visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/x509/x509_mtc.cc

@@ -0,0 +1,598 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/asn1.h>
+#include <openssl/base.h>
+#include <openssl/bytestring.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/nid.h>
+#include <openssl/span.h>
+#include <openssl/x509.h>
+
+#include <assert.h>
+
+#include <algorithm>
+#include <optional>
+
+#include "../bytestring/internal.h"
+#include "../internal.h"
+#include "./internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+namespace {
+
+// Prefix for domain separation to denote a Merkle Tree leaf or interior node.
+constexpr uint8_t kMTCLeafDomainSeparator[] = {0x00};
+constexpr uint8_t kMTCNodeDomainSeparator[] = {0x01};
+// DER encoding of AlgorithmIdentifier for alg-mtcProof-draft with absent
+// parameters.
+//   SEQUENCE (12 bytes) {
+//     OBJECT IDENTIFIER 1.3.6.1.4.1.44363.47.0 (10 bytes)
+//   }
+constexpr uint8_t kMTCAlgorithmIdentifier[] = {
+    0x30,  // SEQUENCE tag
+    12,    // tag + len + OID bytes
+    0x06,  // OBJECT tag
+    10,    // OID length
+    OBJ_ENC_alg_mtcProof_draft,
+};
+// MTCLogEntryType enum value for tbs_cert_entry.
+constexpr uint8_t kMTCLogEntryTypeTBSCertEntry[] = {0x00, 0x01};
+// ASN.1 tag for encoded OCTET STRING.
+constexpr uint8_t kEncodedOctetStringTag[] = {0x04};
+// Prefix for domain separation used in CosignedMessage.
+constexpr uint8_t kCosignedMessageLabel[12] = {'s', 'u', 'b', 't', 'r',  'e',
+                                               'e', '/', 'v', '1', '\n', '\0'};
+// String prefix used to construct ASCII representation of trust anchor IDs for
+// CosignedMessage fields.
+constexpr uint8_t kASCIIOIDPrefix[16] = {'o', 'i', 'd', '/', '1', '.',
+                                         '3', '.', '6', '.', '1', '.',
+                                         '4', '.', '1', '.'};
+// DER encoded OID component found in trust anchor IDs for issuance logs.
+constexpr uint8_t kEncOIDLogs = 0x00;
+
+constexpr CBS_ASN1_TAG kTBSVersionTag =
+    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0;
+
+// HashNode executes one hashing step in the evaluation of an inclusion proof.
+void HashNode(Span<uint8_t> out, const EVP_MD *log_hash,
+              Span<const uint8_t> left_child, Span<const uint8_t> right_child) {
+  assert(out.size() == EVP_MD_size(log_hash));
+  assert(left_child.size() == EVP_MD_size(log_hash));
+  assert(right_child.size() == EVP_MD_size(log_hash));
+  ScopedEVP_MD_CTX ctx;
+  EVP_DigestInit_ex(ctx.get(), log_hash, nullptr);
+  EVP_DigestUpdate(ctx.get(), kMTCNodeDomainSeparator,
+                   sizeof(kMTCNodeDomainSeparator));
+  EVP_DigestUpdate(ctx.get(), left_child.data(), left_child.size());
+  EVP_DigestUpdate(ctx.get(), right_child.data(), right_child.size());
+  EVP_DigestFinal_ex(ctx.get(), out.data(), nullptr);
+}
+
+// lsb returns whether the least-significant bit of `n` is set.
+inline bool lsb(uint64_t n) { return n & 1; }
+
+// is_mtc_proof returns whether `algor` is an mtcProof AlgorithmIdentifier.
+bool is_mtc_proof(const X509_ALGOR *algor) {
+  return OBJ_obj2nid(algor->algorithm) == NID_alg_mtcProof_draft &&
+         algor->parameter == nullptr;
+}
+
+// Returns the first hash value (of size `log_hash_size`) remaining in
+// `inclusion_proof` and advances `inclusion_proof` past the returned value.
+// Returns an empty span if there are no more hash values of the appropriate
+// size.
+Span<const uint8_t> GetNextValueFromInclusionProof(
+    size_t log_hash_size, Span<const uint8_t> &inclusion_proof) {
+  if (inclusion_proof.size() < log_hash_size) {
+    return Span<const uint8_t>();
+  }
+  Span<const uint8_t> value = inclusion_proof.first(log_hash_size);
+  inclusion_proof = inclusion_proof.subspan(log_hash_size);
+  return value;
+}
+
+// Writes `data` to the digest in `ctx`, prepending an 8-bit length prefix.
+bool DigestUpdateWithU8LengthPrefix(EVP_MD_CTX *ctx, Span<const uint8_t> data) {
+  BSSL_CHECK(data.size() < (1u << 8));
+  const uint8_t length_prefix = static_cast<uint8_t>(data.size());
+  return EVP_DigestUpdate(ctx, &length_prefix, sizeof(length_prefix)) &&
+         EVP_DigestUpdate(ctx, data.data(), data.size());
+}
+
+// Writes `data` to the digest in `ctx`, prepending a 16-bit length prefix.
+bool DigestUpdateWithU16LengthPrefix(EVP_MD_CTX *ctx,
+                                     Span<const uint8_t> data) {
+  BSSL_CHECK(data.size() < (1u << 16));
+  const uint8_t length_prefix[2] = {static_cast<uint8_t>(data.size() >> 8),
+                                    static_cast<uint8_t>(data.size())};
+  return EVP_DigestUpdate(ctx, length_prefix, sizeof(length_prefix)) &&
+         EVP_DigestUpdate(ctx, data.data(), data.size());
+}
+
+// Reads the next ASN.1 element from `cbs` and writes it as-is to the digest in
+// `ctx`, including ASN.1 header bytes.
+bool DigestUpdateNextASN1Element(EVP_MD_CTX *ctx, CBS *cbs) {
+  CBS element;
+  if (!CBS_get_any_asn1_element(cbs, &element, /*out_tag=*/nullptr,
+                                /*out_header_len=*/nullptr)) {
+    return false;
+  }
+  return EVP_DigestUpdate(ctx, CBS_data(&element), CBS_len(&element));
+}
+
+// MTCCACosigner represents a Merkle Tree CA and its corresponding CA cosigner
+// (see draft-ietf-plants-merkle-tree-certs, section 5.5).
+class MTCCACosigner {
+ public:
+  MTCCACosigner() = default;
+  ~MTCCACosigner() = default;
+
+  // Init() must be called before this object can be used.
+  // Init parses parameters defining an MTC CA cosigner from `x509`, including
+  // its MTCCertificationAuthority extension. `pkey` is the public key
+  // previously parsed from `x509`. Returns true if successfully initialized an
+  // MTCCACosigner representing a valid MTC CA, or false on error.
+  bool Init(const X509 *x509, const EVP_PKEY *pkey) {
+    // Get and parse the MTCCertificationAuthority extension (see section 5.5).
+    int ext_index =
+        X509_get_ext_by_NID(x509, NID_pe_mtcCertificationAuthority_draft, -1);
+    const X509_EXTENSION *ext = X509_get_ext(x509, ext_index);
+    if (ext == nullptr || !X509_EXTENSION_get_critical(ext)) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_CA);
+      return false;
+    }
+    const ASN1_STRING *value = X509_EXTENSION_get_data(ext);
+    CBS ext_value;
+    CBS_init(&ext_value, ASN1_STRING_get0_data(value),
+             ASN1_STRING_length(value));
+
+    CBS seq, log_hash;
+    if (!CBS_get_asn1(&ext_value, &seq, CBS_ASN1_SEQUENCE) ||         //
+        !CBS_get_asn1_element(&seq, &log_hash, CBS_ASN1_SEQUENCE) ||  //
+        !x509_parse_algorithm(&seq, cosign_sigalg_.get()) ||          //
+        !CBS_get_asn1_uint64(&seq, &min_serial_) ||                   //
+        !CBS_get_asn1_uint64(&seq, &max_serial_) ||                   //
+        CBS_len(&seq) != 0) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+      return false;
+    }
+    log_hash_ = EVP_parse_digest_algorithm(&log_hash);
+    if (log_hash_ == nullptr) {
+      return false;
+    }
+    if (CBS_len(&log_hash) != 0) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+      return false;
+    }
+
+    // Extract the CA ID from the subject (see section 5.1).
+    const X509_NAME *subject = X509_get_subject_name(x509);
+    int tai_index =
+        X509_NAME_get_index_by_NID(subject, NID_rdna_trustAnchorID_draft, -1);
+    if (tai_index < 0 || X509_NAME_entry_count(subject) != 1) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_CA);
+      return false;
+    }
+    // For initial experimentation, the attribute's value is a UTF8String
+    // containing the trust anchor ID's ASCII representation.
+    const ASN1_STRING *tai_ascii =
+        X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject, tai_index));
+    if (ASN1_STRING_type(tai_ascii) != V_ASN1_UTF8STRING) {
+      OPENSSL_PUT_ERROR(X509, X509_R_WRONG_TYPE);
+      return false;
+    }
+    std::string_view tai_ascii_str = BytesAsStringView(
+        Span(ASN1_STRING_get0_data(tai_ascii), ASN1_STRING_length(tai_ascii)));
+    ScopedCBB ca_id_enc;
+    if (!CBB_init(ca_id_enc.get(), 64) ||
+        !CBB_add_asn1_relative_oid_from_text(
+            ca_id_enc.get(), tai_ascii_str.data(), tai_ascii_str.size())) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_OBJECT_ENCODING);
+      return false;
+    }
+    if (!CBBFinishArray(ca_id_enc.get(), &ca_id_enc_oid_)) {
+      OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    cosign_pubkey_.reset(EVP_PKEY_dup_ref(pkey));
+    return true;
+  }
+
+  bool IsSerialInRange(uint64_t serial) const {
+    return min_serial_ <= serial && serial <= max_serial_;
+  }
+
+  // Constructs CosignedMessage and computes signature.
+  bool VerifyCACosignature(Span<const uint8_t> ca_cosignature,
+                           uint64_t log_number, uint64_t subtree_start,
+                           uint64_t subtree_end,
+                           Span<const uint8_t> expected_subtree_hash) const {
+    ScopedCBB cosigned_message;
+    if (!CBB_init(cosigned_message.get(), 256) ||
+        !CBB_add_bytes(cosigned_message.get(), kCosignedMessageLabel,
+                       sizeof(kCosignedMessageLabel)) ||
+        !WriteCosignerName(cosigned_message.get()) ||
+        !CBB_add_u64(cosigned_message.get(), 0u) ||  // timestamp
+        !WriteLogOrigin(cosigned_message.get(), log_number) ||
+        !CBB_add_u64(cosigned_message.get(), subtree_start) ||
+        !CBB_add_u64(cosigned_message.get(), subtree_end) ||
+        !CBB_add_bytes(cosigned_message.get(), expected_subtree_hash.data(),
+                       expected_subtree_hash.size())) {
+      OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+    return x509_verify_signature_bytes(cosign_sigalg_.get(), ca_cosignature,
+                                       CBBAsSpan(cosigned_message.get()),
+                                       cosign_pubkey_.get());
+  }
+
+  // IsCACosigner returns whether `trust_anchor_id` equals the cosigner ID
+  // of this CA's CA cosigner.
+  bool IsCACosigner(Span<const uint8_t> trust_anchor_id) const {
+    return trust_anchor_id == ca_id_enc_oid_;
+  }
+
+  const EVP_MD *log_hash() const { return log_hash_; }
+
+ private:
+  // WriteTaiAscii concatenates the trust anchor ID prefix with the CA ID as a
+  // relative OID to get the CA ID as a full OID, then appends any additional
+  // OID components from `oid_suffix`, and writes the ASCII string
+  // representation of the full trust anchor ID to `out`.
+  bool WriteTaiAscii(CBB *out, Span<const uint64_t> oid_suffix = {}) const {
+    // Trust anchor IDs are constrained to 256 bytes by spec (and are typically
+    // much shorter).
+    uint8_t id[256];
+    CBB id_cbb;
+    if (!CBB_init_fixed(&id_cbb, id, sizeof(id)) ||
+        !CBB_add_bytes(&id_cbb, ca_id_enc_oid_.data(), ca_id_enc_oid_.size())) {
+      return false;
+    }
+    for (const uint64_t component : oid_suffix) {
+      if (!CBB_add_asn1_oid_component(&id_cbb, component)) {
+        return false;
+      }
+    }
+    return CBB_add_asn1_relative_oid_from_der_to_text(out, CBB_data(&id_cbb),
+                                                      CBB_len(&id_cbb));
+  }
+
+  // WriteCosignerName writes the `cosigner_name` field for a CosignedMessage (a
+  // prefixed ASCII representation of the CA ID) to `out`.
+  bool WriteCosignerName(CBB *out) const {
+    CBB cosigner_name;
+    return CBB_add_u8_length_prefixed(out, &cosigner_name) &&
+           CBB_add_bytes(&cosigner_name, kASCIIOIDPrefix,
+                         sizeof(kASCIIOIDPrefix)) &&
+           WriteTaiAscii(&cosigner_name) &&  //
+           CBB_flush(out);
+  }
+
+  // WriteLogOrigin writes the `log_origin` field for a CosignedMessage (a
+  // prefixed ASCII representation of the CA's log ID for a given `log_number`)
+  // to `out`.
+  bool WriteLogOrigin(CBB *out, uint64_t log_number) const {
+    const uint64_t log_number_relative_oid[2] = {kEncOIDLogs, log_number};
+    CBB log_origin;
+    return CBB_add_u8_length_prefixed(out, &log_origin) &&
+           CBB_add_bytes(&log_origin, kASCIIOIDPrefix,
+                         sizeof(kASCIIOIDPrefix)) &&
+           WriteTaiAscii(&log_origin, Span(log_number_relative_oid)) &&
+           CBB_flush(out);
+  }
+
+  // The CA ID, which is equal to the CA cosigner's cosigner ID (see sections
+  // 5.1 and 5.4), in the form of a DER-encoded relative OID. This does not
+  // include any framing, only the element's contents.
+  Array<uint8_t> ca_id_enc_oid_;
+  // Log hash algorithm.
+  const EVP_MD *log_hash_ = nullptr;
+  // Public key of the CA cosigner.
+  UniquePtr<EVP_PKEY> cosign_pubkey_;
+  // Signature algorithm for CA cosigner signatures.
+  ScopedX509Algor cosign_sigalg_;
+  // Min and max allowed serial number, (0..2^64-1).
+  uint64_t min_serial_ = 0u;
+  uint64_t max_serial_ = 0u;
+};
+
+}  // namespace
+
+bool x509_is_merkle_tree_ca(const X509 *x509) {
+  return X509_get_ext_by_NID(x509, NID_pe_mtcCertificationAuthority_draft,
+                             -1) >= 0;
+}
+
+bool x509_evaluate_mtc_subtree_inclusion_proof(
+    Span<uint8_t> out, const EVP_MD *log_hash,
+    Span<const uint8_t> inclusion_proof, uint64_t index,
+    Span<const uint8_t> entry_hash, uint64_t subtree_start,
+    uint64_t subtree_end) {
+  const size_t log_hash_size = EVP_MD_size(log_hash);
+  if (out.size() != log_hash_size || entry_hash.size() != log_hash_size) {
+    return false;
+  }
+
+  // Check that `subtree_start` and `subtree_end` define a valid subtree.
+  if (subtree_start > subtree_end) {
+    return false;
+  }
+  // The subtree must be aligned and not have a ragged left edge, i.e. the size
+  // must not exceed the largest power of 2 that divides the start index.
+  const uint64_t subtree_size = subtree_end - subtree_start;
+  if (subtree_start != 0 &&
+      // The expression `subtree_start & (~subtree_start + 1)` isolates the
+      // lowest set bit of `subtree_start`.
+      subtree_size > (subtree_start & (~subtree_start + 1))) {
+    return false;
+  }
+  // Check that `index` is in range for the subtree.
+  if (index < subtree_start || subtree_end <= index) {
+    return false;
+  }
+
+  OPENSSL_memcpy(out.data(), entry_hash.data(), log_hash_size);
+
+  // `fn` is the index of the entry if the subtree were re-numbered to start at
+  // 0, and `sn` is what the last entry of such a re-numbered subtree would be.
+  uint64_t fn = index - subtree_start;
+  uint64_t sn = subtree_size - 1;
+  while (!inclusion_proof.empty()) {
+    Span<const uint8_t> p =
+        GetNextValueFromInclusionProof(log_hash_size, inclusion_proof);
+    if (p.empty()) {
+      // Truncated hash in inclusion proof, or trailing data after last full
+      // hash.
+      return false;
+    }
+    assert(p.size() == log_hash_size);
+    if (sn == 0) {
+      // More hashes in the inclusion proof than expected.
+      return false;
+    }
+    if (lsb(fn) || fn == sn) {
+      HashNode(out, log_hash, /*left_child=*/p, /*right_child=*/out);
+      while (!lsb(fn)) {
+        fn >>= 1;
+        sn >>= 1;
+      }
+    } else {
+      HashNode(out, log_hash, /*left_child=*/out, /*right_child=*/p);
+    }
+    fn >>= 1;
+    sn >>= 1;
+  }
+
+  if (sn != 0) {
+    // Not enough hashes in inclusion proof.
+    return false;
+  }
+
+  return true;
+}
+
+int x509_verify_mtc(const X509 *x509, const EVP_PKEY *pkey,
+                    const X509 *issuer) {
+  MTCCACosigner issuer_mtc_ca;
+  if (!issuer_mtc_ca.Init(issuer, pkey)) {
+    return 0;
+  }
+
+  auto *impl = FromOpaque(x509);
+  if (!is_mtc_proof(impl->sig_alg.get())) {
+    OPENSSL_PUT_ERROR(X509, X509_R_UNSUPPORTED_ALGORITHM);
+    return 0;
+  }
+  if (X509_ALGOR_cmp(impl->sig_alg.get(), impl->tbs_sig_alg.get())) {
+    OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
+    return 0;
+  }
+
+  if (impl->signature->type == V_ASN1_BIT_STRING &&
+      ASN1_BIT_STRING_unused_bits(impl->signature.get()) != 0) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
+    return 0;
+  }
+
+  CBS mtc_proof;
+  CBS_init(&mtc_proof, ASN1_STRING_get0_data(impl->signature.get()),
+           ASN1_STRING_length(impl->signature.get()));
+
+  CBS extensions, inclusion_proof, signatures;
+  uint64_t subtree_start, subtree_end;
+  if (!CBS_get_u16_length_prefixed(&mtc_proof, &extensions) ||
+      !CBS_get_u48(&mtc_proof, &subtree_start) ||
+      !CBS_get_u48(&mtc_proof, &subtree_end) ||
+      !CBS_get_u16_length_prefixed(&mtc_proof, &inclusion_proof) ||
+      !CBS_get_u16_length_prefixed(&mtc_proof, &signatures) ||
+      CBS_len(&mtc_proof) != 0) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+
+  // Iterate through the subtree signatures array to check that they conform to
+  // spec, and identify the subtree signature from the CA cosigner.
+  CBS cosigner_id, signature;
+  std::optional<Span<const uint8_t>> prev_cosigner_id;
+  std::optional<Span<const uint8_t>> ca_cosignature;
+  while (CBS_len(&signatures) > 0) {
+    if (!CBS_get_u8_length_prefixed(&signatures, &cosigner_id) ||
+        CBS_len(&cosigner_id) == 0 ||
+        !CBS_get_u16_length_prefixed(&signatures, &signature) ||
+        CBS_len(&signature) == 0) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+      return 0;
+    }
+    Span<const uint8_t> cosigner_id_span = cosigner_id;
+    // Cosignatures must be ordered by increasing cosigner ID length
+    // (lexicographical order if same length), and must not contain duplicate
+    // cosigner IDs.
+    if (prev_cosigner_id.has_value()) {
+      if (prev_cosigner_id->size() > cosigner_id_span.size()) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+        return 0;
+      }
+      if (prev_cosigner_id->size() == cosigner_id_span.size() &&
+          !std::lexicographical_compare(
+              prev_cosigner_id->begin(), prev_cosigner_id->end(),
+              cosigner_id_span.begin(), cosigner_id_span.end())) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+        return 0;
+      }
+    }
+    prev_cosigner_id = cosigner_id_span;
+    if (issuer_mtc_ca.IsCACosigner(cosigner_id_span)) {
+      ca_cosignature = signature;
+    }
+  }
+  if (!ca_cosignature.has_value()) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+    return 0;
+  }
+
+  CBS tbs_seq, tbs;
+  Array<uint8_t> tbs_scratch;
+  if (!x509_get_or_marshal_tbs_cert(&tbs_seq, &tbs_scratch, x509) ||
+      !CBS_get_asn1(&tbs_seq, &tbs, CBS_ASN1_SEQUENCE)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+
+  CBS version_field;
+  if (CBS_peek_asn1_tag(&tbs, kTBSVersionTag)) {
+    if (!CBS_get_asn1_element(&tbs, &version_field, kTBSVersionTag)) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+      return 0;
+    }
+  } else {
+    CBS_init(&version_field, nullptr, 0);
+  }
+
+  // Check serial number is well-formed and within CA's range. (Caller is
+  // responsible for checking serial number against other revoked ranges.)
+  uint64_t serial;
+  if (!CBS_get_asn1_uint64(&tbs, &serial)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+  if (!issuer_mtc_ca.IsSerialInRange(serial)) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_PARAMETER);
+    return 0;
+  }
+  // `index` is the least significant 48 bits of `serial`.
+  uint64_t index = serial & ((uint64_t{1} << 48) - 1);
+  uint64_t log_number = serial >> 48;
+  if (log_number == 0) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_PARAMETER);
+    return 0;
+  }
+
+  // The TBSCertificate's `signature` field must match the expected MTC
+  // signature algorithm identifier.
+  CBS tbs_sigalg;
+  if (!CBS_get_asn1_element(&tbs, &tbs_sigalg, CBS_ASN1_SEQUENCE) ||
+      !CBS_mem_equal(&tbs_sigalg, kMTCAlgorithmIdentifier,
+                     sizeof(kMTCAlgorithmIdentifier))) {
+    OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
+    return 0;
+  }
+
+  // Compute `entry_hash` in a single pass without storing the full
+  // TBSCertificateLogEntry or MTCLogEntry.
+  ScopedEVP_MD_CTX entry_hash_ctx;
+  if (!EVP_DigestInit_ex(entry_hash_ctx.get(), issuer_mtc_ca.log_hash(),
+                         nullptr) ||
+      !EVP_DigestUpdate(entry_hash_ctx.get(), kMTCLeafDomainSeparator,
+                        sizeof(kMTCLeafDomainSeparator)) ||
+      // MTCLogEntry `extensions` field (comes directly from the MTCProof).
+      !DigestUpdateWithU16LengthPrefix(entry_hash_ctx.get(), extensions) ||
+      // MTCLogEntryType enum value for a tbs_cert_entry.
+      !EVP_DigestUpdate(entry_hash_ctx.get(), kMTCLogEntryTypeTBSCertEntry,
+                        sizeof(kMTCLogEntryTypeTBSCertEntry)) ||
+      // Contents of TBSCertificateLogEntry follow (excluding the initial
+      // identifier and length octets):
+      !EVP_DigestUpdate(entry_hash_ctx.get(), CBS_data(&version_field),
+                        CBS_len(&version_field)) ||
+      !DigestUpdateNextASN1Element(entry_hash_ctx.get(), &tbs) ||  // issuer
+      !DigestUpdateNextASN1Element(entry_hash_ctx.get(), &tbs) ||  // validity
+      !DigestUpdateNextASN1Element(entry_hash_ctx.get(), &tbs)) {  // subject
+    OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  // Hash the TBSCertificate's `subjectPublicKeyInfo` field.
+  CBS spki;
+  if (!CBS_get_asn1_element(&tbs, &spki, CBS_ASN1_SEQUENCE)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+  uint8_t spki_digest[EVP_MAX_MD_SIZE];
+  unsigned int spki_digest_len;
+  if (!EVP_Digest(CBS_data(&spki), CBS_len(&spki), spki_digest,
+                  &spki_digest_len, issuer_mtc_ca.log_hash(), nullptr) ||
+      spki_digest_len == 0 || spki_digest_len > 0xff) {
+    OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  // Add the AlgorithmIdentifier from the subjectPublicKeyInfo.
+  CBS spki_contents;
+  if (!CBS_get_asn1(&spki, &spki_contents, CBS_ASN1_SEQUENCE)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+  if (!DigestUpdateNextASN1Element(entry_hash_ctx.get(), &spki_contents) ||
+      //`subjectPublicKeyInfoHash` field.
+      !EVP_DigestUpdate(entry_hash_ctx.get(), &kEncodedOctetStringTag,
+                        sizeof(kEncodedOctetStringTag)) ||
+      !DigestUpdateWithU8LengthPrefix(entry_hash_ctx.get(),
+                                      Span(spki_digest, spki_digest_len)) ||
+      // Write the remainder of the TBSCertificate contents octets to the hash.
+      // This includes the optional fields `issuerUniqueID`, `subjectUniqueID`,
+      // and `extensions`.
+      !EVP_DigestUpdate(entry_hash_ctx.get(), CBS_data(&tbs), CBS_len(&tbs))) {
+    OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  uint8_t entry_hash[EVP_MAX_MD_SIZE];
+  unsigned entry_hash_len;
+  if (!EVP_DigestFinal_ex(entry_hash_ctx.get(), entry_hash, &entry_hash_len)) {
+    OPENSSL_PUT_ERROR(X509, ERR_R_INTERNAL_ERROR);
+    return 0;
+  }
+
+  InplaceVector<uint8_t, EVP_MAX_MD_SIZE> expected_subtree_hash;
+  expected_subtree_hash.ResizeForOverwrite(
+      EVP_MD_size(issuer_mtc_ca.log_hash()));
+
+  if (!x509_evaluate_mtc_subtree_inclusion_proof(
+          Span(expected_subtree_hash), issuer_mtc_ca.log_hash(),
+          inclusion_proof, index, Span(entry_hash, entry_hash_len),
+          subtree_start, subtree_end)) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_MTC_PROOF);
+    return 0;
+  }
+
+  return issuer_mtc_ca.VerifyCACosignature(ca_cosignature.value(), log_number,
+                                           subtree_start, subtree_end,
+                                           Span(expected_subtree_hash));
+}
+
+BSSL_NAMESPACE_END