grpc 1.9.1 → 1.10.0.pre1

data/third_party/boringssl/ssl/ssl_aead_ctx.c

@@ -1,335 +0,0 @@
-/* Copyright (c) 2015, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-
-#include <openssl/ssl.h>
-
-#include <assert.h>
-#include <string.h>
-
-#include <openssl/aead.h>
-#include <openssl/err.h>
-#include <openssl/rand.h>
-#include <openssl/type_check.h>
-
-#include "../crypto/internal.h"
-#include "internal.h"
-
-
-SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
-                               uint16_t version, const SSL_CIPHER *cipher,
-                               const uint8_t *enc_key, size_t enc_key_len,
-                               const uint8_t *mac_key, size_t mac_key_len,
-                               const uint8_t *fixed_iv, size_t fixed_iv_len) {
-  const EVP_AEAD *aead;
-  size_t expected_mac_key_len, expected_fixed_iv_len;
-  if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len,
-                               &expected_fixed_iv_len, cipher, version) ||
-      /* Ensure the caller returned correct key sizes. */
-      expected_fixed_iv_len != fixed_iv_len ||
-      expected_mac_key_len != mac_key_len) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return 0;
-  }
-
-  uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
-  if (mac_key_len > 0) {
-    /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher
-     * suites). */
-    if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) {
-      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-      return 0;
-    }
-    OPENSSL_memcpy(merged_key, mac_key, mac_key_len);
-    OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len);
-    OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv,
-                   fixed_iv_len);
-    enc_key = merged_key;
-    enc_key_len += mac_key_len;
-    enc_key_len += fixed_iv_len;
-  }
-
-  SSL_AEAD_CTX *aead_ctx = OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
-  if (aead_ctx == NULL) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return NULL;
-  }
-  OPENSSL_memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX));
-  aead_ctx->cipher = cipher;
-
-  if (!EVP_AEAD_CTX_init_with_direction(
-          &aead_ctx->ctx, aead, enc_key, enc_key_len,
-          EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
-    OPENSSL_free(aead_ctx);
-    return NULL;
-  }
-
-  assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
-  OPENSSL_COMPILE_ASSERT(EVP_AEAD_MAX_NONCE_LENGTH < 256,
-                         variable_nonce_len_doesnt_fit_in_uint8_t);
-  aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead);
-  if (mac_key_len == 0) {
-    assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce));
-    OPENSSL_memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len);
-    aead_ctx->fixed_nonce_len = fixed_iv_len;
-
-    if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
-      /* The fixed nonce into the actual nonce (the sequence number). */
-      aead_ctx->xor_fixed_nonce = 1;
-      aead_ctx->variable_nonce_len = 8;
-    } else {
-      /* The fixed IV is prepended to the nonce. */
-      assert(fixed_iv_len <= aead_ctx->variable_nonce_len);
-      aead_ctx->variable_nonce_len -= fixed_iv_len;
-    }
-
-    /* AES-GCM uses an explicit nonce. */
-    if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) {
-      aead_ctx->variable_nonce_included_in_record = 1;
-    }
-
-    /* The TLS 1.3 construction XORs the fixed nonce into the sequence number
-     * and omits the additional data. */
-    if (version >= TLS1_3_VERSION) {
-      aead_ctx->xor_fixed_nonce = 1;
-      aead_ctx->variable_nonce_len = 8;
-      aead_ctx->variable_nonce_included_in_record = 0;
-      aead_ctx->omit_ad = 1;
-      assert(fixed_iv_len >= aead_ctx->variable_nonce_len);
-    }
-  } else {
-    assert(version < TLS1_3_VERSION);
-    aead_ctx->variable_nonce_included_in_record = 1;
-    aead_ctx->random_variable_nonce = 1;
-    aead_ctx->omit_length_in_ad = 1;
-    aead_ctx->omit_version_in_ad = (version == SSL3_VERSION);
-  }
-
-  return aead_ctx;
-}
-
-void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) {
-  if (aead == NULL) {
-    return;
-  }
-  EVP_AEAD_CTX_cleanup(&aead->ctx);
-  OPENSSL_free(aead);
-}
-
-size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *aead) {
-#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
-  aead = NULL;
-#endif
-
-  if (aead != NULL && aead->variable_nonce_included_in_record) {
-    return aead->variable_nonce_len;
-  }
-  return 0;
-}
-
-size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *aead) {
-#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
-  aead = NULL;
-#endif
-
-  if (aead == NULL) {
-    return 0;
-  }
-  return EVP_AEAD_max_overhead(aead->ctx.aead) +
-         SSL_AEAD_CTX_explicit_nonce_len(aead);
-}
-
-/* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and
- * returns the number of bytes written. */
-static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13],
-                                  uint8_t type, uint16_t wire_version,
-                                  const uint8_t seqnum[8],
-                                  size_t plaintext_len) {
-  if (aead->omit_ad) {
-    return 0;
-  }
-
-  OPENSSL_memcpy(out, seqnum, 8);
-  size_t len = 8;
-  out[len++] = type;
-  if (!aead->omit_version_in_ad) {
-    out[len++] = (uint8_t)(wire_version >> 8);
-    out[len++] = (uint8_t)wire_version;
-  }
-  if (!aead->omit_length_in_ad) {
-    out[len++] = (uint8_t)(plaintext_len >> 8);
-    out[len++] = (uint8_t)plaintext_len;
-  }
-  return len;
-}
-
-int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type,
-                      uint16_t wire_version, const uint8_t seqnum[8],
-                      uint8_t *in, size_t in_len) {
-#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
-  aead = NULL;
-#endif
-
-  if (aead == NULL) {
-    /* Handle the initial NULL cipher. */
-    CBS_init(out, in, in_len);
-    return 1;
-  }
-
-  /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
-   * overhead. Otherwise the parameter is unused. */
-  size_t plaintext_len = 0;
-  if (!aead->omit_length_in_ad) {
-    size_t overhead = SSL_AEAD_CTX_max_overhead(aead);
-    if (in_len < overhead) {
-      /* Publicly invalid. */
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
-      return 0;
-    }
-    plaintext_len = in_len - overhead;
-  }
-  uint8_t ad[13];
-  size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
-                                      plaintext_len);
-
-  /* Assemble the nonce. */
-  uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
-  size_t nonce_len = 0;
-
-  /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
-  if (aead->xor_fixed_nonce) {
-    nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
-    OPENSSL_memset(nonce, 0, nonce_len);
-  } else {
-    OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
-    nonce_len += aead->fixed_nonce_len;
-  }
-
-  /* Add the variable nonce. */
-  if (aead->variable_nonce_included_in_record) {
-    if (in_len < aead->variable_nonce_len) {
-      /* Publicly invalid. */
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
-      return 0;
-    }
-    OPENSSL_memcpy(nonce + nonce_len, in, aead->variable_nonce_len);
-    in += aead->variable_nonce_len;
-    in_len -= aead->variable_nonce_len;
-  } else {
-    assert(aead->variable_nonce_len == 8);
-    OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
-  }
-  nonce_len += aead->variable_nonce_len;
-
-  /* XOR the fixed nonce, if necessary. */
-  if (aead->xor_fixed_nonce) {
-    assert(nonce_len == aead->fixed_nonce_len);
-    for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
-      nonce[i] ^= aead->fixed_nonce[i];
-    }
-  }
-
-  /* Decrypt in-place. */
-  size_t len;
-  if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len,
-                         in, in_len, ad, ad_len)) {
-    return 0;
-  }
-  CBS_init(out, in, len);
-  return 1;
-}
-
-int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
-                      size_t max_out, uint8_t type, uint16_t wire_version,
-                      const uint8_t seqnum[8], const uint8_t *in,
-                      size_t in_len) {
-#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
-  aead = NULL;
-#endif
-
-  if (aead == NULL) {
-    /* Handle the initial NULL cipher. */
-    if (in_len > max_out) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
-      return 0;
-    }
-    OPENSSL_memmove(out, in, in_len);
-    *out_len = in_len;
-    return 1;
-  }
-
-  uint8_t ad[13];
-  size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
-                                      in_len);
-
-  /* Assemble the nonce. */
-  uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
-  size_t nonce_len = 0;
-
-  /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
-  if (aead->xor_fixed_nonce) {
-    nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
-    OPENSSL_memset(nonce, 0, nonce_len);
-  } else {
-    OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
-    nonce_len += aead->fixed_nonce_len;
-  }
-
-  /* Select the variable nonce. */
-  if (aead->random_variable_nonce) {
-    assert(aead->variable_nonce_included_in_record);
-    if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) {
-      return 0;
-    }
-  } else {
-    /* When sending we use the sequence number as the variable part of the
-     * nonce. */
-    assert(aead->variable_nonce_len == 8);
-    OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
-  }
-  nonce_len += aead->variable_nonce_len;
-
-  /* Emit the variable nonce if included in the record. */
-  size_t extra_len = 0;
-  if (aead->variable_nonce_included_in_record) {
-    assert(!aead->xor_fixed_nonce);
-    if (max_out < aead->variable_nonce_len) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
-      return 0;
-    }
-    if (out < in + in_len && in < out + aead->variable_nonce_len) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
-      return 0;
-    }
-    OPENSSL_memcpy(out, nonce + aead->fixed_nonce_len,
-                   aead->variable_nonce_len);
-    extra_len = aead->variable_nonce_len;
-    out += aead->variable_nonce_len;
-    max_out -= aead->variable_nonce_len;
-  }
-
-  /* XOR the fixed nonce, if necessary. */
-  if (aead->xor_fixed_nonce) {
-    assert(nonce_len == aead->fixed_nonce_len);
-    for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
-      nonce[i] ^= aead->fixed_nonce[i];
-    }
-  }
-
-  if (!EVP_AEAD_CTX_seal(&aead->ctx, out, out_len, max_out, nonce, nonce_len,
-                         in, in_len, ad, ad_len)) {
-    return 0;
-  }
-  *out_len += extra_len;
-  return 1;
-}

data/third_party/boringssl/ssl/ssl_ecdh.c

@@ -1,465 +0,0 @@
-/* Copyright (c) 2015, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-
-#include <openssl/ssl.h>
-
-#include <assert.h>
-#include <string.h>
-
-#include <openssl/bn.h>
-#include <openssl/bytestring.h>
-#include <openssl/curve25519.h>
-#include <openssl/ec.h>
-#include <openssl/err.h>
-#include <openssl/mem.h>
-#include <openssl/nid.h>
-
-#include "internal.h"
-#include "../crypto/internal.h"
-
-
-/* |EC_POINT| implementation. */
-
-static void ssl_ec_point_cleanup(SSL_ECDH_CTX *ctx) {
-  BIGNUM *private_key = (BIGNUM *)ctx->data;
-  BN_clear_free(private_key);
-}
-
-static int ssl_ec_point_offer(SSL_ECDH_CTX *ctx, CBB *out) {
-  assert(ctx->data == NULL);
-  BIGNUM *private_key = BN_new();
-  if (private_key == NULL) {
-    return 0;
-  }
-  ctx->data = private_key;
-
-  /* Set up a shared |BN_CTX| for all operations. */
-  BN_CTX *bn_ctx = BN_CTX_new();
-  if (bn_ctx == NULL) {
-    return 0;
-  }
-  BN_CTX_start(bn_ctx);
-
-  int ret = 0;
-  EC_POINT *public_key = NULL;
-  EC_GROUP *group = EC_GROUP_new_by_curve_name(ctx->method->nid);
-  if (group == NULL) {
-    goto err;
-  }
-
-  /* Generate a private key. */
-  if (!BN_rand_range_ex(private_key, 1, EC_GROUP_get0_order(group))) {
-    goto err;
-  }
-
-  /* Compute the corresponding public key and serialize it. */
-  public_key = EC_POINT_new(group);
-  if (public_key == NULL ||
-      !EC_POINT_mul(group, public_key, private_key, NULL, NULL, bn_ctx) ||
-      !EC_POINT_point2cbb(out, group, public_key, POINT_CONVERSION_UNCOMPRESSED,
-                          bn_ctx)) {
-    goto err;
-  }
-
-  ret = 1;
-
-err:
-  EC_GROUP_free(group);
-  EC_POINT_free(public_key);
-  BN_CTX_end(bn_ctx);
-  BN_CTX_free(bn_ctx);
-  return ret;
-}
-
-static int ssl_ec_point_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret,
-                               size_t *out_secret_len, uint8_t *out_alert,
-                               const uint8_t *peer_key, size_t peer_key_len) {
-  BIGNUM *private_key = (BIGNUM *)ctx->data;
-  assert(private_key != NULL);
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-
-  /* Set up a shared |BN_CTX| for all operations. */
-  BN_CTX *bn_ctx = BN_CTX_new();
-  if (bn_ctx == NULL) {
-    return 0;
-  }
-  BN_CTX_start(bn_ctx);
-
-  int ret = 0;
-  EC_GROUP *group = EC_GROUP_new_by_curve_name(ctx->method->nid);
-  EC_POINT *peer_point = NULL, *result = NULL;
-  uint8_t *secret = NULL;
-  if (group == NULL) {
-    goto err;
-  }
-
-  /* Compute the x-coordinate of |peer_key| * |private_key|. */
-  peer_point = EC_POINT_new(group);
-  result = EC_POINT_new(group);
-  if (peer_point == NULL || result == NULL) {
-    goto err;
-  }
-  BIGNUM *x = BN_CTX_get(bn_ctx);
-  if (x == NULL) {
-    goto err;
-  }
-  if (!EC_POINT_oct2point(group, peer_point, peer_key, peer_key_len, bn_ctx)) {
-    *out_alert = SSL_AD_DECODE_ERROR;
-    goto err;
-  }
-  if (!EC_POINT_mul(group, result, NULL, peer_point, private_key, bn_ctx) ||
-      !EC_POINT_get_affine_coordinates_GFp(group, result, x, NULL, bn_ctx)) {
-    goto err;
-  }
-
-  /* Encode the x-coordinate left-padded with zeros. */
-  size_t secret_len = (EC_GROUP_get_degree(group) + 7) / 8;
-  secret = OPENSSL_malloc(secret_len);
-  if (secret == NULL || !BN_bn2bin_padded(secret, secret_len, x)) {
-    goto err;
-  }
-
-  *out_secret = secret;
-  *out_secret_len = secret_len;
-  secret = NULL;
-  ret = 1;
-
-err:
-  EC_GROUP_free(group);
-  EC_POINT_free(peer_point);
-  EC_POINT_free(result);
-  BN_CTX_end(bn_ctx);
-  BN_CTX_free(bn_ctx);
-  OPENSSL_free(secret);
-  return ret;
-}
-
-static int ssl_ec_point_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key,
-                               uint8_t **out_secret, size_t *out_secret_len,
-                               uint8_t *out_alert, const uint8_t *peer_key,
-                               size_t peer_key_len) {
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-  if (!ssl_ec_point_offer(ctx, out_public_key) ||
-      !ssl_ec_point_finish(ctx, out_secret, out_secret_len, out_alert, peer_key,
-                           peer_key_len)) {
-    return 0;
-  }
-  return 1;
-}
-
-/* X25119 implementation. */
-
-static void ssl_x25519_cleanup(SSL_ECDH_CTX *ctx) {
-  if (ctx->data == NULL) {
-    return;
-  }
-  OPENSSL_cleanse(ctx->data, 32);
-  OPENSSL_free(ctx->data);
-}
-
-static int ssl_x25519_offer(SSL_ECDH_CTX *ctx, CBB *out) {
-  assert(ctx->data == NULL);
-
-  ctx->data = OPENSSL_malloc(32);
-  if (ctx->data == NULL) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return 0;
-  }
-  uint8_t public_key[32];
-  X25519_keypair(public_key, (uint8_t *)ctx->data);
-  return CBB_add_bytes(out, public_key, sizeof(public_key));
-}
-
-static int ssl_x25519_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret,
-                             size_t *out_secret_len, uint8_t *out_alert,
-                             const uint8_t *peer_key, size_t peer_key_len) {
-  assert(ctx->data != NULL);
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-
-  uint8_t *secret = OPENSSL_malloc(32);
-  if (secret == NULL) {
-    return 0;
-  }
-
-  if (peer_key_len != 32 ||
-      !X25519(secret, (uint8_t *)ctx->data, peer_key)) {
-    OPENSSL_free(secret);
-    *out_alert = SSL_AD_DECODE_ERROR;
-    OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
-    return 0;
-  }
-
-  *out_secret = secret;
-  *out_secret_len = 32;
-  return 1;
-}
-
-static int ssl_x25519_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key,
-                             uint8_t **out_secret, size_t *out_secret_len,
-                             uint8_t *out_alert, const uint8_t *peer_key,
-                             size_t peer_key_len) {
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-  if (!ssl_x25519_offer(ctx, out_public_key) ||
-      !ssl_x25519_finish(ctx, out_secret, out_secret_len, out_alert, peer_key,
-                         peer_key_len)) {
-    return 0;
-  }
-  return 1;
-}
-
-
-/* Legacy DHE-based implementation. */
-
-static void ssl_dhe_cleanup(SSL_ECDH_CTX *ctx) {
-  DH_free((DH *)ctx->data);
-}
-
-static int ssl_dhe_offer(SSL_ECDH_CTX *ctx, CBB *out) {
-  DH *dh = (DH *)ctx->data;
-  /* The group must have been initialized already, but not the key. */
-  assert(dh != NULL);
-  assert(dh->priv_key == NULL);
-
-  /* Due to a bug in yaSSL, the public key must be zero padded to the size of
-   * the prime. */
-  return DH_generate_key(dh) &&
-         BN_bn2cbb_padded(out, BN_num_bytes(dh->p), dh->pub_key);
-}
-
-static int ssl_dhe_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret,
-                          size_t *out_secret_len, uint8_t *out_alert,
-                          const uint8_t *peer_key, size_t peer_key_len) {
-  DH *dh = (DH *)ctx->data;
-  assert(dh != NULL);
-  assert(dh->priv_key != NULL);
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-
-  int secret_len = 0;
-  uint8_t *secret = NULL;
-  BIGNUM *peer_point = BN_bin2bn(peer_key, peer_key_len, NULL);
-  if (peer_point == NULL) {
-    goto err;
-  }
-
-  secret = OPENSSL_malloc(DH_size(dh));
-  if (secret == NULL) {
-    goto err;
-  }
-  secret_len = DH_compute_key(secret, peer_point, dh);
-  if (secret_len <= 0) {
-    goto err;
-  }
-
-  *out_secret = secret;
-  *out_secret_len = (size_t)secret_len;
-  BN_free(peer_point);
-  return 1;
-
-err:
-  if (secret_len > 0) {
-    OPENSSL_cleanse(secret, (size_t)secret_len);
-  }
-  OPENSSL_free(secret);
-  BN_free(peer_point);
-  return 0;
-}
-
-static int ssl_dhe_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key,
-                          uint8_t **out_secret, size_t *out_secret_len,
-                          uint8_t *out_alert, const uint8_t *peer_key,
-                          size_t peer_key_len) {
-  *out_alert = SSL_AD_INTERNAL_ERROR;
-  if (!ssl_dhe_offer(ctx, out_public_key) ||
-      !ssl_dhe_finish(ctx, out_secret, out_secret_len, out_alert, peer_key,
-                      peer_key_len)) {
-    return 0;
-  }
-  return 1;
-}
-
-static const SSL_ECDH_METHOD kDHEMethod = {
-    NID_undef, 0, "",
-    ssl_dhe_cleanup,
-    ssl_dhe_offer,
-    ssl_dhe_accept,
-    ssl_dhe_finish,
-    CBS_get_u16_length_prefixed,
-    CBB_add_u16_length_prefixed,
-};
-
-static const SSL_ECDH_METHOD kMethods[] = {
-    {
-        NID_X9_62_prime256v1,
-        SSL_CURVE_SECP256R1,
-        "P-256",
-        ssl_ec_point_cleanup,
-        ssl_ec_point_offer,
-        ssl_ec_point_accept,
-        ssl_ec_point_finish,
-        CBS_get_u8_length_prefixed,
-        CBB_add_u8_length_prefixed,
-    },
-    {
-        NID_secp384r1,
-        SSL_CURVE_SECP384R1,
-        "P-384",
-        ssl_ec_point_cleanup,
-        ssl_ec_point_offer,
-        ssl_ec_point_accept,
-        ssl_ec_point_finish,
-        CBS_get_u8_length_prefixed,
-        CBB_add_u8_length_prefixed,
-    },
-    {
-        NID_secp521r1,
-        SSL_CURVE_SECP521R1,
-        "P-521",
-        ssl_ec_point_cleanup,
-        ssl_ec_point_offer,
-        ssl_ec_point_accept,
-        ssl_ec_point_finish,
-        CBS_get_u8_length_prefixed,
-        CBB_add_u8_length_prefixed,
-    },
-    {
-        NID_X25519,
-        SSL_CURVE_X25519,
-        "X25519",
-        ssl_x25519_cleanup,
-        ssl_x25519_offer,
-        ssl_x25519_accept,
-        ssl_x25519_finish,
-        CBS_get_u8_length_prefixed,
-        CBB_add_u8_length_prefixed,
-    },
-};
-
-static const SSL_ECDH_METHOD *method_from_group_id(uint16_t group_id) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kMethods); i++) {
-    if (kMethods[i].group_id == group_id) {
-      return &kMethods[i];
-    }
-  }
-  return NULL;
-}
-
-static const SSL_ECDH_METHOD *method_from_nid(int nid) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kMethods); i++) {
-    if (kMethods[i].nid == nid) {
-      return &kMethods[i];
-    }
-  }
-  return NULL;
-}
-
-static const SSL_ECDH_METHOD *method_from_name(const char *name, size_t len) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kMethods); i++) {
-    if (len == strlen(kMethods[i].name) &&
-        !strncmp(kMethods[i].name, name, len)) {
-      return &kMethods[i];
-    }
-  }
-  return NULL;
-}
-
-const char* SSL_get_curve_name(uint16_t group_id) {
-  const SSL_ECDH_METHOD *method = method_from_group_id(group_id);
-  if (method == NULL) {
-    return NULL;
-  }
-  return method->name;
-}
-
-int ssl_nid_to_group_id(uint16_t *out_group_id, int nid) {
-  const SSL_ECDH_METHOD *method = method_from_nid(nid);
-  if (method == NULL) {
-    return 0;
-  }
-  *out_group_id = method->group_id;
-  return 1;
-}
-
-int ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len) {
-  const SSL_ECDH_METHOD *method = method_from_name(name, len);
-  if (method == NULL) {
-    return 0;
-  }
-  *out_group_id = method->group_id;
-  return 1;
-}
-
-int SSL_ECDH_CTX_init(SSL_ECDH_CTX *ctx, uint16_t group_id) {
-  SSL_ECDH_CTX_cleanup(ctx);
-
-  const SSL_ECDH_METHOD *method = method_from_group_id(group_id);
-  if (method == NULL) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
-    return 0;
-  }
-  ctx->method = method;
-  return 1;
-}
-
-void SSL_ECDH_CTX_init_for_dhe(SSL_ECDH_CTX *ctx, DH *params) {
-  SSL_ECDH_CTX_cleanup(ctx);
-
-  ctx->method = &kDHEMethod;
-  ctx->data = params;
-}
-
-void SSL_ECDH_CTX_cleanup(SSL_ECDH_CTX *ctx) {
-  if (ctx->method == NULL) {
-    return;
-  }
-  ctx->method->cleanup(ctx);
-  ctx->method = NULL;
-  ctx->data = NULL;
-}
-
-uint16_t SSL_ECDH_CTX_get_id(const SSL_ECDH_CTX *ctx) {
-  return ctx->method->group_id;
-}
-
-int SSL_ECDH_CTX_get_key(SSL_ECDH_CTX *ctx, CBS *cbs, CBS *out) {
-  if (ctx->method == NULL) {
-    return 0;
-  }
-  return ctx->method->get_key(cbs, out);
-}
-
-int SSL_ECDH_CTX_add_key(SSL_ECDH_CTX *ctx, CBB *cbb, CBB *out_contents) {
-  if (ctx->method == NULL) {
-    return 0;
-  }
-  return ctx->method->add_key(cbb, out_contents);
-}
-
-int SSL_ECDH_CTX_offer(SSL_ECDH_CTX *ctx, CBB *out_public_key) {
-  return ctx->method->offer(ctx, out_public_key);
-}
-
-int SSL_ECDH_CTX_accept(SSL_ECDH_CTX *ctx, CBB *out_public_key,
-                        uint8_t **out_secret, size_t *out_secret_len,
-                        uint8_t *out_alert, const uint8_t *peer_key,
-                        size_t peer_key_len) {
-  return ctx->method->accept(ctx, out_public_key, out_secret, out_secret_len,
-                             out_alert, peer_key, peer_key_len);
-}
-
-int SSL_ECDH_CTX_finish(SSL_ECDH_CTX *ctx, uint8_t **out_secret,
-                        size_t *out_secret_len, uint8_t *out_alert,
-                        const uint8_t *peer_key, size_t peer_key_len) {
-  return ctx->method->finish(ctx, out_secret, out_secret_len, out_alert,
-                             peer_key, peer_key_len);
-}