@fails-components/webtransport 0.0.1 → 0.0.2

package/third_party/boringssl/src/crypto/curve25519/curve25519.c

@@ -1936,11 +1936,8 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
   OPENSSL_memcpy(pkcopy, public_key, 32);
   uint8_t rcopy[32];
   OPENSSL_memcpy(rcopy, signature, 32);
-  union {
-    uint64_t u64[4];
-    uint8_t u8[32];
-  } scopy;
-  OPENSSL_memcpy(&scopy.u8[0], signature + 32, 32);
+  uint8_t scopy[32];
+  OPENSSL_memcpy(scopy, signature + 32, 32);
 
   // https://tools.ietf.org/html/rfc8032#section-5.1.7 requires that s be in
   // the range [0, order) in order to prevent signature malleability.
@@ -1953,9 +1950,10 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
     UINT64_C(0x1000000000000000),
   };
   for (size_t i = 3;; i--) {
-    if (scopy.u64[i] > kOrder[i]) {
+    uint64_t word = CRYPTO_load_u64_le(scopy + i * 8);
+    if (word > kOrder[i]) {
       return 0;
-    } else if (scopy.u64[i] < kOrder[i]) {
+    } else if (word < kOrder[i]) {
       break;
     } else if (i == 0) {
       return 0;
@@ -1973,7 +1971,7 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
   x25519_sc_reduce(h);
 
   ge_p2 R;
-  ge_double_scalarmult_vartime(&R, h, &A, scopy.u8);
+  ge_double_scalarmult_vartime(&R, h, &A, scopy);
 
   uint8_t rcheck[32];
   x25519_ge_tobytes(rcheck, &R);

package/third_party/boringssl/src/crypto/evp/evp_ctx.c

@@ -71,6 +71,7 @@ static const EVP_PKEY_METHOD *const evp_methods[] = {
     &ec_pkey_meth,
     &ed25519_pkey_meth,
     &x25519_pkey_meth,
+    &hkdf_pkey_meth,
 };
 
 static const EVP_PKEY_METHOD *evp_pkey_meth_find(int type) {
@@ -83,26 +84,9 @@ static const EVP_PKEY_METHOD *evp_pkey_meth_find(int type) {
   return NULL;
 }
 
-static EVP_PKEY_CTX *evp_pkey_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id) {
-  EVP_PKEY_CTX *ret;
-  const EVP_PKEY_METHOD *pmeth;
-
-  if (id == -1) {
-    if (!pkey || !pkey->ameth) {
-      return NULL;
-    }
-    id = pkey->ameth->pkey_id;
-  }
-
-  pmeth = evp_pkey_meth_find(id);
-
-  if (pmeth == NULL) {
-    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
-    ERR_add_error_dataf("algorithm %d", id);
-    return NULL;
-  }
-
-  ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));
+static EVP_PKEY_CTX *evp_pkey_ctx_new(EVP_PKEY *pkey, ENGINE *e,
+                                      const EVP_PKEY_METHOD *pmeth) {
+  EVP_PKEY_CTX *ret = OPENSSL_malloc(sizeof(EVP_PKEY_CTX));
   if (!ret) {
     OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
     return NULL;
@@ -130,11 +114,30 @@ static EVP_PKEY_CTX *evp_pkey_ctx_new(EVP_PKEY *pkey, ENGINE *e, int id) {
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e) {
-  return evp_pkey_ctx_new(pkey, e, -1);
+  if (pkey == NULL || pkey->ameth == NULL) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
+    return NULL;
+  }
+
+  const EVP_PKEY_METHOD *pkey_method = pkey->ameth->pkey_method;
+  if (pkey_method == NULL) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    ERR_add_error_dataf("algorithm %d", pkey->ameth->pkey_id);
+    return NULL;
+  }
+
+  return evp_pkey_ctx_new(pkey, e, pkey_method);
 }
 
 EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e) {
-  return evp_pkey_ctx_new(NULL, e, id);
+  const EVP_PKEY_METHOD *pkey_method = evp_pkey_meth_find(id);
+  if (pkey_method == NULL) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    ERR_add_error_dataf("algorithm %d", id);
+    return NULL;
+  }
+
+  return evp_pkey_ctx_new(NULL, e, pkey_method);
 }
 
 void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx) {

package/third_party/boringssl/src/crypto/evp/internal.h

@@ -71,6 +71,8 @@ struct evp_pkey_asn1_method_st {
   uint8_t oid[9];
   uint8_t oid_len;
 
+  const EVP_PKEY_METHOD *pkey_method;
+
   // pub_decode decodes |params| and |key| as a SubjectPublicKeyInfo
   // and writes the result into |out|. It returns one on success and zero on
   // error. |params| is the AlgorithmIdentifier after the OBJECT IDENTIFIER
@@ -178,6 +180,11 @@ OPENSSL_EXPORT int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
 #define EVP_PKEY_CTRL_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 11)
 #define EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 12)
 #define EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID (EVP_PKEY_ALG_CTRL + 13)
+#define EVP_PKEY_CTRL_HKDF_MODE (EVP_PKEY_ALG_CTRL + 14)
+#define EVP_PKEY_CTRL_HKDF_MD (EVP_PKEY_ALG_CTRL + 15)
+#define EVP_PKEY_CTRL_HKDF_KEY (EVP_PKEY_ALG_CTRL + 16)
+#define EVP_PKEY_CTRL_HKDF_SALT (EVP_PKEY_ALG_CTRL + 17)
+#define EVP_PKEY_CTRL_HKDF_INFO (EVP_PKEY_ALG_CTRL + 18)
 
 struct evp_pkey_ctx_st {
   // Method associated with this operation
@@ -232,18 +239,16 @@ struct evp_pkey_method_st {
 } /* EVP_PKEY_METHOD */;
 
 typedef struct {
-  union {
-    uint8_t priv[64];
-    struct {
-      // Shift the location of the public key to align with where it is in the
-      // private key representation.
-      uint8_t pad[32];
-      uint8_t value[32];
-    } pub;
-  } key;
+  // key is the concatenation of the private seed and public key. It is stored
+  // as a single 64-bit array to allow passing to |ED25519_sign|. If
+  // |has_private| is false, the first 32 bytes are uninitialized and the public
+  // key is in the last 32 bytes.
+  uint8_t key[64];
   char has_private;
 } ED25519_KEY;
 
+#define ED25519_PUBLIC_KEY_OFFSET 32
+
 typedef struct {
   uint8_t pub[32];
   uint8_t priv[32];
@@ -260,6 +265,7 @@ extern const EVP_PKEY_METHOD rsa_pkey_meth;
 extern const EVP_PKEY_METHOD ec_pkey_meth;
 extern const EVP_PKEY_METHOD ed25519_pkey_meth;
 extern const EVP_PKEY_METHOD x25519_pkey_meth;
+extern const EVP_PKEY_METHOD hkdf_pkey_meth;
 
 
 #if defined(__cplusplus)

package/third_party/boringssl/src/crypto/evp/p_dsa_asn1.c

@@ -252,6 +252,8 @@ const EVP_PKEY_ASN1_METHOD dsa_asn1_meth = {
   // 1.2.840.10040.4.1
   {0x2a, 0x86, 0x48, 0xce, 0x38, 0x04, 0x01}, 7,
 
+  NULL /* pkey_method */,
+
   dsa_pub_decode,
   dsa_pub_encode,
   dsa_pub_cmp,

package/third_party/boringssl/src/crypto/evp/p_ec_asn1.c

@@ -230,6 +230,8 @@ const EVP_PKEY_ASN1_METHOD ec_asn1_meth = {
   // 1.2.840.10045.2.1
   {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01}, 7,
 
+  &ec_pkey_meth,
+
   eckey_pub_decode,
   eckey_pub_encode,
   eckey_pub_cmp,

package/third_party/boringssl/src/crypto/evp/p_ed25519.c

@@ -37,7 +37,7 @@ static int pkey_ed25519_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
   }
 
   uint8_t pubkey_unused[32];
-  ED25519_keypair(pubkey_unused, key->key.priv);
+  ED25519_keypair(pubkey_unused, key->key);
   key->has_private = 1;
 
   OPENSSL_free(pkey->pkey.ptr);
@@ -64,7 +64,7 @@ static int pkey_ed25519_sign_message(EVP_PKEY_CTX *ctx, uint8_t *sig,
     return 0;
   }
 
-  if (!ED25519_sign(sig, tbs, tbslen, key->key.priv)) {
+  if (!ED25519_sign(sig, tbs, tbslen, key->key)) {
     return 0;
   }
 
@@ -77,7 +77,7 @@ static int pkey_ed25519_verify_message(EVP_PKEY_CTX *ctx, const uint8_t *sig,
                                        size_t tbslen) {
   ED25519_KEY *key = ctx->pkey->pkey.ptr;
   if (siglen != 64 ||
-      !ED25519_verify(tbs, tbslen, sig, key->key.pub.value)) {
+      !ED25519_verify(tbs, tbslen, sig, key->key + ED25519_PUBLIC_KEY_OFFSET)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_SIGNATURE);
     return 0;
   }

package/third_party/boringssl/src/crypto/evp/p_ed25519_asn1.c

@@ -43,7 +43,7 @@ static int ed25519_set_priv_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) {
   // The RFC 8032 encoding stores only the 32-byte seed, so we must recover the
   // full representation which we use from it.
   uint8_t pubkey_unused[32];
-  ED25519_keypair_from_seed(pubkey_unused, key->key.priv, in);
+  ED25519_keypair_from_seed(pubkey_unused, key->key, in);
   key->has_private = 1;
 
   ed25519_free(pkey);
@@ -63,7 +63,7 @@ static int ed25519_set_pub_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) {
     return 0;
   }
 
-  OPENSSL_memcpy(key->key.pub.value, in, 32);
+  OPENSSL_memcpy(key->key + ED25519_PUBLIC_KEY_OFFSET, in, 32);
   key->has_private = 0;
 
   ed25519_free(pkey);
@@ -90,7 +90,7 @@ static int ed25519_get_priv_raw(const EVP_PKEY *pkey, uint8_t *out,
   }
 
   // The raw private key format is the first 32 bytes of the private key.
-  OPENSSL_memcpy(out, key->key.priv, 32);
+  OPENSSL_memcpy(out, key->key, 32);
   *out_len = 32;
   return 1;
 }
@@ -108,7 +108,7 @@ static int ed25519_get_pub_raw(const EVP_PKEY *pkey, uint8_t *out,
     return 0;
   }
 
-  OPENSSL_memcpy(out, key->key.pub.value, 32);
+  OPENSSL_memcpy(out, key->key + ED25519_PUBLIC_KEY_OFFSET, 32);
   *out_len = 32;
   return 1;
 }
@@ -136,7 +136,8 @@ static int ed25519_pub_encode(CBB *out, const EVP_PKEY *pkey) {
       !CBB_add_bytes(&oid, ed25519_asn1_meth.oid, ed25519_asn1_meth.oid_len) ||
       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
-      !CBB_add_bytes(&key_bitstring, key->key.pub.value, 32) ||
+      !CBB_add_bytes(&key_bitstring, key->key + ED25519_PUBLIC_KEY_OFFSET,
+                     32) ||
       !CBB_flush(out)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
     return 0;
@@ -148,7 +149,8 @@ static int ed25519_pub_encode(CBB *out, const EVP_PKEY *pkey) {
 static int ed25519_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
   const ED25519_KEY *a_key = a->pkey.ptr;
   const ED25519_KEY *b_key = b->pkey.ptr;
-  return OPENSSL_memcmp(a_key->key.pub.value, b_key->key.pub.value, 32) == 0;
+  return OPENSSL_memcmp(a_key->key + ED25519_PUBLIC_KEY_OFFSET,
+                        b_key->key + ED25519_PUBLIC_KEY_OFFSET, 32) == 0;
 }
 
 static int ed25519_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
@@ -185,7 +187,7 @@ static int ed25519_priv_encode(CBB *out, const EVP_PKEY *pkey) {
       !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
       // The PKCS#8 encoding stores only the 32-byte seed which is the first 32
       // bytes of the private key.
-      !CBB_add_bytes(&inner, key->key.priv, 32) ||
+      !CBB_add_bytes(&inner, key->key, 32) ||
       !CBB_flush(out)) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
     return 0;
@@ -202,6 +204,7 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = {
     EVP_PKEY_ED25519,
     {0x2b, 0x65, 0x70},
     3,
+    &ed25519_pkey_meth,
     ed25519_pub_decode,
     ed25519_pub_encode,
     ed25519_pub_cmp,

package/third_party/boringssl/src/crypto/evp/p_hkdf.c

@@ -0,0 +1,241 @@
+/* Copyright (c) 2022, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/evp.h>
+
+#include <openssl/bytestring.h>
+#include <openssl/err.h>
+#include <openssl/hkdf.h>
+#include <openssl/kdf.h>
+#include <openssl/mem.h>
+
+#include "../internal.h"
+#include "internal.h"
+
+
+typedef struct {
+  int mode;
+  const EVP_MD *md;
+  uint8_t *key;
+  size_t key_len;
+  uint8_t *salt;
+  size_t salt_len;
+  CBB info;
+} HKDF_PKEY_CTX;
+
+static int pkey_hkdf_init(EVP_PKEY_CTX *ctx) {
+  HKDF_PKEY_CTX *hctx = OPENSSL_malloc(sizeof(HKDF_PKEY_CTX));
+  if (hctx == NULL) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+    return 0;
+  }
+
+  OPENSSL_memset(hctx, 0, sizeof(HKDF_PKEY_CTX));
+  if (!CBB_init(&hctx->info, 0)) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+    OPENSSL_free(hctx);
+    return 0;
+  }
+
+  ctx->data = hctx;
+  return 1;
+}
+
+static int pkey_hkdf_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
+  if (!pkey_hkdf_init(dst)) {
+    return 0;
+  }
+
+  HKDF_PKEY_CTX *hctx_dst = dst->data;
+  const HKDF_PKEY_CTX *hctx_src = src->data;
+  hctx_dst->mode = hctx_src->mode;
+  hctx_dst->md = hctx_src->md;
+
+  if (hctx_src->key_len != 0) {
+    hctx_dst->key = OPENSSL_memdup(hctx_src->key, hctx_src->key_len);
+    if (hctx_src->key == NULL) {
+      OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+      return 0;
+    }
+    hctx_dst->key_len = hctx_src->key_len;
+  }
+
+  if (hctx_src->salt_len != 0) {
+    hctx_dst->salt = OPENSSL_memdup(hctx_src->salt, hctx_src->salt_len);
+    if (hctx_src->salt == NULL) {
+      OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+      return 0;
+    }
+    hctx_dst->salt_len = hctx_src->salt_len;
+  }
+
+  if (!CBB_add_bytes(&hctx_dst->info, CBB_data(&hctx_src->info),
+                     CBB_len(&hctx_src->info))) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+    return 0;
+  }
+
+  return 1;
+}
+
+static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx) {
+  HKDF_PKEY_CTX *hctx = ctx->data;
+  if (hctx != NULL) {
+    OPENSSL_free(hctx->key);
+    OPENSSL_free(hctx->salt);
+    CBB_cleanup(&hctx->info);
+    OPENSSL_free(hctx);
+    ctx->data = NULL;
+  }
+}
+
+static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len) {
+  HKDF_PKEY_CTX *hctx = ctx->data;
+  if (hctx->md == NULL) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
+    return 0;
+  }
+  if (hctx->key_len == 0) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_NO_KEY_SET);
+    return 0;
+  }
+
+  if (out == NULL) {
+    if (hctx->mode == EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) {
+      *out_len = EVP_MD_size(hctx->md);
+    }
+    // HKDF-Expand is variable-length and returns |*out_len| bytes. "Output" the
+    // input length by leaving it alone.
+    return 1;
+  }
+
+  switch (hctx->mode) {
+    case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:
+      return HKDF(out, *out_len, hctx->md, hctx->key, hctx->key_len, hctx->salt,
+                  hctx->salt_len, CBB_data(&hctx->info), CBB_len(&hctx->info));
+
+    case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:
+      if (*out_len < EVP_MD_size(hctx->md)) {
+        OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
+        return 0;
+      }
+      return HKDF_extract(out, out_len, hctx->md, hctx->key, hctx->key_len,
+                          hctx->salt, hctx->salt_len);
+
+    case EVP_PKEY_HKDEF_MODE_EXPAND_ONLY:
+      return HKDF_expand(out, *out_len, hctx->md, hctx->key, hctx->key_len,
+                         CBB_data(&hctx->info), CBB_len(&hctx->info));
+  }
+  OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
+  return 0;
+}
+
+static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
+  HKDF_PKEY_CTX *hctx = ctx->data;
+  switch (type) {
+    case EVP_PKEY_CTRL_HKDF_MODE:
+      if (p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND &&
+          p1 != EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY &&
+          p1 != EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) {
+        OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_OPERATION);
+        return 0;
+      }
+      hctx->mode = p1;
+      return 1;
+    case EVP_PKEY_CTRL_HKDF_MD:
+      hctx->md = p2;
+      return 1;
+    case EVP_PKEY_CTRL_HKDF_KEY: {
+      const CBS *key = p2;
+      if (!CBS_stow(key, &hctx->key, &hctx->key_len)) {
+        OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+        return 0;
+      }
+      return 1;
+    }
+    case EVP_PKEY_CTRL_HKDF_SALT: {
+      const CBS *salt = p2;
+      if (!CBS_stow(salt, &hctx->salt, &hctx->salt_len)) {
+        OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+        return 0;
+      }
+      return 1;
+    }
+    case EVP_PKEY_CTRL_HKDF_INFO: {
+      const CBS *info = p2;
+      // |EVP_PKEY_CTX_add1_hkdf_info| appends to the info string, rather than
+      // replacing it.
+      if (!CBB_add_bytes(&hctx->info, CBS_data(info), CBS_len(info))) {
+        OPENSSL_PUT_ERROR(EVP, ERR_R_MALLOC_FAILURE);
+        return 0;
+      }
+      return 1;
+    }
+    default:
+      OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
+      return 0;
+  }
+}
+
+const EVP_PKEY_METHOD hkdf_pkey_meth = {
+    EVP_PKEY_HKDF,
+    pkey_hkdf_init,
+    pkey_hkdf_copy,
+    pkey_hkdf_cleanup,
+    /*keygen=*/NULL,
+    /*sign=*/NULL,
+    /*sign_message=*/NULL,
+    /*verify=*/NULL,
+    /*verify_message=*/NULL,
+    /*verify_recover=*/NULL,
+    /*encrypt=*/NULL,
+    /*decrypt=*/NULL,
+    pkey_hkdf_derive,
+    /*paramgen=*/NULL,
+    pkey_hkdf_ctrl,
+};
+
+int EVP_PKEY_CTX_hkdf_mode(EVP_PKEY_CTX *ctx, int mode) {
+  return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
+                           EVP_PKEY_CTRL_HKDF_MODE, mode, NULL);
+}
+
+int EVP_PKEY_CTX_set_hkdf_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) {
+  return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
+                           EVP_PKEY_CTRL_HKDF_MD, 0, (void *)md);
+}
+
+int EVP_PKEY_CTX_set1_hkdf_key(EVP_PKEY_CTX *ctx, const uint8_t *key,
+                               size_t key_len) {
+  CBS cbs;
+  CBS_init(&cbs, key, key_len);
+  return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
+                           EVP_PKEY_CTRL_HKDF_KEY, 0, &cbs);
+}
+
+int EVP_PKEY_CTX_set1_hkdf_salt(EVP_PKEY_CTX *ctx, const uint8_t *salt,
+                                size_t salt_len) {
+  CBS cbs;
+  CBS_init(&cbs, salt, salt_len);
+  return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
+                           EVP_PKEY_CTRL_HKDF_SALT, 0, &cbs);
+}
+
+int EVP_PKEY_CTX_add1_hkdf_info(EVP_PKEY_CTX *ctx, const uint8_t *info,
+                                size_t info_len) {
+  CBS cbs;
+  CBS_init(&cbs, info, info_len);
+  return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_HKDF, EVP_PKEY_OP_DERIVE,
+                           EVP_PKEY_CTRL_HKDF_INFO, 0, &cbs);
+}

package/third_party/boringssl/src/crypto/evp/p_rsa_asn1.c

@@ -171,6 +171,8 @@ const EVP_PKEY_ASN1_METHOD rsa_asn1_meth = {
   // 1.2.840.113549.1.1.1
   {0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01}, 9,
 
+  &rsa_pkey_meth,
+
   rsa_pub_decode,
   rsa_pub_encode,
   rsa_pub_cmp,

package/third_party/boringssl/src/crypto/evp/p_x25519_asn1.c

@@ -199,6 +199,7 @@ const EVP_PKEY_ASN1_METHOD x25519_asn1_meth = {
     EVP_PKEY_X25519,
     {0x2b, 0x65, 0x6e},
     3,
+    &x25519_pkey_meth,
     x25519_pub_decode,
     x25519_pub_encode,
     x25519_pub_cmp,

package/third_party/boringssl/src/crypto/fipsmodule/aes/aes_nohw.c

@@ -18,6 +18,7 @@
 #include <string.h>
 
 #include "../../internal.h"
+#include "internal.h"
 
 #if defined(OPENSSL_SSE2)
 #include <emmintrin.h>
@@ -1181,29 +1182,27 @@ void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
   aes_nohw_expand_round_keys(&sched, key);
 
   // Make |AES_NOHW_BATCH_SIZE| copies of |ivec|.
-  alignas(AES_NOHW_WORD_SIZE) union {
-    uint32_t u32[AES_NOHW_BATCH_SIZE * 4];
-    uint8_t u8[AES_NOHW_BATCH_SIZE * 16];
-  } ivs, enc_ivs;
+  alignas(AES_NOHW_WORD_SIZE) uint8_t ivs[AES_NOHW_BATCH_SIZE * 16];
+  alignas(AES_NOHW_WORD_SIZE) uint8_t enc_ivs[AES_NOHW_BATCH_SIZE * 16];
   for (size_t i = 0; i < AES_NOHW_BATCH_SIZE; i++) {
-    memcpy(ivs.u8 + 16 * i, ivec, 16);
+    memcpy(ivs + 16 * i, ivec, 16);
   }
 
-  uint32_t ctr = CRYPTO_bswap4(ivs.u32[3]);
+  uint32_t ctr = CRYPTO_load_u32_be(ivs + 12);
   for (;;) {
     // Update counters.
     for (size_t i = 0; i < AES_NOHW_BATCH_SIZE; i++) {
-      ivs.u32[4 * i + 3] = CRYPTO_bswap4(ctr + i);
+      CRYPTO_store_u32_be(ivs + 16 * i + 12, ctr + i);
     }
 
     size_t todo = blocks >= AES_NOHW_BATCH_SIZE ? AES_NOHW_BATCH_SIZE : blocks;
     AES_NOHW_BATCH batch;
-    aes_nohw_to_batch(&batch, ivs.u8, todo);
+    aes_nohw_to_batch(&batch, ivs, todo);
     aes_nohw_encrypt_batch(&sched, key->rounds, &batch);
-    aes_nohw_from_batch(enc_ivs.u8, todo, &batch);
+    aes_nohw_from_batch(enc_ivs, todo, &batch);
 
     for (size_t i = 0; i < todo; i++) {
-      aes_nohw_xor_block(out + 16 * i, in + 16 * i, enc_ivs.u8 + 16 * i);
+      aes_nohw_xor_block(out + 16 * i, in + 16 * i, enc_ivs + 16 * i);
     }
 
     blocks -= todo;

package/third_party/boringssl/src/crypto/fipsmodule/aes/key_wrap.c

@@ -164,10 +164,8 @@ static const uint8_t kPaddingConstant[4] = {0xa6, 0x59, 0x59, 0xa6};
 int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
                         size_t max_out, const uint8_t *in, size_t in_len) {
   // See https://tools.ietf.org/html/rfc5649#section-4.1
-  const uint32_t in_len32_be = CRYPTO_bswap4(in_len);
   const uint64_t in_len64 = in_len;
   const size_t padded_len = (in_len + 7) & ~7;
-
   *out_len = 0;
   if (in_len == 0 || in_len64 > 0xffffffffu || in_len + 7 < in_len ||
       padded_len + 8 < padded_len || max_out < padded_len + 8) {
@@ -176,7 +174,7 @@ int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
 
   uint8_t block[AES_BLOCK_SIZE];
   memcpy(block, kPaddingConstant, sizeof(kPaddingConstant));
-  memcpy(block + 4, &in_len32_be, sizeof(in_len32_be));
+  CRYPTO_store_u32_be(block + 4, (uint32_t)in_len);
 
   if (in_len <= 8) {
     memset(block + 8, 0, 8);
@@ -226,9 +224,7 @@ int AES_unwrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
   crypto_word_t ok = constant_time_eq_int(
       CRYPTO_memcmp(iv, kPaddingConstant, sizeof(kPaddingConstant)), 0);
 
-  uint32_t claimed_len32;
-  memcpy(&claimed_len32, iv + 4, sizeof(claimed_len32));
-  const size_t claimed_len = CRYPTO_bswap4(claimed_len32);
+  const size_t claimed_len = CRYPTO_load_u32_be(iv + 4);
   ok &= ~constant_time_is_zero_w(claimed_len);
   ok &= constant_time_eq_w((claimed_len - 1) >> 3, (in_len - 9) >> 3);
 

package/third_party/boringssl/src/crypto/fipsmodule/bn/exponentiation.c

@@ -1016,14 +1016,16 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   tmp.neg = am.neg = 0;
   tmp.flags = am.flags = BN_FLG_STATIC_DATA;
 
-  if (!bn_one_to_montgomery(&tmp, mont, ctx)) {
+  if (!bn_one_to_montgomery(&tmp, mont, ctx) ||
+      !bn_resize_words(&tmp, top)) {
     goto err;
   }
 
-  // prepare a^1 in Montgomery domain
+  // Prepare a^1 in the Montgomery domain.
   assert(!a->neg);
   assert(BN_ucmp(a, m) < 0);
-  if (!BN_to_montgomery(&am, a, mont, ctx)) {
+  if (!BN_to_montgomery(&am, a, mont, ctx) ||
+      !bn_resize_words(&am, top)) {
     goto err;
   }
 
@@ -1047,14 +1049,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   // and its interaction with other parts of the project. Determine whether this
   // is actually necessary for performance.
   if (window == 5 && top > 1) {
-    // Ensure |am| and |tmp| are padded to the right width.
-    for (i = am.width; i < top; i++) {
-      am.d[i] = 0;
-    }
-    for (i = tmp.width; i < top; i++) {
-      tmp.d[i] = 0;
-    }
-
     // Copy |mont->N| to improve cache locality.
     BN_ULONG *np = am.d + top;
     for (i = 0; i < top; i++) {

package/third_party/boringssl/src/crypto/fipsmodule/bn/internal.h

@@ -391,7 +391,7 @@ void bn_scatter5(const BN_ULONG *inp, size_t num, BN_ULONG *table,
 
 // bn_gather5 loads index |power| of |table| and stores it in |out|. |out| and
 // each entry of |table| are |num| words long. |power| must be less than 32.
-void bn_gather5(BN_ULONG *out, size_t num, BN_ULONG *table, size_t power);
+void bn_gather5(BN_ULONG *out, size_t num, const BN_ULONG *table, size_t power);
 
 // bn_power5 squares |ap| five times and multiplies it by the value stored at
 // index |power| of |table|, modulo |np|. It stores the result in |rp|. The

package/third_party/boringssl/src/crypto/fipsmodule/bn/prime.c

@@ -386,6 +386,8 @@ int BN_GENCB_call(BN_GENCB *callback, int event, int n) {
   return callback->callback(event, n, callback);
 }
 
+void *BN_GENCB_get_arg(const BN_GENCB *callback) { return callback->arg; }
+
 int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
                          const BIGNUM *rem, BN_GENCB *cb) {
   BIGNUM *t;