@ttsc/win32-arm64 0.33.0 → 0.34.0

package/bin/go/src/crypto/mldsa/mldsa_fips140v1.26.go

@@ -0,0 +1,226 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !fips140v1.0
+
+package mldsa
+
+import (
+	"crypto"
+	"crypto/internal/fips140/mldsa"
+	"errors"
+	"io"
+)
+
+// PrivateKey is an in-memory ML-DSA private key. It implements [crypto.Signer]
+// and the informal extended [crypto.PrivateKey] interface.
+//
+// A PrivateKey is safe for concurrent use.
+type PrivateKey struct {
+	k mldsa.PrivateKey
+}
+
+var errInvalidParameters = errors.New("mldsa: invalid parameters")
+
+// GenerateKey generates a new random ML-DSA private key.
+func GenerateKey(params Parameters) (*PrivateKey, error) {
+	switch params {
+	case MLDSA44():
+		return &PrivateKey{k: *mldsa.GenerateKey44()}, nil
+	case MLDSA65():
+		return &PrivateKey{k: *mldsa.GenerateKey65()}, nil
+	case MLDSA87():
+		return &PrivateKey{k: *mldsa.GenerateKey87()}, nil
+	default:
+		return nil, errInvalidParameters
+	}
+}
+
+// NewPrivateKey decodes an ML-DSA private key from the given seed.
+//
+// The seed must be exactly [PrivateKeySize] bytes long.
+func NewPrivateKey(params Parameters, seed []byte) (*PrivateKey, error) {
+	var err error
+	var k *mldsa.PrivateKey
+	switch params {
+	case MLDSA44():
+		k, err = mldsa.NewPrivateKey44(seed)
+	case MLDSA65():
+		k, err = mldsa.NewPrivateKey65(seed)
+	case MLDSA87():
+		k, err = mldsa.NewPrivateKey87(seed)
+	default:
+		return nil, errInvalidParameters
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &PrivateKey{k: *k}, nil
+}
+
+// Public returns the corresponding [PublicKey] for this private key.
+//
+// It implements the [crypto.Signer] interface.
+func (sk *PrivateKey) Public() crypto.PublicKey {
+	return sk.PublicKey()
+}
+
+// Equal reports whether sk and x are the same key (i.e. they are derived from
+// the same seed).
+//
+// If x is not a *PrivateKey, Equal returns false.
+func (sk *PrivateKey) Equal(x crypto.PrivateKey) bool {
+	other, ok := x.(*PrivateKey)
+	if !ok || other == nil {
+		return false
+	}
+	return sk.k.Equal(&other.k)
+}
+
+// PublicKey returns the corresponding [PublicKey] for this private key.
+func (sk *PrivateKey) PublicKey() *PublicKey {
+	// Making a copy severs the pointer relationship between the private and
+	// public keys, so that keeping the public key around doesn't keep the
+	// private key alive. This costs a copy and an allocation.
+	return &PublicKey{p: *sk.k.PublicKey()}
+}
+
+// Bytes returns the private key seed.
+func (sk *PrivateKey) Bytes() []byte {
+	return sk.k.Bytes()
+}
+
+var errInvalidSignerOpts = errors.New("mldsa: invalid SignerOpts")
+
+// Sign returns a signature of the given message using this private key.
+//
+// If opts is nil or opts.HashFunc returns zero, the message is signed directly.
+// If opts.HashFunc returns [crypto.MLDSAMu], the provided message must be a
+// [pre-hashed μ message representative]. opts can be of type *[Options] if a
+// context string is desired along with a directly-signed message. The io.Reader
+// argument is ignored.
+//
+// [pre-hashed μ message representative]: https://www.rfc-editor.org/rfc/rfc9881.html#externalmu
+func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts) (signature []byte, err error) {
+	if sk.k == (mldsa.PrivateKey{}) {
+		return nil, errors.New("mldsa: zero private key")
+	}
+	if opts == nil {
+		opts = &Options{}
+	}
+	switch opts.HashFunc() {
+	case 0:
+		var context string
+		if opts, ok := opts.(*Options); ok && opts != nil {
+			context = opts.Context
+		}
+		return mldsa.Sign(&sk.k, message, context)
+	case crypto.MLDSAMu:
+		return mldsa.SignExternalMu(&sk.k, message)
+	default:
+		return nil, errInvalidSignerOpts
+	}
+}
+
+// SignDeterministic works like [PrivateKey.Sign], but the signature is
+// deterministic.
+func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) (signature []byte, err error) {
+	if sk.k == (mldsa.PrivateKey{}) {
+		return nil, errors.New("mldsa: zero private key")
+	}
+	if opts == nil {
+		opts = &Options{}
+	}
+	switch opts.HashFunc() {
+	case 0:
+		var context string
+		if opts, ok := opts.(*Options); ok && opts != nil {
+			context = opts.Context
+		}
+		return mldsa.SignDeterministic(&sk.k, message, context)
+	case crypto.MLDSAMu:
+		return mldsa.SignExternalMuDeterministic(&sk.k, message)
+	default:
+		return nil, errInvalidSignerOpts
+	}
+}
+
+// PublicKey is an ML-DSA public key. It implements the informal extended
+// [crypto.PublicKey] interface.
+//
+// A PublicKey is safe for concurrent use.
+type PublicKey struct {
+	p mldsa.PublicKey
+}
+
+// NewPublicKey creates a new ML-DSA public key from the given encoding.
+func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) {
+	return newPublicKey(&PublicKey{}, params, encoding)
+}
+
+func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKey, error) {
+	var err error
+	var pk *mldsa.PublicKey
+	switch params {
+	case MLDSA44():
+		pk, err = mldsa.NewPublicKey44(encoding)
+	case MLDSA65():
+		pk, err = mldsa.NewPublicKey65(encoding)
+	case MLDSA87():
+		pk, err = mldsa.NewPublicKey87(encoding)
+	default:
+		return nil, errInvalidParameters
+	}
+	if err != nil {
+		return nil, err
+	}
+	pub.p = *pk
+	return pub, nil
+}
+
+// Bytes returns the public key encoding.
+func (pk *PublicKey) Bytes() []byte {
+	return pk.p.Bytes()
+}
+
+// Equal reports whether pk and x are the same key (i.e. they have the same
+// encoding).
+//
+// If x is not a *PublicKey, Equal returns false.
+func (pk *PublicKey) Equal(x crypto.PublicKey) bool {
+	other, ok := x.(*PublicKey)
+	if !ok || other == nil {
+		return false
+	}
+	return pk.p.Equal(&other.p)
+}
+
+// Parameters returns the parameters associated with this public key.
+func (pk *PublicKey) Parameters() Parameters {
+	switch pk.p.Parameters() {
+	case "ML-DSA-44":
+		return MLDSA44()
+	case "ML-DSA-65":
+		return MLDSA65()
+	case "ML-DSA-87":
+		return MLDSA87()
+	default:
+		panic("mldsa: invalid parameters in public key")
+	}
+}
+
+// Verify reports whether signature is a valid signature of message by pk.
+// If opts is nil, it's equivalent to the zero value of Options.
+func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) error {
+	if pk == nil {
+		return errors.New("mldsa: nil public key")
+	}
+	if pk.p == (mldsa.PublicKey{}) {
+		return errors.New("mldsa: zero public key")
+	}
+	if opts == nil {
+		opts = &Options{}
+	}
+	return mldsa.Verify(&pk.p, message, signature, opts.Context)
+}

package/bin/go/src/crypto/mlkem/mlkem.go

@@ -72,7 +72,10 @@ func (dk *DecapsulationKey768) Bytes() []byte {
 }
 
 // Decapsulate generates a shared key from a ciphertext and a decapsulation
-// key. If the ciphertext is not valid, Decapsulate returns an error.
+// key. If the ciphertext is not the correct length, Decapsulate returns an
+// error. A ciphertext that is the correct length but otherwise invalid will
+// not return an error; instead, it will produce a shared key that does not
+// match the sender's, according to FIPS 203.
 //
 // The shared key must be kept secret.
 func (dk *DecapsulationKey768) Decapsulate(ciphertext []byte) (sharedKey []byte, err error) {
@@ -164,7 +167,10 @@ func (dk *DecapsulationKey1024) Bytes() []byte {
 }
 
 // Decapsulate generates a shared key from a ciphertext and a decapsulation
-// key. If the ciphertext is not valid, Decapsulate returns an error.
+// key. If the ciphertext is not the correct length, Decapsulate returns an
+// error. A ciphertext that is the correct length but otherwise invalid will
+// not return an error; instead, it will produce a shared key that does not
+// match the sender's, according to FIPS 203.
 //
 // The shared key must be kept secret.
 func (dk *DecapsulationKey1024) Decapsulate(ciphertext []byte) (sharedKey []byte, err error) {

package/bin/go/src/crypto/rsa/fips.go

@@ -71,15 +71,20 @@ func SignPSS(random io.Reader, priv *PrivateKey, hash crypto.Hash, digest []byte
 		hash = opts.Hash
 	}
 
-	if boring.Enabled && rand.IsDefaultReader(random) {
+	if boring.Enabled && rand.IsDefaultReader(random) && priv.N.BitLen() >= 1024 {
 		bkey, err := boringPrivateKey(priv)
 		if err != nil {
 			return nil, err
 		}
 		return boring.SignRSAPSS(bkey, hash, digest, opts.saltLength())
 	}
-	boring.UnreachableExceptTests()
+	if priv.N.BitLen() >= 1024 {
+		boring.UnreachableExceptTests()
+	}
 
+	if !hash.Available() {
+		return nil, errors.New("crypto/rsa: requested hash function unavailable: " + hash.String())
+	}
 	h := fips140hash.Unwrap(hash.New())
 
 	if err := checkFIPS140OnlyPrivateKey(priv); err != nil {
@@ -145,6 +150,9 @@ func VerifyPSS(pub *PublicKey, hash crypto.Hash, digest []byte, sig []byte, opts
 		return nil
 	}
 
+	if !hash.Available() {
+		return errors.New("crypto/rsa: requested hash function unavailable: " + hash.String())
+	}
 	h := fips140hash.Unwrap(hash.New())
 
 	if err := checkFIPS140OnlyPublicKey(pub); err != nil {
@@ -203,6 +211,12 @@ func EncryptOAEP(hash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, l
 //
 // See [EncryptOAEP] for additional details.
 func EncryptOAEPWithOptions(random io.Reader, pub *PublicKey, msg []byte, opts *OAEPOptions) ([]byte, error) {
+	if !opts.Hash.Available() {
+		return nil, errors.New("crypto/rsa: requested hash function unavailable: " + opts.Hash.String())
+	}
+	if opts.MGFHash != 0 && !opts.MGFHash.Available() {
+		return nil, errors.New("crypto/rsa: requested hash function unavailable: " + opts.MGFHash.String())
+	}
 	if opts.MGFHash == 0 {
 		return encryptOAEP(opts.Hash.New(), opts.Hash.New(), random, pub, msg, opts.Label)
 	}
@@ -269,7 +283,7 @@ func decryptOAEP(hash, mgfHash hash.Hash, priv *PrivateKey, ciphertext []byte, l
 		return nil, err
 	}
 
-	if boring.Enabled {
+	if boring.Enabled && priv.N.BitLen() >= 1024 {
 		k := priv.Size()
 		if len(ciphertext) > k ||
 			k < hash.Size()*2+2 {
@@ -331,7 +345,7 @@ func SignPKCS1v15(random io.Reader, priv *PrivateKey, hash crypto.Hash, hashed [
 		return nil, err
 	}
 
-	if boring.Enabled {
+	if boring.Enabled && priv.N.BitLen() >= 1024 {
 		bkey, err := boringPrivateKey(priv)
 		if err != nil {
 			return nil, err
@@ -342,8 +356,10 @@ func SignPKCS1v15(random io.Reader, priv *PrivateKey, hash crypto.Hash, hashed [
 	if err := checkFIPS140OnlyPrivateKey(priv); err != nil {
 		return nil, err
 	}
-	if fips140only.Enforced() && !fips140only.ApprovedHash(fips140hash.Unwrap(hash.New())) {
-		return nil, errors.New("crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
+	if fips140only.Enforced() {
+		if !hash.Available() || !fips140only.ApprovedHash(fips140hash.Unwrap(hash.New())) {
+			return nil, errors.New("crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
+		}
 	}
 
 	k, err := fipsPrivateKey(priv)
@@ -388,8 +404,10 @@ func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte)
 	if err := checkFIPS140OnlyPublicKey(pub); err != nil {
 		return err
 	}
-	if fips140only.Enforced() && !fips140only.ApprovedHash(fips140hash.Unwrap(hash.New())) {
-		return errors.New("crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
+	if fips140only.Enforced() {
+		if !hash.Available() || !fips140only.ApprovedHash(fips140hash.Unwrap(hash.New())) {
+			return errors.New("crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
+		}
 	}
 
 	k, err := fipsPublicKey(pub)

package/bin/go/src/crypto/rsa/pkcs1v15.go

@@ -115,7 +115,7 @@ func DecryptPKCS1v15(random io.Reader, priv *PrivateKey, ciphertext []byte) ([]b
 		return nil, err
 	}
 
-	if boring.Enabled {
+	if boring.Enabled && priv.N.BitLen() >= 1024 {
 		bkey, err := boringPrivateKey(priv)
 		if err != nil {
 			return nil, err
@@ -221,7 +221,7 @@ func decryptPKCS1v15(priv *PrivateKey, ciphertext []byte) (valid int, em []byte,
 		return 0, nil, 0, err
 	}
 
-	if boring.Enabled {
+	if boring.Enabled && priv.N.BitLen() >= 1024 {
 		var bkey *boring.PrivateKeyRSA
 		bkey, err = boringPrivateKey(priv)
 		if err != nil {

package/bin/go/src/crypto/rsa/rsa.go

@@ -176,6 +176,12 @@ func (priv *PrivateKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.D
 
 	switch opts := opts.(type) {
 	case *OAEPOptions:
+		if !opts.Hash.Available() {
+			return nil, errors.New("rsa: requested hash function unavailable: " + opts.Hash.String())
+		}
+		if opts.MGFHash != 0 && !opts.MGFHash.Available() {
+			return nil, errors.New("rsa: requested hash function unavailable: " + opts.MGFHash.String())
+		}
 		if opts.MGFHash == 0 {
 			return decryptOAEP(opts.Hash.New(), opts.Hash.New(), priv, ciphertext, opts.Label)
 		} else {
@@ -542,8 +548,18 @@ var ErrDecryption = errors.New("crypto/rsa: decryption error")
 // It is deliberately vague to avoid adaptive attacks.
 var ErrVerification = errors.New("crypto/rsa: verification error")
 
-// Precompute performs some calculations that speed up private key operations
-// in the future. It is safe to run on non-validated private keys.
+// Precompute performs some calculations that speed up private key operations in
+// the future. It is safe to run on non-validated private keys, and it can speed
+// up future calls to [PrivateKey.Validate] for valid keys.
+//
+// Precompute writes to the Precomputed field, so it must not be called
+// concurrently with any other method.
+//
+// Precompute does not return an error. Applications should call
+// [PrivateKey.Validate] after Precompute to check for any problems with the
+// key, including any that would cause Precompute to fail.
+//
+// Calling Precompute on a key that has already been precomputed is a no-op.
 func (priv *PrivateKey) Precompute() {
 	if priv.precomputedIsConsistent() {
 		return
@@ -559,6 +575,9 @@ func (priv *PrivateKey) Precompute() {
 	priv.Precomputed = precomputed
 }
 
+// precompute calculates the PrecomputedValues for priv and returns them.
+//
+// It does NOT modify priv and is safe for concurrent use.
 func (priv *PrivateKey) precompute() (PrecomputedValues, error) {
 	var precomputed PrecomputedValues
 
@@ -670,6 +689,10 @@ func fipsPublicKey(pub *PublicKey) (*rsa.PublicKey, error) {
 	return &rsa.PublicKey{N: N, E: pub.E}, nil
 }
 
+// fipsPrivateKey returns the *rsa.PrivateKey corresponding to priv, using the
+// precomputed values if available, and calculating them if not.
+//
+// It does NOT modify priv and is safe for concurrent use.
 func fipsPrivateKey(priv *PrivateKey) (*rsa.PrivateKey, error) {
 	if priv.Precomputed.fips != nil {
 		return priv.Precomputed.fips, nil

package/bin/go/src/crypto/sha1/sha1block_decl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (386 || arm || loong64) && !purego
+//go:build (386 || arm || loong64 || riscv64) && !purego
 
 package sha1
 

package/bin/go/src/crypto/sha1/sha1block_generic.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!386 && !amd64 && !arm && !arm64 && !loong64 && !s390x) || purego
+//go:build (!386 && !amd64 && !arm && !arm64 && !loong64 && !riscv64 && !s390x) || purego
 
 package sha1
 

package/bin/go/src/crypto/sha1/sha1block_loong64.s

@@ -26,6 +26,10 @@
 #define REGTMP1	R17
 #define REGTMP2	R18
 #define REGTMP3	R19
+#define KEYREG1	R25
+#define KEYREG2	R26
+#define KEYREG3	R27
+#define KEYREG4	R28
 
 #define LOAD1(index) \
 	MOVW	(index*4)(R5), REGTMP3; \
@@ -63,38 +67,38 @@
 
 #define FUNC4 FUNC2
 
-#define MIX(a, b, c, d, e, const) \
+#define MIX(a, b, c, d, e, key) \
 	ROTR	$2, b; \	// b << 30
 	ADD	REGTMP1, e; \	// e = e + f
 	ROTR	$27, a, REGTMP2; \	// a << 5
 	ADD	REGTMP3, e; \	// e = e + w[i]
-	ADDV	$const, e; \	// e = e + k
+	ADDV	key, e; \	// e = e + k
 	ADD	REGTMP2, e	// e = e + a<<5
 
 #define ROUND1(a, b, c, d, e, index) \
 	LOAD1(index); \
 	FUNC1(a, b, c, d, e); \
-	MIX(a, b, c, d, e, 0x5A827999)
+	MIX(a, b, c, d, e, KEYREG1)
 
 #define ROUND1x(a, b, c, d, e, index) \
 	LOAD(index); \
 	FUNC1(a, b, c, d, e); \
-	MIX(a, b, c, d, e, 0x5A827999)
+	MIX(a, b, c, d, e, KEYREG1)
 
 #define ROUND2(a, b, c, d, e, index) \
 	LOAD(index); \
 	FUNC2(a, b, c, d, e); \
-	MIX(a, b, c, d, e, 0x6ED9EBA1)
+	MIX(a, b, c, d, e, KEYREG2)
 
 #define ROUND3(a, b, c, d, e, index) \
 	LOAD(index); \
 	FUNC3(a, b, c, d, e); \
-	MIX(a, b, c, d, e, 0x8F1BBCDC)
+	MIX(a, b, c, d, e, KEYREG3)
 
 #define ROUND4(a, b, c, d, e, index) \
 	LOAD(index); \
 	FUNC4(a, b, c, d, e); \
-	MIX(a, b, c, d, e, 0xCA62C1D6)
+	MIX(a, b, c, d, e, KEYREG4)
 
 // A stack frame size of 64 bytes is required here, because
 // the frame size used for data expansion is 64 bytes.
@@ -108,13 +112,19 @@ TEXT ·block(SB),NOSPLIT,$64-32
 	BEQ	R6, zero
 
 	// p_len >= 64
-	ADDV    R5, R6, R24
+	ADDV	R5, R6, R24
 	MOVW	(0*4)(R4), R7
 	MOVW	(1*4)(R4), R8
 	MOVW	(2*4)(R4), R9
 	MOVW	(3*4)(R4), R10
 	MOVW	(4*4)(R4), R11
 
+	MOVV	$·_K(SB), R21
+	MOVW	(0*4)(R21), KEYREG1
+	MOVW	(1*4)(R21), KEYREG2
+	MOVW	(2*4)(R21), KEYREG3
+	MOVW	(3*4)(R21), KEYREG4
+
 loop:
 	MOVW	R7,	R12
 	MOVW	R8,	R13
@@ -224,3 +234,9 @@ end:
 	MOVW	R11, (4*4)(R4)
 zero:
 	RET
+
+GLOBL	·_K(SB),RODATA,$16
+DATA	·_K+0(SB)/4, $0x5A827999
+DATA	·_K+4(SB)/4, $0x6ED9EBA1
+DATA	·_K+8(SB)/4, $0x8F1BBCDC
+DATA	·_K+12(SB)/4, $0xCA62C1D6