grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/simple_mul.cc.inc

@@ -16,22 +16,27 @@
 
 #include <assert.h>
 
+#include <iterator>
+#include <type_traits>
+
 #include "internal.h"
 #include "../bn/internal.h"
 #include "../../internal.h"
 
 
-void ec_GFp_mont_mul(const EC_GROUP *group, EC_JACOBIAN *r,
-                     const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
+using namespace bssl;
+
+void bssl::ec_GFp_mont_mul(const EC_GROUP *group, EC_JACOBIAN *r,
+                           const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
   // This is a generic implementation for uncommon curves that not do not
   // warrant a tuned one. It uses unsigned digits so that the doubling case in
-  // |ec_GFp_mont_add| is always unreachable, erring on safety and simplicity.
+  // `ec_GFp_mont_add` is always unreachable, erring on safety and simplicity.
 
-  // Compute a table of the first 32 multiples of |p| (including infinity).
+  // Compute a table of the first 32 multiples of `p` (including infinity).
   EC_JACOBIAN precomp[32];
   ec_GFp_simple_point_set_to_infinity(group, &precomp[0]);
   ec_GFp_simple_point_copy(&precomp[1], p);
-  for (size_t j = 2; j < OPENSSL_ARRAY_SIZE(precomp); j++) {
+  for (size_t j = 2; j < std::size(precomp); j++) {
     if (j & 1) {
       ec_GFp_mont_add(group, &precomp[j], &precomp[1], &precomp[j - 1]);
     } else {
@@ -39,7 +44,7 @@ void ec_GFp_mont_mul(const EC_GROUP *group, EC_JACOBIAN *r,
     }
   }
 
-  // Divide bits in |scalar| into windows.
+  // Divide bits in `scalar` into windows.
   unsigned bits =  EC_GROUP_order_bits(group);
   int r_is_at_infinity = 1;
   for (unsigned i = bits - 1; i < bits; i--) {
@@ -58,7 +63,7 @@ void ec_GFp_mont_mul(const EC_GROUP *group, EC_JACOBIAN *r,
       // Select the entry in constant-time.
       EC_JACOBIAN tmp;
       OPENSSL_memset(&tmp, 0, sizeof(EC_JACOBIAN));
-      for (size_t j = 0; j < OPENSSL_ARRAY_SIZE(precomp); j++) {
+      for (size_t j = 0; j < std::size(precomp); j++) {
         BN_ULONG mask = constant_time_eq_w(j, window);
         ec_point_select(group, &tmp, mask, &precomp[j], &tmp);
       }
@@ -76,8 +81,8 @@ void ec_GFp_mont_mul(const EC_GROUP *group, EC_JACOBIAN *r,
   }
 }
 
-void ec_GFp_mont_mul_base(const EC_GROUP *group, EC_JACOBIAN *r,
-                          const EC_SCALAR *scalar) {
+void bssl::ec_GFp_mont_mul_base(const EC_GROUP *group, EC_JACOBIAN *r,
+                                const EC_SCALAR *scalar) {
   ec_GFp_mont_mul(group, r, &group->generator.raw, scalar);
 }
 
@@ -126,18 +131,18 @@ static void ec_GFp_mont_batch_get_window(const EC_GROUP *group,
   ec_felem_select(group, &out->Y, sign_mask, &neg_Y, &out->Y);
 }
 
-void ec_GFp_mont_mul_batch(const EC_GROUP *group, EC_JACOBIAN *r,
-                           const EC_JACOBIAN *p0, const EC_SCALAR *scalar0,
-                           const EC_JACOBIAN *p1, const EC_SCALAR *scalar1,
-                           const EC_JACOBIAN *p2, const EC_SCALAR *scalar2) {
+void bssl::ec_GFp_mont_mul_batch(
+    const EC_GROUP *group, EC_JACOBIAN *r, const EC_JACOBIAN *p0,
+    const EC_SCALAR *scalar0, const EC_JACOBIAN *p1, const EC_SCALAR *scalar1,
+    const EC_JACOBIAN *p2, const EC_SCALAR *scalar2) {
   EC_JACOBIAN precomp[3][17];
   ec_GFp_mont_batch_precomp(group, precomp[0], 17, p0);
   ec_GFp_mont_batch_precomp(group, precomp[1], 17, p1);
-  if (p2 != NULL) {
+  if (p2 != nullptr) {
     ec_GFp_mont_batch_precomp(group, precomp[2], 17, p2);
   }
 
-  // Divide bits in |scalar| into windows.
+  // Divide bits in `scalar` into windows.
   unsigned bits = EC_GROUP_order_bits(group);
   int r_is_at_infinity = 1;
   for (unsigned i = bits; i <= bits; i--) {
@@ -157,7 +162,7 @@ void ec_GFp_mont_mul_batch(const EC_GROUP *group, EC_JACOBIAN *r,
       ec_GFp_mont_batch_get_window(group, &tmp, precomp[1], scalar1, i);
       ec_GFp_mont_add(group, r, r, &tmp);
 
-      if (p2 != NULL) {
+      if (p2 != nullptr) {
         ec_GFp_mont_batch_get_window(group, &tmp, precomp[2], scalar2, i);
         ec_GFp_mont_add(group, r, r, &tmp);
       }
@@ -173,12 +178,12 @@ static unsigned ec_GFp_mont_comb_stride(const EC_GROUP *group) {
          EC_MONT_PRECOMP_COMB_SIZE;
 }
 
-int ec_GFp_mont_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
-                             const EC_JACOBIAN *p) {
+int bssl::ec_GFp_mont_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
+                                   const EC_JACOBIAN *p) {
   // comb[i - 1] stores the ith element of the comb. That is, if i is
   // b4 * 2^4 + b3 * 2^3 + ... + b0 * 2^0, it stores k * |p|, where k is
   // b4 * 2^(4*stride) + b3 * 2^(3*stride) + ... + b0 * 2^(0*stride). stride
-  // here is |ec_GFp_mont_comb_stride|. We store at index i - 1 because the 0th
+  // here is `ec_GFp_mont_comb_stride`. We store at index i - 1 because the 0th
   // comb entry is always infinity.
   EC_JACOBIAN comb[(1 << EC_MONT_PRECOMP_COMB_SIZE) - 1];
   unsigned stride = ec_GFp_mont_comb_stride(group);
@@ -187,7 +192,7 @@ int ec_GFp_mont_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
   // entries up to 2^0 are filled.
   comb[(1 << 0) - 1] = *p;
   for (unsigned i = 1; i < EC_MONT_PRECOMP_COMB_SIZE; i++) {
-    // Compute entry 2^i by doubling the entry for 2^(i-1) |stride| times.
+    // Compute entry 2^i by doubling the entry for 2^(i-1) `stride` times.
     unsigned bit = 1 << i;
     ec_GFp_mont_dbl(group, &comb[bit - 1], &comb[bit / 2 - 1]);
     for (unsigned j = 1; j < stride; j++) {
@@ -202,10 +207,10 @@ int ec_GFp_mont_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
 
   // Store the comb in affine coordinates to shrink the table. (This reduces
   // cache pressure and makes the constant-time selects faster.)
-  static_assert(OPENSSL_ARRAY_SIZE(comb) == OPENSSL_ARRAY_SIZE(out->comb),
-                "comb sizes did not match");
-  return ec_jacobian_to_affine_batch(group, out->comb, comb,
-                                     OPENSSL_ARRAY_SIZE(comb));
+  static_assert(
+      std::extent_v<decltype(comb)> == std::extent_v<decltype(out->comb)>,
+      "comb sizes did not match");
+  return ec_jacobian_to_affine_batch(group, out->comb, comb, std::size(comb));
 }
 
 static void ec_GFp_mont_get_comb_window(const EC_GROUP *group,
@@ -214,17 +219,17 @@ static void ec_GFp_mont_get_comb_window(const EC_GROUP *group,
                                         const EC_SCALAR *scalar, unsigned i) {
   const size_t width = group->order.N.width;
   unsigned stride = ec_GFp_mont_comb_stride(group);
-  // Select the bits corresponding to the comb shifted up by |i|.
+  // Select the bits corresponding to the comb shifted up by `i`.
   unsigned window = 0;
   for (unsigned j = 0; j < EC_MONT_PRECOMP_COMB_SIZE; j++) {
     window |= bn_is_bit_set_words(scalar->words, width, j * stride + i)
               << j;
   }
 
-  // Select precomp->comb[window - 1]. If |window| is zero, |match| will always
-  // be zero, which will leave |out| at infinity.
+  // Select precomp->comb[window - 1]. If `window` is zero, `match` will always
+  // be zero, which will leave `out` at infinity.
   OPENSSL_memset(out, 0, sizeof(EC_JACOBIAN));
-  for (unsigned j = 0; j < OPENSSL_ARRAY_SIZE(precomp->comb); j++) {
+  for (unsigned j = 0; j < std::size(precomp->comb); j++) {
     BN_ULONG match = constant_time_eq_w(window, j + 1);
     ec_felem_select(group, &out->X, match, &precomp->comb[j].X, &out->X);
     ec_felem_select(group, &out->Y, match, &precomp->comb[j].Y, &out->Y);
@@ -233,10 +238,10 @@ static void ec_GFp_mont_get_comb_window(const EC_GROUP *group,
   ec_felem_select(group, &out->Z, is_infinity, &out->Z, ec_felem_one(group));
 }
 
-void ec_GFp_mont_mul_precomp(const EC_GROUP *group, EC_JACOBIAN *r,
-                             const EC_PRECOMP *p0, const EC_SCALAR *scalar0,
-                             const EC_PRECOMP *p1, const EC_SCALAR *scalar1,
-                             const EC_PRECOMP *p2, const EC_SCALAR *scalar2) {
+void bssl::ec_GFp_mont_mul_precomp(
+    const EC_GROUP *group, EC_JACOBIAN *r, const EC_PRECOMP *p0,
+    const EC_SCALAR *scalar0, const EC_PRECOMP *p1, const EC_SCALAR *scalar1,
+    const EC_PRECOMP *p2, const EC_SCALAR *scalar2) {
   unsigned stride = ec_GFp_mont_comb_stride(group);
   int r_is_at_infinity = 1;
   for (unsigned i = stride - 1; i < stride; i--) {
@@ -253,12 +258,12 @@ void ec_GFp_mont_mul_precomp(const EC_GROUP *group, EC_JACOBIAN *r,
       ec_GFp_mont_add(group, r, r, &tmp);
     }
 
-    if (p1 != NULL) {
+    if (p1 != nullptr) {
       ec_GFp_mont_get_comb_window(group, &tmp, p1, scalar1, i);
       ec_GFp_mont_add(group, r, r, &tmp);
     }
 
-    if (p2 != NULL) {
+    if (p2 != nullptr) {
       ec_GFp_mont_get_comb_window(group, &tmp, p2, scalar2, i);
       ec_GFp_mont_add(group, r, r, &tmp);
     }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/util.cc.inc

@@ -19,6 +19,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 // This function looks at 5+1 scalar bits (5 current, 1 adjacent less
 // significant bit), and recodes them into a signed digit for use in fast point
 // multiplication: the use of signed rather than unsigned digits means that
@@ -108,7 +110,7 @@
 // is a prime that is much larger than 2^w. It also only holds when windows
 // are applied from most significant to least significant, doubling between each
 // window. It does not apply to more complex table strategies such as
-// |EC_GFp_nistz256_method|.
+// `EC_GFp_nistz256_method`.
 //
 // PROOF:
 //
@@ -240,8 +242,9 @@
 //   P-384: ...01110011; w = 2, 5, 6, 7 are okay
 //   P-256: ...01010001; w = 5, 7 are okay
 //   P-224: ...00111101; w = 3, 4, 5, 6 are okay
-void ec_GFp_nistp_recode_scalar_bits(crypto_word_t *sign, crypto_word_t *digit,
-                                     crypto_word_t in) {
+void bssl::ec_GFp_nistp_recode_scalar_bits(crypto_word_t *sign,
+                                           crypto_word_t *digit,
+                                           crypto_word_t in) {
   crypto_word_t s, d;
 
   s = ~((in >> 5) - 1); /* sets all bits to MSB(in), 'in' seen as

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ec/wnaf.cc.inc

@@ -18,23 +18,26 @@
 #include <assert.h>
 #include <string.h>
 
+#include <iterator>
+
 #include <openssl/bn.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/thread.h>
 
 #include "../../internal.h"
 #include "../bn/internal.h"
 #include "internal.h"
 
 
+using namespace bssl;
+
 // This file implements the wNAF-based interleaving multi-exponentiation method
 // at:
 //   http://link.springer.com/chapter/10.1007%2F3-540-45537-X_13
 //   http://www.bmoeller.de/pdf/TI-01-08.multiexp.pdf
 
-void ec_compute_wNAF(const EC_GROUP *group, int8_t *out,
-                     const EC_SCALAR *scalar, size_t bits, int w) {
+void bssl::ec_compute_wNAF(const EC_GROUP *group, int8_t *out,
+                           const EC_SCALAR *scalar, size_t bits, int w) {
   // 'int8_t' can represent integers with absolute values less than 2^7.
   assert(0 < w && w <= 7);
   assert(bits != 0);
@@ -82,8 +85,8 @@ void ec_compute_wNAF(const EC_GROUP *group, int8_t *out,
 
     out[j] = digit;
 
-    // Incorporate the next bit. Previously, |window_val| <= |next_bit|, so if
-    // we shift and add at most one copy of |bit|, this will continue to hold
+    // Incorporate the next bit. Previously, `window_val` <= `next_bit`, so if
+    // we shift and add at most one copy of `bit`, this will continue to hold
     // afterwards.
     window_val >>= 1;
     window_val += bit * bn_is_bit_set_words(scalar->words, group->order.N.width,
@@ -95,7 +98,7 @@ void ec_compute_wNAF(const EC_GROUP *group, int8_t *out,
   assert(window_val == 0);
 }
 
-// compute_precomp sets |out[i]| to (2*i+1)*p, for i from 0 to |len|.
+// compute_precomp sets `out[i]` to (2*i+1)*p, for i from 0 to `len`.
 static void compute_precomp(const EC_GROUP *group, EC_JACOBIAN *out,
                             const EC_JACOBIAN *p, size_t len) {
   ec_GFp_simple_point_copy(&out[0], p);
@@ -117,20 +120,20 @@ static void lookup_precomp(const EC_GROUP *group, EC_JACOBIAN *out,
   }
 }
 
-// EC_WNAF_WINDOW_BITS is the window size to use for |ec_GFp_mont_mul_public|.
+// EC_WNAF_WINDOW_BITS is the window size to use for `ec_GFp_mont_mul_public`.
 #define EC_WNAF_WINDOW_BITS 4
 
-// EC_WNAF_TABLE_SIZE is the table size to use for |ec_GFp_mont_mul_public|.
+// EC_WNAF_TABLE_SIZE is the table size to use for `ec_GFp_mont_mul_public`.
 #define EC_WNAF_TABLE_SIZE (1 << (EC_WNAF_WINDOW_BITS - 1))
 
 // EC_WNAF_STACK is the number of points worth of data to stack-allocate and
 // avoid a malloc.
 #define EC_WNAF_STACK 3
 
-int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
-                                 const EC_SCALAR *g_scalar,
-                                 const EC_JACOBIAN *points,
-                                 const EC_SCALAR *scalars, size_t num) {
+int bssl::ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
+                                       const EC_SCALAR *g_scalar,
+                                       const EC_JACOBIAN *points,
+                                       const EC_SCALAR *scalars, size_t num) {
   size_t bits = EC_GROUP_order_bits(group);
   size_t wNAF_len = bits + 1;
 
@@ -139,8 +142,8 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
   EC_JACOBIAN precomp_stack[EC_WNAF_STACK][EC_WNAF_TABLE_SIZE];
 
   // Allocated pointers, which will remain NULL unless needed.
-  EC_JACOBIAN(*precomp_alloc)[EC_WNAF_TABLE_SIZE] = NULL;
-  int8_t(*wNAF_alloc)[EC_MAX_BYTES * 8 + 1] = NULL;
+  EC_JACOBIAN(*precomp_alloc)[EC_WNAF_TABLE_SIZE] = nullptr;
+  int8_t (*wNAF_alloc)[EC_MAX_BYTES * 8 + 1] = nullptr;
 
   // These fields point either to the stack or heap buffers of the same name.
   int8_t(*wNAF)[EC_MAX_BYTES * 8 + 1];
@@ -152,12 +155,12 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
   } else {
     wNAF_alloc = reinterpret_cast<decltype(wNAF_alloc)>(
         OPENSSL_calloc(num, sizeof(wNAF_alloc[0])));
-    if (wNAF_alloc == NULL) {
+    if (wNAF_alloc == nullptr) {
       return 0;
     }
     precomp_alloc = reinterpret_cast<decltype(precomp_alloc)>(
         OPENSSL_calloc(num, sizeof(precomp_alloc[0])));
-    if (precomp_alloc == NULL) {
+    if (precomp_alloc == nullptr) {
       OPENSSL_free(wNAF_alloc);
       return 0;
     }
@@ -168,15 +171,15 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
 
   int8_t g_wNAF[EC_MAX_BYTES * 8 + 1];
   EC_JACOBIAN g_precomp[EC_WNAF_TABLE_SIZE];
-  assert(wNAF_len <= OPENSSL_ARRAY_SIZE(g_wNAF));
+  assert(wNAF_len <= std::size(g_wNAF));
   const EC_JACOBIAN *g = &group->generator.raw;
-  if (g_scalar != NULL) {
+  if (g_scalar != nullptr) {
     ec_compute_wNAF(group, g_wNAF, g_scalar, bits, EC_WNAF_WINDOW_BITS);
     compute_precomp(group, g_precomp, g, EC_WNAF_TABLE_SIZE);
   }
 
   for (size_t i = 0; i < num; i++) {
-    assert(wNAF_len <= OPENSSL_ARRAY_SIZE(wNAF[i]));
+    assert(wNAF_len <= std::size(wNAF[i]));
     ec_compute_wNAF(group, wNAF[i], &scalars[i], bits, EC_WNAF_WINDOW_BITS);
     compute_precomp(group, precomp[i], &points[i], EC_WNAF_TABLE_SIZE);
   }
@@ -188,7 +191,7 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
       ec_GFp_mont_dbl(group, r, r);
     }
 
-    if (g_scalar != NULL && g_wNAF[k] != 0) {
+    if (g_scalar != nullptr && g_wNAF[k] != 0) {
       lookup_precomp(group, &tmp, g_precomp, g_wNAF[k]);
       if (r_is_at_infinity) {
         ec_GFp_simple_point_copy(r, &tmp);

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ecdh/ecdh.cc.inc

@@ -23,21 +23,24 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../ec/internal.h"
 #include "../service_indicator/internal.h"
 
 
+using namespace bssl;
+
 int ECDH_compute_key_fips(uint8_t *out, size_t out_len, const EC_POINT *pub_key,
                           const EC_KEY *priv_key) {
   boringssl_ensure_ecc_self_test();
 
-  if (priv_key->priv_key == NULL) {
+  if (FromOpaque(priv_key)->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDH, ECDH_R_NO_PRIVATE_VALUE);
     return 0;
   }
-  const EC_SCALAR *const priv = &priv_key->priv_key->scalar;
+  const EC_SCALAR *const priv = &FromOpaque(priv_key)->priv_key->scalar;
   const EC_GROUP *const group = EC_KEY_get0_group(priv_key);
-  if (EC_GROUP_cmp(group, pub_key->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, pub_key->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ecdsa/ecdsa.cc.inc

@@ -22,13 +22,16 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../bn/internal.h"
 #include "../ec/internal.h"
 #include "../service_indicator/internal.h"
 #include "internal.h"
 
 
-// digest_to_scalar interprets |digest_len| bytes from |digest| as a scalar for
+using namespace bssl;
+
+// digest_to_scalar interprets `digest_len` bytes from `digest` as a scalar for
 // ECDSA.
 static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                              const uint8_t *digest, size_t digest_len) {
@@ -46,8 +49,8 @@ static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
     bn_rshift_words(out->words, out->words, 8 - (num_bits & 0x7), order->width);
   }
 
-  // |out| now has the same bit width as |order|, but this only bounds by
-  // 2*|order|. Subtract the order if out of range.
+  // `out` now has the same bit width as `order`, but this only bounds by
+  // 2*`order`. Subtract the order if out of range.
   //
   // Montgomery multiplication accepts the looser bounds, so this isn't strictly
   // necessary, but it is a cleaner abstraction and has no performance impact.
@@ -56,12 +59,12 @@ static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                           order->width);
 }
 
-int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
-                                    const uint8_t *sig, size_t sig_len,
-                                    const EC_KEY *eckey) {
+int bssl::ecdsa_verify_fixed_no_self_test(const uint8_t *digest,
+                                          size_t digest_len, const uint8_t *sig,
+                                          size_t sig_len, const EC_KEY *eckey) {
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   const EC_POINT *pub_key = EC_KEY_get0_public_key(eckey);
-  if (group == NULL || pub_key == NULL || sig == NULL) {
+  if (group == nullptr || pub_key == nullptr || sig == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_MISSING_PARAMETERS);
     return 0;
   }
@@ -86,8 +89,8 @@ int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
   // u1 = m * s^-1 mod order
   // u2 = r * s^-1 mod order
   //
-  // |s_inv_mont| is in Montgomery form while |m| and |r| are not, so |u1| and
-  // |u2| will be taken out of Montgomery form, as desired.
+  // `s_inv_mont` is in Montgomery form while `m` and `r` are not, so `u1` and
+  // `u2` will be taken out of Montgomery form, as desired.
   digest_to_scalar(group, &m, digest, digest_len);
   ec_scalar_mul_montgomery(group, &u1, &m, &s_inv_mont);
   ec_scalar_mul_montgomery(group, &u2, &r, &s_inv_mont);
@@ -106,8 +109,9 @@ int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
   return 1;
 }
 
-int ecdsa_verify_fixed(const uint8_t *digest, size_t digest_len,
-                       const uint8_t *sig, size_t sig_len, const EC_KEY *key) {
+int bssl::ecdsa_verify_fixed(const uint8_t *digest, size_t digest_len,
+                             const uint8_t *sig, size_t sig_len,
+                             const EC_KEY *key) {
   boringssl_ensure_ecc_self_test();
 
   return ecdsa_verify_fixed_no_self_test(digest, digest_len, sig, sig_len, key);
@@ -119,14 +123,7 @@ static int ecdsa_sign_impl(const EC_GROUP *group, int *out_retry, uint8_t *sig,
                            const uint8_t *digest, size_t digest_len) {
   *out_retry = 0;
 
-  // Check that the size of the group order is FIPS compliant (FIPS 186-4
-  // B.5.2).
   const BIGNUM *order = EC_GROUP_get0_order(group);
-  if (BN_num_bits(order) < 160) {
-    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
-    return 0;
-  }
-
   size_t sig_len = 2 * BN_num_bytes(order);
   if (sig_len > max_sig_len) {
     OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
@@ -147,7 +144,7 @@ static int ecdsa_sign_impl(const EC_GROUP *group, int *out_retry, uint8_t *sig,
   }
 
   // s = priv_key * r. Note if only one parameter is in the Montgomery domain,
-  // |ec_scalar_mod_mul_montgomery| will compute the answer in the normal
+  // `ec_scalar_mod_mul_montgomery` will compute the answer in the normal
   // domain.
   EC_SCALAR s;
   ec_scalar_to_montgomery(group, &s, &r);
@@ -159,9 +156,9 @@ static int ecdsa_sign_impl(const EC_GROUP *group, int *out_retry, uint8_t *sig,
   ec_scalar_add(group, &s, &s, &tmp);
 
   // s = k^-1 * (m + priv_key * r). First, we compute k^-1 in the Montgomery
-  // domain. This is |ec_scalar_to_montgomery| followed by
-  // |ec_scalar_inv0_montgomery|, but |ec_scalar_inv0_montgomery| followed by
-  // |ec_scalar_from_montgomery| is equivalent and slightly more efficient.
+  // domain. This is `ec_scalar_to_montgomery` followed by
+  // `ec_scalar_inv0_montgomery`, but `ec_scalar_inv0_montgomery` followed by
+  // `ec_scalar_from_montgomery` is equivalent and slightly more efficient.
   // Then, as above, only one parameter is in the Montgomery domain, so the
   // result is in the normal domain. Finally, note k is non-zero (or computing r
   // would fail), so the inverse must exist.
@@ -184,21 +181,23 @@ static int ecdsa_sign_impl(const EC_GROUP *group, int *out_retry, uint8_t *sig,
   return 1;
 }
 
-int ecdsa_sign_fixed_with_nonce_for_known_answer_test(
+int bssl::ecdsa_sign_fixed_with_nonce_for_known_answer_test(
     const uint8_t *digest, size_t digest_len, uint8_t *sig, size_t *out_sig_len,
     size_t max_sig_len, const EC_KEY *eckey, const uint8_t *nonce,
     size_t nonce_len) {
-  if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
+  const ECKey *impl = FromOpaque(eckey);
+
+  if (impl->ecdsa_meth && impl->ecdsa_meth->sign) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED);
     return 0;
   }
 
-  const EC_GROUP *group = EC_KEY_get0_group(eckey);
-  if (group == NULL || eckey->priv_key == NULL) {
+  const EC_GROUP *group = EC_KEY_get0_group(impl);
+  if (group == nullptr || impl->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
-  const EC_SCALAR *priv_key = &eckey->priv_key->scalar;
+  const EC_SCALAR *priv_key = &impl->priv_key->scalar;
 
   EC_SCALAR k;
   if (!ec_scalar_from_bytes(group, &k, nonce, nonce_len)) {
@@ -209,33 +208,44 @@ int ecdsa_sign_fixed_with_nonce_for_known_answer_test(
                          priv_key, &k, digest, digest_len);
 }
 
-int ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len, uint8_t *sig,
-                     size_t *out_sig_len, size_t max_sig_len,
-                     const EC_KEY *eckey) {
+int bssl::ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len,
+                           uint8_t *sig, size_t *out_sig_len,
+                           size_t max_sig_len, const EC_KEY *eckey) {
+  const ECKey *impl = FromOpaque(eckey);
+
   boringssl_ensure_ecc_self_test();
 
-  if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
+  if (impl->ecdsa_meth && impl->ecdsa_meth->sign) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED);
     return 0;
   }
 
-  const EC_GROUP *group = EC_KEY_get0_group(eckey);
-  if (group == NULL || eckey->priv_key == NULL) {
+  const EC_GROUP *group = EC_KEY_get0_group(impl);
+  if (group == nullptr || impl->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
   const BIGNUM *order = EC_GROUP_get0_order(group);
-  const EC_SCALAR *priv_key = &eckey->priv_key->scalar;
+  const EC_SCALAR *priv_key = &impl->priv_key->scalar;
+
+  // Generate the ECDSA per-message secret number by rejection sampling. This
+  // function implements FIPS 186-5, A.3.2, repeating the process on failure.
+
+  // Check the group order is large enough. See step 1 of FIPS 186-5, A.3.2.
+  if (BN_num_bits(order) < 224) {
+    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
+    return 0;
+  }
 
   // Pass a SHA512 hash of the private key and digest as additional data
   // into the RBG. This is a hardening measure against entropy failure.
-  static_assert(BCM_SHA512_DIGEST_LENGTH >= 32,
+  static_assert(SHA512_DIGEST_LENGTH >= 32,
                 "additional_data is too large for SHA-512");
 
   FIPS_service_indicator_lock_state();
 
   SHA512_CTX sha;
-  uint8_t additional_data[BCM_SHA512_DIGEST_LENGTH];
+  uint8_t additional_data[SHA512_DIGEST_LENGTH];
   BCM_sha512_init(&sha);
   BCM_sha512_update(&sha, priv_key->words, order->width * sizeof(BN_ULONG));
   BCM_sha512_update(&sha, digest, digest_len);
@@ -254,7 +264,7 @@ int ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len, uint8_t *sig,
       goto out;
     }
 
-    // TODO(davidben): Move this inside |ec_random_nonzero_scalar| or lower, so
+    // TODO(davidben): Move this inside `ec_random_nonzero_scalar` or lower, so
     // that all scalars we generate are, by default, secret.
     CONSTTIME_SECRET(k.words, sizeof(k.words));
 

data/third_party/boringssl-with-bazel/crypto/fipsmodule/ecdsa/internal.h

@@ -19,30 +19,28 @@
 
 #include "../ec/internal.h"
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
 
+BSSL_NAMESPACE_BEGIN
 
 // ECDSA_MAX_FIXED_LEN is the maximum length of an ECDSA signature in the
 // fixed-width, big-endian format from IEEE P1363.
 #define ECDSA_MAX_FIXED_LEN (2 * EC_MAX_BYTES)
 
-// ecdsa_sign_fixed behaves like |ECDSA_sign| but uses the fixed-width,
+// ecdsa_sign_fixed behaves like `ECDSA_sign` but uses the fixed-width,
 // big-endian format from IEEE P1363.
 int ecdsa_sign_fixed(const uint8_t *digest, size_t digest_len, uint8_t *sig,
                      size_t *out_sig_len, size_t max_sig_len,
                      const EC_KEY *key);
 
 // ecdsa_sign_fixed_with_nonce_for_known_answer_test behaves like
-// |ecdsa_sign_fixed| but takes a caller-supplied nonce. This function is used
+// `ecdsa_sign_fixed` but takes a caller-supplied nonce. This function is used
 // as part of known-answer tests in the FIPS module.
 int ecdsa_sign_fixed_with_nonce_for_known_answer_test(
     const uint8_t *digest, size_t digest_len, uint8_t *sig, size_t *out_sig_len,
     size_t max_sig_len, const EC_KEY *key, const uint8_t *nonce,
     size_t nonce_len);
 
-// ecdsa_verify_fixed behaves like |ECDSA_verify| but uses the fixed-width,
+// ecdsa_verify_fixed behaves like `ECDSA_verify` but uses the fixed-width,
 // big-endian format from IEEE P1363.
 int ecdsa_verify_fixed(const uint8_t *digest, size_t digest_len,
                        const uint8_t *sig, size_t sig_len, const EC_KEY *key);
@@ -54,9 +52,6 @@ int ecdsa_verify_fixed_no_self_test(const uint8_t *digest, size_t digest_len,
                                     const uint8_t *sig, size_t sig_len,
                                     const EC_KEY *key);
 
-
-#if defined(__cplusplus)
-}
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_ECDSA_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/fipsmodule/entropy/internal.h

@@ -0,0 +1,38 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_ENTROPY_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_ENTROPY_INTERNAL_H
+
+#include <openssl/base.h>
+
+#if defined(OPENSSL_LINUX) || defined(OPENSSL_MACOS)
+
+BSSL_NAMESPACE_BEGIN
+namespace entropy {
+
+// GetSeed fills `out` with random bytes from the jitter source.
+OPENSSL_EXPORT bool GetSeed(uint8_t out[48]);
+
+// GetSamples fetches `n` raw delta time samples.
+OPENSSL_EXPORT bool GetSamples(uint64_t *out, size_t n);
+
+// GetVersion returns the version of the entropy module.
+int GetVersion();
+
+}  // namespace entropy
+BSSL_NAMESPACE_END
+
+#endif  // LINUX || MACOS
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_ENTROPY_INTERNAL_H