crypto/internal/fips/subtle: provide XORBytes

This is needed from inside the module, and we generally don't want to
import the crypto tree from it.

For golang#69536

Change-Id: I69e91e4df89ecac0016c671ccd28e733a7131533

Author: FiloSottile

src/crypto/internal/fips/subtle/xor.go

@@ -0,0 +1,21 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package subtle
+
+// XORBytes sets dst[i] = x[i] ^ y[i] for all i < n = min(len(x), len(y)),
+// returning n, the number of bytes written to dst.
+// If dst does not have length at least n,
+// XORBytes panics without writing anything to dst.
+func XORBytes(dst, x, y []byte) int {
+	n := min(len(x), len(y))
+	if n == 0 {
+		return 0
+	}
+	if n > len(dst) {
+		panic("subtle.XORBytes: dst too short")
+	}
+	xorBytes(&dst[0], &x[0], &y[0], n) // arch-specific
+	return n
+}

src/crypto/subtle/xor_amd64.go renamed to src/crypto/internal/fips/subtle/xor_amd64.go

@@ -6,8 +6,8 @@ package subtle_test
 
 import (
 	"bytes"
+	. "crypto/internal/fips/subtle"
 	"crypto/rand"
-	. "crypto/subtle"
 	"fmt"
 	"io"
 	"testing"

src/crypto/subtle/xor_amd64.s renamed to src/crypto/internal/fips/subtle/xor_amd64.s

@@ -4,18 +4,12 @@
 
 package subtle
 
+import "crypto/internal/fips/subtle"
+
 // XORBytes sets dst[i] = x[i] ^ y[i] for all i < n = min(len(x), len(y)),
 // returning n, the number of bytes written to dst.
 // If dst does not have length at least n,
 // XORBytes panics without writing anything to dst.
 func XORBytes(dst, x, y []byte) int {
-	n := min(len(x), len(y))
-	if n == 0 {
-		return 0
-	}
-	if n > len(dst) {
-		panic("subtle.XORBytes: dst too short")
-	}
-	xorBytes(&dst[0], &x[0], &y[0], n) // arch-specific
-	return n
+	return subtle.XORBytes(dst, x, y)
 }

src/crypto/subtle/xor_arm64.go renamed to src/crypto/internal/fips/subtle/xor_arm64.go

@@ -449,6 +449,7 @@ var depsRules = `
 	# backwards compatibility with older versions of the module.
 	STR, crypto/internal/impl
 	< crypto/internal/fips
+	< crypto/internal/fips/subtle
 	< crypto/internal/fips/sha256
 	< crypto/internal/fips/sha512
 	< crypto/internal/fips/hmac