visaljs 0.0.2 → 0.0.4

package/runtime/src/crypto_bn.c

@@ -0,0 +1,91 @@
+/* Big-integer primitives (ADR 0018) on BoringSSL's BIGNUM: node:crypto's finite-field Diffie-Hellman
+ * (modular exponentiation), generatePrime and checkPrime. Integers travel as big-endian bytes. */
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/err.h>
+
+#include "builtins_util.h"
+#include "crypto_internal.h"
+#include "js_buffer.h"
+#include "js_crypto.h"
+#include "js_exception.h"
+#include "js_ops.h"
+#include "js_web.h"
+#include "jscontext.h"
+
+#define PRIMITIVE(fn) \
+    JSValue fn(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target)
+#define ARG(i) ((i) < argc ? argv[i] : JS_UNDEFINED)
+
+static BIGNUM *bn_arg(JSValue v) {
+    uint8_t *p;
+    size_t n;
+    if (!js_buffer_source_bytes(v, &p, &n)) return NULL;
+    return BN_bin2bn(p, n, NULL);
+}
+
+/* A BIGNUM as a Buffer: big-endian, `pad` bytes long (zeros in front) or minimal (0: none, for zero) */
+static JSValue bn_buffer(JSContext *ctx, const BIGNUM *b, size_t pad) {
+    size_t n = pad ? pad : BN_num_bytes(b);
+    uint8_t *out = malloc(n ? n : 1);
+    if (!out) js_fatal("out of memory in crypto");
+    if (pad) BN_bn2bin_padded(out, n, b);
+    else BN_bn2bin(b, out);
+    JSValue r = js_new_buffer_from_bytes(ctx, out, n);
+    free(out);
+    return r;
+}
+
+/* cryptoModExp(base, exponent, modulus, pad) → base^exponent mod modulus, a Buffer (`pad` bytes, or
+ * minimal) | null for a modulus of zero. Constant time over the exponent for an odd modulus (the
+ * secret is the exponent in Diffie-Hellman). */
+PRIMITIVE(js_crypto_mod_exp) {
+    UNUSED_ARGS;
+    BIGNUM *b = bn_arg(ARG(0)), *e = bn_arg(ARG(1)), *m = bn_arg(ARG(2)), *r = BN_new();
+    BN_CTX *bc = BN_CTX_new();
+    if (!b || !e || !m || !r || !bc) {
+        BN_free(b), BN_free(e), BN_free(m), BN_free(r), BN_CTX_free(bc);
+        return js_throw_type_error(ctx, "cryptoModExp: bytes expected");
+    }
+    JSValue out = JS_NULL;
+    if (!BN_is_zero(m)) {
+        bool ok;
+        if (BN_is_odd(m) && BN_cmp(b, m) < 0) ok = BN_mod_exp_mont_consttime(r, b, e, m, bc, NULL);
+        else ok = BN_mod_exp(r, b, e, m, bc);
+        if (ok) out = bn_buffer(ctx, r, js_is_number(ARG(3)) ? (size_t)js_as_number(ARG(3)) : 0);
+    }
+    BN_clear_free(e);
+    BN_free(b), BN_free(m), BN_free(r), BN_CTX_free(bc);
+    ERR_clear_error();
+    return out;
+}
+
+/* cryptoGeneratePrime(bits, safe, add | undefined, rem | undefined) → a prime, a Buffer | null
+ * when there is none with those constraints */
+PRIMITIVE(js_crypto_generate_prime) {
+    UNUSED_ARGS;
+    int bits = js_is_number(ARG(0)) ? (int)js_as_number(ARG(0)) : 0;
+    BIGNUM *add = js_is_undefined(ARG(2)) ? NULL : bn_arg(ARG(2)), *rem = js_is_undefined(ARG(3)) ? NULL : bn_arg(ARG(3));
+    BIGNUM *p = BN_new();
+    JSValue out = JS_NULL;
+    if (p && BN_generate_prime_ex(p, bits, js_truthy(ARG(1)), add, rem, NULL)) out = bn_buffer(ctx, p, 0);
+    BN_free(p), BN_free(add), BN_free(rem);
+    ERR_clear_error();
+    return out;
+}
+
+/* cryptoCheckPrime(candidate, checks) → whether it is (probably) prime: `checks` Miller-Rabin rounds,
+ * or 0 for the number OpenSSL chooses */
+PRIMITIVE(js_crypto_check_prime) {
+    UNUSED_ARGS;
+    BIGNUM *c = bn_arg(ARG(0));
+    BN_CTX *bc = BN_CTX_new();
+    int checks = js_is_number(ARG(1)) ? (int)js_as_number(ARG(1)) : 0;
+    int prime = 0;
+    if (c && bc && !BN_primality_test(&prime, c, checks ? checks : BN_prime_checks_for_generation, bc, 0, NULL)) prime = 0;
+    BN_free(c), BN_CTX_free(bc);
+    ERR_clear_error();
+    return js_bool(prime);
+}

package/runtime/src/crypto_cipher.c

@@ -1,12 +1,16 @@
 /* The crypto primitives' ciphers (ADR 0018): one streaming context for every cipher node:crypto
- * offers on BearSSL (AES in ECB, CBC, CFB, CFB1, CFB8, OFB, CTR, GCM, CCM and key wrap; 2- and
- * 3-key DES-EDE; ChaCha20 and ChaCha20-Poly1305), with OpenSSL's padding, chunking and checks.
- * Web Crypto's AES runs on it too. BearSSL gives the block functions (through its CBC classes,
- * the fastest implementation the CPU has: AES-NI, else constant-time 64-bit), GCM, CCM, ChaCha20
- * and Poly1305; the modes BearSSL lacks (CFB, OFB, a 128-bit CTR, key wrap) are ours. */
+ * offers (AES in ECB, CBC, CFB, CFB1, CFB8, OFB, CTR, GCM, CCM and key wrap; 2- and 3-key
+ * DES-EDE; ChaCha20 and ChaCha20-Poly1305), with OpenSSL's padding, chunking and checks. Web
+ * Crypto's AES runs on it too. BoringSSL gives the block functions (the fastest the CPU has:
+ * AES-NI, ARMv8, else constant-time), GCM, ChaCha20 and Poly1305; the modes over a block (CBC,
+ * CFB, OFB, a 128-bit CTR, key wrap, CCM) are ours. */
 #include <stdlib.h>
 #include <string.h>
 
+#include <openssl/chacha.h>
+#include <openssl/cipher.h>
+#include <openssl/poly1305.h>
+
 #include "crypto_internal.h"
 #include "js_builtins.h"
 #include "js_exception.h"
@@ -115,35 +119,32 @@ const JSCipherAlg *js_cipher_aes(uint8_t mode, size_t key_len) {
 
 /* ---- Block functions ----------------------------------------------------------------------------- */
 
-static const br_block_cbcenc_class *aes_enc_class(void) {
-    const br_block_cbcenc_class *c = br_aes_x86ni_cbcenc_get_vtable();
-    return c ? c : &br_aes_ct64_cbcenc_vtable;
-}
-static const br_block_cbcdec_class *aes_dec_class(void) {
-    const br_block_cbcdec_class *c = br_aes_x86ni_cbcdec_get_vtable();
-    return c ? c : &br_aes_ct64_cbcdec_vtable;
+/* One block encrypted (decrypted) in place: AES's, or 3DES's (blk 8). */
+static void block_enc(JSCipherCtx *c, uint8_t *b) {
+    if (c->blk == 8) DES_ecb3_encrypt((const DES_cblock *)b, (DES_cblock *)b, &c->des[0], &c->des[1], &c->des[2], DES_ENCRYPT);
+    else AES_encrypt(b, b, &c->aes_enc);
 }
-static const br_block_ctr_class *aes_ctr_class(void) {
-    const br_block_ctr_class *c = br_aes_x86ni_ctr_get_vtable();
-    return c ? c : &br_aes_ct64_ctr_vtable;
+static void block_dec(JSCipherCtx *c, uint8_t *b) {
+    if (c->blk == 8) DES_ecb3_encrypt((const DES_cblock *)b, (DES_cblock *)b, &c->des[0], &c->des[1], &c->des[2], DES_DECRYPT);
+    else AES_decrypt(b, b, &c->aes_dec);
 }
-static const br_block_ctrcbc_class *aes_ctrcbc_class(void) {
-    const br_block_ctrcbc_class *c = br_aes_x86ni_ctrcbc_get_vtable();
-    return c ? c : &br_aes_ct64_ctrcbc_vtable;
+
+/* CBC over one block, in place, chaining through c->iv */
+static void cbc_enc(JSCipherCtx *c, uint8_t *b) {
+    for (size_t i = 0; i < c->blk; i++) b[i] ^= c->iv[i];
+    block_enc(c, b);
+    memcpy(c->iv, b, c->blk);
 }
-static br_ghash ghash_impl(void) {
-    br_ghash g = br_ghash_pclmul_get();
-    return g ? g : br_ghash_ctmul64;
+static void cbc_dec(JSCipherCtx *c, uint8_t *b) {
+    uint8_t in[16];
+    memcpy(in, b, c->blk);
+    block_dec(c, b);
+    for (size_t i = 0; i < c->blk; i++) b[i] ^= c->iv[i];
+    memcpy(c->iv, in, c->blk);
 }
 
-/* One block encrypted (decrypted) in place: CBC with a zero IV over one block. */
-static void block_enc(JSCipherCtx *c, uint8_t *b) {
-    uint8_t iv[16] = { 0 };
-    c->enc.vtable->run(&c->enc.vtable, iv, b, c->blk);
-}
-static void block_dec(JSCipherCtx *c, uint8_t *b) {
-    uint8_t iv[16] = { 0 };
-    c->dec.vtable->run(&c->dec.vtable, iv, b, c->blk);
+static const EVP_CIPHER *gcm_cipher(size_t key_len) {
+    return key_len == 16 ? EVP_aes_128_gcm() : key_len == 24 ? EVP_aes_192_gcm() : EVP_aes_256_gcm();
 }
 
 /* ---- Output buffer ------------------------------------------------------------------------------- */
@@ -191,7 +192,7 @@ int js_cipher_init(JSCipherCtx *c, const JSCipherAlg *alg, bool encrypt, const u
         if (!has_iv || iv_len != alg->iv_len) return JS_CIPHER_ERR_IV;
         break;
     }
-    if (alg->mode != JS_CIPHER_GCM) {  /* GCM takes any length, straight into br_gcm_reset */
+    if (alg->mode != JS_CIPHER_GCM) {  /* GCM takes any length, straight into BoringSSL's */
         if (iv_len > sizeof c->nonce) return JS_CIPHER_ERR_IV;
         if (iv_len) memcpy(c->nonce, iv, iv_len);
         c->nonce_len = iv_len;
@@ -211,24 +212,22 @@ int js_cipher_init(JSCipherCtx *c, const JSCipherAlg *alg, bool encrypt, const u
     }
     memcpy(c->key, key, key_len);
     if (alg->prim == 0) {
-        const br_block_cbcenc_class *e = aes_enc_class();
-        e->init(&c->enc.vtable, key, key_len);
-        const br_block_cbcdec_class *d = aes_dec_class();
-        d->init(&c->dec.vtable, key, key_len);
-    } else if (alg->prim == 1) {
-        br_des_ct_cbcenc_vtable.init(&c->enc.vtable, key, key_len);
-        br_des_ct_cbcdec_vtable.init(&c->dec.vtable, key, key_len);
+        AES_set_encrypt_key(key, (unsigned)key_len * 8, &c->aes_enc);
+        AES_set_decrypt_key(key, (unsigned)key_len * 8, &c->aes_dec);
+    } else if (alg->prim == 1) {  /* DES-EDE: K1, K2, K1; DES-EDE3: K1, K2, K3 */
+        DES_set_key_unchecked((const DES_cblock *)key, &c->des[0]);
+        DES_set_key_unchecked((const DES_cblock *)(key + 8), &c->des[1]);
+        DES_set_key_unchecked((const DES_cblock *)(key + (key_len == 24 ? 16 : 0)), &c->des[2]);
     }
     if (iv_len && alg->mode != JS_CIPHER_GCM && alg->mode != JS_CIPHER_CCM) memcpy(c->iv, iv, iv_len < 16 ? iv_len : 16);
     switch (alg->mode) {
     case JS_CIPHER_GCM:
-        aes_ctr_class()->init(&c->ctr.vtable, key, key_len);
-        br_gcm_init(&c->gcm, &c->ctr.vtable, ghash_impl());
-        br_gcm_reset(&c->gcm, iv, iv_len);
-        break;
-    case JS_CIPHER_CCM:
-        aes_ctrcbc_class()->init(&c->ctrcbc.vtable, key, key_len);
-        br_ccm_init(&c->ccm, &c->ctrcbc.vtable);
+        c->gcm = EVP_CIPHER_CTX_new();
+        if (!c->gcm) js_fatal("out of memory in crypto");
+        if (!EVP_CipherInit_ex(c->gcm, gcm_cipher(key_len), NULL, NULL, NULL, encrypt) ||
+            !EVP_CIPHER_CTX_ctrl(c->gcm, EVP_CTRL_GCM_SET_IVLEN, (int)iv_len, NULL) ||
+            !EVP_CipherInit_ex(c->gcm, NULL, NULL, key, iv, -1))
+            return JS_CIPHER_ERR_IV;
         break;
     case JS_CIPHER_CHACHA20:
         c->counter = (uint32_t)iv[0] | (uint32_t)iv[1] << 8 | (uint32_t)iv[2] << 16 | (uint32_t)iv[3] << 24;
@@ -247,6 +246,8 @@ int js_cipher_init(JSCipherCtx *c, const JSCipherAlg *alg, bool encrypt, const u
 }
 
 void js_cipher_free(JSCipherCtx *c) {
+    EVP_CIPHER_CTX_free(c->gcm);
+    c->gcm = NULL;
     free(c->aad.p);
     free(c->data.p);
     memset(c->key, 0, sizeof c->key);
@@ -255,9 +256,10 @@ void js_cipher_free(JSCipherCtx *c) {
 
 /* ---- Streams of keystream ----------------------------------------------------------------------- */
 
+static const uint8_t ZEROS[64];
+
 static void chacha_block(JSCipherCtx *c) {
-    memset(c->ks, 0, 64);
-    br_chacha20_ct_run(c->key, c->nonce, c->counter++, c->ks, 64);
+    CRYPTO_chacha_20(c->ks, ZEROS, 64, c->key, c->nonce, c->counter++);
     c->ks_pos = 0;
 }
 
@@ -286,9 +288,9 @@ static void blocks_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut
             if (c->encrypt) block_enc(c, b);
             else block_dec(c, b);
         } else if (c->encrypt) {
-            c->enc.vtable->run(&c->enc.vtable, c->iv, b, blk);
+            cbc_enc(c, b);
         } else {
-            c->dec.vtable->run(&c->dec.vtable, c->iv, b, blk);
+            cbc_dec(c, b);
         }
         out_put(out, b, blk);
         c->buf_len = 0;
@@ -444,30 +446,104 @@ static int unwrap(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
     return err;
 }
 
+/* CCM (NIST SP 800-38C) over the AES block: the counter block for i */
+static void ccm_counter(const JSCipherCtx *c, uint64_t i, uint8_t *a) {
+    size_t L = 15 - c->nonce_len;
+    memset(a, 0, 16);
+    a[0] = (uint8_t)(L - 1);
+    memcpy(a + 1, c->nonce, c->nonce_len);
+    for (size_t k = 0; k < L && k < 8; k++) a[15 - k] = (uint8_t)(i >> (8 * k));
+}
+
+/* CBC-MAC over B0, the AAD (its length encoded first) and the payload, each padded with zeros */
+static void ccm_mac(JSCipherCtx *c, const uint8_t *p, size_t n, uint8_t *x) {
+    size_t L = 15 - c->nonce_len, at = 0;
+    memset(x, 0, 16);
+    x[0] = (uint8_t)((c->aad.n ? 0x40 : 0) | ((c->tag_len - 2) / 2) << 3 | (L - 1));
+    memcpy(x + 1, c->nonce, c->nonce_len);
+    for (size_t k = 0; k < L && k < 8; k++) x[15 - k] = (uint8_t)((uint64_t)n >> (8 * k));
+    block_enc(c, x);
+    if (c->aad.n) {
+        uint8_t head[10];
+        size_t hn;
+        uint64_t a = c->aad.n;
+        if (a < 0xFF00) head[0] = (uint8_t)(a >> 8), head[1] = (uint8_t)a, hn = 2;
+        else if (a <= 0xFFFFFFFFu) {
+            head[0] = 0xFF, head[1] = 0xFE, hn = 6;
+            for (int k = 0; k < 4; k++) head[2 + k] = (uint8_t)(a >> (24 - 8 * k));
+        } else {
+            head[0] = 0xFF, head[1] = 0xFF, hn = 10;
+            for (int k = 0; k < 8; k++) head[2 + k] = (uint8_t)(a >> (56 - 8 * k));
+        }
+        for (size_t k = 0; k < hn; k++) {
+            x[at++] ^= head[k];
+            if (at == 16) block_enc(c, x), at = 0;
+        }
+        for (size_t k = 0; k < c->aad.n; k++) {
+            x[at++] ^= c->aad.p[k];
+            if (at == 16) block_enc(c, x), at = 0;
+        }
+        if (at) block_enc(c, x), at = 0;
+    }
+    for (size_t k = 0; k < n; k++) {
+        x[at++] ^= p[k];
+        if (at == 16) block_enc(c, x), at = 0;
+    }
+    if (at) block_enc(c, x);
+}
+
+static void ccm_ctr(JSCipherCtx *c, const uint8_t *in, uint8_t *out, size_t n) {
+    uint8_t a[16];
+    for (size_t k = 0; k < n; k += 16) {
+        ccm_counter(c, k / 16 + 1, a);
+        block_enc(c, a);
+        for (size_t j = 0; j < 16 && k + j < n; j++) out[k + j] = in[k + j] ^ a[j];
+    }
+}
+
 /* The CCM run, done at its one update: the lengths are known only now. */
 static int ccm_run(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
     size_t L = 15 - c->nonce_len;
     if (L < 8 && n >= (1ULL << (8 * L))) return JS_CIPHER_ERR_MESSAGE_LENGTH;
     if (c->ccm_length_set && n != c->ccm_length) return JS_CIPHER_ERR_STATE;
-    if (!br_ccm_reset(&c->ccm, c->nonce, c->nonce_len, c->aad.n, n, c->tag_len)) return JS_CIPHER_ERR_STATE;
-    br_ccm_aad_inject(&c->ccm, c->aad.p, c->aad.n);
-    br_ccm_flip(&c->ccm);
     uint8_t *d = malloc(n ? n : 1);
     if (!d) js_fatal("out of memory in crypto");
-    if (n) memcpy(d, p, n);
-    br_ccm_run(&c->ccm, c->encrypt, d, n);
+    uint8_t x[16], s0[16];
+    ccm_counter(c, 0, s0);
+    block_enc(c, s0);
     if (c->encrypt) {
-        br_ccm_get_tag(&c->ccm, c->tag);
-        out_put(out, d, n);
-    } else if (c->tag_set && br_ccm_check_tag(&c->ccm, c->tag)) {
+        ccm_mac(c, p, n, x);
+        ccm_ctr(c, p, d, n);
+        for (size_t k = 0; k < c->tag_len; k++) c->tag[k] = x[k] ^ s0[k];
         out_put(out, d, n);
     } else {
-        c->auth_failed = true;  /* the output is nothing; final reports it */
+        ccm_ctr(c, p, d, n);
+        ccm_mac(c, d, n, x);
+        for (size_t k = 0; k < c->tag_len; k++) x[k] ^= s0[k];
+        if (c->tag_set && js_crypto_equal(x, c->tag, c->tag_len)) out_put(out, d, n);
+        else c->auth_failed = true;  /* the output is nothing; final reports it */
     }
+    memset(d, 0, n);
     free(d);
     return 0;
 }
 
+/* ChaCha20-Poly1305's tag (RFC 8439): Poly1305, keyed by block 0, over the AAD and ciphertext */
+static void chapoly_tag(JSCipherCtx *c, uint8_t tag[16]) {
+    uint8_t otk[32], lens[16];
+    CRYPTO_chacha_20(otk, ZEROS, 32, c->key, c->nonce, 0);
+    poly1305_state st;
+    CRYPTO_poly1305_init(&st, otk);
+    CRYPTO_poly1305_update(&st, c->aad.p ? c->aad.p : ZEROS, c->aad.n);
+    CRYPTO_poly1305_update(&st, ZEROS, (16 - c->aad.n % 16) % 16);
+    CRYPTO_poly1305_update(&st, c->data.p ? c->data.p : ZEROS, c->data.n);
+    CRYPTO_poly1305_update(&st, ZEROS, (16 - c->data.n % 16) % 16);
+    for (int k = 0; k < 8; k++) lens[k] = (uint8_t)((uint64_t)c->aad.n >> (8 * k)), lens[8 + k] = (uint8_t)((uint64_t)c->data.n >> (8 * k));
+    CRYPTO_poly1305_update(&st, lens, 16);
+    CRYPTO_poly1305_finish(&st, tag);
+    memset(otk, 0, sizeof otk);
+}
+
 int js_cipher_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
     if (c->state == JS_CIPHER_FINAL) return JS_CIPHER_ERR_STATE;
     switch (c->alg->mode) {
@@ -476,11 +552,12 @@ int js_cipher_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out
         blocks_update(c, p, n, out);
         break;
     case JS_CIPHER_GCM:
-        if (c->state == JS_CIPHER_INIT) br_gcm_flip(&c->gcm);
         if (n) {
             size_t start = out->n;
             out_put(out, p, n);
-            br_gcm_run(&c->gcm, c->encrypt, out->p + start, n);
+            int got;
+            if (!EVP_CipherUpdate(c->gcm, out->p + start, &got, p, (int)n)) return JS_CIPHER_ERR_STATE;
+            out->n = start + (size_t)got;
         }
         break;
     case JS_CIPHER_CCM: {
@@ -527,7 +604,7 @@ int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
             memset(b + c->buf_len, pad, pad);
             c->buf_len = 0;
             if (c->alg->mode == JS_CIPHER_ECB) block_enc(c, b);
-            else c->enc.vtable->run(&c->enc.vtable, c->iv, b, blk);
+            else cbc_enc(c, b);
             out_put(out, b, blk);
             return 0;
         }
@@ -535,7 +612,7 @@ int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
         if (c->buf_len != blk) return JS_CIPHER_ERR_FINAL_BLOCK;
         memcpy(b, c->buf, blk);
         if (c->alg->mode == JS_CIPHER_ECB) block_dec(c, b);
-        else c->dec.vtable->run(&c->dec.vtable, c->iv, b, blk);
+        else cbc_dec(c, b);
         uint8_t pad = b[blk - 1];
         if (pad == 0 || pad > blk) return JS_CIPHER_ERR_BAD_DECRYPT;
         for (size_t i = blk - pad; i < blk; i++)
@@ -544,15 +621,18 @@ int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
         return 0;
     }
     case JS_CIPHER_GCM: {
-        if (!updated) br_gcm_flip(&c->gcm);
-        uint8_t tag[16];
-        br_gcm_get_tag(&c->gcm, tag);
+        (void)updated;
+        uint8_t rest[16];
+        int got;
         if (c->encrypt) {
-            memcpy(c->tag, tag, 16);
+            if (!EVP_CipherFinal_ex(c->gcm, rest, &got) || !EVP_CIPHER_CTX_ctrl(c->gcm, EVP_CTRL_GCM_GET_TAG, 16, c->tag))
+                return JS_CIPHER_ERR_STATE;
             c->tag_ready = true;
             return 0;
         }
-        if (!c->tag_set || !js_crypto_equal(tag, c->tag, c->given_tag_len)) return JS_CIPHER_ERR_AUTH;
+        if (!c->tag_set || !EVP_CIPHER_CTX_ctrl(c->gcm, EVP_CTRL_GCM_SET_TAG, (int)c->given_tag_len, c->tag) ||
+            !EVP_CipherFinal_ex(c->gcm, rest, &got))
+            return JS_CIPHER_ERR_AUTH;
         return 0;
     }
     case JS_CIPHER_CCM:
@@ -563,12 +643,8 @@ int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
         }
         return !updated || c->auth_failed ? JS_CIPHER_ERR_AUTH : 0;
     case JS_CIPHER_CHACHA20_POLY1305: {
-        uint8_t tag[16], *copy = malloc(c->data.n ? c->data.n : 1);
-        if (!copy) js_fatal("out of memory in crypto");
-        if (c->data.n) memcpy(copy, c->data.p, c->data.n);
-        br_poly1305_ctmul_run(c->key, c->nonce, copy, c->data.n, c->aad.p ? c->aad.p : (const uint8_t *)"", c->aad.n, tag,
-                              br_chacha20_ct_run, 0);
-        free(copy);
+        uint8_t tag[16];
+        chapoly_tag(c, tag);
         if (c->encrypt) {
             memcpy(c->tag, tag, 16);
             c->tag_ready = true;
@@ -586,10 +662,12 @@ int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
 
 int js_cipher_set_aad(JSCipherCtx *c, const uint8_t *p, size_t n, long plaintext_length) {
     switch (c->alg->mode) {
-    case JS_CIPHER_GCM:
+    case JS_CIPHER_GCM: {
         if (c->state != JS_CIPHER_INIT) return JS_CIPHER_ERR_STATE;
-        br_gcm_aad_inject(&c->gcm, p, n);
+        int got;
+        if (n && !EVP_CipherUpdate(c->gcm, NULL, &got, p, (int)n)) return JS_CIPHER_ERR_STATE;
         return 0;
+    }
     case JS_CIPHER_CCM:
         if (c->state != JS_CIPHER_INIT) return JS_CIPHER_ERR_STATE;
         if (plaintext_length < 0) return JS_CIPHER_ERR_PLAINTEXT_LENGTH;
@@ -647,7 +725,7 @@ bool js_aes_ctr_masked(const uint8_t *key, size_t key_len, const uint8_t counter
     JSCipherCtx c;
     memset(&c, 0, sizeof c);
     c.blk = 16;
-    aes_enc_class()->init(&c.enc.vtable, key, key_len);
+    AES_set_encrypt_key(key, (unsigned)key_len * 8, &c.aes_enc);
     uint8_t ctr[16];
     memcpy(ctr, counter, 16);
     for (size_t i = 0; i < n; i += 16) {

package/runtime/src/crypto_hash.c

@@ -1,9 +1,12 @@
-/* The crypto primitives' hashes, HMAC and random bytes (ADR 0018): BearSSL's MD5, SHA-1 and
- * SHA-2, SHA-512/224 and /256 on BearSSL's SHA-512 with their own IVs, and SHA-3 and SHAKE on
- * a Keccak-f[1600] of our own (BearSSL's is private to its SHAKE). HMAC is generic over them. */
+/* The crypto primitives' hashes, HMAC and random bytes (ADR 0018): BoringSSL's MD5, SHA-1 and
+ * SHA-2, SHA-512/224 and /256 on its SHA-512 with their own IVs, and SHA-3 and SHAKE on a
+ * Keccak-f[1600] of our own (BoringSSL has none to offer). HMAC is generic over them; random
+ * bytes are BoringSSL's. */
 #include <ctype.h>
 #include <string.h>
 
+#include <openssl/rand.h>
+
 #include "crypto_internal.h"
 #include "js_builtins.h"
 #include "js_exception.h"
@@ -78,7 +81,7 @@ static const uint64_t SHA512_256_IV[8] = {
     0x96283EE2A88EFFE3ULL, 0xBE5E1E2553863992ULL, 0x2B0199FC2C85B8AAULL, 0x0EB72DDC81C52CA2ULL,
 };
 
-/* OIDs as BearSSL's PKCS#1 code takes them: the length, then the OID's bytes */
+/* OIDs as the DigestInfo takes them (crypto_asym.c): the length, then the OID's bytes */
 static const unsigned char OID_MD5[] = { 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05 };
 static const unsigned char OID_SHA1[] = { 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A };
 #define NIST_HASH_OID(last) { 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, (last) }
@@ -93,18 +96,45 @@ static const unsigned char OID_SHA3_256[] = NIST_HASH_OID(0x08);
 static const unsigned char OID_SHA3_384[] = NIST_HASH_OID(0x09);
 static const unsigned char OID_SHA3_512[] = NIST_HASH_OID(0x0A);
 
-#define BR(name, web, len, block, cls, oid) { name, web, JS_HASH_BEARSSL, false, len, block, &cls, NULL, 0, oid }
-#define SHA512T(name, len, iv, oid) { name, NULL, JS_HASH_SHA512T, false, len, 128, &br_sha512_vtable, iv, 0, oid }
+/* BoringSSL's hashes over JSHashState */
+#define IMPL(id, ctx, field, init, update, final)                                                                      \
+    static void id##_init(JSHashState *s) { init(&s->field); }                                                          \
+    static void id##_update(JSHashState *s, const void *p, size_t n) { update(&s->field, p, n); }                       \
+    static void id##_final(JSHashState *s, uint8_t *out) { final(out, &s->field); }                                     \
+    static const JSHashImpl id##_impl = { id##_init, id##_update, id##_final };
+IMPL(md5, MD5_CTX, md5, MD5_Init, MD5_Update, MD5_Final)
+IMPL(sha1, SHA_CTX, sha1, SHA1_Init, SHA1_Update, SHA1_Final)
+IMPL(sha224, SHA256_CTX, sha256, SHA224_Init, SHA224_Update, SHA224_Final)
+IMPL(sha256, SHA256_CTX, sha256, SHA256_Init, SHA256_Update, SHA256_Final)
+IMPL(sha384, SHA512_CTX, sha512, SHA384_Init, SHA384_Update, SHA384_Final)
+IMPL(sha512, SHA512_CTX, sha512, SHA512_Init, SHA512_Update, SHA512_Final)
+
+static void md5sha1_init(JSHashState *s) {
+    MD5_Init(&s->md5sha1.md5);
+    SHA1_Init(&s->md5sha1.sha1);
+}
+static void md5sha1_update(JSHashState *s, const void *p, size_t n) {
+    MD5_Update(&s->md5sha1.md5, p, n);
+    SHA1_Update(&s->md5sha1.sha1, p, n);
+}
+static void md5sha1_final(JSHashState *s, uint8_t *out) {
+    MD5_Final(out, &s->md5sha1.md5);
+    SHA1_Final(out + 16, &s->md5sha1.sha1);
+}
+static const JSHashImpl md5sha1_impl = { md5sha1_init, md5sha1_update, md5sha1_final };
+
+#define BSSL(name, web, len, block, impl, oid) { name, web, JS_HASH_BORINGSSL, false, len, block, &impl, NULL, 0, oid }
+#define SHA512T(name, len, iv, oid) { name, NULL, JS_HASH_SHA512T, false, len, 128, &sha512_impl, iv, 0, oid }
 #define KECCAK(name, xof, len, rate, suffix, oid) { name, NULL, JS_HASH_KECCAK, xof, len, rate, NULL, NULL, suffix, oid }
 
 static const JSHashAlg ALGS[] = {
-    BR("md5", NULL, 16, 64, br_md5_vtable, OID_MD5),
-    BR("sha1", "SHA-1", 20, 64, br_sha1_vtable, OID_SHA1),
-    BR("sha224", NULL, 28, 64, br_sha224_vtable, OID_SHA224),
-    BR("sha256", "SHA-256", 32, 64, br_sha256_vtable, OID_SHA256),
-    BR("sha384", "SHA-384", 48, 128, br_sha384_vtable, OID_SHA384),
-    BR("sha512", "SHA-512", 64, 128, br_sha512_vtable, OID_SHA512),
-    BR("md5-sha1", NULL, 36, 64, br_md5sha1_vtable, NULL),
+    BSSL("md5", NULL, 16, 64, md5_impl, OID_MD5),
+    BSSL("sha1", "SHA-1", 20, 64, sha1_impl, OID_SHA1),
+    BSSL("sha224", NULL, 28, 64, sha224_impl, OID_SHA224),
+    BSSL("sha256", "SHA-256", 32, 64, sha256_impl, OID_SHA256),
+    BSSL("sha384", "SHA-384", 48, 128, sha384_impl, OID_SHA384),
+    BSSL("sha512", "SHA-512", 64, 128, sha512_impl, OID_SHA512),
+    BSSL("md5-sha1", NULL, 36, 64, md5sha1_impl, NULL),
     SHA512T("sha512-224", 28, SHA512_224_IV, OID_SHA512_224),
     SHA512T("sha512-256", 32, SHA512_256_IV, OID_SHA512_256),
     KECCAK("sha3-224", false, 28, 144, 0x06, OID_SHA3_224),
@@ -115,29 +145,29 @@ static const JSHashAlg ALGS[] = {
     KECCAK("shake256", true, 32, 136, 0x1F, NULL),
 };
 
-enum { MD5, SHA1, SHA224, SHA256, SHA384, SHA512, MD5SHA1, SHA512_224, SHA512_256, SHA3_224, SHA3_256, SHA3_384, SHA3_512, SHAKE128, SHAKE256 };
+enum { H_MD5, H_SHA1, H_SHA224, H_SHA256, H_SHA384, H_SHA512, H_MD5SHA1, H_SHA512_224, H_SHA512_256, H_SHA3_224, H_SHA3_256, H_SHA3_384, H_SHA3_512, H_SHAKE128, H_SHAKE256 };
 
 /* Every name OpenSSL takes for them (its EVP names, its aliases, its fetch names) */
 static const struct { const char *name; uint8_t alg; } NAMES[] = {
-    { "md5", MD5 }, { "rsa-md5", MD5 }, { "md5withrsaencryption", MD5 }, { "ssl3-md5", MD5 },
-    { "sha1", SHA1 }, { "sha-1", SHA1 }, { "rsa-sha1", SHA1 }, { "rsa-sha1-2", SHA1 }, { "sha1withrsaencryption", SHA1 }, { "ssl3-sha1", SHA1 },
-    { "sha224", SHA224 }, { "sha-224", SHA224 }, { "sha2-224", SHA224 }, { "rsa-sha224", SHA224 }, { "sha224withrsaencryption", SHA224 },
-    { "sha256", SHA256 }, { "sha-256", SHA256 }, { "sha2-256", SHA256 }, { "rsa-sha256", SHA256 }, { "sha256withrsaencryption", SHA256 },
-    { "sha384", SHA384 }, { "sha-384", SHA384 }, { "sha2-384", SHA384 }, { "rsa-sha384", SHA384 }, { "sha384withrsaencryption", SHA384 },
-    { "sha512", SHA512 }, { "sha-512", SHA512 }, { "sha2-512", SHA512 }, { "rsa-sha512", SHA512 }, { "sha512withrsaencryption", SHA512 },
-    { "md5-sha1", MD5SHA1 },
-    { "sha512-224", SHA512_224 }, { "sha-512/224", SHA512_224 }, { "sha2-512/224", SHA512_224 },
-    { "rsa-sha512/224", SHA512_224 }, { "sha512-224withrsaencryption", SHA512_224 },
-    { "sha512-256", SHA512_256 }, { "sha-512/256", SHA512_256 }, { "sha2-512/256", SHA512_256 },
-    { "rsa-sha512/256", SHA512_256 }, { "sha512-256withrsaencryption", SHA512_256 },
-    { "sha3-224", SHA3_224 }, { "rsa-sha3-224", SHA3_224 }, { "id-rsassa-pkcs1-v1_5-with-sha3-224", SHA3_224 },
-    { "sha3-256", SHA3_256 }, { "rsa-sha3-256", SHA3_256 }, { "id-rsassa-pkcs1-v1_5-with-sha3-256", SHA3_256 },
-    { "sha3-384", SHA3_384 }, { "rsa-sha3-384", SHA3_384 }, { "id-rsassa-pkcs1-v1_5-with-sha3-384", SHA3_384 },
-    { "sha3-512", SHA3_512 }, { "rsa-sha3-512", SHA3_512 }, { "id-rsassa-pkcs1-v1_5-with-sha3-512", SHA3_512 },
-    { "shake128", SHAKE128 }, { "shake-128", SHAKE128 }, { "shake256", SHAKE256 }, { "shake-256", SHAKE256 },
+    { "md5", H_MD5 }, { "rsa-md5", H_MD5 }, { "md5withrsaencryption", H_MD5 }, { "ssl3-md5", H_MD5 },
+    { "sha1", H_SHA1 }, { "sha-1", H_SHA1 }, { "rsa-sha1", H_SHA1 }, { "rsa-sha1-2", H_SHA1 }, { "sha1withrsaencryption", H_SHA1 }, { "ssl3-sha1", H_SHA1 },
+    { "sha224", H_SHA224 }, { "sha-224", H_SHA224 }, { "sha2-224", H_SHA224 }, { "rsa-sha224", H_SHA224 }, { "sha224withrsaencryption", H_SHA224 },
+    { "sha256", H_SHA256 }, { "sha-256", H_SHA256 }, { "sha2-256", H_SHA256 }, { "rsa-sha256", H_SHA256 }, { "sha256withrsaencryption", H_SHA256 },
+    { "sha384", H_SHA384 }, { "sha-384", H_SHA384 }, { "sha2-384", H_SHA384 }, { "rsa-sha384", H_SHA384 }, { "sha384withrsaencryption", H_SHA384 },
+    { "sha512", H_SHA512 }, { "sha-512", H_SHA512 }, { "sha2-512", H_SHA512 }, { "rsa-sha512", H_SHA512 }, { "sha512withrsaencryption", H_SHA512 },
+    { "md5-sha1", H_MD5SHA1 },
+    { "sha512-224", H_SHA512_224 }, { "sha-512/224", H_SHA512_224 }, { "sha2-512/224", H_SHA512_224 },
+    { "rsa-sha512/224", H_SHA512_224 }, { "sha512-224withrsaencryption", H_SHA512_224 },
+    { "sha512-256", H_SHA512_256 }, { "sha-512/256", H_SHA512_256 }, { "sha2-512/256", H_SHA512_256 },
+    { "rsa-sha512/256", H_SHA512_256 }, { "sha512-256withrsaencryption", H_SHA512_256 },
+    { "sha3-224", H_SHA3_224 }, { "rsa-sha3-224", H_SHA3_224 }, { "id-rsassa-pkcs1-v1_5-with-sha3-224", H_SHA3_224 },
+    { "sha3-256", H_SHA3_256 }, { "rsa-sha3-256", H_SHA3_256 }, { "id-rsassa-pkcs1-v1_5-with-sha3-256", H_SHA3_256 },
+    { "sha3-384", H_SHA3_384 }, { "rsa-sha3-384", H_SHA3_384 }, { "id-rsassa-pkcs1-v1_5-with-sha3-384", H_SHA3_384 },
+    { "sha3-512", H_SHA3_512 }, { "rsa-sha3-512", H_SHA3_512 }, { "id-rsassa-pkcs1-v1_5-with-sha3-512", H_SHA3_512 },
+    { "shake128", H_SHAKE128 }, { "shake-128", H_SHAKE128 }, { "shake256", H_SHAKE256 }, { "shake-256", H_SHAKE256 },
 };
 
-/* crypto.getHashes(): Node's list, less the hashes BearSSL doesn't have (RIPEMD-160, BLAKE2, SM3) */
+/* crypto.getHashes(): Node's list, less the hashes we don't have (RIPEMD-160, BLAKE2, SM3) */
 const char *const js_hash_names[] = {
     "RSA-MD5", "RSA-SHA1", "RSA-SHA1-2", "RSA-SHA224", "RSA-SHA256", "RSA-SHA3-224", "RSA-SHA3-256", "RSA-SHA3-384",
     "RSA-SHA3-512", "RSA-SHA384", "RSA-SHA512", "RSA-SHA512/224", "RSA-SHA512/256",
@@ -171,12 +201,12 @@ const JSHashAlg *js_hash_by_web_name(const char *name) {
 void js_hash_init(JSHashCtx *h, const JSHashAlg *alg) {
     h->alg = alg;
     switch (alg->kind) {
-    case JS_HASH_BEARSSL:
-        alg->br->init(&h->u.br.vtable);
+    case JS_HASH_BORINGSSL:
+        alg->impl->init(&h->u.hash);
         break;
     case JS_HASH_SHA512T:
-        br_sha512_init(&h->u.br.sha512);
-        memcpy(h->u.br.sha512.val, alg->iv, sizeof h->u.br.sha512.val);
+        SHA512_Init(&h->u.hash.sha512);
+        memcpy(h->u.hash.sha512.h, alg->iv, sizeof h->u.hash.sha512.h);
         break;
     case JS_HASH_KECCAK:
         memset(&h->u.keccak, 0, sizeof h->u.keccak);
@@ -188,7 +218,7 @@ void js_hash_init(JSHashCtx *h, const JSHashAlg *alg) {
 void js_hash_update(JSHashCtx *h, const void *data, size_t n) {
     if (!n) return;
     if (h->alg->kind == JS_HASH_KECCAK) keccak_absorb(&h->u.keccak, data, n);
-    else h->u.br.vtable->update(&h->u.br.vtable, data, n);
+    else h->alg->impl->update(&h->u.hash, data, n);
 }
 
 void js_hash_final(JSHashCtx *h, uint8_t *out, size_t n) {
@@ -197,7 +227,7 @@ void js_hash_final(JSHashCtx *h, uint8_t *out, size_t n) {
         return;
     }
     uint8_t full[64];
-    h->u.br.vtable->out(&h->u.br.vtable, full);
+    h->alg->impl->final(&h->u.hash, full);
     memcpy(out, full, n);
 }
 
@@ -234,23 +264,8 @@ void js_hmac_final(JSHmacCtx *m, uint8_t *out) {
 
 /* ---- Random bytes ------------------------------------------------------------------------------- */
 
-static br_hmac_drbg_context drbg;
-static bool drbg_seeded;
-
-const br_prng_class **js_crypto_prng(void) {
-    uint8_t none;
-    js_crypto_random(&none, 0);  /* seeded */
-    return &drbg.vtable;
-}
-
 void js_crypto_random(void *out, size_t n) {
-    if (!drbg_seeded) {
-        br_hmac_drbg_init(&drbg, &br_sha256_vtable, NULL, 0);
-        br_prng_seeder seeder = br_prng_seeder_system(NULL);
-        if (!seeder || !seeder(&drbg.vtable)) js_fatal("no system entropy source for crypto");
-        drbg_seeded = true;
-    }
-    br_hmac_drbg_generate(&drbg, out, n);
+    if (n) RAND_bytes(out, n);
 }
 
 bool js_crypto_equal(const uint8_t *a, const uint8_t *b, size_t n) {