libmongocrypt-helper 1.7.4.0.1001 → 1.8.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-common-private.h

@@ -0,0 +1,69 @@
+/*
+ * Copyright 2023-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_COMMON_PRIVATE_H
+#define MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_COMMON_PRIVATE_H
+
+#include "mc-fle-blob-subtype-private.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-crypto-private.h"
+#include "mongocrypt-status-private.h"
+
+/**
+ * Deserializes the data in @buf and assigns the parsed values to
+ * to the output parameters.
+ * Callers are expected to call _mongocrypt_buffer_init() on the
+ * @key_uuid and @ciphertext output buffers prior to this call, and
+ * call _mongocrypt_buffer_cleanup() afterwards.
+ * Returns false and sets @status on error.
+ */
+bool _mc_FLE2UnindexedEncryptedValueCommon_parse(const _mongocrypt_buffer_t *buf,
+                                                 uint8_t *fle_blob_subtype,
+                                                 uint8_t *original_bson_type,
+                                                 _mongocrypt_buffer_t *key_uuid,
+                                                 _mongocrypt_buffer_t *ciphertext,
+                                                 mongocrypt_status_t *status);
+
+/**
+ * Decrypts @ciphertext onto the @plaintext buffer. The @plaintext
+ * pointer is returned on success. The @fle_blob_subtype must be an
+ * unindexed type, and determines the decryption algorithm to use.
+ * Returns NULL and sets @status on error.
+ */
+const _mongocrypt_buffer_t *_mc_FLE2UnindexedEncryptedValueCommon_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                          mc_fle_blob_subtype_t fle_blob_subtype,
+                                                                          const _mongocrypt_buffer_t *key_uuid,
+                                                                          bson_type_t original_bson_type,
+                                                                          const _mongocrypt_buffer_t *ciphertext,
+                                                                          const _mongocrypt_buffer_t *key,
+                                                                          _mongocrypt_buffer_t *plaintext,
+                                                                          mongocrypt_status_t *status);
+
+/**
+ * Encrypts @plaintext onto the @out buffer. The @fle_blob_subtype must
+ * be an unindexed type, and determines the encryption algorithm to use.
+ * Returns false and sets @status on error.
+ */
+bool _mc_FLE2UnindexedEncryptedValueCommon_encrypt(_mongocrypt_crypto_t *crypto,
+                                                   mc_fle_blob_subtype_t fle_blob_subtype,
+                                                   const _mongocrypt_buffer_t *key_uuid,
+                                                   bson_type_t original_bson_type,
+                                                   const _mongocrypt_buffer_t *plaintext,
+                                                   const _mongocrypt_buffer_t *key,
+                                                   _mongocrypt_buffer_t *out,
+                                                   mongocrypt_status_t *status);
+
+#endif /* MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_COMMON_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-common.c

@@ -0,0 +1,182 @@
+/*
+ * Copyright 2023-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mc-fle2-payload-uev-common-private.h"
+#include "mc-reader-private.h"
+#include "mongocrypt-private.h"
+
+#define CHECK_AND_RETURN(x)                                                                                            \
+    if (!(x)) {                                                                                                        \
+        return false;                                                                                                  \
+    }
+
+bool _mc_FLE2UnindexedEncryptedValueCommon_parse(const _mongocrypt_buffer_t *buf,
+                                                 uint8_t *fle_blob_subtype,
+                                                 uint8_t *original_bson_type,
+                                                 _mongocrypt_buffer_t *key_uuid,
+                                                 _mongocrypt_buffer_t *ciphertext,
+                                                 mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(buf);
+    BSON_ASSERT_PARAM(fle_blob_subtype);
+    BSON_ASSERT_PARAM(original_bson_type);
+    BSON_ASSERT_PARAM(key_uuid);
+    BSON_ASSERT_PARAM(ciphertext);
+
+    mc_reader_t reader;
+    mc_reader_init_from_buffer(&reader, buf, __FUNCTION__);
+
+    /* Read fle_blob_subtype. */
+    CHECK_AND_RETURN(mc_reader_read_u8(&reader, fle_blob_subtype, status));
+
+    /* Read key_uuid. */
+    CHECK_AND_RETURN(mc_reader_read_buffer(&reader, key_uuid, 16, status));
+    key_uuid->subtype = BSON_SUBTYPE_UUID;
+
+    /* Read original_bson_type. */
+    CHECK_AND_RETURN(mc_reader_read_u8(&reader, original_bson_type, status));
+
+    /* Read ciphertext. */
+    CHECK_AND_RETURN(mc_reader_read_buffer(&reader, ciphertext, mc_reader_get_remaining_length(&reader), status));
+
+    return true;
+}
+
+const _mongocrypt_buffer_t *_mc_FLE2UnindexedEncryptedValueCommon_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                          mc_fle_blob_subtype_t fle_blob_subtype,
+                                                                          const _mongocrypt_buffer_t *key_uuid,
+                                                                          bson_type_t original_bson_type,
+                                                                          const _mongocrypt_buffer_t *ciphertext,
+                                                                          const _mongocrypt_buffer_t *key,
+                                                                          _mongocrypt_buffer_t *plaintext,
+                                                                          mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(crypto);
+    BSON_ASSERT_PARAM(key_uuid);
+    BSON_ASSERT_PARAM(ciphertext);
+    BSON_ASSERT_PARAM(key);
+    BSON_ASSERT_PARAM(plaintext);
+
+    BSON_ASSERT(MC_SUBTYPE_FLE2UnindexedEncryptedValue == fle_blob_subtype
+                || MC_SUBTYPE_FLE2UnindexedEncryptedValueV2 == fle_blob_subtype);
+
+    const _mongocrypt_value_encryption_algorithm_t *fle2aead =
+        (MC_SUBTYPE_FLE2UnindexedEncryptedValue == fle_blob_subtype) ? _mcFLE2AEADAlgorithm()
+                                                                     : _mcFLE2v2AEADAlgorithm();
+
+    /* Serialize associated data: fle_blob_subtype || key_uuid ||
+     * original_bson_type */
+    _mongocrypt_buffer_t AD;
+    _mongocrypt_buffer_init(&AD);
+    if (key_uuid->len > UINT32_MAX - 2) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueCommon_decrypt expected "
+                   "key UUID length <= %" PRIu32 " got: %" PRIu32,
+                   UINT32_MAX - 2u,
+                   key_uuid->len);
+        return NULL;
+    }
+    _mongocrypt_buffer_resize(&AD, 1 + key_uuid->len + 1);
+
+    AD.data[0] = (uint8_t)fle_blob_subtype;
+    memcpy(AD.data + 1, key_uuid->data, key_uuid->len);
+    AD.data[1 + key_uuid->len] = (uint8_t)original_bson_type;
+    const uint32_t plaintext_len = fle2aead->get_plaintext_len(ciphertext->len, status);
+    if (plaintext_len == 0) {
+        _mongocrypt_buffer_cleanup(&AD);
+        return NULL;
+    }
+    _mongocrypt_buffer_resize(plaintext, plaintext_len);
+
+    uint32_t bytes_written;
+
+    if (!fle2aead->do_decrypt(crypto, &AD, key, ciphertext, plaintext, &bytes_written, status)) {
+        _mongocrypt_buffer_cleanup(&AD);
+        return NULL;
+    }
+
+    // Some block cipher modes (eg. CBC) may write fewer bytes than the size
+    // estimate that the plaintext buffer was allocated with. Therefore, the
+    // plaintext buffer length must be updated to the actual size written.
+    plaintext->len = bytes_written;
+
+    _mongocrypt_buffer_cleanup(&AD);
+    return plaintext;
+}
+
+bool _mc_FLE2UnindexedEncryptedValueCommon_encrypt(_mongocrypt_crypto_t *crypto,
+                                                   mc_fle_blob_subtype_t fle_blob_subtype,
+                                                   const _mongocrypt_buffer_t *key_uuid,
+                                                   bson_type_t original_bson_type,
+                                                   const _mongocrypt_buffer_t *plaintext,
+                                                   const _mongocrypt_buffer_t *key,
+                                                   _mongocrypt_buffer_t *out,
+                                                   mongocrypt_status_t *status) {
+    _mongocrypt_buffer_t iv = {0};
+    _mongocrypt_buffer_t AD = {0};
+    bool res = false;
+
+    BSON_ASSERT_PARAM(crypto);
+    BSON_ASSERT_PARAM(key_uuid);
+    BSON_ASSERT_PARAM(plaintext);
+    BSON_ASSERT_PARAM(key);
+    BSON_ASSERT_PARAM(out);
+
+    BSON_ASSERT(MC_SUBTYPE_FLE2UnindexedEncryptedValue == fle_blob_subtype
+                || MC_SUBTYPE_FLE2UnindexedEncryptedValueV2 == fle_blob_subtype);
+
+    const _mongocrypt_value_encryption_algorithm_t *fle2aead =
+        (MC_SUBTYPE_FLE2UnindexedEncryptedValue == fle_blob_subtype) ? _mcFLE2AEADAlgorithm()
+                                                                     : _mcFLE2v2AEADAlgorithm();
+
+    _mongocrypt_buffer_resize(&iv, MONGOCRYPT_IV_LEN);
+    if (!_mongocrypt_random(crypto, &iv, MONGOCRYPT_IV_LEN, status)) {
+        goto fail;
+    }
+
+    /* Serialize associated data: fle_blob_subtype || key_uuid ||
+     * original_bson_type */
+    {
+        if (key_uuid->len > UINT32_MAX - 2) {
+            CLIENT_ERR("mc_FLE2UnindexedEncryptedValueCommon_encrypt expected "
+                       "key UUID length <= %" PRIu32 " got: %" PRIu32,
+                       UINT32_MAX - 2u,
+                       key_uuid->len);
+            goto fail;
+        }
+        _mongocrypt_buffer_resize(&AD, 1 + key_uuid->len + 1);
+        AD.data[0] = (uint8_t)fle_blob_subtype;
+        memcpy(AD.data + 1, key_uuid->data, key_uuid->len);
+        AD.data[1 + key_uuid->len] = (uint8_t)original_bson_type;
+    }
+
+    /* Encrypt. */
+    {
+        const uint32_t cipherlen = fle2aead->get_ciphertext_len(plaintext->len, status);
+        if (cipherlen == 0) {
+            goto fail;
+        }
+        _mongocrypt_buffer_resize(out, cipherlen);
+        uint32_t bytes_written; /* unused. */
+        if (!fle2aead->do_encrypt(crypto, &iv, &AD, key, plaintext, out, &bytes_written, status)) {
+            goto fail;
+        }
+    }
+
+    res = true;
+
+fail:
+    _mongocrypt_buffer_cleanup(&AD);
+    _mongocrypt_buffer_cleanup(&iv);
+    return res;
+}

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-private.h

@@ -18,8 +18,8 @@
 #define MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_PRIVATE_H
 
 #include "mongocrypt-buffer-private.h"
-#include "mongocrypt-status-private.h"
 #include "mongocrypt-crypto-private.h"
+#include "mongocrypt-status-private.h"
 
 /**
  * FLE2UnindexedEncryptedValue represents an FLE2 unindexed encrypted value.
@@ -35,59 +35,51 @@
  * } FLE2UnindexedEncryptedValue;
  *
  * ciphertext is the output of:
- *    EncryptAEAD(
+ *    EncryptAEAD_AES_256_CTR_HMAC_SHA_256(
  *       key=K_Key,
  *       plaintext=ClientValue,
  *       associated_data=(fle_blob_subtype || key_uuid || original_bson_type))
  */
 
-typedef struct _mc_FLE2UnindexedEncryptedValue_t
-   mc_FLE2UnindexedEncryptedValue_t;
+typedef struct _mc_FLE2UnindexedEncryptedValue_t mc_FLE2UnindexedEncryptedValue_t;
 
-mc_FLE2UnindexedEncryptedValue_t *
-mc_FLE2UnindexedEncryptedValue_new (void);
+mc_FLE2UnindexedEncryptedValue_t *mc_FLE2UnindexedEncryptedValue_new(void);
 
-bool
-mc_FLE2UnindexedEncryptedValue_parse (mc_FLE2UnindexedEncryptedValue_t *uev,
-                                      const _mongocrypt_buffer_t *buf,
-                                      mongocrypt_status_t *status);
+bool mc_FLE2UnindexedEncryptedValue_parse(mc_FLE2UnindexedEncryptedValue_t *uev,
+                                          const _mongocrypt_buffer_t *buf,
+                                          mongocrypt_status_t *status);
 
 /* mc_FLE2UnindexedEncryptedValue_get_original_bson_type returns
  * original_bson_type. Returns 0 and sets @status on error.
  * It is an error to call before mc_FLE2UnindexedEncryptedValue_parse. */
-bson_type_t
-mc_FLE2UnindexedEncryptedValue_get_original_bson_type (
-   const mc_FLE2UnindexedEncryptedValue_t *uev, mongocrypt_status_t *status);
+bson_type_t mc_FLE2UnindexedEncryptedValue_get_original_bson_type(const mc_FLE2UnindexedEncryptedValue_t *uev,
+                                                                  mongocrypt_status_t *status);
 
 /* mc_FLE2UnindexedEncryptedValue_get_key_uuid returns key_uuid. Returns
  * NULL and sets @status on error. It is an error to call before
  * mc_FLE2UnindexedEncryptedValue_parse. */
-const _mongocrypt_buffer_t *
-mc_FLE2UnindexedEncryptedValue_get_key_uuid (
-   const mc_FLE2UnindexedEncryptedValue_t *uev, mongocrypt_status_t *status);
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValue_get_key_uuid(const mc_FLE2UnindexedEncryptedValue_t *uev,
+                                                                        mongocrypt_status_t *status);
 
 /* mc_FLE2UnindexedEncryptedValue_decrypt decrypts ciphertext.
  * Returns NULL and sets @status on error. It is an error to call before
  * mc_FLE2UnindexedEncryptedValue_parse. */
-const _mongocrypt_buffer_t *
-mc_FLE2UnindexedEncryptedValue_decrypt (_mongocrypt_crypto_t *crypto,
-                                        mc_FLE2UnindexedEncryptedValue_t *uev,
-                                        const _mongocrypt_buffer_t *key,
-                                        mongocrypt_status_t *status);
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValue_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                   mc_FLE2UnindexedEncryptedValue_t *uev,
+                                                                   const _mongocrypt_buffer_t *key,
+                                                                   mongocrypt_status_t *status);
 
 /* mc_FLE2UnindexedEncryptedValue_encrypt outputs the ciphertext field of
  * FLEUnindexedEncryptedValue into @out. Returns false and sets @status on
  * error. */
-bool
-mc_FLE2UnindexedEncryptedValue_encrypt (_mongocrypt_crypto_t *crypto,
-                                        const _mongocrypt_buffer_t *key_uuid,
-                                        bson_type_t original_bson_type,
-                                        const _mongocrypt_buffer_t *plaintext,
-                                        const _mongocrypt_buffer_t *key,
-                                        _mongocrypt_buffer_t *out,
-                                        mongocrypt_status_t *status);
+bool mc_FLE2UnindexedEncryptedValue_encrypt(_mongocrypt_crypto_t *crypto,
+                                            const _mongocrypt_buffer_t *key_uuid,
+                                            bson_type_t original_bson_type,
+                                            const _mongocrypt_buffer_t *plaintext,
+                                            const _mongocrypt_buffer_t *key,
+                                            _mongocrypt_buffer_t *out,
+                                            mongocrypt_status_t *status);
 
-void
-mc_FLE2UnindexedEncryptedValue_destroy (mc_FLE2UnindexedEncryptedValue_t *uev);
+void mc_FLE2UnindexedEncryptedValue_destroy(mc_FLE2UnindexedEncryptedValue_t *uev);
 
 #endif /* MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-v2-private.h

@@ -0,0 +1,85 @@
+/*
+ * Copyright 2023-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_V2_PRIVATE_H
+#define MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_V2_PRIVATE_H
+
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-crypto-private.h"
+#include "mongocrypt-status-private.h"
+
+/**
+ * FLE2UnindexedEncryptedValueV2 represents a FLE2 protocol version 2
+ * unindexed encrypted value. It is created client side.
+ *
+ * FLE2UnindexedEncryptedValueV2 has the following data layout:
+ *
+ * struct {
+ *   uint8_t fle_blob_subtype = 16;
+ *   uint8_t key_uuid[16];
+ *   uint8_t original_bson_type;
+ *   uint8_t ciphertext[ciphertext_length];
+ * } FLE2UnindexedEncryptedValueV2;
+ *
+ * ciphertext is the output of:
+ *    EncryptAEAD_AES_256_CBC_HMAC_SHA_256(
+ *       key=K_Key,
+ *       plaintext=ClientValue,
+ *       associated_data=(fle_blob_subtype || key_uuid || original_bson_type))
+ */
+
+typedef struct _mc_FLE2UnindexedEncryptedValueV2_t mc_FLE2UnindexedEncryptedValueV2_t;
+
+mc_FLE2UnindexedEncryptedValueV2_t *mc_FLE2UnindexedEncryptedValueV2_new(void);
+
+bool mc_FLE2UnindexedEncryptedValueV2_parse(mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                            const _mongocrypt_buffer_t *buf,
+                                            mongocrypt_status_t *status);
+
+/* mc_FLE2UnindexedEncryptedValueV2_get_original_bson_type returns
+ * original_bson_type. Returns 0 and sets @status on error.
+ * It is an error to call before mc_FLE2UnindexedEncryptedValueV2_parse. */
+bson_type_t mc_FLE2UnindexedEncryptedValueV2_get_original_bson_type(const mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                    mongocrypt_status_t *status);
+
+/* mc_FLE2UnindexedEncryptedValueV2_get_key_uuid returns key_uuid. Returns
+ * NULL and sets @status on error. It is an error to call before
+ * mc_FLE2UnindexedEncryptedValueV2_parse. */
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValueV2_get_key_uuid(const mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                          mongocrypt_status_t *status);
+
+/* mc_FLE2UnindexedEncryptedValueV2_decrypt decrypts ciphertext.
+ * Returns NULL and sets @status on error. It is an error to call before
+ * mc_FLE2UnindexedEncryptedValueV2_parse. */
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValueV2_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                     mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                     const _mongocrypt_buffer_t *key,
+                                                                     mongocrypt_status_t *status);
+
+/* mc_FLE2UnindexedEncryptedValueV2_encrypt outputs the ciphertext field of
+ * FLEUnindexedEncryptedValueV2 into @out. Returns false and sets @status on
+ * error. */
+bool mc_FLE2UnindexedEncryptedValueV2_encrypt(_mongocrypt_crypto_t *crypto,
+                                              const _mongocrypt_buffer_t *key_uuid,
+                                              bson_type_t original_bson_type,
+                                              const _mongocrypt_buffer_t *plaintext,
+                                              const _mongocrypt_buffer_t *key,
+                                              _mongocrypt_buffer_t *out,
+                                              mongocrypt_status_t *status);
+
+void mc_FLE2UnindexedEncryptedValueV2_destroy(mc_FLE2UnindexedEncryptedValueV2_t *uev);
+
+#endif /* MONGOCRYPT_FLE2_UNINDEXED_ENCRYPTED_VALUE_V2_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-v2.c

@@ -0,0 +1,142 @@
+/*
+ * Copyright 2023-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mc-fle2-payload-uev-common-private.h"
+#include "mc-fle2-payload-uev-v2-private.h"
+#include "mongocrypt-private.h"
+
+struct _mc_FLE2UnindexedEncryptedValueV2_t {
+    _mongocrypt_buffer_t key_uuid;
+    uint8_t original_bson_type;
+    _mongocrypt_buffer_t ciphertext;
+    _mongocrypt_buffer_t plaintext;
+    bool parsed;
+};
+
+mc_FLE2UnindexedEncryptedValueV2_t *mc_FLE2UnindexedEncryptedValueV2_new(void) {
+    mc_FLE2UnindexedEncryptedValueV2_t *uev = bson_malloc0(sizeof(mc_FLE2UnindexedEncryptedValueV2_t));
+    return uev;
+}
+
+bool mc_FLE2UnindexedEncryptedValueV2_parse(mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                            const _mongocrypt_buffer_t *buf,
+                                            mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(uev);
+    BSON_ASSERT_PARAM(buf);
+
+    if (uev->parsed) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueV2_parse must not be called twice");
+        return false;
+    }
+
+    uint8_t fle_blob_subtype;
+
+    if (!_mc_FLE2UnindexedEncryptedValueCommon_parse(buf,
+                                                     &fle_blob_subtype,
+                                                     &uev->original_bson_type,
+                                                     &uev->key_uuid,
+                                                     &uev->ciphertext,
+                                                     status)) {
+        return false;
+    }
+
+    if (MC_SUBTYPE_FLE2UnindexedEncryptedValueV2 != fle_blob_subtype) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueV2_parse expected "
+                   "fle_blob_subtype=%d got: %" PRIu8,
+                   MC_SUBTYPE_FLE2UnindexedEncryptedValueV2,
+                   fle_blob_subtype);
+        return false;
+    }
+
+    uev->parsed = true;
+    return true;
+}
+
+bson_type_t mc_FLE2UnindexedEncryptedValueV2_get_original_bson_type(const mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                    mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(uev);
+
+    if (!uev->parsed) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueV2_get_original_bson_type must be "
+                   "called after mc_FLE2UnindexedEncryptedValueV2_parse");
+        return 0;
+    }
+    return uev->original_bson_type;
+}
+
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValueV2_get_key_uuid(const mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                          mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(uev);
+
+    if (!uev->parsed) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueV2_get_key_uuid must be "
+                   "called after mc_FLE2UnindexedEncryptedValueV2_parse");
+        return NULL;
+    }
+    return &uev->key_uuid;
+}
+
+const _mongocrypt_buffer_t *mc_FLE2UnindexedEncryptedValueV2_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                     mc_FLE2UnindexedEncryptedValueV2_t *uev,
+                                                                     const _mongocrypt_buffer_t *key,
+                                                                     mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(crypto);
+    BSON_ASSERT_PARAM(uev);
+    BSON_ASSERT_PARAM(key);
+
+    if (!uev->parsed) {
+        CLIENT_ERR("mc_FLE2UnindexedEncryptedValueV2_decrypt must be "
+                   "called after mc_FLE2UnindexedEncryptedValueV2_parse");
+        return NULL;
+    }
+
+    return _mc_FLE2UnindexedEncryptedValueCommon_decrypt(crypto,
+                                                         MC_SUBTYPE_FLE2UnindexedEncryptedValueV2,
+                                                         &uev->key_uuid,
+                                                         uev->original_bson_type,
+                                                         &uev->ciphertext,
+                                                         key,
+                                                         &uev->plaintext,
+                                                         status);
+}
+
+bool mc_FLE2UnindexedEncryptedValueV2_encrypt(_mongocrypt_crypto_t *crypto,
+                                              const _mongocrypt_buffer_t *key_uuid,
+                                              bson_type_t original_bson_type,
+                                              const _mongocrypt_buffer_t *plaintext,
+                                              const _mongocrypt_buffer_t *key,
+                                              _mongocrypt_buffer_t *out,
+                                              mongocrypt_status_t *status) {
+    return _mc_FLE2UnindexedEncryptedValueCommon_encrypt(crypto,
+                                                         MC_SUBTYPE_FLE2UnindexedEncryptedValueV2,
+                                                         key_uuid,
+                                                         original_bson_type,
+                                                         plaintext,
+                                                         key,
+                                                         out,
+                                                         status);
+}
+
+void mc_FLE2UnindexedEncryptedValueV2_destroy(mc_FLE2UnindexedEncryptedValueV2_t *uev) {
+    if (NULL == uev) {
+        return;
+    }
+    _mongocrypt_buffer_cleanup(&uev->key_uuid);
+    _mongocrypt_buffer_cleanup(&uev->ciphertext);
+    _mongocrypt_buffer_cleanup(&uev->plaintext);
+
+    bson_free(uev);
+}