@ttsc/win32-arm64 0.33.1 → 0.34.0

package/bin/go/src/crypto/sha1/sha1block_riscv64.s

@@ -0,0 +1,225 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !purego
+
+#include "textflag.h"
+
+#define LOAD(index) \
+	MOVBU	((index*4)+0)(X29), X5; \
+	MOVBU	((index*4)+1)(X29), X6; \
+	MOVBU	((index*4)+2)(X29), X7; \
+	MOVBU	((index*4)+3)(X29), X8; \
+	SLL	$24, X5; \
+	SLL	$16, X6; \
+	OR	X5, X6, X5; \
+	SLL	$8, X7; \
+	OR	X5, X7, X5; \
+	OR	X5, X8, X5; \
+	MOVW	X5, (index*4)(X19)
+
+#define SHUFFLE(index) \
+	MOVWU	(((index)&0xf)*4)(X19), X5; \
+	MOVWU	(((index-3)&0xf)*4)(X19), X6; \
+	MOVWU	(((index-8)&0xf)*4)(X19), X7; \
+	MOVWU	(((index-14)&0xf)*4)(X19), X8; \
+	XOR	X6, X5; \
+	XOR	X7, X5; \
+	XOR	X8, X5; \
+	RORW	$31, X5; \
+	MOVW	X5, (((index)&0xf)*4)(X19)
+
+// f = d ^ (b & (c ^ d))
+#define FUNC1(a, b, c, d, e) \
+	XOR	c, d, X7; \
+	AND	b, X7; \
+	XOR	d, X7
+
+// f = b ^ c ^ d
+#define FUNC2(a, b, c, d, e) \
+	XOR	b, c, X7; \
+	XOR	d, X7
+
+// f = (b & c) | ((b | c) & d)
+#define FUNC3(a, b, c, d, e) \
+	OR	b, c, X8; \
+	AND	b, c, X6; \
+	AND	d, X8; \
+	OR	X6, X8, X7
+
+#define FUNC4 FUNC2
+
+#define MIX(a, b, c, d, e, key) \
+	RORW	$2, b; \
+	ADD	X7, e; \
+	RORW	$27, a, X8; \
+	ADD	X5, e; \
+	ADD	key, e; \
+	ADD	X8, e
+
+#define ROUND1(a, b, c, d, e, index) \
+	LOAD(index); \
+	FUNC1(a, b, c, d, e); \
+	MIX(a, b, c, d, e, X15)
+
+#define ROUND1x(a, b, c, d, e, index) \
+	SHUFFLE(index); \
+	FUNC1(a, b, c, d, e); \
+	MIX(a, b, c, d, e, X15)
+
+#define ROUND2(a, b, c, d, e, index) \
+	SHUFFLE(index); \
+	FUNC2(a, b, c, d, e); \
+	MIX(a, b, c, d, e, X16)
+
+#define ROUND3(a, b, c, d, e, index) \
+	SHUFFLE(index); \
+	FUNC3(a, b, c, d, e); \
+	MIX(a, b, c, d, e, X17)
+
+#define ROUND4(a, b, c, d, e, index) \
+	SHUFFLE(index); \
+	FUNC4(a, b, c, d, e); \
+	MIX(a, b, c, d, e, X18)
+
+// func block(dig *Digest, p []byte)
+TEXT ·block(SB),NOSPLIT,$64-32
+	MOV	p_base+8(FP), X29
+	MOV	p_len+16(FP), X30
+	SRL	$6, X30
+	SLL	$6, X30
+
+	ADD	X29, X30, X28
+	BEQ	X28, X29, end
+
+	ADD	$8, X2, X19	// message schedule buffer on stack
+
+	MOV	dig+0(FP), X20
+	MOVWU	(0*4)(X20), X10	// a = H0
+	MOVWU	(1*4)(X20), X11	// b = H1
+	MOVWU	(2*4)(X20), X12	// c = H2
+	MOVWU	(3*4)(X20), X13	// d = H3
+	MOVWU	(4*4)(X20), X14	// e = H4
+
+	MOV	$·_K(SB), X21
+	MOVW	(0*4)(X21), X15
+	MOVW	(1*4)(X21), X16
+	MOVW	(2*4)(X21), X17
+	MOVW	(3*4)(X21), X18
+
+loop:
+	MOVW	X10, X22
+	MOVW	X11, X23
+	MOVW	X12, X24
+	MOVW	X13, X25
+	MOVW	X14, X26
+
+	ROUND1(X10, X11, X12, X13, X14, 0)
+	ROUND1(X14, X10, X11, X12, X13, 1)
+	ROUND1(X13, X14, X10, X11, X12, 2)
+	ROUND1(X12, X13, X14, X10, X11, 3)
+	ROUND1(X11, X12, X13, X14, X10, 4)
+	ROUND1(X10, X11, X12, X13, X14, 5)
+	ROUND1(X14, X10, X11, X12, X13, 6)
+	ROUND1(X13, X14, X10, X11, X12, 7)
+	ROUND1(X12, X13, X14, X10, X11, 8)
+	ROUND1(X11, X12, X13, X14, X10, 9)
+	ROUND1(X10, X11, X12, X13, X14, 10)
+	ROUND1(X14, X10, X11, X12, X13, 11)
+	ROUND1(X13, X14, X10, X11, X12, 12)
+	ROUND1(X12, X13, X14, X10, X11, 13)
+	ROUND1(X11, X12, X13, X14, X10, 14)
+	ROUND1(X10, X11, X12, X13, X14, 15)
+
+	ROUND1x(X14, X10, X11, X12, X13, 16)
+	ROUND1x(X13, X14, X10, X11, X12, 17)
+	ROUND1x(X12, X13, X14, X10, X11, 18)
+	ROUND1x(X11, X12, X13, X14, X10, 19)
+
+	ROUND2(X10, X11, X12, X13, X14, 20)
+	ROUND2(X14, X10, X11, X12, X13, 21)
+	ROUND2(X13, X14, X10, X11, X12, 22)
+	ROUND2(X12, X13, X14, X10, X11, 23)
+	ROUND2(X11, X12, X13, X14, X10, 24)
+	ROUND2(X10, X11, X12, X13, X14, 25)
+	ROUND2(X14, X10, X11, X12, X13, 26)
+	ROUND2(X13, X14, X10, X11, X12, 27)
+	ROUND2(X12, X13, X14, X10, X11, 28)
+	ROUND2(X11, X12, X13, X14, X10, 29)
+	ROUND2(X10, X11, X12, X13, X14, 30)
+	ROUND2(X14, X10, X11, X12, X13, 31)
+	ROUND2(X13, X14, X10, X11, X12, 32)
+	ROUND2(X12, X13, X14, X10, X11, 33)
+	ROUND2(X11, X12, X13, X14, X10, 34)
+	ROUND2(X10, X11, X12, X13, X14, 35)
+	ROUND2(X14, X10, X11, X12, X13, 36)
+	ROUND2(X13, X14, X10, X11, X12, 37)
+	ROUND2(X12, X13, X14, X10, X11, 38)
+	ROUND2(X11, X12, X13, X14, X10, 39)
+
+	ROUND3(X10, X11, X12, X13, X14, 40)
+	ROUND3(X14, X10, X11, X12, X13, 41)
+	ROUND3(X13, X14, X10, X11, X12, 42)
+	ROUND3(X12, X13, X14, X10, X11, 43)
+	ROUND3(X11, X12, X13, X14, X10, 44)
+	ROUND3(X10, X11, X12, X13, X14, 45)
+	ROUND3(X14, X10, X11, X12, X13, 46)
+	ROUND3(X13, X14, X10, X11, X12, 47)
+	ROUND3(X12, X13, X14, X10, X11, 48)
+	ROUND3(X11, X12, X13, X14, X10, 49)
+	ROUND3(X10, X11, X12, X13, X14, 50)
+	ROUND3(X14, X10, X11, X12, X13, 51)
+	ROUND3(X13, X14, X10, X11, X12, 52)
+	ROUND3(X12, X13, X14, X10, X11, 53)
+	ROUND3(X11, X12, X13, X14, X10, 54)
+	ROUND3(X10, X11, X12, X13, X14, 55)
+	ROUND3(X14, X10, X11, X12, X13, 56)
+	ROUND3(X13, X14, X10, X11, X12, 57)
+	ROUND3(X12, X13, X14, X10, X11, 58)
+	ROUND3(X11, X12, X13, X14, X10, 59)
+
+	ROUND4(X10, X11, X12, X13, X14, 60)
+	ROUND4(X14, X10, X11, X12, X13, 61)
+	ROUND4(X13, X14, X10, X11, X12, 62)
+	ROUND4(X12, X13, X14, X10, X11, 63)
+	ROUND4(X11, X12, X13, X14, X10, 64)
+	ROUND4(X10, X11, X12, X13, X14, 65)
+	ROUND4(X14, X10, X11, X12, X13, 66)
+	ROUND4(X13, X14, X10, X11, X12, 67)
+	ROUND4(X12, X13, X14, X10, X11, 68)
+	ROUND4(X11, X12, X13, X14, X10, 69)
+	ROUND4(X10, X11, X12, X13, X14, 70)
+	ROUND4(X14, X10, X11, X12, X13, 71)
+	ROUND4(X13, X14, X10, X11, X12, 72)
+	ROUND4(X12, X13, X14, X10, X11, 73)
+	ROUND4(X11, X12, X13, X14, X10, 74)
+	ROUND4(X10, X11, X12, X13, X14, 75)
+	ROUND4(X14, X10, X11, X12, X13, 76)
+	ROUND4(X13, X14, X10, X11, X12, 77)
+	ROUND4(X12, X13, X14, X10, X11, 78)
+	ROUND4(X11, X12, X13, X14, X10, 79)
+
+	ADD	X22, X10
+	ADD	X23, X11
+	ADD	X24, X12
+	ADD	X25, X13
+	ADD	X26, X14
+
+	ADD	$64, X29
+	BNE	X28, X29, loop
+
+end:
+	MOVW	X10, (0*4)(X20)
+	MOVW	X11, (1*4)(X20)
+	MOVW	X12, (2*4)(X20)
+	MOVW	X13, (3*4)(X20)
+	MOVW	X14, (4*4)(X20)
+
+	RET
+
+GLOBL	·_K(SB),RODATA,$16
+DATA	·_K+0(SB)/4, $0x5A827999
+DATA	·_K+4(SB)/4, $0x6ED9EBA1
+DATA	·_K+8(SB)/4, $0x8F1BBCDC
+DATA	·_K+12(SB)/4, $0xCA62C1D6

package/bin/go/src/crypto/sha3/sha3.go

@@ -103,8 +103,9 @@ type SHA3 struct {
 }
 
 //go:linkname fips140hash_sha3Unwrap crypto/internal/fips140hash.sha3Unwrap
-func fips140hash_sha3Unwrap(sha3 *SHA3) *sha3.Digest {
-	return &sha3.s
+func fips140hash_sha3Unwrap(s *SHA3) *sha3.Digest {
+	s.init()
+	return &s.s
 }
 
 // New224 creates a new SHA3-224 hash.

package/bin/go/src/crypto/tls/alert.go

@@ -12,6 +12,8 @@ import "strconv"
 // which wraps AlertError rather than sending a TLS alert.
 type AlertError uint8
 
+var _ error = AlertError(0)
+
 func (e AlertError) Error() string {
 	return alert(e).String()
 }

package/bin/go/src/crypto/tls/auth.go

@@ -10,6 +10,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
+	"crypto/mldsa"
 	"crypto/rsa"
 	"errors"
 	"fmt"
@@ -21,6 +22,9 @@ import (
 // verifyHandshakeSignature verifies a signature against unhashed handshake contents.
 func verifyHandshakeSignature(sigType uint8, pubkey crypto.PublicKey, hashFunc crypto.Hash, signed, sig []byte) error {
 	if hashFunc != directSigning {
+		if !hashFunc.Available() {
+			return fmt.Errorf("hash function unavailable: %v", hashFunc)
+		}
 		h := hashFunc.New()
 		h.Write(signed)
 		signed = h.Sum(nil)
@@ -42,6 +46,14 @@ func verifyHandshakeSignature(sigType uint8, pubkey crypto.PublicKey, hashFunc c
 		if !ed25519.Verify(pubKey, signed, sig) {
 			return errors.New("Ed25519 verification failure")
 		}
+	case signatureMLDSA:
+		pubKey, ok := pubkey.(*mldsa.PublicKey)
+		if !ok {
+			return fmt.Errorf("expected an ML-DSA public key, got %T", pubkey)
+		}
+		if err := mldsa.Verify(pubKey, signed, sig, nil); err != nil {
+			return fmt.Errorf("ML-DSA verification failure: %w", err)
+		}
 	case signaturePKCS1v15:
 		pubKey, ok := pubkey.(*rsa.PublicKey)
 		if !ok {
@@ -130,6 +142,8 @@ func typeAndHashFromSignatureScheme(signatureAlgorithm SignatureScheme) (sigType
 		sigType = signatureECDSA
 	case Ed25519:
 		sigType = signatureEd25519
+	case MLDSA44, MLDSA65, MLDSA87:
+		sigType = signatureMLDSA
 	default:
 		return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm)
 	}
@@ -144,6 +158,8 @@ func typeAndHashFromSignatureScheme(signatureAlgorithm SignatureScheme) (sigType
 		hash = crypto.SHA512
 	case Ed25519:
 		hash = directSigning
+	case MLDSA44, MLDSA65, MLDSA87:
+		hash = directSigning
 	default:
 		return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm)
 	}
@@ -165,6 +181,8 @@ func legacyTypeAndHashFromPublicKey(pub crypto.PublicKey) (sigType uint8, hash c
 		// full signature, and not even OpenSSL bothers with the
 		// complexity, so we can't even test it properly.
 		return 0, 0, fmt.Errorf("tls: Ed25519 public keys are not supported before TLS 1.2")
+	case *mldsa.PublicKey:
+		return 0, 0, fmt.Errorf("tls: ML-DSA public keys are not supported before TLS 1.3")
 	default:
 		return 0, 0, fmt.Errorf("tls: unsupported public key: %T", pub)
 	}
@@ -221,6 +239,17 @@ func signatureSchemesForPublicKey(version uint16, pub crypto.PublicKey) []Signat
 		return sigAlgs
 	case ed25519.PublicKey:
 		return []SignatureScheme{Ed25519}
+	case *mldsa.PublicKey:
+		switch pub.Parameters() {
+		case mldsa.MLDSA44():
+			return []SignatureScheme{MLDSA44}
+		case mldsa.MLDSA65():
+			return []SignatureScheme{MLDSA65}
+		case mldsa.MLDSA87():
+			return []SignatureScheme{MLDSA87}
+		default:
+			panic("tls: internal error: unknown ML-DSA parameter set: " + pub.Parameters().String())
+		}
 	default:
 		return nil
 	}
@@ -297,6 +326,8 @@ func unsupportedCertificateError(cert *Certificate) error {
 	case *rsa.PublicKey:
 		return fmt.Errorf("tls: certificate RSA key size too small for supported signature algorithms")
 	case ed25519.PublicKey:
+	case *mldsa.PublicKey:
+		return errors.New("tls: ML-DSA certificates require TLS 1.3")
 	default:
 		return fmt.Errorf("tls: unsupported certificate key (%T)", pub)
 	}

package/bin/go/src/crypto/tls/bogo_config.json

@@ -34,7 +34,12 @@
         "TLS-ECH-Server-EarlyDataRejected": "Go does not support early (0-RTT) data",
 
         "MLKEMKeyShareIncludedSecond": "BoGo wants us to order the key shares based on its preference, but we don't support that",
+        "MLKEMKeyShareIncludedSecond-*": "BoGo wants us to order the key shares based on its preference, but we don't support that",
         "MLKEMKeyShareIncludedThird": "BoGo wants us to order the key shares based on its preference, but we don't support that",
+        "MLKEMKeyShareIncludedThird-*": "BoGo wants us to order the key shares based on its preference, but we don't support that",
+        "TwoMLKEMs": "BoGo wants us to order the key shares based on its preference, but we don't support that",
+        "NotJustMLKEMKeyShare-MLKEM1024": "BoringSSL sends an ECC key share for fallback when the main key share is MLKEM1024, we currently don't",
+
         "PostQuantumNotEnabledByDefaultInClients": "We do enable it by default!",
         "*-Kyber-TLS13": "We don't support Kyber, only ML-KEM (BoGo bug ignoring AllCurves?)",
 
@@ -42,7 +47,7 @@
         "*-Verify-RSA_PKCS1_SHA256_LEGACY-TLS12": "Likewise, we don't know how to handle it in TLS 1.2, so we send the wrong alert",
         "*-VerifyDefault-*": "Our signature algorithms are not configurable, so there is no difference between default and supported",
         "Ed25519DefaultDisable-*": "We support Ed25519 by default",
-        "NoCommonSignatureAlgorithms-TLS12-Fallback": "We don't support the legacy RSA exchange (without tlsrsakex=1)",
+        "NoCommonSignatureAlgorithms-TLS12-Fallback": "We don't support the legacy RSA exchange",
 
         "*_SHA1-TLS12": "We don't support SHA-1 in TLS 1.2 (without tlssha1=1)",
         "Agree-Digest-SHA1": "We don't support SHA-1 in TLS 1.2 (without tlssha1=1)",
@@ -75,6 +80,12 @@
         "PAKE-Extension-*": "We don't support PAKE",
         "*TicketFlags": "We don't support draft-ietf-tls-tlsflags",
 
+        "MLKEMKeyShareIncludedThird-X25519MLKEM768": "We don't return key shares in client preference order",
+
+        "ECDSAKeyUsage-*": "We don't enforce ECDSA KU",
+
+        "RSAKeyUsage-*": "We don't enforce RSA KU",
+
         "CheckLeafCurve": "TODO: first pass, this should be fixed",
         "KeyUpdate-RequestACK": "TODO: first pass, this should be fixed",
         "SupportedVersionSelection-TLS12": "TODO: first pass, this should be fixed",
@@ -166,19 +177,6 @@
         "HelloRetryRequest-DuplicateCookie-TLS13": "TODO: first pass, this should be fixed",
         "HelloRetryRequest-Unknown-TLS13": "TODO: first pass, this should be fixed",
         "SendPostHandshakeChangeCipherSpec-TLS13": "TODO: first pass, this should be fixed",
-        "ECDSAKeyUsage-Server-TLS12": "TODO: first pass, this should be fixed",
-        "ECDSAKeyUsage-Server-TLS13": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantEncipherment-GotEnciphermentTLS1": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Server-WantSignature-GotEncipherment-TLS1": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantSignature-GotSignature-TLS1": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantEncipherment-GotEnciphermentTLS11": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantSignature-GotSignature-TLS11": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantEncipherment-GotEnciphermentTLS12": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Server-WantSignature-GotEncipherment-TLS12": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Server-WantSignature-GotEncipherment-TLS11": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantSignature-GotSignature-TLS12": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Client-WantSignature-GotSignature-TLS13": "TODO: first pass, this should be fixed",
-        "RSAKeyUsage-Server-WantSignature-GotEncipherment-TLS13": "TODO: first pass, this should be fixed",
         "EmptyExtensions-ClientHello-TLS1": "TODO: first pass, this should be fixed",
         "OmitExtensions-ClientHello-TLS1": "TODO: first pass, this should be fixed",
         "EmptyExtensions-ClientHello-TLS12": "TODO: first pass, this should be fixed",
@@ -213,15 +211,6 @@
         "KeyUpdate-Requested": "TODO: 2025/06  BoGo update, should be fixed",
         "AppDataBeforeTLS13KeyChange-*": "TODO: 2025/06  BoGo update, should be fixed"
     },
-    "AllCurves": [
-        23,
-        24,
-        25,
-        29,
-        4587,
-        4588,
-        4589
-    ],
     "ErrorMap": {
         ":ECH_REJECTED:": ["tls: server rejected ECH"]
     }

package/bin/go/src/crypto/tls/cipher_suites.go

@@ -16,6 +16,7 @@ import (
 	"crypto/rc4"
 	"crypto/sha1"
 	"crypto/sha256"
+	_ "crypto/sha512" // for crypto.SHA384
 	"fmt"
 	"hash"
 	"internal/cpu"
@@ -345,25 +346,16 @@ var disabledCipherSuites = map[uint16]bool{
 	TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: true,
 	TLS_ECDHE_RSA_WITH_RC4_128_SHA:   true,
 	TLS_RSA_WITH_RC4_128_SHA:         true,
-}
 
-// rsaKexCiphers contains the ciphers which use RSA based key exchange,
-// which we also disable by default unless a GODEBUG is set.
-var rsaKexCiphers = map[uint16]bool{
-	TLS_RSA_WITH_RC4_128_SHA:        true,
+	// RSA key exchange
 	TLS_RSA_WITH_3DES_EDE_CBC_SHA:   true,
 	TLS_RSA_WITH_AES_128_CBC_SHA:    true,
 	TLS_RSA_WITH_AES_256_CBC_SHA:    true,
-	TLS_RSA_WITH_AES_128_CBC_SHA256: true,
 	TLS_RSA_WITH_AES_128_GCM_SHA256: true,
 	TLS_RSA_WITH_AES_256_GCM_SHA384: true,
-}
 
-// tdesCiphers contains 3DES ciphers,
-// which we also disable by default unless a GODEBUG is set.
-var tdesCiphers = map[uint16]bool{
+	// 3DES
 	TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: true,
-	TLS_RSA_WITH_3DES_EDE_CBC_SHA:       true,
 }
 
 var (