grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/kyber/internal.h

@@ -16,12 +16,119 @@
 #define OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H
 
 #include <openssl/base.h>
-#include <openssl/experimental/kyber.h>
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
 
+BSSL_NAMESPACE_BEGIN
+
+// Kyber is the pre-standard version of ML-KEM. This was once exported as public
+// API, but is now internal and only used by libssl. It will be removed entirely
+// in the future.
+//
+// This implements the round-3 specification of Kyber, defined at
+// https://pq-crystals.org/kyber/data/kyber-specification-round3-20210804.pdf
+
+// KYBER_public_key contains a Kyber768 public key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct KYBER_public_key {
+  union {
+    uint8_t bytes[512 * (3 + 9) + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+// KYBER_private_key contains a Kyber768 private key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct KYBER_private_key {
+  union {
+    uint8_t bytes[512 * (3 + 3 + 9) + 32 + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+// KYBER_PUBLIC_KEY_BYTES is the number of bytes in an encoded Kyber768 public
+// key.
+#define KYBER_PUBLIC_KEY_BYTES 1184
+
+// KYBER_SHARED_SECRET_BYTES is the number of bytes in the Kyber768 shared
+// secret. Although the round-3 specification has a variable-length output, the
+// final ML-KEM construction is expected to use a fixed 32-byte output. To
+// simplify the future transition, we apply the same restriction.
+#define KYBER_SHARED_SECRET_BYTES 32
+
+// KYBER_generate_key generates a random public/private key pair, writes the
+// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
+// the private key.
+OPENSSL_EXPORT void KYBER_generate_key(
+    uint8_t out_encoded_public_key[KYBER_PUBLIC_KEY_BYTES],
+    struct KYBER_private_key *out_private_key);
+
+// KYBER_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. (This is faster than parsing the output of
+// `KYBER_generate_key` if, for some reason, you need to encapsulate to a key
+// that was just generated.)
+OPENSSL_EXPORT void KYBER_public_from_private(
+    struct KYBER_public_key *out_public_key,
+    const struct KYBER_private_key *private_key);
+
+// KYBER_CIPHERTEXT_BYTES is number of bytes in the Kyber768 ciphertext.
+#define KYBER_CIPHERTEXT_BYTES 1088
+
+// KYBER_encap encrypts a random shared secret for `public_key`, writes the
+// ciphertext to `out_ciphertext`, and writes the random shared secret to
+// `out_shared_secret`.
+OPENSSL_EXPORT void KYBER_encap(
+    uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+    const struct KYBER_public_key *public_key);
+
+// KYBER_decap decrypts a shared secret from `ciphertext` using `private_key`
+// and writes it to `out_shared_secret`. If `ciphertext` is invalid,
+// `out_shared_secret` is filled with a key that will always be the same for the
+// same `ciphertext` and `private_key`, but which appears to be random unless
+// one has access to `private_key`. These alternatives occur in constant time.
+// Any subsequent symmetric encryption using `out_shared_secret` must use an
+// authenticated encryption scheme in order to discover the decapsulation
+// failure.
+OPENSSL_EXPORT void KYBER_decap(
+    uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+    const uint8_t ciphertext[KYBER_CIPHERTEXT_BYTES],
+    const struct KYBER_private_key *private_key);
+
+
+// Serialisation of keys.
+
+// KYBER_marshal_public_key serializes `public_key` to `out` in the standard
+// format for Kyber public keys. It returns one on success or zero on allocation
+// error.
+OPENSSL_EXPORT int KYBER_marshal_public_key(
+    CBB *out, const struct KYBER_public_key *public_key);
+
+// KYBER_parse_public_key parses a public key, in the format generated by
+// `KYBER_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns one on success or zero on parse error or if
+// there are trailing bytes in `in`.
+OPENSSL_EXPORT int KYBER_parse_public_key(
+    struct KYBER_public_key *out_public_key, CBS *in);
+
+// KYBER_marshal_private_key serializes `private_key` to `out` in the standard
+// format for Kyber private keys. It returns one on success or zero on
+// allocation error.
+OPENSSL_EXPORT int KYBER_marshal_private_key(
+    CBB *out, const struct KYBER_private_key *private_key);
+
+// KYBER_PRIVATE_KEY_BYTES is the length of the data produced by
+// `KYBER_marshal_private_key`.
+#define KYBER_PRIVATE_KEY_BYTES 2400
+
+// KYBER_parse_private_key parses a private key, in the format generated by
+// `KYBER_marshal_private_key`, from `in` and writes the result to
+// `out_private_key`. It returns one on success or zero on parse error or if
+// there are trailing bytes in `in`.
+OPENSSL_EXPORT int KYBER_parse_private_key(
+    struct KYBER_private_key *out_private_key, CBS *in);
+
+
+// Internal symbols.
 
 // KYBER_ENCAP_ENTROPY is the number of bytes of uniformly random entropy
 // necessary to encapsulate a secret. The entropy will be leaked to the
@@ -35,26 +142,24 @@ extern "C" {
 // KYBER_generate_key_external_entropy is a deterministic function to create a
 // pair of Kyber768 keys, using the supplied entropy. The entropy needs to be
 // uniformly random generated. This function is should only be used for tests,
-// regular callers should use the non-deterministic |KYBER_generate_key|
+// regular callers should use the non-deterministic `KYBER_generate_key`
 // directly.
 OPENSSL_EXPORT void KYBER_generate_key_external_entropy(
     uint8_t out_encoded_public_key[KYBER_PUBLIC_KEY_BYTES],
     struct KYBER_private_key *out_private_key,
     const uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]);
 
-// KYBER_encap_external_entropy behaves like |KYBER_encap|, but uses
-// |KYBER_ENCAP_ENTROPY| bytes of |entropy| for randomization. The decapsulating
-// side will be able to recover |entropy| in full. This function should only be
+// KYBER_encap_external_entropy behaves like `KYBER_encap`, but uses
+// `KYBER_ENCAP_ENTROPY` bytes of `entropy` for randomization. The decapsulating
+// side will be able to recover `entropy` in full. This function should only be
 // used for tests, regular callers should use the non-deterministic
-// |KYBER_encap| directly.
+// `KYBER_encap` directly.
 OPENSSL_EXPORT void KYBER_encap_external_entropy(
     uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
     uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
     const struct KYBER_public_key *public_key,
     const uint8_t entropy[KYBER_ENCAP_ENTROPY]);
 
-#if defined(__cplusplus)
-}
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/kyber/kyber.cc

@@ -12,9 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#define OPENSSL_UNSTABLE_EXPERIMENTAL_KYBER
-#include <openssl/experimental/kyber.h>
-
 #include <assert.h>
 #include <stdlib.h>
 
@@ -29,6 +26,8 @@
 // See
 // https://pq-crystals.org/kyber/data/kyber-specification-round3-20210804.pdf
 
+using namespace bssl;
+
 static void prf(uint8_t *out, size_t out_len, const uint8_t in[33]) {
   BORINGSSL_keccak(out, out_len, in, 33, boringssl_shake256);
 }
@@ -146,7 +145,7 @@ static uint16_t reduce_once(uint16_t x) {
   // We usually add value barriers to selects because Clang turns consecutive
   // selects with the same condition into a branch instead of CMOV/CSEL. This
   // condition does not occur in Kyber, so omitting it seems to be safe so far,
-  // but see |scalar_centered_binomial_distribution_eta_2_with_prf|.
+  // but see `scalar_centered_binomial_distribution_eta_2_with_prf`.
   return (mask & x) | (~mask & subtracted);
 }
 
@@ -167,9 +166,9 @@ static void vector_zero(vector *out) { OPENSSL_memset(out, 0, sizeof(*out)); }
 // In place number theoretic transform of a given scalar.
 // Note that Kyber's kPrime 3329 does not have a 512th root of unity, so this
 // transform leaves off the last iteration of the usual FFT code, with the 128
-// relevant roots of unity being stored in |kNTTRoots|. This means the output
+// relevant roots of unity being stored in `kNTTRoots`. This means the output
 // should be seen as 128 elements in GF(3329^2), with the coefficients of the
-// elements being consecutive entries in |s->c|.
+// elements being consecutive entries in `s->c`.
 static void scalar_ntt(scalar *s) {
   int offset = DEGREE;
   // `int` is used here because using `size_t` throughout caused a ~5% slowdown
@@ -200,7 +199,7 @@ static void vector_ntt(vector *a) {
 // entries of s->v being interpreted as elements of GF(3329^2). Just as with the
 // number theoretic transform, this leaves off the first step of the normal iFFT
 // to account for the fact that 3329 does not have a 512th root of unity, using
-// the precomputed 128 roots of unity stored in |kInverseNTTRoots|.
+// the precomputed 128 roots of unity stored in `kInverseNTTRoots`.
 static void scalar_inverse_ntt(scalar *s) {
   int step = DEGREE / 2;
   // `int` is used here because using `size_t` throughout caused a ~5% slowdown
@@ -246,8 +245,8 @@ static void scalar_sub(scalar *lhs, const scalar *rhs) {
 // 3329 does not have a 512th root of unity, this means we have to interpret
 // the 2*ith and (2*i+1)th entries of the scalar as elements of GF(3329)[X]/(X^2
 // - 17^(2*bitreverse(i)+1)) The value of 17^(2*bitreverse(i)+1) mod 3329 is
-// stored in the precomputed |kModRoots| table. Note that our Barrett transform
-// only allows us to multipy two reduced numbers together, so we need some
+// stored in the precomputed `kModRoots` table. Note that our Barrett transform
+// only allows us to multiply two reduced numbers together, so we need some
 // intermediate reduction steps, even if an uint64_t could hold 3 multiplied
 // numbers.
 static void scalar_mult(scalar *out, const scalar *lhs, const scalar *rhs) {
@@ -328,7 +327,7 @@ static void scalar_from_keccak_vartime(scalar *out,
 }
 
 // Algorithm 2 of the Kyber spec, with eta fixed to two and the PRF call
-// included. Creates binominally distributed elements by sampling 2*|eta| bits,
+// included. Creates binominally distributed elements by sampling 2*`eta` bits,
 // and setting the coefficient to the count of the first bits minus the count of
 // the second bits, resulting in a centered binomial distribution. Since eta is
 // two this gives -2/2 with a probability of 1/16, -1/1 with probability 1/4,
@@ -336,7 +335,7 @@ static void scalar_from_keccak_vartime(scalar *out,
 static void scalar_centered_binomial_distribution_eta_2_with_prf(
     scalar *out, const uint8_t input[33]) {
   uint8_t entropy[128];
-  static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8, "");
+  static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8);
   prf(entropy, sizeof(entropy), input);
 
   for (int i = 0; i < DEGREE; i += 2) {
@@ -344,10 +343,10 @@ static void scalar_centered_binomial_distribution_eta_2_with_prf(
 
     uint16_t value = (byte & 1) + ((byte >> 1) & 1);
     value -= ((byte >> 2) & 1) + ((byte >> 3) & 1);
-    // Add |kPrime| if |value| underflowed. See |reduce_once| for a discussion
+    // Add `kPrime` if `value` underflowed. See `reduce_once` for a discussion
     // on why the value barrier is omitted. While this could have been written
     // reduce_once(value + kPrime), this is one extra addition and small range
-    // of |value| tempts some versions of Clang to emit a branch.
+    // of `value` tempts some versions of Clang to emit a branch.
     uint16_t mask = 0u - (value >> 15);
     out->c[i] = value + (kPrime & mask);
 
@@ -361,8 +360,8 @@ static void scalar_centered_binomial_distribution_eta_2_with_prf(
 }
 
 // Generates a secret vector by using
-// |scalar_centered_binomial_distribution_eta_2_with_prf|, using the given seed
-// appending and incrementing |counter| for entry of the vector.
+// `scalar_centered_binomial_distribution_eta_2_with_prf`, using the given seed
+// appending and incrementing `counter` for entry of the vector.
 static void vector_generate_secret_eta_2(vector *out, uint8_t *counter,
                                          const uint8_t seed[32]) {
   uint8_t input[33];
@@ -427,7 +426,7 @@ static void scalar_encode(uint8_t *out, const scalar *s, int bits) {
   }
 }
 
-// scalar_encode_1 is |scalar_encode| specialised for |bits| == 1.
+// scalar_encode_1 is `scalar_encode` specialised for `bits` == 1.
 static void scalar_encode_1(uint8_t out[32], const scalar *s) {
   for (int i = 0; i < DEGREE; i += 8) {
     uint8_t out_byte = 0;
@@ -439,7 +438,7 @@ static void scalar_encode_1(uint8_t out[32], const scalar *s) {
   }
 }
 
-// Encodes an entire vector into 32*|RANK|*|bits| bytes. Note that since 256
+// Encodes an entire vector into 32*`RANK`*`bits` bytes. Note that since 256
 // (DEGREE) is divisible by 8, the individual vector entries will always fill a
 // whole number of bytes, so we do not need to worry about bit packing here.
 static void vector_encode(uint8_t *out, const vector *a, int bits) {
@@ -448,9 +447,9 @@ static void vector_encode(uint8_t *out, const vector *a, int bits) {
   }
 }
 
-// scalar_decode parses |DEGREE * bits| bits from |in| into |DEGREE| values in
-// |out|. It returns one on success and zero if any parsed value is >=
-// |kPrime|.
+// scalar_decode parses `DEGREE * bits` bits from `in` into `DEGREE` values in
+// `out`. It returns one on success and zero if any parsed value is >=
+// `kPrime`.
 static int scalar_decode(scalar *out, const uint8_t *in, int bits) {
   assert(bits <= (int)sizeof(*out->c) * 8 && bits != 1);
 
@@ -491,7 +490,7 @@ static int scalar_decode(scalar *out, const uint8_t *in, int bits) {
   return 1;
 }
 
-// scalar_decode_1 is |scalar_decode| specialised for |bits| == 1.
+// scalar_decode_1 is `scalar_decode` specialised for `bits` == 1.
 static void scalar_decode_1(scalar *out, const uint8_t in[32]) {
   for (int i = 0; i < DEGREE; i += 8) {
     uint8_t in_byte = *in;
@@ -503,8 +502,8 @@ static void scalar_decode_1(scalar *out, const uint8_t in[32]) {
   }
 }
 
-// Decodes 32*|RANK|*|bits| bytes from |in| into |out|. It returns one on
-// success or zero if any parsed value is >= |kPrime|.
+// Decodes 32*`RANK`*`bits` bytes from `in` into `out`. It returns one on
+// success or zero if any parsed value is >= `kPrime`.
 static int vector_decode(vector *out, const uint8_t *in, int bits) {
   for (int i = 0; i < RANK; i++) {
     if (!scalar_decode(&out->v[i], in + i * bits * DEGREE / 8, bits)) {
@@ -514,12 +513,12 @@ static int vector_decode(vector *out, const uint8_t *in, int bits) {
   return 1;
 }
 
-// Compresses (lossily) an input |x| mod 3329 into |bits| many bits by grouping
+// Compresses (lossily) an input `x` mod 3329 into `bits` many bits by grouping
 // numbers close to each other together. The formula used is
-// round(2^|bits|/kPrime*x) mod 2^|bits|.
+// round(2^`bits`/kPrime*x) mod 2^`bits`.
 // Uses Barrett reduction to achieve constant time. Since we need both the
 // remainder (for rounding) and the quotient (as the result), we cannot use
-// |reduce| here, but need to do the Barrett reduction directly.
+// `reduce` here, but need to do the Barrett reduction directly.
 static uint16_t compress(uint16_t x, int bits) {
   uint32_t shifted = (uint32_t)x << bits;
   uint64_t product = (uint64_t)shifted * kBarrettMultiplier;
@@ -536,19 +535,19 @@ static uint16_t compress(uint16_t x, int bits) {
   return quotient & ((1 << bits) - 1);
 }
 
-// Decompresses |x| by using an equi-distant representative. The formula is
-// round(kPrime/2^|bits|*x). Note that 2^|bits| being the divisor allows us to
+// Decompresses `x` by using an equi-distant representative. The formula is
+// round(kPrime/2^`bits`*x). Note that 2^`bits` being the divisor allows us to
 // implement this logic using only bit operations.
 static uint16_t decompress(uint16_t x, int bits) {
   uint32_t product = (uint32_t)x * kPrime;
   uint32_t power = 1 << bits;
-  // This is |product| % power, since |power| is a power of 2.
+  // This is `product` % power, since `power` is a power of 2.
   uint32_t remainder = product & (power - 1);
-  // This is |product| / power, since |power| is a power of 2.
+  // This is `product` / power, since `power` is a power of 2.
   uint32_t lower = product >> bits;
-  // The rounding logic works since the first half of numbers mod |power| have a
-  // 0 as first bit, and the second half has a 1 as first bit, since |power| is
-  // a power of 2. As a 12 bit number, |remainder| is always positive, so we
+  // The rounding logic works since the first half of numbers mod `power` have a
+  // 0 as first bit, and the second half has a 1 as first bit, since `power` is
+  // a power of 2. As a 12 bit number, `remainder` is always positive, so we
   // will shift in 0s for a right shift.
   return lower + (remainder >> (bits - 1));
 }
@@ -613,10 +612,11 @@ static struct private_key *private_key_from_external(
 
 }  // namespace
 
-// Calls |KYBER_generate_key_external_entropy| with random bytes from
-// |RAND_bytes|.
-void KYBER_generate_key(uint8_t out_encoded_public_key[KYBER_PUBLIC_KEY_BYTES],
-                        struct KYBER_private_key *out_private_key) {
+// Calls `KYBER_generate_key_external_entropy` with random bytes from
+// `RAND_bytes`.
+void bssl::KYBER_generate_key(
+    uint8_t out_encoded_public_key[KYBER_PUBLIC_KEY_BYTES],
+    struct KYBER_private_key *out_private_key) {
   uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY];
   RAND_bytes(entropy, sizeof(entropy));
   CONSTTIME_SECRET(entropy, sizeof(entropy));
@@ -639,7 +639,7 @@ static int kyber_marshal_public_key(CBB *out, const struct public_key *pub) {
 // Algorithms 4 and 7 of the Kyber spec. Algorithms are combined since key
 // generation is not part of the FO transform, and the spec uses Algorithm 7 to
 // specify the actual key format.
-void KYBER_generate_key_external_entropy(
+void bssl::KYBER_generate_key_external_entropy(
     uint8_t out_encoded_public_key[KYBER_PUBLIC_KEY_BYTES],
     struct KYBER_private_key *out_private_key,
     const uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]) {
@@ -674,15 +674,16 @@ void KYBER_generate_key_external_entropy(
   OPENSSL_memcpy(priv->fo_failure_secret, entropy + 32, 32);
 }
 
-void KYBER_public_from_private(struct KYBER_public_key *out_public_key,
-                               const struct KYBER_private_key *private_key) {
+void bssl::KYBER_public_from_private(
+    struct KYBER_public_key *out_public_key,
+    const struct KYBER_private_key *private_key) {
   struct public_key *const pub = public_key_from_external(out_public_key);
   const struct private_key *const priv = private_key_from_external(private_key);
   *pub = priv->pub;
 }
 
 // Algorithm 5 of the Kyber spec. Encrypts a message with given randomness to
-// the ciphertext in |out|. Without applying the Fujisaki-Okamoto transform this
+// the ciphertext in `out`. Without applying the Fujisaki-Okamoto transform this
 // would not result in a CCA secure scheme, since lattice schemes are vulnerable
 // to decryption failure oracles.
 static void encrypt_cpa(uint8_t out[KYBER_CIPHERTEXT_BYTES],
@@ -717,10 +718,10 @@ static void encrypt_cpa(uint8_t out[KYBER_CIPHERTEXT_BYTES],
   scalar_encode(out + kCompressedVectorSize, &v, kDV);
 }
 
-// Calls KYBER_encap_external_entropy| with random bytes from |RAND_bytes|
-void KYBER_encap(uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
-                 uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
-                 const struct KYBER_public_key *public_key) {
+// Calls `KYBER_encap_external_entropy` with random bytes from `RAND_bytes`
+void bssl::KYBER_encap(uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
+                       uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+                       const struct KYBER_public_key *public_key) {
   uint8_t entropy[KYBER_ENCAP_ENTROPY];
   RAND_bytes(entropy, KYBER_ENCAP_ENTROPY);
   CONSTTIME_SECRET(entropy, KYBER_ENCAP_ENTROPY);
@@ -734,7 +735,7 @@ void KYBER_encap(uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
 // this when a secure random number generator is used. When an insecure random
 // number generator is used, the caller should switch to a secure one before
 // calling this method.
-void KYBER_encap_external_entropy(
+void bssl::KYBER_encap_external_entropy(
     uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
     uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
     const struct KYBER_public_key *public_key,
@@ -777,9 +778,9 @@ static void decrypt_cpa(uint8_t out[32], const struct private_key *priv,
 // failure to be passed on to the caller, and instead returns a result that is
 // deterministic but unpredictable to anyone without knowledge of the private
 // key.
-void KYBER_decap(uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
-                 const uint8_t ciphertext[KYBER_CIPHERTEXT_BYTES],
-                 const struct KYBER_private_key *private_key) {
+void bssl::KYBER_decap(uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+                       const uint8_t ciphertext[KYBER_CIPHERTEXT_BYTES],
+                       const struct KYBER_private_key *private_key) {
   const struct private_key *priv = private_key_from_external(private_key);
   uint8_t decrypted[64];
   decrypt_cpa(decrypted, priv, ciphertext);
@@ -803,13 +804,13 @@ void KYBER_decap(uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
   kdf(out_shared_secret, KYBER_SHARED_SECRET_BYTES, input, sizeof(input));
 }
 
-int KYBER_marshal_public_key(CBB *out,
-                             const struct KYBER_public_key *public_key) {
+int bssl::KYBER_marshal_public_key(CBB *out,
+                                   const struct KYBER_public_key *public_key) {
   return kyber_marshal_public_key(out, public_key_from_external(public_key));
 }
 
-// kyber_parse_public_key_no_hash parses |in| into |pub| but doesn't calculate
-// the value of |pub->public_key_hash|.
+// kyber_parse_public_key_no_hash parses `in` into `pub` but doesn't calculate
+// the value of `pub->public_key_hash`.
 static int kyber_parse_public_key_no_hash(struct public_key *pub, CBS *in) {
   CBS t_bytes;
   if (!CBS_get_bytes(in, &t_bytes, kEncodedVectorSize) ||
@@ -821,7 +822,7 @@ static int kyber_parse_public_key_no_hash(struct public_key *pub, CBS *in) {
   return 1;
 }
 
-int KYBER_parse_public_key(struct KYBER_public_key *public_key, CBS *in) {
+int bssl::KYBER_parse_public_key(struct KYBER_public_key *public_key, CBS *in) {
   struct public_key *pub = public_key_from_external(public_key);
   CBS orig_in = *in;
   if (!kyber_parse_public_key_no_hash(pub, in) ||  //
@@ -832,8 +833,8 @@ int KYBER_parse_public_key(struct KYBER_public_key *public_key, CBS *in) {
   return 1;
 }
 
-int KYBER_marshal_private_key(CBB *out,
-                              const struct KYBER_private_key *private_key) {
+int bssl::KYBER_marshal_private_key(
+    CBB *out, const struct KYBER_private_key *private_key) {
   const struct private_key *const priv = private_key_from_external(private_key);
   uint8_t *s_output;
   if (!CBB_add_space(out, &s_output, kEncodedVectorSize)) {
@@ -850,8 +851,8 @@ int KYBER_marshal_private_key(CBB *out,
   return 1;
 }
 
-int KYBER_parse_private_key(struct KYBER_private_key *out_private_key,
-                            CBS *in) {
+int bssl::KYBER_parse_private_key(struct KYBER_private_key *out_private_key,
+                                  CBS *in) {
   struct private_key *const priv = private_key_from_external(out_private_key);
 
   CBS s_bytes;

data/third_party/boringssl-with-bazel/crypto/lhash/internal.h

@@ -15,20 +15,17 @@
 #ifndef OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H
 #define OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H
 
-#include <openssl/lhash.h>
+#include <openssl/base.h>
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
 
+BSSL_NAMESPACE_BEGIN
 
 // lhash is a traditional, chaining hash table that automatically expands and
 // contracts as needed. One should not use the lh_* functions directly, rather
 // use the type-safe macro wrappers:
 //
-// A hash table of a specific type of object has type |LHASH_OF(type)|. This
-// can be defined (once) with |DEFINE_LHASH_OF(type)| and declared where needed
-// with |DECLARE_LHASH_OF(type)|. For example:
+// A hash table of a specific type of object has type `LHASH_OF(type)`. This
+// can be defined (once) with `DEFINE_LHASH_OF(type)`.
 //
 //   struct foo {
 //     int bar;
@@ -36,19 +33,24 @@ extern "C" {
 //
 //   DEFINE_LHASH_OF(struct foo)
 //
-// Although note that the hash table will contain /pointers/ to |foo|.
+// Although note that the hash table will contain /pointers/ to `foo`.
 //
-// A macro will be defined for each of the |OPENSSL_lh_*| functions below. For
-// |LHASH_OF(foo)|, the macros would be |lh_foo_new|, |lh_foo_num_items| etc.
+// A macro will be defined for each of the `OPENSSL_lh_*` functions below. For
+// `LHASH_OF(foo)`, the macros would be `lh_foo_new`, `lh_foo_num_items` etc.
+//
+// TODO(davidben): Now that this type is completely internal, this can just be a
+// C++ template without any macros.
+
 
+#define LHASH_OF(type) struct bssl::type##_lhash_st
 
 // lhash_cmp_func is a comparison function that returns a value equal, or not
-// equal, to zero depending on whether |*a| is equal, or not equal to |*b|,
-// respectively. Note the difference between this and |stack_cmp_func| in that
+// equal, to zero depending on whether `*a` is equal, or not equal to `*b`,
+// respectively. Note the difference between this and `stack_cmp_func` in that
 // this takes pointers to the objects directly.
 //
 // This function's actual type signature is int (*)(const T*, const T*). The
-// low-level |lh_*| functions will be passed a type-specific wrapper to call it
+// low-level `lh_*` functions will be passed a type-specific wrapper to call it
 // correctly.
 typedef int (*lhash_cmp_func)(const void *a, const void *b);
 typedef int (*lhash_cmp_func_helper)(lhash_cmp_func func, const void *a,
@@ -58,74 +60,76 @@ typedef int (*lhash_cmp_func_helper)(lhash_cmp_func func, const void *a,
 // uint32_t.
 //
 // This function's actual type signature is uint32_t (*)(const T*). The
-// low-level |lh_*| functions will be passed a type-specific wrapper to call it
+// low-level `lh_*` functions will be passed a type-specific wrapper to call it
 // correctly.
 typedef uint32_t (*lhash_hash_func)(const void *a);
 typedef uint32_t (*lhash_hash_func_helper)(lhash_hash_func func, const void *a);
 
-typedef struct lhash_st _LHASH;
+struct _LHASH;
 
 // OPENSSL_lh_new returns a new, empty hash table or NULL on error.
 OPENSSL_EXPORT _LHASH *OPENSSL_lh_new(lhash_hash_func hash,
                                       lhash_cmp_func comp);
 
 // OPENSSL_lh_free frees the hash table itself but none of the elements. See
-// |OPENSSL_lh_doall|.
+// `OPENSSL_lh_doall`.
 OPENSSL_EXPORT void OPENSSL_lh_free(_LHASH *lh);
 
-// OPENSSL_lh_num_items returns the number of items in |lh|.
+// OPENSSL_lh_num_items returns the number of items in `lh`.
 OPENSSL_EXPORT size_t OPENSSL_lh_num_items(const _LHASH *lh);
 
-// OPENSSL_lh_retrieve finds an element equal to |data| in the hash table and
+// OPENSSL_lh_retrieve finds an element equal to `data` in the hash table and
 // returns it. If no such element exists, it returns NULL.
 OPENSSL_EXPORT void *OPENSSL_lh_retrieve(const _LHASH *lh, const void *data,
                                          lhash_hash_func_helper call_hash_func,
                                          lhash_cmp_func_helper call_cmp_func);
 
-// OPENSSL_lh_retrieve_key finds an element matching |key|, given the specified
-// hash and comparison function. This differs from |OPENSSL_lh_retrieve| in that
-// the key may be a different type than the values stored in |lh|. |key_hash|
-// and |cmp_key| must be compatible with the functions passed into
-// |OPENSSL_lh_new|.
+// OPENSSL_lh_retrieve_key finds an element matching `key`, given the specified
+// hash and comparison function. This differs from `OPENSSL_lh_retrieve` in that
+// the key may be a different type than the values stored in `lh`. `key_hash`
+// and `cmp_key` must be compatible with the functions passed into
+// `OPENSSL_lh_new`.
 OPENSSL_EXPORT void *OPENSSL_lh_retrieve_key(const _LHASH *lh, const void *key,
                                              uint32_t key_hash,
                                              int (*cmp_key)(const void *key,
                                                             const void *value));
 
-// OPENSSL_lh_insert inserts |data| into the hash table. If an existing element
-// is equal to |data| (with respect to the comparison function) then |*old_data|
+// OPENSSL_lh_insert inserts `data` into the hash table. If an existing element
+// is equal to `data` (with respect to the comparison function) then `*old_data`
 // will be set to that value and it will be replaced. Otherwise, or in the
-// event of an error, |*old_data| will be set to NULL. It returns one on
+// event of an error, `*old_data` will be set to NULL. It returns one on
 // success or zero in the case of an allocation error.
 OPENSSL_EXPORT int OPENSSL_lh_insert(_LHASH *lh, void **old_data, void *data,
                                      lhash_hash_func_helper call_hash_func,
                                      lhash_cmp_func_helper call_cmp_func);
 
-// OPENSSL_lh_delete removes an element equal to |data| from the hash table and
+// OPENSSL_lh_delete removes an element equal to `data` from the hash table and
 // returns it. If no such element is found, it returns NULL.
 OPENSSL_EXPORT void *OPENSSL_lh_delete(_LHASH *lh, const void *data,
                                        lhash_hash_func_helper call_hash_func,
                                        lhash_cmp_func_helper call_cmp_func);
 
-// OPENSSL_lh_doall_arg calls |func| on each element of the hash table and also
-// passes |arg| as the second argument.
+// OPENSSL_lh_doall_arg calls `func` on each element of the hash table and also
+// passes `arg` as the second argument.
 // TODO(fork): rename this
 OPENSSL_EXPORT void OPENSSL_lh_doall_arg(_LHASH *lh,
                                          void (*func)(void *, void *),
                                          void *arg);
 
+// DEFINE_LHASH_OF creates (inline) definitions of hash table. It must be used
+// from within the bssl namespace.
 #define DEFINE_LHASH_OF(type)                                                  \
   /* We disable MSVC C4191 in this macro, which warns when pointers are cast   \
    * to the wrong type. While the cast itself is valid, it is often a bug      \
    * because calling it through the cast is UB. However, we never actually     \
-   * call functions as |lhash_cmp_func|. The type is just a type-erased        \
+   * call functions as `lhash_cmp_func`. The type is just a type-erased        \
    * function pointer. (C does not guarantee function pointers fit in          \
-   * |void*|, and GCC will warn on this.) Thus we just disable the false       \
+   * `void*`, and GCC will warn on this.) Thus we just disable the false       \
    * positive warning. */                                                      \
   OPENSSL_MSVC_PRAGMA(warning(push))                                           \
   OPENSSL_MSVC_PRAGMA(warning(disable : 4191))                                 \
                                                                                \
-  DECLARE_LHASH_OF(type)                                                       \
+  struct type##_lhash_st;                                                      \
                                                                                \
   typedef int (*lhash_##type##_cmp_func)(const type *, const type *);          \
   typedef uint32_t (*lhash_##type##_hash_func)(const type *);                  \
@@ -181,7 +185,7 @@ OPENSSL_EXPORT void OPENSSL_lh_doall_arg(_LHASH *lh,
                                                                                \
   inline int lh_##type##_insert(LHASH_OF(type) *lh, type **old_data,           \
                                 type *data) {                                  \
-    void *old_data_void = NULL;                                                \
+    void *old_data_void = nullptr;                                             \
     int ret = OPENSSL_lh_insert((_LHASH *)lh, &old_data_void, data,            \
                                 lh_##type##_call_hash_func,                    \
                                 lh_##type##_call_cmp_func);                    \
@@ -213,9 +217,6 @@ OPENSSL_EXPORT void OPENSSL_lh_doall_arg(_LHASH *lh,
                                                                                \
   OPENSSL_MSVC_PRAGMA(warning(pop))
 
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H