visaljs 0.0.2 → 0.0.4

package/runtime/third_party/boringssl/crypto/cipher/tls_cbc.cc

@@ -0,0 +1,476 @@
+// Copyright 2012-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/digest.h>
+#include <openssl/nid.h>
+#include <openssl/sha.h>
+#include <openssl/span.h>
+
+#include "../fipsmodule/cipher/internal.h"
+#include "../internal.h"
+#include "internal.h"
+
+
+using namespace bssl;
+
+int bssl::EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok,
+                                     size_t *out_len, const uint8_t *in,
+                                     size_t in_len, size_t block_size,
+                                     size_t mac_size) {
+  const size_t overhead = 1 /* padding length byte */ + mac_size;
+
+  // These lengths are all public so we can test them in non-constant time.
+  if (overhead > in_len) {
+    return 0;
+  }
+
+  size_t padding_length = in[in_len - 1];
+
+  crypto_word_t good = constant_time_ge_w(in_len, overhead + padding_length);
+  // The padding consists of a length byte at the end of the record and
+  // then that many bytes of padding, all with the same value as the
+  // length byte. Thus, with the length byte included, there are i+1
+  // bytes of padding.
+  //
+  // We can't check just `padding_length+1` bytes because that leaks
+  // decrypted information. Therefore we always have to check the maximum
+  // amount of padding possible. (Again, the length of the record is
+  // public information so we can use it.)
+  size_t to_check = 256;  // maximum amount of padding, inc length byte.
+  if (to_check > in_len) {
+    to_check = in_len;
+  }
+
+  for (size_t i = 0; i < to_check; i++) {
+    uint8_t mask = constant_time_ge_8(padding_length, i);
+    // The value barrier on `(in_len - 1 - i)` isn't needed to enforce
+    // constant-time. It is just there to prevent a false positive in
+    // constant-time checks by valgrind.
+    uint8_t b = in[value_barrier_w(in_len - 1 - i)];
+    // The final `padding_length+1` bytes should all have the value
+    // `padding_length`. Therefore the XOR should be zero.
+    good &= ~(mask & (padding_length ^ b));
+  }
+
+  // If any of the final `padding_length+1` bytes had the wrong value,
+  // one or more of the lower eight bits of `good` will be cleared.
+  good = constant_time_eq_w(0xff, good & 0xff);
+
+  // Always treat `padding_length` as zero on error. If, assuming block size of
+  // 16, a padding of [<15 arbitrary bytes> 15] treated `padding_length` as 16
+  // and returned -1, distinguishing good MAC and bad padding from bad MAC and
+  // bad padding would give POODLE's padding oracle.
+  padding_length = good & (padding_length + 1);
+  *out_len = in_len - padding_length;
+  *out_padding_ok = good;
+  return 1;
+}
+
+void bssl::EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
+                                size_t in_len, size_t orig_len) {
+  uint8_t rotated_mac1[EVP_MAX_MD_SIZE], rotated_mac2[EVP_MAX_MD_SIZE];
+  uint8_t *rotated_mac = rotated_mac1;
+  uint8_t *rotated_mac_tmp = rotated_mac2;
+
+  // mac_end is the index of `in` just after the end of the MAC.
+  size_t mac_end = in_len;
+  size_t mac_start = mac_end - md_size;
+
+  declassify_assert(orig_len >= in_len);
+  declassify_assert(in_len >= md_size);
+  assert(md_size <= EVP_MAX_MD_SIZE);
+  assert(md_size > 0);
+
+  // scan_start contains the number of bytes that we can ignore because
+  // the MAC's position can only vary by 255 bytes.
+  size_t scan_start = 0;
+  // This information is public so it's safe to branch based on it.
+  if (orig_len > md_size + 255 + 1) {
+    scan_start = orig_len - (md_size + 255 + 1);
+  }
+
+  size_t rotate_offset = 0;
+  uint8_t mac_started = 0;
+  OPENSSL_memset(rotated_mac, 0, md_size);
+  for (size_t i = scan_start, j = 0; i < orig_len; i++, j++) {
+    if (j >= md_size) {
+      j -= md_size;
+    }
+    crypto_word_t is_mac_start = constant_time_eq_w(i, mac_start);
+    mac_started |= is_mac_start;
+    uint8_t mac_ended = constant_time_ge_8(i, mac_end);
+    rotated_mac[j] |= in[i] & mac_started & ~mac_ended;
+    // Save the offset that `mac_start` is mapped to.
+    rotate_offset |= j & is_mac_start;
+  }
+
+  // Now rotate the MAC. We rotate in log(md_size) steps, one for each bit
+  // position.
+  for (size_t offset = 1; offset < md_size; offset <<= 1, rotate_offset >>= 1) {
+    // Rotate by `offset` iff the corresponding bit is set in
+    // `rotate_offset`, placing the result in `rotated_mac_tmp`.
+    const uint8_t skip_rotate = (rotate_offset & 1) - 1;
+    for (size_t i = 0, j = offset; i < md_size; i++, j++) {
+      if (j >= md_size) {
+        j -= md_size;
+      }
+      rotated_mac_tmp[i] =
+          constant_time_select_8(skip_rotate, rotated_mac[i], rotated_mac[j]);
+    }
+
+    // Swap pointers so `rotated_mac` contains the (possibly) rotated value.
+    // Note the number of iterations and thus the identity of these pointers is
+    // public information.
+    uint8_t *tmp = rotated_mac;
+    rotated_mac = rotated_mac_tmp;
+    rotated_mac_tmp = tmp;
+  }
+
+  OPENSSL_memcpy(out, rotated_mac, md_size);
+}
+
+int bssl::EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
+                                            uint8_t out[SHA_DIGEST_LENGTH],
+                                            const uint8_t *in, size_t len,
+                                            size_t max_len) {
+  // Bound the input length so `total_bits` below fits in four bytes. This is
+  // redundant with TLS record size limits. This also ensures `input_idx` below
+  // does not overflow.
+  size_t max_len_bits = max_len << 3;
+  if (ctx->Nh != 0 ||
+      (max_len_bits >> 3) != max_len ||  // Overflow
+      ctx->Nl + max_len_bits < max_len_bits ||
+      ctx->Nl + max_len_bits > UINT32_MAX) {
+    return 0;
+  }
+
+  // We need to hash the following into `ctx`:
+  //
+  // - ctx->data[:ctx->num]
+  // - in[:len]
+  // - A 0x80 byte
+  // - However many zero bytes are needed to pad up to a block.
+  // - Eight bytes of length.
+  size_t num_blocks = (ctx->num + len + 1 + 8 + SHA_CBLOCK - 1) >> 6;
+  size_t last_block = num_blocks - 1;
+  size_t max_blocks = (ctx->num + max_len + 1 + 8 + SHA_CBLOCK - 1) >> 6;
+
+  // The bounds above imply `total_bits` fits in four bytes.
+  size_t total_bits = ctx->Nl + (len << 3);
+  uint8_t length_bytes[4];
+  CRYPTO_store_u32_be(length_bytes, total_bits);
+
+  // We now construct and process each expected block in constant-time.
+  uint8_t block[SHA_CBLOCK] = {0};
+  uint32_t result[5] = {0};
+  // input_idx is the index into `in` corresponding to the current block.
+  // However, we allow this index to overflow beyond `max_len`, to simplify the
+  // 0x80 byte.
+  size_t input_idx = 0;
+  for (size_t i = 0; i < max_blocks; i++) {
+    // Fill `block` with data from the partial block in `ctx` and `in`. We copy
+    // as if we were hashing up to `max_len` and then zero the excess later.
+    size_t block_start = 0;
+    if (i == 0) {
+      OPENSSL_memcpy(block, ctx->data, ctx->num);
+      block_start = ctx->num;
+    }
+    if (input_idx < max_len) {
+      size_t to_copy = SHA_CBLOCK - block_start;
+      if (to_copy > max_len - input_idx) {
+        to_copy = max_len - input_idx;
+      }
+      OPENSSL_memcpy(block + block_start, in + input_idx, to_copy);
+    }
+
+    // Zero any bytes beyond `len` and add the 0x80 byte.
+    for (size_t j = block_start; j < SHA_CBLOCK; j++) {
+      // input[idx] corresponds to block[j].
+      size_t idx = input_idx + j - block_start;
+      // The barriers on `len` are not strictly necessary. However, without
+      // them, GCC compiles this code by incorporating `len` into the loop
+      // counter and subtracting it out later. This is still constant-time, but
+      // it frustrates attempts to validate this.
+      uint8_t is_in_bounds = constant_time_lt_8(idx, value_barrier_w(len));
+      uint8_t is_padding_byte = constant_time_eq_8(idx, value_barrier_w(len));
+      block[j] &= is_in_bounds;
+      block[j] |= 0x80 & is_padding_byte;
+    }
+
+    input_idx += SHA_CBLOCK - block_start;
+
+    // Fill in the length if this is the last block. Use a value barrier to
+    // prevent Clang from compiling the conditional select as a jump.
+    crypto_word_t is_last_block =
+        value_barrier_w(constant_time_eq_w(i, last_block));
+    for (size_t j = 0; j < 4; j++) {
+      block[SHA_CBLOCK - 4 + j] |= is_last_block & length_bytes[j];
+    }
+
+    // Process the block and save the hash state if it is the final value.
+    SHA1_Transform(ctx, block);
+    for (size_t j = 0; j < 5; j++) {
+      result[j] |= is_last_block & ctx->h[j];
+    }
+  }
+
+  // Write the output.
+  for (size_t i = 0; i < 5; i++) {
+    CRYPTO_store_u32_be(out + 4 * i, result[i]);
+  }
+  return 1;
+}
+
+int bssl::EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
+                                              uint8_t out[SHA256_DIGEST_LENGTH],
+                                              const uint8_t *in, size_t len,
+                                              size_t max_len) {
+  // Bound the input length so `total_bits` below fits in four bytes. This is
+  // redundant with TLS record size limits. This also ensures `input_idx` below
+  // does not overflow.
+  size_t max_len_bits = max_len << 3;
+  if (ctx->Nh != 0 ||
+      (max_len_bits >> 3) != max_len ||  // Overflow
+      ctx->Nl + max_len_bits < max_len_bits ||
+      ctx->Nl + max_len_bits > UINT32_MAX) {
+    return 0;
+  }
+
+  // We need to hash the following into `ctx`:
+  //
+  // - ctx->data[:ctx->num]
+  // - in[:len]
+  // - A 0x80 byte
+  // - However many zero bytes are needed to pad up to a block.
+  // - Eight bytes of length.
+  size_t num_blocks = (ctx->num + len + 1 + 8 + SHA256_CBLOCK - 1) >> 6;
+  size_t last_block = num_blocks - 1;
+  size_t max_blocks = (ctx->num + max_len + 1 + 8 + SHA256_CBLOCK - 1) >> 6;
+
+  // The bounds above imply `total_bits` fits in four bytes.
+  size_t total_bits = ctx->Nl + (len << 3);
+  uint8_t length_bytes[4];
+  CRYPTO_store_u32_be(length_bytes, total_bits);
+
+  // We now construct and process each expected block in constant-time.
+  uint8_t block[SHA256_CBLOCK] = {0};
+  uint32_t result[8] = {0};
+  // input_idx is the index into `in` corresponding to the current block.
+  // However, we allow this index to overflow beyond `max_len`, to simplify the
+  // 0x80 byte.
+  size_t input_idx = 0;
+  for (size_t i = 0; i < max_blocks; i++) {
+    // Fill `block` with data from the partial block in `ctx` and `in`. We copy
+    // as if we were hashing up to `max_len` and then zero the excess later.
+    size_t block_start = 0;
+    if (i == 0) {
+      OPENSSL_memcpy(block, ctx->data, ctx->num);
+      block_start = ctx->num;
+    }
+    if (input_idx < max_len) {
+      size_t to_copy = SHA256_CBLOCK - block_start;
+      if (to_copy > max_len - input_idx) {
+        to_copy = max_len - input_idx;
+      }
+      OPENSSL_memcpy(block + block_start, in + input_idx, to_copy);
+    }
+
+    // Zero any bytes beyond `len` and add the 0x80 byte.
+    for (size_t j = block_start; j < SHA256_CBLOCK; j++) {
+      // input[idx] corresponds to block[j].
+      size_t idx = input_idx + j - block_start;
+      // The barriers on `len` are not strictly necessary. However, without
+      // them, GCC compiles this code by incorporating `len` into the loop
+      // counter and subtracting it out later. This is still constant-time, but
+      // it frustrates attempts to validate this.
+      uint8_t is_in_bounds = constant_time_lt_8(idx, value_barrier_w(len));
+      uint8_t is_padding_byte = constant_time_eq_8(idx, value_barrier_w(len));
+      block[j] &= is_in_bounds;
+      block[j] |= 0x80 & is_padding_byte;
+    }
+
+    input_idx += SHA256_CBLOCK - block_start;
+
+    // Fill in the length if this is the last block. Use a value barrier to
+    // prevent Clang from compiling the conditional select as a jump.
+    crypto_word_t is_last_block =
+        value_barrier_w(constant_time_eq_w(i, last_block));
+    for (size_t j = 0; j < 4; j++) {
+      block[SHA256_CBLOCK - 4 + j] |= is_last_block & length_bytes[j];
+    }
+
+    // Process the block and save the hash state if it is the final value.
+    SHA256_Transform(ctx, block);
+    for (size_t j = 0; j < 8; j++) {
+      result[j] |= is_last_block & ctx->h[j];
+    }
+  }
+
+  // Write the output.
+  for (size_t i = 0; i < 8; i++) {
+    CRYPTO_store_u32_be(out + 4 * i, result[i]);
+  }
+  return 1;
+}
+
+int bssl::EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
+  switch (EVP_MD_type(md)) {
+    case NID_sha1:
+    case NID_sha256:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+static int tls_cbc_digest_record_sha1(
+    uint8_t *md_out, size_t *md_out_size, const uint8_t len_header[2],
+    Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
+  if (mac_secret_length > SHA_CBLOCK) {
+    // HMAC pads small keys with zeros and hashes large keys down. This function
+    // should never reach the large key case.
+    assert(0);
+    return 0;
+  }
+
+  // Compute the initial HMAC block.
+  uint8_t hmac_pad[SHA_CBLOCK];
+  OPENSSL_memset(hmac_pad, 0, sizeof(hmac_pad));
+  OPENSSL_memcpy(hmac_pad, mac_secret, mac_secret_length);
+  for (size_t i = 0; i < SHA_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x36;
+  }
+
+  SHA_CTX ctx;
+  SHA1_Init(&ctx);
+  SHA1_Update(&ctx, hmac_pad, SHA_CBLOCK);
+  for (const CRYPTO_IVEC &aadvec : aadvecs) {
+    SHA1_Update(&ctx, aadvec.in, aadvec.len);
+  }
+  SHA1_Update(&ctx, len_header, 2);
+
+  // Hash the public minimum length directly. This reduces the number of blocks
+  // that must be computed in constant-time.
+  for (const CRYPTO_IOVEC &iovec : iovecs_without_trailer) {
+    SHA1_Update(&ctx, iovec.out, iovec.len);
+  }
+
+  // Hash the remaining data without leaking `data_in_trailer_size`.
+  uint8_t mac_out[SHA_DIGEST_LENGTH];
+  if (!EVP_sha1_final_with_secret_suffix(&ctx, mac_out, trailer.data(),
+                                         data_in_trailer_size,
+                                         trailer.size())) {
+    return 0;
+  }
+
+  // Complete the HMAC in the standard manner.
+  SHA1_Init(&ctx);
+  for (size_t i = 0; i < SHA_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x6a;
+  }
+
+  SHA1_Update(&ctx, hmac_pad, SHA_CBLOCK);
+  SHA1_Update(&ctx, mac_out, SHA_DIGEST_LENGTH);
+  SHA1_Final(md_out, &ctx);
+  *md_out_size = SHA_DIGEST_LENGTH;
+  return 1;
+}
+
+static int tls_cbc_digest_record_sha256(
+    uint8_t *md_out, size_t *md_out_size, const uint8_t len_header[2],
+    Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
+  if (mac_secret_length > SHA256_CBLOCK) {
+    // HMAC pads small keys with zeros and hashes large keys down. This function
+    // should never reach the large key case.
+    assert(0);
+    return 0;
+  }
+
+  // Compute the initial HMAC block.
+  uint8_t hmac_pad[SHA256_CBLOCK];
+  OPENSSL_memset(hmac_pad, 0, sizeof(hmac_pad));
+  OPENSSL_memcpy(hmac_pad, mac_secret, mac_secret_length);
+  for (size_t i = 0; i < SHA256_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x36;
+  }
+
+  SHA256_CTX ctx;
+  SHA256_Init(&ctx);
+  SHA256_Update(&ctx, hmac_pad, SHA256_CBLOCK);
+  for (const CRYPTO_IVEC &aadvec : aadvecs) {
+    SHA256_Update(&ctx, aadvec.in, aadvec.len);
+  }
+  SHA256_Update(&ctx, len_header, 2);
+
+  // Hash the public minimum length directly. This reduces the number of blocks
+  // that must be computed in constant-time.
+  for (const CRYPTO_IOVEC &iovec : iovecs_without_trailer) {
+    SHA256_Update(&ctx, iovec.out, iovec.len);
+  }
+
+  // Hash the remaining data without leaking `data_in_trailer_size`.
+  uint8_t mac_out[SHA256_DIGEST_LENGTH];
+  if (!EVP_sha256_final_with_secret_suffix(&ctx, mac_out, trailer.data(),
+                                           data_in_trailer_size,
+                                           trailer.size())) {
+    return 0;
+  }
+
+  // Complete the HMAC in the standard manner.
+  SHA256_Init(&ctx);
+  for (size_t i = 0; i < SHA256_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x6a;
+  }
+
+  SHA256_Update(&ctx, hmac_pad, SHA256_CBLOCK);
+  SHA256_Update(&ctx, mac_out, SHA256_DIGEST_LENGTH);
+  SHA256_Final(md_out, &ctx);
+  *md_out_size = SHA256_DIGEST_LENGTH;
+  return 1;
+}
+
+int bssl::EVP_tls_cbc_digest_record(
+    const EVP_MD *md, uint8_t *md_out, size_t *md_out_size,
+    const uint8_t len_header[2], Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
+  switch (EVP_MD_type(md)) {
+    case NID_sha1:
+      return tls_cbc_digest_record_sha1(  //
+          md_out, md_out_size, len_header, aadvecs, iovecs_without_trailer,
+          trailer, data_in_trailer_size, mac_secret, mac_secret_length);
+
+    case NID_sha256:
+      return tls_cbc_digest_record_sha256(  //
+          md_out, md_out_size, len_header, aadvecs, iovecs_without_trailer,
+          trailer, data_in_trailer_size, mac_secret, mac_secret_length);
+
+    default:
+      // EVP_tls_cbc_record_digest_supported should have been called first to
+      // check that the hash function is supported.
+      assert(0);
+      *md_out_size = 0;
+      return 0;
+  }
+}

package/runtime/third_party/boringssl/crypto/cms/cms.cc

@@ -0,0 +1,178 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/cms.h>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/mem.h>
+#include <openssl/x509.h>
+
+#include "../bytestring/internal.h"
+#include "../internal.h"
+#include "../mem_internal.h"
+#include "../pkcs7/internal.h"
+
+
+using namespace bssl;
+
+// TODO(davidben): Should we move the core PKCS#7 / CMS implementation into
+// crypto/cms instead of crypto/pkcs7? CMS is getting new features while PKCS#7
+// is not.
+OPENSSL_DECLARE_ERROR_REASON(CMS, CERTIFICATE_HAS_NO_KEYID)
+
+DECLARE_OPAQUE_STRUCT(CMS_SignerInfo_st, CMSSignerInfo)
+DECLARE_OPAQUE_STRUCT(CMS_ContentInfo_st, CMSContentInfo)
+
+BSSL_NAMESPACE_BEGIN
+
+class CMSSignerInfo : public CMS_SignerInfo_st {
+ public:
+  UniquePtr<X509> signcert;
+  UniquePtr<EVP_PKEY> pkey;
+  const EVP_MD *md = nullptr;
+  bool use_key_id = false;
+};
+
+class CMSContentInfo : public CMS_ContentInfo_st {
+ public:
+  static constexpr bool kAllowUniquePtr = true;
+  bool has_signer_info = false;
+  CMSSignerInfo signer_info;
+  Array<uint8_t> der;
+};
+
+BSSL_NAMESPACE_END
+
+CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                          BIO *data, uint32_t flags) {
+  // We only support external signatures and do not support embedding
+  // certificates in SignedData.
+  if ((flags & CMS_DETACHED) == 0 || sk_X509_num(certs) != 0) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return nullptr;
+  }
+
+  UniquePtr<CMSContentInfo> cms = MakeUnique<CMSContentInfo>();
+  if (cms == nullptr) {
+    return nullptr;
+  }
+
+  if (pkey != nullptr &&
+      !CMS_add1_signer(cms.get(), signcert, pkey, /*md=*/nullptr, flags)) {
+    return nullptr;
+  }
+
+  // We don't actually use streaming mode, but Linux passes `CMS_STREAM` to
+  // `CMS_sign` and OpenSSL interprets it as an alias for `CMS_PARTIAL` in this
+  // context.
+  if ((flags & (CMS_PARTIAL | CMS_STREAM)) == 0 &&
+      !CMS_final(cms.get(), data, nullptr, flags)) {
+    return nullptr;
+  }
+
+  return cms.release();
+}
+
+void CMS_ContentInfo_free(CMS_ContentInfo *cms) { Delete(FromOpaque(cms)); }
+
+CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert,
+                                EVP_PKEY *pkey, const EVP_MD *md,
+                                uint32_t flags) {
+  auto *impl = FromOpaque(cms);
+  if (  // Already finalized.
+      !impl->der.empty() ||
+      // We only support one signer.
+      impl->has_signer_info ||
+      // We do not support embedding certificates in SignedData.
+      (flags & CMS_NOCERTS) == 0 ||
+      // We do not support attributes in SignedData.
+      (flags & CMS_NOATTR) == 0) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return nullptr;
+  }
+
+  if (signcert == nullptr || pkey == nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_PASSED_NULL_PARAMETER);
+    return nullptr;
+  }
+
+  if (!X509_check_private_key(signcert, pkey)) {
+    OPENSSL_PUT_ERROR(CMS, CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+    return nullptr;
+  }
+
+  // Default to SHA-256.
+  if (md == nullptr) {
+    md = EVP_sha256();
+  }
+
+  // Save information for later.
+  impl->has_signer_info = true;
+  impl->signer_info.signcert = UpRef(signcert);
+  impl->signer_info.pkey = UpRef(pkey);
+  impl->signer_info.md = md;
+  impl->signer_info.use_key_id = (flags & CMS_USE_KEYID) != 0;
+  return &impl->signer_info;
+}
+
+int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, uint32_t flags) {
+  auto *impl = FromOpaque(cms);
+  if (  // Already finalized.
+      !impl->der.empty() ||
+      // Require a SignerInfo. We do not support signature-less SignedDatas.
+      !impl->has_signer_info ||
+      // We only support the straightforward passthrough mode, without S/MIME
+      // translations.
+      (flags & CMS_BINARY) == 0 ||
+      // We do not support `dcont`. It is unclear what it does.
+      dcont != nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 2048) ||
+      !pkcs7_add_external_signature(cbb.get(), impl->signer_info.signcert.get(),
+                                    impl->signer_info.pkey.get(),
+                                    impl->signer_info.md, data,
+                                    impl->signer_info.use_key_id) ||
+      !CBBFinishArray(cbb.get(), &impl->der)) {
+    return 0;
+  }
+
+  return 1;
+}
+
+int i2d_CMS_bio(BIO *out, CMS_ContentInfo *cms) {
+  auto *impl = FromOpaque(cms);
+  if (impl->der.empty()) {
+    // Not yet finalized.
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  return BIO_write_all(out, impl->der.data(), impl->der.size());
+}
+
+int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags) {
+  // We do not support streaming mode.
+  if ((flags & CMS_STREAM) != 0 || in != nullptr) {
+    OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  return i2d_CMS_bio(out, cms);
+}