@fails-components/webtransport 0.0.1-rc.2 → 0.0.1

package/third_party/boringssl/src/crypto/fipsmodule/bn/exponentiation.c

@@ -979,13 +979,13 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 #if defined(OPENSSL_BN_ASM_MONT5)
   if (window >= 5) {
     window = 5;  // ~5% improvement for RSA2048 sign, and even for RSA4096
-    // reserve space for mont->N.d[] copy
+    // Reserve space for the |mont->N| copy.
     powerbufLen += top * sizeof(mont->N.d[0]);
   }
 #endif
 
   // Allocate a buffer large enough to hold all of the pre-computed
-  // powers of am, am itself and tmp.
+  // powers of |am|, |am| itself, and |tmp|.
   numPowers = 1 << window;
   powerbufLen +=
       sizeof(m->d[0]) *
@@ -1008,7 +1008,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   }
   OPENSSL_memset(powerbuf, 0, powerbufLen);
 
-  // lay down tmp and am right after powers table
+  // Place |tmp| and |am| right after powers table.
   tmp.d = powerbuf + top * numPowers;
   am.d = tmp.d + top;
   tmp.width = am.width = 0;
@@ -1028,18 +1028,26 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   }
 
 #if defined(OPENSSL_BN_ASM_MONT5)
-  // This optimization uses ideas from http://eprint.iacr.org/2011/239,
-  // specifically optimization of cache-timing attack countermeasures
-  // and pre-computation optimization.
-
-  // Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
-  // 512-bit RSA is hardly relevant, we omit it to spare size...
+  // This optimization uses ideas from https://eprint.iacr.org/2011/239,
+  // specifically optimization of cache-timing attack countermeasures,
+  // pre-computation optimization, and Almost Montgomery Multiplication.
+  //
+  // The paper discusses a 4-bit window to optimize 512-bit modular
+  // exponentiation, used in RSA-1024 with CRT, but RSA-1024 is no longer
+  // important.
+  //
+  // |bn_mul_mont_gather5| and |bn_power5| implement the "almost" reduction
+  // variant, so the values here may not be fully reduced. They are bounded by R
+  // (i.e. they fit in |top| words), not |m|. Additionally, we pass these
+  // "almost" reduced inputs into |bn_mul_mont|, which implements the normal
+  // reduction variant. Given those inputs, |bn_mul_mont| may not give reduced
+  // output, but it will still produce "almost" reduced output.
+  //
+  // TODO(davidben): Using "almost" reduction complicates analysis of this code,
+  // and its interaction with other parts of the project. Determine whether this
+  // is actually necessary for performance.
   if (window == 5 && top > 1) {
-    const BN_ULONG *n0 = mont->n0;
-    BN_ULONG *np;
-
-    // BN_to_montgomery can contaminate words above .top
-    // [in BN_DEBUG[_DEBUG] build]...
+    // Ensure |am| and |tmp| are padded to the right width.
     for (i = am.width; i < top; i++) {
       am.d[i] = 0;
     }
@@ -1047,40 +1055,33 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
       tmp.d[i] = 0;
     }
 
-    // copy mont->N.d[] to improve cache locality
-    for (np = am.d + top, i = 0; i < top; i++) {
+    // Copy |mont->N| to improve cache locality.
+    BN_ULONG *np = am.d + top;
+    for (i = 0; i < top; i++) {
       np[i] = mont->N.d[i];
     }
 
+    // Fill |powerbuf| with the first 32 powers of |am|.
+    const BN_ULONG *n0 = mont->n0;
     bn_scatter5(tmp.d, top, powerbuf, 0);
     bn_scatter5(am.d, am.width, powerbuf, 1);
     bn_mul_mont(tmp.d, am.d, am.d, np, n0, top);
     bn_scatter5(tmp.d, top, powerbuf, 2);
 
-    // same as above, but uses squaring for 1/2 of operations
+    // Square to compute powers of two.
     for (i = 4; i < 32; i *= 2) {
       bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
       bn_scatter5(tmp.d, top, powerbuf, i);
     }
-    for (i = 3; i < 8; i += 2) {
-      int j;
+    // Compute odd powers |i| based on |i - 1|, then all powers |i * 2^j|.
+    for (i = 3; i < 32; i += 2) {
       bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
       bn_scatter5(tmp.d, top, powerbuf, i);
-      for (j = 2 * i; j < 32; j *= 2) {
+      for (int j = 2 * i; j < 32; j *= 2) {
         bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
         bn_scatter5(tmp.d, top, powerbuf, j);
       }
     }
-    for (; i < 16; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
-      bn_scatter5(tmp.d, top, powerbuf, i);
-      bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
-      bn_scatter5(tmp.d, top, powerbuf, 2 * i);
-    }
-    for (; i < 32; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
-      bn_scatter5(tmp.d, top, powerbuf, i);
-    }
 
     bits--;
     for (wvalue = 0, i = bits % 5; i >= 0; i--, bits--) {
@@ -1137,15 +1138,15 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, val);
       }
     }
-
-    ret = bn_from_montgomery(tmp.d, tmp.d, NULL, np, n0, top);
-    tmp.width = top;
-    if (ret) {
-      if (!BN_copy(rr, &tmp)) {
-        ret = 0;
-      }
-      goto err;  // non-zero ret means it's not error
-    }
+    // The result is now in |tmp| in Montgomery form, but it may not be fully
+    // reduced. This is within bounds for |BN_from_montgomery| (tmp < R <= m*R)
+    // so it will, when converting from Montgomery form, produce a fully reduced
+    // result.
+    //
+    // This differs from Figure 2 of the paper, which uses AMM(h, 1) to convert
+    // from Montgomery form with unreduced output, followed by an extra
+    // reduction step. In the paper's terminology, we replace steps 9 and 10
+    // with MM(h, 1).
   } else
 #endif
   {
@@ -1206,7 +1207,11 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     }
   }
 
-  // Convert the final result from montgomery to standard format
+  // Convert the final result from Montgomery to standard format. If we used the
+  // |OPENSSL_BN_ASM_MONT5| codepath, |tmp| may not be fully reduced. It is only
+  // bounded by R rather than |m|. However, that is still within bounds for
+  // |BN_from_montgomery|, which implements full Montgomery reduction, not
+  // "almost" Montgomery reduction.
   if (!BN_from_montgomery(rr, &tmp, mont, ctx)) {
     goto err;
   }

package/third_party/boringssl/src/crypto/fipsmodule/bn/internal.h

@@ -353,6 +353,9 @@ int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
 // corresponding field in |BN_MONT_CTX|. It returns one if |bn_mul_mont| handles
 // inputs of this size and zero otherwise.
 //
+// If at least one of |ap| or |bp| is fully reduced, |rp| will be fully reduced.
+// If neither is fully-reduced, the output may not be either.
+//
 // TODO(davidben): The x86_64 implementation expects a 32-bit input and masks
 // off upper bits. The aarch64 implementation expects a 64-bit input and does
 // not. |size_t| is the safer option but not strictly correct for x86_64. But
@@ -372,6 +375,10 @@ int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
 // by |ap| modulo |np|, and stores the result in |rp|. The values are |num|
 // words long and represented in Montgomery form. |n0| is a pointer to the
 // corresponding field in |BN_MONT_CTX|.
+//
+// WARNING: This function implements Almost Montgomery Multiplication from
+// https://eprint.iacr.org/2011/239. The inputs do not need to be fully reduced.
+// However, even if they are fully reduced, the output may not be.
 void bn_mul_mont_gather5(BN_ULONG *rp, const BN_ULONG *ap,
                          const BN_ULONG *table, const BN_ULONG *np,
                          const BN_ULONG *n0, int num, int power);
@@ -391,16 +398,12 @@ void bn_gather5(BN_ULONG *out, size_t num, BN_ULONG *table, size_t power);
 // values are |num| words long and represented in Montgomery form. |n0| is a
 // pointer to the corresponding field in |BN_MONT_CTX|. |num| must be divisible
 // by 8.
+//
+// WARNING: This function implements Almost Montgomery Multiplication from
+// https://eprint.iacr.org/2011/239. The inputs do not need to be fully reduced.
+// However, even if they are fully reduced, the output may not be.
 void bn_power5(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *table,
                const BN_ULONG *np, const BN_ULONG *n0, int num, int power);
-
-// bn_from_montgomery converts |ap| from Montgomery form modulo |np| and writes
-// the result in |rp|, each of which is |num| words long. It returns one on
-// success and zero if it cannot handle inputs of length |num|. |n0| is a
-// pointer to the corresponding field in |BN_MONT_CTX|.
-int bn_from_montgomery(BN_ULONG *rp, const BN_ULONG *ap,
-                       const BN_ULONG *not_used, const BN_ULONG *np,
-                       const BN_ULONG *n0, int num);
 #endif  // !OPENSSL_NO_ASM && OPENSSL_X86_64
 
 uint64_t bn_mont_n0(const BIGNUM *n);

package/third_party/boringssl/src/crypto/fipsmodule/bn/rsaz_exp.c

@@ -66,23 +66,14 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   // R2 = 2^3052 * 2^80 / 2^1044 = 2^2088 = (2^1044)^2
 
   // table[0] = 1
-  rsaz_1024_mul_avx2(result, R2, one, m, k0);
   // table[1] = a_inv^1
+  rsaz_1024_mul_avx2(result, R2, one, m, k0);
   rsaz_1024_mul_avx2(a_inv, a_inv, R2, m, k0);
-
   rsaz_1024_scatter5_avx2(table_s, result, 0);
   rsaz_1024_scatter5_avx2(table_s, a_inv, 1);
-
   // table[2] = a_inv^2
   rsaz_1024_sqr_avx2(result, a_inv, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 2);
-#if 0
-  // This is almost 2x smaller and less than 1% slower.
-  for (int index = 3; index < 32; index++) {
-    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-    rsaz_1024_scatter5_avx2(table_s, result, index);
-  }
-#else
   // table[4] = a_inv^4
   rsaz_1024_sqr_avx2(result, result, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 4);
@@ -92,109 +83,25 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   // table[16] = a_inv^16
   rsaz_1024_sqr_avx2(result, result, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 16);
-  // table[17] = a_inv^17
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 17);
-
-  // table[3]
-  rsaz_1024_gather5_avx2(result, table_s, 2);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 3);
-  // table[6]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 6);
-  // table[12]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 12);
-  // table[24]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 24);
-  // table[25]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 25);
-
-  // table[5]
-  rsaz_1024_gather5_avx2(result, table_s, 4);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 5);
-  // table[10]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 10);
-  // table[20]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 20);
-  // table[21]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 21);
-
-  // table[7]
-  rsaz_1024_gather5_avx2(result, table_s, 6);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 7);
-  // table[14]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 14);
-  // table[28]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 28);
-  // table[29]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 29);
-
-  // table[9]
-  rsaz_1024_gather5_avx2(result, table_s, 8);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 9);
-  // table[18]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 18);
-  // table[19]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 19);
-
-  // table[11]
-  rsaz_1024_gather5_avx2(result, table_s, 10);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 11);
-  // table[22]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 22);
-  // table[23]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 23);
-
-  // table[13]
-  rsaz_1024_gather5_avx2(result, table_s, 12);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 13);
-  // table[26]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 26);
-  // table[27]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 27);
-
-  // table[15]
-  rsaz_1024_gather5_avx2(result, table_s, 14);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 15);
-  // table[30]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 30);
-  // table[31]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 31);
-#endif
+  for (int i = 3; i < 32; i += 2) {
+    // table[i] = table[i-1] * a_inv = a_inv^i
+    rsaz_1024_gather5_avx2(result, table_s, i - 1);
+    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
+    rsaz_1024_scatter5_avx2(table_s, result, i);
+    for (int j = 2 * i; j < 32; j *= 2) {
+      // table[j] = table[j/2]^2 = a_inv^j
+      rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+      rsaz_1024_scatter5_avx2(table_s, result, j);
+    }
+  }
 
+  // Load the first window.
   const uint8_t *p_str = (const uint8_t *)exponent;
-
-  // load first window
   int wvalue = p_str[127] >> 3;
   rsaz_1024_gather5_avx2(result, table_s, wvalue);
 
   int index = 1014;
   while (index > -1) {  // Loop for the remaining 127 windows.
-
     rsaz_1024_sqr_avx2(result, result, m, k0, 5);
 
     uint16_t wvalue_16;
@@ -219,6 +126,8 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   rsaz_1024_mul_avx2(result, result, one, m, k0);
 
   rsaz_1024_red2norm_avx2(result_norm, result);
+  BN_ULONG scratch[16];
+  bn_reduce_once_in_place(result_norm, /*carry=*/0, m_norm, scratch, 16);
 
   OPENSSL_cleanse(storage, MOD_EXP_CTIME_STORAGE_LEN * sizeof(BN_ULONG));
 }

package/third_party/boringssl/src/crypto/fipsmodule/bn/rsaz_exp.h

@@ -90,7 +90,11 @@ void rsaz_1024_gather5_avx2(BN_ULONG val[40], const BN_ULONG tbl[32 * 18],
                             int i);
 
 // rsaz_1024_red2norm_avx2 converts |red| from RSAZ to |BIGNUM| representation
-// and writes the result to |norm|.
+// and writes the result to |norm|. The result will be <= the modulus.
+//
+// WARNING: The result of this operation may not be fully reduced. |norm| may be
+// the modulus instead of zero. This function should be followed by a call to
+// |bn_reduce_once|.
 void rsaz_1024_red2norm_avx2(BN_ULONG norm[16], const BN_ULONG red[40]);
 
 

package/third_party/boringssl/src/crypto/fipsmodule/cipher/e_aes.c

@@ -603,7 +603,7 @@ static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
   }
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_cbc_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_cbc) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_128_cbc;
@@ -616,7 +616,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_cbc_generic) {
   out->cipher = aes_cbc_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_ctr_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_ctr) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_128_ctr;
@@ -641,7 +641,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_ecb_generic) {
   out->cipher = aes_ecb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_ofb_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_ofb) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_128_ofb128;
@@ -654,7 +654,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_ofb_generic) {
   out->cipher = aes_ofb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_gcm_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_gcm) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_128_gcm;
@@ -671,7 +671,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_128_gcm_generic) {
   out->ctrl = aes_gcm_ctrl;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_cbc_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_192_cbc) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_192_cbc;
@@ -684,7 +684,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_cbc_generic) {
   out->cipher = aes_cbc_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_ctr_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_192_ctr) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_192_ctr;
@@ -709,7 +709,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_ecb_generic) {
   out->cipher = aes_ecb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_ofb_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_192_ofb) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_192_ofb128;
@@ -722,7 +722,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_ofb_generic) {
   out->cipher = aes_ofb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_gcm_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_192_gcm) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_192_gcm;
@@ -739,7 +739,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_192_gcm_generic) {
   out->ctrl = aes_gcm_ctrl;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_cbc_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_256_cbc) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_256_cbc;
@@ -752,7 +752,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_cbc_generic) {
   out->cipher = aes_cbc_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_ctr_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_256_ctr) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_256_ctr;
@@ -777,7 +777,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_ecb_generic) {
   out->cipher = aes_ecb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_ofb_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_256_ofb) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_256_ofb128;
@@ -790,7 +790,7 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_ofb_generic) {
   out->cipher = aes_ofb_cipher;
 }
 
-DEFINE_LOCAL_DATA(EVP_CIPHER, aes_256_gcm_generic) {
+DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_256_gcm) {
   memset(out, 0, sizeof(EVP_CIPHER));
 
   out->nid = NID_aes_256_gcm;
@@ -875,26 +875,6 @@ DEFINE_LOCAL_DATA(EVP_CIPHER, aes_hw_256_ecb) {
 
 #endif  // HWAES_ECB
 
-#define EVP_CIPHER_FUNCTION(keybits, mode)             \
-  const EVP_CIPHER *EVP_aes_##keybits##_##mode(void) { \
-    return aes_##keybits##_##mode##_generic();         \
-  }
-
-EVP_CIPHER_FUNCTION(128, cbc)
-EVP_CIPHER_FUNCTION(128, ctr)
-EVP_CIPHER_FUNCTION(128, ofb)
-EVP_CIPHER_FUNCTION(128, gcm)
-
-EVP_CIPHER_FUNCTION(192, cbc)
-EVP_CIPHER_FUNCTION(192, ctr)
-EVP_CIPHER_FUNCTION(192, ofb)
-EVP_CIPHER_FUNCTION(192, gcm)
-
-EVP_CIPHER_FUNCTION(256, cbc)
-EVP_CIPHER_FUNCTION(256, ctr)
-EVP_CIPHER_FUNCTION(256, ofb)
-EVP_CIPHER_FUNCTION(256, gcm)
-
 EVP_ECB_CIPHER_FUNCTION(128)
 EVP_ECB_CIPHER_FUNCTION(192)
 EVP_ECB_CIPHER_FUNCTION(256)

package/third_party/boringssl/src/crypto/fipsmodule/cipher/internal.h

@@ -112,6 +112,45 @@ struct evp_aead_st {
                     size_t extra_in_len);
 };
 
+struct evp_cipher_st {
+  // type contains a NID identifying the cipher. (e.g. NID_aes_128_gcm.)
+  int nid;
+
+  // block_size contains the block size, in bytes, of the cipher, or 1 for a
+  // stream cipher.
+  unsigned block_size;
+
+  // key_len contains the key size, in bytes, for the cipher. If the cipher
+  // takes a variable key size then this contains the default size.
+  unsigned key_len;
+
+  // iv_len contains the IV size, in bytes, or zero if inapplicable.
+  unsigned iv_len;
+
+  // ctx_size contains the size, in bytes, of the per-key context for this
+  // cipher.
+  unsigned ctx_size;
+
+  // flags contains the OR of a number of flags. See |EVP_CIPH_*|.
+  uint32_t flags;
+
+  // app_data is a pointer to opaque, user data.
+  void *app_data;
+
+  int (*init)(EVP_CIPHER_CTX *ctx, const uint8_t *key, const uint8_t *iv,
+              int enc);
+
+  int (*cipher)(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
+                size_t inl);
+
+  // cleanup, if non-NULL, releases memory associated with the context. It is
+  // called if |EVP_CTRL_INIT| succeeds. Note that |init| may not have been
+  // called at this point.
+  void (*cleanup)(EVP_CIPHER_CTX *);
+
+  int (*ctrl)(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
+};
+
 // aes_ctr_set_key initialises |*aes_key| using |key_bytes| bytes from |key|,
 // where |key_bytes| must either be 16, 24 or 32. If not NULL, |*out_block| is
 // set to a function that encrypts single blocks. If not NULL, |*gcm_key| is

package/third_party/boringssl/src/crypto/{evp → fipsmodule/digestsign}/digestsign.c

@@ -57,11 +57,9 @@
 
 #include <openssl/err.h>
 
-#include "internal.h"
-#include "../fipsmodule/digest/internal.h"
-#include "../fipsmodule/service_indicator/internal.h"
-
-// TODO(agl): this will have to be moved into the FIPS module.
+#include "../../evp/internal.h"
+#include "../digest/internal.h"
+#include "../service_indicator/internal.h"
 
 
 enum evp_sign_verify_t {
@@ -69,9 +67,9 @@ enum evp_sign_verify_t {
   evp_verify,
 };
 
-static const struct evp_md_pctx_ops md_pctx_ops = {
-  EVP_PKEY_CTX_free,
-  EVP_PKEY_CTX_dup,
+DEFINE_LOCAL_DATA(struct evp_md_pctx_ops, md_pctx_ops) {
+  out->free = EVP_PKEY_CTX_free;
+  out->dup = EVP_PKEY_CTX_dup;
 };
 
 static int uses_prehash(EVP_MD_CTX *ctx, enum evp_sign_verify_t op) {
@@ -88,7 +86,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
   if (ctx->pctx == NULL) {
     return 0;
   }
-  ctx->pctx_ops = &md_pctx_ops;
+  ctx->pctx_ops = md_pctx_ops();
 
   if (op == evp_verify) {
     if (!EVP_PKEY_verify_init(ctx->pctx)) {

package/third_party/boringssl/src/crypto/fipsmodule/ec/ec_key.c

@@ -79,6 +79,7 @@
 
 #include "internal.h"
 #include "../delocate.h"
+#include "../service_indicator/internal.h"
 #include "../../internal.h"
 
 

package/third_party/boringssl/src/crypto/fipsmodule/ecdh/ecdh.c

@@ -74,8 +74,9 @@
 #include <openssl/mem.h>
 #include <openssl/sha.h>
 
-#include "../ec/internal.h"
 #include "../../internal.h"
+#include "../ec/internal.h"
+#include "../service_indicator/internal.h"
 
 
 int ECDH_compute_key_fips(uint8_t *out, size_t out_len, const EC_POINT *pub_key,

package/third_party/boringssl/src/crypto/fipsmodule/ecdsa/ecdsa.c

@@ -64,6 +64,7 @@
 #include "../../internal.h"
 #include "../bn/internal.h"
 #include "../ec/internal.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 

package/third_party/boringssl/src/crypto/fipsmodule/hmac/hmac.c

@@ -63,6 +63,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 uint8_t *HMAC(const EVP_MD *evp_md, const void *key, size_t key_len,

package/third_party/boringssl/src/crypto/fipsmodule/service_indicator/service_indicator.c

@@ -15,6 +15,7 @@
 #include <openssl/crypto.h>
 #include <openssl/ec.h>
 #include <openssl/ec_key.h>
+#include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/service_indicator.h>
 

package/third_party/boringssl/src/crypto/pkcs8/pkcs8_x509.c

@@ -104,10 +104,10 @@ static int pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 }
 
 ASN1_SEQUENCE_cb(PKCS8_PRIV_KEY_INFO, pkey_cb) = {
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
-  ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0)
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
+    ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0),
 } ASN1_SEQUENCE_END_cb(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)