bssl

Namespaces

```
namespace internal
```

Enumerations

enum class bcm_infallible_t

Name	Value
approved	0
not_approved	1

Enumerated types for return values from bcm functions, both infallible

and fallible functions. Two success values are used to correspond to the

FIPS service indicator. For the moment, the official service indicator

remains the counter, not these values. Once we fully transition to

these return values from bcm we will change that.

Defined at line 40 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../bcm_interface.h

enum class bcm_status_t

Name	Value
approved	0
not_approved	1
failure	2

Defined at line 45 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../bcm_interface.h

enum (unnamed)

Name	Value
OPENSSL_THREAD_LOCAL_ERR	0
OPENSSL_THREAD_LOCAL_RAND	1
OPENSSL_THREAD_LOCAL_FIPS_COUNTERS	2
OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE	3
OPENSSL_THREAD_LOCAL_TEST	4
NUM_OPENSSL_THREAD_LOCALS	5

thread_local_data_t enumerates the types of thread-local data that can be

stored.

Defined at line 713 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

Records

Functions

```
bcm_infallible BCM_rand_bytes (uint8_t * out, size_t out_len)
```
BCM_rand_bytes is the same as the public `RAND_bytes` function, other

than returning a bcm_infallible status indicator.
```
bcm_status BCM_rand_bytes_hwrng (uint8_t * out, size_t len)
```
BCM_rand_bytes_hwrng attempts to fill `out` with `len` bytes of entropy from

the CPU hardware random number generator if one is present.

bcm_status_approved is returned on success, and a failure status is

returned otherwise.

bcm_infallible BCM_rand_bytes_with_additional_data (uint8_t * out, size_t out_len, const uint8_t[32] user_additional_data)

BCM_rand_bytes_with_additional_data samples from the RNG after mixing 32

bytes from `user_additional_data` in.

bcm_infallible BCM_sha1_init (SHA_CTX * sha)

BCM_sha1_init initialises `sha`.

```
bcm_infallible BCM_sha1_transform (SHA_CTX * c, const uint8_t[64] data)
```
SHA1_transform is a low-level function that performs a single, SHA-1

block transformation using the state from `sha` and `SHA_CBLOCK` bytes from

`block`.

bcm_infallible BCM_sha1_update (SHA_CTX * c, const void * data, size_t len)

BCM_sha1_update adds `len` bytes from `data` to `sha`.

```
bcm_infallible BCM_sha1_final (uint8_t[20] out, SHA_CTX * c)
```
BCM_sha1_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA_DIGEST_LENGTH` bytes of space.
```
bcm_infallible BCM_fips_186_2_prf (uint8_t * out, size_t out_len, const uint8_t[20] xkey)
```
BCM_fips_186_2_prf derives `out_len` bytes from `xkey` using the PRF

defined in FIPS 186-2, Appendix 3.1, with change notice 1 applied. The b

parameter is 160 and seed, XKEY, is also 160 bits. The optional XSEED user

input is all zeros.

The PRF generates a sequence of 320-bit numbers. Each number is encoded as a

40-byte string in big-endian and then concatenated to form `out`. If

`out_len` is not a multiple of 40, the result is truncated. This matches the

construction used in Section 7 of RFC 4186 and Section 7 of RFC 4187.

This PRF is based on SHA-1, a weak hash function, and should not be used

in new protocols. It is provided for compatibility with some legacy EAP

methods.
```
bcm_infallible BCM_sha224_init (SHA256_CTX * sha)
```
BCM_sha224_unit initialises `sha`.

Defined at line 29 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha224_update (SHA256_CTX * sha, const void * data, size_t len)
```
BCM_sha224_update adds `len` bytes from `data` to `sha`.

Defined at line 87 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha224_final (uint8_t[28] out, SHA256_CTX * sha)
```
BCM_sha224_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA224_DIGEST_LENGTH` bytes of

space. It aborts on programmer error.

Defined at line 118 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha256_init (SHA256_CTX * sha)
```
BCM_sha256_init initialises `sha`.

Defined at line 43 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha256_update (SHA256_CTX * sha, const void * data, size_t len)
```
BCM_sha256_update adds `len` bytes from `data` to `sha`.

Defined at line 80 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha256_final (uint8_t[32] out, SHA256_CTX * sha)
```
BCM_sha256_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA256_DIGEST_LENGTH` bytes of

space. It aborts on programmer error.

Defined at line 107 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha256_transform (SHA256_CTX * sha, const uint8_t[64] block)
```
BCM_sha256_transform is a low-level function that performs a single, SHA-256

block transformation using the state from `sha` and `SHA256_CBLOCK` bytes

from `block`.

Defined at line 62 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc
```
bcm_infallible BCM_sha256_transform_blocks (uint32_t[8] state, const uint8_t * data, size_t num_blocks)
```
BCM_sha256_transform_blocks is a low-level function that takes `num_blocks` *

`SHA256_CBLOCK` bytes of data and performs SHA-256 transforms on it to update

`state`.

Defined at line 299 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/sha256.cc.inc

bcm_infallible BCM_sha384_init (SHA512_CTX * sha)

BCM_sha384_init initialises `sha`.

bcm_infallible BCM_sha384_update (SHA512_CTX * sha, const void * data, size_t len)

BCM_sha384_update adds `len` bytes from `data` to `sha`.

```
bcm_infallible BCM_sha384_final (uint8_t[48] out, SHA512_CTX * sha)
```
BCM_sha384_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA384_DIGEST_LENGTH` bytes of

space. It may abort on programmer error.

bcm_infallible BCM_sha512_init (SHA512_CTX * sha)

BCM_sha512_init initialises `sha`.

bcm_infallible BCM_sha512_update (SHA512_CTX * sha, const void * data, size_t len)

BCM_sha512_update adds `len` bytes from `data` to `sha`.

```
bcm_infallible BCM_sha512_final (uint8_t[64] out, SHA512_CTX * sha)
```
BCM_sha512_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA512_DIGEST_LENGTH` bytes of

space.
```
bcm_infallible BCM_sha512_transform (SHA512_CTX * sha, const uint8_t[128] block)
```
BCM_sha512_transform is a low-level function that performs a single, SHA-512

block transformation using the state from `sha` and `SHA512_CBLOCK` bytes

from `block`.

bcm_infallible BCM_sha512_256_init (SHA512_CTX * sha)

BCM_sha512_256_init initialises `sha`.

bcm_infallible BCM_sha512_256_update (SHA512_CTX * sha, const void * data, size_t len)

BCM_sha512_256_update adds `len` bytes from `data` to `sha`.

```
bcm_infallible BCM_sha512_256_final (uint8_t[32] out, SHA512_CTX * sha)
```
BCM_sha512_256_final adds the final padding to `sha` and writes the resulting

digest to `out`, which must have at least `SHA512_256_DIGEST_LENGTH` bytes of

space. It may abort on programmer error.

bcm_status BCM_mldsa65_generate_key (uint8_t[1952] out_encoded_public_key, uint8_t[32] out_seed, MLDSA65_private_key * out_private_key)

bcm_status BCM_mldsa65_private_key_from_seed (MLDSA65_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa65_public_from_private (MLDSA65_public_key * out_public_key, const MLDSA65_private_key * private_key)

const MLDSA65_public_key * BCM_mldsa65_public_of_private (const MLDSA65_private_key * private_key)

BCM_mldsa65_public_of_private returns the public half of `private_key`.

bcm_status BCM_mldsa65_check_key_fips (MLDSA65_private_key * private_key)

bcm_status BCM_mldsa65_generate_key_fips (uint8_t[1952] out_encoded_public_key, uint8_t[32] out_seed, MLDSA65_private_key * out_private_key)

bcm_status BCM_mldsa65_private_key_from_seed_fips (MLDSA65_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa65_sign (uint8_t[3309] out_encoded_signature, const MLDSA65_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_mldsa65_verify (const MLDSA65_public_key * public_key, const uint8_t[3309] signature, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

void BCM_mldsa65_prehash_init (MLDSA65_prehash * out_prehash_ctx, const MLDSA65_public_key * public_key, const uint8_t * context, size_t context_len)

void BCM_mldsa65_prehash_update (MLDSA65_prehash * inout_prehash_ctx, const uint8_t * msg, size_t msg_len)

void BCM_mldsa65_prehash_finalize (uint8_t[64] out_msg_rep, MLDSA65_prehash * inout_prehash_ctx)

bcm_status BCM_mldsa65_sign_message_representative (uint8_t[3309] out_encoded_signature, const MLDSA65_private_key * private_key, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa65_verify_message_representative (const MLDSA65_public_key * public_key, const uint8_t[3309] signature, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa65_marshal_public_key (CBB * out, const MLDSA65_public_key * public_key)

bcm_status BCM_mldsa65_parse_public_key (MLDSA65_public_key * public_key, CBS * in)

bcm_status BCM_mldsa65_parse_private_key (MLDSA65_private_key * private_key, CBS * in)

```
bcm_status BCM_mldsa65_generate_key_external_entropy (uint8_t[1952] out_encoded_public_key, MLDSA65_private_key * out_private_key, const uint8_t[32] entropy)
```
BCM_mldsa65_generate_key_external_entropy generates a public/private key pair

using the given seed, writes the encoded public key to

`out_encoded_public_key` and sets `out_private_key` to the private key.

bcm_status BCM_mldsa65_generate_key_external_entropy_fips (uint8_t[1952] out_encoded_public_key, MLDSA65_private_key * out_private_key, const uint8_t[32] entropy)

```
bcm_status BCM_mldsa65_sign_internal (uint8_t[3309] out_encoded_signature, const MLDSA65_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len, const uint8_t[32] randomizer)
```
BCM_mldsa5_sign_internal signs `msg` using `private_key` and writes the

signature to `out_encoded_signature`. The `context_prefix` and `context` are

prefixed to the message, in that order, before signing. The `randomizer`

value can be set to zero bytes in order to make a deterministic signature, or

else filled with entropy for the usual `MLDSA_sign` behavior.

bcm_status BCM_mldsa65_sign_mu_internal (uint8_t[3309] out_encoded_signature, const MLDSA65_private_key * private_key, const uint8_t[64] msg_rep, const uint8_t[32] randomizer)

bcm_status BCM_mldsa65_verify_internal (const MLDSA65_public_key * public_key, const uint8_t[3309] encoded_signature, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len)

BCM_mldsa5_verify_internal verifies that `encoded_signature` is a valid

signature of `msg` by `public_key`. The `context_prefix` and `context` are

prefixed to the message before verification, in that order.

```
bcm_status BCM_mldsa65_marshal_private_key (CBB * out, const MLDSA65_private_key * private_key)
```
BCM_mldsa65_marshal_private_key serializes `private_key` to `out` in the

NIST format for ML-DSA-65 private keys.

int BCM_mldsa65_public_keys_equal (const MLDSA65_public_key * a, const MLDSA65_public_key * b)

BCM_mldsa65_public_keys_equal returns one if `a` and `b` are equal and zero

otherwise.

bcm_status BCM_mldsa87_generate_key (uint8_t[2592] out_encoded_public_key, uint8_t[32] out_seed, MLDSA87_private_key * out_private_key)

bcm_status BCM_mldsa87_private_key_from_seed (MLDSA87_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa87_public_from_private (MLDSA87_public_key * out_public_key, const MLDSA87_private_key * private_key)

const MLDSA87_public_key * BCM_mldsa87_public_of_private (const MLDSA87_private_key * private_key)

BCM_mldsa87_public_of_private returns the public half of `private_key`.

bcm_status BCM_mldsa87_check_key_fips (MLDSA87_private_key * private_key)

bcm_status BCM_mldsa87_generate_key_fips (uint8_t[2592] out_encoded_public_key, uint8_t[32] out_seed, MLDSA87_private_key * out_private_key)

bcm_status BCM_mldsa87_private_key_from_seed_fips (MLDSA87_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa87_sign (uint8_t[4627] out_encoded_signature, const MLDSA87_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_mldsa87_verify (const MLDSA87_public_key * public_key, const uint8_t * signature, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

void BCM_mldsa87_prehash_init (MLDSA87_prehash * out_prehash_ctx, const MLDSA87_public_key * public_key, const uint8_t * context, size_t context_len)

void BCM_mldsa87_prehash_update (MLDSA87_prehash * inout_prehash_ctx, const uint8_t * msg, size_t msg_len)

void BCM_mldsa87_prehash_finalize (uint8_t[64] out_msg_rep, MLDSA87_prehash * inout_prehash_ctx)

bcm_status BCM_mldsa87_sign_message_representative (uint8_t[4627] out_encoded_signature, const MLDSA87_private_key * private_key, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa87_verify_message_representative (const MLDSA87_public_key * public_key, const uint8_t[4627] signature, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa87_marshal_public_key (CBB * out, const MLDSA87_public_key * public_key)

bcm_status BCM_mldsa87_parse_public_key (MLDSA87_public_key * public_key, CBS * in)

bcm_status BCM_mldsa87_parse_private_key (MLDSA87_private_key * private_key, CBS * in)

```
bcm_status BCM_mldsa87_generate_key_external_entropy (uint8_t[2592] out_encoded_public_key, MLDSA87_private_key * out_private_key, const uint8_t[32] entropy)
```
BCM_mldsa87_generate_key_external_entropy generates a public/private key pair

using the given seed, writes the encoded public key to

`out_encoded_public_key` and sets `out_private_key` to the private key.

bcm_status BCM_mldsa87_generate_key_external_entropy_fips (uint8_t[2592] out_encoded_public_key, MLDSA87_private_key * out_private_key, const uint8_t[32] entropy)

```
bcm_status BCM_mldsa87_sign_internal (uint8_t[4627] out_encoded_signature, const MLDSA87_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len, const uint8_t[32] randomizer)
```
BCM_mldsa87_sign_internal signs `msg` using `private_key` and writes the

signature to `out_encoded_signature`. The `context_prefix` and `context` are

prefixed to the message, in that order, before signing. The `randomizer`

value can be set to zero bytes in order to make a deterministic signature, or

else filled with entropy for the usual `MLDSA_sign` behavior.

bcm_status BCM_mldsa87_sign_mu_internal (uint8_t[4627] out_encoded_signature, const MLDSA87_private_key * private_key, const uint8_t[64] msg_rep, const uint8_t[32] randomizer)

bcm_status BCM_mldsa87_verify_internal (const MLDSA87_public_key * public_key, const uint8_t[4627] encoded_signature, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len)

BCM_mldsa87_verify_internal verifies that `encoded_signature` is a valid

signature of `msg` by `public_key`. The `context_prefix` and `context` are

prefixed to the message before verification, in that order.

```
bcm_status BCM_mldsa87_marshal_private_key (CBB * out, const MLDSA87_private_key * private_key)
```
BCM_mldsa87_marshal_private_key serializes `private_key` to `out` in the

NIST format for ML-DSA-87 private keys.

int BCM_mldsa87_public_keys_equal (const MLDSA87_public_key * a, const MLDSA87_public_key * b)

BCM_mldsa87_public_keys_equal returns one if `a` and `b` are equal and zero

otherwise.

bcm_status BCM_mldsa44_generate_key (uint8_t[1312] out_encoded_public_key, uint8_t[32] out_seed, MLDSA44_private_key * out_private_key)

bcm_status BCM_mldsa44_private_key_from_seed (MLDSA44_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa44_public_from_private (MLDSA44_public_key * out_public_key, const MLDSA44_private_key * private_key)

const MLDSA44_public_key * BCM_mldsa44_public_of_private (const MLDSA44_private_key * private_key)

BCM_mldsa44_public_of_private returns the public half of `private_key`.

bcm_status BCM_mldsa44_check_key_fips (MLDSA44_private_key * private_key)

bcm_status BCM_mldsa44_generate_key_fips (uint8_t[1312] out_encoded_public_key, uint8_t[32] out_seed, MLDSA44_private_key * out_private_key)

bcm_status BCM_mldsa44_private_key_from_seed_fips (MLDSA44_private_key * out_private_key, const uint8_t[32] seed)

bcm_status BCM_mldsa44_sign (uint8_t[2420] out_encoded_signature, const MLDSA44_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_mldsa44_verify (const MLDSA44_public_key * public_key, const uint8_t * signature, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

void BCM_mldsa44_prehash_init (MLDSA44_prehash * out_prehash_ctx, const MLDSA44_public_key * public_key, const uint8_t * context, size_t context_len)

void BCM_mldsa44_prehash_update (MLDSA44_prehash * inout_prehash_ctx, const uint8_t * msg, size_t msg_len)

void BCM_mldsa44_prehash_finalize (uint8_t[64] out_msg_rep, MLDSA44_prehash * inout_prehash_ctx)

bcm_status BCM_mldsa44_sign_message_representative (uint8_t[2420] out_encoded_signature, const MLDSA44_private_key * private_key, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa44_verify_message_representative (const MLDSA44_public_key * public_key, const uint8_t[2420] signature, const uint8_t[64] msg_rep)

bcm_status BCM_mldsa44_marshal_public_key (CBB * out, const MLDSA44_public_key * public_key)

bcm_status BCM_mldsa44_parse_public_key (MLDSA44_public_key * public_key, CBS * in)

bcm_status BCM_mldsa44_parse_private_key (MLDSA44_private_key * private_key, CBS * in)

```
bcm_status BCM_mldsa44_generate_key_external_entropy (uint8_t[1312] out_encoded_public_key, MLDSA44_private_key * out_private_key, const uint8_t[32] entropy)
```
BCM_mldsa44_generate_key_external_entropy generates a public/private key pair

using the given seed, writes the encoded public key to

`out_encoded_public_key` and sets `out_private_key` to the private key.

bcm_status BCM_mldsa44_generate_key_external_entropy_fips (uint8_t[1312] out_encoded_public_key, MLDSA44_private_key * out_private_key, const uint8_t[32] entropy)

```
bcm_status BCM_mldsa44_sign_internal (uint8_t[2420] out_encoded_signature, const MLDSA44_private_key * private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len, const uint8_t[32] randomizer)
```
BCM_mldsa44_sign_internal signs `msg` using `private_key` and writes the

signature to `out_encoded_signature`. The `context_prefix` and `context` are

prefixed to the message, in that order, before signing. The `randomizer`

value can be set to zero bytes in order to make a deterministic signature, or

else filled with entropy for the usual `MLDSA_sign` behavior.

bcm_status BCM_mldsa44_sign_mu_internal (uint8_t[2420] out_encoded_signature, const MLDSA44_private_key * private_key, const uint8_t[64] msg_rep, const uint8_t[32] randomizer)

bcm_status BCM_mldsa44_verify_internal (const MLDSA44_public_key * public_key, const uint8_t[2420] encoded_signature, const uint8_t * msg, size_t msg_len, const uint8_t * context_prefix, size_t context_prefix_len, const uint8_t * context, size_t context_len)

BCM_mldsa44_verify_internal verifies that `encoded_signature` is a valid

signature of `msg` by `public_key`. The `context_prefix` and `context` are

prefixed to the message before verification, in that order.

```
bcm_status BCM_mldsa44_marshal_private_key (CBB * out, const MLDSA44_private_key * private_key)
```
BCM_mldsa44_marshal_private_key serializes `private_key` to `out` in the

NIST format for ML-DSA-44 private keys.

int BCM_mldsa44_public_keys_equal (const MLDSA44_public_key * a, const MLDSA44_public_key * b)

BCM_mldsa44_public_keys_equal returns one if `a` and `b` are equal and zero

otherwise.

bcm_infallible BCM_mlkem768_generate_key (uint8_t[1184] out_encoded_public_key, uint8_t[64] optional_out_seed, MLKEM768_private_key * out_private_key)

bcm_status BCM_mlkem768_private_key_from_seed (MLKEM768_private_key * out_private_key, const uint8_t * seed, size_t seed_len)

bcm_status BCM_mlkem768_generate_key_fips (uint8_t[1184] out_encoded_public_key, uint8_t[64] optional_out_seed, MLKEM768_private_key * out_private_key)

bcm_status BCM_mlkem768_check_fips (const MLKEM768_private_key * private_key)

bcm_infallible BCM_mlkem768_public_from_private (MLKEM768_public_key * out_public_key, const MLKEM768_private_key * private_key)

const MLKEM768_public_key * BCM_mlkem768_public_of_private (const MLKEM768_private_key * private_key)

bcm_infallible BCM_mlkem768_encap (uint8_t[1088] out_ciphertext, uint8_t[32] out_shared_secret, const MLKEM768_public_key * public_key)

bcm_status BCM_mlkem768_decap (uint8_t[32] out_shared_secret, const uint8_t * ciphertext, size_t ciphertext_len, const MLKEM768_private_key * private_key)

bcm_status BCM_mlkem768_marshal_public_key (CBB * out, const MLKEM768_public_key * public_key)

int BCM_mlkem768_public_keys_equal (const MLKEM768_public_key * a, const MLKEM768_public_key * b)

BCM_mlkem768_public_keys_equal returns one if `a` and `b` are equal and zero

otherwise.

bcm_status BCM_mlkem768_parse_public_key (MLKEM768_public_key * out_public_key, CBS * in)

```
bcm_status BCM_mlkem768_parse_private_key (MLKEM768_private_key * out_private_key, CBS * in)
```
BCM_mlkem768_parse_private_key parses a private key, in NIST's format for

private keys, from `in` and writes the result to `out_private_key`. It

returns one on success or zero on parse error or if there are trailing bytes

in `in`. This format is verbose and should be avoided. Private keys should be

stored as seeds and parsed using `BCM_mlkem768_private_key_from_seed`.
```
bcm_infallible BCM_mlkem768_generate_key_external_seed (uint8_t[1184] out_encoded_public_key, MLKEM768_private_key * out_private_key, const uint8_t[64] seed)
```
BCM_mlkem768_generate_key_external_seed is a deterministic function to create

a pair of ML-KEM-768 keys, using the supplied seed. The seed needs to be

uniformly random. This function should only be used for tests; regular

callers should use the non-deterministic `BCM_mlkem768_generate_key`

directly.
```
bcm_infallible BCM_mlkem768_encap_external_entropy (uint8_t[1088] out_ciphertext, uint8_t[32] out_shared_secret, const MLKEM768_public_key * public_key, const uint8_t[32] entropy)
```
BCM_mlkem768_encap_external_entropy behaves like `MLKEM768_encap`, but uses

`MLKEM_ENCAP_ENTROPY` bytes of `entropy` for randomization. The decapsulating

side will be able to recover `entropy` in full. This function should only be

used for tests, regular callers should use the non-deterministic

`BCM_mlkem768_encap` directly.
```
bcm_status BCM_mlkem768_marshal_private_key (CBB * out, const MLKEM768_private_key * private_key)
```
BCM_mlkem768_marshal_private_key serializes `private_key` to `out` in the

NIST format for ML-KEM-768 private keys. (Note that one can also save just

the seed value produced by `BCM_mlkem768_generate_key`, which is

significantly smaller.)

bcm_infallible BCM_mlkem1024_generate_key (uint8_t[1568] out_encoded_public_key, uint8_t[64] optional_out_seed, MLKEM1024_private_key * out_private_key)

bcm_status BCM_mlkem1024_generate_key_fips (uint8_t[1568] out_encoded_public_key, uint8_t[64] optional_out_seed, MLKEM1024_private_key * out_private_key)

bcm_status BCM_mlkem1024_check_fips (const MLKEM1024_private_key * private_key)

bcm_status BCM_mlkem1024_private_key_from_seed (MLKEM1024_private_key * out_private_key, const uint8_t * seed, size_t seed_len)

bcm_infallible BCM_mlkem1024_public_from_private (MLKEM1024_public_key * out_public_key, const MLKEM1024_private_key * private_key)

const MLKEM1024_public_key * BCM_mlkem1024_public_of_private (const MLKEM1024_private_key * private_key)

bcm_infallible BCM_mlkem1024_encap (uint8_t[1568] out_ciphertext, uint8_t[32] out_shared_secret, const MLKEM1024_public_key * public_key)

bcm_status BCM_mlkem1024_decap (uint8_t[32] out_shared_secret, const uint8_t * ciphertext, size_t ciphertext_len, const MLKEM1024_private_key * private_key)

bcm_status BCM_mlkem1024_marshal_public_key (CBB * out, const MLKEM1024_public_key * public_key)

int BCM_mlkem1024_public_keys_equal (const MLKEM1024_public_key * a, const MLKEM1024_public_key * b)

BCM_mlkem1024_public_keys_equal returns one if `a` and `b` are equal and zero

otherwise.

bcm_status BCM_mlkem1024_parse_public_key (MLKEM1024_public_key * out_public_key, CBS * in)

```
bcm_status BCM_mlkem1024_parse_private_key (MLKEM1024_private_key * out_private_key, CBS * in)
```
BCM_mlkem1024_parse_private_key parses a private key, in NIST's format for

private keys, from `in` and writes the result to `out_private_key`. It

returns one on success or zero on parse error or if there are trailing bytes

in `in`. This format is verbose and should be avoided. Private keys should be

stored as seeds and parsed using `BCM_mlkem1024_private_key_from_seed`.
```
bcm_infallible BCM_mlkem1024_generate_key_external_seed (uint8_t[1568] out_encoded_public_key, MLKEM1024_private_key * out_private_key, const uint8_t[64] seed)
```
BCM_mlkem1024_generate_key_external_seed is a deterministic function to

create a pair of ML-KEM-1024 keys, using the supplied seed. The seed needs to

be uniformly random. This function should only be used for tests, regular

callers should use the non-deterministic `BCM_mlkem1024_generate_key`

directly.
```
bcm_infallible BCM_mlkem1024_encap_external_entropy (uint8_t[1568] out_ciphertext, uint8_t[32] out_shared_secret, const MLKEM1024_public_key * public_key, const uint8_t[32] entropy)
```
BCM_mlkem1024_encap_external_entropy behaves like `MLKEM1024_encap`, but uses

`MLKEM_ENCAP_ENTROPY` bytes of `entropy` for randomization. The

decapsulating side will be able to recover `entropy` in full. This function

should only be used for tests, regular callers should use the

non-deterministic `BCM_mlkem1024_encap` directly.
```
bcm_status BCM_mlkem1024_marshal_private_key (CBB * out, const MLKEM1024_private_key * private_key)
```
BCM_mlkem1024_marshal_private_key serializes `private_key` to `out` in the

NIST format for ML-KEM-1024 private keys. (Note that one can also save just

the seed value produced by `BCM_mlkem1024_generate_key`, which is

significantly smaller.)
```
bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed (uint8_t[32] out_public_key, uint8_t[64] out_secret_key, const uint8_t[48] seed)
```
BCM_slhdsa_sha2_128s_generate_key_from_seed generates an SLH-DSA-SHA2-128s

key pair from a 48-byte seed and writes the result to `out_public_key` and

`out_secret_key`.

bcm_infallible BCM_slhdsa_shake_256f_generate_key_from_seed (uint8_t[64] out_public_key, uint8_t[128] out_secret_key, const uint8_t[96] seed)

```
bcm_status BCM_slhdsa_sha2_128s_generate_key_from_seed_fips (uint8_t[32] out_public_key, uint8_t[64] out_secret_key, const uint8_t[48] seed)
```
BCM_slhdsa_sha2_128s_generate_key_from_seed_fips does the same thing as

`BCM_slhdsa_sha2_128s_generate_key_from_seed` but implements the required

second check before generating a key by testing for nullptr arguments.

bcm_status BCM_slhdsa_shake_256f_generate_key_from_seed_fips (uint8_t[64] out_public_key, uint8_t[128] out_secret_key, const uint8_t[96] seed)

```
bcm_infallible BCM_slhdsa_sha2_128s_sign_internal (uint8_t[7856] out_signature, const uint8_t[64] secret_key, const uint8_t[2] header, const uint8_t * context, size_t context_len, const uint8_t * msg, size_t msg_len, const uint8_t[16] entropy)
```
BCM_slhdsa_sha2_128s_sign_internal acts like `SLHDSA_SHA2_128S_sign` but

accepts an explicit entropy input, which can be PK.seed (bytes 32..48 of

the private key) to generate deterministic signatures. It also takes the

input message in three parts so that the "internal" version of the signing

function, from section 9.2, can be implemented. The `header` argument may be

NULL to omit it.

bcm_infallible BCM_slhdsa_shake_256f_sign_internal (uint8_t[49856] out_signature, const uint8_t[128] secret_key, const uint8_t[2] header, const uint8_t * context, size_t context_len, const uint8_t * msg, size_t msg_len, const uint8_t[32] entropy)

```
bcm_status BCM_slhdsa_sha2_128s_verify_internal (const uint8_t * signature, size_t signature_len, const uint8_t[32] public_key, const uint8_t[2] header, const uint8_t * context, size_t context_len, const uint8_t * msg, size_t msg_len)
```
BCM_slhdsa_sha2_128s_verify_internal acts like `SLHDSA_SHA2_128S_verify` but

takes the input message in three parts so that the "internal" version of the

verification function, from section 9.3, can be implemented. The `header`

argument may be NULL to omit it.

bcm_status BCM_slhdsa_shake_256f_verify_internal (const uint8_t * signature, size_t signature_len, const uint8_t[64] public_key, const uint8_t[2] header, const uint8_t * context, size_t context_len, const uint8_t * msg, size_t msg_len)

bcm_infallible BCM_slhdsa_sha2_128s_generate_key (uint8_t[32] out_public_key, uint8_t[64] out_private_key)

bcm_infallible BCM_slhdsa_shake_256f_generate_key (uint8_t[64] out_public_key, uint8_t[128] out_private_key)

bcm_status BCM_slhdsa_sha2_128s_generate_key_fips (uint8_t[32] out_public_key, uint8_t[64] out_private_key)

bcm_status BCM_slhdsa_shake_256f_generate_key_fips (uint8_t[64] out_public_key, uint8_t[128] out_private_key)

bcm_infallible BCM_slhdsa_sha2_128s_public_from_private (uint8_t[32] out_public_key, const uint8_t[64] private_key)

bcm_infallible BCM_slhdsa_shake_256f_public_from_private (uint8_t[64] out_public_key, const uint8_t[128] private_key)

bcm_status BCM_slhdsa_sha2_128s_sign (uint8_t[7856] out_signature, const uint8_t[64] private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_shake_256f_sign (uint8_t[49856] out_signature, const uint8_t[128] private_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_sha2_128s_verify (const uint8_t * signature, size_t signature_len, const uint8_t[32] public_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_shake_256f_verify (const uint8_t * signature, size_t signature_len, const uint8_t[64] public_key, const uint8_t * msg, size_t msg_len, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_sha2_128s_prehash_sign (uint8_t[7856] out_signature, const uint8_t[64] private_key, const uint8_t * hashed_msg, size_t hashed_msg_len, int hash_nid, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_shake_256f_prehash_sign (uint8_t[49856] out_signature, const uint8_t[128] private_key, const uint8_t * hashed_msg, size_t hashed_msg_len, int hash_nid, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_sha2_128s_prehash_verify (const uint8_t * signature, size_t signature_len, const uint8_t[32] public_key, const uint8_t * hashed_msg, size_t hashed_msg_len, int hash_nid, const uint8_t * context, size_t context_len)

bcm_status BCM_slhdsa_shake_256f_prehash_verify (const uint8_t * signature, size_t signature_len, const uint8_t[64] public_key, const uint8_t * hashed_msg, size_t hashed_msg_len, int hash_nid, const uint8_t * context, size_t context_len)

```
bcm_infallible BCM_aes_encrypt (const uint8_t * in, uint8_t * out, const AES_KEY * key)
```
BCM_aes_encrypt encrypts a single block from `in` to `out` with `key`. The

`in` and `out` pointers may overlap.
```
bcm_infallible BCM_aes_decrypt (const uint8_t * in, uint8_t * out, const AES_KEY * key)
```
BCM_aes_decrypt decrypts a single block from `in` to `out` with `key`. The

`in` and `out` pointers may overlap.
```
bcm_status BCM_aes_set_encrypt_key (const uint8_t * key, unsigned int bits, AES_KEY * aeskey)
```
BCM_aes_set_encrypt_key configures `aeskey` to encrypt with the `bits`-bit

key, `key`. `key` must point to `bits`/8 bytes. It will return failure if

`bits` is an invalid AES key size.
```
bcm_status BCM_aes_set_decrypt_key (const uint8_t * key, unsigned int bits, AES_KEY * aeskey)
```
BCM_aes_set_decrypt_key configures `aeskey` to decrypt with the `bits`-bit

key, `key`. `key` must point to `bits`/8 bytes. It will return failure if

`bits` is an invalid AES key size.
```
int BORINGSSL_check_test (Span<const uint8_t> expected, Span<const uint8_t> actual, const char * name)
```
BORINGSSL_check_test checks that `expected` and `actual` are equal. It

returns 1 on success and, on failure, it prints an error message that

includes the hexdumps the two values and returns 0.

template <typename F>

Cleanup<F> <deduction guide for Cleanup> (F func)

```
int bcm_success (bcm_status status)
```
Defined at line 53 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../bcm_interface.h
```
bcm_status_t bcm_as_approved_status (int result)
```
Defined at line 57 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../bcm_interface.h
```
bcm_status_t bcm_as_not_approved_status (int result)
```
Defined at line 61 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../bcm_interface.h
```
template <typename Traits>
```
```
void crypto_md32_update (typename Traits::HashContext * ctx, Span<const uint8_t> in)
```
crypto_md32_update hashes `in` to `ctx`.

Defined at line 78 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../digest/md32_common.h
```
void ECDH_verify_service_indicator (const EC_KEY * ec_key)
```
Defined at line 90 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void EVP_Cipher_verify_service_indicator (const EVP_CIPHER_CTX * ctx)
```
Defined at line 93 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void EVP_DigestSign_verify_service_indicator (const EVP_MD_CTX * ctx)
```
Defined at line 96 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void EVP_DigestVerify_verify_service_indicator (const EVP_MD_CTX * ctx)
```
Defined at line 99 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
uint16_t CRYPTO_bswap2 (uint16_t x)
```
Defined at line 807 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t CRYPTO_bswap4 (uint32_t x)
```
Defined at line 809 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_bswap8 (uint64_t x)
```
Defined at line 811 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t FIPS_service_indicator_before_call ()
```
FIPS_service_indicator_before_call and `FIPS_service_indicator_after_call`

both currently return the same local thread counter which is slowly

incremented whenever approved services are called. The

`CALL_SERVICE_AND_CHECK_APPROVED` macro is strongly recommended over calling

these functions directly.

`FIPS_service_indicator_before_call` is intended to be called immediately

before an approved service, while `FIPS_service_indicator_after_call` should

be called immediately after. If the values returned from these two functions

are not equal, this means that the service called in between is deemed to be

approved. If the values are still the same, this means the counter has not

been incremented, and the service called is not approved for FIPS.

In non-FIPS builds, `FIPS_service_indicator_before_call` always returns zero

and `FIPS_service_indicator_after_call` always returns one. Thus calls always

appear to be approved. This is intended to simplify testing.

uint64_t FIPS_service_indicator_after_call ()

```
void CRYPTO_once (CRYPTO_once_t * once, void (*)() init)
```
CRYPTO_once calls `init` exactly once per process. This is thread-safe: if

concurrent threads call `CRYPTO_once` with the same `CRYPTO_once_t` argument

then they will block until `init` completes, but `init` will have only been

called once.

The `once` argument must be a `CRYPTO_once_t` that has been initialised with

the value `CRYPTO_ONCE_INIT`.
```
void CRYPTO_refcount_inc (CRYPTO_refcount_t * count)
```
CRYPTO_refcount_inc atomically increments the value at `*count` unless the

value would overflow. It's safe for multiple threads to concurrently call

this or `CRYPTO_refcount_dec_and_test_zero` on the same

`CRYPTO_refcount_t`.
```
int CRYPTO_refcount_dec_and_test_zero (CRYPTO_refcount_t * count)
```
CRYPTO_refcount_dec_and_test_zero tests the value at `*count`:

if it's zero, it crashes the address space.

if it's the maximum value, it returns zero.

otherwise, it atomically decrements it and returns one iff the resulting

value is zero.

It's safe for multiple threads to concurrently call this or

`CRYPTO_refcount_inc` on the same `CRYPTO_refcount_t`.
```
void * CRYPTO_get_thread_local (thread_local_data_t value)
```
CRYPTO_get_thread_local gets the pointer value that is stored for the

current thread for the given index, or NULL if none has been set.
```
int CRYPTO_set_thread_local (thread_local_data_t index, void * value, thread_local_destructor_t destructor)
```
CRYPTO_set_thread_local sets a pointer value for the current thread at the

given index. This function should only be called once per thread for a given

`index`: rather than update the pointer value itself, update the data that

is pointed to.

The destructor function will be called when a thread exits to free this

thread-local data. All calls to `CRYPTO_set_thread_local` with the same

`index` should have the same `destructor` argument. The destructor may be

called with a NULL argument if a thread that never set a thread-local

pointer for `index`, exits. The destructor may be called concurrently with

different arguments.

This function returns one on success or zero on error. If it returns zero

then `destructor` has been called with `value` already.
```
int CRYPTO_get_ex_new_index_ex (ExDataClass * ex_data_class, long argl, void * argp, CRYPTO_EX_free * free_func)
```
CRYPTO_get_ex_new_index_ex allocates a new index for `ex_data_class`. Each

class of object should provide a wrapper function that uses the correct

`ExDataClass`. It returns the new index on success and -1 on error.
```
void FIPS_service_indicator_update_state ()
```
Service indicator functions are no-ops in non-FIPS builds.

Defined at line 77 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void FIPS_service_indicator_lock_state ()
```
Defined at line 78 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void FIPS_service_indicator_unlock_state ()
```
Defined at line 79 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void AEAD_GCM_verify_service_indicator (const EVP_AEAD_CTX * ctx)
```
Defined at line 81 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void AEAD_CCM_verify_service_indicator (const EVP_AEAD_CTX * ctx)
```
Defined at line 84 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void OPENSSL_init_cpuid ()
```
Defined at line 86 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void EC_KEY_keygen_verify_service_indicator (const EC_KEY * eckey)
```
Defined at line 87 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void HMAC_verify_service_indicator (const EVP_MD * evp_md)
```
Defined at line 102 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
void TLSKDF_verify_service_indicator (const EVP_MD * dgst)
```
Defined at line 105 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../service_indicator/internal.h
```
template <typename Traits>
```
```
void crypto_md32_final (typename Traits::HashContext * ctx)
```
crypto_md32_final incorporates the partial block and trailing length into the

digest state in `ctx`. The trailing length is encoded in little-endian if

`is_big_endian` is zero and big-endian otherwise. `data` must be a buffer of

length `block_size` with the first `*num` bytes containing a partial block.

`Nh` and `Nl` contain the total number of bits processed. On return, this

function clears the partial block in `data` and

`*num`.

This function does not serialize `h` into a final digest. This is the

responsibility of the caller.

Defined at line 133 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../digest/md32_common.h
```
void OPENSSL_reset_malloc_counter_for_testing ()
```
Defined at line 172 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void OPENSSL_disable_malloc_failures_for_testing ()
```
Defined at line 173 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void OPENSSL_enable_malloc_failures_for_testing ()
```
Defined at line 174 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int buffers_alias (const void * a, size_t a_bytes, const void * b, size_t b_bytes)
```
buffers_alias returns one if `a` and `b` alias and zero otherwise.

Defined at line 187 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
template <typename T>
```
```
int spans_alias (Span<const T> a, Span<const T> b)
```
spans_alias returns one if `a` and `b` alias, and zero otherwise.

Defined at line 200 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void * align_pointer (void * ptr, size_t alignment)
```
align_pointer returns `ptr`, advanced to `alignment`. `alignment` must be a

power of two, and `ptr` must have at least `alignment - 1` bytes of scratch

space.

Defined at line 208 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t value_barrier_w (crypto_word_t a)
```
value_barrier_w returns `a`, but prevents GCC and Clang from reasoning about

the returned value. This is used to mitigate compilers undoing constant-time

code, until we can express our requirements directly in the language.

Note the compiler is aware that `value_barrier_w` has no side effects and

always has the same output for a given input. This allows it to eliminate

dead code, move computations across loops, and vectorize.

Defined at line 266 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t value_barrier_u32 (uint32_t a)
```
value_barrier_u32 behaves like `value_barrier_w` but takes a `uint32_t`.

Defined at line 274 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t value_barrier_u64 (uint64_t a)
```
value_barrier_u64 behaves like `value_barrier_w` but takes a `uint64_t`.

Defined at line 282 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_msb_w (crypto_word_t a)
```
constant_time_msb_w returns the given value with the MSB copied to all the

other bits.

Defined at line 294 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_lt_w (crypto_word_t a, crypto_word_t b)
```
constant_time_lt_w returns 0xff..f if a

<

b and 0 otherwise.

Defined at line 299 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint8_t constant_time_lt_8 (crypto_word_t a, crypto_word_t b)
```
constant_time_lt_8 acts like `constant_time_lt_w` but returns an 8-bit

mask.

Defined at line 335 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_ge_w (crypto_word_t a, crypto_word_t b)
```
constant_time_ge_w returns 0xff..f if a >= b and 0 otherwise.

Defined at line 340 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint8_t constant_time_ge_8 (crypto_word_t a, crypto_word_t b)
```
constant_time_ge_8 acts like `constant_time_ge_w` but returns an 8-bit

mask.

Defined at line 346 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
UniquePtr<EC_KEY> UpRef (EC_KEY * v)
```
Defined at line 350 of file ../../third_party/boringssl/src/include/openssl/ec_key.h
```
UniquePtr<EC_KEY> UpRef (const UniquePtr<EC_KEY> & ptr)
```
Defined at line 350 of file ../../third_party/boringssl/src/include/openssl/ec_key.h
```
crypto_word_t constant_time_is_zero_w (crypto_word_t a)
```
constant_time_is_zero returns 0xff..f if a == 0 and 0 otherwise.

Defined at line 351 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint8_t constant_time_is_zero_8 (crypto_word_t a)
```
constant_time_is_zero_8 acts like `constant_time_is_zero_w` but returns an

8-bit mask.

Defined at line 367 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_eq_w (crypto_word_t a, crypto_word_t b)
```
constant_time_eq_w returns 0xff..f if a == b and 0 otherwise.

Defined at line 372 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
UniquePtr<DSA> UpRef (DSA * v)
```
Defined at line 373 of file ../../third_party/boringssl/src/include/openssl/dsa.h
```
UniquePtr<DSA> UpRef (const UniquePtr<DSA> & ptr)
```
Defined at line 373 of file ../../third_party/boringssl/src/include/openssl/dsa.h
```
uint8_t constant_time_eq_8 (crypto_word_t a, crypto_word_t b)
```
constant_time_eq_8 acts like `constant_time_eq_w` but returns an 8-bit

mask.

Defined at line 378 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_eq_int (int a, int b)
```
constant_time_eq_int acts like `constant_time_eq_w` but works on int

values.

Defined at line 384 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint8_t constant_time_eq_int_8 (int a, int b)
```
constant_time_eq_int_8 acts like `constant_time_eq_int` but returns an 8-bit

mask.

Defined at line 390 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_select_w (crypto_word_t mask, crypto_word_t a, crypto_word_t b)
```
constant_time_select_w returns (mask

&

a) | (~mask

&

b). When `mask` is all

1s or all 0s (as returned by the methods above), the select methods return

either `a` (if `mask` is nonzero) or `b` (if `mask` is zero).

Defined at line 397 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint8_t constant_time_select_8 (crypto_word_t mask, uint8_t a, uint8_t b)
```
constant_time_select_8 acts like `constant_time_select` but operates on

8-bit values.

Defined at line 410 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int constant_time_select_int (crypto_word_t mask, int a, int b)
```
constant_time_select_int acts like `constant_time_select` but operates on

ints.

Defined at line 424 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t constant_time_select_32 (crypto_word_t mask, uint32_t a, uint32_t b)
```
constant_time_select_32 acts like `constant_time_select` but operates on

32-bit values.

Defined at line 431 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void constant_time_conditional_memcpy (void * dst, const void * src, const size_t n, const crypto_word_t mask)
```
constant_time_conditional_memcpy copies `n` bytes from `src` to `dst` if

`mask` is 0xff..ff and does nothing if `mask` is 0. The `n`-byte memory

ranges at `dst` and `src` must not overlap, as when calling `memcpy`.

Defined at line 440 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void constant_time_conditional_memxor (void * dst, const void * src, size_t n, const crypto_word_t mask)
```
constant_time_conditional_memxor xors `n` bytes from `src` to `dst` if

`mask` is 0xff..ff and does nothing if `mask` is 0. The `n`-byte memory

ranges at `dst` and `src` must not overlap, as when calling `memcpy`.

Defined at line 454 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t constant_time_declassify_w (crypto_word_t v)
```
Defined at line 508 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int constant_time_declassify_int (int v)
```
Defined at line 524 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
UniquePtr<RSA> UpRef (RSA * v)
```
Defined at line 835 of file ../../third_party/boringssl/src/include/openssl/rsa.h
```
UniquePtr<RSA> UpRef (const UniquePtr<RSA> & ptr)
```
Defined at line 835 of file ../../third_party/boringssl/src/include/openssl/rsa.h
```
uint32_t CRYPTO_load_u32_le (const void * in)
```
Defined at line 924 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_set_ex_data (CRYPTO_EX_DATA * ad, int index, void * val)
```
CRYPTO_set_ex_data sets an extra data pointer on a given object. Each class

of object should provide a wrapper function.
```
void * CRYPTO_get_ex_data (const CRYPTO_EX_DATA * ad, int index)
```
CRYPTO_get_ex_data returns an extra data pointer for a given object, or NULL

if no such index exists. Each class of object should provide a wrapper

function.
```
void CRYPTO_new_ex_data (CRYPTO_EX_DATA * ad)
```
CRYPTO_new_ex_data initialises a newly allocated `CRYPTO_EX_DATA`.

void CRYPTO_free_ex_data (ExDataClass * ex_data_class, CRYPTO_EX_DATA * ad)

CRYPTO_free_ex_data frees `ad`, which is an object of the given class.

```
const void * OPENSSL_memchr (const void * s, int c, size_t n)
```
C++ defines `memchr` as a const-correct overload.

Defined at line 848 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void * OPENSSL_memchr (void * s, int c, size_t n)
```
Defined at line 856 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int OPENSSL_memcmp (const void * s1, const void * s2, size_t n)
```
Defined at line 864 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void * OPENSSL_memcpy (void * dst, const void * src, size_t n)
```
Defined at line 872 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void * OPENSSL_memmove (void * dst, const void * src, size_t n)
```
Defined at line 880 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void * OPENSSL_memset (void * dst, int c, size_t n)
```
Defined at line 888 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint16_t CRYPTO_load_u16_le (const void * in)
```
Loads and stores.

The following functions load and store sized integers with the specified

endianness. They use `memcpy`, and so avoid alignment or strict aliasing

requirements on the input and output pointers.

Defined at line 903 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u16_le (void * out, uint16_t v)
```
Defined at line 909 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint16_t CRYPTO_load_u16_be (const void * in)
```
Defined at line 913 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u16_be (void * out, uint16_t v)
```
Defined at line 919 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u32_le (void * out, uint32_t v)
```
Defined at line 930 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t CRYPTO_load_u32_be (const void * in)
```
Defined at line 934 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u32_be (void * out, uint32_t v)
```
Defined at line 940 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_load_u64_le (const void * in)
```
Defined at line 945 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u64_le (void * out, uint64_t v)
```
Defined at line 951 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_load_u64_be (const void * ptr)
```
Defined at line 955 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_u64_be (void * out, uint64_t v)
```
Defined at line 961 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t CRYPTO_load_word_le (const void * in)
```
Defined at line 966 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void CRYPTO_store_word_le (void * out, crypto_word_t v)
```
Defined at line 972 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
crypto_word_t CRYPTO_load_word_be (const void * in)
```
Defined at line 976 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t CRYPTO_rotl_u32 (uint32_t value, int shift)
```
Bit rotation functions.

Note these functions use `(-shift)

&

31`, etc., because shifting by the bit

width is undefined. Both Clang and GCC recognize this pattern as a rotation,

but MSVC does not. Instead, we call MSVC's built-in functions.

Defined at line 995 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint32_t CRYPTO_rotr_u32 (uint32_t value, int shift)
```
Defined at line 1003 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_rotl_u64 (uint64_t value, int shift)
```
Defined at line 1011 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_rotr_u64 (uint64_t value, int shift)
```
Defined at line 1019 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void boringssl_ensure_rsa_sign_self_test ()
```
Outside of FIPS mode, the lazy tests are no-ops.

Defined at line 1066 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void boringssl_ensure_rsa_verify_self_test ()
```
Defined at line 1067 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void boringssl_ensure_ecc_self_test ()
```
Defined at line 1068 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void boringssl_ensure_ffdh_self_test ()
```
Defined at line 1069 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
void boringssl_fips_inc_counter (enum fips_counter_t counter)
```
Defined at line 1100 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int boringssl_fips_break_test (const char * test)
```
Defined at line 1109 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_intel_cpu ()
```
See Intel manual, volume 2A, table 3-11.

Defined at line 1150 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_PCLMUL_capable ()
```
See Intel manual, volume 2A, table 3-10.

Defined at line 1157 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_SSSE3_capable ()
```
Defined at line 1165 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_SSE4_1_capable ()
```
Defined at line 1173 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_MOVBE_capable ()
```
Defined at line 1181 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_AESNI_capable ()
```
Defined at line 1189 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_AVX_capable ()
```
We intentionally avoid defining a `CRYPTO_is_XSAVE_capable` function. See

`CRYPTO_cpu_perf_is_like_silvermont`.

Defined at line 1200 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_RDRAND_capable ()
```
Defined at line 1208 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_BMI1_capable ()
```
See Intel manual, volume 2A, table 3-8.

Defined at line 1217 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_AVX2_capable ()
```
Defined at line 1225 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_BMI2_capable ()
```
Defined at line 1233 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_ADX_capable ()
```
Defined at line 1241 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_x86_SHA_capable ()
```
SHA-1 and SHA-256 are defined as a single extension.

Defined at line 1250 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_cpu_perf_is_like_silvermont ()
```
CRYPTO_cpu_perf_is_like_silvermont returns one if, based on a heuristic, the

CPU has Silvermont-like performance characteristics. It is often faster to

run different codepaths on these CPUs than the available instructions would

otherwise select. See chacha-x86_64.pl.

Bonnell, Silvermont's predecessor in the Atom lineup, will also be matched by

this. Goldmont (Silvermont's successor in the Atom lineup) added XSAVE so it

isn't matched by this. Various sources indicate AMD first implemented MOVBE

and XSAVE at the same time in Jaguar, so it seems like AMD chips will not be

matched by this. That seems to be the case for other x86(-64) CPUs.

Defined at line 1268 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_AVX512BW_capable ()
```
Defined at line 1282 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_AVX512VL_capable ()
```
Defined at line 1290 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_cpu_avoid_zmm_registers ()
```
CRYPTO_cpu_avoid_zmm_registers returns 1 if zmm registers (512-bit vectors)

should not be used even if the CPU supports them.

Note that this reuses the bit for the removed MPX feature.

Defined at line 1302 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_VAES_capable ()
```
Defined at line 1306 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_is_VPCLMULQDQ_capable ()
```
Defined at line 1314 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int CRYPTO_fuzzer_mode_enabled ()
```
Defined at line 1477 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned int CRYPTO_addc_impl (unsigned int x, unsigned int y, unsigned int carry, unsigned int * out_carry)

Defined at line 1490 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned long CRYPTO_addc_impl (unsigned long x, unsigned long y, unsigned long carry, unsigned long * out_carry)

Defined at line 1496 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned long long CRYPTO_addc_impl (unsigned long long x, unsigned long long y, unsigned long long carry, unsigned long long * out_carry)

Defined at line 1502 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

```
uint32_t CRYPTO_addc_u32 (uint32_t x, uint32_t y, uint32_t carry, uint32_t * out_carry)
```
Defined at line 1509 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_addc_u64 (uint64_t x, uint64_t y, uint64_t carry, uint64_t * out_carry)
```
Defined at line 1514 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned int CRYPTO_subc_impl (unsigned int x, unsigned int y, unsigned int borrow, unsigned int * out_borrow)

Defined at line 1564 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned long CRYPTO_subc_impl (unsigned long x, unsigned long y, unsigned long borrow, unsigned long * out_borrow)

Defined at line 1570 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

unsigned long long CRYPTO_subc_impl (unsigned long long x, unsigned long long y, unsigned long long borrow, unsigned long long * out_borrow)

Defined at line 1576 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h

```
uint32_t CRYPTO_subc_u32 (uint32_t x, uint32_t y, uint32_t borrow, uint32_t * out_borrow)
```
Defined at line 1583 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
uint64_t CRYPTO_subc_u64 (uint64_t x, uint64_t y, uint64_t borrow, uint64_t * out_borrow)
```
Defined at line 1588 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
template <typename Public>
```
```
typename Public::ImplType * FromOpaque (Public * p)
```
Defined at line 1701 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
template <typename Public>
```
```
const typename Public::ImplType * FromOpaque (const Public * p)
```
Defined at line 1706 of file ../../third_party/boringssl/src/crypto/fipsmodule/sha/../../internal.h
```
int boringssl_self_test_sha256 ()
```
boringssl_self_test_sha256 performs a SHA-256 KAT.
```
int boringssl_self_test_sha512 ()
```
boringssl_self_test_sha512 performs a SHA-512 KAT.
```
int boringssl_self_test_hmac_sha256 ()
```
boringssl_self_test_hmac_sha256 performs an HMAC-SHA-256 KAT.
```
int boringssl_self_test_mlkem ()
```
boringssl_self_test_mlkem performs the ML-KEM KATs.
```
int boringssl_self_test_mldsa ()
```
boringssl_self_test_mldsa performs the ML-DSA KATs.
```
int boringssl_self_test_slhdsa ()
```
boringssl_self_test_slhdsa performs the SLH-DSA KATs.
```
uint32_t OPENSSL_get_ia32cap (int idx)
```
OPENSSL_get_ia32cap initializes the library if needed and returns the `idx`th

entry of `OPENSSL_ia32cap_P`. It is marked as a const function so duplicate

calls can be merged by the compiler, at least when indices match.
```
void OPENSSL_adjust_ia32cap (uint32_t[4] cap, const char * env)
```
OPENSSL_adjust_ia32cap adjusts `cap`, which should contain

`OPENSSL_ia32cap_P`, based on the environment variable value in `env`. This

function is exposed for unit tests.
```
int OPENSSL_vasprintf_internal (char ** str, const char * format, va_list args, int system_malloc)
```
OPENSSL_vasprintf_internal is just like `vasprintf(3)`. If `system_malloc` is

0, memory will be allocated with `OPENSSL_malloc` and must be freed with

`OPENSSL_free`. Otherwise the system `malloc` function is used and the memory

must be freed with the system `free` function.

Variables

uint32_t[4] OPENSSL_ia32cap_P