crypto/evp/evp_kem.cc

// Copyright 2026 The BoringSSL Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <openssl/evp.h>

#include <stddef.h>
#include <stdint.h>

#include <openssl/err.h>

#include "../internal.h"
#include "internal.h"

using namespace bssl;

// Checks whether KEM function invocation is valid.
// `ciphertext_len` may be nullptr if it is not required to match.
// `secret_len` must always match.
static bool check_kem_invocation(const EVP_KEM *kem,
                                 const size_t *ciphertext_len,
                                 size_t secret_len,
                                 const bssl::EvpPkey *pkey_impl) {
  if (pkey_impl == nullptr || pkey_impl->pkey == nullptr ||
      pkey_impl->ameth == nullptr) {
    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
    return false;
  }
  if (kem->pkey_id != EVP_PKEY_id(pkey_impl) ||
      (kem->check_key != nullptr && !kem->check_key(kem, pkey_impl))) {
    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
    return false;
  }
  if (ciphertext_len && *ciphertext_len != kem->ciphertext_len) {
    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_CIPHERTEXT_LENGTH);
    return false;
  }
  if (secret_len != kem->secret_len) {
    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_SECRET_LENGTH);
    return false;
  }
  return true;
}

size_t EVP_KEM_ciphertext_len(const EVP_KEM *kem) {
  return kem->ciphertext_len;
}

size_t EVP_KEM_secret_len(const EVP_KEM *kem) { return kem->secret_len; }

size_t EVP_KEM_entropy_len_for_testing(const EVP_KEM *kem) {
  return kem->entropy_len;
}

int EVP_KEM_encap(const EVP_KEM *kem, uint8_t *out_ciphertext,
                  size_t ciphertext_len, uint8_t *out_secret, size_t secret_len,
                  const EVP_PKEY *peer_key) {
  auto *pkey_impl = FromOpaque(peer_key);
  if (!check_kem_invocation(kem, &ciphertext_len, secret_len, pkey_impl)) {
    return 0;
  }
  return kem->encap(kem, Span(out_ciphertext, ciphertext_len),
                    Span(out_secret, secret_len), pkey_impl);
}

int EVP_KEM_encap_external_entropy_for_testing(
    const EVP_KEM *kem, uint8_t *out_ciphertext, size_t ciphertext_len,
    uint8_t *out_secret, size_t secret_len, const EVP_PKEY *peer_key,
    const uint8_t *entropy, size_t entropy_len) {
  auto *pkey_impl = FromOpaque(peer_key);
  if (!check_kem_invocation(kem, &ciphertext_len, secret_len, pkey_impl)) {
    return 0;
  }
  if (entropy_len != kem->entropy_len) {
    OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_ENTROPY_LENGTH);
    return 0;
  }
  return kem->encap_external_entropy(kem, Span(out_ciphertext, ciphertext_len),
                                     Span(out_secret, secret_len), pkey_impl,
                                     Span(entropy, entropy_len));
}

int EVP_KEM_decap(const EVP_KEM *kem, uint8_t *out_secret, size_t secret_len,
                  const uint8_t *ciphertext, size_t ciphertext_len,
                  const EVP_PKEY *key) {
  auto *pkey_impl = FromOpaque(key);
  if (!check_kem_invocation(kem, nullptr, secret_len, pkey_impl)) {
    return 0;
  }
  return kem->decap(kem, Span(out_secret, secret_len),
                    Span(ciphertext, ciphertext_len), pkey_impl);
}