visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/ec/internal.h

@@ -0,0 +1,114 @@
+// Copyright 2020 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_EC_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_EC_INTERNAL_H
+
+#include <openssl/ec.h>
+
+#include <openssl/span.h>
+
+#include "../fipsmodule/ec/internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// Parsing functions.
+
+// ec_key_parse_curve_name behaves like `EC_KEY_parse_curve_name` but only
+// supports the groups in `allowed_groups`. If no syntax errors were found but
+// the group is unknown, it will fail with an error of `EC_R_UNKNOWN_GROUP`.
+const EC_GROUP *ec_key_parse_curve_name(
+    CBS *cbs, bssl::Span<const EC_GROUP *const> allowed_groups);
+
+// ec_key_parse_parameters behaves like `EC_KEY_parse_parameters` but only
+// supports the groups in `allowed_groups`. If no syntax errors were found but
+// the group is unknown, it will fail with an error of `EC_R_UNKNOWN_GROUP`.
+const EC_GROUP *ec_key_parse_parameters(
+    CBS *cbs, bssl::Span<const EC_GROUP *const> allowed_groups);
+
+// ec_key_parse_private_key behaves like `EC_KEY_parse_private_key` but only
+// supports the groups in `allowed_groups`. If `group` is non-NULL,
+// `allowed_groups` is ignored and instead only `group` is supported.
+//
+// TODO(crbug.com/boringssl/414361735): This should return a bssl::UniquePtr,
+// but cannot until it is made C++ linkage.
+EC_KEY *ec_key_parse_private_key(
+    CBS *cbs, const EC_GROUP *group,
+    bssl::Span<const EC_GROUP *const> allowed_groups);
+
+
+// Hash-to-curve.
+//
+// Internal `EC_JACOBIAN` versions of the corresponding public APIs.
+
+// ec_hash_to_curve_p256_xmd_sha256_sswu hashes `msg` to a point on `group` and
+// writes the result to `out`, implementing the P256_XMD:SHA-256_SSWU_RO_ suite
+// from RFC 9380. It returns one on success and zero on error.
+OPENSSL_EXPORT int ec_hash_to_curve_p256_xmd_sha256_sswu(
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_hash_to_curve_p384_xmd_sha384_sswu hashes `msg` to a point on `group` and
+// writes the result to `out`, implementing the P384_XMD:SHA-384_SSWU_RO_ suite
+// from RFC 9380. It returns one on success and zero on error.
+OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha384_sswu(
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_encode_to_curve_p256_xmd_sha256_sswu hashes `msg` to a point on `group`
+// and writes the result to `out`, implementing the P256_XMD:SHA-256_SSWU_NU_
+// suite from RFC 9380. It returns one on success and zero on error.
+OPENSSL_EXPORT int ec_encode_to_curve_p256_xmd_sha256_sswu(
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_encode_to_curve_p384_xmd_sha384_sswu hashes `msg` to a point on `group`
+// and writes the result to `out`, implementing the P384_XMD:SHA-384_SSWU_NU_
+// suite from RFC 9380. It returns one on success and zero on error.
+OPENSSL_EXPORT int ec_encode_to_curve_p384_xmd_sha384_sswu(
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_hash_to_scalar_p384_xmd_sha384 hashes `msg` to a scalar on `group`
+// and writes the result to `out`, using the hash_to_field operation from the
+// P384_XMD:SHA-384_SSWU_RO_ suite from RFC 9380, but generating a value modulo
+// the group order rather than a field element.
+OPENSSL_EXPORT int ec_hash_to_scalar_p384_xmd_sha384(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_hash_to_curve_p384_xmd_sha512_sswu_draft07 hashes `msg` to a point on
+// `group` and writes the result to `out`, implementing the
+// P384_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-07. It
+// returns one on success and zero on error.
+//
+// TODO(https://crbug.com/1414562): Migrate this to the final version.
+OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_hash_to_scalar_p384_xmd_sha512_draft07 hashes `msg` to a scalar on `group`
+// and writes the result to `out`, using the hash_to_field operation from the
+// P384_XMD:SHA-512_SSWU_RO_ suite from draft-irtf-cfrg-hash-to-curve-07, but
+// generating a value modulo the group order rather than a field element.
+//
+// TODO(https://crbug.com/1414562): Migrate this to the final version.
+OPENSSL_EXPORT int ec_hash_to_scalar_p384_xmd_sha512_draft07(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_EC_INTERNAL_H

package/runtime/third_party/boringssl/crypto/ecdh/ecdh.cc

@@ -0,0 +1,75 @@
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ecdh.h>
+
+#include <limits.h>
+#include <string.h>
+
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+#include "../fipsmodule/ec/internal.h"
+#include "../internal.h"
+
+
+using namespace bssl;
+
+int ECDH_compute_key(void *out, size_t out_len, const EC_POINT *pub_key,
+                     const EC_KEY *priv_key,
+                     void *(*kdf)(const void *in, size_t inlen, void *out,
+                                  size_t *out_len)) {
+  if (FromOpaque(priv_key)->priv_key == nullptr) {
+    OPENSSL_PUT_ERROR(ECDH, ECDH_R_NO_PRIVATE_VALUE);
+    return -1;
+  }
+  const EC_SCALAR *const priv = &FromOpaque(priv_key)->priv_key->scalar;
+  const EC_GROUP *const group = EC_KEY_get0_group(priv_key);
+  if (EC_GROUP_cmp(group, pub_key->group, nullptr) != 0) {
+    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
+    return -1;
+  }
+
+  EC_JACOBIAN shared_point;
+  uint8_t buf[EC_MAX_BYTES];
+  size_t buf_len;
+  if (!ec_point_mul_scalar(group, &shared_point, &pub_key->raw, priv) ||
+      !ec_get_x_coordinate_as_bytes(group, buf, &buf_len, sizeof(buf),
+                                    &shared_point)) {
+    OPENSSL_PUT_ERROR(ECDH, ECDH_R_POINT_ARITHMETIC_FAILURE);
+    return -1;
+  }
+
+  if (kdf != nullptr) {
+    if (kdf(buf, buf_len, out, &out_len) == nullptr) {
+      OPENSSL_PUT_ERROR(ECDH, ECDH_R_KDF_FAILED);
+      return -1;
+    }
+  } else {
+    // no KDF, just copy as much as we can
+    if (buf_len < out_len) {
+      out_len = buf_len;
+    }
+    OPENSSL_memcpy(out, buf, out_len);
+  }
+
+  if (out_len > INT_MAX) {
+    OPENSSL_PUT_ERROR(ECDH, ERR_R_OVERFLOW);
+    return -1;
+  }
+
+  return (int)out_len;
+}

package/runtime/third_party/boringssl/crypto/ecdsa/ecdsa_asn1.cc

@@ -0,0 +1,337 @@
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ecdsa.h>
+
+#include <limits.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/bytestring.h>
+#include <openssl/ec_key.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+#include "../bytestring/internal.h"
+#include "../fipsmodule/ecdsa/internal.h"
+#include "../internal.h"
+#include "../mem_internal.h"
+
+
+using namespace bssl;
+
+static ECDSA_SIG *ecdsa_sig_from_fixed(const EC_KEY *key, const uint8_t *in,
+                                       size_t len) {
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == nullptr) {
+    OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
+    return nullptr;
+  }
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (len != 2 * scalar_len) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    return nullptr;
+  }
+  ECDSA_SIG *ret = ECDSA_SIG_new();
+  if (ret == nullptr || !BN_bin2bn(in, scalar_len, ret->r) ||
+      !BN_bin2bn(in + scalar_len, scalar_len, ret->s)) {
+    ECDSA_SIG_free(ret);
+    return nullptr;
+  }
+  return ret;
+}
+
+static int ecdsa_sig_to_fixed(const EC_KEY *key, uint8_t *out, size_t *out_len,
+                              size_t max_out, const ECDSA_SIG *sig) {
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == nullptr) {
+    OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (max_out < 2 * scalar_len) {
+    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+  if (BN_is_negative(sig->r) || !BN_bn2bin_padded(out, scalar_len, sig->r) ||
+      BN_is_negative(sig->s) ||
+      !BN_bn2bin_padded(out + scalar_len, scalar_len, sig->s)) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    return 0;
+  }
+  *out_len = 2 * scalar_len;
+  return 1;
+}
+
+int ECDSA_sign(int type, const uint8_t *digest, size_t digest_len, uint8_t *sig,
+               unsigned int *out_sig_len, const EC_KEY *eckey) {
+  const ECKey *eckey_impl = FromOpaque(eckey);
+  if (eckey_impl->ecdsa_meth && eckey_impl->ecdsa_meth->sign) {
+    return eckey_impl->ecdsa_meth->sign(digest, digest_len, sig, out_sig_len,
+                                        (EC_KEY *)eckey /* cast away const */);
+  }
+
+  *out_sig_len = 0;
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  if (!ecdsa_sign_fixed(digest, digest_len, fixed, &fixed_len, sizeof(fixed),
+                        eckey)) {
+    return 0;
+  }
+
+  // TODO(davidben): We can actually do better and go straight from the DER
+  // format to the fixed-width format without a malloc.
+  UniquePtr<ECDSA_SIG> s(ecdsa_sig_from_fixed(eckey, fixed, fixed_len));
+  if (s == nullptr) {
+    return 0;
+  }
+
+  CBB cbb;
+  CBB_init_fixed(&cbb, sig, ECDSA_size(eckey));
+  size_t len;
+  if (!ECDSA_SIG_marshal(&cbb, s.get()) || !CBB_finish(&cbb, nullptr, &len)) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
+    return 0;
+  }
+  *out_sig_len = static_cast<unsigned>(len);
+  return 1;
+}
+
+int ECDSA_verify(int type, const uint8_t *digest, size_t digest_len,
+                 const uint8_t *sig, size_t sig_len, const EC_KEY *eckey) {
+  // Decode the ECDSA signature.
+  //
+  // TODO(davidben): We can actually do better and go straight from the DER
+  // format to the fixed-width format without a malloc.
+  int ret = 0;
+  uint8_t *der = nullptr;
+  UniquePtr<ECDSA_SIG> s(ECDSA_SIG_from_bytes(sig, sig_len));
+  if (s == nullptr) {
+    goto err;
+  }
+
+  // Defend against potential laxness in the DER parser.
+  size_t der_len;
+  if (!ECDSA_SIG_to_bytes(&der, &der_len, s.get()) || der_len != sig_len ||
+      OPENSSL_memcmp(sig, der, sig_len) != 0) {
+    // This should never happen. crypto/bytestring is strictly DER.
+    OPENSSL_PUT_ERROR(ECDSA, ERR_R_INTERNAL_ERROR);
+    goto err;
+  }
+
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  ret = ecdsa_sig_to_fixed(eckey, fixed, &fixed_len, sizeof(fixed), s.get()) &&
+        ecdsa_verify_fixed(digest, digest_len, fixed, fixed_len, eckey);
+
+err:
+  OPENSSL_free(der);
+  return ret;
+}
+
+
+size_t ECDSA_size(const EC_KEY *key) {
+  if (key == nullptr) {
+    return 0;
+  }
+
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == nullptr) {
+    return 0;
+  }
+
+  size_t group_order_size = BN_num_bytes(EC_GROUP_get0_order(group));
+  return ECDSA_SIG_max_len(group_order_size);
+}
+
+ECDSA_SIG *ECDSA_SIG_new() {
+  ECDSA_SIG *sig = New<ECDSA_SIG>();
+  if (sig == nullptr) {
+    return nullptr;
+  }
+  sig->r = BN_new();
+  sig->s = BN_new();
+  if (sig->r == nullptr || sig->s == nullptr) {
+    ECDSA_SIG_free(sig);
+    return nullptr;
+  }
+  return sig;
+}
+
+void ECDSA_SIG_free(ECDSA_SIG *sig) {
+  if (sig == nullptr) {
+    return;
+  }
+
+  BN_free(sig->r);
+  BN_free(sig->s);
+  Delete(sig);
+}
+
+const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig) { return sig->r; }
+
+const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig) { return sig->s; }
+
+void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **out_r,
+                    const BIGNUM **out_s) {
+  if (out_r != nullptr) {
+    *out_r = sig->r;
+  }
+  if (out_s != nullptr) {
+    *out_s = sig->s;
+  }
+}
+
+int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
+  if (r == nullptr || s == nullptr) {
+    return 0;
+  }
+  BN_free(sig->r);
+  BN_free(sig->s);
+  sig->r = r;
+  sig->s = s;
+  return 1;
+}
+
+int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
+                    const ECDSA_SIG *sig, const EC_KEY *eckey) {
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  return ecdsa_sig_to_fixed(eckey, fixed, &fixed_len, sizeof(fixed), sig) &&
+         ecdsa_verify_fixed(digest, digest_len, fixed, fixed_len, eckey);
+}
+
+// This function is only exported for testing and is not called in production
+// code.
+ECDSA_SIG *ECDSA_sign_with_nonce_and_leak_private_key_for_testing(
+    const uint8_t *digest, size_t digest_len, const EC_KEY *eckey,
+    const uint8_t *nonce, size_t nonce_len) {
+  uint8_t sig[ECDSA_MAX_FIXED_LEN];
+  size_t sig_len;
+  if (!ecdsa_sign_fixed_with_nonce_for_known_answer_test(
+          digest, digest_len, sig, &sig_len, sizeof(sig), eckey, nonce,
+          nonce_len)) {
+    return nullptr;
+  }
+
+  return ecdsa_sig_from_fixed(eckey, sig, sig_len);
+}
+
+ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
+                         const EC_KEY *eckey) {
+  uint8_t sig[ECDSA_MAX_FIXED_LEN];
+  size_t sig_len;
+  if (!ecdsa_sign_fixed(digest, digest_len, sig, &sig_len, sizeof(sig),
+                        eckey)) {
+    return nullptr;
+  }
+
+  return ecdsa_sig_from_fixed(eckey, sig, sig_len);
+}
+
+ECDSA_SIG *ECDSA_SIG_parse(CBS *cbs) {
+  ECDSA_SIG *ret = ECDSA_SIG_new();
+  if (ret == nullptr) {
+    return nullptr;
+  }
+  CBS child;
+  if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) ||
+      !BN_parse_asn1_unsigned(&child, ret->r) ||
+      !BN_parse_asn1_unsigned(&child, ret->s) || CBS_len(&child) != 0) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    ECDSA_SIG_free(ret);
+    return nullptr;
+  }
+  return ret;
+}
+
+ECDSA_SIG *ECDSA_SIG_from_bytes(const uint8_t *in, size_t in_len) {
+  CBS cbs;
+  CBS_init(&cbs, in, in_len);
+  ECDSA_SIG *ret = ECDSA_SIG_parse(&cbs);
+  if (ret == nullptr || CBS_len(&cbs) != 0) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    ECDSA_SIG_free(ret);
+    return nullptr;
+  }
+  return ret;
+}
+
+int ECDSA_SIG_marshal(CBB *cbb, const ECDSA_SIG *sig) {
+  CBB child;
+  if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) ||
+      !BN_marshal_asn1(&child, sig->r) || !BN_marshal_asn1(&child, sig->s) ||
+      !CBB_flush(cbb)) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
+    return 0;
+  }
+  return 1;
+}
+
+int ECDSA_SIG_to_bytes(uint8_t **out_bytes, size_t *out_len,
+                       const ECDSA_SIG *sig) {
+  CBB cbb;
+  CBB_zero(&cbb);
+  if (!CBB_init(&cbb, 0) || !ECDSA_SIG_marshal(&cbb, sig) ||
+      !CBB_finish(&cbb, out_bytes, out_len)) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
+    CBB_cleanup(&cbb);
+    return 0;
+  }
+  return 1;
+}
+
+// der_len_len returns the number of bytes needed to represent a length of `len`
+// in DER.
+static size_t der_len_len(size_t len) {
+  if (len < 0x80) {
+    return 1;
+  }
+  size_t ret = 1;
+  while (len > 0) {
+    ret++;
+    len >>= 8;
+  }
+  return ret;
+}
+
+size_t ECDSA_SIG_max_len(size_t order_len) {
+  // Compute the maximum length of an `order_len` byte integer. Defensively
+  // assume that the leading 0x00 is included.
+  size_t integer_len = 1 /* tag */ + der_len_len(order_len + 1) + 1 + order_len;
+  if (integer_len < order_len) {
+    return 0;
+  }
+  // An ECDSA signature is two INTEGERs.
+  size_t value_len = 2 * integer_len;
+  if (value_len < integer_len) {
+    return 0;
+  }
+  // Add the header.
+  size_t ret = 1 /* tag */ + der_len_len(value_len) + value_len;
+  if (ret < value_len) {
+    return 0;
+  }
+  return ret;
+}
+
+ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **out, const uint8_t **inp, long len) {
+  return D2IFromCBS(out, inp, len, ECDSA_SIG_parse);
+}
+
+int i2d_ECDSA_SIG(const ECDSA_SIG *sig, uint8_t **outp) {
+  return I2DFromCBB(
+      /*initial_capacity=*/64, outp,
+      [&](CBB *cbb) -> bool { return ECDSA_SIG_marshal(cbb, sig); });
+}

package/runtime/third_party/boringssl/crypto/ecdsa/ecdsa_p1363.cc

@@ -0,0 +1,54 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ecdsa.h>
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+
+#include "../fipsmodule/ecdsa/internal.h"
+
+
+using namespace bssl;
+
+int ECDSA_sign_p1363(const uint8_t *digest, size_t digest_len, uint8_t *sig,
+                     size_t *out_sig_len, size_t max_sig_len,
+                     const EC_KEY *eckey) {
+  return ecdsa_sign_fixed(digest, digest_len, sig, out_sig_len, max_sig_len,
+                          eckey);
+}
+
+int ECDSA_verify_p1363(const uint8_t *digest, size_t digest_len,
+                       const uint8_t *sig, size_t sig_len,
+                       const EC_KEY *eckey) {
+  return ecdsa_verify_fixed(digest, digest_len, sig, sig_len, eckey);
+}
+
+size_t ECDSA_size_p1363(const EC_KEY *key) {
+  if (key == nullptr) {
+    return 0;
+  }
+
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == nullptr) {
+    return 0;
+  }
+
+  size_t group_order_size = BN_num_bytes(EC_GROUP_get0_order(group));
+  return 2 * group_order_size;
+}

package/runtime/third_party/boringssl/crypto/engine/engine.cc

@@ -0,0 +1,95 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/engine.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/ec_key.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+#include <openssl/rsa.h>
+
+#include "../internal.h"
+#include "../mem_internal.h"
+
+
+using namespace bssl;
+
+struct engine_st {
+  RSA_METHOD *rsa_method;
+  ECDSA_METHOD *ecdsa_method;
+};
+
+ENGINE *ENGINE_new() { return New<ENGINE>(); }
+
+int ENGINE_free(ENGINE *engine) {
+  // Methods are currently required to be static so are not unref'ed.
+  Delete(engine);
+  return 1;
+}
+
+// set_method takes a pointer to a method and its given size and sets
+// `*out_member` to point to it. This function might want to be extended in the
+// future to support making a copy of the method so that a stable ABI for
+// ENGINEs can be supported. But, for the moment, all *_METHODS must be
+// static.
+static int set_method(void **out_member, const void *method, size_t method_size,
+                      size_t compiled_size) {
+  const struct openssl_method_common_st *common =
+      reinterpret_cast<const openssl_method_common_st *>(method);
+  if (method_size != compiled_size || !common->is_static) {
+    return 0;
+  }
+
+  *out_member = (void *)method;
+  return 1;
+}
+
+int ENGINE_set_RSA_method(ENGINE *engine, const RSA_METHOD *method,
+                          size_t method_size) {
+  return set_method((void **)&engine->rsa_method, method, method_size,
+                    sizeof(RSA_METHOD));
+}
+
+RSA_METHOD *ENGINE_get_RSA_method(const ENGINE *engine) {
+  return engine->rsa_method;
+}
+
+int ENGINE_set_ECDSA_method(ENGINE *engine, const ECDSA_METHOD *method,
+                            size_t method_size) {
+  return set_method((void **)&engine->ecdsa_method, method, method_size,
+                    sizeof(ECDSA_METHOD));
+}
+
+ECDSA_METHOD *ENGINE_get_ECDSA_method(const ENGINE *engine) {
+  return engine->ecdsa_method;
+}
+
+void METHOD_ref(void *method_in) {
+  assert(((struct openssl_method_common_st *)method_in)->is_static);
+}
+
+void METHOD_unref(void *method_in) {
+  struct openssl_method_common_st *method =
+      reinterpret_cast<openssl_method_common_st *>(method_in);
+
+  if (method == nullptr) {
+    return;
+  }
+  assert(method->is_static);
+}
+
+OPENSSL_DECLARE_ERROR_REASON(ENGINE, OPERATION_NOT_SUPPORTED)