grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/include/openssl/mldsa.h

@@ -15,7 +15,7 @@
 #ifndef OPENSSL_HEADER_MLDSA_H_
 #define OPENSSL_HEADER_MLDSA_H_
 
-#include <openssl/base.h>   // IWYU pragma: export
+#include <openssl/base.h>  // IWYU pragma: export
 
 #if defined(__cplusplus)
 extern "C" {
@@ -31,6 +31,9 @@ extern "C" {
 // MLDSA_SEED_BYTES is the number of bytes in an ML-DSA seed value.
 #define MLDSA_SEED_BYTES 32
 
+// MLDSA_MU_BYTES is the number of bytes in an ML-DSA mu value.
+#define MLDSA_MU_BYTES 64
+
 
 // ML-DSA-65.
 
@@ -38,7 +41,7 @@ extern "C" {
 // object should never leave the address space since the format is unstable.
 struct MLDSA65_private_key {
   union {
-    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (5 + 6 + 6)];
+    uint8_t bytes[(32 + 64 + 256 * 4 * 6) + 32 + 256 * 4 * (5 + 6 + 6)];
     uint32_t alignment;
   } opaque;
 };
@@ -52,9 +55,15 @@ struct MLDSA65_public_key {
   } opaque;
 };
 
-// MLDSA65_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
-// private key.
-#define MLDSA65_PRIVATE_KEY_BYTES 4032
+// MLDSA65_prehash contains a pre-hash context for ML-DSA-65. The contents of
+// this object should never leave the address space since the format is
+// unstable.
+struct MLDSA65_prehash {
+  union {
+    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
+    uint64_t alignment;
+  } opaque;
+};
 
 // MLDSA65_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
 // public key.
@@ -65,8 +74,8 @@ struct MLDSA65_public_key {
 #define MLDSA65_SIGNATURE_BYTES 3309
 
 // MLDSA65_generate_key generates a random public/private key pair, writes the
-// encoded public key to |out_encoded_public_key|, writes the seed to
-// |out_seed|, and sets |out_private_key| to the private key. Returns 1 on
+// encoded public key to `out_encoded_public_key`, writes the seed to
+// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
 // success and 0 on allocation failure.
 OPENSSL_EXPORT int MLDSA65_generate_key(
     uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
@@ -74,34 +83,34 @@ OPENSSL_EXPORT int MLDSA65_generate_key(
     struct MLDSA65_private_key *out_private_key);
 
 // MLDSA65_private_key_from_seed regenerates a private key from a seed value
-// that was generated by |MLDSA65_generate_key|. Returns 1 on success and 0 on
-// allocation failure or if |seed_len| is incorrect.
+// that was generated by `MLDSA65_generate_key`. Returns 1 on success and 0 on
+// allocation failure or if `seed_len` is incorrect.
 OPENSSL_EXPORT int MLDSA65_private_key_from_seed(
     struct MLDSA65_private_key *out_private_key, const uint8_t *seed,
     size_t seed_len);
 
-// MLDSA65_public_from_private sets |*out_public_key| to the public key that
-// corresponds to |private_key|. Returns 1 on success and 0 on failure.
+// MLDSA65_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. Returns 1 on success and 0 on failure.
 OPENSSL_EXPORT int MLDSA65_public_from_private(
     struct MLDSA65_public_key *out_public_key,
     const struct MLDSA65_private_key *private_key);
 
-// MLDSA65_sign generates a signature for the message |msg| of length
-// |msg_len| using |private_key| (following the randomized algorithm), and
-// writes the encoded signature to |out_encoded_signature|. The |context|
+// MLDSA65_sign generates a signature for the message `msg` of length
+// `msg_len` using `private_key` (following the randomized algorithm), and
+// writes the encoded signature to `out_encoded_signature`. The `context`
 // argument is also signed over and can be used to include implicit contextual
-// information that isn't included in |msg|. The same value of |context| must be
-// presented to |MLDSA65_verify| in order for the generated signature to be
-// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
+// information that isn't included in `msg`. The same value of `context` must be
+// presented to `MLDSA65_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
 // empty context (this is common). Returns 1 on success and 0 on failure.
 OPENSSL_EXPORT int MLDSA65_sign(
     uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
     const struct MLDSA65_private_key *private_key, const uint8_t *msg,
     size_t msg_len, const uint8_t *context, size_t context_len);
 
-// MLDSA65_verify verifies that |signature| constitutes a valid
-// signature for the message |msg| of length |msg_len| using |public_key|. The
-// value of |context| must equal the value that was passed to |MLDSA65_sign|
+// MLDSA65_verify verifies that `signature` constitutes a valid
+// signature for the message `msg` of length `msg_len` using `public_key`. The
+// value of `context` must equal the value that was passed to `MLDSA65_sign`
 // when the signature was generated. Returns 1 on success or 0 on error.
 OPENSSL_EXPORT int MLDSA65_verify(const struct MLDSA65_public_key *public_key,
                                   const uint8_t *signature,
@@ -109,20 +118,367 @@ OPENSSL_EXPORT int MLDSA65_verify(const struct MLDSA65_public_key *public_key,
                                   size_t msg_len, const uint8_t *context,
                                   size_t context_len);
 
-// MLDSA65_marshal_public_key serializes |public_key| to |out| in the standard
+// MLDSA65_prehash_init initializes a pre-hashing state using `public_key`. The
+// `context` argument can be used to include implicit contextual information
+// that isn't included in the message. The same value of `context` must be
+// presented to `MLDSA65_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
+// empty context (this is common). Returns 1 on success and 0 on failure (if the
+// context is too long).
+OPENSSL_EXPORT int MLDSA65_prehash_init(
+    struct MLDSA65_prehash *out_state,
+    const struct MLDSA65_public_key *public_key, const uint8_t *context,
+    size_t context_len);
+
+// MLDSA65_prehash_update incorporates the given `msg` of length `msg_len` into
+// the pre-hashing state. This can be called multiple times on successive chunks
+// of the message. This should be called after `MLDSA65_prehash_init` and before
+// `MLDSA65_prehash_finalize`.
+OPENSSL_EXPORT void MLDSA65_prehash_update(struct MLDSA65_prehash *inout_state,
+                                           const uint8_t *msg, size_t msg_len);
+
+// MLDSA65_prehash_finalize extracts a pre-hashed message representative from
+// the given pre-hashing state. This should be called after
+// `MLDSA65_prehash_init` and `MLDSA65_prehash_update`. The resulting
+// `out_msg_rep` should then be passed to `MLDSA65_sign_message_representative`
+// to obtain a signature.
+OPENSSL_EXPORT void MLDSA65_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA65_prehash *inout_state);
+
+// MLDSA65_sign_message_representative generates a signature for the pre-hashed
+// message `msg_rep` using `private_key` (following the randomized algorithm),
+// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
+// should be obtained via calls to `MLDSA65_prehash_init`,
+// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using the public key
+// from the same key pair, otherwise the signature will not verify. Returns 1 on
+// success and 0 on failure.
+OPENSSL_EXPORT int MLDSA65_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
+    const struct MLDSA65_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA65_verify_message_representative verifies that `signature` constitutes a
+// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
+// `msg_rep` should be obtained via calls to `MLDSA65_prehash_init`,
+// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using `public_key`
+// and the same context as when the signature was generated. Returns 1 on
+// success or 0 on error.
+OPENSSL_EXPORT int MLDSA65_verify_message_representative(
+    const struct MLDSA65_public_key *public_key,
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA65_marshal_public_key serializes `public_key` to `out` in the standard
 // format for ML-DSA-65 public keys. It returns 1 on success or 0 on
 // allocation error.
 OPENSSL_EXPORT int MLDSA65_marshal_public_key(
     CBB *out, const struct MLDSA65_public_key *public_key);
 
 // MLDSA65_parse_public_key parses a public key, in the format generated by
-// |MLDSA65_marshal_public_key|, from |in| and writes the result to
-// |out_public_key|. It returns 1 on success or 0 on parse error or if
-// there are trailing bytes in |in|.
+// `MLDSA65_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns 1 on success or 0 on parse error or if
+// there are trailing bytes in `in`.
 OPENSSL_EXPORT int MLDSA65_parse_public_key(
     struct MLDSA65_public_key *public_key, CBS *in);
 
 
+// ML-DSA-87.
+//
+// ML-DSA-87 is excessively and unnecessarily large. Use -65 unless you are
+// specifically attempting to achieve CNSA 2.0 compliance.
+
+// MLDSA87_private_key contains an ML-DSA-87 private key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct MLDSA87_private_key {
+  union {
+    uint8_t bytes[(32 + 64 + 256 * 4 * 8) + 32 + 256 * 4 * (7 + 8 + 8)];
+    uint32_t alignment;
+  } opaque;
+};
+
+// MLDSA87_public_key contains an ML-DSA-87 public key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct MLDSA87_public_key {
+  union {
+    uint8_t bytes[32 + 64 + 256 * 4 * 8];
+    uint32_t alignment;
+  } opaque;
+};
+
+// MLDSA87_prehash contains a pre-hash context for ML-DSA-87. The contents of
+// this object should never leave the address space since the format is
+// unstable.
+struct MLDSA87_prehash {
+  union {
+    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
+    uint64_t alignment;
+  } opaque;
+};
+
+// MLDSA87_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
+// public key.
+#define MLDSA87_PUBLIC_KEY_BYTES 2592
+
+// MLDSA87_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-87
+// signature.
+#define MLDSA87_SIGNATURE_BYTES 4627
+
+// MLDSA87_generate_key generates a random public/private key pair, writes the
+// encoded public key to `out_encoded_public_key`, writes the seed to
+// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
+// success and 0 on allocation failure.
+OPENSSL_EXPORT int MLDSA87_generate_key(
+    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES],
+    struct MLDSA87_private_key *out_private_key);
+
+// MLDSA87_private_key_from_seed regenerates a private key from a seed value
+// that was generated by `MLDSA87_generate_key`. Returns 1 on success and 0 on
+// allocation failure or if `seed_len` is incorrect.
+OPENSSL_EXPORT int MLDSA87_private_key_from_seed(
+    struct MLDSA87_private_key *out_private_key, const uint8_t *seed,
+    size_t seed_len);
+
+// MLDSA87_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. Returns 1 on success and 0 on failure.
+OPENSSL_EXPORT int MLDSA87_public_from_private(
+    struct MLDSA87_public_key *out_public_key,
+    const struct MLDSA87_private_key *private_key);
+
+// MLDSA87_sign generates a signature for the message `msg` of length
+// `msg_len` using `private_key` (following the randomized algorithm), and
+// writes the encoded signature to `out_encoded_signature`. The `context`
+// argument is also signed over and can be used to include implicit contextual
+// information that isn't included in `msg`. The same value of `context` must be
+// presented to `MLDSA87_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
+// empty context (this is common). Returns 1 on success and 0 on failure.
+OPENSSL_EXPORT int MLDSA87_sign(
+    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+    const struct MLDSA87_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context, size_t context_len);
+
+// MLDSA87_verify verifies that `signature` constitutes a valid
+// signature for the message `msg` of length `msg_len` using `public_key`. The
+// value of `context` must equal the value that was passed to `MLDSA87_sign`
+// when the signature was generated. Returns 1 on success or 0 on error.
+OPENSSL_EXPORT int MLDSA87_verify(const struct MLDSA87_public_key *public_key,
+                                  const uint8_t *signature,
+                                  size_t signature_len, const uint8_t *msg,
+                                  size_t msg_len, const uint8_t *context,
+                                  size_t context_len);
+
+// MLDSA87_prehash_init initializes a pre-hashing state using `public_key`. The
+// `context` argument can be used to include implicit contextual information
+// that isn't included in the message. The same value of `context` must be
+// presented to `MLDSA87_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
+// empty context (this is common). Returns 1 on success and 0 on failure (if the
+// context is too long).
+OPENSSL_EXPORT int MLDSA87_prehash_init(
+    struct MLDSA87_prehash *out_state,
+    const struct MLDSA87_public_key *public_key, const uint8_t *context,
+    size_t context_len);
+
+// MLDSA87_prehash_update incorporates the given `msg` of length `msg_len` into
+// the pre-hashing state. This can be called multiple times on successive chunks
+// of the message. This should be called after `MLDSA87_prehash_init` and before
+// `MLDSA87_prehash_finalize`.
+OPENSSL_EXPORT void MLDSA87_prehash_update(struct MLDSA87_prehash *inout_state,
+                                           const uint8_t *msg, size_t msg_len);
+
+// MLDSA87_prehash_finalize extracts a pre-hashed message representative from
+// the given pre-hashing state. This should be called after
+// `MLDSA87_prehash_init` and `MLDSA87_prehash_update`. The resulting
+// `out_msg_rep` should then be passed to `MLDSA87_sign_message_representative`
+// to obtain a signature.
+OPENSSL_EXPORT void MLDSA87_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA87_prehash *inout_state);
+
+// MLDSA87_sign_message_representative generates a signature for the pre-hashed
+// message `msg_rep` using `private_key` (following the randomized algorithm),
+// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
+// should be obtained via calls to `MLDSA87_prehash_init`,
+// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using the public key
+// from the same key pair, otherwise the signature will not verify. Returns 1 on
+// success and 0 on failure.
+OPENSSL_EXPORT int MLDSA87_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+    const struct MLDSA87_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA87_verify_message_representative verifies that `signature` constitutes a
+// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
+// `msg_rep` should be obtained via calls to `MLDSA87_prehash_init`,
+// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using `public_key`
+// and the same context as when the signature was generated. Returns 1 on
+// success or 0 on error.
+OPENSSL_EXPORT int MLDSA87_verify_message_representative(
+    const struct MLDSA87_public_key *public_key,
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA87_marshal_public_key serializes `public_key` to `out` in the standard
+// format for ML-DSA-87 public keys. It returns 1 on success or 0 on
+// allocation error.
+OPENSSL_EXPORT int MLDSA87_marshal_public_key(
+    CBB *out, const struct MLDSA87_public_key *public_key);
+
+// MLDSA87_parse_public_key parses a public key, in the format generated by
+// `MLDSA87_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns 1 on success or 0 on parse error or if
+// there are trailing bytes in `in`.
+OPENSSL_EXPORT int MLDSA87_parse_public_key(
+    struct MLDSA87_public_key *public_key, CBS *in);
+
+
+// ML-DSA-44.
+
+// MLDSA44_private_key contains an ML-DSA-44 private key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct MLDSA44_private_key {
+  union {
+    uint8_t bytes[(32 + 64 + 256 * 4 * 4) + 32 + 256 * 4 * (4 + 4 + 4)];
+    uint32_t alignment;
+  } opaque;
+};
+
+// MLDSA44_public_key contains an ML-DSA-44 public key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct MLDSA44_public_key {
+  union {
+    uint8_t bytes[32 + 64 + 256 * 4 * 4];
+    uint32_t alignment;
+  } opaque;
+};
+
+// MLDSA44_prehash contains a pre-hash context for ML-DSA-44. The contents of
+// this object should never leave the address space since the format is
+// unstable.
+struct MLDSA44_prehash {
+  union {
+    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
+    uint64_t alignment;
+  } opaque;
+};
+
+// MLDSA44_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-44
+// public key.
+#define MLDSA44_PUBLIC_KEY_BYTES 1312
+
+// MLDSA44_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-44
+// signature.
+#define MLDSA44_SIGNATURE_BYTES 2420
+
+// MLDSA44_generate_key generates a random public/private key pair, writes the
+// encoded public key to `out_encoded_public_key`, writes the seed to
+// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
+// success and 0 on allocation failure.
+OPENSSL_EXPORT int MLDSA44_generate_key(
+    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES],
+    struct MLDSA44_private_key *out_private_key);
+
+// MLDSA44_private_key_from_seed regenerates a private key from a seed value
+// that was generated by `MLDSA44_generate_key`. Returns 1 on success and 0 on
+// allocation failure or if `seed_len` is incorrect.
+OPENSSL_EXPORT int MLDSA44_private_key_from_seed(
+    struct MLDSA44_private_key *out_private_key, const uint8_t *seed,
+    size_t seed_len);
+
+// MLDSA44_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. Returns 1 on success and 0 on failure.
+OPENSSL_EXPORT int MLDSA44_public_from_private(
+    struct MLDSA44_public_key *out_public_key,
+    const struct MLDSA44_private_key *private_key);
+
+// MLDSA44_sign generates a signature for the message `msg` of length
+// `msg_len` using `private_key` (following the randomized algorithm), and
+// writes the encoded signature to `out_encoded_signature`. The `context`
+// argument is also signed over and can be used to include implicit contextual
+// information that isn't included in `msg`. The same value of `context` must be
+// presented to `MLDSA44_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
+// empty context (this is common). Returns 1 on success and 0 on failure.
+OPENSSL_EXPORT int MLDSA44_sign(
+    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const struct MLDSA44_private_key *private_key, const uint8_t *msg,
+    size_t msg_len, const uint8_t *context, size_t context_len);
+
+// MLDSA44_verify verifies that `signature` constitutes a valid
+// signature for the message `msg` of length `msg_len` using `public_key`. The
+// value of `context` must equal the value that was passed to `MLDSA44_sign`
+// when the signature was generated. Returns 1 on success or 0 on error.
+OPENSSL_EXPORT int MLDSA44_verify(const struct MLDSA44_public_key *public_key,
+                                  const uint8_t *signature,
+                                  size_t signature_len, const uint8_t *msg,
+                                  size_t msg_len, const uint8_t *context,
+                                  size_t context_len);
+
+// MLDSA44_prehash_init initializes a pre-hashing state using `public_key`. The
+// `context` argument can be used to include implicit contextual information
+// that isn't included in the message. The same value of `context` must be
+// presented to `MLDSA44_verify` in order for the generated signature to be
+// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
+// empty context (this is common). Returns 1 on success and 0 on failure (if the
+// context is too long).
+OPENSSL_EXPORT int MLDSA44_prehash_init(
+    struct MLDSA44_prehash *out_state,
+    const struct MLDSA44_public_key *public_key, const uint8_t *context,
+    size_t context_len);
+
+// MLDSA44_prehash_update incorporates the given `msg` of length `msg_len` into
+// the pre-hashing state. This can be called multiple times on successive chunks
+// of the message. This should be called after `MLDSA44_prehash_init` and before
+// `MLDSA44_prehash_finalize`.
+OPENSSL_EXPORT void MLDSA44_prehash_update(struct MLDSA44_prehash *inout_state,
+                                           const uint8_t *msg, size_t msg_len);
+
+// MLDSA44_prehash_finalize extracts a pre-hashed message representative from
+// the given pre-hashing state. This should be called after
+// `MLDSA44_prehash_init` and `MLDSA44_prehash_update`. The resulting
+// `out_msg_rep` should then be passed to `MLDSA44_sign_message_representative`
+// to obtain a signature.
+OPENSSL_EXPORT void MLDSA44_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA44_prehash *inout_state);
+
+// MLDSA44_sign_message_representative generates a signature for the pre-hashed
+// message `msg_rep` using `private_key` (following the randomized algorithm),
+// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
+// should be obtained via calls to `MLDSA44_prehash_init`,
+// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using the public key
+// from the same key pair, otherwise the signature will not verify. Returns 1 on
+// success and 0 on failure.
+OPENSSL_EXPORT int MLDSA44_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const struct MLDSA44_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA44_verify_message_representative verifies that `signature` constitutes a
+// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
+// `msg_rep` should be obtained via calls to `MLDSA44_prehash_init`,
+// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using `public_key`
+// and the same context as when the signature was generated. Returns 1 on
+// success or 0 on error.
+OPENSSL_EXPORT int MLDSA44_verify_message_representative(
+    const struct MLDSA44_public_key *public_key,
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+// MLDSA44_marshal_public_key serializes `public_key` to `out` in the standard
+// format for ML-DSA-44 public keys. It returns 1 on success or 0 on
+// allocation error.
+OPENSSL_EXPORT int MLDSA44_marshal_public_key(
+    CBB *out, const struct MLDSA44_public_key *public_key);
+
+// MLDSA44_parse_public_key parses a public key, in the format generated by
+// `MLDSA44_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns 1 on success or 0 on parse error or if
+// there are trailing bytes in `in`.
+OPENSSL_EXPORT int MLDSA44_parse_public_key(
+    struct MLDSA44_public_key *public_key, CBS *in);
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/include/openssl/mlkem.h

@@ -25,7 +25,7 @@ extern "C" {
 // ML-KEM-768.
 //
 // This implements the Module-Lattice-Based Key-Encapsulation Mechanism from
-// https://csrc.nist.gov/pubs/fips/204/final
+// https://csrc.nist.gov/pubs/fips/203/final
 
 
 // MLKEM768_public_key contains an ML-KEM-768 public key. The contents of this
@@ -54,8 +54,8 @@ struct MLKEM768_private_key {
 #define MLKEM_SEED_BYTES 64
 
 // MLKEM768_generate_key generates a random public/private key pair, writes the
-// encoded public key to |out_encoded_public_key| and sets |out_private_key| to
-// the private key. If |optional_out_seed| is not NULL then the seed used to
+// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
+// the private key. If `optional_out_seed` is not NULL then the seed used to
 // generate the private key is written to it.
 OPENSSL_EXPORT void MLKEM768_generate_key(
     uint8_t out_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES],
@@ -63,15 +63,15 @@ OPENSSL_EXPORT void MLKEM768_generate_key(
     struct MLKEM768_private_key *out_private_key);
 
 // MLKEM768_private_key_from_seed derives a private key from a seed that was
-// generated by |MLKEM768_generate_key|. It fails and returns 0 if |seed_len| is
-// incorrect, otherwise it writes |*out_private_key| and returns 1.
+// generated by `MLKEM768_generate_key`. It fails and returns 0 if `seed_len` is
+// incorrect, otherwise it writes `*out_private_key` and returns 1.
 OPENSSL_EXPORT int MLKEM768_private_key_from_seed(
     struct MLKEM768_private_key *out_private_key, const uint8_t *seed,
     size_t seed_len);
 
-// MLKEM768_public_from_private sets |*out_public_key| to the public key that
-// corresponds to |private_key|. (This is faster than parsing the output of
-// |MLKEM768_generate_key| if, for some reason, you need to encapsulate to a key
+// MLKEM768_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. (This is faster than parsing the output of
+// `MLKEM768_generate_key` if, for some reason, you need to encapsulate to a key
 // that was just generated.)
 OPENSSL_EXPORT void MLKEM768_public_from_private(
     struct MLKEM768_public_key *out_public_key,
@@ -83,21 +83,21 @@ OPENSSL_EXPORT void MLKEM768_public_from_private(
 // MLKEM_SHARED_SECRET_BYTES is the number of bytes in an ML-KEM shared secret.
 #define MLKEM_SHARED_SECRET_BYTES 32
 
-// MLKEM768_encap encrypts a random shared secret for |public_key|, writes the
-// ciphertext to |out_ciphertext|, and writes the random shared secret to
-// |out_shared_secret|.
+// MLKEM768_encap encrypts a random shared secret for `public_key`, writes the
+// ciphertext to `out_ciphertext`, and writes the random shared secret to
+// `out_shared_secret`.
 OPENSSL_EXPORT void MLKEM768_encap(
     uint8_t out_ciphertext[MLKEM768_CIPHERTEXT_BYTES],
     uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
     const struct MLKEM768_public_key *public_key);
 
-// MLKEM768_decap decrypts a shared secret from |ciphertext| using |private_key|
-// and writes it to |out_shared_secret|. If |ciphertext_len| is incorrect it
-// returns 0, otherwise it returns 1. If |ciphertext| is invalid (but of the
-// correct length), |out_shared_secret| is filled with a key that will always be
-// the same for the same |ciphertext| and |private_key|, but which appears to be
-// random unless one has access to |private_key|. These alternatives occur in
-// constant time. Any subsequent symmetric encryption using |out_shared_secret|
+// MLKEM768_decap decrypts a shared secret from `ciphertext` using `private_key`
+// and writes it to `out_shared_secret`. If `ciphertext_len` is incorrect it
+// returns 0, otherwise it returns 1. If `ciphertext` is invalid (but of the
+// correct length), `out_shared_secret` is filled with a key that will always be
+// the same for the same `ciphertext` and `private_key`, but which appears to be
+// random unless one has access to `private_key`. These alternatives occur in
+// constant time. Any subsequent symmetric encryption using `out_shared_secret`
 // must use an authenticated encryption scheme in order to discover the
 // decapsulation failure.
 OPENSSL_EXPORT int MLKEM768_decap(
@@ -108,16 +108,16 @@ OPENSSL_EXPORT int MLKEM768_decap(
 
 // Serialisation of keys.
 
-// MLKEM768_marshal_public_key serializes |public_key| to |out| in the standard
+// MLKEM768_marshal_public_key serializes `public_key` to `out` in the standard
 // format for ML-KEM-768 public keys. It returns one on success or zero on
 // allocation error.
 OPENSSL_EXPORT int MLKEM768_marshal_public_key(
     CBB *out, const struct MLKEM768_public_key *public_key);
 
 // MLKEM768_parse_public_key parses a public key, in the format generated by
-// |MLKEM768_marshal_public_key|, from |in| and writes the result to
-// |out_public_key|. It returns one on success or zero on parse error or if
-// there are trailing bytes in |in|.
+// `MLKEM768_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns one on success or zero on parse error or if
+// there are trailing bytes in `in`.
 OPENSSL_EXPORT int MLKEM768_parse_public_key(
     struct MLKEM768_public_key *out_public_key, CBS *in);
 
@@ -150,8 +150,8 @@ struct MLKEM1024_private_key {
 #define MLKEM1024_PUBLIC_KEY_BYTES 1568
 
 // MLKEM1024_generate_key generates a random public/private key pair, writes the
-// encoded public key to |out_encoded_public_key| and sets |out_private_key| to
-// the private key. If |optional_out_seed| is not NULL then the seed used to
+// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
+// the private key. If `optional_out_seed` is not NULL then the seed used to
 // generate the private key is written to it.
 OPENSSL_EXPORT void MLKEM1024_generate_key(
     uint8_t out_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES],
@@ -159,15 +159,15 @@ OPENSSL_EXPORT void MLKEM1024_generate_key(
     struct MLKEM1024_private_key *out_private_key);
 
 // MLKEM1024_private_key_from_seed derives a private key from a seed that was
-// generated by |MLKEM1024_generate_key|. It fails and returns 0 if |seed_len|
-// is incorrect, otherwise it writes |*out_private_key| and returns 1.
+// generated by `MLKEM1024_generate_key`. It fails and returns 0 if `seed_len`
+// is incorrect, otherwise it writes `*out_private_key` and returns 1.
 OPENSSL_EXPORT int MLKEM1024_private_key_from_seed(
     struct MLKEM1024_private_key *out_private_key, const uint8_t *seed,
     size_t seed_len);
 
-// MLKEM1024_public_from_private sets |*out_public_key| to the public key that
-// corresponds to |private_key|. (This is faster than parsing the output of
-// |MLKEM1024_generate_key| if, for some reason, you need to encapsulate to a
+// MLKEM1024_public_from_private sets `*out_public_key` to the public key that
+// corresponds to `private_key`. (This is faster than parsing the output of
+// `MLKEM1024_generate_key` if, for some reason, you need to encapsulate to a
 // key that was just generated.)
 OPENSSL_EXPORT void MLKEM1024_public_from_private(
     struct MLKEM1024_public_key *out_public_key,
@@ -176,22 +176,22 @@ OPENSSL_EXPORT void MLKEM1024_public_from_private(
 // MLKEM1024_CIPHERTEXT_BYTES is number of bytes in the ML-KEM-1024 ciphertext.
 #define MLKEM1024_CIPHERTEXT_BYTES 1568
 
-// MLKEM1024_encap encrypts a random shared secret for |public_key|, writes the
-// ciphertext to |out_ciphertext|, and writes the random shared secret to
-// |out_shared_secret|.
+// MLKEM1024_encap encrypts a random shared secret for `public_key`, writes the
+// ciphertext to `out_ciphertext`, and writes the random shared secret to
+// `out_shared_secret`.
 OPENSSL_EXPORT void MLKEM1024_encap(
     uint8_t out_ciphertext[MLKEM1024_CIPHERTEXT_BYTES],
     uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
     const struct MLKEM1024_public_key *public_key);
 
-// MLKEM1024_decap decrypts a shared secret from |ciphertext| using
-// |private_key| and writes it to |out_shared_secret|. If |ciphertext_len| is
-// incorrect it returns 0, otherwise it returns 1. If |ciphertext| is invalid
-// (but of the correct length), |out_shared_secret| is filled with a key that
-// will always be the same for the same |ciphertext| and |private_key|, but
-// which appears to be random unless one has access to |private_key|. These
+// MLKEM1024_decap decrypts a shared secret from `ciphertext` using
+// `private_key` and writes it to `out_shared_secret`. If `ciphertext_len` is
+// incorrect it returns 0, otherwise it returns 1. If `ciphertext` is invalid
+// (but of the correct length), `out_shared_secret` is filled with a key that
+// will always be the same for the same `ciphertext` and `private_key`, but
+// which appears to be random unless one has access to `private_key`. These
 // alternatives occur in constant time. Any subsequent symmetric encryption
-// using |out_shared_secret| must use an authenticated encryption scheme in
+// using `out_shared_secret` must use an authenticated encryption scheme in
 // order to discover the decapsulation failure.
 OPENSSL_EXPORT int MLKEM1024_decap(
     uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
@@ -201,16 +201,16 @@ OPENSSL_EXPORT int MLKEM1024_decap(
 
 // Serialisation of ML-KEM-1024 keys.
 
-// MLKEM1024_marshal_public_key serializes |public_key| to |out| in the standard
+// MLKEM1024_marshal_public_key serializes `public_key` to `out` in the standard
 // format for ML-KEM-1024 public keys. It returns one on success or zero on
 // allocation error.
 OPENSSL_EXPORT int MLKEM1024_marshal_public_key(
     CBB *out, const struct MLKEM1024_public_key *public_key);
 
 // MLKEM1024_parse_public_key parses a public key, in the format generated by
-// |MLKEM1024_marshal_public_key|, from |in| and writes the result to
-// |out_public_key|. It returns one on success or zero on parse error or if
-// there are trailing bytes in |in|.
+// `MLKEM1024_marshal_public_key`, from `in` and writes the result to
+// `out_public_key`. It returns one on success or zero on parse error or if
+// there are trailing bytes in `in`.
 OPENSSL_EXPORT int MLKEM1024_parse_public_key(
     struct MLKEM1024_public_key *out_public_key, CBS *in);