chore: sync with go1.20.12

See https://github.com/ooni/probe/issues/2556

This reverts CL 545356.

Reason for revert: 1.20 still supports Windows versions before
ProcessP...

RtlGenRandom is a semi-undocumented API, also known as
SystemFunction036, which we use to genera...

chore: prepare for merging from go1.20.11

chore: prepare for merging with go1.20.10

Part of https://github.com/ooni/probe/issues/2524

Part of https://github.com/ooni/probe/issues/2524

The newly added code was using internal/godebug, which we cannot use
because we're not in the st...

Add a new GODEBUG setting, tlsmaxrsasize, which allows controlling the
maximum RSA key size we w...

Extremely large RSA keys in certificate chains can cause a client/server
to expend significant C...

Part of https://github.com/ooni/probe/issues/2503

chore: update to go1.20.6

Part of https://github.com/ooni/probe/issues/2503

Conflicts:
ecdsa/ecdsa.go
ecdsa/ecdsa_test.go
x509/verify_test.go

See https://github.com/ooni/probe/issues/2503

Due to the semantics of roots, a root store may contain two valid roots
that have the same subje...

Before, if a hash was exactly 66 bytes long, we weren't truncating it
for use with P-521, becaus...

chore: update to go1.20.5

Conflicts:
rsa/rsa.go

Part of https://github.com/ooni/probe/issues/2417

This pull request updates oocrypto to use go1.20.4. After this pull request is merged, one must ...

Updates #58803
Fixes #58927

Change-Id: I097938ff61dae2b65214f8d0126d68de63525f5b
Reviewed-on: h...

When server and client have mismatch in curve preference, the server will
send HelloRetryRequest...

Casting to a *uintptr is not ok if there isn't at least 8 bytes of
data backing that pointer (on...

Convert TestUnknownAuthorityError to use subtests, avoiding continuing
the test after an unrecov...

On Windows, replace tests which rely on a root that expired last year.
On Darwin fix an test whi...

Updates #58789.
Fixes #58793.

Change-Id: I91cdd20c6d4f05baaacd6a38717aa7bed6682573
Reviewed-on:...

I had forgotten, which caused amd64 allocations to go back up
significantly. Added an allocation...

Return an explicit error when PrivateKey.ECDH is called with a PublicKey
which uses a different ...

Unlike the rest of nistec, the P-256 assembly doesn't use complete
addition formulas, meaning th...

feat: update to go1.19.6

Conflicts:
tls/boring_test.go
x509/boring_test.go

Message marshalling makes use of BytesOrPanic a lot, under the
assumption that it will never pan...

Message marshalling makes use of BytesOrPanic a lot, under the
assumption that it will never pan...

Change-Id: Ic215a90d1e1daa5805dbab1dc56480281e53b341
Reviewed-on: https://go-review.googlesource...

In particular, CheckSignatureFrom just can't check the path length
limit, because it might be en...

Generating 8192 bit keys times out on builders relatively frequently. We
just need something tha...

chore: merge changes from go1.19.5

See https://github.com/ooni/probe/issues/2273

Conflicts:
x509/internal/macos/corefoundation.go
x509/internal/macos/corefoundation.s
x509/in...

On macOS return the error code from SecTrustEvaluateWithError, and use
it to create typed errors...

Change-Id: Idcea184a5b0c205efd3c91c60b5d954424f37679
Reviewed-on: https://go-review.googlesource...

Update to go 1.19.4

With these scripts, we have greater confidence in the process.

The dev branch is at go1.19.4

Conflicts:
README.md

chore: update to go1.19.4

Conflicts:
tls/boring_test.go
x509/boring.go
x509/boring_test.go
x509/sec1.go
x509/verify_t...

This branch does not exist anymore.

Part of https://github.com/ooni/probe/issues/2273

chore: merge stable into main

Similar to https://github.com/ooni/oohttp/pull/35

Part of ht...

Here's the actual diff:

```diff
diff --git a/go.mod b/go.mod
index f05467ac6b..8fb70ec083 10064...

To this end, the diff between this branch and stable should be
zero for *.go files in this repos...

chore: update to go1.18.9

Conflicts:
x509/verify_test.go
x509/x509.go
x509/x509_test.go

Fixes #57556
Updates #54936

Change-Id: I3fb4331c2b1b6adafbac3e76eaf66c79cd5ef56f
Reviewed-on: h...

Add the text from dev.boringcrypto's README making clear what
this code is and that it is unsupp...

On macOS return the error code from SecTrustEvaluateWithError, and use
it to create typed errors...

The comment copy pasted from the permuteInitialBlock and should be fixed.

Change-Id: I101f1dece...

Include hint from isValid, as well as CheckSignatureFrom.

Change-Id: I408f73fc5f12572f1937da50b...

CL 353849 removed validation of signature parameters being passed to
Verify which led to two dis...

These should be deprecated, but per go.dev/wiki/Deprecated,
that should only happen two releases...

These should be marked deprecated, but that needs a
(likely quick) proposal review.

The proposa...

VerifyASN1 became directly reachable without encoding/decoding in
CL 353849, so it's now possibl...

crypto/sha512:

name old time/op new time/op delta
Hash8Bytes/New...

With this change, we are down to 1.2x the running time of the previous
variable time implementat...

Ignoring custom curves, this makes the whole package constant-time.
There is a slight loss in pe...

This will let us reuse it in crypto/ecdsa for the NIST scalar fields.

The main change in API is...

This is missing a test for Ed25519ph with context, since the RFC doesn't
provide one.

Fixes #31...

Several operations emulate instructions available on power9. Use
the GOPPC64_power9 macro provid...

With a small tweak and the help of the inliner, we preallocate enough
nat backing space to do RS...

This is faster than the current code because computing RR involves
one more shiftIn and using it...

This change adds some private fields to PrecomputedValues.

If applications were for some reason...

I have never encountered multi-prime RSA in the wild. A GitHub-wide
search reveals exactly two e...

Infamously, big.Int does not provide constant-time arithmetic, making
its use in cryptographic c...

Fixes #56088
Updates #52221

Change-Id: Id2f806a116100a160be7daafc3e4c0be2acdd6a9
Reviewed-on: h...

Adds a method which allows users to set a fallback certificate pool for
usage during verificatio...

Fixes #48152

Change-Id: I503f088edeb5574fd5eb5905bff7c3c23b2bc8fc
GitHub-Last-Rev: 2b0e982f3f6b...

Change-Id: I69065f8adf101fdb28682c55997f503013a50e29
Reviewed-on: https://go-review.googlesource...

While at it, drop P-224 benchmarks. Nobody cares about P-224.

Change-Id: I31db6fedde6026deff36d...

Generating 8192 bit keys times out on builders relatively frequently. We
just need something tha...