Merge branch 'golang-crypto-upstream' into merged-main

This merge has been interesting. It took quite some time and I
realized that I could further simplify the codebase by removing
all the assembly implementations we don't need.

Part of ooni/probe#2211.

README.md

@@ -136,8 +136,6 @@ I have not find a way for getting results for all architectures)
 - [ ] double check whether we need to add more checks to the list above (you
 can get a list of packages using `tree -d`)
 
-- [ ] manually import the latest `src/internal/godebug` from upstream
-
 - [ ] ensure that `stdlibwrapper.go` correctly fills `tls.ConnectionState`
 in the `ConnStdlib.ConnectionState` method
 

aes/aes_gcm.go

@@ -40,13 +40,6 @@ const (
 
 var errOpen = errors.New("cipher: message authentication failed")
 
-// aesCipherGCM implements crypto/cipher.gcmAble so that crypto/cipher.NewGCM
-// will use the optimised implementation in this file when possible. Instances
-// of this type only exist when hasGCMAsm returns true.
-type aesCipherGCM struct {
-	aesCipherAsm
-}
-
 // Assert that aesCipherGCM implements the gcmAble interface.
 var _ gcmAble = (*aesCipherGCM)(nil)
 

aes/cipher_asm.go

@@ -32,6 +32,14 @@ type aesCipherAsm struct {
 var supportsAES = cpu.X86.HasAES || cpuarm64.HasAES()
 var supportsGFMUL = cpu.X86.HasPCLMULQDQ || cpuarm64.HasPMULL()
 
+// aesCipherGCM implements crypto/cipher.gcmAble so that crypto/cipher.NewGCM
+// will use the optimised implementation in aes_gcm.go when possible.
+// Instances of this type only exist when hasGCMAsm returns true. Likewise,
+// the gcmAble implementation is in aes_gcm.go.
+type aesCipherGCM struct {
+	aesCipherAsm
+}
+
 func newCipher(key []byte) (cipher.Block, error) {
 	if !supportsAES {
 		return newCipherGeneric(key)
@@ -46,6 +54,8 @@ func newCipher(key []byte) (cipher.Block, error) {
 		rounds = 12
 	case 256 / 8:
 		rounds = 14
+	default:
+		return nil, KeySizeError(len(key))
 	}
 
 	expandKeyAsm(rounds, &key[0], &c.enc[0], &c.dec[0])

aes/cipher_generic.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !s390x && !ppc64le && !arm64
+//go:build !amd64 && !arm64
 
 package aes