV_TAG_LEN) != 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
@@ -501,16 +621,15 @@ const EVP_AEAD aead_aes_128_gcm_siv_asm = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // max tag length
-    0,                               // seal_scatter_supports_extra_in
 
     aead_aes_gcm_siv_asm_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_gcm_siv_asm_cleanup,
-    NULL /* open */,
-    aead_aes_gcm_siv_asm_seal_scatter,
-    aead_aes_gcm_siv_asm_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_gcm_siv_asm_sealv,
+    aead_aes_gcm_siv_asm_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 
 const EVP_AEAD aead_aes_256_gcm_siv_asm = {
@@ -518,16 +637,15 @@ const EVP_AEAD aead_aes_256_gcm_siv_asm = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // max tag length
-    0,                               // seal_scatter_supports_extra_in
 
     aead_aes_gcm_siv_asm_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_gcm_siv_asm_cleanup,
-    NULL /* open */,
-    aead_aes_gcm_siv_asm_seal_scatter,
-    aead_aes_gcm_siv_asm_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_gcm_siv_asm_sealv,
+    aead_aes_gcm_siv_asm_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 
 #endif  // X86_64 && !NO_ASM && !WINDOWS
@@ -542,7 +660,7 @@ struct aead_aes_gcm_siv_ctx {
   unsigned is_256 : 1;
 };
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_gcm_siv_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=
@@ -570,7 +688,7 @@ int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len,
       (struct aead_aes_gcm_siv_ctx *)&ctx->state;
   OPENSSL_memset(gcm_siv_ctx, 0, sizeof(struct aead_aes_gcm_siv_ctx));
 
-  aes_ctr_set_key(&gcm_siv_ctx->ks.ks, NULL, &gcm_siv_ctx->kgk_block, key,
+  aes_ctr_set_key(&gcm_siv_ctx->ks.ks, nullptr, &gcm_siv_ctx->kgk_block, key,
                   key_len);
   gcm_siv_ctx->is_256 = (key_len == 32);
   ctx->tag_len = tag_len;
@@ -580,14 +698,14 @@ int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len,
 
 void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {}
 
-// gcm_siv_crypt encrypts (or decrypts—it's the same thing) |in_len| bytes from
-// |in| to |out|, using the block function |enc_block| with |key| in counter
-// mode, starting at |initial_counter|. This differs from the traditional
-// counter mode code in that the counter is handled little-endian, only the
-// first four bytes are used and the GCM-SIV tweak to the final byte is
-// applied. The |in| and |out| pointers may be equal but otherwise must not
+// gcm_siv_crypt encrypts (or decrypts—it's the same thing) bytes from `in` to
+// `out` in the `iovec`, using the block function `enc_block` with `key` in
+// counter mode, starting at `initial_counter`. This differs from the
+// traditional counter mode code in that the counter is handled little-endian,
+// only the first four bytes are used and the GCM-SIV tweak to the final byte
+// is applied. The `in` and `out` pointers may be equal but otherwise must not
 // alias.
-void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
+void gcm_siv_crypt(Span<const CRYPTO_IOVEC> iovecs,
                    const uint8_t initial_counter[AES_BLOCK_SIZE],
                    block128_f enc_block, const AES_KEY *key) {
   uint8_t counter[16];
@@ -595,22 +713,28 @@ void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
   OPENSSL_memcpy(counter, initial_counter, AES_BLOCK_SIZE);
   counter[15] |= 0x80;
 
-  for (size_t done = 0; done < in_len;) {
-    uint8_t keystream[AES_BLOCK_SIZE];
-    enc_block(counter, keystream, key);
-    CRYPTO_store_u32_le(counter, CRYPTO_load_u32_le(counter) + 1);
+  auto crypt_bytes = [&](const uint8_t *in, uint8_t *out, size_t len) {
+    for (size_t done = 0; done < len;) {
+      uint8_t keystream[AES_BLOCK_SIZE];
+      enc_block(counter, keystream, key);
+      inc_counter(counter, 1);
 
-    size_t todo = AES_BLOCK_SIZE;
-    if (in_len - done < todo) {
-      todo = in_len - done;
-    }
+      size_t todo = AES_BLOCK_SIZE;
+      if (len - done < todo) {
+        todo = len - done;
+      }
+
+      for (size_t i = 0; i < todo; i++) {
+        out[done + i] = keystream[i] ^ in[done + i];
+      }
 
-    for (size_t i = 0; i < todo; i++) {
-      out[done + i] = keystream[i] ^ in[done + i];
+      done += todo;
     }
+    return true;
+  };
 
-    done += todo;
-  }
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/true>(
+      iovecs, crypt_bytes, crypt_bytes);
 }
 
 
@@ -633,7 +757,7 @@ struct polyval_ctx {
   ghash_func ghash;
 };
 
-// byte_reverse reverses the order of the bytes in |b->c|.
+// byte_reverse reverses the order of the bytes in `b->c`.
 void byte_reverse(uint8_t b[16]) {
   uint64_t hi = CRYPTO_load_u64_le(b);
   uint64_t lo = CRYPTO_load_u64_le(b + 8);
@@ -641,8 +765,8 @@ void byte_reverse(uint8_t b[16]) {
   CRYPTO_store_u64_le(b + 8, CRYPTO_bswap8(hi));
 }
 
-// reverse_and_mulX_ghash interprets |b| as a reversed element of the GHASH
-// field, multiplies that by 'x' and serialises the result back into |b|, but
+// reverse_and_mulX_ghash interprets `b` as a reversed element of the GHASH
+// field, multiplies that by 'x' and serialises the result back into `b`, but
 // with GHASH's backwards bit ordering.
 void reverse_and_mulX_ghash(uint8_t b[16]) {
   uint64_t hi = CRYPTO_load_u64_le(b);
@@ -694,34 +818,50 @@ void crypto_polyval_finish(const struct polyval_ctx *ctx, uint8_t out[16]) {
   byte_reverse(out);
 }
 
-// gcm_siv_polyval evaluates POLYVAL at |auth_key| on the given plaintext and
-// AD. The result is written to |out_tag|.
-void gcm_siv_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len,
-                     const uint8_t *ad, size_t ad_len,
+// gcm_siv_polyval evaluates POLYVAL at `auth_key` on the given plaintext and
+// AD. The result is written to `out_tag`.
+void gcm_siv_polyval(uint8_t out_tag[16], Span<const CRYPTO_IOVEC> iovecs,
+                     bool encrypt, Span<const CRYPTO_IVEC> aadvecs,
                      const uint8_t auth_key[16],
                      const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
   struct polyval_ctx polyval_ctx;
   crypto_polyval_init(&polyval_ctx, auth_key);
 
-  crypto_polyval_update_blocks(&polyval_ctx, ad, ad_len & ~15);
+  auto f_whole = [&](const uint8_t *in, size_t len) {
+    crypto_polyval_update_blocks(&polyval_ctx, in, len);
+    return true;
+  };
+  auto f_final = [&](const uint8_t *in, size_t len) {
+    size_t len_whole = (len / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+    if (len_whole != 0) {
+      crypto_polyval_update_blocks(&polyval_ctx, in, len_whole);
+      in += len_whole;
+      len -= len_whole;
+    }
+    if (len != 0) {
+      uint8_t pad_buf[AES_BLOCK_SIZE];
+      OPENSSL_memcpy(pad_buf, in, len);
+      OPENSSL_memset(pad_buf + len, 0, AES_BLOCK_SIZE - len);
+      crypto_polyval_update_blocks(&polyval_ctx, pad_buf, AES_BLOCK_SIZE);
+    }
+    return true;
+  };
 
-  uint8_t scratch[16];
-  if (ad_len & 15) {
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, &ad[ad_len & ~15], ad_len & 15);
-    crypto_polyval_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
-  }
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(aadvecs, f_whole,
+                                                               f_final);
 
-  crypto_polyval_update_blocks(&polyval_ctx, in, in_len & ~15);
-  if (in_len & 15) {
-    OPENSSL_memset(scratch, 0, sizeof(scratch));
-    OPENSSL_memcpy(scratch, &in[in_len & ~15], in_len & 15);
-    crypto_polyval_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
+  if (encrypt) {
+    bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
+        iovecs, f_whole, f_final);
+  } else {
+    bssl::iovec::ForEachOutBlockRange<AES_BLOCK_SIZE>(iovecs, f_whole, f_final);
   }
 
   uint8_t length_block[16];
-  CRYPTO_store_u64_le(length_block, ((uint64_t)ad_len) * 8);
-  CRYPTO_store_u64_le(length_block + 8, ((uint64_t)in_len) * 8);
+  CRYPTO_store_u64_le(length_block,
+                      ((uint64_t)bssl::iovec::TotalLength(aadvecs)) * 8);
+  CRYPTO_store_u64_le(length_block + 8,
+                      ((uint64_t)bssl::iovec::TotalLength(iovecs)) * 8);
   crypto_polyval_update_blocks(&polyval_ctx, length_block,
                                sizeof(length_block));
 
@@ -743,7 +883,7 @@ struct gcm_siv_record_keys {
 };
 
 // gcm_siv_keys calculates the keys for a specific GCM-SIV record with the
-// given nonce and writes them to |*out_keys|.
+// given nonce and writes them to `*out_keys`.
 void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
                   struct gcm_siv_record_keys *out_keys,
                   const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
@@ -764,27 +904,27 @@ void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
   }
 
   OPENSSL_memcpy(out_keys->auth_key, key_material, 16);
-  // Note the |ctr128_f| function uses a big-endian couner, while AES-GCM-SIV
+  // Note the `ctr128_f` function uses a big-endian couner, while AES-GCM-SIV
   // uses a little-endian counter. We ignore the return value and only use
-  // |block128_f|. This has a significant performance cost for the fallback
+  // `block128_f`. This has a significant performance cost for the fallback
   // bitsliced AES implementations (bsaes and aes_nohw).
   //
   // We currently do not consider AES-GCM-SIV to be performance-sensitive on
-  // client hardware. If this changes, we can write little-endian |ctr128_f|
+  // client hardware. If this changes, we can write little-endian `ctr128_f`
   // functions.
-  aes_ctr_set_key(&out_keys->enc_key.ks, NULL, &out_keys->enc_block,
+  aes_ctr_set_key(&out_keys->enc_key.ks, nullptr, &out_keys->enc_block,
                   key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
 }
 
-int aead_aes_gcm_siv_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                  uint8_t *out_tag, size_t *out_tag_len,
-                                  size_t max_out_tag_len, const uint8_t *nonce,
-                                  size_t nonce_len, const uint8_t *in,
-                                  size_t in_len, const uint8_t *extra_in,
-                                  size_t extra_in_len, const uint8_t *ad,
-                                  size_t ad_len) {
+int aead_aes_gcm_siv_sealv(const EVP_AEAD_CTX *ctx,
+                           Span<const CRYPTO_IOVEC> iovecs,
+                           Span<uint8_t> out_tag, size_t *out_tag_len,
+                           Span<const uint8_t> nonce,
+                           Span<const CRYPTO_IVEC> aadvecs) {
   const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx =
       (struct aead_aes_gcm_siv_ctx *)&ctx->state;
+  size_t in_len = bssl::iovec::TotalLength(iovecs);
+  size_t ad_len = bssl::iovec::TotalLength(aadvecs);
   const uint64_t in_len_64 = in_len;
   const uint64_t ad_len_64 = ad_len;
 
@@ -794,50 +934,50 @@ int aead_aes_gcm_siv_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
     return 0;
   }
 
-  if (max_out_tag_len < EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
+  if (out_tag.size() < EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
 
   struct gcm_siv_record_keys keys;
-  gcm_siv_keys(gcm_siv_ctx, &keys, nonce);
+  gcm_siv_keys(gcm_siv_ctx, &keys, nonce.data());
 
-  uint8_t tag[16];
-  gcm_siv_polyval(tag, in, in_len, ad, ad_len, keys.auth_key, nonce);
+  uint8_t tag[EVP_AEAD_AES_GCM_SIV_TAG_LEN];
+  gcm_siv_polyval(tag, iovecs, true, aadvecs, keys.auth_key, nonce.data());
   keys.enc_block(tag, tag, &keys.enc_key.ks);
 
-  gcm_siv_crypt(out, in, in_len, tag, keys.enc_block, &keys.enc_key.ks);
+  gcm_siv_crypt(iovecs, tag, keys.enc_block, &keys.enc_key.ks);
 
-  OPENSSL_memcpy(out_tag, tag, EVP_AEAD_AES_GCM_SIV_TAG_LEN);
+  CopyToPrefix(tag, out_tag);
   *out_tag_len = EVP_AEAD_AES_GCM_SIV_TAG_LEN;
 
   return 1;
 }
 
-int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                 const uint8_t *nonce, size_t nonce_len,
-                                 const uint8_t *in, size_t in_len,
-                                 const uint8_t *in_tag, size_t in_tag_len,
-                                 const uint8_t *ad, size_t ad_len) {
-  const uint64_t ad_len_64 = ad_len;
+int aead_aes_gcm_siv_openv_detached(const EVP_AEAD_CTX *ctx,
+                                    Span<const CRYPTO_IOVEC> iovecs,
+                                    Span<const uint8_t> nonce,
+                                    Span<const uint8_t> in_tag,
+                                    Span<const CRYPTO_IVEC> aadvecs) {
+  const uint64_t ad_len_64 = bssl::iovec::TotalLength(aadvecs);
   if (ad_len_64 >= (UINT64_C(1) << 61)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
     return 0;
   }
 
-  const uint64_t in_len_64 = in_len;
-  if (in_tag_len != EVP_AEAD_AES_GCM_SIV_TAG_LEN ||
-      in_len_64 > (UINT64_C(1) << 36) + AES_BLOCK_SIZE) {
+  const uint64_t in_len_64 = bssl::iovec::TotalLength(iovecs);
+  if (in_tag.size() != EVP_AEAD_AES_GCM_SIV_TAG_LEN ||
+      in_len_64 > (UINT64_C(1) << 36)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
@@ -846,15 +986,16 @@ int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
       (struct aead_aes_gcm_siv_ctx *)&ctx->state;
 
   struct gcm_siv_record_keys keys;
-  gcm_siv_keys(gcm_siv_ctx, &keys, nonce);
+  gcm_siv_keys(gcm_siv_ctx, &keys, nonce.data());
 
-  gcm_siv_crypt(out, in, in_len, in_tag, keys.enc_block, &keys.enc_key.ks);
+  gcm_siv_crypt(iovecs, in_tag.data(), keys.enc_block, &keys.enc_key.ks);
 
   uint8_t expected_tag[EVP_AEAD_AES_GCM_SIV_TAG_LEN];
-  gcm_siv_polyval(expected_tag, out, in_len, ad, ad_len, keys.auth_key, nonce);
+  gcm_siv_polyval(expected_tag, iovecs, false, aadvecs, keys.auth_key,
+                  nonce.data());
   keys.enc_block(expected_tag, expected_tag, &keys.enc_key.ks);
 
-  if (CRYPTO_memcmp(expected_tag, in_tag, sizeof(expected_tag)) != 0) {
+  if (CRYPTO_memcmp(expected_tag, in_tag.data(), sizeof(expected_tag)) != 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
@@ -867,16 +1008,15 @@ const EVP_AEAD aead_aes_128_gcm_siv = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // max tag length
-    0,                               // seal_scatter_supports_extra_in
 
     aead_aes_gcm_siv_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_gcm_siv_cleanup,
-    NULL /* open */,
-    aead_aes_gcm_siv_seal_scatter,
-    aead_aes_gcm_siv_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_gcm_siv_sealv,
+    aead_aes_gcm_siv_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 
 const EVP_AEAD aead_aes_256_gcm_siv = {
@@ -884,30 +1024,31 @@ const EVP_AEAD aead_aes_256_gcm_siv = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN,  // nonce length
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // overhead
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,    // max tag length
-    0,                               // seal_scatter_supports_extra_in
 
     aead_aes_gcm_siv_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_gcm_siv_cleanup,
-    NULL /* open */,
-    aead_aes_gcm_siv_seal_scatter,
-    aead_aes_gcm_siv_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_gcm_siv_sealv,
+    aead_aes_gcm_siv_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 }  // namespace
 
 #if defined(AES_GCM_SIV_ASM)
 
-const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void) {
-  if (CRYPTO_is_AVX_capable() && CRYPTO_is_AESNI_capable()) {
+const EVP_AEAD *EVP_aead_aes_128_gcm_siv() {
+  if (CRYPTO_is_AVX_capable() && CRYPTO_is_AESNI_capable() &&
+      CRYPTO_is_PCLMUL_capable()) {
     return &aead_aes_128_gcm_siv_asm;
   }
   return &aead_aes_128_gcm_siv;
 }
 
-const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) {
-  if (CRYPTO_is_AVX_capable() && CRYPTO_is_AESNI_capable()) {
+const EVP_AEAD *EVP_aead_aes_256_gcm_siv() {
+  if (CRYPTO_is_AVX_capable() && CRYPTO_is_AESNI_capable() &&
+      CRYPTO_is_PCLMUL_capable()) {
     return &aead_aes_256_gcm_siv_asm;
   }
   return &aead_aes_256_gcm_siv;
@@ -915,8 +1056,8 @@ const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) {
 
 #else
 
-const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void) { return &aead_aes_128_gcm_siv; }
+const EVP_AEAD *EVP_aead_aes_128_gcm_siv() { return &aead_aes_128_gcm_siv; }
 
-const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) { return &aead_aes_256_gcm_siv; }
+const EVP_AEAD *EVP_aead_aes_256_gcm_siv() { return &aead_aes_256_gcm_siv; }
 
 #endif  // AES_GCM_SIV_ASM