visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/sha/sha256.cc

@@ -0,0 +1,89 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/sha2.h>
+
+#include <openssl/mem.h>
+
+#include "../fipsmodule/bcm_interface.h"
+
+
+using namespace bssl;
+
+int SHA224_Init(SHA256_CTX *sha) {
+  BCM_sha224_init(sha);
+  return 1;
+}
+
+int SHA224_Update(SHA256_CTX *sha, const void *data, size_t len) {
+  BCM_sha224_update(sha, data, len);
+  return 1;
+}
+
+int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *sha) {
+  BCM_sha224_final(out, sha);
+  return 1;
+}
+
+uint8_t *SHA224(const uint8_t *data, size_t len,
+                uint8_t out[SHA224_DIGEST_LENGTH]) {
+  SHA256_CTX ctx;
+  BCM_sha224_init(&ctx);
+  BCM_sha224_update(&ctx, data, len);
+  BCM_sha224_final(out, &ctx);
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
+int SHA256_Init(SHA256_CTX *sha) {
+  BCM_sha256_init(sha);
+  return 1;
+}
+
+int SHA256_Update(SHA256_CTX *sha, const void *data, size_t len) {
+  BCM_sha256_update(sha, data, len);
+  return 1;
+}
+
+int SHA256_Final(uint8_t out[SHA256_DIGEST_LENGTH], SHA256_CTX *sha) {
+  // TODO(bbe): This overflow check one of the few places a low-level hash
+  // 'final' function can fail. SHA-512 does not have a corresponding check.
+  // The BCM function is infallible and will abort if this is done incorrectly.
+  // we should verify nothing crashes with this removed and eliminate the 0
+  // return.
+  if (sha->md_len > SHA256_DIGEST_LENGTH) {
+    return 0;
+  }
+  BCM_sha256_final(out, sha);
+  return 1;
+}
+
+uint8_t *SHA256(const uint8_t *data, size_t len,
+                uint8_t out[SHA256_DIGEST_LENGTH]) {
+  SHA256_CTX ctx;
+  BCM_sha256_init(&ctx);
+  BCM_sha256_update(&ctx, data, len);
+  BCM_sha256_final(out, &ctx);
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
+void SHA256_Transform(SHA256_CTX *sha, const uint8_t block[SHA256_CBLOCK]) {
+  BCM_sha256_transform(sha, block);
+}
+
+void SHA256_TransformBlocks(uint32_t state[8], const uint8_t *data,
+                            size_t num_blocks) {
+  BCM_sha256_transform_blocks(state, data, num_blocks);
+}

package/runtime/third_party/boringssl/crypto/sha/sha512.cc

@@ -0,0 +1,106 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/sha2.h>
+
+#include <openssl/mem.h>
+
+#include "../fipsmodule/bcm_interface.h"
+
+
+using namespace bssl;
+
+int SHA384_Init(SHA512_CTX *sha) {
+  BCM_sha384_init(sha);
+  return 1;
+}
+
+int SHA384_Update(SHA512_CTX *sha, const void *data, size_t len) {
+  BCM_sha384_update(sha, data, len);
+  return 1;
+}
+
+int SHA384_Final(uint8_t out[SHA384_DIGEST_LENGTH], SHA512_CTX *sha) {
+  BCM_sha384_final(out, sha);
+  return 1;
+}
+
+uint8_t *SHA384(const uint8_t *data, size_t len,
+                uint8_t out[SHA384_DIGEST_LENGTH]) {
+  SHA512_CTX ctx;
+  BCM_sha384_init(&ctx);
+  BCM_sha384_update(&ctx, data, len);
+  BCM_sha384_final(out, &ctx);
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
+int SHA512_256_Init(SHA512_CTX *sha) {
+  BCM_sha512_256_init(sha);
+  return 1;
+}
+
+int SHA512_256_Update(SHA512_CTX *sha, const void *data, size_t len) {
+  BCM_sha512_256_update(sha, data, len);
+  return 1;
+}
+
+int SHA512_256_Final(uint8_t out[SHA512_256_DIGEST_LENGTH], SHA512_CTX *sha) {
+  BCM_sha512_256_final(out, sha);
+  return 1;
+}
+
+uint8_t *SHA512_256(const uint8_t *data, size_t len,
+                uint8_t out[SHA512_256_DIGEST_LENGTH]) {
+  SHA512_CTX ctx;
+  BCM_sha512_256_init(&ctx);
+  BCM_sha512_256_update(&ctx, data, len);
+  BCM_sha512_256_final(out, &ctx);
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
+int SHA512_Init(SHA512_CTX *sha) {
+  BCM_sha512_init(sha);
+  return 1;
+}
+
+int SHA512_Update(SHA512_CTX *sha, const void *data, size_t len) {
+  BCM_sha512_update(sha, data, len);
+  return 1;
+}
+
+int SHA512_Final(uint8_t out[SHA512_DIGEST_LENGTH], SHA512_CTX *sha) {
+  // Historically this function returned failure if passed NULL, even though
+  // other final functions do not.
+  if (out == nullptr) {
+    return 0;
+  }
+  BCM_sha512_final(out, sha);
+  return 1;
+}
+
+uint8_t *SHA512(const uint8_t *data, size_t len,
+                uint8_t out[SHA512_DIGEST_LENGTH]) {
+  SHA512_CTX ctx;
+  BCM_sha512_init(&ctx);
+  BCM_sha512_update(&ctx, data, len);
+  BCM_sha512_final(out, &ctx);
+  OPENSSL_cleanse(&ctx, sizeof(ctx));
+  return out;
+}
+
+void SHA512_Transform(SHA512_CTX *sha, const uint8_t block[SHA512_CBLOCK]) {
+  BCM_sha512_transform(sha, block);
+}

package/runtime/third_party/boringssl/crypto/siphash/siphash.cc

@@ -0,0 +1,81 @@
+// Copyright 2019 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdint.h>
+#include <string.h>
+
+#include <openssl/siphash.h>
+
+#include "../internal.h"
+
+
+using namespace bssl;
+
+static void siphash_round(uint64_t v[4]) {
+  v[0] += v[1];
+  v[2] += v[3];
+  v[1] = CRYPTO_rotl_u64(v[1], 13);
+  v[3] = CRYPTO_rotl_u64(v[3], 16);
+  v[1] ^= v[0];
+  v[3] ^= v[2];
+  v[0] = CRYPTO_rotl_u64(v[0], 32);
+  v[2] += v[1];
+  v[0] += v[3];
+  v[1] = CRYPTO_rotl_u64(v[1], 17);
+  v[3] = CRYPTO_rotl_u64(v[3], 21);
+  v[1] ^= v[2];
+  v[3] ^= v[0];
+  v[2] = CRYPTO_rotl_u64(v[2], 32);
+}
+
+uint64_t SIPHASH_24(const uint64_t key[2], const uint8_t *input,
+                    size_t input_len) {
+  const size_t orig_input_len = input_len;
+
+  uint64_t v[4];
+  v[0] = key[0] ^ UINT64_C(0x736f6d6570736575);
+  v[1] = key[1] ^ UINT64_C(0x646f72616e646f6d);
+  v[2] = key[0] ^ UINT64_C(0x6c7967656e657261);
+  v[3] = key[1] ^ UINT64_C(0x7465646279746573);
+
+  while (input_len >= sizeof(uint64_t)) {
+    uint64_t m = CRYPTO_load_u64_le(input);
+    v[3] ^= m;
+    siphash_round(v);
+    siphash_round(v);
+    v[0] ^= m;
+
+    input += sizeof(uint64_t);
+    input_len -= sizeof(uint64_t);
+  }
+
+  uint8_t last_block[8];
+  OPENSSL_memset(last_block, 0, sizeof(last_block));
+  OPENSSL_memcpy(last_block, input, input_len);
+  last_block[7] = orig_input_len & 0xff;
+
+  uint64_t last_block_word = CRYPTO_load_u64_le(last_block);
+  v[3] ^= last_block_word;
+  siphash_round(v);
+  siphash_round(v);
+  v[0] ^= last_block_word;
+
+  v[2] ^= 0xff;
+  siphash_round(v);
+  siphash_round(v);
+  siphash_round(v);
+  siphash_round(v);
+
+  return v[0] ^ v[1] ^ v[2] ^ v[3];
+}

package/runtime/third_party/boringssl/crypto/slhdsa/slhdsa.cc

@@ -0,0 +1,167 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/slhdsa.h>
+
+#include <openssl/obj.h>
+
+#include "../fipsmodule/bcm_interface.h"
+
+
+using namespace bssl;
+
+static_assert(SLHDSA_SHA2_128S_SEED_BYTES == 3 * BCM_SLHDSA_SHA2_128S_N);
+static_assert(SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES ==
+              BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES);
+static_assert(SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES ==
+              BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES);
+static_assert(SLHDSA_SHA2_128S_SIGNATURE_BYTES ==
+              BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES);
+static_assert(SLHDSA_SHAKE_256F_SEED_BYTES == 3 * BCM_SLHDSA_SHAKE_256F_N);
+static_assert(SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES ==
+              BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES);
+static_assert(SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES ==
+              BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES);
+static_assert(SLHDSA_SHAKE_256F_SIGNATURE_BYTES ==
+              BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES);
+
+void SLHDSA_SHA2_128S_generate_key_from_seed(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[SLHDSA_SHA2_128S_SEED_BYTES]) {
+  BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key, out_private_key,
+                                              seed);
+}
+
+void SLHDSA_SHAKE_256F_generate_key_from_seed(
+    uint8_t out_public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t seed[SLHDSA_SHAKE_256F_SEED_BYTES]) {
+  BCM_slhdsa_shake_256f_generate_key_from_seed(out_public_key, out_private_key,
+                                               seed);
+}
+
+void SLHDSA_SHA2_128S_generate_key(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  BCM_slhdsa_sha2_128s_generate_key(out_public_key, out_private_key);
+}
+
+void SLHDSA_SHAKE_256F_generate_key(
+    uint8_t out_public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]) {
+  BCM_slhdsa_shake_256f_generate_key(out_public_key, out_private_key);
+}
+
+void SLHDSA_SHA2_128S_public_from_private(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  BCM_slhdsa_sha2_128s_public_from_private(out_public_key, private_key);
+}
+
+void SLHDSA_SHAKE_256F_public_from_private(
+    uint8_t out_public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]) {
+  BCM_slhdsa_shake_256f_public_from_private(out_public_key, private_key);
+}
+
+int SLHDSA_SHA2_128S_sign(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  return bcm_success(BCM_slhdsa_sha2_128s_sign(out_signature, private_key, msg,
+                                               msg_len, context, context_len));
+}
+
+int SLHDSA_SHAKE_256F_sign(
+    uint8_t out_signature[SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  return bcm_success(BCM_slhdsa_shake_256f_sign(out_signature, private_key, msg,
+                                                msg_len, context, context_len));
+}
+
+int SLHDSA_SHA2_128S_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  return bcm_success(BCM_slhdsa_sha2_128s_verify(signature, signature_len,
+                                                 public_key, msg, msg_len,
+                                                 context, context_len));
+}
+
+int SLHDSA_SHAKE_256F_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  return bcm_success(BCM_slhdsa_shake_256f_verify(signature, signature_len,
+                                                  public_key, msg, msg_len,
+                                                  context, context_len));
+}
+
+int SLHDSA_SHA2_128S_prehash_sign(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (hash_nid != NID_sha256) {
+    return 0;
+  }
+  return bcm_success(BCM_slhdsa_sha2_128s_prehash_sign(
+      out_signature, private_key, hashed_msg, hashed_msg_len, hash_nid, context,
+      context_len));
+}
+
+int SLHDSA_SHA2_128S_prehash_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (hash_nid != NID_sha256) {
+    return 0;
+  }
+  return bcm_success(BCM_slhdsa_sha2_128s_prehash_verify(
+      signature, signature_len, public_key, hashed_msg, hashed_msg_len,
+      hash_nid, context, context_len));
+}
+
+int SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (hash_nid != NID_sha384) {
+    return 0;
+  }
+  return bcm_success(BCM_slhdsa_sha2_128s_prehash_sign(
+      out_signature, private_key, hashed_msg, hashed_msg_len, hash_nid, context,
+      context_len));
+}
+
+int SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (hash_nid != NID_sha384) {
+    return 0;
+  }
+  return bcm_success(BCM_slhdsa_sha2_128s_prehash_verify(
+      signature, signature_len, public_key, hashed_msg, hashed_msg_len,
+      hash_nid, context, context_len));
+}

package/runtime/third_party/boringssl/crypto/spake2plus/internal.h

@@ -0,0 +1,204 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_SPAKE2PLUS_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_SPAKE2PLUS_INTERNAL_H
+
+#include <openssl/base.h>
+
+#include <sys/types.h>
+
+#include <openssl/sha2.h>
+#include <openssl/span.h>
+
+#include "../fipsmodule/ec/internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// SPAKE2+.
+//
+// SPAKE2+ is an augmented password-authenticated key-exchange. It allows
+// two parties, a prover and verifier, to derive a strong shared key with no
+// risk of disclosing the password, known only to the prover, to the verifier.
+// (But note that the verifier can still attempt an offline, brute-force attack
+// to recover the password.)
+//
+// This is an implementation of SPAKE2+ using P-256 as the group, SHA-256 as
+// the hash function, HKDF-SHA256 as the key derivation function, and
+// HMAC-SHA256 as the message authentication code.
+//
+// See https://www.rfc-editor.org/rfc/rfc9383.html
+
+namespace spake2plus {
+
+// kShareSize is the size of a SPAKE2+ key share.
+constexpr size_t kShareSize = 65;
+
+// kConfirmSize is the size of a SPAKE2+ key confirmation message.
+constexpr size_t kConfirmSize = 32;
+
+// kVerifierSize is the size of the w0 and w1 values in the SPAKE2+ protocol.
+constexpr size_t kVerifierSize = 32;
+
+// kRegistrationRecordSize is the number of bytes in a registration record,
+// which is provided to the verifier.
+constexpr size_t kRegistrationRecordSize = 65;
+
+// kSecretSize is the number of bytes of shared secret that the SPAKE2+ protocol
+// generates.
+constexpr size_t kSecretSize = 32;
+
+// Register computes the values needed in the offline registration
+// step of the SPAKE2+ protocol. See the following for more details:
+// https://www.rfc-editor.org/rfc/rfc9383.html#section-3.2
+//
+// The `password` argument is the mandatory prover password. The `out_w0`,
+// `out_w1`, and `out_registration_record` arguments are where the password
+// verifiers (w0 and w1) and registration record (L) are stored, respectively.
+// The prover is given `out_w0` and `out_w1` while the verifier is given
+// `out_w0` and `out_registration_record`.
+//
+// To ensure success, `out_w0` and `out_w1` must be of length `kVerifierSize`,
+// and `out_registration_record` of size `kRegistrationRecordSize`.
+[[nodiscard]] OPENSSL_EXPORT bool Register(
+    Span<uint8_t> out_w0, Span<uint8_t> out_w1,
+    Span<uint8_t> out_registration_record, Span<const uint8_t> password,
+    Span<const uint8_t> id_prover, Span<const uint8_t> id_verifier);
+
+class OPENSSL_EXPORT Prover {
+ public:
+  static constexpr bool kAllowUniquePtr = true;
+
+  Prover();
+  ~Prover();
+
+  // Init creates a new prover, which can only be used for a single execution of
+  // the protocol.
+  //
+  // The `context` argument is an application-specific value meant to constrain
+  // the protocol execution. The `w0` and `w1` arguments are password verifier
+  // values computed during the offline registration phase of the protocol. The
+  // `id_prover` and `id_verifier` arguments allow optional, opaque names to be
+  // bound into the protocol. See the following for more information about how
+  // these identities may be chosen:
+  // https://www.rfc-editor.org/rfc/rfc9383.html#name-definition-of-spake2
+  [[nodiscard]] bool Init(Span<const uint8_t> context,
+                          Span<const uint8_t> id_prover,
+                          Span<const uint8_t> id_verifier,
+                          Span<const uint8_t> w0, Span<const uint8_t> w1,
+                          Span<const uint8_t> x = Span<const uint8_t>());
+
+  // GenerateShare computes a SPAKE2+ share and writes it to `out_share`.
+  //
+  // This function can only be called once for a given `Prover`. To ensure
+  // success, `out_share` must be `kShareSize` bytes.
+  [[nodiscard]] bool GenerateShare(Span<uint8_t> out_share);
+
+  // ComputeConfirmation computes a SPAKE2+ key confirmation
+  // message and writes it to `out_confirm`. It also computes the shared secret
+  // and writes it to `out_secret`.
+  //
+  // This function can only be called once for a given `Prover`.
+  //
+  // To ensure success, `out_confirm` must be `kConfirmSize` bytes
+  // and `out_secret` must be `kSecretSize` bytes.
+  [[nodiscard]] bool ComputeConfirmation(Span<uint8_t> out_confirm,
+                                         Span<uint8_t> out_secret,
+                                         Span<const uint8_t> peer_share,
+                                         Span<const uint8_t> peer_confirm);
+
+ private:
+  enum class State {
+    kInit,
+    kShareGenerated,
+    kConfirmGenerated,
+    kDone,
+  };
+
+  State state_ = State::kInit;
+  SHA256_CTX transcript_hash_;
+  EC_SCALAR w0_;
+  EC_SCALAR w1_;
+  EC_SCALAR x_;
+  EC_AFFINE X_;
+  uint8_t share_[kShareSize];
+};
+
+class OPENSSL_EXPORT Verifier {
+ public:
+  static constexpr bool kAllowUniquePtr = true;
+
+  Verifier();
+  ~Verifier();
+
+  // Init creates a new verifier, which can only be used for a single execution
+  // of the protocol.
+  //
+  // The `context` argument is an application-specific value meant to constrain
+  // the protocol execution. The `w0` and `registration_record` arguments are
+  // required, and are computed by the prover via `Register`. Only the prover
+  // can produce `w0` and `registration_record`, as they require
+  // knowledge of the password. The prover must securely transmit this to the
+  // verifier out-of-band. The `id_prover` and `id_verifier` arguments allow
+  // optional, opaque names to be bound into the protocol. See the following for
+  // more information about how these identities may be chosen:
+  // https://www.rfc-editor.org/rfc/rfc9383.html#name-definition-of-spake2
+  [[nodiscard]] bool Init(Span<const uint8_t> context,
+                          Span<const uint8_t> id_prover,
+                          Span<const uint8_t> id_verifier,
+                          Span<const uint8_t> w0,
+                          Span<const uint8_t> registration_record,
+                          Span<const uint8_t> y = Span<const uint8_t>());
+
+  // ProcessProverShare computes a SPAKE2+ share from an input share,
+  // `prover_share`, and writes it to `out_share`. It also computes the key
+  // confirmation message and writes it to `out_confirm`. Finally, it computes
+  // the shared secret and writes it to `out_secret`.
+  //
+  // This function can only be called once for a given `Verifier`.
+  //
+  // To ensure success, `out_share` must be `kShareSize` bytes, `out_confirm`
+  // must be `kConfirmSize` bytes, and `out_secret` must be `kSecretSize` bytes.
+  [[nodiscard]] bool ProcessProverShare(Span<uint8_t> out_share,
+                                        Span<uint8_t> out_confirm,
+                                        Span<uint8_t> out_secret,
+                                        Span<const uint8_t> prover_share);
+
+  // VerifyProverConfirmation verifies a SPAKE2+ key confirmation message,
+  // `prover_confirm`.
+  //
+  // This function can only be called once for a given `Verifier`.
+  [[nodiscard]] bool VerifyProverConfirmation(Span<const uint8_t> peer_confirm);
+
+ private:
+  enum class State {
+    kInit,
+    kProverShareSeen,
+    kDone,
+  };
+
+  State state_ = State::kInit;
+  SHA256_CTX transcript_hash_;
+  EC_SCALAR w0_;
+  EC_AFFINE L_;
+  EC_SCALAR y_;
+  uint8_t confirm_[kConfirmSize];
+};
+
+}  // namespace spake2plus
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_SPAKE2PLUS_INTERNAL_H