grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/p256_internal.h

@@ -0,0 +1,193 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_EC_P256_INTERNAL_H
+#define OPENSSL_HEADER_EC_P256_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/bn.h>
+
+#include "../../internal.h"
+#include "../../../third_party/fiat/bedrock_unverified_platform.c.inc"
+
+#define P256_LIMBS (32 / sizeof(bssl::crypto_word_t))
+typedef bssl::crypto_word_t fiat_p256_felem[P256_LIMBS];
+
+
+// Choose implementation of arithmetic in the coordinate field.
+
+#if defined(BORINGSSL_HAS_UINT128)
+#include "../../../third_party/fiat/p256_field_64.br.c.inc"
+
+#include "../../../third_party/fiat/p256_64.h"
+#elif defined(OPENSSL_64_BIT)
+#include "../../../third_party/fiat/p256_field_64.br.c.inc"
+
+#include "../../../third_party/fiat/p256_64_msvc.h"
+#else
+#include "../../../third_party/fiat/p256_field_32.br.c.inc"
+
+#include "../../../third_party/fiat/p256_32.h"
+// Add Bedrock versions of p256_32.h functions for p256_point.br.c.inc to call.
+static inline void p256_coord_add(br_word_t out, br_word_t x, br_word_t y) {
+  fiat_p256_add((uint32_t *)out, (const uint32_t *)x, (const uint32_t *)y);
+}
+static inline void p256_coord_sub(br_word_t out, br_word_t x, br_word_t y) {
+  fiat_p256_sub((uint32_t *)out, (const uint32_t *)x, (const uint32_t *)y);
+}
+#endif
+
+extern "C" {
+#if !defined(OPENSSL_NO_ASM) && (defined(__ELF__) || defined(__APPLE__)) && \
+    defined(OPENSSL_X86_64) && !defined(OPENSSL_NANOLIBC)
+// These functions are only available with gas and SysV ABI, used by Apple and
+// ELF-based platforms. Unlike most of our SysV assembly, they currently rely on
+// the SysV redzone. This trips one target which looks like it targets SysV but
+// has no redzone. This happens to define `OPENSSL_NANOLIBC`, so gate on that.
+//
+// TODO(crbug.com/522255483): Come up with a clearer story for the redzone
+// situation.
+#define FIAT_P256_ADX_ASM
+void fiat_p256_adx_mul(uint64_t x0[4], const uint64_t x1[4],
+                       const uint64_t x2[4]);
+void fiat_p256_adx_sqr(uint64_t x0[4], const uint64_t x1[4]);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+void ecp_nistz256_mul_mont(uint64_t pr[4], const uint64_t py[4], uint64_t y0,
+                           uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3);
+void ecp_nistz256_sqr_mont(uint64_t pr[4], const uint64_t py[4], uint64_t y0,
+                           uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3);
+#endif
+}
+
+static inline void p256_coord_mul(fiat_p256_felem out, const fiat_p256_felem x,
+                                  const fiat_p256_felem y) {
+#if defined(FIAT_P256_ADX_ASM)
+  if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
+      bssl::CRYPTO_is_ADX_capable()) {
+    return fiat_p256_adx_mul(out, x, y);
+  }
+  fiat_p256_mul(out, x, y);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+  ecp_nistz256_mul_mont(out, y, y[0], x[0], x[1], x[2], x[3]);
+#else
+  fiat_p256_mul(out, x, y);
+#endif
+}
+
+static inline void p256_coord_sqr(fiat_p256_felem out,
+                                  const fiat_p256_felem x) {
+#if defined(FIAT_P256_ADX_ASM)
+  if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
+      bssl::CRYPTO_is_ADX_capable()) {
+    return fiat_p256_adx_sqr(out, x);
+  }
+  fiat_p256_square(out, x);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+  ecp_nistz256_sqr_mont(out, x, x[0], x[0], x[1], x[2], x[3]);
+#else
+  fiat_p256_square(out, x);
+#endif
+}
+
+// Add Bedrock versions of these functions for p256_point.br.c.inc to call.
+static inline void p256_coord_mul(br_word_t out, br_word_t x, br_word_t y) {
+  p256_coord_mul((br_word_t *)out, (const br_word_t *)x, (const br_word_t *)y);
+}
+
+static inline void p256_coord_sqr(br_word_t out, br_word_t x) {
+  p256_coord_sqr((br_word_t *)out, (const br_word_t *)x);
+}
+
+
+// Choose implementation of arithmetic in the field modulo curve order.
+
+extern "C" {
+
+#if !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64))
+// beeu_mod_inverse_vartime sets out = a^-1 mod p using a Euclidean algorithm.
+// Assumption: 0 < a < p < 2^(256) and p is odd.
+int beeu_mod_inverse_vartime(BN_ULONG out[4], const BN_ULONG a[4],
+                             const BN_ULONG p[4]);
+#endif
+
+// P-256 scalar operations.
+//
+// The following functions compute modulo N, where N is the order of P-256. They
+// take fully-reduced inputs and give fully-reduced outputs.
+
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+// ecp_nistz256_ord_mul_mont sets `res` to `a` * `b` where inputs and outputs
+// are in Montgomery form. That is, `res` is `a` * `b` * 2^-256 mod N.
+void ecp_nistz256_ord_mul_mont(BN_ULONG res[4], const BN_ULONG a[4],
+                               const BN_ULONG b[4]);
+
+// ecp_nistz256_ord_sqr_mont sets `res` to `a`^(2*`rep`) where inputs and
+// outputs are in Montgomery form. That is, `res` is
+// (`a` * 2^-256)^(2*`rep`) * 2^256 mod N.
+void ecp_nistz256_ord_sqr_mont(BN_ULONG res[4], const BN_ULONG a[4],
+                               BN_ULONG rep);
+
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
+void ecp_nistz256_ord_mul_mont_nohw(BN_ULONG res[4], const BN_ULONG a[4],
+                                    const BN_ULONG b[4]);
+void ecp_nistz256_ord_mul_mont_adx(BN_ULONG res[4], const BN_ULONG a[4],
+                                   const BN_ULONG b[4]);
+
+void ecp_nistz256_ord_sqr_mont_nohw(BN_ULONG res[4], const BN_ULONG a[4],
+                                    BN_ULONG rep);
+void ecp_nistz256_ord_sqr_mont_adx(BN_ULONG res[4], const BN_ULONG a[4],
+                                   BN_ULONG rep);
+#endif
+
+}  // extern C
+
+static inline void p256_order_mul(const EC_GROUP *group,
+                                  BN_ULONG res[P256_LIMBS],
+                                  const BN_ULONG a[P256_LIMBS],
+                                  const BN_ULONG b[P256_LIMBS]) {
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+  return ecp_nistz256_ord_mul_mont(res, a, b);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
+  if (bssl::CRYPTO_is_BMI2_capable() && bssl::CRYPTO_is_ADX_capable()) {
+    return ecp_nistz256_ord_mul_mont_adx(res, a, b);
+  }
+  return ecp_nistz256_ord_mul_mont_nohw(res, a, b);
+#else
+  const BIGNUM *order = &group->order.N;
+  bssl::bn_mod_mul_montgomery_small(res, a, b, order->width, &group->order);
+#endif
+}
+
+static inline void p256_order_sqr(const EC_GROUP *group,
+                                  BN_ULONG res[P256_LIMBS],
+                                  const BN_ULONG a[P256_LIMBS], BN_ULONG rep) {
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
+  return ecp_nistz256_ord_sqr_mont(res, a, rep);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
+  if (bssl::CRYPTO_is_BMI2_capable() && bssl::CRYPTO_is_ADX_capable()) {
+    return ecp_nistz256_ord_sqr_mont_adx(res, a, rep);
+  }
+  return ecp_nistz256_ord_sqr_mont_nohw(res, a, rep);
+#else
+  bssl::OPENSSL_memmove(res, a, sizeof(BN_ULONG) * P256_LIMBS);
+  for (BN_ULONG i = 0; i < rep; i++) {
+    p256_order_mul(group, res, res, res);
+  }
+#endif
+}
+
+#include "../../../third_party/fiat/p256_point.br.c.inc"
+
+#endif  // OPENSSL_HEADER_EC_P256_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/scalar.cc.inc

@@ -21,8 +21,10 @@
 #include "internal.h"
 
 
-int ec_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                        const BIGNUM *in) {
+using namespace bssl;
+
+int bssl::ec_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
+                              const BIGNUM *in) {
   // Scalars, which are often secret, must be reduced modulo the order. Those
   // that are not will be discarded, so leaking the result of the comparison is
   // safe.
@@ -35,13 +37,13 @@ int ec_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   return 1;
 }
 
-int ec_scalar_equal_vartime(const EC_GROUP *group, const EC_SCALAR *a,
-                            const EC_SCALAR *b) {
+int bssl::ec_scalar_equal_vartime(const EC_GROUP *group, const EC_SCALAR *a,
+                                  const EC_SCALAR *b) {
   return OPENSSL_memcmp(a->words, b->words,
                         group->order.N.width * sizeof(BN_ULONG)) == 0;
 }
 
-int ec_scalar_is_zero(const EC_GROUP *group, const EC_SCALAR *a) {
+int bssl::ec_scalar_is_zero(const EC_GROUP *group, const EC_SCALAR *a) {
   BN_ULONG mask = 0;
   for (int i = 0; i < group->order.N.width; i++) {
     mask |= a->words[i];
@@ -49,27 +51,27 @@ int ec_scalar_is_zero(const EC_GROUP *group, const EC_SCALAR *a) {
   return mask == 0;
 }
 
-int ec_random_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                     const uint8_t additional_data[32]) {
+int bssl::ec_random_scalar(const EC_GROUP *group, EC_SCALAR *out,
+                           const uint8_t additional_data[32]) {
   return bn_rand_range_words(out->words, 0, group->order.N.d,
                              group->order.N.width, additional_data);
 }
 
-int ec_random_nonzero_scalar(const EC_GROUP *group, EC_SCALAR *out,
-                             const uint8_t additional_data[32]) {
+int bssl::ec_random_nonzero_scalar(const EC_GROUP *group, EC_SCALAR *out,
+                                   const uint8_t additional_data[32]) {
   return bn_rand_range_words(out->words, 1, group->order.N.d,
                              group->order.N.width, additional_data);
 }
 
-void ec_scalar_to_bytes(const EC_GROUP *group, uint8_t *out, size_t *out_len,
-                        const EC_SCALAR *in) {
+void bssl::ec_scalar_to_bytes(const EC_GROUP *group, uint8_t *out,
+                              size_t *out_len, const EC_SCALAR *in) {
   size_t len = BN_num_bytes(&group->order.N);
   bn_words_to_big_endian(out, len, in->words, group->order.N.width);
   *out_len = len;
 }
 
-int ec_scalar_from_bytes(const EC_GROUP *group, EC_SCALAR *out,
-                         const uint8_t *in, size_t len) {
+int bssl::ec_scalar_from_bytes(const EC_GROUP *group, EC_SCALAR *out,
+                               const uint8_t *in, size_t len) {
   if (len != BN_num_bytes(&group->order.N)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR);
     return 0;
@@ -85,8 +87,8 @@ int ec_scalar_from_bytes(const EC_GROUP *group, EC_SCALAR *out,
   return 1;
 }
 
-void ec_scalar_reduce(const EC_GROUP *group, EC_SCALAR *out,
-                      const BN_ULONG *words, size_t num) {
+void bssl::ec_scalar_reduce(const EC_GROUP *group, EC_SCALAR *out,
+                            const BN_ULONG *words, size_t num) {
   // Convert "from" Montgomery form so the value is reduced modulo the order.
   bn_from_montgomery_small(out->words, group->order.N.width, words, num,
                            &group->order);
@@ -94,64 +96,66 @@ void ec_scalar_reduce(const EC_GROUP *group, EC_SCALAR *out,
   ec_scalar_to_montgomery(group, out, out);
 }
 
-void ec_scalar_add(const EC_GROUP *group, EC_SCALAR *r, const EC_SCALAR *a,
-                   const EC_SCALAR *b) {
+void bssl::ec_scalar_add(const EC_GROUP *group, EC_SCALAR *r,
+                         const EC_SCALAR *a, const EC_SCALAR *b) {
   const BIGNUM *order = &group->order.N;
   BN_ULONG tmp[EC_MAX_WORDS];
   bn_mod_add_words(r->words, a->words, b->words, order->d, tmp, order->width);
   OPENSSL_cleanse(tmp, sizeof(tmp));
 }
 
-void ec_scalar_sub(const EC_GROUP *group, EC_SCALAR *r, const EC_SCALAR *a,
-                   const EC_SCALAR *b) {
+void bssl::ec_scalar_sub(const EC_GROUP *group, EC_SCALAR *r,
+                         const EC_SCALAR *a, const EC_SCALAR *b) {
   const BIGNUM *order = &group->order.N;
   BN_ULONG tmp[EC_MAX_WORDS];
   bn_mod_sub_words(r->words, a->words, b->words, order->d, tmp, order->width);
   OPENSSL_cleanse(tmp, sizeof(tmp));
 }
 
-void ec_scalar_neg(const EC_GROUP *group, EC_SCALAR *r, const EC_SCALAR *a) {
+void bssl::ec_scalar_neg(const EC_GROUP *group, EC_SCALAR *r,
+                         const EC_SCALAR *a) {
   EC_SCALAR zero;
   OPENSSL_memset(&zero, 0, sizeof(EC_SCALAR));
   ec_scalar_sub(group, r, &zero, a);
 }
 
-void ec_scalar_select(const EC_GROUP *group, EC_SCALAR *out, BN_ULONG mask,
-                      const EC_SCALAR *a, const EC_SCALAR *b) {
+void bssl::ec_scalar_select(const EC_GROUP *group, EC_SCALAR *out,
+                            BN_ULONG mask, const EC_SCALAR *a,
+                            const EC_SCALAR *b) {
   const BIGNUM *order = &group->order.N;
   bn_select_words(out->words, mask, a->words, b->words, order->width);
 }
 
-void ec_scalar_to_montgomery(const EC_GROUP *group, EC_SCALAR *r,
-                             const EC_SCALAR *a) {
+void bssl::ec_scalar_to_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                   const EC_SCALAR *a) {
   const BIGNUM *order = &group->order.N;
   bn_to_montgomery_small(r->words, a->words, order->width, &group->order);
 }
 
-void ec_scalar_from_montgomery(const EC_GROUP *group, EC_SCALAR *r,
-                               const EC_SCALAR *a) {
+void bssl::ec_scalar_from_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                     const EC_SCALAR *a) {
   const BIGNUM *order = &group->order.N;
   bn_from_montgomery_small(r->words, order->width, a->words, order->width,
                            &group->order);
 }
 
-void ec_scalar_mul_montgomery(const EC_GROUP *group, EC_SCALAR *r,
-                              const EC_SCALAR *a, const EC_SCALAR *b) {
+void bssl::ec_scalar_mul_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                    const EC_SCALAR *a, const EC_SCALAR *b) {
   const BIGNUM *order = &group->order.N;
   bn_mod_mul_montgomery_small(r->words, a->words, b->words, order->width,
                               &group->order);
 }
 
-void ec_simple_scalar_inv0_montgomery(const EC_GROUP *group, EC_SCALAR *r,
-                                      const EC_SCALAR *a) {
+void bssl::ec_simple_scalar_inv0_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                            const EC_SCALAR *a) {
   const BIGNUM *order = &group->order.N;
   bn_mod_inverse0_prime_mont_small(r->words, a->words, order->width,
                                    &group->order);
 }
 
-int ec_simple_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
-                                               EC_SCALAR *r,
-                                               const EC_SCALAR *a) {
+int bssl::ec_simple_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
+                                                     EC_SCALAR *r,
+                                                     const EC_SCALAR *a) {
   if (ec_scalar_is_zero(group, a)) {
     return 0;
   }
@@ -160,20 +164,21 @@ int ec_simple_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
   // even though for this interface it is not mandatory.
 
   // r = a^-1 in the Montgomery domain. This is
-  // |ec_scalar_to_montgomery| followed by |ec_scalar_inv0_montgomery|, but
-  // |ec_scalar_inv0_montgomery| followed by |ec_scalar_from_montgomery| is
+  // `ec_scalar_to_montgomery` followed by `ec_scalar_inv0_montgomery`, but
+  // `ec_scalar_inv0_montgomery` followed by `ec_scalar_from_montgomery` is
   // equivalent and slightly more efficient.
   ec_scalar_inv0_montgomery(group, r, a);
   ec_scalar_from_montgomery(group, r, r);
   return 1;
 }
 
-void ec_scalar_inv0_montgomery(const EC_GROUP *group, EC_SCALAR *r,
-                               const EC_SCALAR *a) {
+void bssl::ec_scalar_inv0_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                     const EC_SCALAR *a) {
   group->meth->scalar_inv0_montgomery(group, r, a);
 }
 
-int ec_scalar_to_montgomery_inv_vartime(const EC_GROUP *group, EC_SCALAR *r,
-                                        const EC_SCALAR *a) {
+int bssl::ec_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
+                                              EC_SCALAR *r,
+                                              const EC_SCALAR *a) {
   return group->meth->scalar_to_montgomery_inv_vartime(group, r, a);
 }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/simple.cc.inc

@@ -21,13 +21,15 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../../internal.h"
+#include "internal.h"
+
 
+using namespace bssl;
 
 // Most method functions in this file are designed to work with non-trivial
-// representations of field elements if necessary (see ecp_mont.c): while
-// standard modular addition and subtraction are used, the field_mul and
+// representations of field elements if necessary (see ec_montgomery.cc.inc):
+// while standard modular addition and subtraction are used, the field_mul and
 // field_sqr methods will be used for multiplication, and field_encode and
 // field_decode (if defined) will be used for converting between
 // representations.
@@ -35,17 +37,20 @@
 // Functions here specifically assume that if a non-trivial representation is
 // used, it is a Montgomery representation (i.e. 'encoding' means multiplying
 // by some factor R).
+//
+// TODO(crbug.com/505908440): ec_montgomery.cc.inc is now the only field element
+// representation. Fold these files together.
 
-int ec_GFp_simple_group_set_curve(EC_GROUP *group, const BIGNUM *p,
-                                  const BIGNUM *a, const BIGNUM *b,
-                                  BN_CTX *ctx) {
+int bssl::ec_GFp_simple_group_set_curve(EC_GROUP *group, const BIGNUM *p,
+                                        const BIGNUM *a, const BIGNUM *b,
+                                        BN_CTX *ctx) {
   // p must be a prime > 3
   if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FIELD);
     return 0;
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   if (tmp == nullptr) {
     return 0;
@@ -69,46 +74,46 @@ int ec_GFp_simple_group_set_curve(EC_GROUP *group, const BIGNUM *p,
   return 1;
 }
 
-int ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
-                                  BIGNUM *b) {
-  if ((p != NULL && !BN_copy(p, &group->field.N)) ||
-      (a != NULL && !ec_felem_to_bignum(group, a, &group->a)) ||
-      (b != NULL && !ec_felem_to_bignum(group, b, &group->b))) {
+int bssl::ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p,
+                                        BIGNUM *a, BIGNUM *b) {
+  if ((p != nullptr && !BN_copy(p, &group->field.N)) ||
+      (a != nullptr && !ec_felem_to_bignum(group, a, &group->a)) ||
+      (b != nullptr && !ec_felem_to_bignum(group, b, &group->b))) {
     return 0;
   }
   return 1;
 }
 
-void ec_GFp_simple_point_init(EC_JACOBIAN *point) {
+void bssl::ec_GFp_simple_point_init(EC_JACOBIAN *point) {
   OPENSSL_memset(&point->X, 0, sizeof(EC_FELEM));
   OPENSSL_memset(&point->Y, 0, sizeof(EC_FELEM));
   OPENSSL_memset(&point->Z, 0, sizeof(EC_FELEM));
 }
 
-void ec_GFp_simple_point_copy(EC_JACOBIAN *dest, const EC_JACOBIAN *src) {
+void bssl::ec_GFp_simple_point_copy(EC_JACOBIAN *dest, const EC_JACOBIAN *src) {
   OPENSSL_memcpy(&dest->X, &src->X, sizeof(EC_FELEM));
   OPENSSL_memcpy(&dest->Y, &src->Y, sizeof(EC_FELEM));
   OPENSSL_memcpy(&dest->Z, &src->Z, sizeof(EC_FELEM));
 }
 
-void ec_GFp_simple_point_set_to_infinity(const EC_GROUP *group,
-                                         EC_JACOBIAN *point) {
+void bssl::ec_GFp_simple_point_set_to_infinity(const EC_GROUP *group,
+                                               EC_JACOBIAN *point) {
   // Although it is strictly only necessary to zero Z, we zero the entire point
-  // in case |point| was stack-allocated and yet to be initialized.
+  // in case `point` was stack-allocated and yet to be initialized.
   ec_GFp_simple_point_init(point);
 }
 
-void ec_GFp_simple_invert(const EC_GROUP *group, EC_JACOBIAN *point) {
+void bssl::ec_GFp_simple_invert(const EC_GROUP *group, EC_JACOBIAN *point) {
   ec_felem_neg(group, &point->Y, &point->Y);
 }
 
-int ec_GFp_simple_is_at_infinity(const EC_GROUP *group,
-                                 const EC_JACOBIAN *point) {
+int bssl::ec_GFp_simple_is_at_infinity(const EC_GROUP *group,
+                                       const EC_JACOBIAN *point) {
   return ec_felem_non_zero_mask(group, &point->Z) == 0;
 }
 
-int ec_GFp_simple_is_on_curve(const EC_GROUP *group,
-                              const EC_JACOBIAN *point) {
+int bssl::ec_GFp_simple_is_on_curve(const EC_GROUP *group,
+                                    const EC_JACOBIAN *point) {
   // We have a curve defined by a Weierstrass equation
   //      y^2 = x^3 + a*x + b.
   // The point to consider is given in Jacobian projective coordinates
@@ -121,19 +126,14 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group,
   // This function may be used when double-checking the secret result of a point
   // multiplication, so we proceed in constant-time.
 
-  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
-                          const EC_FELEM *b) = group->meth->felem_mul;
-  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
-      group->meth->felem_sqr;
-
   // rh := X^2
   EC_FELEM rh;
-  felem_sqr(group, &rh, &point->X);
+  ec_felem_sqr(group, &rh, &point->X);
 
   EC_FELEM tmp, Z4, Z6;
-  felem_sqr(group, &tmp, &point->Z);
-  felem_sqr(group, &Z4, &tmp);
-  felem_mul(group, &Z6, &Z4, &tmp);
+  ec_felem_sqr(group, &tmp, &point->Z);
+  ec_felem_sqr(group, &Z4, &tmp);
+  ec_felem_mul(group, &Z6, &Z4, &tmp);
 
   // rh := rh + a*Z^4
   if (group->a_is_minus3) {
@@ -141,19 +141,19 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group,
     ec_felem_add(group, &tmp, &tmp, &Z4);
     ec_felem_sub(group, &rh, &rh, &tmp);
   } else {
-    felem_mul(group, &tmp, &Z4, &group->a);
+    ec_felem_mul(group, &tmp, &Z4, &group->a);
     ec_felem_add(group, &rh, &rh, &tmp);
   }
 
   // rh := (rh + a*Z^4)*X
-  felem_mul(group, &rh, &rh, &point->X);
+  ec_felem_mul(group, &rh, &rh, &point->X);
 
   // rh := rh + b*Z^6
-  felem_mul(group, &tmp, &group->b, &Z6);
+  ec_felem_mul(group, &tmp, &group->b, &Z6);
   ec_felem_add(group, &rh, &rh, &tmp);
 
   // 'lh' := Y^2
-  felem_sqr(group, &tmp, &point->Y);
+  ec_felem_sqr(group, &tmp, &point->Y);
 
   ec_felem_sub(group, &tmp, &tmp, &rh);
   BN_ULONG not_equal = ec_felem_non_zero_mask(group, &tmp);
@@ -164,8 +164,9 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group,
   return 1 & ~(not_infinity & not_equal);
 }
 
-int ec_GFp_simple_points_equal(const EC_GROUP *group, const EC_JACOBIAN *a,
-                               const EC_JACOBIAN *b) {
+int bssl::ec_GFp_simple_points_equal(const EC_GROUP *group,
+                                     const EC_JACOBIAN *a,
+                                     const EC_JACOBIAN *b) {
   // This function is implemented in constant-time for two reasons. First,
   // although EC points are usually public, their Jacobian Z coordinates may be
   // secret, or at least are not obviously public. Second, more complex
@@ -176,28 +177,23 @@ int ec_GFp_simple_points_equal(const EC_GROUP *group, const EC_JACOBIAN *a,
   // restore this optimization by keeping better track of affine vs. Jacobian
   // forms. See https://crbug.com/boringssl/326.
 
-  // If neither |a| or |b| is infinity, we have to decide whether
+  // If neither `a` or `b` is infinity, we have to decide whether
   //     (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3),
   // or equivalently, whether
   //     (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3).
 
-  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
-                          const EC_FELEM *b) = group->meth->felem_mul;
-  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
-      group->meth->felem_sqr;
-
   EC_FELEM tmp1, tmp2, Za23, Zb23;
-  felem_sqr(group, &Zb23, &b->Z);         // Zb23 = Z_b^2
-  felem_mul(group, &tmp1, &a->X, &Zb23);  // tmp1 = X_a * Z_b^2
-  felem_sqr(group, &Za23, &a->Z);         // Za23 = Z_a^2
-  felem_mul(group, &tmp2, &b->X, &Za23);  // tmp2 = X_b * Z_a^2
+  ec_felem_sqr(group, &Zb23, &b->Z);         // Zb23 = Z_b^2
+  ec_felem_mul(group, &tmp1, &a->X, &Zb23);  // tmp1 = X_a * Z_b^2
+  ec_felem_sqr(group, &Za23, &a->Z);         // Za23 = Z_a^2
+  ec_felem_mul(group, &tmp2, &b->X, &Za23);  // tmp2 = X_b * Z_a^2
   ec_felem_sub(group, &tmp1, &tmp1, &tmp2);
   const BN_ULONG x_not_equal = ec_felem_non_zero_mask(group, &tmp1);
 
-  felem_mul(group, &Zb23, &Zb23, &b->Z);  // Zb23 = Z_b^3
-  felem_mul(group, &tmp1, &a->Y, &Zb23);  // tmp1 = Y_a * Z_b^3
-  felem_mul(group, &Za23, &Za23, &a->Z);  // Za23 = Z_a^3
-  felem_mul(group, &tmp2, &b->Y, &Za23);  // tmp2 = Y_b * Z_a^3
+  ec_felem_mul(group, &Zb23, &Zb23, &b->Z);  // Zb23 = Z_b^3
+  ec_felem_mul(group, &tmp1, &a->Y, &Zb23);  // tmp1 = Y_a * Z_b^3
+  ec_felem_mul(group, &Za23, &Za23, &a->Z);  // Za23 = Z_a^3
+  ec_felem_mul(group, &tmp2, &b->Y, &Za23);  // tmp2 = Y_b * Z_a^3
   ec_felem_sub(group, &tmp1, &tmp1, &tmp2);
   const BN_ULONG y_not_equal = ec_felem_non_zero_mask(group, &tmp1);
   const BN_ULONG x_and_y_equal = ~(x_not_equal | y_not_equal);
@@ -211,26 +207,21 @@ int ec_GFp_simple_points_equal(const EC_GROUP *group, const EC_JACOBIAN *a,
   return equal & 1;
 }
 
-int ec_affine_jacobian_equal(const EC_GROUP *group, const EC_AFFINE *a,
-                             const EC_JACOBIAN *b) {
-  // If |b| is not infinity, we have to decide whether
+int bssl::ec_affine_jacobian_equal(const EC_GROUP *group, const EC_AFFINE *a,
+                                   const EC_JACOBIAN *b) {
+  // If `b` is not infinity, we have to decide whether
   //     (X_a, Y_a) = (X_b/Z_b^2, Y_b/Z_b^3),
   // or equivalently, whether
   //     (X_a*Z_b^2, Y_a*Z_b^3) = (X_b, Y_b).
 
-  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
-                          const EC_FELEM *b) = group->meth->felem_mul;
-  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
-      group->meth->felem_sqr;
-
   EC_FELEM tmp, Zb2;
-  felem_sqr(group, &Zb2, &b->Z);        // Zb2 = Z_b^2
-  felem_mul(group, &tmp, &a->X, &Zb2);  // tmp = X_a * Z_b^2
+  ec_felem_sqr(group, &Zb2, &b->Z);        // Zb2 = Z_b^2
+  ec_felem_mul(group, &tmp, &a->X, &Zb2);  // tmp = X_a * Z_b^2
   ec_felem_sub(group, &tmp, &tmp, &b->X);
   const BN_ULONG x_not_equal = ec_felem_non_zero_mask(group, &tmp);
 
-  felem_mul(group, &tmp, &a->Y, &Zb2);  // tmp = Y_a * Z_b^2
-  felem_mul(group, &tmp, &tmp, &b->Z);  // tmp = Y_a * Z_b^3
+  ec_felem_mul(group, &tmp, &a->Y, &Zb2);  // tmp = Y_a * Z_b^2
+  ec_felem_mul(group, &tmp, &tmp, &b->Z);  // tmp = Y_a * Z_b^3
   ec_felem_sub(group, &tmp, &tmp, &b->Y);
   const BN_ULONG y_not_equal = ec_felem_non_zero_mask(group, &tmp);
   const BN_ULONG x_and_y_equal = ~(x_not_equal | y_not_equal);
@@ -241,10 +232,11 @@ int ec_affine_jacobian_equal(const EC_GROUP *group, const EC_AFFINE *a,
   return equal & 1;
 }
 
-int ec_GFp_simple_cmp_x_coordinate(const EC_GROUP *group, const EC_JACOBIAN *p,
-                                   const EC_SCALAR *r) {
+int bssl::ec_GFp_simple_cmp_x_coordinate(const EC_GROUP *group,
+                                         const EC_JACOBIAN *p,
+                                         const EC_SCALAR *r) {
   if (ec_GFp_simple_is_at_infinity(group, p)) {
-    // |ec_get_x_coordinate_as_scalar| will check this internally, but this way
+    // `ec_get_x_coordinate_as_scalar` will check this internally, but this way
     // we do not push to the error queue.
     return 0;
   }
@@ -253,27 +245,3 @@ int ec_GFp_simple_cmp_x_coordinate(const EC_GROUP *group, const EC_JACOBIAN *p,
   return ec_get_x_coordinate_as_scalar(group, &x, p) &&
          ec_scalar_equal_vartime(group, &x, r);
 }
-
-void ec_GFp_simple_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
-                                  size_t *out_len, const EC_FELEM *in) {
-  size_t len = BN_num_bytes(&group->field.N);
-  bn_words_to_big_endian(out, len, in->words, group->field.N.width);
-  *out_len = len;
-}
-
-int ec_GFp_simple_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out,
-                                   const uint8_t *in, size_t len) {
-  if (len != BN_num_bytes(&group->field.N)) {
-    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
-    return 0;
-  }
-
-  bn_big_endian_to_words(out->words, group->field.N.width, in, len);
-
-  if (!bn_less_than_words(out->words, group->field.N.d, group->field.N.width)) {
-    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
-    return 0;
-  }
-
-  return 1;
-}