grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/hpke/hpke.cc

@@ -17,6 +17,9 @@
 #include <assert.h>
 #include <string.h>
 
+#include <array>
+#include <string_view>
+
 #include <openssl/aead.h>
 #include <openssl/bytestring.h>
 #include <openssl/curve25519.h>
@@ -26,18 +29,27 @@
 #include <openssl/evp_errors.h>
 #include <openssl/hkdf.h>
 #include <openssl/mem.h>
+#include <openssl/mlkem.h>
 #include <openssl/rand.h>
-#include <openssl/sha.h>
+#include <openssl/sha2.h>
+#include <openssl/span.h>
+#include <openssl/xwing.h>
 
+#include "../fipsmodule/bcm_interface.h"
 #include "../fipsmodule/ec/internal.h"
+#include "../fipsmodule/keccak/internal.h"
 #include "../internal.h"
+#include "../mem_internal.h"
+
 
+using namespace bssl;
 
 // This file implements RFC 9180.
 
-#define MAX_SEED_LEN X25519_PRIVATE_KEY_LEN
+#define MAX_SEED_LEN XWING_SEED_LEN
 #define MAX_SHARED_SECRET_LEN SHA256_DIGEST_LENGTH
 
+// TODO(chlily): Fold this into `EVP_KEM`.
 struct evp_hpke_kem_st {
   uint16_t id;
   size_t public_key_len;
@@ -47,6 +59,7 @@ struct evp_hpke_kem_st {
   int (*init_key)(EVP_HPKE_KEY *key, const uint8_t *priv_key,
                   size_t priv_key_len);
   int (*generate_key)(EVP_HPKE_KEY *key);
+  int (*derive_key)(EVP_HPKE_KEY *key, Span<const uint8_t> ikm);
   int (*encap_with_seed)(const EVP_HPKE_KEM *kem, uint8_t *out_shared_secret,
                          size_t *out_shared_secret_len, uint8_t *out_enc,
                          size_t *out_enc_len, size_t max_enc,
@@ -72,12 +85,12 @@ struct evp_hpke_kem_st {
 struct evp_hpke_kdf_st {
   uint16_t id;
   // We only support HKDF-based KDFs.
-  const EVP_MD *(*hkdf_md_func)(void);
+  const EVP_MD *(*hkdf_md_func)();
 };
 
 struct evp_hpke_aead_st {
   uint16_t id;
-  const EVP_AEAD *(*aead_func)(void);
+  const EVP_AEAD *(*aead_func)();
 };
 
 
@@ -126,9 +139,44 @@ static int hpke_labeled_expand(const EVP_MD *hkdf_md, uint8_t *out_key,
   return ok;
 }
 
+static void absorb_u16(BORINGSSL_keccak_st *ctx, uint16_t n) {
+  uint8_t bytes[2];
+  CRYPTO_store_u16_be(bytes, n);
+  BORINGSSL_keccak_absorb(ctx, bytes, sizeof(bytes));
+}
+
+static void hpke_shake256_labeled_derive(Span<uint8_t> out,
+                                         Span<const uint8_t> ikm,
+                                         Span<const uint8_t> suite_id,
+                                         std::string_view label,
+                                         Span<const uint8_t> context) {
+  // https://www.ietf.org/archive/id/draft-ietf-hpke-hpke-03.html#name-labeled-derivation-function
+  // https://www.ietf.org/archive/id/draft-ietf-hpke-pq-04.html#name-single-stage-kdfs
+  BORINGSSL_keccak_st ctx;
+  BORINGSSL_keccak_init(&ctx, boringssl_shake256);
+  BORINGSSL_keccak_absorb(&ctx, ikm.data(), ikm.size());
+  auto hpke_version_id = StringAsBytes(kHpkeVersionId);
+  BORINGSSL_keccak_absorb(&ctx, hpke_version_id.data(), hpke_version_id.size());
+  BORINGSSL_keccak_absorb(&ctx, suite_id.data(), suite_id.size());
+  auto label_bytes = StringAsBytes(label);
+  assert(label_bytes.size() < 0xffff);
+  absorb_u16(&ctx, static_cast<uint16_t>(label_bytes.size()));
+  BORINGSSL_keccak_absorb(&ctx, label_bytes.data(), label_bytes.size());
+  assert(out.size() <= 0xffff);
+  absorb_u16(&ctx, static_cast<uint16_t>(out.size()));
+  BORINGSSL_keccak_absorb(&ctx, context.data(), context.size());
+  BORINGSSL_keccak_squeeze(&ctx, out.data(), out.size());
+}
+
 
 // KEM implementations.
 
+static std::array<uint8_t, 5> hpke_kem_suite_id(uint16_t kem_id) {
+  // concat("KEM", I2OSP(kem_id, 2))
+  return {'K', 'E', 'M', static_cast<uint8_t>(kem_id >> 8),
+          static_cast<uint8_t>(kem_id)};
+}
+
 // dhkem_extract_and_expand implements the ExtractAndExpand operation in the
 // DHKEM construction. See section 4.1 of RFC 9180.
 static int dhkem_extract_and_expand(uint16_t kem_id, const EVP_MD *hkdf_md,
@@ -136,16 +184,15 @@ static int dhkem_extract_and_expand(uint16_t kem_id, const EVP_MD *hkdf_md,
                                     const uint8_t *dh, size_t dh_len,
                                     const uint8_t *kem_context,
                                     size_t kem_context_len) {
-  // concat("KEM", I2OSP(kem_id, 2))
-  uint8_t suite_id[5] = {'K', 'E', 'M', static_cast<uint8_t>(kem_id >> 8),
-                         static_cast<uint8_t>(kem_id & 0xff)};
+  auto suite_id = hpke_kem_suite_id(kem_id);
   uint8_t prk[EVP_MAX_MD_SIZE];
   size_t prk_len;
-  return hpke_labeled_extract(hkdf_md, prk, &prk_len, NULL, 0, suite_id,
-                              sizeof(suite_id), "eae_prk", dh, dh_len) &&
-         hpke_labeled_expand(hkdf_md, out_key, out_len, prk, prk_len, suite_id,
-                             sizeof(suite_id), "shared_secret", kem_context,
-                             kem_context_len);
+  return hpke_labeled_extract(hkdf_md, prk, &prk_len, nullptr, 0,
+                              suite_id.data(), suite_id.size(), "eae_prk", dh,
+                              dh_len) &&
+         hpke_labeled_expand(hkdf_md, out_key, out_len, prk, prk_len,
+                             suite_id.data(), suite_id.size(), "shared_secret",
+                             kem_context, kem_context_len);
 }
 
 static int x25519_init_key(EVP_HPKE_KEY *key, const uint8_t *priv_key,
@@ -165,6 +212,23 @@ static int x25519_generate_key(EVP_HPKE_KEY *key) {
   return 1;
 }
 
+static int x25519_derive_key(EVP_HPKE_KEY *key, Span<const uint8_t> ikm) {
+  // https://www.rfc-editor.org/rfc/rfc9180.html#name-derivekeypair
+  auto suite_id = hpke_kem_suite_id(EVP_HPKE_DHKEM_X25519_HKDF_SHA256);
+  uint8_t dkp_prk[SHA256_DIGEST_LENGTH];
+  size_t dkp_prk_len;
+  uint8_t sk[32];
+  if (!hpke_labeled_extract(EVP_sha256(), dkp_prk, &dkp_prk_len, nullptr, 0,
+                            suite_id.data(), suite_id.size(), "dkp_prk",
+                            ikm.data(), ikm.size()) ||
+      !hpke_labeled_expand(EVP_sha256(), sk, sizeof(sk), dkp_prk, dkp_prk_len,
+                           suite_id.data(), suite_id.size(), "sk",
+                           /*info=*/nullptr, /*info_len=*/0)) {
+    return 0;
+  }
+  return x25519_init_key(key, sk, sizeof(sk));
+}
+
 static int x25519_encap_with_seed(
     const EVP_HPKE_KEM *kem, uint8_t *out_shared_secret,
     size_t *out_shared_secret_len, uint8_t *out_enc, size_t *out_enc_len,
@@ -296,7 +360,7 @@ static int x25519_auth_decap(const EVP_HPKE_KEY *key,
   return 1;
 }
 
-const EVP_HPKE_KEM *EVP_hpke_x25519_hkdf_sha256(void) {
+const EVP_HPKE_KEM *EVP_hpke_x25519_hkdf_sha256() {
   static const EVP_HPKE_KEM kKEM = {
       /*id=*/EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
       /*public_key_len=*/X25519_PUBLIC_VALUE_LEN,
@@ -305,6 +369,7 @@ const EVP_HPKE_KEM *EVP_hpke_x25519_hkdf_sha256(void) {
       /*enc_len=*/X25519_PUBLIC_VALUE_LEN,
       x25519_init_key,
       x25519_generate_key,
+      x25519_derive_key,
       x25519_encap_with_seed,
       x25519_decap,
       x25519_auth_encap_with_seed,
@@ -362,17 +427,14 @@ static int p256_init_key(EVP_HPKE_KEY *key, const uint8_t *priv_key,
 }
 
 static int p256_private_key_from_seed(uint8_t out_priv[P256_PRIVATE_KEY_LEN],
-                                      const uint8_t seed[P256_SEED_LEN]) {
+                                      const uint8_t *seed, size_t seed_len) {
   // https://www.rfc-editor.org/rfc/rfc9180.html#name-derivekeypair
-  const uint8_t suite_id[5] = {'K', 'E', 'M',
-                               EVP_HPKE_DHKEM_P256_HKDF_SHA256 >> 8,
-                               EVP_HPKE_DHKEM_P256_HKDF_SHA256 & 0xff};
-
+  auto suite_id = hpke_kem_suite_id(EVP_HPKE_DHKEM_P256_HKDF_SHA256);
   uint8_t dkp_prk[32];
   size_t dkp_prk_len;
-  if (!hpke_labeled_extract(EVP_sha256(), dkp_prk, &dkp_prk_len, NULL, 0,
-                            suite_id, sizeof(suite_id), "dkp_prk", seed,
-                            P256_SEED_LEN)) {
+  if (!hpke_labeled_extract(EVP_sha256(), dkp_prk, &dkp_prk_len, nullptr, 0,
+                            suite_id.data(), suite_id.size(), "dkp_prk", seed,
+                            seed_len)) {
     return 0;
   }
   assert(dkp_prk_len == sizeof(dkp_prk));
@@ -383,15 +445,16 @@ static int p256_private_key_from_seed(uint8_t out_priv[P256_PRIVATE_KEY_LEN],
   for (unsigned counter = 0; counter < 256; counter++) {
     const uint8_t counter_byte = counter & 0xff;
     if (!hpke_labeled_expand(EVP_sha256(), out_priv, P256_PRIVATE_KEY_LEN,
-                             dkp_prk, sizeof(dkp_prk), suite_id,
-                             sizeof(suite_id), "candidate", &counter_byte,
+                             dkp_prk, sizeof(dkp_prk), suite_id.data(),
+                             suite_id.size(), "candidate", &counter_byte,
                              sizeof(counter_byte))) {
       return 0;
     }
 
-    // This checks that the scalar is less than the order.
+    // `ec_scalar_from_bytes` checks that the scalar is less than the order.
     if (ec_scalar_from_bytes(group, &private_scalar, out_priv,
-                             P256_PRIVATE_KEY_LEN)) {
+                             P256_PRIVATE_KEY_LEN) &&
+        !ec_scalar_is_zero(group, &private_scalar)) {
       return 1;
     }
   }
@@ -401,16 +464,20 @@ static int p256_private_key_from_seed(uint8_t out_priv[P256_PRIVATE_KEY_LEN],
   return 0;
 }
 
-static int p256_generate_key(EVP_HPKE_KEY *key) {
-  uint8_t seed[P256_SEED_LEN];
-  RAND_bytes(seed, sizeof(seed));
-  if (!p256_private_key_from_seed(key->private_key, seed) ||
+static int p256_derive_key(EVP_HPKE_KEY *key, Span<const uint8_t> ikm) {
+  if (!p256_private_key_from_seed(key->private_key, ikm.data(), ikm.size()) ||
       !p256_public_from_private(key->public_key, key->private_key)) {
     return 0;
   }
   return 1;
 }
 
+static int p256_generate_key(EVP_HPKE_KEY *key) {
+  uint8_t seed[P256_SEED_LEN];
+  RAND_bytes(seed, sizeof(seed));
+  return p256_derive_key(key, seed);
+}
+
 static int p256(uint8_t out_dh[P256_SHARED_KEY_LEN],
                 const uint8_t my_private[P256_PRIVATE_KEY_LEN],
                 const uint8_t their_public[P256_PUBLIC_VALUE_LEN]) {
@@ -460,10 +527,10 @@ static int p256_encap_with_seed(const EVP_HPKE_KEM *kem,
     return 0;
   }
   uint8_t private_key[P256_PRIVATE_KEY_LEN];
-  if (!p256_private_key_from_seed(private_key, seed)) {
+  if (!p256_private_key_from_seed(private_key, seed, seed_len) ||
+      !p256_public_from_private(out_enc, private_key)) {
     return 0;
   }
-  p256_public_from_private(out_enc, private_key);
 
   uint8_t dh[P256_SHARED_KEY_LEN];
   if (peer_public_key_len != P256_PUBLIC_VALUE_LEN ||
@@ -525,10 +592,10 @@ static int p256_auth_encap_with_seed(
     return 0;
   }
   uint8_t private_key[P256_PRIVATE_KEY_LEN];
-  if (!p256_private_key_from_seed(private_key, seed)) {
+  if (!p256_private_key_from_seed(private_key, seed, seed_len) ||
+      !p256_public_from_private(out_enc, private_key)) {
     return 0;
   }
-  p256_public_from_private(out_enc, private_key);
 
   uint8_t dh[2 * P256_SHARED_KEY_LEN];
   if (peer_public_key_len != P256_PUBLIC_VALUE_LEN ||
@@ -584,7 +651,7 @@ static int p256_auth_decap(const EVP_HPKE_KEY *key, uint8_t *out_shared_secret,
   return 1;
 }
 
-const EVP_HPKE_KEM *EVP_hpke_p256_hkdf_sha256(void) {
+const EVP_HPKE_KEM *EVP_hpke_p256_hkdf_sha256() {
   static const EVP_HPKE_KEM kKEM = {
       /*id=*/EVP_HPKE_DHKEM_P256_HKDF_SHA256,
       /*public_key_len=*/P256_PUBLIC_KEY_LEN,
@@ -593,6 +660,7 @@ const EVP_HPKE_KEM *EVP_hpke_p256_hkdf_sha256(void) {
       /*enc_len=*/P256_PUBLIC_VALUE_LEN,
       p256_init_key,
       p256_generate_key,
+      p256_derive_key,
       p256_encap_with_seed,
       p256_decap,
       p256_auth_encap_with_seed,
@@ -601,6 +669,293 @@ const EVP_HPKE_KEM *EVP_hpke_p256_hkdf_sha256(void) {
   return &kKEM;
 }
 
+#define XWING_PRIVATE_KEY_LEN XWING_PRIVATE_KEY_BYTES
+#define XWING_PUBLIC_KEY_LEN XWING_PUBLIC_KEY_BYTES
+#define XWING_PUBLIC_VALUE_LEN XWING_CIPHERTEXT_BYTES
+#define XWING_SEED_LEN 64
+#define XWING_SHARED_KEY_LEN XWING_SHARED_SECRET_BYTES
+
+static int xwing_init_key(EVP_HPKE_KEY *key, const uint8_t *priv_key,
+                          size_t priv_key_len) {
+  CBS cbs;
+  CBS_init(&cbs, priv_key, priv_key_len);
+  XWING_private_key private_key;
+  if (!XWING_parse_private_key(&private_key, &cbs) || CBS_len(&cbs) != 0) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+
+  if (!XWING_public_from_private(key->public_key, &private_key)) {
+    return 0;
+  }
+
+  if (priv_key_len > sizeof(key->private_key)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+  OPENSSL_memcpy(key->private_key, priv_key, priv_key_len);
+  return 1;
+}
+
+static int xwing_generate_key(EVP_HPKE_KEY *key) {
+  XWING_private_key private_key;
+  if (!XWING_generate_key(key->public_key, &private_key)) {
+    return 0;
+  }
+
+  CBB cbb;
+  CBB_init_fixed(&cbb, key->private_key, XWING_PRIVATE_KEY_LEN);
+  if (!XWING_marshal_private_key(&cbb, &private_key) ||
+      CBB_len(&cbb) != XWING_PRIVATE_KEY_LEN) {
+    return 0;
+  }
+
+  return 1;
+}
+
+static int xwing_derive_key(EVP_HPKE_KEY *key, Span<const uint8_t> ikm) {
+  uint8_t seed[32];
+  hpke_shake256_labeled_derive(seed, ikm, hpke_kem_suite_id(EVP_HPKE_XWING),
+                               "DeriveKeyPair", /*context=*/{});
+  return xwing_init_key(key, seed, sizeof(seed));
+}
+
+static int xwing_encap_with_seed(const EVP_HPKE_KEM *kem,
+                                 uint8_t *out_shared_secret,
+                                 size_t *out_shared_secret_len,
+                                 uint8_t *out_enc, size_t *out_enc_len,
+                                 size_t max_enc, const uint8_t *peer_public_key,
+                                 size_t peer_public_key_len,
+                                 const uint8_t *seed, size_t seed_len) {
+  if (max_enc < XWING_PUBLIC_VALUE_LEN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_BUFFER_SIZE);
+    return 0;
+  }
+  if (peer_public_key_len != XWING_PUBLIC_KEY_LEN ||
+      seed_len != XWING_SEED_LEN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+
+  if (!XWING_encap_external_entropy(out_enc, out_shared_secret, peer_public_key,
+                                    seed)) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  *out_enc_len = XWING_PUBLIC_VALUE_LEN;
+  *out_shared_secret_len = XWING_SHARED_KEY_LEN;
+  return 1;
+}
+
+static int xwing_decap(const EVP_HPKE_KEY *key, uint8_t *out_shared_secret,
+                       size_t *out_shared_secret_len, const uint8_t *enc,
+                       size_t enc_len) {
+  if (enc_len != XWING_PUBLIC_VALUE_LEN) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+
+  CBS cbs;
+  CBS_init(&cbs, key->private_key, XWING_PRIVATE_KEY_LEN);
+  XWING_private_key private_key;
+  if (!XWING_parse_private_key(&private_key, &cbs)) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return 0;
+  }
+
+  if (!XWING_decap(out_shared_secret, enc, &private_key)) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  *out_shared_secret_len = XWING_SHARED_KEY_LEN;
+  return 1;
+}
+
+const EVP_HPKE_KEM *EVP_hpke_xwing() {
+  static const EVP_HPKE_KEM kKEM = {
+      /*id=*/EVP_HPKE_XWING,
+      /*public_key_len=*/XWING_PUBLIC_KEY_LEN,
+      /*private_key_len=*/XWING_PRIVATE_KEY_LEN,
+      /*seed_len=*/XWING_SEED_LEN,
+      /*enc_len=*/XWING_PUBLIC_VALUE_LEN,
+      xwing_init_key,
+      xwing_generate_key,
+      xwing_derive_key,
+      xwing_encap_with_seed,
+      xwing_decap,
+      // X-Wing doesn't support authenticated encapsulation/decapsulation:
+      // https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem-08#name-use-in-hpke
+      /* auth_encap_with_seed= */ nullptr,
+      /* auth_decap= */ nullptr,
+  };
+  return &kKEM;
+}
+
+namespace {
+
+template <uint16_t KEM_ID, size_t PUBLIC_KEY_BYTES, size_t CIPHERTEXT_BYTES,
+          size_t ENCAP_ENTROPY_BYTES,
+
+          typename PrivateKey, typename PublicKey,
+
+          int (*PrivateKeyFromSeed)(PrivateKey *, const uint8_t *, size_t),
+          void (*PublicFromPrivate)(PublicKey *, const PrivateKey *),
+          int (*MarshalPublicKey)(CBB *, const PublicKey *),
+          void (*GenerateKey)(uint8_t *, uint8_t *, PrivateKey *),
+          int (*ParsePublicKey)(PublicKey *, CBS *),
+          bcm_infallible (*BCMEncapExternalEntropy)(
+              uint8_t *, uint8_t *, const PublicKey *, const uint8_t *),
+          int (*Decap)(uint8_t *, const uint8_t *, size_t, const PrivateKey *)>
+struct MLKEMHPKE {
+  // These sizes are common across both ML-KEM-768 and ML-KEM-1024.
+  static constexpr size_t PRIVATE_KEY_LEN = MLKEM_SEED_BYTES;
+  static constexpr size_t SHARED_KEY_LEN = MLKEM_SHARED_SECRET_BYTES;
+
+  static constexpr uint16_t ID = KEM_ID;
+  static constexpr size_t PUBLIC_KEY_LEN = PUBLIC_KEY_BYTES;
+  static constexpr size_t SEED_LEN = ENCAP_ENTROPY_BYTES;
+  static constexpr size_t ENC_LEN = CIPHERTEXT_BYTES;
+
+  static int InitKey(EVP_HPKE_KEY *key, const uint8_t *priv_key,
+                     size_t priv_key_len) {
+    PrivateKey expanded_private_key;
+    if (!PrivateKeyFromSeed(&expanded_private_key, priv_key, priv_key_len)) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+      return 0;
+    }
+    PublicKey public_key;
+    PublicFromPrivate(&public_key, &expanded_private_key);
+    CBB cbb;
+    static_assert(sizeof(key->public_key) >= PUBLIC_KEY_BYTES,
+                  "EVP_HPKE_KEY public_key is too small for ML-KEM.");
+    if (!CBB_init_fixed(&cbb, key->public_key, PUBLIC_KEY_BYTES) ||
+        !MarshalPublicKey(&cbb, &public_key)) {
+      return 0;
+    }
+
+    static_assert(sizeof(key->private_key) >= PRIVATE_KEY_LEN,
+                  "EVP_HPKE_KEY private_key is too small for ML-KEM");
+    OPENSSL_memcpy(key->private_key, priv_key, priv_key_len);
+    return 1;
+  }
+
+  static int HpkeDeriveKey(EVP_HPKE_KEY *key, Span<const uint8_t> ikm) {
+    uint8_t seed[64];
+    hpke_shake256_labeled_derive(seed, ikm, hpke_kem_suite_id(ID),
+                                 "DeriveKeyPair",
+                                 /*context=*/{});
+    return InitKey(key, seed, sizeof(seed));
+  }
+
+  static int HpkeGenerateKey(EVP_HPKE_KEY *key) {
+    static_assert(sizeof(key->public_key) >= PUBLIC_KEY_BYTES,
+                  "EVP_HPKE_KEY public_key is too small for ML-KEM.");
+    static_assert(sizeof(key->private_key) >= PRIVATE_KEY_LEN,
+                  "EVP_HPKE_KEY private_key is too small for ML-KEM");
+    PrivateKey expanded_private_key;
+    GenerateKey(key->public_key, key->private_key, &expanded_private_key);
+
+    return 1;
+  }
+
+  static int EncapWithSeed(const EVP_HPKE_KEM *kem, uint8_t *out_shared_secret,
+                           size_t *out_shared_secret_len, uint8_t *out_enc,
+                           size_t *out_enc_len, size_t max_enc,
+                           const uint8_t *peer_public_key,
+                           size_t peer_public_key_len, const uint8_t *seed,
+                           size_t seed_len) {
+    if (max_enc < CIPHERTEXT_BYTES) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_BUFFER_SIZE);
+      return 0;
+    }
+    if (peer_public_key_len != PUBLIC_KEY_BYTES ||
+        seed_len != ENCAP_ENTROPY_BYTES) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+      return 0;
+    }
+
+    CBS cbs;
+    CBS_init(&cbs, peer_public_key, peer_public_key_len);
+    PublicKey public_key;
+    if (!ParsePublicKey(&public_key, &cbs)) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+      return 0;
+    }
+    // The public ML-KEM interface doesn't support providing the encap entropy
+    // so the BCM function is used here.
+    BCMEncapExternalEntropy(out_enc, out_shared_secret, &public_key, seed);
+
+    *out_enc_len = CIPHERTEXT_BYTES;
+    *out_shared_secret_len = SHARED_KEY_LEN;
+    return 1;
+  }
+
+  static int HpkeDecap(const EVP_HPKE_KEY *key, uint8_t *out_shared_secret,
+                       size_t *out_shared_secret_len, const uint8_t *enc,
+                       size_t enc_len) {
+    PrivateKey private_key;
+    if (!PrivateKeyFromSeed(&private_key, key->private_key, PRIVATE_KEY_LEN)) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+      return 0;
+    }
+
+    if (!Decap(out_shared_secret, enc, enc_len, &private_key)) {
+      OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
+      return 0;
+    }
+
+    *out_shared_secret_len = SHARED_KEY_LEN;
+    return 1;
+  }
+};
+
+using MLKEM768HPKE =
+    MLKEMHPKE<EVP_HPKE_MLKEM768, MLKEM768_PUBLIC_KEY_BYTES,
+              MLKEM768_CIPHERTEXT_BYTES, BCM_MLKEM_ENCAP_ENTROPY,
+
+              MLKEM768_private_key, MLKEM768_public_key,
+
+              MLKEM768_private_key_from_seed, MLKEM768_public_from_private,
+              MLKEM768_marshal_public_key, MLKEM768_generate_key,
+              MLKEM768_parse_public_key, BCM_mlkem768_encap_external_entropy,
+              MLKEM768_decap>;
+
+using MLKEM1024HPKE =
+    MLKEMHPKE<EVP_HPKE_MLKEM1024, MLKEM1024_PUBLIC_KEY_BYTES,
+              MLKEM1024_CIPHERTEXT_BYTES, BCM_MLKEM_ENCAP_ENTROPY,
+
+              MLKEM1024_private_key, MLKEM1024_public_key,
+
+              MLKEM1024_private_key_from_seed, MLKEM1024_public_from_private,
+              MLKEM1024_marshal_public_key, MLKEM1024_generate_key,
+              MLKEM1024_parse_public_key, BCM_mlkem1024_encap_external_entropy,
+              MLKEM1024_decap>;
+
+template <typename MLKEM>
+static const EVP_HPKE_KEM kMLKEM = {
+    /*id=*/MLKEM::ID,
+    /*public_key_len=*/MLKEM::PUBLIC_KEY_LEN,
+    /*private_key_len=*/MLKEM::PRIVATE_KEY_LEN,
+    /*seed_len=*/MLKEM::SEED_LEN,
+    /*enc_len=*/MLKEM::ENC_LEN,
+    MLKEM::InitKey,
+    MLKEM::HpkeGenerateKey,
+    MLKEM::HpkeDeriveKey,
+    MLKEM::EncapWithSeed,
+    MLKEM::HpkeDecap,
+    // ML-KEM doesn't support authenticated encapsulation/decapsulation:
+    // https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/01/
+    /*auth_encap_with_seed=*/nullptr,
+    /*auth_decap=*/nullptr,
+};
+
+}  // namespace
+
+const EVP_HPKE_KEM *EVP_hpke_mlkem768() { return &kMLKEM<MLKEM768HPKE>; }
+const EVP_HPKE_KEM *EVP_hpke_mlkem1024() { return &kMLKEM<MLKEM1024HPKE>; }
+
 uint16_t EVP_HPKE_KEM_id(const EVP_HPKE_KEM *kem) { return kem->id; }
 
 size_t EVP_HPKE_KEM_public_key_len(const EVP_HPKE_KEM *kem) {
@@ -622,32 +977,31 @@ void EVP_HPKE_KEY_cleanup(EVP_HPKE_KEY *key) {
   // future.
 }
 
-EVP_HPKE_KEY *EVP_HPKE_KEY_new(void) {
-  EVP_HPKE_KEY *key =
-      reinterpret_cast<EVP_HPKE_KEY *>(OPENSSL_malloc(sizeof(EVP_HPKE_KEY)));
-  if (key == NULL) {
-    return NULL;
+EVP_HPKE_KEY *EVP_HPKE_KEY_new() {
+  EVP_HPKE_KEY *key = New<EVP_HPKE_KEY>();
+  if (key == nullptr) {
+    return nullptr;
   }
   EVP_HPKE_KEY_zero(key);
   return key;
 }
 
 void EVP_HPKE_KEY_free(EVP_HPKE_KEY *key) {
-  if (key != NULL) {
+  if (key != nullptr) {
     EVP_HPKE_KEY_cleanup(key);
-    OPENSSL_free(key);
+    Delete(key);
   }
 }
 
 int EVP_HPKE_KEY_copy(EVP_HPKE_KEY *dst, const EVP_HPKE_KEY *src) {
-  // For now, |EVP_HPKE_KEY| is trivially copyable.
+  // For now, `EVP_HPKE_KEY` is trivially copyable.
   OPENSSL_memcpy(dst, src, sizeof(EVP_HPKE_KEY));
   return 1;
 }
 
 void EVP_HPKE_KEY_move(EVP_HPKE_KEY *out, EVP_HPKE_KEY *in) {
   EVP_HPKE_KEY_cleanup(out);
-  // For now, |EVP_HPKE_KEY| is trivially movable.
+  // For now, `EVP_HPKE_KEY` is trivially movable.
   // Note that Rust may move this structure. See
   // bssl-crypto/src/scoped.rs:EvpHpkeKey.
   OPENSSL_memcpy(out, in, sizeof(EVP_HPKE_KEY));
@@ -659,7 +1013,7 @@ int EVP_HPKE_KEY_init(EVP_HPKE_KEY *key, const EVP_HPKE_KEM *kem,
   EVP_HPKE_KEY_zero(key);
   key->kem = kem;
   if (!kem->init_key(key, priv_key, priv_key_len)) {
-    key->kem = NULL;
+    key->kem = nullptr;
     return 0;
   }
   return 1;
@@ -669,7 +1023,18 @@ int EVP_HPKE_KEY_generate(EVP_HPKE_KEY *key, const EVP_HPKE_KEM *kem) {
   EVP_HPKE_KEY_zero(key);
   key->kem = kem;
   if (!kem->generate_key(key)) {
-    key->kem = NULL;
+    key->kem = nullptr;
+    return 0;
+  }
+  return 1;
+}
+
+int EVP_HPKE_KEY_derive(EVP_HPKE_KEY *key, const EVP_HPKE_KEM *kem,
+                        const uint8_t *ikm, size_t ikm_len) {
+  EVP_HPKE_KEY_zero(key);
+  key->kem = kem;
+  if (!kem->derive_key(key, Span(ikm, ikm_len))) {
+    key->kem = nullptr;
     return 0;
   }
   return 1;
@@ -704,30 +1069,35 @@ int EVP_HPKE_KEY_private_key(const EVP_HPKE_KEY *key, uint8_t *out,
 
 // Supported KDFs and AEADs.
 
-const EVP_HPKE_KDF *EVP_hpke_hkdf_sha256(void) {
+const EVP_HPKE_KDF *EVP_hpke_hkdf_sha256() {
   static const EVP_HPKE_KDF kKDF = {EVP_HPKE_HKDF_SHA256, &EVP_sha256};
   return &kKDF;
 }
 
+const EVP_HPKE_KDF *EVP_hpke_hkdf_sha384() {
+  static const EVP_HPKE_KDF kKDF = {EVP_HPKE_HKDF_SHA384, &EVP_sha384};
+  return &kKDF;
+}
+
 uint16_t EVP_HPKE_KDF_id(const EVP_HPKE_KDF *kdf) { return kdf->id; }
 
 const EVP_MD *EVP_HPKE_KDF_hkdf_md(const EVP_HPKE_KDF *kdf) {
   return kdf->hkdf_md_func();
 }
 
-const EVP_HPKE_AEAD *EVP_hpke_aes_128_gcm(void) {
+const EVP_HPKE_AEAD *EVP_hpke_aes_128_gcm() {
   static const EVP_HPKE_AEAD kAEAD = {EVP_HPKE_AES_128_GCM,
                                       &EVP_aead_aes_128_gcm};
   return &kAEAD;
 }
 
-const EVP_HPKE_AEAD *EVP_hpke_aes_256_gcm(void) {
+const EVP_HPKE_AEAD *EVP_hpke_aes_256_gcm() {
   static const EVP_HPKE_AEAD kAEAD = {EVP_HPKE_AES_256_GCM,
                                       &EVP_aead_aes_256_gcm};
   return &kAEAD;
 }
 
-const EVP_HPKE_AEAD *EVP_hpke_chacha20_poly1305(void) {
+const EVP_HPKE_AEAD *EVP_hpke_chacha20_poly1305() {
   static const EVP_HPKE_AEAD kAEAD = {EVP_HPKE_CHACHA20_POLY1305,
                                       &EVP_aead_chacha20_poly1305};
   return &kAEAD;
@@ -742,19 +1112,19 @@ const EVP_AEAD *EVP_HPKE_AEAD_aead(const EVP_HPKE_AEAD *aead) {
 
 // HPKE implementation.
 
-// This is strlen("HPKE") + 3 * sizeof(uint16_t).
-#define HPKE_SUITE_ID_LEN 10
-
-// The suite_id for non-KEM pieces of HPKE is defined as concat("HPKE",
-// I2OSP(kem_id, 2), I2OSP(kdf_id, 2), I2OSP(aead_id, 2)).
-static int hpke_build_suite_id(const EVP_HPKE_CTX *ctx,
-                               uint8_t out[HPKE_SUITE_ID_LEN]) {
-  CBB cbb;
-  CBB_init_fixed(&cbb, out, HPKE_SUITE_ID_LEN);
-  return add_label_string(&cbb, "HPKE") &&   //
-         CBB_add_u16(&cbb, ctx->kem->id) &&  //
-         CBB_add_u16(&cbb, ctx->kdf->id) &&  //
-         CBB_add_u16(&cbb, ctx->aead->id);
+static std::array<uint8_t, 10> hpke_full_suite_id(const EVP_HPKE_CTX *ctx) {
+  return {
+      'H',
+      'P',
+      'K',
+      'E',
+      static_cast<uint8_t>(ctx->kem->id >> 8),
+      static_cast<uint8_t>(ctx->kem->id),
+      static_cast<uint8_t>(ctx->kdf->id >> 8),
+      static_cast<uint8_t>(ctx->kdf->id),
+      static_cast<uint8_t>(ctx->aead->id >> 8),
+      static_cast<uint8_t>(ctx->aead->id),
+  };
 }
 
 #define HPKE_MODE_BASE 0
@@ -764,27 +1134,24 @@ static int hpke_key_schedule(EVP_HPKE_CTX *ctx, uint8_t mode,
                              const uint8_t *shared_secret,
                              size_t shared_secret_len, const uint8_t *info,
                              size_t info_len) {
-  uint8_t suite_id[HPKE_SUITE_ID_LEN];
-  if (!hpke_build_suite_id(ctx, suite_id)) {
-    return 0;
-  }
+  auto suite_id = hpke_full_suite_id(ctx);
 
   // psk_id_hash = LabeledExtract("", "psk_id_hash", psk_id)
   // TODO(davidben): Precompute this value and store it with the EVP_HPKE_KDF.
   const EVP_MD *hkdf_md = ctx->kdf->hkdf_md_func();
   uint8_t psk_id_hash[EVP_MAX_MD_SIZE];
   size_t psk_id_hash_len;
-  if (!hpke_labeled_extract(hkdf_md, psk_id_hash, &psk_id_hash_len, NULL, 0,
-                            suite_id, sizeof(suite_id), "psk_id_hash", NULL,
-                            0)) {
+  if (!hpke_labeled_extract(hkdf_md, psk_id_hash, &psk_id_hash_len, nullptr, 0,
+                            suite_id.data(), suite_id.size(), "psk_id_hash",
+                            nullptr, 0)) {
     return 0;
   }
 
   // info_hash = LabeledExtract("", "info_hash", info)
   uint8_t info_hash[EVP_MAX_MD_SIZE];
   size_t info_hash_len;
-  if (!hpke_labeled_extract(hkdf_md, info_hash, &info_hash_len, NULL, 0,
-                            suite_id, sizeof(suite_id), "info_hash", info,
+  if (!hpke_labeled_extract(hkdf_md, info_hash, &info_hash_len, nullptr, 0,
+                            suite_id.data(), suite_id.size(), "info_hash", info,
                             info_len)) {
     return 0;
   }
@@ -797,7 +1164,7 @@ static int hpke_key_schedule(EVP_HPKE_CTX *ctx, uint8_t mode,
   if (!CBB_add_u8(&context_cbb, mode) ||
       !CBB_add_bytes(&context_cbb, psk_id_hash, psk_id_hash_len) ||
       !CBB_add_bytes(&context_cbb, info_hash, info_hash_len) ||
-      !CBB_finish(&context_cbb, NULL, &context_len)) {
+      !CBB_finish(&context_cbb, nullptr, &context_len)) {
     return 0;
   }
 
@@ -805,8 +1172,8 @@ static int hpke_key_schedule(EVP_HPKE_CTX *ctx, uint8_t mode,
   uint8_t secret[EVP_MAX_MD_SIZE];
   size_t secret_len;
   if (!hpke_labeled_extract(hkdf_md, secret, &secret_len, shared_secret,
-                            shared_secret_len, suite_id, sizeof(suite_id),
-                            "secret", NULL, 0)) {
+                            shared_secret_len, suite_id.data(), suite_id.size(),
+                            "secret", nullptr, 0)) {
     return 0;
   }
 
@@ -814,24 +1181,25 @@ static int hpke_key_schedule(EVP_HPKE_CTX *ctx, uint8_t mode,
   const EVP_AEAD *aead = EVP_HPKE_AEAD_aead(ctx->aead);
   uint8_t key[EVP_AEAD_MAX_KEY_LENGTH];
   const size_t kKeyLen = EVP_AEAD_key_length(aead);
-  if (!hpke_labeled_expand(hkdf_md, key, kKeyLen, secret, secret_len, suite_id,
-                           sizeof(suite_id), "key", context, context_len) ||
+  if (!hpke_labeled_expand(hkdf_md, key, kKeyLen, secret, secret_len,
+                           suite_id.data(), suite_id.size(), "key", context,
+                           context_len) ||
       !EVP_AEAD_CTX_init(&ctx->aead_ctx, aead, key, kKeyLen,
-                         EVP_AEAD_DEFAULT_TAG_LENGTH, NULL)) {
+                         EVP_AEAD_DEFAULT_TAG_LENGTH, nullptr)) {
     return 0;
   }
 
   // base_nonce = LabeledExpand(secret, "base_nonce", key_schedule_context, Nn)
   if (!hpke_labeled_expand(hkdf_md, ctx->base_nonce,
                            EVP_AEAD_nonce_length(aead), secret, secret_len,
-                           suite_id, sizeof(suite_id), "base_nonce", context,
-                           context_len)) {
+                           suite_id.data(), suite_id.size(), "base_nonce",
+                           context, context_len)) {
     return 0;
   }
 
   // exporter_secret = LabeledExpand(secret, "exp", key_schedule_context, Nh)
   if (!hpke_labeled_expand(hkdf_md, ctx->exporter_secret, EVP_MD_size(hkdf_md),
-                           secret, secret_len, suite_id, sizeof(suite_id),
+                           secret, secret_len, suite_id.data(), suite_id.size(),
                            "exp", context, context_len)) {
     return 0;
   }
@@ -848,20 +1216,19 @@ void EVP_HPKE_CTX_cleanup(EVP_HPKE_CTX *ctx) {
   EVP_AEAD_CTX_cleanup(&ctx->aead_ctx);
 }
 
-EVP_HPKE_CTX *EVP_HPKE_CTX_new(void) {
-  EVP_HPKE_CTX *ctx =
-      reinterpret_cast<EVP_HPKE_CTX *>(OPENSSL_malloc(sizeof(EVP_HPKE_CTX)));
-  if (ctx == NULL) {
-    return NULL;
+EVP_HPKE_CTX *EVP_HPKE_CTX_new() {
+  EVP_HPKE_CTX *ctx = New<EVP_HPKE_CTX>();
+  if (ctx == nullptr) {
+    return nullptr;
   }
   EVP_HPKE_CTX_zero(ctx);
   return ctx;
 }
 
 void EVP_HPKE_CTX_free(EVP_HPKE_CTX *ctx) {
-  if (ctx != NULL) {
+  if (ctx != nullptr) {
     EVP_HPKE_CTX_cleanup(ctx);
-    OPENSSL_free(ctx);
+    Delete(ctx);
   }
 }
 
@@ -943,7 +1310,7 @@ int EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing(
     const uint8_t *peer_public_key, size_t peer_public_key_len,
     const uint8_t *info, size_t info_len, const uint8_t *seed,
     size_t seed_len) {
-  if (key->kem->auth_encap_with_seed == NULL) {
+  if (key->kem->auth_encap_with_seed == nullptr) {
     // Not all HPKE KEMs support AuthEncap.
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
@@ -972,7 +1339,7 @@ int EVP_HPKE_CTX_setup_auth_recipient(
     const EVP_HPKE_AEAD *aead, const uint8_t *enc, size_t enc_len,
     const uint8_t *info, size_t info_len, const uint8_t *peer_public_key,
     size_t peer_public_key_len) {
-  if (key->kem->auth_decap == NULL) {
+  if (key->kem->auth_decap == nullptr) {
     // Not all HPKE KEMs support AuthDecap.
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     return 0;
@@ -999,7 +1366,7 @@ static void hpke_nonce(const EVP_HPKE_CTX *ctx, uint8_t *out_nonce,
                        size_t nonce_len) {
   assert(nonce_len >= 8);
 
-  // Write padded big-endian bytes of |ctx->seq| to |out_nonce|.
+  // Write padded big-endian bytes of `ctx->seq` to `out_nonce`.
   OPENSSL_memset(out_nonce, 0, nonce_len);
   uint64_t seq_copy = ctx->seq;
   for (size_t i = 0; i < 8; i++) {
@@ -1007,7 +1374,7 @@ static void hpke_nonce(const EVP_HPKE_CTX *ctx, uint8_t *out_nonce,
     seq_copy >>= 8;
   }
 
-  // XOR the encoded sequence with the |ctx->base_nonce|.
+  // XOR the encoded sequence with the `ctx->base_nonce`.
   for (size_t i = 0; i < nonce_len; i++) {
     out_nonce[i] ^= ctx->base_nonce[i];
   }
@@ -1064,14 +1431,11 @@ int EVP_HPKE_CTX_seal(EVP_HPKE_CTX *ctx, uint8_t *out, size_t *out_len,
 int EVP_HPKE_CTX_export(const EVP_HPKE_CTX *ctx, uint8_t *out,
                         size_t secret_len, const uint8_t *context,
                         size_t context_len) {
-  uint8_t suite_id[HPKE_SUITE_ID_LEN];
-  if (!hpke_build_suite_id(ctx, suite_id)) {
-    return 0;
-  }
+  auto suite_id = hpke_full_suite_id(ctx);
   const EVP_MD *hkdf_md = ctx->kdf->hkdf_md_func();
   if (!hpke_labeled_expand(hkdf_md, out, secret_len, ctx->exporter_secret,
-                           EVP_MD_size(hkdf_md), suite_id, sizeof(suite_id),
-                           "sec", context, context_len)) {
+                           EVP_MD_size(hkdf_md), suite_id.data(),
+                           suite_id.size(), "sec", context, context_len)) {
     return 0;
   }
   return 1;